@pidgeon-ai/issuer 0.2.0 → 0.4.1

package/dist/{chunk-BXZ2EI2Y.js → chunk-IKGE6SNR.js}

@@ -1,6 +1,11 @@
 #!/usr/bin/env node
 
 // src/directory.ts
+function onePerAddress(agents) {
+  const count = /* @__PURE__ */ new Map();
+  for (const agent of agents) count.set(agent.address, (count.get(agent.address) ?? 0) + 1);
+  return agents.filter((agent) => count.get(agent.address) === 1);
+}
 function staticDirectory(agents) {
   const list = agents.map((agent) => ({ ...agent, address: agent.address.toLowerCase() }));
   return {
@@ -25,6 +30,104 @@ function cachedDirectory(inner, seconds = 60, now = () => Date.now()) {
   };
 }
 
+// src/rate-limit.ts
+async function withBackoff(attempt, now = () => Date.now(), sleep = (ms) => new Promise((done) => setTimeout(done, ms))) {
+  for (let tries = 0; ; tries++) {
+    const response = await attempt();
+    if (response.status !== 429 || tries >= 2) return response;
+    const reset = Number(
+      response.headers.get("x-ratelimit-reset") ?? response.headers.get("x-rate-limit-reset")
+    );
+    const retryAfter = Number(response.headers.get("retry-after"));
+    const wait = Number.isFinite(reset) && reset > 0 ? reset * 1e3 - now() : Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1e3 : 1e3;
+    await sleep(Math.min(2e3, Math.max(250, wait)));
+  }
+}
+
+// src/auth0.ts
+var PER_PAGE = 100;
+function auth0Directory(options) {
+  const base = `https://${options.tenant.replace(/^https:\/\//, "").replace(/\/$/, "")}`;
+  const domain = options.domain.toLowerCase();
+  const fetcher = options.fetch ?? fetch;
+  const now = options.now ?? (() => Date.now());
+  let token = null;
+  async function accessToken() {
+    if (token && token.until > now()) return token.value;
+    const response = await fetcher(`${base}/oauth/token`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "client_credentials",
+        client_id: options.clientId,
+        client_secret: options.clientSecret,
+        audience: `${base}/api/v2/`
+      })
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok || !body.access_token) {
+      throw new Error(
+        `Auth0 refused the issuer's application ${options.clientId} (${response.status}).`
+      );
+    }
+    token = { value: body.access_token, until: now() + ((body.expires_in ?? 120) - 60) * 1e3 };
+    return token.value;
+  }
+  async function management(path) {
+    const bearer = await accessToken();
+    const response = await withBackoff(
+      () => fetcher(`${base}/api/v2${path}`, {
+        headers: { authorization: `Bearer ${bearer}`, accept: "application/json" }
+      }),
+      now
+    );
+    if (response.status === 404) return null;
+    if (!response.ok) throw new Error(`Auth0 answered ${response.status} for ${path}.`);
+    return await response.json();
+  }
+  function agentOf(client) {
+    if (client.app_type !== "non_interactive") return null;
+    const metadata = client.client_metadata ?? {};
+    if (metadata.pidgeon_disabled?.trim().toLowerCase() === "true") return null;
+    const key = metadata.pidgeon_key?.trim();
+    if (!key || Buffer.from(key, "base64url").length !== 32) return null;
+    const address = metadata.pidgeon_address?.trim().toLowerCase();
+    if (!address?.endsWith(`@${domain}`)) return null;
+    return {
+      sub: client.client_id,
+      address,
+      kind: metadata.pidgeon_kind?.trim() === "service" ? "service" : "agent",
+      key,
+      groups: (metadata.pidgeon_groups ?? "").split(",").map((group) => group.trim()).filter(Boolean),
+      // An age Auth0 does not give is treated as new: the card says `new`, never older than it is.
+      createdAt: new Date(client.created_at ? Date.parse(client.created_at) : now()).toISOString()
+    };
+  }
+  async function all() {
+    const agents = [];
+    for (let page2 = 0; ; page2++) {
+      const body = await management(
+        `/clients?app_type=non_interactive&per_page=${PER_PAGE}&page=${page2}&include_totals=true`
+      );
+      const clients = body?.clients ?? [];
+      for (const client of clients) {
+        const agent = agentOf(client);
+        if (agent) agents.push(agent);
+      }
+      if (clients.length < PER_PAGE || (page2 + 1) * PER_PAGE >= (body?.total ?? 0)) break;
+    }
+    return agents;
+  }
+  return {
+    agents: async () => onePerAddress(await all()),
+    async agent(sub) {
+      const client = await management(`/clients/${encodeURIComponent(sub)}`);
+      const agent = client ? agentOf(client) : null;
+      return agent?.sub === sub ? agent : null;
+    }
+  };
+}
+
 // src/keycloak.ts
 var SERVICE_ACCOUNT_PREFIX = "service-account-";
 var ATTRIBUTES = { key: "pidgeon.key", address: "pidgeon.address", kind: "pidgeon.kind" };
@@ -106,7 +209,7 @@ function keycloakDirectory(options) {
       const clients = await admin("/clients?first=0&max=1000") ?? [];
       const candidates = clients.filter((client) => keyOf(client) !== null);
       const agents = await Promise.all(candidates.map(agentOf));
-      return agents.filter((agent) => agent !== null);
+      return onePerAddress(agents.filter((agent) => agent !== null));
     },
     /**
      * The user's record does not name its client (only a realm export
@@ -128,229 +231,129 @@ function keycloakDirectory(options) {
   };
 }
 
-// src/person.ts
-import {
-  createCipheriv,
-  createDecipheriv,
-  createHash,
-  createPublicKey,
-  randomBytes,
-  timingSafeEqual,
-  verify
-} from "crypto";
-var MIN_SECRET = 32;
-var FLOW_COOKIE = "pidgeon_issuer_flow";
-var CODE_SECONDS = 60;
-var FLOW_SECONDS = 600;
-var SKEW = 60;
-var UPSTREAM_ALGS = ["RS256", "ES256", "EdDSA"];
-function checkSecret(secret) {
-  if (!secret || secret.length < MIN_SECRET) {
-    throw new Error(
-      `A person's sign-in needs PIDGEON_ISSUER_SECRET, ${MIN_SECRET} characters or more. It seals the sign-in in progress and the code; there is no default.`
+// src/okta.ts
+import { createPrivateKey, randomUUID, sign } from "crypto";
+var OKTA_SCOPE = "okta.apps.read";
+function oktaDirectory(options) {
+  const org = options.org.replace(/\/$/, "");
+  const domain = options.domain.toLowerCase();
+  const fetcher = options.fetch ?? fetch;
+  const now = options.now ?? (() => Date.now());
+  const privateKey = typeof options.privateKey === "string" ? createPrivateKey(options.privateKey) : options.privateKey;
+  const alg = privateKey.asymmetricKeyType === "rsa" ? "RS256" : privateKey.asymmetricKeyType === "ec" && privateKey.asymmetricKeyDetails?.namedCurve === "prime256v1" ? "ES256" : null;
+  if (!alg) throw new Error("Okta's client assertion is signed with an RSA or P-256 key.");
+  let token = null;
+  function assertion(audience) {
+    const at = Math.floor(now() / 1e3);
+    const b64 = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+    const input = `${b64({ alg, typ: "JWT", ...options.keyId ? { kid: options.keyId } : {} })}.${b64(
+      {
+        iss: options.clientId,
+        sub: options.clientId,
+        aud: audience,
+        iat: at,
+        exp: at + 300,
+        jti: randomUUID()
+      }
+    )}`;
+    const signature = sign(
+      "sha256",
+      Buffer.from(input),
+      alg === "ES256" ? { key: privateKey, dsaEncoding: "ieee-p1363" } : privateKey
     );
+    return `${input}.${signature.toString("base64url")}`;
   }
-  return secret;
-}
-var b64url = (bytes) => Buffer.from(bytes).toString("base64url");
-function sealKey(secret, purpose) {
-  return createHash("sha256").update(`pidgeon issuer seal\0${purpose}\0${secret}`).digest();
-}
-function seal(secret, purpose, value) {
-  const iv = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", sealKey(secret, purpose), iv);
-  cipher.setAAD(Buffer.from(purpose));
-  const body = Buffer.concat([cipher.update(JSON.stringify(value), "utf8"), cipher.final()]);
-  return b64url(Buffer.concat([iv, body, cipher.getAuthTag()]));
-}
-function unseal(secret, purpose, token) {
-  if (!token) return null;
-  try {
-    const raw = Buffer.from(token, "base64url");
-    if (raw.length < 29) return null;
-    const decipher = createDecipheriv("aes-256-gcm", sealKey(secret, purpose), raw.subarray(0, 12));
-    decipher.setAAD(Buffer.from(purpose));
-    decipher.setAuthTag(raw.subarray(raw.length - 16));
-    const text2 = Buffer.concat([
-      decipher.update(raw.subarray(12, raw.length - 16)),
-      decipher.final()
-    ]).toString("utf8");
-    return JSON.parse(text2);
-  } catch {
-    return null;
-  }
-}
-function pkceChallenge(verifier) {
-  return b64url(createHash("sha256").update(verifier).digest());
-}
-function pkceHolds(verifier, challenge) {
-  const a = Buffer.from(pkceChallenge(verifier));
-  const b = Buffer.from(challenge);
-  return a.length === b.length && timingSafeEqual(a, b);
-}
-function cookieOf(request, name) {
-  for (const part of (request.headers.get("cookie") ?? "").split(";")) {
-    const eq = part.indexOf("=");
-    if (eq > 0 && part.slice(0, eq).trim() === name) {
-      return decodeURIComponent(part.slice(eq + 1).trim());
-    }
-  }
-  return null;
-}
-var ProviderRefused = class extends Error {
-};
-function provider(options, fetcher, now) {
-  const issuer = options.issuer.replace(/\/$/, "");
-  let configuration = null;
-  let keys = null;
-  function discover() {
-    if (!configuration || configuration.at <= now() - 36e5) {
-      const url = options.discoveryUrl ?? `${issuer}/.well-known/openid-configuration`;
-      const value = (async () => {
-        const response = await fetcher(url, { headers: { accept: "application/json" } });
-        if (!response.ok) throw new Error(`${url} answered ${response.status}.`);
-        const body = await response.json();
-        if (body.issuer?.replace(/\/$/, "") !== issuer) {
-          throw new Error(`${url} names the issuer ${body.issuer}, not ${issuer}.`);
-        }
-        return body;
-      })();
-      configuration = { at: now(), value };
-      value.catch(() => {
-        if (configuration?.value === value) configuration = null;
-      });
-    }
-    return configuration.value;
-  }
-  async function key(kid) {
-    const find = () => keys?.value.find((one) => (kid ? one.kid === kid : true) && one.use !== "enc") ?? null;
-    const fresh = keys && keys.at > now() - 3e5;
-    if (fresh && find()) return find();
-    if (keys && keys.at > now() - 1e4) return null;
-    const response = await fetcher((await discover()).jwks_uri);
-    const body = await response.json().catch(() => ({}));
-    keys = { at: now(), value: Array.isArray(body.keys) ? body.keys : [] };
-    return find();
-  }
-  async function authorizeUrl(input) {
-    const url = new URL((await discover()).authorization_endpoint);
-    url.search = new URLSearchParams({
-      response_type: "code",
-      client_id: options.clientId,
-      redirect_uri: input.redirectUri,
-      scope: "openid email",
-      state: input.state,
-      nonce: input.nonce,
-      code_challenge: pkceChallenge(input.verifier),
-      code_challenge_method: "S256"
-    }).toString();
-    return url.toString();
-  }
-  async function redeem(input) {
-    const form = new URLSearchParams({
-      grant_type: "authorization_code",
-      code: input.code,
-      redirect_uri: input.redirectUri,
-      code_verifier: input.verifier
-    });
-    const headers = {
-      "content-type": "application/x-www-form-urlencoded",
-      accept: "application/json"
-    };
-    if (options.tokenAuth === "client_secret_post") {
-      form.set("client_id", options.clientId);
-      form.set("client_secret", options.clientSecret);
-    } else {
-      const pair = `${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`;
-      headers.authorization = `Basic ${Buffer.from(pair).toString("base64")}`;
-    }
-    const response = await fetcher((await discover()).token_endpoint, {
+  async function accessToken() {
+    if (token && token.until > now()) return token.value;
+    const endpoint = `${org}/oauth2/v1/token`;
+    const response = await fetcher(endpoint, {
       method: "POST",
-      headers,
-      body: form
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json"
+      },
+      body: new URLSearchParams({
+        grant_type: "client_credentials",
+        scope: OKTA_SCOPE,
+        client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+        client_assertion: assertion(endpoint)
+      })
     });
     const body = await response.json().catch(() => ({}));
-    if (!response.ok || typeof body.id_token !== "string") {
-      throw new ProviderRefused(
-        `The identity provider did not sign the person in (${body.error ?? response.status}).`
+    if (!response.ok || !body.access_token) {
+      throw new Error(
+        `Okta refused the issuer's app ${options.clientId} (${response.status}${body.error_description ? `: ${body.error_description}` : ""}).`
       );
     }
-    return check(body.id_token, input.nonce);
+    token = { value: body.access_token, until: now() + ((body.expires_in ?? 120) - 60) * 1e3 };
+    return token.value;
   }
-  async function check(token, nonce) {
-    const parts = token.split(".");
-    if (parts.length !== 3) throw new ProviderRefused("The provider sent no ID token.");
-    let header;
-    let claims;
-    try {
-      header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
-      claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-    } catch {
-      throw new ProviderRefused("The provider sent no ID token.");
-    }
-    if (!header.alg || !UPSTREAM_ALGS.includes(header.alg)) {
-      throw new ProviderRefused(`The provider's ID token is signed with ${header.alg}.`);
-    }
-    const jwk = await key(header.kid);
-    if (!jwk || !signatureHolds(header.alg, jwk, `${parts[0]}.${parts[1]}`, parts[2])) {
-      throw new ProviderRefused("The provider's ID token is not signed by its keys.");
-    }
-    const at = Math.floor(now() / 1e3);
-    if (typeof claims.iss !== "string" || claims.iss.replace(/\/$/, "") !== issuer) {
-      throw new ProviderRefused("The provider's ID token is from another issuer.");
-    }
-    const aud = claims.aud;
-    const audiences = Array.isArray(aud) ? aud : [aud];
-    if (!audiences.includes(options.clientId)) {
-      throw new ProviderRefused("The provider's ID token is for another client.");
-    }
-    if (audiences.length > 1 && claims.azp !== options.clientId) {
-      throw new ProviderRefused("The provider's ID token is for another client.");
-    }
-    if (typeof claims.exp !== "number" || claims.exp + SKEW <= at) {
-      throw new ProviderRefused("The provider's ID token has expired.");
-    }
-    if (typeof claims.iat === "number" && claims.iat > at + SKEW) {
-      throw new ProviderRefused("The provider's ID token is from the future.");
-    }
-    if (claims.nonce !== nonce) {
-      throw new ProviderRefused("The provider's ID token is for another sign-in.");
-    }
-    if (typeof claims.sub !== "string" || !claims.sub) {
-      throw new ProviderRefused("The provider's ID token names nobody.");
-    }
-    if (claims.email_verified !== true || typeof claims.email !== "string") {
-      throw new ProviderRefused("The identity provider has not verified this person\u2019s address.");
-    }
+  async function api(url) {
+    const bearer = await accessToken();
+    const response = await withBackoff(
+      () => fetcher(url, {
+        headers: { authorization: `Bearer ${bearer}`, accept: "application/json" }
+      }),
+      now
+    );
+    if (!response.ok && response.status !== 404) {
+      throw new Error(`Okta answered ${response.status} for ${new URL(url).pathname}.`);
+    }
+    return response;
+  }
+  function agentOf(app) {
+    if (app.status !== "ACTIVE") return null;
+    if (app.settings?.oauthClient?.application_type !== "service") return null;
+    const pidgeon = app.profile?.pidgeon;
+    const key = typeof pidgeon?.key === "string" ? pidgeon.key.trim() : "";
+    if (!key || Buffer.from(key, "base64url").length !== 32) return null;
+    const address = typeof pidgeon?.address === "string" ? pidgeon.address.trim().toLowerCase() : "";
+    if (!address.endsWith(`@${domain}`)) return null;
     return {
-      sub: claims.sub,
-      email: claims.email.trim().toLowerCase(),
-      authTime: typeof claims.auth_time === "number" ? claims.auth_time : at
+      sub: app.id,
+      address,
+      kind: pidgeon?.kind === "service" ? "service" : "agent",
+      key,
+      groups: Array.isArray(pidgeon?.groups) ? pidgeon.groups.filter((group) => typeof group === "string") : [],
+      createdAt: new Date(app.created ? Date.parse(app.created) : now()).toISOString()
     };
   }
-  return { authorizeUrl, redeem };
-}
-function signatureHolds(alg, jwk, input, signature) {
-  try {
-    const key = createPublicKey({ key: jwk, format: "jwk" });
-    const data = Buffer.from(input);
-    const sig = Buffer.from(signature, "base64url");
-    if (alg === "EdDSA") return jwk.kty === "OKP" && verify(null, data, key, sig);
-    if (alg === "ES256") {
-      return jwk.kty === "EC" && jwk.crv === "P-256" && verify("sha256", data, { key, dsaEncoding: "ieee-p1363" }, sig);
+  function nextPage(response) {
+    for (const part of (response.headers.get("link") ?? "").split(",")) {
+      const match = /<([^>]+)>\s*;\s*rel="next"/.exec(part);
+      if (match && new URL(match[1]).origin === new URL(org).origin) return match[1];
+    }
+    return null;
+  }
+  return {
+    async agents() {
+      const agents = [];
+      let url = `${org}/api/v1/apps?filter=${encodeURIComponent('status eq "ACTIVE"')}&limit=200`;
+      for (let pages = 0; url && pages < 100; pages++) {
+        const response = await api(url);
+        for (const app of await response.json() ?? []) {
+          const agent = agentOf(app);
+          if (agent) agents.push(agent);
+        }
+        url = nextPage(response);
+      }
+      return onePerAddress(agents);
+    },
+    async agent(sub) {
+      const response = await api(`${org}/api/v1/apps/${encodeURIComponent(sub)}`);
+      if (response.status === 404) return null;
+      const agent = agentOf(await response.json());
+      return agent?.sub === sub ? agent : null;
     }
-    return jwk.kty === "RSA" && verify("sha256", data, key, sig);
-  } catch {
-    return false;
-  }
+  };
 }
 
-// src/signer.ts
-import { readFile } from "fs/promises";
+// src/kms.ts
+import { createPublicKey, verify as verify2 } from "crypto";
 
 // ../id/dist/chunk-QDQDZSU7.js
-import { createHash as createHash2 } from "crypto";
-import { createHash as createHash22, randomBytes as randomBytes2 } from "crypto";
+import { createHash } from "crypto";
+import { createHash as createHash2, randomBytes } from "crypto";
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -365,8 +368,8 @@ __export(post_core_wasm_exports, {
   policyDecision: () => policyDecision,
   policyMaxAge: () => policyMaxAge,
   publicKey: () => publicKey,
-  sign: () => sign,
-  verify: () => verify2
+  sign: () => sign2,
+  verify: () => verify
 });
 function generateSeed() {
   try {
@@ -430,7 +433,7 @@ function publicKey(seed) {
     wasm.__wbindgen_add_to_stack_pointer(16);
   }
 }
-function sign(seed, message) {
+function sign2(seed, message) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
     const ptr0 = passArray8ToWasm0(seed, wasm.__wbindgen_export3);
@@ -452,7 +455,7 @@ function sign(seed, message) {
     wasm.__wbindgen_add_to_stack_pointer(16);
   }
 }
-function verify2(public_key, message, signature) {
+function verify(public_key, message, signature) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
     const ptr0 = passArray8ToWasm0(public_key, wasm.__wbindgen_export3);
@@ -697,9 +700,9 @@ function wasm2() {
   }
   return post_core_wasm_exports;
 }
-var b64url2 = (bytes) => Buffer.from(bytes).toString("base64url");
+var b64url = (bytes) => Buffer.from(bytes).toString("base64url");
 function jwkThumbprint(publicKey2) {
-  return createHash2("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${b64url2(publicKey2)}"}`).digest("base64url");
+  return createHash("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${b64url(publicKey2)}"}`).digest("base64url");
 }
 function verifyBytes(publicKey2, message, signature) {
   try {
@@ -732,7 +735,7 @@ function bytesOf(body) {
   return typeof body === "string" ? new TextEncoder().encode(body) : body;
 }
 function contentDigest(body) {
-  return `sha-256=:${createHash22("sha256").update(bytesOf(body)).digest("base64")}:`;
+  return `sha-256=:${createHash2("sha256").update(bytesOf(body)).digest("base64")}:`;
 }
 async function verifyRequest(input, options) {
   const headers = /* @__PURE__ */ new Map();
@@ -841,7 +844,307 @@ function splitTopLevel(value) {
   return out;
 }
 
+// src/kms.ts
+var KMS_KEY_SPEC = "ECC_NIST_EDWARDS25519";
+var KMS_SIGNING_ALGORITHM = "ED25519_SHA_512";
+async function sdkClient(region) {
+  let sdk;
+  try {
+    sdk = await import("@aws-sdk/client-kms");
+  } catch {
+    throw new Error(
+      "A KMS key needs @aws-sdk/client-kms: `npm install @aws-sdk/client-kms` beside the issuer."
+    );
+  }
+  const client = new sdk.KMSClient(region ? { region } : {});
+  return {
+    getPublicKey: (input) => client.send(new sdk.GetPublicKeyCommand(input)),
+    sign: (input) => client.send(
+      new sdk.SignCommand({
+        ...input,
+        SigningAlgorithm: input.SigningAlgorithm
+      })
+    )
+  };
+}
+async function readKey(kms, keyId) {
+  let key;
+  try {
+    key = await kms.getPublicKey({ KeyId: keyId });
+  } catch (error) {
+    throw new Error(
+      `KMS would not give the issuer ${keyId}'s public key (${error instanceof Error ? error.message : error}). Its role needs kms:GetPublicKey and kms:Sign on that key.`
+    );
+  }
+  if (key.KeySpec !== KMS_KEY_SPEC) {
+    throw new Error(`${keyId} is a ${key.KeySpec} key. The issuer signs with ${KMS_KEY_SPEC}.`);
+  }
+  if (key.KeyUsage && key.KeyUsage !== "SIGN_VERIFY") {
+    throw new Error(`${keyId} is not a signing key.`);
+  }
+  if (!key.SigningAlgorithms?.includes(KMS_SIGNING_ALGORITHM)) {
+    throw new Error(`${keyId} does not sign with ${KMS_SIGNING_ALGORITHM}.`);
+  }
+  if (!key.KeyId || !key.PublicKey) throw new Error(`KMS gave no public key for ${keyId}.`);
+  const publicKey2 = createPublicKey({
+    key: Buffer.from(key.PublicKey),
+    format: "der",
+    type: "spki"
+  });
+  const x = publicKey2.export({ format: "jwk" }).x;
+  const raw = new Uint8Array(Buffer.from(x ?? "", "base64url"));
+  if (raw.length !== 32) throw new Error(`${keyId}'s public key is not an Ed25519 key.`);
+  return { arn: key.KeyId, publicKey: publicKey2, raw };
+}
+async function kmsSigner(options) {
+  const kms = options.kms ?? await sdkClient(options.region);
+  const { arn, publicKey: publicKey2, raw } = await readKey(kms, options.keyId);
+  return {
+    kid: jwkThumbprint(raw),
+    publicKey: raw,
+    keyArn: arn,
+    async sign(message) {
+      const signed = await kms.sign({
+        KeyId: arn,
+        Message: message,
+        MessageType: "RAW",
+        SigningAlgorithm: KMS_SIGNING_ALGORITHM
+      });
+      const signature = signed.Signature ? new Uint8Array(signed.Signature) : null;
+      if (!signature || !verify2(null, message, publicKey2, signature)) {
+        throw new Error(
+          `KMS answered for ${arn} with a signature its public key does not verify. Nothing was signed.`
+        );
+      }
+      return signature;
+    }
+  };
+}
+async function kmsRetiredKey(options) {
+  const kms = options.kms ?? await sdkClient(options.region);
+  const { raw } = await readKey(kms, options.keyId);
+  return { kid: jwkThumbprint(raw), publicKey: raw, notAfter: options.notAfter };
+}
+
+// src/person.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash as createHash3,
+  createPublicKey as createPublicKey2,
+  randomBytes as randomBytes2,
+  timingSafeEqual,
+  verify as verify3
+} from "crypto";
+var MIN_SECRET = 32;
+var FLOW_COOKIE = "pidgeon_issuer_flow";
+var CODE_SECONDS = 60;
+var FLOW_SECONDS = 600;
+var SKEW = 60;
+var UPSTREAM_ALGS = ["RS256", "ES256", "EdDSA"];
+function checkSecret(secret) {
+  if (!secret || secret.length < MIN_SECRET) {
+    throw new Error(
+      `A person's sign-in needs PIDGEON_ISSUER_SECRET, ${MIN_SECRET} characters or more. It seals the sign-in in progress and the code; there is no default.`
+    );
+  }
+  return secret;
+}
+var b64url2 = (bytes) => Buffer.from(bytes).toString("base64url");
+function sealKey(secret, purpose) {
+  return createHash3("sha256").update(`pidgeon issuer seal\0${purpose}\0${secret}`).digest();
+}
+function seal(secret, purpose, value) {
+  const iv = randomBytes2(12);
+  const cipher = createCipheriv("aes-256-gcm", sealKey(secret, purpose), iv);
+  cipher.setAAD(Buffer.from(purpose));
+  const body = Buffer.concat([cipher.update(JSON.stringify(value), "utf8"), cipher.final()]);
+  return b64url2(Buffer.concat([iv, body, cipher.getAuthTag()]));
+}
+function unseal(secret, purpose, token) {
+  if (!token) return null;
+  try {
+    const raw = Buffer.from(token, "base64url");
+    if (raw.length < 29) return null;
+    const decipher = createDecipheriv("aes-256-gcm", sealKey(secret, purpose), raw.subarray(0, 12));
+    decipher.setAAD(Buffer.from(purpose));
+    decipher.setAuthTag(raw.subarray(raw.length - 16));
+    const text2 = Buffer.concat([
+      decipher.update(raw.subarray(12, raw.length - 16)),
+      decipher.final()
+    ]).toString("utf8");
+    return JSON.parse(text2);
+  } catch {
+    return null;
+  }
+}
+function pkceChallenge(verifier) {
+  return b64url2(createHash3("sha256").update(verifier).digest());
+}
+function pkceHolds(verifier, challenge) {
+  const a = Buffer.from(pkceChallenge(verifier));
+  const b = Buffer.from(challenge);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function cookieOf(request, name) {
+  for (const part of (request.headers.get("cookie") ?? "").split(";")) {
+    const eq = part.indexOf("=");
+    if (eq > 0 && part.slice(0, eq).trim() === name) {
+      return decodeURIComponent(part.slice(eq + 1).trim());
+    }
+  }
+  return null;
+}
+var ProviderRefused = class extends Error {
+};
+function provider(options, fetcher, now) {
+  const issuer = options.issuer.replace(/\/$/, "");
+  let configuration = null;
+  let keys = null;
+  function discover() {
+    if (!configuration || configuration.at <= now() - 36e5) {
+      const url = options.discoveryUrl ?? `${issuer}/.well-known/openid-configuration`;
+      const value = (async () => {
+        const response = await fetcher(url, { headers: { accept: "application/json" } });
+        if (!response.ok) throw new Error(`${url} answered ${response.status}.`);
+        const body = await response.json();
+        if (body.issuer?.replace(/\/$/, "") !== issuer) {
+          throw new Error(`${url} names the issuer ${body.issuer}, not ${issuer}.`);
+        }
+        return body;
+      })();
+      configuration = { at: now(), value };
+      value.catch(() => {
+        if (configuration?.value === value) configuration = null;
+      });
+    }
+    return configuration.value;
+  }
+  async function key(kid) {
+    const find = () => keys?.value.find((one) => (kid ? one.kid === kid : true) && one.use !== "enc") ?? null;
+    const fresh = keys && keys.at > now() - 3e5;
+    if (fresh && find()) return find();
+    if (keys && keys.at > now() - 1e4) return null;
+    const response = await fetcher((await discover()).jwks_uri);
+    const body = await response.json().catch(() => ({}));
+    keys = { at: now(), value: Array.isArray(body.keys) ? body.keys : [] };
+    return find();
+  }
+  async function authorizeUrl(input) {
+    const url = new URL((await discover()).authorization_endpoint);
+    url.search = new URLSearchParams({
+      response_type: "code",
+      client_id: options.clientId,
+      redirect_uri: input.redirectUri,
+      scope: "openid email",
+      state: input.state,
+      nonce: input.nonce,
+      code_challenge: pkceChallenge(input.verifier),
+      code_challenge_method: "S256"
+    }).toString();
+    return url.toString();
+  }
+  async function redeem(input) {
+    const form = new URLSearchParams({
+      grant_type: "authorization_code",
+      code: input.code,
+      redirect_uri: input.redirectUri,
+      code_verifier: input.verifier
+    });
+    const headers = {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    };
+    if (options.tokenAuth === "client_secret_post") {
+      form.set("client_id", options.clientId);
+      form.set("client_secret", options.clientSecret);
+    } else {
+      const pair = `${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`;
+      headers.authorization = `Basic ${Buffer.from(pair).toString("base64")}`;
+    }
+    const response = await fetcher((await discover()).token_endpoint, {
+      method: "POST",
+      headers,
+      body: form
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok || typeof body.id_token !== "string") {
+      throw new ProviderRefused(
+        `The identity provider did not sign the person in (${body.error ?? response.status}).`
+      );
+    }
+    return check(body.id_token, input.nonce);
+  }
+  async function check(token, nonce) {
+    const parts = token.split(".");
+    if (parts.length !== 3) throw new ProviderRefused("The provider sent no ID token.");
+    let header;
+    let claims;
+    try {
+      header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
+      claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    } catch {
+      throw new ProviderRefused("The provider sent no ID token.");
+    }
+    if (!header.alg || !UPSTREAM_ALGS.includes(header.alg)) {
+      throw new ProviderRefused(`The provider's ID token is signed with ${header.alg}.`);
+    }
+    const jwk = await key(header.kid);
+    if (!jwk || !signatureHolds(header.alg, jwk, `${parts[0]}.${parts[1]}`, parts[2])) {
+      throw new ProviderRefused("The provider's ID token is not signed by its keys.");
+    }
+    const at = Math.floor(now() / 1e3);
+    if (typeof claims.iss !== "string" || claims.iss.replace(/\/$/, "") !== issuer) {
+      throw new ProviderRefused("The provider's ID token is from another issuer.");
+    }
+    const aud = claims.aud;
+    const audiences = Array.isArray(aud) ? aud : [aud];
+    if (!audiences.includes(options.clientId)) {
+      throw new ProviderRefused("The provider's ID token is for another client.");
+    }
+    if (audiences.length > 1 && claims.azp !== options.clientId) {
+      throw new ProviderRefused("The provider's ID token is for another client.");
+    }
+    if (typeof claims.exp !== "number" || claims.exp + SKEW <= at) {
+      throw new ProviderRefused("The provider's ID token has expired.");
+    }
+    if (typeof claims.iat === "number" && claims.iat > at + SKEW) {
+      throw new ProviderRefused("The provider's ID token is from the future.");
+    }
+    if (claims.nonce !== nonce) {
+      throw new ProviderRefused("The provider's ID token is for another sign-in.");
+    }
+    if (typeof claims.sub !== "string" || !claims.sub) {
+      throw new ProviderRefused("The provider's ID token names nobody.");
+    }
+    if (claims.email_verified !== true || typeof claims.email !== "string") {
+      throw new ProviderRefused("The identity provider has not verified this person\u2019s address.");
+    }
+    return {
+      sub: claims.sub,
+      email: claims.email.trim().toLowerCase(),
+      authTime: typeof claims.auth_time === "number" ? claims.auth_time : at
+    };
+  }
+  return { authorizeUrl, redeem };
+}
+function signatureHolds(alg, jwk, input, signature) {
+  try {
+    const key = createPublicKey2({ key: jwk, format: "jwk" });
+    const data = Buffer.from(input);
+    const sig = Buffer.from(signature, "base64url");
+    if (alg === "EdDSA") return jwk.kty === "OKP" && verify3(null, data, key, sig);
+    if (alg === "ES256") {
+      return jwk.kty === "EC" && jwk.crv === "P-256" && verify3("sha256", data, { key, dsaEncoding: "ieee-p1363" }, sig);
+    }
+    return jwk.kty === "RSA" && verify3("sha256", data, key, sig);
+  } catch {
+    return false;
+  }
+}
+
 // src/signer.ts
+import { readFile } from "fs/promises";
 async function fileSigner(path) {
   let file;
   try {
@@ -884,12 +1187,21 @@ async function loadConfig(path, env = process.env) {
     throw new Error(`${path}: \`domain\` is the domain whose agents this issues for.`);
   }
   const here = (relative) => resolve(dirname(path), relative);
-  const signer = env.PIDGEON_ISSUER_KEY ? seedSigner(env.PIDGEON_ISSUER_KEY, { domain: file.domain }) : file.key ? await fileSigner(here(file.key)) : null;
-  if (!signer) throw new Error(`${path}: name a \`key\` file, or set PIDGEON_ISSUER_KEY.`);
+  const signer = env.PIDGEON_ISSUER_KEY ? seedSigner(env.PIDGEON_ISSUER_KEY, { domain: file.domain }) : typeof file.key === "string" ? await fileSigner(here(file.key)) : file.key?.kms ? await kmsSigner({ keyId: file.key.kms, region: file.key.region }) : null;
+  if (!signer) {
+    throw new Error(`${path}: name a \`key\` file or a KMS key, or set PIDGEON_ISSUER_KEY.`);
+  }
   const retired = [];
   for (const entry of file.retired ?? []) {
-    const old = await fileSigner(here(entry.key));
-    retired.push({ kid: old.kid, publicKey: old.publicKey, notAfter: new Date(entry.not_after) });
+    const notAfter = new Date(entry.not_after);
+    if (typeof entry.key === "string") {
+      const old = await fileSigner(here(entry.key));
+      retired.push({ kid: old.kid, publicKey: old.publicKey, notAfter });
+    } else {
+      retired.push(
+        await kmsRetiredKey({ keyId: entry.key.kms, region: entry.key.region, notAfter })
+      );
+    }
   }
   let person;
   if (file.person) {
@@ -946,6 +1258,32 @@ function directoryFrom(file, path, env) {
       group: keycloak.group
     });
   }
+  if ("auth0" in directory) {
+    const { auth0 } = directory;
+    const secretName = auth0.client_secret_env ?? "AUTH0_CLIENT_SECRET";
+    const secret = env[secretName];
+    if (!secret) throw new Error(`${path}: set ${secretName}, the issuer's Auth0 client secret.`);
+    return auth0Directory({
+      tenant: auth0.tenant,
+      clientId: auth0.client_id,
+      clientSecret: secret,
+      domain: file.domain
+    });
+  }
+  if ("okta" in directory) {
+    const { okta } = directory;
+    const keyName = okta.private_key_env ?? "OKTA_PRIVATE_KEY";
+    const privateKey = env[keyName];
+    if (!privateKey)
+      throw new Error(`${path}: set ${keyName}, the issuer's Okta private key (PEM).`);
+    return oktaDirectory({
+      org: okta.org,
+      clientId: okta.client_id,
+      privateKey,
+      keyId: okta.key_id,
+      domain: file.domain
+    });
+  }
   if ("static" in directory && Array.isArray(directory.static)) {
     for (const agent of directory.static) {
       if (!agent.address?.toLowerCase().endsWith(`@${file.domain.toLowerCase()}`)) {
@@ -954,11 +1292,13 @@ function directoryFrom(file, path, env) {
     }
     return staticDirectory(directory.static);
   }
-  throw new Error(`${path}: \`directory\` is { "keycloak": {...} } or { "static": [...] }.`);
+  throw new Error(
+    `${path}: \`directory\` is { "keycloak": {...} }, { "auth0": {...} }, { "okta": {...} } or { "static": [...] }.`
+  );
 }
 
 // src/issuer.ts
-import { createHash as createHash3, createPublicKey as createPublicKey2, randomBytes as randomBytes3, randomUUID, verify as verify3 } from "crypto";
+import { createHash as createHash4, createPublicKey as createPublicKey3, randomBytes as randomBytes3, randomUUID as randomUUID2, verify as verify4 } from "crypto";
 var TOKEN_EXCHANGE2 = "urn:ietf:params:oauth:grant-type:token-exchange";
 var TOKEN_TYPE_JWT = "urn:ietf:params:oauth:token-type:jwt";
 var TOKEN_TYPE_ID = "urn:ietf:params:oauth:token-type:id_token";
@@ -1029,10 +1369,10 @@ function createIssuer(options) {
       if (header?.alg !== "EdDSA" || header?.typ !== typ) return null;
       const key = publishedIssuerKeys().find((candidate) => candidate.kid === header.kid);
       if (!key) return null;
-      const signed = verify3(
+      const signed = verify4(
         null,
         Buffer.from(`${parts[0]}.${parts[1]}`),
-        createPublicKey2({
+        createPublicKey3({
           key: { kty: "OKP", crv: "Ed25519", x: b64url3(key.publicKey) },
           format: "jwk"
         }),
@@ -1152,7 +1492,7 @@ function createIssuer(options) {
     };
   }
   function record() {
-    const id = createHash3("sha256").update(`post policy id\0self-hosted\0${domain}`).digest("hex").slice(0, 16);
+    const id = createHash4("sha256").update(`post policy id\0self-hosted\0${domain}`).digest("hex").slice(0, 16);
     return `v=post0; id=${id}`;
   }
   const cardUrl = (address) => `${issuer}${PATHS.card}?address=${encodeURIComponent(address)}`;
@@ -1189,7 +1529,7 @@ function createIssuer(options) {
     const claims = cardClaims(agent);
     return { jws: await jws({ alg: "EdDSA", typ: "agent-card+jwt" }, claims), card: claims };
   }
-  const grantId = (agent, rule) => `grt_${createHash3("sha256").update(
+  const grantId = (agent, rule) => `grt_${createHash4("sha256").update(
     `${agent.sub}\0${rule.group}\0${rule.scope.name}\0${rule.subject.type}:${rule.subject.id}`
   ).digest("base64url").slice(0, 22)}`;
   const rulesFor = (agent) => (options.grants ?? []).filter((rule) => agent.groups.includes(rule.group));
@@ -1380,7 +1720,7 @@ function createIssuer(options) {
     }
     const audience = form.get("audience");
     const iat = nowSeconds();
-    const jti = randomUUID();
+    const jti = randomUUID2();
     const cnf = { jwk: { kty: "OKP", crv: "Ed25519", x: live.key } };
     const fresh = now() - Date.parse(live.createdAt) < NEW_ADDRESS_DAYS * 864e5;
     const idToken = await jws(
@@ -1580,7 +1920,7 @@ function createIssuer(options) {
       });
     }
     const sealed = {
-      jti: randomUUID(),
+      jti: randomUUID2(),
       clientId: flow.site.clientId,
       redirectUri: flow.site.redirectUri,
       challenge: flow.site.challenge,
@@ -1625,7 +1965,7 @@ function createIssuer(options) {
         exp: iat + ID_TOKEN_SECONDS,
         auth_time: code.authTime,
         ...code.nonce ? { nonce: code.nonce } : {},
-        jti: randomUUID(),
+        jti: randomUUID2(),
         sub: code.sub,
         kind: "person",
         email: code.email,
@@ -1865,7 +2205,11 @@ ${HELP}`);
 export {
   staticDirectory,
   cachedDirectory,
+  auth0Directory,
   keycloakDirectory,
+  oktaDirectory,
+  kmsSigner,
+  kmsRetiredKey,
   fileSigner,
   seedSigner,
   loadConfig,
@@ -1877,4 +2221,4 @@ export {
   UsageError2 as UsageError,
   runIssuer
 };
-//# sourceMappingURL=chunk-BXZ2EI2Y.js.map
+//# sourceMappingURL=chunk-IKGE6SNR.js.map