@poppykit/client 0.4.0 → 0.5.0

package/dist/provider.js

@@ -45,7 +45,6 @@ function https(value) { try {
 catch {
     return fail('binding_conflict');
 } }
-function onDomain(value, domain) { const host = https(value).hostname; return host === domain || host.endsWith(`.${domain}`); }
 function publicKey(value) {
     if (value.kty !== 'EC' || value.crv !== 'P-256' || typeof value.x !== 'string' || typeof value.y !== 'string' || 'd' in value || 'k' in value)
         fail('unavailable');
@@ -67,6 +66,8 @@ export function createProvider(options) {
         const row = tx.get('operation', `${enrollment.enrollmentId}:${operationId}`);
         if (!row)
             fail('binding_conflict');
+        if (row.binding.purpose === 'direct' && (typeof row.binding.sessionKey !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(row.binding.sessionKey)))
+            fail('binding_conflict');
         if (row.expiresAt <= now())
             fail('expired');
         if (row.status === 'canceled')
@@ -138,37 +139,29 @@ export function createProvider(options) {
             });
         },
         async begin(credential, input) {
-            exact(input, ['version', 'installationId', 'operationId', 'domain', 'issuer', 'purpose', 'sessionId', 'returnTo', 'state']);
-            if (!['client-authentication', 'session', 'browser', 'direct'].includes(input.purpose))
+            exact(input, ['version', 'installationId', 'operationId', 'domain', 'issuer', 'purpose', 'sessionId', 'sessionKey', 'state']);
+            if (!['client-authentication', 'session', 'direct'].includes(input.purpose))
                 fail('binding_conflict');
             text(input.operationId);
             if (input.sessionId !== undefined)
                 text(input.sessionId);
             await authorizeCompany(credential, input);
-            if (input.purpose === 'client-authentication' && (input.sessionId !== undefined || input.returnTo !== undefined))
-                fail('binding_conflict');
-            if (input.purpose !== 'browser' && input.returnTo !== undefined)
+            if (input.purpose === 'client-authentication' && input.sessionId !== undefined)
                 fail('binding_conflict');
             if (input.purpose !== 'direct' && input.state !== undefined)
                 fail('binding_conflict');
-            if (input.purpose === 'direct' && (typeof input.state !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(input.state) || !input.sessionId))
+            if (input.purpose === 'direct' && (typeof input.state !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(input.state) || typeof input.sessionKey !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(input.sessionKey)))
                 fail('binding_conflict');
-            if (input.purpose === 'browser' && !input.sessionId)
+            if (input.purpose !== 'direct' && input.sessionKey !== undefined)
                 fail('binding_conflict');
-            if (input.purpose === 'browser')
-                text(input.returnTo);
             const metadata = await verified(text(input.domain), text(input.issuer));
-            if (input.purpose === 'browser' && (!onDomain(input.returnTo, metadata.document.organization.domain) || !metadata.document.web?.browser_session_endpoint))
-                fail('binding_conflict');
             const identity = await store.transaction({ kind: 'identity', enrollmentId: enrollmentId(credential), issuer: input.issuer }, tx => {
                 const enrollment = auth(tx, credential, text(input.installationId));
                 if (!enrollment.allowedCompanies.includes(metadata.document.organization.domain))
                     fail('unauthorized');
                 return { enrollment, userId: user(tx, enrollment.visitor, input.issuer) };
             });
-            if (input.purpose === 'browser' && !await options.verifySession?.({ clientId: options.clientId, userId: identity.userId, issuer: input.issuer, sessionId: input.sessionId }))
-                fail('unauthorized');
-            const binding = { issuer: input.issuer, domain: metadata.document.organization.domain, purpose: input.purpose, sessionId: input.sessionId ?? null, returnTo: input.returnTo ?? null, stateHash: input.state ? hash(input.state) : null, userId: identity.userId, browserEndpoint: metadata.document.web?.browser_session_endpoint ?? null };
+            const binding = { issuer: input.issuer, domain: metadata.document.organization.domain, purpose: input.purpose, sessionKey: input.sessionKey ?? null, sessionId: input.sessionId ?? null, stateHash: input.state ? hash(input.state) : null, userId: identity.userId };
             return store.transaction({ kind: 'begin', enrollmentId: enrollmentId(credential), operationId: input.operationId, issuer: input.issuer, ...(binding.stateHash ? { stateHash: binding.stateHash } : {}), at: now() }, tx => {
                 const enrollment = auth(tx, credential, text(input.installationId)), key = `${enrollment.enrollmentId}:${text(input.operationId)}`, existing = tx.get('operation', key);
                 if (existing) {
@@ -203,19 +196,16 @@ export function createProvider(options) {
             exact(input, ['version', 'installationId', 'operationId', 'purpose']);
             const snapshot = await store.transaction(selectedOperation(credential, input), tx => {
                 const enrollment = auth(tx, credential, text(input.installationId)), op = operation(tx, enrollment, text(input.operationId));
-                if (op.binding.purpose !== input.purpose || !['client-authentication', 'session', 'browser'].includes(input.purpose))
+                if (op.binding.purpose !== input.purpose || !['client-authentication', 'session'].includes(input.purpose))
                     fail('binding_conflict');
                 throttle(tx, enrollment);
                 return { enrollment, op };
             });
-            const b = snapshot.op.binding, metadata = await verified(b.domain, b.issuer);
-            if (b.browserEndpoint !== (metadata.document.web?.browser_session_endpoint ?? null))
-                fail('binding_conflict');
-            if (b.purpose === 'browser' && !await options.verifySession?.({ clientId: options.clientId, userId: b.userId, issuer: b.issuer, sessionId: b.sessionId }))
-                fail('unauthorized');
+            const b = snapshot.op.binding;
+            await verified(b.domain, b.issuer);
             const iat = Math.floor(now() / 1000), exp = iat + 60;
-            const claims = { iss: options.clientId, sub: b.purpose === 'client-authentication' ? options.clientId : b.userId, aud: b.purpose === 'browser' ? b.browserEndpoint : b.issuer, iat, exp, jti: id(), ...(b.purpose === 'browser' ? { session_id: b.sessionId, return_to: b.returnTo } : {}) };
-            const header = { alg: 'ES256', kid: options.signer.kid, typ: b.purpose === 'client-authentication' ? 'client-authentication+jwt' : b.purpose === 'browser' ? 'poppy-browser+jwt' : 'JWT' };
+            const claims = { iss: options.clientId, sub: b.purpose === 'client-authentication' ? options.clientId : b.userId, aud: b.issuer, iat, exp, jti: id() };
+            const header = { alg: 'ES256', kid: options.signer.kid, typ: b.purpose === 'client-authentication' ? 'client-authentication+jwt' : 'JWT' };
             const unsigned = `${Buffer.from(JSON.stringify(header)).toString('base64url')}.${Buffer.from(JSON.stringify(claims)).toString('base64url')}`;
             const signature = await options.signer.sign(new TextEncoder().encode(unsigned));
             if (signature.length !== 64)
@@ -252,10 +242,10 @@ export function createProvider(options) {
             });
         },
         async takeResult(credential, input) {
-            exact(input, ['version', 'installationId', 'operationId', 'issuer', 'sessionId']);
+            exact(input, ['version', 'installationId', 'operationId', 'issuer', 'sessionId', 'sessionKey']);
             return store.transaction(selectedOperation(credential, input), tx => {
                 const enrollment = auth(tx, credential, text(input.installationId)), op = operation(tx, enrollment, text(input.operationId));
-                if (op.binding.issuer !== input.issuer || op.binding.sessionId !== input.sessionId || op.binding.purpose !== 'direct')
+                if (op.binding.issuer !== input.issuer || op.binding.sessionKey !== input.sessionKey || op.binding.purpose !== 'direct')
                     fail('binding_conflict');
                 if (op.status !== 'ready')
                     return { status: 'pending' };

package/examples/quickstart.mjs

@@ -7,7 +7,7 @@ if (!domain) throw new Error('usage: node examples/quickstart.mjs DOMAIN|--self-
 const transport = selfCheck ? {
   async fetch(request) {
     assert.equal(request.url, 'https://company.example/.well-known/poppy.json');
-    return Response.json({ protocol_version: '0.2', organization: { name: 'Example Company', domain }, web: {} });
+    return Response.json({ protocol_version: '0.3', organization: { name: 'Example Company', domain }, web: {} });
   },
 } : createNodeTransport();
 try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poppykit/client",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "private": false,
   "description": "Personal Agent Protocol client SDK",
   "repository": {
@@ -9,7 +9,7 @@
   },
   "type": "module",
   "engines": {
-    "node": ">=24.22.1 <25"
+    "node": ">=24.21.0 <25"
   },
   "packageManager": "pnpm@11.25.0",
   "scripts": {