@poppykit/client 0.4.1 → 0.5.0

package/dist/auth/client-auth.js

@@ -1,8 +1,10 @@
+import { parseAlternative } from '../network/tasks.js';
+import { registeredRedirect } from '../network/redirect.js';
 import { acquireOwner, releaseOwner, localOwnerAlive } from './ownership.js';
 import { createHash } from 'node:crypto';
 import { calculateJwkThumbprint } from 'jose';
 import { parseJson, parseProtocolError, parseTokenResponse, retryAfterMilliseconds } from '../protocol/wire.js';
-import { validateClientId } from '../network/discovery.js';
+import { validateClientId, signInMethods } from '../network/discovery.js';
 import { dpopChallenge, schemeChallenge } from './challenge.js';
 import { resolveApiTarget, mcpScheme, browserDestination, validateFeedback } from '../integrations.js';
 export class AuthFailure extends Error {
@@ -33,7 +35,7 @@ function providerFailure(error, connectionId) {
             : ['invalid_response', 'binding_conflict', 'expired', 'consumed', 'canceled'].includes(String(code)) ? 'provider_invalid_response' : 'provider_unavailable', connectionId);
 }
 // OAuth codes the token endpoint may return (spec 4.2, RFC 6749/8707); anything else is reported as token_error.
-const SAFE_ERRORS = new Set(['invalid_request', 'invalid_client', 'invalid_grant', 'unauthorized_client', 'unsupported_grant_type', 'invalid_scope', 'invalid_target', 'invalid_session', 'account_mismatch', 'invalid_dpop_proof', 'use_dpop_nonce', 'extension_required', 'rate_limited']);
+const SAFE_ERRORS = new Set(['invalid_request', 'invalid_client', 'invalid_grant', 'unauthorized_client', 'unsupported_grant_type', 'invalid_scope', 'invalid_target', 'account_mismatch', 'invalid_dpop_proof', 'use_dpop_nonce', 'extension_required', 'rate_limited']);
 const b64 = (data) => Buffer.from(data).toString('base64url');
 const randomId = (prefix = '') => prefix + b64(crypto.getRandomValues(new Uint8Array(16)));
 const own = (record, key) => Object.hasOwn(record, key) ? record[key] : undefined;
@@ -84,7 +86,28 @@ function parseCallback(callbackUrl) {
     return { params, base };
 }
 export function initialClientAuthState() {
-    return { version: 1, epoch: randomId(), owner: null, identities: {}, connections: {}, grants: {}, operations: {}, cleanup: {} };
+    return { version: 2, epoch: randomId(), owner: null, identities: {}, connections: {}, grants: {}, operations: {}, cleanup: {} };
+}
+/** Upgrade a complete namespace under its writer lock; dispatched/staged work still goes through recover(). */
+export function upgradeClientAuthState(state) {
+    if (state.version === 2)
+        return;
+    if (state.version !== 1)
+        throw new Error('unsupported auth state version');
+    for (const connection of Object.values(state.connections)) {
+        connection.needsSessionKey = true;
+        connection.slots = {};
+    }
+    for (const operation of Object.values(state.operations))
+        if (operation.phase === 'prepared') {
+            operation.phase = 'terminal';
+            operation.status = 'cancelled';
+            operation.result = null;
+            const grant = operation.grantId ? own(state.grants, operation.grantId) : undefined;
+            if (grant?.operationId === operation.id)
+                grant.operationId = null;
+        }
+    state.version = 2;
 }
 function publicEcJwk(value, code) {
     const jwk = (value ?? {});
@@ -125,9 +148,9 @@ export function createClientAuth(options) {
         if (state.owner && (state.owner.namespace !== namespace || state.owner.clientId !== clientId || state.owner.localUserId !== localUserId))
             throw new AuthFailure('owner_mismatch');
     }
-    async function load(selection) { const state = await store.read(selection); checkOwner(state); return state; }
+    async function load(selection) { const state = await store.read(selection); checkOwner(state); upgradeClientAuthState(state); return state; }
     function transaction(selection, change) {
-        return store.transaction(selection, state => { checkOwner(state); state.owner ??= owner; return change(state); });
+        return store.transaction(selection, state => { checkOwner(state); upgradeClientAuthState(state); state.owner ??= owner; return change(state); });
     }
     async function record(connectionId) {
         const found = typeof connectionId === 'string' ? own((await load({ connectionId })).connections, connectionId) : undefined;
@@ -143,7 +166,7 @@ export function createClientAuth(options) {
     async function verified(metadata) {
         let fresh;
         try {
-            fresh = await options.metadata.resolveCompany(new URL(metadata.url).hostname);
+            fresh = await options.metadata.resolveCompany(new URL(metadata.url).host);
         }
         catch {
             throw new AuthFailure('discovery_failed');
@@ -211,14 +234,14 @@ export function createClientAuth(options) {
             return signature;
         });
     }
-    async function proof(key, method, url, token) {
+    async function proof(key, method, url, token, browserCode) {
         const htu = new URL(url);
         htu.search = '';
         htu.hash = '';
         const payload = { jti: randomId(), htm: method, htu: htu.href, iat: Math.floor(now() / 1000) };
         if (token !== undefined)
             payload.ath = b64(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(token))));
-        const nonce = nonces.get(htu.origin);
+        const nonce = browserCode ?? nonces.get(htu.origin);
         if (nonce !== undefined)
             payload.nonce = nonce;
         return compact({ typ: 'dpop+jwt', alg: 'ES256', jwk: key.jwk }, payload, async (input) => new Uint8Array(await crypto.subtle.sign(ES256, key.privateKey, input)));
@@ -298,6 +321,8 @@ export function createClientAuth(options) {
             catch { /* reported below */ }
             if (response.status === 200) {
                 try {
+                    if (fields.grant_type === 'urn:ietf:params:oauth:grant-type:token-exchange' && (typeof json !== 'object' || json === null || !('issued_token_type' in json) || json.issued_token_type !== 'urn:ietf:params:oauth:token-type:access_token'))
+                        throw 0;
                     return { token: parseTokenResponse(json), scheme };
                 }
                 catch {
@@ -333,30 +358,30 @@ export function createClientAuth(options) {
             throw new AuthFailure('invalid_target');
         }
     }
-    // Signed-out Session Token via the JWT bearer grant (spec 4.2); renewal passes session_id.
+    // The proof key names the Session; signed-out tokens have no account scopes.
     async function signedOutToken(metadata, userId, dpopKeyRef, sessionId, resource, anonymous = false) {
         const fields = { grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer' };
-        if (sessionId !== null)
-            fields.session_id = sessionId;
         if (resource !== null)
             fields.resource = resource;
         const { token, scheme } = await tokenRequest(metadata, dpopKeyRef, fields, userId, anonymous);
         if (token.token_type !== scheme)
             throw new AuthFailure('unsupported_token_type');
-        if (token.signed_in !== false || token.scope !== '' || (sessionId !== null && token.session_id !== sessionId))
+        if ((token.scope ?? '') !== '' || token.refresh_token !== undefined)
             throw new AuthFailure('invalid_response');
         return token;
     }
+    async function newSessionKey() {
+        // shortcut: SecretStore stores a private JWK; use a host signer when non-extractable key persistence is available.
+        const pair = await crypto.subtle.generateKey(EC, true, ['sign', 'verify']);
+        const { kty, crv, x, y, d } = await crypto.subtle.exportKey('jwk', pair.privateKey);
+        return secrets.stage(JSON.stringify({ kty, crv, x, y, d }));
+    }
     async function identityFor(issuer, anonymous = false) {
         if (anonymous && !identity)
             throw new AuthFailure('anonymous_unavailable');
         const existing = anonymous ? undefined : own((await load({ issuer })).identities, issuer);
         if (existing)
             return existing;
-        // shortcut: extractable key, because the SecretStore holds the private JWK as a string and Node cannot persist a non-extractable CryptoKey; move to a KMS/OS-keystore signer when the host platform offers one.
-        const pair = await crypto.subtle.generateKey(EC, true, ['sign', 'verify']);
-        const { kty, crv, x, y, d } = await crypto.subtle.exportKey('jwk', pair.privateKey);
-        const dpopKeyRef = await secrets.stage(JSON.stringify({ kty, crv, x, y, d }));
         let userId = randomId('usr_');
         if (options.providerIdentity && !anonymous) {
             let bound;
@@ -364,22 +389,36 @@ export function createClientAuth(options) {
                 bound = await options.providerIdentity.identity(issuer);
             }
             catch (error) {
-                await secrets.remove(dpopKeyRef);
                 throw providerFailure(error);
             }
-            if (!bound || bound.clientId !== clientId || typeof bound.userId !== 'string' || !bound.userId) {
-                await secrets.remove(dpopKeyRef);
+            if (!bound || bound.clientId !== clientId || typeof bound.userId !== 'string' || !bound.userId)
                 throw new AuthFailure('provider_invalid_response');
-            }
             userId = bound.userId;
         }
         if (anonymous)
-            return { userId, dpopKeyRef };
-        const winner = await transaction({ issuer }, state => own(state.identities, issuer) ?? (state.identities[issuer] = { userId, dpopKeyRef }));
-        // A concurrent start won; our staged key was never referenced by any record.
-        if (winner.dpopKeyRef !== dpopKeyRef)
-            await secrets.remove(dpopKeyRef);
-        return winner;
+            return { userId };
+        return transaction({ issuer }, state => own(state.identities, issuer) ?? (state.identities[issuer] = { userId }));
+    }
+    async function freshSessionKey(connection, operationId) {
+        const ref = await newSessionKey();
+        const current = await commit({ connectionId: connection.id }, [ref], (state, drop) => {
+            const live = own(state.connections, connection.id);
+            if (live.generation !== connection.generation || live.dpopKeyRef !== connection.dpopKeyRef) {
+                drop.push(ref);
+                return live;
+            }
+            // Legacy keys may still be referenced by another old connection, so never delete them here.
+            if (!live.needsSessionKey)
+                drop.push(live.dpopKeyRef);
+            live.dpopKeyRef = ref;
+            delete live.needsSessionKey;
+            live.generation++;
+            switchSession(live, randomId('ses_'), drop);
+            if (operationId)
+                own(state.operations, operationId).connectionGeneration = live.generation;
+            return live;
+        });
+        return current;
     }
     // Commits a change that may stage or release secrets. When our own fence check rejects it, nothing references the
     // staged secrets, so they are removed; references the committed change pushed to `drop` are removed after commit.
@@ -438,14 +477,19 @@ export function createClientAuth(options) {
     async function signedOutRenewal(connection, resource) {
         // Expiry counts from before dispatch so a slow response never extends the token's believed lifetime.
         const issuedAt = now(), operationId = randomId('op_');
+        if (connection.needsSessionKey)
+            connection = await freshSessionKey(connection);
         let token;
         try {
             token = await signedOutToken(connection.metadata, connection.userId, connection.dpopKeyRef, connection.sessionId, resource, connection.anonymous);
         }
         catch (error) {
             // The Session ended (spec 4.2): start a new signed-out one. Signed-out renewal never touches an account.
-            if (!(error instanceof AuthFailure && error.code === 'invalid_session'))
+            if (!(error instanceof AuthFailure && error.code === 'invalid_grant'))
                 throw error;
+            await transaction({ connectionId: connection.id }, state => { const live = own(state.connections, connection.id); if (live.dpopKeyRef === connection.dpopKeyRef)
+                live.needsSessionKey = true; });
+            connection = await freshSessionKey(connection);
             token = await signedOutToken(connection.metadata, connection.userId, connection.dpopKeyRef, null, resource, connection.anonymous);
         }
         const secretRef = await stageSessionToken(token.access_token);
@@ -453,7 +497,6 @@ export function createClientAuth(options) {
             const current = own(state.connections, connection.id);
             if (!current || current.generation !== connection.generation || current.status !== 'signed_out' || current.sessionId !== connection.sessionId)
                 throw new AuthFailure('state_changed', connection.id);
-            switchSession(current, token.session_id, drop);
             replaceSlot(current, resource, { secretRef, tokenType: token.token_type, dpopKeyRef: current.dpopKeyRef, scopes: [], expiresAt: issuedAt + token.expires_in * 1000, generation: current.generation }, drop);
             return finish(state, renewOperation(state, operationId, current, null, issuedAt, resource, []), 'completed');
         });
@@ -492,8 +535,9 @@ export function createClientAuth(options) {
             }
             if (refreshToken === null)
                 return await endRefresh(operationId, 'failed', 'missing_credential');
-            const sessionId = claim.connection.sessionId;
-            const fields = { grant_type: 'refresh_token', refresh_token: refreshToken, session_id: sessionId };
+            if (claim.connection.needsSessionKey)
+                claim.connection = await freshSessionKey(claim.connection, operationId);
+            const fields = { grant_type: 'refresh_token', refresh_token: refreshToken };
             if (resource !== null)
                 fields.resource = resource;
             if (scopes)
@@ -511,19 +555,29 @@ export function createClientAuth(options) {
                 return await endRefresh(operationId, 'failed', 'state_changed');
             const issuedAt = now();
             const send = () => tokenRequest(claim.connection.metadata, claim.connection.dpopKeyRef, fields, null);
-            let acquired, newSession = false;
+            let acquired;
             try {
                 try {
                     acquired = await send();
                 }
                 catch (error) {
-                    // A definite invalid_session (a 4xx OAuth code) left the Account Token unused, so this is a new request, not a resend:
-                    // without session_id the Company starts a new Session signed in to the same account (spec 4.8).
-                    if (!(error instanceof AuthFailure && error.code === 'invalid_session'))
+                    if (!(error instanceof AuthFailure && error.code === 'invalid_grant'))
                         throw error;
-                    delete fields.session_id;
-                    newSession = true;
-                    acquired = await send();
+                    // Diagnose with an assertion, never by resending a potentially consumed Account Token.
+                    try {
+                        await signedOutToken(claim.connection.metadata, claim.connection.userId, claim.connection.dpopKeyRef, claim.connection.sessionId, resource, claim.connection.anonymous);
+                    }
+                    catch (diagnosis) {
+                        if (!(diagnosis instanceof AuthFailure && diagnosis.code === 'invalid_grant')) {
+                            return await endRefresh(operationId, 'failed', diagnosis instanceof AuthFailure ? diagnosis.code : 'local_error');
+                        }
+                        await transaction({ connectionId: connection.id }, state => { const live = own(state.connections, connection.id); if (live.dpopKeyRef === claim.connection.dpopKeyRef)
+                            live.needsSessionKey = true; });
+                        claim.connection = await freshSessionKey(claim.connection, operationId);
+                        acquired = await send();
+                    }
+                    if (!acquired)
+                        return await endRefresh(operationId, 'failed', 'invalid_grant');
                 }
             }
             catch (error) {
@@ -536,11 +590,11 @@ export function createClientAuth(options) {
                 return await endRefresh(operationId, 'failed', code);
             }
             const { token, scheme } = acquired;
-            const granted = token.scope.split(' ').filter(Boolean);
+            const granted = (token.scope ?? claim.requested.join(' ')).split(' ').filter(Boolean);
             let problem = null;
             if (token.token_type !== scheme)
                 problem = 'unsupported_token_type';
-            else if (token.signed_in !== true || (newSession ? token.session_id === sessionId : token.session_id !== sessionId) || granted.some(scope => !claim.requested.includes(scope)))
+            else if (granted.some(scope => !claim.requested.includes(scope)))
                 problem = 'invalid_response';
             let refreshRef = null, accessRef = null;
             try {
@@ -560,7 +614,7 @@ export function createClientAuth(options) {
             if (problem || accessRef === null)
                 return await endRefresh(operationId, 'failed', problem ?? 'storage_error', refreshRef);
             const staged = {
-                accessRef, refreshRef, tokenType: token.token_type, sessionId: token.session_id, scopes: granted, signedIn: true, expiresAt: issuedAt + token.expires_in * 1000,
+                accessRef, refreshRef, tokenType: token.token_type, sessionId: claim.connection.sessionId, scopes: granted, signedIn: true, expiresAt: issuedAt + token.expires_in * 1000,
                 refreshExpiresAt: token.refresh_token_expires_in === undefined ? null : issuedAt + token.refresh_token_expires_in * 1000,
             };
             // Its own commit, so a crash before activation leaves the new Account Token referenced for recover (interface 4).
@@ -663,6 +717,56 @@ export function createClientAuth(options) {
         if (wait > 0n)
             throw new AuthFailure('rate_limited', connection.id, Number(wait), connection.notBefore);
     }
+    async function exchangeBearer(connection, resource, scopes) {
+        if (!connection.metadata.authorization?.grant_types_supported.includes('urn:ietf:params:oauth:grant-type:token-exchange'))
+            throw new AuthFailure('invalid_target', connection.id);
+        let subject = await credentialFor(connection.id, null, null);
+        connection = await currentConnection(connection.id);
+        const granted = publicConnection(await load({ connectionId: connection.id }), connection).scopes;
+        const requested = scopes ?? granted;
+        if (!requested.every(scope => granted.includes(scope)))
+            throw new AuthFailure('invalid_scope', connection.id);
+        if (!requested.every(scope => subject.scopes.includes(scope)))
+            subject = await renewShared(connection.id, null);
+        for (let attempt = 0;; attempt++) {
+            let value = await secrets.read(subject.secretRef);
+            if (!value) {
+                subject = await credentialFor(connection.id, null, subject.secretRef);
+                value = await secrets.read(subject.secretRef);
+            }
+            if (!value || subject.tokenType !== 'DPoP')
+                throw new AuthFailure('invalid_response', connection.id);
+            connection = await currentConnection(connection.id);
+            if (!requested.every(scope => subject.scopes.includes(scope)))
+                throw new AuthFailure('invalid_scope', connection.id);
+            const fields = { grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange', subject_token: value, subject_token_type: 'urn:ietf:params:oauth:token-type:access_token', resource };
+            if (scopes !== null)
+                fields.scope = scopes.join(' ');
+            const issuedAt = now();
+            let token;
+            try {
+                ({ token } = await tokenRequest(connection.metadata, connection.dpopKeyRef, fields, null, connection.anonymous));
+            }
+            catch (error) {
+                if (!(error instanceof AuthFailure && error.code === 'invalid_grant') || attempt !== 0)
+                    throw error;
+                // A definite subject rejection uses normal renewal/diagnosis; ambiguous exchanges never replay credentials.
+                subject = await credentialFor(connection.id, null, subject.secretRef);
+                continue;
+            }
+            const allowed = token.scope === undefined ? requested : token.scope.split(' ').filter(Boolean);
+            if (token.token_type !== 'Bearer' || token.refresh_token !== undefined || !allowed.every(scope => requested.includes(scope)))
+                throw new AuthFailure('invalid_response', connection.id);
+            const secretRef = await stageSessionToken(token.access_token);
+            return commit({ connectionId: connection.id }, [secretRef], (state, drop) => {
+                const live = own(state.connections, connection.id);
+                if (!live || live.generation !== connection.generation || live.status !== connection.status || live.sessionId !== connection.sessionId || live.dpopKeyRef !== connection.dpopKeyRef || own(live.slots, slotKey(live.sessionId, null))?.secretRef !== subject.secretRef)
+                    throw new AuthFailure('state_changed', connection.id);
+                replaceSlot(live, resource, { secretRef, tokenType: 'Bearer', dpopKeyRef: live.dpopKeyRef, scopes: allowed, expiresAt: issuedAt + token.expires_in * 1000, generation: live.generation }, drop);
+                return finish(state, renewOperation(state, randomId('op_'), live, null, issuedAt, resource, allowed), 'completed');
+            });
+        }
+    }
     // Every token-request path (internal refresh and public renew) goes through here, so all honour Retry-After.
     async function renewal(connection, resource, scopes) {
         // Local failures first: a wait is only meaningful for a connection that can still send a token request.
@@ -673,7 +777,10 @@ export function createClientAuth(options) {
         checkCooldown(await record(connection.id));
         let outcome;
         try {
-            outcome = connection.status === 'signed_out' ? await signedOutRenewal(connection, resource) : await refresh(connection, resource, scopes);
+            if (resource !== null && await resourceScheme(connection.metadata, resource) === 'Bearer')
+                outcome = await exchangeBearer(connection, resource, scopes);
+            else
+                outcome = connection.status === 'signed_out' ? await signedOutRenewal(connection, resource) : await refresh(connection, resource, scopes);
         }
         catch (error) {
             if (error instanceof AuthFailure && error.retryAfterMs !== undefined)
@@ -773,7 +880,7 @@ export function createClientAuth(options) {
         return { issuer: connection.issuer, endpoint: entry.endpoint, ...(entry.resource === undefined ? {} : { resource: entry.resource }) };
     }
     function outcomeOf(state, operation) {
-        return operation.result ?? { operationId: operation.id, status: 'pending', connection: publicConnection(state, own(state.connections, operation.connectionId)), nextAction: 'wait' };
+        return operation.result ?? { operationId: operation.id, status: operation.status, connection: publicConnection(state, own(state.connections, operation.connectionId)), ...(operation.phase === 'terminal' ? {} : { nextAction: 'wait' }) };
     }
     // The terminal result is recorded once and returned verbatim to duplicate callbacks.
     function finish(state, operation, status, extra = {}) {
@@ -843,7 +950,7 @@ export function createClientAuth(options) {
     }
     async function acceptSignIn(operationId, token, issuedAt) {
         const snapshot = await load({ operationId }), operation = own(snapshot.operations, operationId);
-        const granted = token.scope.split(' ').filter(Boolean);
+        const granted = (token.scope ?? operation.scopes.join(' ')).split(' ').filter(Boolean);
         let refreshRef = null;
         try {
             if (token.refresh_token !== undefined)
@@ -852,7 +959,7 @@ export function createClientAuth(options) {
         catch {
             return await terminate(operationId, 'uncertain', 'storage_error');
         }
-        if (token.token_type !== 'DPoP' || token.signed_in !== true || token.session_id !== operation.signInSessionId || !refreshRef ||
+        if (token.token_type !== 'DPoP' || !refreshRef ||
             !granted.length || new Set(granted).size !== granted.length || granted.some(scope => !operation.scopes.includes(scope))) {
             return commit({ operationId }, [], (state, drop) => {
                 const current = own(state.operations, operationId);
@@ -863,7 +970,7 @@ export function createClientAuth(options) {
             });
         }
         const accessRef = await stageSessionToken(token.access_token);
-        const staged = { accessRef, refreshRef, sessionId: token.session_id, scopes: granted, signedIn: true,
+        const staged = { accessRef, refreshRef, sessionId: operation.signInSessionId, scopes: granted, signedIn: true,
             expiresAt: issuedAt + token.expires_in * 1000, refreshExpiresAt: token.refresh_token_expires_in === undefined ? null : issuedAt + token.refresh_token_expires_in * 1000 };
         // Stage before activation: recovery can finish locally without exchanging a consumed credential again.
         const recorded = await transaction({ operationId }, state => {
@@ -887,6 +994,8 @@ export function createClientAuth(options) {
     }
     async function claimSignIn(operationId, executionOwner, preSend = false) {
         const snapshot = await load({ operationId }), operation = own(snapshot.operations, operationId);
+        if (operation.phase === 'prepared' && !operation.signInSessionKey)
+            return terminate(operationId, 'failed', 'restart_required');
         await currentConnection(operation.connectionId);
         return await transaction({ operationId }, state => {
             const current = own(state.operations, operationId);
@@ -943,7 +1052,7 @@ export function createClientAuth(options) {
                 throw new AuthFailure('invalid_response');
             }
             const { device_code, user_code, verification_uri, verification_uri_complete, expires_in, interval = 5 } = value ?? {};
-            const hosts = [new URL(connection.issuer).hostname, ...metadata.authorization.poppy_domains];
+            const hosts = [new URL(connection.issuer).hostname, ...metadata.authorization.protected_resources.map(resource => new URL(resource).hostname)];
             if (typeof device_code !== 'string' || !device_code || typeof user_code !== 'string' || !user_code || typeof verification_uri !== 'string' || !allowedHost(verification_uri, hosts) ||
                 (verification_uri_complete !== undefined && (typeof verification_uri_complete !== 'string' || !allowedHost(verification_uri_complete, hosts))) ||
                 typeof expires_in !== 'number' || !Number.isSafeInteger(expires_in) || expires_in <= 0 || expires_in > 86400 || typeof interval !== 'number' || !Number.isSafeInteger(interval) || interval < 1 || interval > 86400)
@@ -994,7 +1103,7 @@ export function createClientAuth(options) {
             const { operation, connection } = claim, code = await secrets.read(operation.device.codeRef);
             if (!code)
                 return await terminate(operationId, 'failed', 'missing_credential');
-            const issuedAt = now(), fields = { grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code: code, session_id: operation.signInSessionId };
+            const issuedAt = now(), fields = { grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code: code };
             if (operation.resource)
                 fields.resource = operation.resource;
             let token;
@@ -1222,18 +1331,20 @@ export function createClientAuth(options) {
                 throw new AuthFailure('no_auth');
             const issuer = metadata.authorization.issuer;
             const anonymous = input?.anonymous === true;
-            const { userId, dpopKeyRef } = await identityFor(issuer, anonymous);
+            const { userId } = await identityFor(issuer, anonymous);
+            const epoch = (await load({ issuer })).epoch;
+            const dpopKeyRef = await newSessionKey();
             const createdAt = now();
             const token = await signedOutToken(metadata, userId, dpopKeyRef, null, null, anonymous);
             const secretRef = await stageSessionToken(token.access_token);
-            const id = randomId('con_'), operationId = randomId('op_');
-            return commit({ issuer, history: true }, [secretRef], state => {
+            const id = randomId('con_'), operationId = randomId('op_'), sessionId = randomId('ses_');
+            return commit({ issuer, history: true }, [secretRef, dpopKeyRef], state => {
                 // A reset or competing identity since we signed means this session belongs to no current identity.
-                if (!anonymous && own(state.identities, issuer)?.dpopKeyRef !== dpopKeyRef)
+                if (state.epoch !== epoch || (!anonymous && own(state.identities, issuer)?.userId !== userId))
                     throw new AuthFailure('state_changed');
                 const connection = {
-                    id, domain, issuer, metadata, userId, dpopKeyRef, sessionId: token.session_id, generation: 1, status: 'signed_out', grantId: null,
-                    slots: { [slotKey(token.session_id, null)]: { secretRef, tokenType: 'DPoP', dpopKeyRef, scopes: [], expiresAt: createdAt + token.expires_in * 1000, generation: 1 } },
+                    id, domain, issuer, metadata, userId, dpopKeyRef, sessionId, generation: 1, status: 'signed_out', grantId: null,
+                    slots: { [slotKey(sessionId, null)]: { secretRef, tokenType: 'DPoP', dpopKeyRef, scopes: [], expiresAt: createdAt + token.expires_in * 1000, generation: 1 } },
                     ...(anonymous ? { anonymous: true } : {}),
                 };
                 state.connections[id] = connection;
@@ -1263,13 +1374,10 @@ export function createClientAuth(options) {
             const connection = await currentConnection(connectionId), state = await load({ connectionId });
             const grantedScopes = publicConnection(state, connection).scopes;
             const grant = connection.grantId ? own(state.grants, connection.grantId) : undefined;
-            const methods = ['direct', 'device', 'mediated'].flatMap(method => {
-                const supported = connection.metadata.document.auth?.[method];
-                return supported ? [{ method, scopes: [...supported.scopes] }] : [];
-            });
+            const methods = signInMethods(connection.metadata);
             const required = [...new Set(requiredScopes)], missingScopes = required.filter(scope => !grantedScopes.includes(scope));
             return { requiredScopes: required, grantedScopes, missingScopes, sufficient: connection.status === 'signed_in' && grant?.status === 'active' && (grant.expiresAt === null || grant.expiresAt > now()) && !missingScopes.length,
-                methods, organization: { ...connection.metadata.document.organization } };
+                methods, scopeDescriptions: { ...connection.metadata.document.auth?.scopes }, organization: { ...connection.metadata.document.organization } };
         },
         async beginSignIn(connectionId, input) {
             let found = await currentConnection(connectionId);
@@ -1282,7 +1390,7 @@ export function createClientAuth(options) {
             const method = input?.method ?? 'direct';
             if (!['direct', 'device', 'mediated'].includes(method))
                 throw new AuthFailure('unsupported_method', connectionId);
-            const supported = found.metadata.document.auth?.[method];
+            const supported = signInMethods(found.metadata).find(item => item.method === method);
             const authorizationEndpoint = found.metadata.authorization?.authorization_endpoint;
             if (!supported || (method === 'direct' && !authorizationEndpoint) || (method === 'device' && !found.metadata.authorization?.device_authorization_endpoint))
                 throw new AuthFailure(`${method}_unavailable`, connectionId);
@@ -1297,7 +1405,7 @@ export function createClientAuth(options) {
             checkCooldown(found);
             if (method === 'mediated' && !options.trustedInput)
                 throw new AuthFailure('trusted_input_required', connectionId);
-            if (method === 'direct' && (typeof redirectUri !== 'string' || !options.redirectUris.includes(redirectUri) || !URL.canParse(redirectUri) || !safeHttps(redirectUri) || new URL(redirectUri).hostname !== new URL(clientId).hostname || CALLBACK_PARAMS.some(name => new URL(redirectUri).searchParams.has(name))))
+            if (method === 'direct' && (typeof redirectUri !== 'string' || !registeredRedirect(redirectUri, options.redirectUris, clientId) || CALLBACK_PARAMS.some(name => new URL(redirectUri).searchParams.has(name))))
                 throw new AuthFailure('invalid_redirect', connectionId);
             // The host derives this from its authenticated browser session; a short value would be guessable.
             if (method === 'direct' && (typeof browserBinding !== 'string' || browserBinding.length < 22))
@@ -1306,6 +1414,10 @@ export function createClientAuth(options) {
             const resource = found.metadata.document.agent?.protocols.find(protocol => protocol.type === 'poppy')?.resource ?? null;
             if (await resourceScheme(found.metadata, resource) !== 'DPoP')
                 throw new AuthFailure('invalid_target', connectionId);
+            if (found.needsSessionKey && found.status === 'uncertain') {
+                found = await freshSessionKey(found);
+                await signedOutToken(found.metadata, found.userId, found.dpopKeyRef, found.sessionId, resource, found.anonymous);
+            }
             // The code exchange names this Session (spec 4.5). A stale credential means it may have ended, so renew first,
             // which replaces an ended Session; a failed renewal leaves the Session as it was for the issuer to judge.
             const renew = () => credentialFor(connectionId, resource, null).catch(error => { if (!(error instanceof AuthFailure))
@@ -1323,6 +1435,7 @@ export function createClientAuth(options) {
                 throw new AuthFailure('sign_in_unavailable', connectionId);
             const state = b64(crypto.getRandomValues(new Uint8Array(32)));
             const verifier = b64(crypto.getRandomValues(new Uint8Array(32)));
+            const sessionKey = (await loadDpopKey(connection.dpopKeyRef)).thumbprint;
             const verifierRef = method === 'direct' ? await secrets.stage(verifier) : null;
             const createdAt = now(), operationId = randomId('op_');
             const outcome = await commit({ connectionId, history: true }, [verifierRef], draft => {
@@ -1333,7 +1446,7 @@ export function createClientAuth(options) {
                 const operation = draft.operations[operationId] = {
                     epoch: draft.epoch, id: operationId, kind: 'sign_in', connectionId, connectionGeneration: current.generation, grantId: current.grantId, grantGeneration: null,
                     phase: 'prepared', status: 'pending', createdAt, expiresAt: createdAt + SIGN_IN_MS, resource, scopes: [...scopes],
-                    method, signInSessionId: connection.sessionId, requiredExistingScopes: requiredExistingScopes ?? requirement.grantedScopes,
+                    method, signInSessionId: connection.sessionId, signInSessionKey: sessionKey, requiredExistingScopes: requiredExistingScopes ?? requirement.grantedScopes,
                     direct: method === 'direct' ? { stateHash: sha256(state), verifierRef: verifierRef, browserHash: sha256(browserBinding), redirectUri: redirectUri, issuer: current.issuer, clientId, sessionId: connection.sessionId } : null,
                     staged: null, result: null,
                 };
@@ -1344,7 +1457,7 @@ export function createClientAuth(options) {
             if (method === 'mediated')
                 return { outcome: await continueMediated(outcome.operationId) };
             const url = new URL(authorizationEndpoint);
-            const query = { response_type: 'code', client_id: clientId, redirect_uri: redirectUri, scope: scopes.join(' '), state, code_challenge: sha256(verifier), code_challenge_method: 'S256' };
+            const query = { response_type: 'code', client_id: clientId, redirect_uri: redirectUri, scope: scopes.join(' '), state, code_challenge: sha256(verifier), code_challenge_method: 'S256', dpop_jkt: sessionKey };
             for (const [name, value] of Object.entries(query))
                 url.searchParams.set(name, value);
             if (resource !== null)
@@ -1366,6 +1479,8 @@ export function createClientAuth(options) {
                 if (!found || !direct || direct.browserHash !== browserHash || !redirectMatches(base, new URL(direct.redirectUri)) || params.iss !== direct.issuer)
                     throw new AuthFailure('invalid_callback');
                 checkCooldown(await record(found.connectionId));
+                if (found.phase === 'prepared' && !found.signInSessionKey)
+                    return terminate(found.id, 'failed', 'restart_required');
                 const operationId = found.id;
                 const verifier = found.phase === 'prepared' && params.code !== undefined ? await secrets.read(direct.verifierRef) : null;
                 const at = now();
@@ -1377,7 +1492,7 @@ export function createClientAuth(options) {
                     if (operation.phase !== 'prepared')
                         return outcomeOf(state, operation);
                     const connection = own(state.connections, operation.connectionId);
-                    if (connection.generation !== operation.connectionGeneration)
+                    if (connection.generation !== operation.connectionGeneration || connection.sessionId !== operation.signInSessionId)
                         return finish(state, operation, 'failed', { error: 'state_changed' });
                     if (at >= operation.expiresAt)
                         return finish(state, operation, 'expired');
@@ -1395,7 +1510,7 @@ export function createClientAuth(options) {
                     return claim;
                 }
                 const { connection, operation } = claim;
-                const fields = { grant_type: 'authorization_code', code: params.code, redirect_uri: direct.redirectUri, code_verifier: verifier, session_id: direct.sessionId };
+                const fields = { grant_type: 'authorization_code', code: params.code, redirect_uri: direct.redirectUri, code_verifier: verifier };
                 if (operation.resource !== null)
                     fields.resource = operation.resource;
                 const issuedAt = now();
@@ -1477,6 +1592,8 @@ export function createClientAuth(options) {
                             result = activateSignIn(state, operation, drop);
                         else if (operation.phase !== 'prepared')
                             result = finish(state, operation, 'uncertain', { error: 'lost_response' });
+                        else if (operation.kind === 'sign_in' && !operation.signInSessionKey)
+                            result = finish(state, operation, 'failed', { error: 'restart_required' });
                         else if (at >= operation.expiresAt)
                             result = finish(state, operation, 'expired');
                         else
@@ -1550,7 +1667,7 @@ export function createClientAuth(options) {
         },
         async joinBrowser(connectionId, returnTo, controller) {
             const connection = await currentConnection(connectionId), endpoint = connection.metadata.document.web?.browser_session_endpoint;
-            if (!endpoint || !connection.sessionId || connection.status === 'disconnected' || connection.status === 'uncertain' || controller?.kind !== 'agent-controlled' || typeof controller.postForm !== 'function')
+            if (!endpoint || !connection.sessionId || connection.status === 'disconnected' || connection.status === 'uncertain' || controller?.kind !== 'agent-controlled' || typeof controller.loadJoinForm !== 'function' || typeof controller.postForm !== 'function' || typeof controller.navigate !== 'function')
                 throw new AuthFailure('invalid_browser', connectionId);
             try {
                 browserDestination(returnTo, connection.metadata.document.organization.domain);
@@ -1559,25 +1676,21 @@ export function createClientAuth(options) {
                 throw new AuthFailure('invalid_target', connectionId);
             }
             const key = await loadDpopKey(connection.dpopKeyRef);
-            let value;
-            if (options.assertions && !connection.anonymous) {
-                let result;
-                try {
-                    result = await options.assertions.assert({ purpose: 'browser', operationId: randomId('op_'), issuer: connection.issuer, sessionId: connection.sessionId, returnTo });
-                }
-                catch (error) {
-                    throw providerFailure(error, connectionId);
-                }
-                value = providerAssertion(result, connectionId);
-            }
-            else
-                value = await signIdentity({ typ: 'poppy-browser+jwt' }, { ...assertionClaims(connection.userId, endpoint), session_id: connection.sessionId, return_to: returnTo }, key.thumbprint);
             try {
-                await controller.postForm({ url: endpoint, fields: { assertion: value }, validateRedirect(status, location) {
-                        if (status !== 303 || location !== returnTo)
+                const { code } = await controller.loadJoinForm(endpoint);
+                if (typeof code !== 'string' || !code || code.length > 256)
+                    throw new Error('code');
+                const live = await currentConnection(connectionId);
+                if (live.generation !== connection.generation || live.dpopKeyRef !== connection.dpopKeyRef || live.status !== connection.status)
+                    throw new Error('state changed');
+                await controller.postForm({ url: endpoint, fields: { code, proof: await proof(key, 'POST', endpoint, undefined, code) }, validateRedirect(status, location) {
+                        if (status !== 303)
                             throw new AuthFailure('invalid_browser_redirect', connectionId);
-                        return returnTo;
+                        const destination = new URL(location, endpoint).href;
+                        browserDestination(destination, connection.metadata.document.organization.domain);
+                        return destination;
                     } });
+                await controller.navigate(returnTo);
             }
             catch {
                 throw new AuthFailure('browser_failed', connectionId);
@@ -1589,8 +1702,23 @@ export function createClientAuth(options) {
             if (!endpoint)
                 throw new AuthFailure('feedback_unavailable', connectionId);
             const response = await sendAuthorized(connectionId, new Request(endpoint, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(report) }), { issuer: connection.issuer, endpoint }, [], 'DPoP', false);
-            if (response.status !== 202 || (await response.text()) !== '')
-                throw new AuthFailure('feedback_failed', connectionId);
+            try {
+                const text = await response.text();
+                if (response.status === 202 && text === '')
+                    return;
+                if (response.status === 200)
+                    return parseAlternative(parseJson(text), connection.metadata.document);
+            }
+            catch { /* Do not expose company response/parser details. */ }
+            throw new AuthFailure('feedback_failed', connectionId);
+        },
+        async excludedTasks(connectionId) {
+            const connection = await currentConnection(connectionId);
+            if (!connection.metadata.document.excluded_tasks)
+                return [];
+            if (!options.metadata.resolveExcludedTasks)
+                throw new AuthFailure('excluded_tasks_unavailable', connectionId);
+            return options.metadata.resolveExcludedTasks(connection.metadata.document);
         },
         async authorizedFetch(connectionId, request, target, requiredScopes = []) {
             const connection = await currentConnection(connectionId), expected = targetOf(connection);