@poppykit/client 0.4.1 → 0.6.0

package/dist/sqlite.d.ts

@@ -1,3 +1,4 @@
+import type { BusinessAttemptStore } from './operations.js';
 export { SqliteAuthStore } from './auth/sqlite-store.js';
 import type { ConversationKey, ConversationStore } from './conversation-store.js';
 import type { ConsumerCheckpoint, OutboundRecord } from './conversation.js';
@@ -18,3 +19,14 @@ export declare class SqliteConversationStore implements ConversationStore {
     advanceCheckpoint(key: ConversationKey, row: ConsumerCheckpoint, from: readonly (string | undefined)[]): Promise<void>;
     resetCheckpoint(key: ConversationKey, conversation: string, name: string): Promise<void>;
 }
+/** Separate from authentication lifecycle operations. Never discard uncertain business attempts. */
+export declare class SqliteBusinessAttemptStore implements BusinessAttemptStore {
+    readonly namespace: string;
+    private readonly db;
+    constructor(path: string, namespace: string);
+    close(): void;
+    pending(after: string | undefined, limit: number): Promise<string[]>;
+    transaction<T>(id: string, action: (slot: {
+        record?: import('./operations.js').BusinessAttempt;
+    }) => T): Promise<T>;
+}

package/dist/sqlite.js

@@ -1,3 +1,4 @@
+import { validateJson } from './protocol/wire.js';
 import { DatabaseSync } from 'node:sqlite';
 import { initializeSqlite } from './sqlite-init.js';
 export { SqliteAuthStore } from './auth/sqlite-store.js';
@@ -78,3 +79,44 @@ export class SqliteConversationStore {
         this.db.prepare('DELETE FROM checkpoints WHERE connection=? AND issuer=? AND endpoint=? AND conversation=? AND name=?').run(key.connectionId, key.issuer, key.endpoint, conversation, name);
     }
 }
+/** Separate from authentication lifecycle operations. Never discard uncertain business attempts. */
+export class SqliteBusinessAttemptStore {
+    namespace;
+    db;
+    constructor(path, namespace) {
+        this.namespace = namespace;
+        this.db = new DatabaseSync(path);
+        initializeSqlite(this.db, () => this.db.exec(`PRAGMA busy_timeout=5000; PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL;
+      CREATE TABLE IF NOT EXISTS business_attempts (ns TEXT NOT NULL, id TEXT NOT NULL, body TEXT NOT NULL, PRIMARY KEY(ns,id));`));
+    }
+    close() { this.db.close(); }
+    async pending(after, limit) {
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000)
+            throw new TypeError('business recovery limit');
+        return this.db.prepare("SELECT id FROM business_attempts WHERE ns=? AND id>? AND json_extract(body,'$.phase') IN ('pending_consent','consenting','approved','uncertain') ORDER BY id LIMIT ?").all(this.namespace, after ?? '', limit).map(row => row.id);
+    }
+    async transaction(id, action) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const row = this.db.prepare('SELECT body FROM business_attempts WHERE ns=? AND id=?').get(this.namespace, id);
+            const slot = { record: row ? JSON.parse(row.body) : undefined };
+            if (slot.record && slot.record.version !== 1)
+                throw new Error('unsupported business attempt version');
+            const result = action(slot);
+            if (result && typeof result.then === 'function')
+                throw new TypeError('async business attempt transaction');
+            if (slot.record) {
+                if (slot.record.version !== 1 || slot.record.id !== id)
+                    throw new TypeError('business attempt binding');
+                validateJson(slot.record);
+                this.db.prepare('INSERT INTO business_attempts VALUES (?,?,?) ON CONFLICT(ns,id) DO UPDATE SET body=excluded.body').run(this.namespace, id, JSON.stringify(slot.record));
+            }
+            this.db.exec('COMMIT');
+            return structuredClone(result);
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+}

package/examples/operations.mjs

@@ -0,0 +1,25 @@
+// Synthetic Company flow. The trusted terminal asks each time; --self-check always declines.
+import assert from 'node:assert/strict';
+import {mkdtemp,rm} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import {join} from 'node:path';
+import {createInterface} from 'node:readline/promises';
+import {createOperationClient} from '../dist/index.js';
+import {SqliteBusinessAttemptStore} from '../dist/sqlite.js';
+const dir=await mkdtemp(join(tmpdir(),'poppy-operation-example-')),store=new SqliteBusinessAttemptStore(join(dir,'attempts.db'),'synthetic-user');
+const selfCheck=process.argv.includes('--self-check');let sends=0;
+try{
+  const client=createOperationClient({store,context:async()=>({companyId:'https://example.com',companyName:'Example Company',clientId:'https://agent.example/client',userId:'synthetic',authority:'session:synthetic',operations:true}),
+    checkTerms:async(request,operation)=>operation.terms?.order_id===request.arguments?.order_id?[]:['Order differs from your request.'],
+    consent:{confirm:async({attemptId,companyId,companyName,summary,terms,differences})=>{
+      if(selfCheck)return 'decline';
+      if(!process.stdin.isTTY||!process.stderr.isTTY)throw new Error('Trusted terminal required');
+      const saved=await client.get(attemptId),display=JSON.stringify({companyId,companyName,summary,terms,differences,request:saved.request,expiresAt:saved.operation.expires_at},null,2).replace(/[\u007f-\u009f\u2028-\u202e\u2066-\u2069]/g,c=>'\\u'+c.charCodeAt(0).toString(16).padStart(4,'0'));
+      const terminal=createInterface({input:process.stdin,output:process.stderr});
+      try{const answer=await terminal.question(`${display}\nApprove these exact terms? Type yes: `);return answer==='yes'?'approve':'decline';}finally{terminal.close();}
+    }},send:async()=>{sends++;return {kind:'completed',result:{synthetic:true,done:true}};}});
+  await client.receiveMcp('exchange-order-one',{channel:'mcp',url:'https://example.com/mcp',name:'exchange',arguments:{order_id:'one'}},{isError:true,structuredContent:{operation:{operation_id:'exchange_one',revision:'revision_one',summary:'Exchange order one for the blue jacket for $70.',terms:{order_id:'one',amount:'70.00'},expires_at:new Date(Date.now()+900000).toISOString()}}});
+  const decision=await client.requestConsent('exchange-order-one');
+  if(decision.phase==='approved')console.log((await client.retry(decision.id)).phase);else console.log(decision.phase);
+  if(selfCheck){assert.equal(decision.phase,'declined');assert.equal(sends,0);}
+}finally{store.close();await rm(dir,{recursive:true,force:true});}

package/examples/quickstart.mjs

@@ -6,8 +6,9 @@ const domain = selfCheck ? 'company.example' : process.argv[2];
 if (!domain) throw new Error('usage: node examples/quickstart.mjs DOMAIN|--self-check');
 const transport = selfCheck ? {
   async fetch(request) {
+    if (request.url === 'https://company.example/.well-known/oauth-protected-resource') return new Response(null, {status:404});
     assert.equal(request.url, 'https://company.example/.well-known/poppy.json');
-    return Response.json({ protocol_version: '0.2', organization: { name: 'Example Company', domain }, web: {} });
+    return Response.json({ protocol_version: '0.3', organization: { name: 'Example Company', domain }, web: {} });
   },
 } : createNodeTransport();
 try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poppykit/client",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "private": false,
   "description": "Personal Agent Protocol client SDK",
   "repository": {
@@ -43,7 +43,9 @@
     "RELEASING.md",
     "examples",
     "LICENSE",
-    "migrations"
+    "migrations",
+    "CONFORMANCE.md",
+    "OPERATIONS.md"
   ],
   "exports": {
     ".": {
@@ -80,6 +82,7 @@
     }
   },
   "dependencies": {
+    "@agentsig/structured-fields": "0.1.1",
     "jose": "6.2.12"
   },
   "license": "MIT",