@poppykit/server 0.3.1 → 0.4.0

package/dist/protocol/wire.js

@@ -50,7 +50,26 @@ function positive(value, field) {
 export function parseMessage(value, options = {}) {
     const message = { ...object(value, 'message') };
     id(message.id, 'message.id');
-    member(message.sender, ['agent', 'human'], 'message.sender');
+    const author = object(message.author, 'message.author');
+    member(author.type, ['agent', 'human'], 'message.author.type');
+    if ('sender' in message)
+        throw new ValidationError('message.sender');
+    for (const key of ['id', 'name', 'image'])
+        if (key in author) {
+            if (!options.company && !(options.recorded && message.role === 'company'))
+                throw new ValidationError('message.author.' + key);
+            string(author[key], 'message.author.' + key);
+        }
+    if ('image' in author) {
+        try {
+            const url = new URL(author.image);
+            if (url.protocol !== 'https:' || url.username || url.password)
+                throw 0;
+        }
+        catch {
+            throw new ValidationError('message.author.image');
+        }
+    }
     if (!['text', 'data', 'context'].some(key => key in message))
         throw new ValidationError('message.content');
     if ('text' in message)
@@ -126,9 +145,9 @@ export function parseEvent(value) {
             member(event.responder, ['agent', 'human'], 'event.responder');
             break;
         case 'authorization':
-            member(event.error, ['sign_in_required', 'insufficient_scope'], 'event.error');
-            if (event.error === 'insufficient_scope' || 'scope' in event)
-                string(event.scope, 'event.scope', false);
+            member(event.error, ['insufficient_scope'], 'event.error');
+            if (!/^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$/.test(string(event.scope, 'event.scope')))
+                throw new ValidationError('event.scope');
             break;
         case 'user_requested':
             string(event.reason, 'event.reason', false);
@@ -161,10 +180,12 @@ export function parseEventPage(value, requestCursor) {
 export function parseTokenResponse(value) {
     const token = object(value);
     string(token.access_token, 'access_token');
-    string(token.session_id, 'session_id');
-    string(token.scope, 'scope', false);
+    if ('scope' in token) {
+        const scope = string(token.scope, 'scope', false);
+        if (scope !== '' && (!/^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$/.test(scope) || new Set(scope.split(' ')).size !== scope.split(' ').length))
+            throw new ValidationError('scope');
+    }
     member(token.token_type, ['DPoP', 'Bearer'], 'token_type');
-    member(token.signed_in, [true, false], 'signed_in');
     positive(token.expires_in, 'expires_in');
     if ('refresh_token' in token)
         string(token.refresh_token, 'refresh_token');
@@ -215,6 +236,11 @@ export function parseAssertionClaims(value) {
     const claims = object(value, 'claims');
     for (const key of ['iss', 'sub', 'aud', 'jti'])
         string(claims[key], key);
+    if ('agent_id' in claims) {
+        string(claims.agent_id, 'agent_id');
+        if (claims.agent_id.length > 256)
+            throw new ValidationError('agent_id');
+    }
     // 128 random bits is at least 16 bytes; cap length since jti lands in the replay store. Encoding is not constrained.
     if (claims.jti.length < 16 || claims.jti.length > 256)
         throw new ValidationError('jti');

package/dist/reference-auth/index.d.ts

@@ -1,13 +1,14 @@
 import type { MetadataResolver } from '../network/discovery.js';
 import type { IssuerStore, IssuerSelection } from './store.js';
 import type { AuthorityCoordinator, ExternalAuthorityAdapter } from '../auth/authority.js';
-import type { BrowserSessionAuthority } from '../browser.js';
+import type { BrowserSession, BrowserSessionAuthority } from '../browser.js';
 export type { IssuerStore, IssuerSelection };
 export { createMetadataResolver } from '../network/discovery.js';
 export { createNodeTransport } from '../network/transport.js';
 interface SessionRecord {
     clientId: string;
     userId: string;
+    agentId?: string;
     version: number;
     createdAt: number;
     expiresAt: number;
@@ -33,6 +34,7 @@ interface AccessTokenRecord {
     expiresAt: number;
 }
 interface AuthorizationRecord {
+    sessionKey: string;
     clientId: string;
     redirectUri: string;
     state: string;
@@ -47,6 +49,7 @@ interface AuthorizationRecord {
     };
 }
 interface CodeRecord {
+    sessionKey: string;
     clientId: string;
     redirectUri: string;
     codeChallenge: string;
@@ -58,6 +61,7 @@ interface CodeRecord {
 }
 export type SignInRecord = {
     kind: 'device';
+    sessionKey: string | null;
     clientId: string;
     scopes: string[];
     expiresAt: number;
@@ -132,9 +136,10 @@ export interface IssuerState {
         pending: number;
         pendingForClient: number;
     };
-    version: 3;
+    version: 3 | 4;
     generation: string;
     sessions: Record<string, SessionRecord>;
+    sessionKeys: Record<string, string>;
     grants: Record<string, GrantRecord>;
     refreshTokens: Record<string, string>;
     authorizations: Record<string, AuthorizationRecord>;
@@ -152,8 +157,8 @@ export interface ReferenceIssuerOptions {
     tokenEndpoint: string;
     revocationEndpoint: string;
     authorizationEndpoint?: string;
-    poppyDomains: string[];
-    directScopes: string[];
+    protectedResources: string[];
+    supportedScopes: string[];
     resources?: string[];
     mcpResources?: {
         url: string;
@@ -177,7 +182,6 @@ export interface ReferenceIssuerOptions {
     device?: {
         endpoint: string;
         verificationUri: string;
-        scopes: string[];
         intervalSeconds?: number;
     };
     mediated?: MediatedOptions;
@@ -197,6 +201,11 @@ export type AuthorizationDecision = {
 };
 export interface ReferenceIssuer {
     browserSessions: BrowserSessionAuthority;
+    sessionForKey(binding: {
+        clientId: string;
+        userId: string;
+        sessionKey: string;
+    }): Promise<BrowserSession>;
     token(request: Request): Promise<Response>;
     revoke(request: Request): Promise<Response>;
     beginAuthorization(request: Request, browserBinding: string): Promise<AuthorizationView>;
@@ -214,5 +223,7 @@ export declare class AuthorizationError extends Error {
     readonly redirectTo?: URL | undefined;
     constructor(code: string, redirectTo?: URL | undefined);
 }
+/** Run once over the complete namespace, under the adapter's writer lock. */
+export declare function upgradeIssuerState(state: IssuerState): void;
 export declare function initialIssuerState(): IssuerState;
 export declare function createReferenceIssuer(options: ReferenceIssuerOptions): ReferenceIssuer;

package/dist/reference-auth/index.js

@@ -1,6 +1,8 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { calculateJwkThumbprint, compactVerify, createLocalJWKSet, errors } from 'jose';
 import { ValidationError, parseAssertionClaims, parseJson } from '../protocol/wire.js';
+import { companyScopes } from '../network/discovery.js';
+import { registeredRedirect } from '../network/redirect.js';
 import { secureUrl } from '../network/transport.js';
 import { own } from '../store.js';
 import { clientRevisionKey, accountRevisionKey } from './store.js';
@@ -41,12 +43,31 @@ function callback(redirectUri, fields) {
 }
 // Shape changes bump the version; other versions are refused instead of misread.
 function checked(state) {
+    upgradeIssuerState(state);
+    return state;
+}
+/** Run once over the complete namespace, under the adapter's writer lock. */
+export function upgradeIssuerState(state) {
+    if (state.version === 4)
+        return;
     if (state.version !== 3)
         throw new Error('unsupported issuer state version');
-    return state;
+    // Old keys could name several Sessions. Never guess ownership; end those Sessions, keeping IDs and grant lineage.
+    state.sessionKeys = {};
+    for (const token of Object.values(state.accessTokens))
+        if (token.jkt)
+            state.sessionKeys[token.jkt] = '';
+    for (const session of Object.values(state.sessions))
+        session.expiresAt = 0;
+    state.authorizations = {};
+    state.codes = {};
+    for (const [id, row] of Object.entries(state.signIns))
+        if (row.kind === 'device' || row.kind === 'mediated')
+            delete state.signIns[id];
+    state.version = 4;
 }
 export function initialIssuerState() {
-    return { version: 3, generation: random(16), sessions: {}, grants: {}, refreshTokens: {}, authorizations: {}, codes: {}, signIns: {}, accessTokens: {}, replay: {}, nonces: [] };
+    return { version: 4, generation: random(16), sessions: {}, sessionKeys: {}, grants: {}, refreshTokens: {}, authorizations: {}, codes: {}, signIns: {}, accessTokens: {}, replay: {}, nonces: [] };
 }
 class TokenError extends Error {
     code;
@@ -107,6 +128,14 @@ export function createReferenceIssuer(options) {
         throw new TypeError('issuer');
     secureUrl(options.tokenEndpoint);
     secureUrl(options.revocationEndpoint);
+    if (!options.protectedResources.length)
+        throw new TypeError('protectedResources');
+    options.protectedResources.forEach(value => secureUrl(value));
+    companyScopes(options.supportedScopes, true);
+    if (options.authorizationEndpoint)
+        secureUrl(options.authorizationEndpoint);
+    if (options.mediated && companyScopes(options.mediated.scopes).some(scope => !options.supportedScopes.includes(scope)))
+        throw new TypeError('mediated.scopes');
     const positive = (value, fallback, name) => {
         const result = value ?? fallback;
         if (!Number.isSafeInteger(result) || result <= 0)
@@ -124,7 +153,7 @@ export function createReferenceIssuer(options) {
     if (options.device) {
         secureUrl(options.device.endpoint);
         const url = secureUrl(options.device.verificationUri);
-        const hosts = [new URL(issuer).hostname, ...options.poppyDomains];
+        const hosts = [new URL(issuer).hostname, ...options.protectedResources.map(resource => new URL(resource).hostname)];
         if (!hosts.some(host => url.hostname === host || url.hostname.endsWith(`.${host}`)))
             throw new TypeError('verificationUri');
     }
@@ -277,9 +306,8 @@ export function createReferenceIssuer(options) {
         target.accountId = accountId;
         target.grantId = grantId;
         target.expiresAt = at + sessionMs;
-        const bearer = isBearerResource(resource);
-        draft.accessTokens[tokenHash(accessToken)] = { sessionId, grantId, scopes: [...scopes], resource: resource ?? null, jkt: bearer ? '' : jkt, expiresAt: at + lifetimeMs };
-        return { grantId, body: { access_token: accessToken, token_type: bearer ? 'Bearer' : 'DPoP', expires_in: lifetimeSeconds, refresh_token: refreshToken, refresh_token_expires_in: Math.floor(accountLifetimeMs / 1000), scope: scopes.join(' '), session_id: sessionId, signed_in: true } };
+        draft.accessTokens[tokenHash(accessToken)] = { sessionId, grantId, scopes: [...scopes], resource: resource ?? null, jkt, expiresAt: at + lifetimeMs };
+        return { grantId, body: { access_token: accessToken, token_type: 'DPoP', expires_in: lifetimeSeconds, refresh_token: refreshToken, refresh_token_expires_in: Math.floor(accountLifetimeMs / 1000), scope: scopes.join(' ') } };
     }
     function signInScopes(scope, allowed) {
         const scopes = scope?.split(' ') ?? [];
@@ -303,7 +331,7 @@ export function createReferenceIssuer(options) {
         if (!options.device)
             throw new TokenError('unsupported_grant_type');
         const params = await readParams(request), { clientId, clientAssertion } = clientCredentials(params);
-        const scopes = signInScopes(params.get('scope'), options.device.scopes), { client } = await authenticateClient(clientId, clientAssertion);
+        const scopes = signInScopes(params.get('scope'), options.supportedScopes), { client } = await authenticateClient(clientId, clientAssertion);
         const { generation } = await read(), userCode = random(8).toUpperCase(), deviceCode = `${userCode}.${random(32)}`, id = tokenHash(userCode);
         const replayKey = `assertion ${clientId} ${client.jti}`;
         await commit({ kind: 'sign_in', ids: [id, clientRevisionKey(clientId)], clientId, replayKeys: [replayKey], at: now() }, draft => {
@@ -313,7 +341,7 @@ export function createReferenceIssuer(options) {
             if ((draft.limits?.pending ?? pending.length) >= maxPending || (draft.limits?.pendingForClient ?? pending.filter(row => row.clientId === clientId).length) >= maxPendingPerClient)
                 throw new TokenError('rate_limited', { 'Retry-After': '60' });
             consumeReplay(draft, replayKey, client.exp * 1000);
-            draft.signIns[id] = { kind: 'device', clientId, scopes, expiresAt: now() + AUTHORIZATION_MS, deviceHash: tokenHash(deviceCode), status: 'pending', nextPollAt: now() + deviceIntervalMs, intervalMs: deviceIntervalMs, revision: revision(draft, clientRevisionKey(clientId)) };
+            draft.signIns[id] = { kind: 'device', sessionKey: null, clientId, scopes, expiresAt: now() + AUTHORIZATION_MS, deviceHash: tokenHash(deviceCode), status: 'pending', nextPollAt: now() + deviceIntervalMs, intervalMs: deviceIntervalMs, revision: revision(draft, clientRevisionKey(clientId)) };
         });
         const complete = new URL(options.device.verificationUri);
         complete.searchParams.set('user_code', userCode);
@@ -322,29 +350,34 @@ export function createReferenceIssuer(options) {
     async function pollDevice(request, params) {
         if (!options.device)
             throw new TokenError('unsupported_grant_type');
-        const { clientId, clientAssertion } = clientCredentials(params), code = params.get('device_code'), sessionId = params.get('session_id'), resource = params.get('resource');
-        if (!code || !sessionId || params.has('assertion'))
+        const { clientId, clientAssertion } = clientCredentials(params), code = params.get('device_code'), resource = params.get('resource');
+        if (!code || params.has('session_id') || params.has('assertion'))
             throw new TokenError('invalid_request');
-        if (resource !== undefined && !resources.includes(resource))
+        if (resource !== undefined && (!resources.includes(resource) || isBearerResource(resource)))
             throw new TokenError('invalid_target');
-        const state = await read(), bearer = isBearerResource(resource);
-        const proof = bearer ? { jkt: '', claims: { iat: now() / 1000, jti: '', nonce: undefined } } : await verifyDpopProof(request.headers.get('dpop'), { method: 'POST', url: options.tokenEndpoint, nowMs: now() });
-        if (!bearer && requireNonce && !state.nonces.some(nonce => nonce.value === proof.claims.nonce && nonce.expiresAt > now()))
+        const state = await read();
+        const proof = await verifyDpopProof(request.headers.get('dpop'), { method: 'POST', url: options.tokenEndpoint, nowMs: now() });
+        if (requireNonce && !state.nonces.some(nonce => nonce.value === proof.claims.nonce && nonce.expiresAt > now()))
             throw new TokenError('use_dpop_nonce', { 'DPoP-Nonce': await currentNonce(state) });
         const { client, keys } = await authenticateClient(clientId, clientAssertion);
         for (const key of keys().keys)
             if (await calculateJwkThumbprint(key).catch(() => null) === proof.jkt)
                 throw new TokenError('invalid_dpop_proof');
         const id = tokenHash(code.split('.')[0]), replayKey = `assertion ${clientId} ${client.jti}`, proofKey = `proof ${proof.jkt} ${proof.claims.jti}`;
-        const body = await commit({ kind: 'sign_in', ids: [id], sessionId, clientId, replayKeys: [replayKey, proofKey], at: now() }, draft => {
+        const body = await commit({ kind: 'sign_in', ids: [id], sessionKey: proof.jkt, clientId, replayKeys: [replayKey, proofKey], at: now() }, draft => {
             if (draft.generation !== state.generation || !current(client))
                 throw new TokenError('invalid_client');
             consumeReplay(draft, replayKey, client.exp * 1000);
-            if (!bearer)
-                consumeReplay(draft, proofKey, (proof.claims.iat + PROOF_WINDOW_SECONDS) * 1000);
+            consumeReplay(draft, proofKey, (proof.claims.iat + PROOF_WINDOW_SECONDS) * 1000);
             const record = own(draft.signIns, id);
             if (!record || record.kind !== 'device' || record.clientId !== clientId || record.deviceHash !== tokenHash(code))
                 return { error: 'invalid_grant' };
+            if (record.sessionKey === undefined || (record.sessionKey !== null && record.sessionKey !== proof.jkt))
+                return { error: 'invalid_grant' };
+            const sessionId = own(draft.sessionKeys, proof.jkt), session = sessionId ? own(draft.sessions, sessionId) : undefined;
+            if (!session || session.clientId !== clientId || session.expiresAt <= now())
+                return { error: 'invalid_grant' };
+            record.sessionKey ??= proof.jkt;
             if (record.expiresAt <= now())
                 return { error: 'expired_token' };
             if (record.status === 'denied')
@@ -359,9 +392,8 @@ export function createReferenceIssuer(options) {
             record.nextPollAt = now() + record.intervalMs;
             if (record.status === 'pending')
                 return { error: 'authorization_pending' };
-            const session = own(draft.sessions, sessionId);
-            if (!session || session.clientId !== clientId || session.expiresAt <= now())
-                throw new TokenError('invalid_session');
+            if (session.accountId !== null && session.accountId !== record.accountId)
+                return { error: 'account_mismatch' };
             const granted = issueSignIn(draft, sessionId, session, record.accountId, record.scopes, proof.jkt, resource);
             record.status = 'consumed';
             return granted.body;
@@ -535,11 +567,48 @@ export function createReferenceIssuer(options) {
             code = '';
         }
     }
+    async function exchangeToken(request, params) {
+        const { clientId, clientAssertion } = clientCredentials(params);
+        const subject = params.get('subject_token'), resource = params.get('resource');
+        if (!subject || params.get('subject_token_type') !== 'urn:ietf:params:oauth:token-type:access_token' || ['assertion', 'session_id', 'refresh_token', 'code', 'actor_token', 'actor_token_type'].some(key => params.has(key)) || (params.has('requested_token_type') && params.get('requested_token_type') !== 'urn:ietf:params:oauth:token-type:access_token'))
+            throw new TokenError('invalid_request');
+        if (!resource || !isBearerResource(resource))
+            throw new TokenError('invalid_target');
+        const state = await read();
+        const proof = await verifyDpopProof(request.headers.get('dpop'), { method: 'POST', url: options.tokenEndpoint, nowMs: now() });
+        if (requireNonce && !state.nonces.some(nonce => nonce.value === proof.claims.nonce && nonce.expiresAt > now()))
+            throw new TokenError('use_dpop_nonce', { 'DPoP-Nonce': await currentNonce(state) });
+        const { client, keys } = await authenticateClient(clientId, clientAssertion);
+        for (const key of keys().keys)
+            if (await calculateJwkThumbprint(key).catch(() => null) === proof.jkt)
+                throw new TokenError('invalid_dpop_proof');
+        const replayKey = 'assertion ' + clientId + ' ' + client.jti, proofKey = 'proof ' + proof.jkt + ' ' + proof.claims.jti;
+        const body = await commit({ kind: 'sign_in', ids: [], sessionKey: proof.jkt, clientId, accessHash: tokenHash(subject), replayKeys: [replayKey, proofKey], at: now() }, draft => {
+            const at = now(), token = own(draft.accessTokens, tokenHash(subject)), session = token && own(draft.sessions, token.sessionId);
+            if (draft.generation !== state.generation || !current(client))
+                throw new TokenError('invalid_client');
+            if ((proof.claims.iat + PROOF_WINDOW_SECONDS) * 1000 <= at)
+                throw new TokenError('invalid_dpop_proof');
+            if (!token || !session || !token.jkt || token.jkt !== proof.jkt || own(draft.sessionKeys, proof.jkt) !== token.sessionId || session.clientId !== clientId || token.expiresAt <= at || session.expiresAt <= at || session.grantId !== token.grantId || (token.grantId !== null && !grantLive(own(draft.grants, token.grantId), at)))
+                throw new TokenError('invalid_grant');
+            const scopes = params.has('scope') ? signInScopes(params.get('scope'), token.scopes) : [...token.scopes];
+            if ((own(draft.replay, proofKey) ?? 0) > at)
+                throw new TokenError('invalid_dpop_proof');
+            consumeReplay(draft, replayKey, client.exp * 1000);
+            consumeReplay(draft, proofKey, (proof.claims.iat + PROOF_WINDOW_SECONDS) * 1000);
+            const access = random(32), expiresAt = Math.min(at + lifetimeMs, session.expiresAt);
+            draft.accessTokens[tokenHash(access)] = { sessionId: token.sessionId, grantId: token.grantId, scopes, resource, jkt: '', expiresAt };
+            return { access_token: access, issued_token_type: 'urn:ietf:params:oauth:token-type:access_token', token_type: 'Bearer', expires_in: Math.floor((expiresAt - at) / 1000), scope: scopes.join(' ') };
+        });
+        return json(200, body);
+    }
     async function issue(request) {
         const params = await readParams(request);
         const grantType = params.get('grant_type');
         if (!grantType)
             throw new TokenError('invalid_request');
+        if (grantType === 'urn:ietf:params:oauth:grant-type:token-exchange')
+            return exchangeToken(request, params);
         if (grantType === DEVICE_GRANT)
             return pollDevice(request, params);
         if (grantType !== JWT_BEARER && grantType !== 'authorization_code' && grantType !== 'refresh_token')
@@ -550,10 +619,9 @@ export function createReferenceIssuer(options) {
         const redirectUri = params.get('redirect_uri');
         const codeVerifier = params.get('code_verifier');
         const refreshToken = params.get('refresh_token');
-        const sessionId = params.get('session_id');
         const resource = params.get('resource');
         const scope = params.get('scope');
-        if (sessionId === '')
+        if (params.has('session_id'))
             throw new TokenError('invalid_request');
         // Each grant takes only its own credential, so a stray assertion can never stand in for a code or Account Token.
         if (grantType !== JWT_BEARER && assertion !== undefined)
@@ -567,8 +635,7 @@ export function createReferenceIssuer(options) {
                 throw new TokenError('invalid_scope');
         }
         else if (grantType === 'authorization_code') {
-            // Direct Sign-In always names the Session to sign in (spec 4.5).
-            if (!code || !redirectUri || !codeVerifier || sessionId === undefined)
+            if (!code || !redirectUri || !codeVerifier)
                 throw new TokenError('invalid_request');
             // RFC 7636 4.1: 43-128 unreserved characters.
             if (!/^[A-Za-z0-9._~-]{43,128}$/.test(codeVerifier))
@@ -581,15 +648,14 @@ export function createReferenceIssuer(options) {
         if (requested?.length === 0)
             throw new TokenError('invalid_scope');
         // Resources are exact configured identifiers, chosen per token request; grants are never narrowed to one.
-        if (resource !== undefined && !resources.includes(resource))
+        if (resource !== undefined && (!resources.includes(resource) || isBearerResource(resource)))
             throw new TokenError('invalid_target');
         const state = await read();
         const generation = state.generation;
         // htu is checked against the configured token endpoint, never the incoming Request URL.
-        const bearerResource = isBearerResource(resource);
-        const proof = bearerResource ? { jkt: '', claims: { iat: now() / 1000, jti: '', nonce: undefined } } : await verifyDpopProof(request.headers.get('dpop'), { method: 'POST', url: options.tokenEndpoint, nowMs: now() });
+        const proof = await verifyDpopProof(request.headers.get('dpop'), { method: 'POST', url: options.tokenEndpoint, nowMs: now() });
         // Nonce challenge precedes any network fetch and any replay consumption.
-        if (!bearerResource && requireNonce && !state.nonces.some(nonce => nonce.value === proof.claims.nonce && nonce.expiresAt > now()))
+        if (requireNonce && !state.nonces.some(nonce => nonce.value === proof.claims.nonce && nonce.expiresAt > now()))
             throw new TokenError('use_dpop_nonce', { 'DPoP-Nonce': await currentNonce(state) });
         const { client, verify, keys } = await authenticateClient(clientId, clientAssertion);
         let session;
@@ -607,7 +673,7 @@ export function createReferenceIssuer(options) {
         for (const key of keys().keys)
             if (await calculateJwkThumbprint(key).catch(() => null) === proof.jkt)
                 throw new TokenError('invalid_dpop_proof');
-        const body = await commit({ kind: 'token', clientId, ...(sessionId === undefined ? {} : { sessionId }), ...(code ? { codeHash: tokenHash(code) } : {}), ...(refreshToken ? { refreshHash: tokenHash(refreshToken) } : {}), replayKeys: [...(session ? [client, session] : [client]).map(claims => `assertion ${clientId} ${claims.jti}`), `proof ${proof.jkt} ${proof.claims.jti}`], at: now() }, draft => {
+        const body = await commit({ kind: 'token', clientId, sessionKey: proof.jkt, ...(code ? { codeHash: tokenHash(code) } : {}), ...(refreshToken ? { refreshHash: tokenHash(refreshToken) } : {}), replayKeys: [...(session ? [client, session] : [client]).map(claims => `assertion ${clientId} ${claims.jti}`), `proof ${proof.jkt} ${proof.claims.jti}`], at: now() }, draft => {
             // A reset between verification and commit must not recreate state from a stale verification.
             if (draft.generation !== generation)
                 throw new TokenError('invalid_grant');
@@ -626,15 +692,15 @@ export function createReferenceIssuer(options) {
             const proofKey = `proof ${proof.jkt} ${proof.claims.jti}`;
             if (assertionKeys.some(key => own(draft.replay, key) !== undefined))
                 throw new TokenError('invalid_grant');
-            if (!bearerResource && own(draft.replay, proofKey) !== undefined)
+            if (own(draft.replay, proofKey) !== undefined)
                 throw new TokenError('invalid_dpop_proof');
             assertions.forEach((claims, index) => { draft.replay[assertionKeys[index]] = claims.exp * 1000; });
-            if (!bearerResource)
-                draft.replay[proofKey] = (proof.claims.iat + PROOF_WINDOW_SECONDS) * 1000;
+            draft.replay[proofKey] = (proof.claims.iat + PROOF_WINDOW_SECONDS) * 1000;
+            const sessionId = own(draft.sessionKeys, proof.jkt);
             const existing = (userId) => {
                 const found = sessionId === undefined ? undefined : own(draft.sessions, sessionId);
                 if (!found || !(found.expiresAt > at) || found.clientId !== clientId || (userId !== undefined && found.userId !== userId))
-                    throw new TokenError('invalid_session');
+                    throw new TokenError('invalid_grant');
                 return found;
             };
             const create = (userId) => {
@@ -643,13 +709,14 @@ export function createReferenceIssuer(options) {
                 if ((draft.limits?.sessions ?? live.length) >= maxSessionsPerClient)
                     throw new TokenError('rate_limited', { 'Retry-After': String(Math.ceil(((draft.limits?.earliestSessionExpiry ?? Math.min(...live.map(record => record.expiresAt))) - at) / 1000)) });
                 const id = `ses_${random(16)}`;
-                return [id, draft.sessions[id] = { clientId, userId, version: 1, createdAt: at, expiresAt: at, accountId: null, grantId: null }];
+                draft.sessionKeys[proof.jkt] = id;
+                return [id, draft.sessions[id] = { clientId, userId, ...(session?.agent_id === undefined ? {} : { agentId: session.agent_id }), version: 1, createdAt: at, expiresAt: at, accountId: null, grantId: null }];
             };
             const accessToken = random(32);
             const grant = (id, record, grantId, scopes) => {
                 record.expiresAt = at + sessionMs;
                 draft.accessTokens[tokenHash(accessToken)] = { sessionId: id, grantId, scopes, resource: resource ?? null, jkt: proof.jkt, expiresAt: at + lifetimeMs };
-                return { access_token: accessToken, token_type: bearerResource ? 'Bearer' : 'DPoP', expires_in: lifetimeSeconds, scope: scopes.join(' '), session_id: id, signed_in: grantId !== null };
+                return { access_token: accessToken, token_type: 'DPoP', expires_in: lifetimeSeconds, ...(grantId === null ? {} : { scope: scopes.join(' ') }) };
             };
             // Signs the Session in to the lineage and rotates its Account Token: consume, successor and session update in this one commit.
             const signIn = (id, record, grantId) => {
@@ -675,14 +742,17 @@ export function createReferenceIssuer(options) {
                 if (sessionId === undefined)
                     return grant(...create(session.sub), null, []);
                 const record = existing(session.sub);
+                if (record.agentId !== session.agent_id)
+                    throw new TokenError('invalid_grant');
                 // A signed-in Session is renewed with its Account Token instead (spec 4.2).
                 if (record.grantId !== null && grantLive(own(draft.grants, record.grantId), at))
                     throw new TokenError('invalid_grant');
+                record.grantId = null;
                 return grant(sessionId, record, null, []);
             }
             if (grantType === 'authorization_code') {
                 const record = own(draft.codes, tokenHash(code));
-                if (!record || record.expiresAt <= at || record.clientId !== clientId)
+                if (!record || record.expiresAt <= at || record.clientId !== clientId || record.sessionKey !== proof.jkt)
                     throw new TokenError('invalid_grant');
                 if (record.grantId !== null) {
                     revokeGrant(draft, record.grantId);
@@ -797,19 +867,23 @@ export function createReferenceIssuer(options) {
     return {
         browserSessions: {
             async current(binding) { return browserSession(await read({ kind: 'browser', sessionId: binding.sessionId }), binding); },
-            join(binding, assertion) {
-                const replayKey = `assertion ${binding.clientId} ${assertion.jti}`;
-                return commit({ kind: 'browser', sessionId: binding.sessionId, replayKey }, draft => {
-                    if (assertion.expiresAt <= now() || assertion.expiresAt > now() + 90000 || !assertion.jti || assertion.jti.length > 256 || (own(draft.replay, replayKey) ?? 0) > now())
-                        throw new AuthorityError('invalid_token');
-                    const session = browserSession(draft, binding);
-                    draft.replay[replayKey] = assertion.expiresAt;
-                    return session;
-                });
+            async join(sessionKey) {
+                const state = await read({ kind: 'sign_in', ids: [], sessionKey, replayKeys: [], at: now() });
+                const id = own(state.sessionKeys, sessionKey), session = id && own(state.sessions, id);
+                if (!id || !session)
+                    throw new AuthorityError('invalid_token');
+                return browserSession(state, { clientId: session.clientId, userId: session.userId, sessionId: id });
             },
         },
         token: request => respond(request, issue),
         revoke: request => respond(request, revokeToken),
+        async sessionForKey(binding) {
+            const state = await read({ kind: 'sign_in', ids: [], sessionKey: binding.sessionKey, replayKeys: [], at: now() });
+            const sessionId = own(state.sessionKeys, binding.sessionKey);
+            if (!sessionId)
+                throw new AuthorityError('invalid_token');
+            return browserSession(state, { clientId: binding.clientId, userId: binding.userId, sessionId });
+        },
         deviceAuthorization: request => respond(request, startDevice),
         mediatedSignIn: request => respond(request, mediatedSignIn),
         async beginDeviceAuthorization(userCode, browserBinding) {
@@ -874,16 +948,8 @@ export function createReferenceIssuer(options) {
             catch {
                 throw new AuthorizationError('invalid_client');
             }
-            // Exact string match against the client's metadata (spec 4.5).
-            if (!client.redirect_uris.includes(redirectUri))
+            if (!registeredRedirect(redirectUri, client.redirect_uris, clientId))
                 throw new AuthorizationError('invalid_request');
-            try {
-                if (secureUrl(redirectUri).hostname !== secureUrl(clientId).hostname)
-                    throw 0;
-            }
-            catch {
-                throw new AuthorizationError('invalid_request');
-            }
             const state = params.get('state');
             const fail = (code) => new AuthorizationError(code, new URL(callback(redirectUri, { error: code, ...(state ? { state } : {}), iss: issuer })));
             if (params.get('response_type') !== 'code')
@@ -893,8 +959,11 @@ export function createReferenceIssuer(options) {
             const codeChallenge = params.get('code_challenge') ?? '';
             if (params.get('code_challenge_method') !== 'S256' || !/^[A-Za-z0-9_-]{43}$/.test(codeChallenge))
                 throw fail('invalid_request');
+            const sessionKey = params.get('dpop_jkt');
+            if (!sessionKey || !/^[A-Za-z0-9_-]{43}$/.test(sessionKey))
+                throw fail('invalid_request');
             const scopes = [...new Set((params.get('scope') ?? '').split(' ').filter(Boolean))];
-            if (!scopes.length || !scopes.every(scope => options.directScopes.includes(scope)))
+            if (!scopes.length || !scopes.every(scope => options.supportedScopes.includes(scope)))
                 throw fail('invalid_scope');
             // resource is accepted and ignored here: grants cover every resource, and each token request selects one (spec 4.3).
             const resource = params.get('resource');
@@ -911,7 +980,7 @@ export function createReferenceIssuer(options) {
                     throw fail('temporarily_unavailable');
                 const id = random(16);
                 const expiresAt = at + AUTHORIZATION_MS;
-                draft.authorizations[id] = { clientId, redirectUri, state, codeChallenge, scopes, browserHash: tokenHash(browserBinding), expiresAt, revision: revision(draft, clientRevisionKey(clientId)) };
+                draft.authorizations[id] = { sessionKey, clientId, redirectUri, state, codeChallenge, scopes, browserHash: tokenHash(browserBinding), expiresAt, revision: revision(draft, clientRevisionKey(clientId)) };
                 return { id, clientId, clientName: client.client_name, scopes, expiresAt };
             });
         },
@@ -926,7 +995,7 @@ export function createReferenceIssuer(options) {
             const accountId = 'accountId' in decision && typeof decision.accountId === 'string' ? decision.accountId : undefined;
             const href = await commit({ kind: 'authorization', id, ...(snapshot && accountId ? { revocationKey: accountRevisionKey(snapshot.clientId, accountId) } : {}) }, draft => {
                 const record = own(draft.authorizations, id);
-                if (!record || record.expiresAt <= now() || record.browserHash !== tokenHash(browserBinding))
+                if (!record || !record.sessionKey || record.expiresAt <= now() || record.browserHash !== tokenHash(browserBinding))
                     throw new AuthorizationError('invalid_request');
                 const denied = 'denied' in decision && decision.denied === true;
                 const { accountId, scopes } = decision;
@@ -950,7 +1019,7 @@ export function createReferenceIssuer(options) {
                 }
                 const code = random(32);
                 record.expiresAt = Math.min(record.expiresAt, now() + CODE_MS);
-                draft.codes[tokenHash(code)] = { clientId: record.clientId, redirectUri: record.redirectUri, codeChallenge: record.codeChallenge, accountId: accountId, scopes: granted, expiresAt: record.expiresAt, grantId: null, revision: record.revision };
+                draft.codes[tokenHash(code)] = { sessionKey: record.sessionKey, clientId: record.clientId, redirectUri: record.redirectUri, codeChallenge: record.codeChallenge, accountId: accountId, scopes: granted, expiresAt: record.expiresAt, grantId: null, revision: record.revision };
                 const href = callback(record.redirectUri, { code, ...fields });
                 record.completion = { decisionHash, callback: cipher.seal(href) };
                 return href;
@@ -963,7 +1032,9 @@ export function createReferenceIssuer(options) {
                 ...(options.authorizationEndpoint ? { authorization_endpoint: options.authorizationEndpoint, response_types_supported: ['code'], code_challenge_methods_supported: ['S256'] } : {}),
                 ...(options.device ? { device_authorization_endpoint: options.device.endpoint } : {}),
                 dpop_signing_alg_values_supported: ['ES256'], client_id_metadata_document_supported: true,
-                poppy_domains: [...options.poppyDomains],
+                protected_resources: [...options.protectedResources],
+                grant_types_supported: [JWT_BEARER, 'refresh_token', ...(mcpResources.some(entry => !entry.dpop) ? ['urn:ietf:params:oauth:grant-type:token-exchange'] : []), ...(options.authorizationEndpoint ? ['authorization_code'] : []), ...(options.device ? [DEVICE_GRANT] : [])],
+                scopes_supported: [...options.supportedScopes],
             };
         },
         authority: {

package/dist/reference-auth/store.d.ts

@@ -6,7 +6,7 @@ export type IssuerSelection = {
 } | {
     kind: 'token';
     clientId: string;
-    sessionId?: string;
+    sessionKey: string;
     codeHash?: string;
     refreshHash?: string;
     replayKeys: string[];
@@ -43,6 +43,7 @@ export type IssuerSelection = {
     ids: string[];
     clientId?: string;
     sessionId?: string;
+    sessionKey?: string;
     accessHash?: string;
     replayKeys: string[];
     at: number;