@toa.io/extensions.exposition 1.0.0-alpha.28 → 1.0.0-alpha.283

package/components/identity.clients/manifest.toa.yaml

@@ -0,0 +1,243 @@
+namespace: identity
+name: clients
+
+# A registration is addressed by the hash of what it says, so the same metadata is the
+# same client however many times it arrives. `associated` is what lets a transition create
+# the record at an id decided outside the storage.
+entity:
+  associated: true
+  schema:
+    type: object
+    properties:
+      authority:
+        type: string
+      name:
+        description: client_name
+        type: string
+        maxLength: 128
+      uris:
+        description: redirect_uris
+        type: array
+        minItems: 1
+        maxItems: 8
+        items:
+          type: string
+          maxLength: 2048
+      uri:
+        description: client_uri
+        type: string
+        maxLength: 2048
+      logo:
+        description: logo_uri
+        type: string
+        maxLength: 2048
+      scope:
+        type: string
+        maxLength: 512
+      expires:
+        description: When a registration nothing has used is swept
+        type: number
+    required:
+      - authority
+      - uris
+  index:
+    authority:
+      authority: asc
+
+operations:
+  transit:
+    concurrency: retry
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        name:
+          type: string
+        uri:
+          type: string
+        logo:
+          type: string
+        scope:
+          type: string
+        uris:
+          type: array
+          items:
+            type: string
+        expires:
+          type: number
+      required:
+        - authority
+        - uris
+
+  register:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        client_name:
+          type: string
+          maxLength: 128
+        client_uri:
+          type: string
+          maxLength: 2048
+        logo_uri:
+          type: string
+          maxLength: 2048
+        redirect_uris:
+          type: array
+          minItems: 1
+          maxItems: 8
+          items:
+            type: string
+            maxLength: 2048
+        scope:
+          type: string
+          maxLength: 512
+        grant_types:
+          type: array
+          items:
+            type: string
+        response_types:
+          type: array
+          items:
+            type: string
+        token_endpoint_auth_method:
+          type: string
+      required:
+        - authority
+        - redirect_uris
+    # RFC 7591 §3.2.2 states a registration error as a body, not as a status of its own
+    output:
+      type: object
+      properties:
+        status:
+          description: Read and removed by `map:status`
+          type: number
+        client_id:
+          type: string
+        client_id_issued_at:
+          type: number
+        client_name:
+          type: string
+        client_uri:
+          type: string
+        logo_uri:
+          type: string
+        redirect_uris:
+          type: array
+          items:
+            type: string
+        grant_types:
+          type: array
+          items:
+            type: string
+        response_types:
+          type: array
+          items:
+            type: string
+        token_endpoint_auth_method:
+          type: string
+        error:
+          type: string
+        error_description:
+          type: string
+
+  describe:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        id:
+          description: client_id, which is an https URL when the client publishes its own metadata
+          type: string
+          maxLength: 2048
+        redirect:
+          description: Asked about together with the client, since only this component may answer it
+          type: string
+          maxLength: 2048
+      required:
+        - authority
+        - id
+    output:
+      type: object
+      properties:
+        client_id:
+          type: string
+        client_name:
+          type: string
+        client_uri:
+          type: string
+        logo_uri:
+          type: string
+        redirect_uris:
+          type: array
+          items:
+            type: string
+        permitted:
+          description: Whether `redirect` is one this client may receive a code at
+          type: boolean
+    errors:
+      - UNKNOWN_CLIENT
+
+configuration:
+  schema:
+    type: object
+    properties:
+      trust:
+        description: Origins whose Client ID Metadata Documents may be read; none are without one
+        type: array
+        items:
+          type: string
+          pattern: ^https://
+        default: []
+      lifetime:
+        description: Seconds a Client ID Metadata Document is held before it is read again
+        type: integer
+        minimum: 1
+        default: 3600
+      ttl:
+        description: Seconds a registration nothing has used is kept
+        type: integer
+        minimum: 1
+        default: 2592000
+      size:
+        description: Bytes of a Client ID Metadata Document that are read
+        type: integer
+        minimum: 1
+        default: 16384
+      timeout:
+        description: Milliseconds a Client ID Metadata Document has to arrive
+        type: integer
+        minimum: 1
+        default: 3000
+
+stash: ~
+
+exposition:
+  isolated: true
+  /:
+    POST:
+      anonymous: true
+      map:authority: authority
+      io:input: [client_name, client_uri, logo_uri, redirect_uris, scope, grant_types, response_types, token_endpoint_auth_method]
+      io:output: true
+      io:throttle:
+        key: ip
+        requests: 10
+        interval: 3600
+      io:status: status
+      cache:exact: no-store
+      endpoint: register
+    /:id:
+      GET:
+        anyone: true
+        map:authority: authority
+        map:segments:
+          id: id
+        io:output: [client_id, client_name, client_uri, logo_uri, redirect_uris]
+        endpoint: describe

package/components/identity.clients/operations/describe.d.ts

@@ -0,0 +1,27 @@
+import type { Maybe } from '@toa.io/core';
+import type { Operation } from '@toa.io/bridges.node';
+import type { Client, Context } from './lib/index.js';
+/**
+ * What a client is, whichever way it came to be known: a `client_id` that is an https URL
+ * publishes its own metadata, and anything else was registered here. The caller is not told
+ * which, and neither mechanism is visible past this operation.
+ *
+ * Whether a redirect is one the client may receive a code at is answered here too. The rule
+ * is this component's — nothing else knows a loopback port is ignored — and asking for it
+ * with the client saves a second call on the path a person is waiting on.
+ */
+export declare class Computation implements Operation {
+    private context;
+    mount(context: Context): void;
+    execute(input: Input): Promise<Maybe<Output>>;
+    private registered;
+}
+interface Input {
+    authority: string;
+    id: string;
+    redirect?: string;
+}
+interface Output extends Client {
+    permitted?: boolean;
+}
+export {};

package/components/identity.clients/operations/describe.js

@@ -0,0 +1,44 @@
+import { ERR_UNKNOWN_CLIENT, permits, read } from './lib/index.js';
+/**
+ * What a client is, whichever way it came to be known: a `client_id` that is an https URL
+ * publishes its own metadata, and anything else was registered here. The caller is not told
+ * which, and neither mechanism is visible past this operation.
+ *
+ * Whether a redirect is one the client may receive a code at is answered here too. The rule
+ * is this component's — nothing else knows a loopback port is ignored — and asking for it
+ * with the client saves a second call on the path a person is waiting on.
+ */
+export class Computation {
+    context;
+    mount(context) {
+        this.context = context;
+    }
+    async execute(input) {
+        const client = input.id.startsWith(HTTPS)
+            ? await read(input.id, this.context)
+            : await this.registered(input);
+        if (client instanceof Error)
+            return client;
+        return {
+            ...client,
+            ...(input.redirect === undefined
+                ? {}
+                : { permitted: permits(client.redirect_uris, input.redirect) })
+        };
+    }
+    async registered(input) {
+        const entity = await this.context.local.observe({ query: { id: input.id } });
+        // credentials are scoped to an authority, and so is what may act for them
+        if (entity === null || entity.authority !== input.authority)
+            return ERR_UNKNOWN_CLIENT;
+        return {
+            client_id: entity.id,
+            client_name: entity.name,
+            client_uri: entity.uri,
+            logo_uri: entity.logo,
+            redirect_uris: entity.uris
+        };
+    }
+}
+const HTTPS = 'https://';
+//# sourceMappingURL=describe.js.map

package/components/identity.clients/operations/describe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.js","sourceRoot":"","sources":["../source/describe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAKlE;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IACd,OAAO,CAAU;IAElB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAY;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;YACvC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC;YACpC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAEhC,IAAI,MAAM,YAAY,KAAK;YACzB,OAAO,MAAM,CAAA;QAEf,OAAO;YACL,GAAG,MAAM;YACT,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;SAClE,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAE,KAAY;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAE5E,0EAA0E;QAC1E,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;YACzD,OAAO,kBAAkB,CAAA;QAE3B,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,UAAU,EAAE,MAAM,CAAC,GAAG;YACtB,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,aAAa,EAAE,MAAM,CAAC,IAAI;SAC3B,CAAA;IACH,CAAC;CACF;AAED,MAAM,KAAK,GAAG,UAAU,CAAA"}

package/components/identity.clients/operations/lib/Context.d.ts

@@ -0,0 +1,29 @@
+import type { Call, Observation, Transition } from '@toa.io/core';
+import type { Stash } from '@toa.io/extensions.stash';
+import type { Logs } from '@toa.io/extensions.telemetry';
+import type { Entity } from './Entity.js';
+export interface Context {
+    stash: Stash;
+    fetch: Fetch;
+    logs: Logs;
+    local: {
+        observe: Observation<Entity>;
+        transit: Call<Entity, TransitInput>;
+    };
+    configuration: Configuration;
+}
+export type Fetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export type TransitInput = Omit<Entity, 'id' | '_created'>;
+export interface Configuration {
+    /** Origins whose Client ID Metadata Documents may be read. Empty admits nobody. */
+    readonly trust: string[];
+    /** Seconds a document is held before it is read again. */
+    readonly lifetime: number;
+    /** Seconds a registration nothing has used is kept. */
+    readonly ttl: number;
+    /** Bytes of a document that are read. */
+    readonly size: number;
+    /** Milliseconds a document has to arrive. */
+    readonly timeout: number;
+}
+export type { Transition };

package/components/identity.clients/operations/lib/Context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=Context.js.map

package/components/identity.clients/operations/lib/Context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Context.js","sourceRoot":"","sources":["../../source/lib/Context.ts"],"names":[],"mappings":""}

package/components/identity.clients/operations/lib/Entity.d.ts

@@ -0,0 +1,29 @@
+export interface Entity {
+    id: string;
+    authority: string;
+    name?: string;
+    uris: string[];
+    uri?: string;
+    logo?: string;
+    scope?: string;
+    expires?: number;
+    _created?: number;
+}
+/** What a client says about itself, in the shape both mechanisms carry it. */
+export interface Metadata {
+    client_name?: string;
+    client_uri?: string;
+    logo_uri?: string;
+    redirect_uris: string[];
+    scope?: string;
+    token_endpoint_auth_method?: string;
+}
+/** A client, however it came to be known. */
+export interface Client {
+    client_id: string;
+    client_name?: string;
+    client_uri?: string;
+    logo_uri?: string;
+    redirect_uris: string[];
+    issued?: number;
+}

package/components/identity.clients/operations/lib/Entity.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=Entity.js.map

package/components/identity.clients/operations/lib/Entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Entity.js","sourceRoot":"","sources":["../../source/lib/Entity.ts"],"names":[],"mappings":""}

package/components/identity.clients/operations/lib/canonical.d.ts

@@ -0,0 +1,11 @@
+import type { Metadata } from './Entity.js';
+/**
+ * The id of a registration: a hash of what it says, so identical metadata is one client
+ * however many times it arrives. A client cannot remember that it registered here, and
+ * registers again on every fresh connection; without this the registry only grows.
+ *
+ * Only what is honoured is hashed. A field this component ignores would otherwise mint a
+ * client per release of whoever sends it, and the authority is in there because credentials
+ * are scoped to one.
+ */
+export declare function identify(authority: string, metadata: Metadata): string;

package/components/identity.clients/operations/lib/canonical.js

@@ -0,0 +1,24 @@
+import { createHash } from 'node:crypto';
+/**
+ * The id of a registration: a hash of what it says, so identical metadata is one client
+ * however many times it arrives. A client cannot remember that it registered here, and
+ * registers again on every fresh connection; without this the registry only grows.
+ *
+ * Only what is honoured is hashed. A field this component ignores would otherwise mint a
+ * client per release of whoever sends it, and the authority is in there because credentials
+ * are scoped to one.
+ */
+export function identify(authority, metadata) {
+    const canonical = JSON.stringify([
+        authority,
+        metadata.client_name ?? null,
+        metadata.client_uri ?? null,
+        metadata.logo_uri ?? null,
+        metadata.scope ?? null,
+        [...metadata.redirect_uris].sort()
+    ]);
+    return createHash('sha256').update(canonical).digest('hex').slice(0, LENGTH);
+}
+/** What the entity prototype accepts as an id. */
+const LENGTH = 32;
+//# sourceMappingURL=canonical.js.map

package/components/identity.clients/operations/lib/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../source/lib/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAE,SAAiB,EAAE,QAAkB;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,SAAS;QACT,QAAQ,CAAC,WAAW,IAAI,IAAI;QAC5B,QAAQ,CAAC,UAAU,IAAI,IAAI;QAC3B,QAAQ,CAAC,QAAQ,IAAI,IAAI;QACzB,QAAQ,CAAC,KAAK,IAAI,IAAI;QACtB,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE;KACnC,CAAC,CAAA;IAEF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;AAC9E,CAAC;AAED,kDAAkD;AAClD,MAAM,MAAM,GAAG,EAAE,CAAA"}

package/components/identity.clients/operations/lib/cimd.d.ts

@@ -0,0 +1,8 @@
+import type { Context } from './Context.js';
+import type { Client } from './Entity.js';
+/**
+ * A Client ID Metadata Document: the client publishes what it is at an https URL, and that
+ * URL is its `client_id`. Control of the origin is what proves the identity, so nothing is
+ * registered and nothing is written — the document is read and held for a while.
+ */
+export declare function read(id: string, context: Context): Promise<Client | Error>;

package/components/identity.clients/operations/lib/cimd.js

@@ -0,0 +1,86 @@
+import { createHash } from 'node:crypto';
+import { ERR_UNKNOWN_CLIENT } from './errors.js';
+/**
+ * A Client ID Metadata Document: the client publishes what it is at an https URL, and that
+ * URL is its `client_id`. Control of the origin is what proves the identity, so nothing is
+ * registered and nothing is written — the document is read and held for a while.
+ */
+export async function read(id, context) {
+    // before anything is fetched: the id is the caller's to choose, and this runs inside
+    // the cluster. An origin the configuration does not name is not reached at all.
+    if (!trusted(id, context.configuration.trust))
+        return ERR_UNKNOWN_CLIENT;
+    const key = CACHE + createHash('sha256').update(id).digest('hex');
+    const cached = await context.stash.get(key);
+    if (cached !== null)
+        return cached === MISS ? ERR_UNKNOWN_CLIENT : JSON.parse(cached);
+    const client = await fetch(id, context);
+    // a document that does not answer is remembered too, or a bad id is fetched per request
+    await context.stash.set(key, client instanceof Error ? MISS : JSON.stringify(client), 'EX', context.configuration.lifetime);
+    return client;
+}
+/**
+ * An https URL whose origin the configuration names. Compared by origin so that a path on a
+ * trusted host cannot be escaped by one that merely starts the same way.
+ */
+function trusted(id, trust) {
+    let url;
+    try {
+        url = new URL(id);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'https:')
+        return false;
+    return trust.some((origin) => {
+        try {
+            return new URL(origin).origin === url.origin;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+async function fetch(id, context) {
+    const { size, timeout } = context.configuration;
+    try {
+        const response = await context.fetch(id, {
+            redirect: 'error', // a redirect leaves the origin that was trusted
+            signal: AbortSignal.timeout(timeout),
+            headers: { accept: 'application/json' }
+        });
+        if (!response.ok)
+            return ERR_UNKNOWN_CLIENT;
+        const text = await response.text();
+        if (text.length > size)
+            return ERR_UNKNOWN_CLIENT;
+        return validate(id, JSON.parse(text));
+    }
+    catch (error) {
+        context.logs.debug('Client metadata document is unreadable', {
+            client: id,
+            error: error?.toString?.()
+        });
+        return ERR_UNKNOWN_CLIENT;
+    }
+}
+function validate(id, metadata) {
+    // the document names itself, so one client's cannot claim another's identity
+    if (metadata.client_id !== id)
+        return ERR_UNKNOWN_CLIENT;
+    if (!Array.isArray(metadata.redirect_uris) || metadata.redirect_uris.length === 0 ||
+        metadata.redirect_uris.some((uri) => typeof uri !== 'string'))
+        return ERR_UNKNOWN_CLIENT;
+    return {
+        client_id: id,
+        client_name: metadata.client_name,
+        client_uri: metadata.client_uri,
+        logo_uri: metadata.logo_uri,
+        redirect_uris: metadata.redirect_uris
+    };
+}
+const CACHE = 'cimd:';
+/** Held in place of a document that could not be read, so a bad id is not refetched. */
+const MISS = '';
+//# sourceMappingURL=cimd.js.map

package/components/identity.clients/operations/lib/cimd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../source/lib/cimd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAIhD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAE,EAAU,EAAE,OAAgB;IACtD,qFAAqF;IACrF,gFAAgF;IAChF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC;QAC3C,OAAO,kBAAkB,CAAA;IAE3B,MAAM,GAAG,GAAG,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAE3C,IAAI,MAAM,KAAK,IAAI;QACjB,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAW,CAAA;IAE5E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAEvC,wFAAwF;IACxF,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAClF,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;IAEvC,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAE,EAAU,EAAE,KAAe;IAC3C,IAAI,GAAQ,CAAA;IAEZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAC3B,OAAO,KAAK,CAAA;IAEd,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAA;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,KAAK,CAAE,EAAU,EAAE,OAAgB;IAChD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,CAAA;IAE/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;YACvC,QAAQ,EAAE,OAAO,EAAE,gDAAgD;YACnE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;YACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YACd,OAAO,kBAAkB,CAAA;QAE3B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAElC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;YACpB,OAAO,kBAAkB,CAAA;QAE3B,OAAO,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsC,CAAC,CAAA;IAC5E,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,wCAAwC,EAAE;YAC3D,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;SAC3B,CAAC,CAAA;QAEF,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAE,EAAU,EAAE,QAA2C;IACxE,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,SAAS,KAAK,EAAE;QAC3B,OAAO,kBAAkB,CAAA;IAE3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAC/E,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;QAC7D,OAAO,kBAAkB,CAAA;IAE3B,OAAO;QACL,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,aAAa,EAAE,QAAQ,CAAC,aAAa;KACtC,CAAA;AACH,CAAC;AAED,MAAM,KAAK,GAAG,OAAO,CAAA;AAErB,wFAAwF;AACxF,MAAM,IAAI,GAAG,EAAE,CAAA"}

package/components/identity.clients/operations/lib/errors.d.ts

@@ -0,0 +1,7 @@
+export declare const ERR_UNKNOWN_CLIENT: {
+    readonly code: "UNKNOWN_CLIENT";
+    readonly message: "No such client";
+    name: string;
+    stack?: string;
+    cause?: unknown;
+};

package/components/identity.clients/operations/lib/errors.js

@@ -0,0 +1,5 @@
+export const ERR_UNKNOWN_CLIENT = new (class UnknownClientError extends Error {
+    code = 'UNKNOWN_CLIENT';
+    message = 'No such client';
+})();
+//# sourceMappingURL=errors.js.map

package/components/identity.clients/operations/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../source/lib/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,kBAAmB,SAAQ,KAAK;IAC3D,IAAI,GAAG,gBAAgB,CAAA;IACd,OAAO,GAAG,gBAAgB,CAAA;CACpD,CAAC,EAAE,CAAA"}

package/components/identity.clients/operations/lib/index.d.ts

@@ -0,0 +1,6 @@
+export * from './canonical.js';
+export * from './cimd.js';
+export * from './Context.js';
+export * from './Entity.js';
+export * from './errors.js';
+export * from './redirect.js';

package/components/identity.clients/operations/lib/index.js

@@ -0,0 +1,7 @@
+export * from './canonical.js';
+export * from './cimd.js';
+export * from './Context.js';
+export * from './Entity.js';
+export * from './errors.js';
+export * from './redirect.js';
+//# sourceMappingURL=index.js.map

package/components/identity.clients/operations/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/lib/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA"}

package/components/identity.clients/operations/lib/redirect.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Whether a client may receive a code at this address.
+ *
+ * Exact string comparison, which RFC 6749 §3.1.2.3 requires, except for a loopback
+ * address: a native client binds whatever port is free when it starts, so RFC 8252 §7.3
+ * has the port ignored there. Claude Code registers `http://localhost/callback` and
+ * `http://127.0.0.1/callback` and comes back on an ephemeral port; comparing those
+ * literally would refuse every one of them.
+ */
+export declare function permits(registered: string[], redirect: string): boolean;

package/components/identity.clients/operations/lib/redirect.js

@@ -0,0 +1,32 @@
+/**
+ * Whether a client may receive a code at this address.
+ *
+ * Exact string comparison, which RFC 6749 §3.1.2.3 requires, except for a loopback
+ * address: a native client binds whatever port is free when it starts, so RFC 8252 §7.3
+ * has the port ignored there. Claude Code registers `http://localhost/callback` and
+ * `http://127.0.0.1/callback` and comes back on an ephemeral port; comparing those
+ * literally would refuse every one of them.
+ */
+export function permits(registered, redirect) {
+    return registered.some((uri) => uri === redirect || loopback(uri, redirect));
+}
+function loopback(registered, redirect) {
+    const a = parse(registered);
+    const b = parse(redirect);
+    if (a === null || b === null)
+        return false;
+    return a.protocol === 'http:' && b.protocol === 'http:' &&
+        LOOPBACK.has(a.hostname) && a.hostname === b.hostname &&
+        a.pathname === b.pathname && a.search === b.search;
+}
+function parse(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return null;
+    }
+}
+/** `localhost` resolves through the host's own configuration, which RFC 8252 §8.3 warns of. */
+const LOOPBACK = new Set(['127.0.0.1', '[::1]', 'localhost']);
+//# sourceMappingURL=redirect.js.map

package/components/identity.clients/operations/lib/redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../source/lib/redirect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAE,UAAoB,EAAE,QAAgB;IAC7D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAE,UAAkB,EAAE,QAAgB;IACrD,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;IAEzB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAC1B,OAAO,KAAK,CAAA;IAEd,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;QACrD,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACrD,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAA;AACtD,CAAC;AAED,SAAS,KAAK,CAAE,KAAa;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAA"}

package/components/identity.clients/operations/register.d.ts

@@ -0,0 +1,37 @@
+import type { Maybe } from '@toa.io/core';
+import type { Operation } from '@toa.io/bridges.node';
+import type { Context, Metadata } from './lib/index.js';
+/**
+ * Dynamic Client Registration, RFC 7591: the client sends what it is and is given an
+ * identifier for it. Unauthenticated, as the specification has it — a registration grants
+ * nothing on its own, and stays inert until a user consents to the client on a page that
+ * shows them its name and where it would send them.
+ *
+ * The identifier is a hash of the metadata, so registering the same thing twice is the
+ * same client rather than another row. A client cannot remember it registered here.
+ */
+export declare class Effect implements Operation {
+    private transit;
+    private ttl;
+    mount(context: Context): void;
+    execute(input: Input): Promise<Maybe<Output>>;
+}
+interface Input extends Metadata {
+    authority: string;
+}
+interface Output {
+    /** Read and removed by `map:status`; absent on a success, which answers 201. */
+    status?: number;
+    client_id?: string;
+    client_id_issued_at?: number;
+    client_name?: string;
+    client_uri?: string;
+    logo_uri?: string;
+    redirect_uris?: string[];
+    grant_types?: string[];
+    response_types?: string[];
+    token_endpoint_auth_method?: string;
+    error?: string;
+    error_description?: string;
+}
+export {};