@adonis-agora/agent/dist/src/poppy-client/dpop.js

Governed, durable-backed AI agent (chat + tool-calling + governance) for AdonisJS — part of the Agora ecosystem.

import { SignJWT } from 'jose';
import { bareEcPublicJwk, generateEs256Key, importSigningKey } from './keys.js';
import { nowSeconds, randomId, sha256b64url } from './util.js';
/** `htu`: the request URL without query or fragment (RFC 9449 4.2). */
export function htuOf(url) {
    const u = new URL(url);
    u.search = '';
    u.hash = '';
    return u.toString();
}
/**
 * A DPoP key (RFC 9449). The agent keeps one per User per Company (4.3); it is never published.
 */
export class DpopKey {
    stored;
    constructor(stored) {
        this.stored = stored;
    }
    static async generate() {
        return new DpopKey(await generateEs256Key());
    }
    /** A fresh proof for one request. `accessToken` adds `ath`; token-endpoint proofs have none. */
    async proof(input) {
        const payload = {
            jti: randomId(),
            htm: input.htm.toUpperCase(),
            htu: htuOf(input.htu),
            iat: nowSeconds(),
        };
        if (input.accessToken)
            payload.ath = sha256b64url(input.accessToken);
        if (input.nonce)
            payload.nonce = input.nonce;
        return new SignJWT(payload)
            .setProtectedHeader({
            typ: 'dpop+jwt',
            alg: 'ES256',
            jwk: bareEcPublicJwk(this.stored.publicJwk),
        })
            .sign(await importSigningKey(this.stored));
    }
}
//# sourceMappingURL=dpop.js.map