[notme-18450e] revert to @agentic-research/dpop on GitHub Packages + [notme-3bc238] stable error codes#46
Merged
Conversation
Adds DPoPVerificationError with a machine-readable `code` on every failure the verifiers and validateClaims can throw. The implementation was already in the working tree, uncommitted, from in-flight work on this bead. I preserved and tested it rather than discarding it while reverting an unrelated rename in the same tree. Why it matters: `message` is for humans and may be reworded; `code` is the contract. Downstream verifiers had already started matching on message SUBSTRINGS — cloister's bundle-auth built a whole reason-mapper out of `msg.includes(...)`, which degrades silently the moment a message changes, losing exactly the audit granularity it exists to preserve. These codes are the fix for that, and cloister-195e47 will consume them. Tests added (+12): the error is a DPoPVerificationError not a bare Error, `instanceof` survives the prototype chain across `extends Error`, and every validateClaims branch cloister's mapper cared about is pinned to its code — audience, issuer, not-yet-valid, sub, exp. A contract with no test is a comment, and this one has two consumers about to depend on it. worker 351 pass (+12), tsc clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… Packages main was declaring notme-dpop on npmjs.org while the only artifact that actually exists is @agentic-research/dpop@0.1.0 on GitHub Packages. Any consumer wiring against main would have pointed at a package published nowhere, so this is a correctness fix, not a preference. The npmjs.org move solved the right problem — that registry requires auth to INSTALL even for public packages (401 anonymous, verified) — but paid for it with an npm account and a long-lived NPM_TOKEN. Since every current consumer is same-org, the cost lands cheaper here: publishing needs no created credential (automatic GITHUB_TOKEN), CI reads with `packages: read`, and a developer machine needs one `gh auth refresh -s read:packages`, once. That grant is now in place and verified against the registry (HTTP 200). If this SDK ever needs adoption outside the org — plausible, since notme is a public identity provider and any external resource server verifying its tokens is a potential consumer — the trade inverts and the move is a rename plus a registry swap. Deliberately small for that reason, and the reasoning is recorded in the workflow header rather than left to be rediscovered a third time. worker 351 pass, tsc clean, package build clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits, deliberately separate.
1.
[notme-18450e]Revert the registry move — correctness, not preferencemain was declaring
notme-dpopon npmjs.org while the only artifact that actually exists is@agentic-research/dpop@0.1.0on GitHub Packages. Any consumer wiring against main would have pointed at a package published nowhere.The npmjs.org move solved the right problem — GitHub Packages requires auth to install even public packages (401 anonymous, verified against the endpoint) — but paid for it with an npm account and a long-lived
NPM_TOKEN.Every current consumer is same-org, so the cost lands cheaper here:
GITHUB_TOKENpackages: readgh auth refresh -s read:packages, onceThat grant is now in place and verified against the registry (HTTP 200), which is what unblocked this.
If the SDK ever needs adoption outside the org — plausible, since notme is a public identity provider — the trade inverts and the move is a rename plus a registry swap. Kept deliberately small, and the reasoning now lives in the workflow header rather than being rediscovered a third time.
2.
[notme-3bc238]Stable error codesDPoPVerificationErrorwith a machine-readablecodeon every failure the verifiers andvalidateClaimscan throw.The implementation was already in the working tree, uncommitted, from in-flight work on that bead. I preserved and tested it rather than discarding it while reverting the rename in the same tree — hence the separate commit and separate bead attribution.
Why it matters:
messageis for humans and may be reworded;codeis the contract. Downstream verifiers had already started matching on message substrings — cloister'sbundle-authbuilt an entire reason-mapper out ofmsg.includes(...), which degrades silently the moment a message changes, losing exactly the audit granularity it exists to preserve.cloister-195e47will consume these codes.+12 tests, because it shipped with none: the error is a
DPoPVerificationErrorrather than a bareError,instanceofsurvives the prototype chain acrossextends Error, and everyvalidateClaimsbranch cloister's mapper cared about is pinned to its code — audience, issuer, not-yet-valid, sub, exp.Verification
tsc --noEmit— clean🤖 Generated with Claude Code
https://claude.ai/code/session_01UNahXs8dda3vttpWrVwVaA