@agenticprimitives/connect-client 1.0.0-alpha.1 → 1.0.0-alpha.11

package/dist/deployment-epoch.d.ts

@@ -0,0 +1,18 @@
+export type DeploymentEpochVerdict = 'ok' | 'stale' | 'unstamped' | 'unknown';
+/**
+ * Compare a stored session's epoch to the current deployment epoch.
+ *
+ * - `current` undefined ⇒ `'unknown'`: the running build carries no epoch
+ *   (e.g. an older deployments artifact), so we CANNOT know staleness and must
+ *   NOT gate — fail-open only when knowledge is absent (never a silent
+ *   fallback to a weaker check; there simply is no check to run).
+ * - `stored` undefined ⇒ `'unstamped'`: a session written before the guard
+ *   existed. Since the guard's whole purpose is post-reset recovery, callers
+ *   SHOULD treat this like `'stale'` and force a reconnect.
+ * - otherwise: string equality → `'ok'` | `'stale'`.
+ */
+export declare function checkDeploymentEpoch(current: string | undefined, stored: string | undefined): DeploymentEpochVerdict;
+/** Convenience: does this verdict require dropping the session + reconnecting?
+ *  `unstamped` and `stale` both do; `ok` and `unknown` do not. */
+export declare function requiresReconnect(verdict: DeploymentEpochVerdict): boolean;
+//# sourceMappingURL=deployment-epoch.d.ts.map

package/dist/deployment-epoch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-epoch.d.ts","sourceRoot":"","sources":["../src/deployment-epoch.ts"],"names":[],"mappings":"AAeA,MAAM,MAAM,sBAAsB,GAC9B,IAAI,GACJ,OAAO,GACP,WAAW,GACX,SAAS,CAAC;AAEd;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,sBAAsB,CAIxB;AAED;kEACkE;AAClE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAE1E"}

package/dist/deployment-epoch.js

@@ -0,0 +1,39 @@
+// Spec 311 — the deployment-epoch guard for relying-app sessions.
+//
+// A relying app stamps each stored session with the authority deployment epoch
+// it was minted against (`CONTRACTS.deploymentEpoch`, emitted by the contracts
+// deployments artifact). On load, it compares the stored epoch to the CURRENT
+// one; a mismatch means a full-reset redeploy happened (new factory / new
+// DelegationManager / new signature validator), so the stored grant + session
+// delegation are signed against a now-dead EIP-712 domain and will fail
+// on-chain verification — the confusing "Signed in, but every vault call
+// 401s" state. Detecting it lets the app force a reconnect instead.
+//
+// Pure + storage-agnostic: the app owns where the epoch is stored (its session
+// blob) and what it does with the verdict (clear + route to reconnect). This
+// module only decides.
+/**
+ * Compare a stored session's epoch to the current deployment epoch.
+ *
+ * - `current` undefined ⇒ `'unknown'`: the running build carries no epoch
+ *   (e.g. an older deployments artifact), so we CANNOT know staleness and must
+ *   NOT gate — fail-open only when knowledge is absent (never a silent
+ *   fallback to a weaker check; there simply is no check to run).
+ * - `stored` undefined ⇒ `'unstamped'`: a session written before the guard
+ *   existed. Since the guard's whole purpose is post-reset recovery, callers
+ *   SHOULD treat this like `'stale'` and force a reconnect.
+ * - otherwise: string equality → `'ok'` | `'stale'`.
+ */
+export function checkDeploymentEpoch(current, stored) {
+    if (!current)
+        return 'unknown';
+    if (!stored)
+        return 'unstamped';
+    return stored === current ? 'ok' : 'stale';
+}
+/** Convenience: does this verdict require dropping the session + reconnecting?
+ *  `unstamped` and `stale` both do; `ok` and `unknown` do not. */
+export function requiresReconnect(verdict) {
+    return verdict === 'stale' || verdict === 'unstamped';
+}
+//# sourceMappingURL=deployment-epoch.js.map

package/dist/deployment-epoch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-epoch.js","sourceRoot":"","sources":["../src/deployment-epoch.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,wEAAwE;AACxE,yEAAyE;AACzE,oEAAoE;AACpE,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,uBAAuB;AAQvB;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA2B,EAC3B,MAA0B;IAE1B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC;IAChC,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED;kEACkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,OAA+B;IAC/D,OAAO,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,WAAW,CAAC;AACxD,CAAC"}

package/dist/index.d.ts

@@ -3,4 +3,6 @@ export declare const SPEC_REF = "specs/295-relying-connect-client.md";
 export { createConnectClient, generatePkce, randomB64url, type ConnectClient, type ConnectClientConfig, type AuthorizeTemplate, type IdTokenClaims, type TokenResult, type EnrollmentStart, type WireDelegation, } from './oidc.js';
 export { openCentralAuthPopup, preferRedirect, relayCodeIfPopupReturn, type PopupResult, } from './popup.js';
 export { connectViaRedirect, connectViaPopup, connectViaFedcm, type ConnectStash, type PopupConnectResult, type FedcmConnectResult, } from './launch.js';
+export { checkDeploymentEpoch, requiresReconnect, type DeploymentEpochVerdict, } from './deployment-epoch.js';
+export { listQuickConnect, connectAsQuickConnect, type QuickConnectIdentity, type QuickConnectSession, type QuickConnectConfig, } from './quick-connect.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,YAAY,sCAAsC,CAAC;AAChE,eAAO,MAAM,QAAQ,wCAAwC,CAAC;AAE9D,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,YAAY,sCAAsC,CAAC;AAChE,eAAO,MAAM,QAAQ,wCAAwC,CAAC;AAE9D,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -10,4 +10,9 @@ export const SPEC_REF = 'specs/295-relying-connect-client.md';
 export { createConnectClient, generatePkce, randomB64url, } from './oidc.js';
 export { openCentralAuthPopup, preferRedirect, relayCodeIfPopupReturn, } from './popup.js';
 export { connectViaRedirect, connectViaPopup, connectViaFedcm, } from './launch.js';
+export { checkDeploymentEpoch, requiresReconnect, } from './deployment-epoch.js';
+// Quick-connect identities a Home may offer (the client half of its persona registry). Gated by the
+// HOME: `listQuickConnect` returns [] when none are offered, so the affordance disappears everywhere at
+// once without any app shipping a flag.
+export { listQuickConnect, connectAsQuickConnect, } from './quick-connect.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,EAAE;AACF,uGAAuG;AACvG,uGAAuG;AACvG,iGAAiG;AACjG,wGAAwG;AACxG,8FAA8F;AAE9F,MAAM,CAAC,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAChE,MAAM,CAAC,MAAM,QAAQ,GAAG,qCAAqC,CAAC;AAE9D,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,YAAY,GAQb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,sBAAsB,GAEvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,GAIhB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,EAAE;AACF,uGAAuG;AACvG,uGAAuG;AACvG,iGAAiG;AACjG,wGAAwG;AACxG,8FAA8F;AAE9F,MAAM,CAAC,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAChE,MAAM,CAAC,MAAM,QAAQ,GAAG,qCAAqC,CAAC;AAE9D,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,YAAY,GAQb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,sBAAsB,GAEvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,GAIhB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAE/B,oGAAoG;AACpG,wGAAwG;AACxG,wCAAwC;AACxC,OAAO,EACL,gBAAgB,EAChB,qBAAqB,GAItB,MAAM,oBAAoB,CAAC"}

package/dist/oidc.d.ts

@@ -37,6 +37,11 @@ export interface TokenResult {
     delegation?: WireDelegation;
     /** Present for `org-create`: the created org's identity + its broker delegation. */
     org?: Record<string, unknown>;
+    /** spec 345 — a `delegator = delegate = person` grant scoped to the person's OWN vault record
+     *  family, present when the requesting client's Home-side registry declared `self_vault_grant`.
+     *  Rides the SAME plain sign-in as `delegation` — no separate ceremony. Generic: any relying app
+     *  may use this, not tied to one app's domain. Opaque here; the app casts to its `DelegationWire`. */
+    selfVaultGrant?: WireDelegation;
 }
 /** The PKCE + state + nonce a started enrollment must round-trip back to `exchangeCode`/`verifyIdToken`. */
 export interface EnrollmentStart {
@@ -64,6 +69,8 @@ interface AuthorizeParams {
     orgBase?: string;
     purpose?: string;
     grantOrg?: Address;
+    /** org-create: reuse an EXISTING org the person stewards — the Home grants from it instead of deploying. */
+    existingOrg?: Address;
     /** Appended when launching in a popup (the Home posts the result back instead of redirecting). */
     mode?: 'popup';
 }
@@ -75,10 +82,18 @@ export interface ConnectClient {
     startEnrollment(name: string, opts?: {
         mode?: 'popup';
     }): Promise<EnrollmentStart>;
-    /** Build an `org-create` authorize request (deploy + custody an org SA at the Home). */
-    startOrgCreation(personName: string, orgBase: string, opts?: {
+    /** Build an `org-create` authorize request (deploy + custody an org SA at the Home). Omit `orgBase`
+     *  (and `existingOrg`) to run CHOOSER MODE: the Home asks the member to pick an org they already
+     *  steward — granting from it, no deploy — or to name a new one there. */
+    startOrgCreation(personName: string, orgBase?: string, opts?: {
         purpose?: string;
         grantOrg?: Address;
+        existingOrg?: Address;
+        mode?: 'popup';
+    }): Promise<EnrollmentStart>;
+    /** Deploy a workspace-kind Smart Agent (at:WorkspaceAgent). Name is required. */
+    startWorkspaceCreation(personName: string, workspaceName: string, opts?: {
+        purpose?: string;
         mode?: 'popup';
     }): Promise<EnrollmentStart>;
     /** Exchange the authorization `code` at the Home's `/token` (PKCE) → `{ idToken, delegation, org? }`. */

package/dist/oidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD;0GAC0G;AAC1G,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD;6EAC6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,YAAY,GAAG,MAAM,CAAC;AAErE,0GAA0G;AAC1G,MAAM,WAAW,mBAAmB;IAClC,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,QAAQ,EAAE,OAAO,CAAC;IAClB,qGAAqG;IACrG,WAAW,EAAE,MAAM,MAAM,CAAC;IAC1B;0FACsF;IACtF,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC/D,6FAA6F;IAC7F,qBAAqB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB;8EAC0E;IAC1E,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,4GAA4G;AAC5G,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAiBD,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9C;AACD,0FAA0F;AAC1F,wBAAsB,YAAY,IAAI,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrF;AAED,UAAU,eAAe;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kGAAkG;IAClG,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,iBAAiB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;IAC9C;6FACyF;IACzF,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACnF,wFAAwF;IACxF,gBAAgB,CACd,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,yGAAyG;IACzG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3F;oEACgE;IAChE,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAClG,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAAC;IAC9C,mGAAmG;IACnG,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACnD;;wFAEoF;IACpF,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAChD;AAED;4GAC4G;AAC5G,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAyF9E"}
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD;0GAC0G;AAC1G,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD;6EAC6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,YAAY,GAAG,MAAM,CAAC;AAErE,0GAA0G;AAC1G,MAAM,WAAW,mBAAmB;IAClC,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,QAAQ,EAAE,OAAO,CAAC;IAClB,qGAAqG;IACrG,WAAW,EAAE,MAAM,MAAM,CAAC;IAC1B;0FACsF;IACtF,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC/D,6FAA6F;IAC7F,qBAAqB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB;8EAC0E;IAC1E,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B;;;0GAGsG;IACtG,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,4GAA4G;AAC5G,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAiBD,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9C;AACD,0FAA0F;AAC1F,wBAAsB,YAAY,IAAI,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrF;AAED,UAAU,eAAe;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4GAA4G;IAC5G,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kGAAkG;IAClG,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,iBAAiB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;IAC9C;6FACyF;IACzF,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACnF;;8EAE0E;IAC1E,gBAAgB,CACd,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GACrF,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,iFAAiF;IACjF,sBAAsB,CACpB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1C,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,yGAAyG;IACzG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3F;oEACgE;IAChE,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAClG,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAAC;IAC9C,mGAAmG;IACnG,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACnD;;wFAEoF;IACpF,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAChD;AAED;4GAC4G;AAC5G,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,CA4F9E"}

package/dist/oidc.js

@@ -57,6 +57,8 @@ export function createConnectClient(config) {
             u.searchParams.set('org_purpose', p.purpose);
         if (p.grantOrg)
             u.searchParams.set('grant_org', p.grantOrg);
+        if (p.existingOrg)
+            u.searchParams.set('existing_org', p.existingOrg);
         if (p.mode)
             u.searchParams.set('mode', p.mode);
         return u.toString();
@@ -73,7 +75,8 @@ export function createConnectClient(config) {
     return {
         buildAuthorizeUrl,
         startEnrollment: (name, opts) => begin(name, 'site-login', { mode: opts?.mode }),
-        startOrgCreation: (personName, orgBase, opts) => begin(personName, 'org-create', { orgBase, purpose: opts?.purpose, grantOrg: opts?.grantOrg, mode: opts?.mode }),
+        startOrgCreation: (personName, orgBase, opts) => begin(personName, 'org-create', { orgBase, purpose: opts?.purpose, grantOrg: opts?.grantOrg, existingOrg: opts?.existingOrg, mode: opts?.mode }),
+        startWorkspaceCreation: (personName, workspaceName, opts) => begin(personName, 'workspace-create', { orgBase: workspaceName, purpose: opts?.purpose, mode: opts?.mode }),
         async exchangeCode(authOrigin, code, codeVerifier) {
             const r = await fetch(new URL('/token', authOrigin).toString(), {
                 method: 'POST',
@@ -83,7 +86,7 @@ export function createConnectClient(config) {
             const b = (await r.json().catch(() => ({})));
             if (!r.ok || !b.id_token)
                 throw new Error(b.error ?? `token exchange failed (HTTP ${r.status})`);
-            return { idToken: b.id_token, delegation: b.delegation, org: b.org };
+            return { idToken: b.id_token, delegation: b.delegation, org: b.org, selfVaultGrant: b.selfVaultGrant };
         },
         async verifyIdToken(authOrigin, idToken, expectedNonce) {
             if (!config.isAllowedIssuerOrigin(authOrigin)) {

package/dist/oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,4GAA4G;AAC5G,4GAA4G;AAC5G,4GAA4G;AAC5G,6CAA6C;AAC7C,EAAE;AACF,0GAA0G;AAC1G,8GAA8G;AAC9G,0FAA0F;AA0D1F,0EAA0E;AAC1E,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AACD,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,gBAAgB,CAAI,GAAW;IACtC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAM,CAAC;AACpE,CAAC;AACD,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AACD,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AA2CD;4GAC4G;AAC5G,MAAM,UAAU,mBAAmB,CAAC,MAA2B;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,cAAc,CAAC;IAE7C,MAAM,iBAAiB,GAAG,CAAC,CAAkB,EAAU,EAAE;QACvD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;QACtD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,OAAO;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,CAAC,OAAO;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC,QAAQ;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC,IAAI;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EACjB,IAAY,EACZ,QAA2B,EAC3B,QAA4E,EAAE,EACpD,EAAE;QAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7E,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,gBAAgB,CAAgB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEvH,OAAO;QACL,iBAAiB;QACjB,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAChF,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAC9C,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAElH,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY;YAC/C,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAC9D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;aAC9J,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAsG,CAAC;YAClJ,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,+BAA+B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACjG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QACvE,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa;YACpD,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,wCAAwC,UAAU,oBAAoB,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC9D,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAiC,CAAC;YACpD,MAAM,MAAM,GAAG,gBAAgB,CAAiC,CAAC,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,gBAAgB,CAAgB,CAAC,CAAC,CAAC;YAClD,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAEpF,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC1D,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC7F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACrI,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAChG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC7E,IAAI,aAAa,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAChG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC3G,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,aAAa;QACb,wBAAwB,CAAC,OAAO;YAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,GAAG,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC,CAAC,GAAG,CAAY,CAAC;QACtE,CAAC;QACD,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,4GAA4G;AAC5G,4GAA4G;AAC5G,4GAA4G;AAC5G,6CAA6C;AAC7C,EAAE;AACF,0GAA0G;AAC1G,8GAA8G;AAC9G,0FAA0F;AA+D1F,0EAA0E;AAC1E,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AACD,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,gBAAgB,CAAI,GAAW;IACtC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAM,CAAC;AACpE,CAAC;AACD,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AACD,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAqDD;4GAC4G;AAC5G,MAAM,UAAU,mBAAmB,CAAC,MAA2B;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,cAAc,CAAC;IAE7C,MAAM,iBAAiB,GAAG,CAAC,CAAkB,EAAU,EAAE;QACvD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;QACtD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,OAAO;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,CAAC,OAAO;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC,QAAQ;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC,WAAW;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,CAAC,CAAC,IAAI;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EACjB,IAAY,EACZ,QAA2B,EAC3B,QAA4F,EAAE,EACpE,EAAE;QAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7E,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,gBAAgB,CAAgB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEvH,OAAO;QACL,iBAAiB;QACjB,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAChF,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAC9C,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAClJ,sBAAsB,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAC1D,KAAK,CAAC,UAAU,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAE7G,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY;YAC/C,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAC9D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;aAC9J,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuI,CAAC;YACnL,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,+BAA+B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACjG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;QACzG,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa;YACpD,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,wCAAwC,UAAU,oBAAoB,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC9D,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAiC,CAAC;YACpD,MAAM,MAAM,GAAG,gBAAgB,CAAiC,CAAC,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,gBAAgB,CAAgB,CAAC,CAAC,CAAC;YAClD,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAEpF,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC1D,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC7F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACrI,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAChG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC7E,IAAI,aAAa,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAChG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC3G,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,aAAa;QACb,wBAAwB,CAAC,OAAO;YAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,GAAG,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC,CAAC,GAAG,CAAY,CAAC;QACtE,CAAC;QACD,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC;AACJ,CAAC"}

package/dist/quick-connect.d.ts

@@ -0,0 +1,58 @@
+/** One identity a Home offers for quick connect. */
+export interface QuickConnectIdentity {
+    /** Short stable id used to request a session. */
+    handle: string;
+    /** The canonical Smart Agent address — the identity itself (ADR-0010). */
+    sa: string;
+    /** Display name. */
+    name: string;
+    /** One-line description of who they are in the demo world. */
+    blurb: string;
+    /** The custodian address holding their key at the Home, when disclosed. */
+    custodian?: string;
+    /** Agents this identity custodies (orgs, services) — what makes them useful for testing. */
+    custodies?: {
+        sa: string;
+        name?: string;
+        kind?: string;
+    }[];
+}
+/** What a Home returns when an app connects as one of them — an ordinary sign-in result. */
+export interface QuickConnectSession {
+    /** Canonical subject (CAIP-10 or SA address, per the Home). */
+    sub: string;
+    agentName: string | null;
+    /** OIDC id_token — what Home-run surfaces (inbox, invites) authenticate with. */
+    idToken: string;
+    /** The site-login delegation — the AUTHORITY half. A token authenticates; this authorizes. */
+    delegation: unknown;
+    /** The same person's Home session, so an app can hand off into their portal already signed in. */
+    homeSession?: string;
+    homeSessionExpiresIn?: number;
+}
+export interface QuickConnectConfig {
+    /** The Home origin, injected by the app's own domain module. */
+    homeOrigin: string;
+    /** This app's registered OIDC client id — the Home resolves the delegate from its OWN registry, so a
+     *  wrong value yields no session rather than a session scoped to somebody else. */
+    clientId: string;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * List the identities this Home offers.
+ *
+ * Returns `[]` for every non-success — a Home that does not offer the feature, an origin that is not a
+ * Home, a network failure. That is deliberate: the ONLY use of this list is deciding whether to show an
+ * affordance, and "show nothing" is the correct outcome in all of those cases. It never throws, so a
+ * Home being unreachable cannot break an app's header.
+ */
+export declare function listQuickConnect(config: QuickConnectConfig): Promise<QuickConnectIdentity[]>;
+/**
+ * Connect as one of them.
+ *
+ * THROWS on failure, unlike the list above, and the asymmetry is intentional: listing decides whether to
+ * offer a choice, where silence is a fine answer; connecting is a user action, where silence would leave
+ * someone looking at a button that did nothing. A failed connect must say so.
+ */
+export declare function connectAsQuickConnect(config: QuickConnectConfig, handleOrSa: string): Promise<QuickConnectSession>;
+//# sourceMappingURL=quick-connect.d.ts.map

package/dist/quick-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-connect.d.ts","sourceRoot":"","sources":["../src/quick-connect.ts"],"names":[],"mappings":"AAoBA,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,SAAS,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5D;AAED,4FAA4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,UAAU,EAAE,OAAO,CAAC;IACpB,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB;uFACmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAID;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAalG;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,kBAAkB,EAC1B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,CAAC,CA2B9B"}

package/dist/quick-connect.js

@@ -0,0 +1,79 @@
+// Quick-connect identities offered by a Home (spec 295; the client half of the Home's persona registry).
+//
+// WHAT THIS IS FOR. A Home MAY offer a small set of pre-custodied identities a relying app can connect
+// as without running a credential ceremony — the same person, same Smart Agent, same vault and org
+// memberships, in every app that asks. It exists so a demo or a test can exercise a real authority
+// chain instead of a mock: the identity is an actual on-chain SA whose custodian the Home holds, so
+// every downstream signature, delegation and vault read is genuine.
+//
+// GATED BY THE HOME, NOT BY THE APP. `listQuickConnect` returns `[]` when the Home offers none, and an
+// app is expected to render nothing in that case. That is the whole configuration story: a Home without
+// the feature enabled reports an empty list, so the affordance disappears everywhere at once without
+// any app shipping a flag. An app that hard-coded its own list would defeat that.
+//
+// THIS IS NOT A CREDENTIAL PATH. The app never holds a key. It asks the Home for a session and receives
+// exactly what an ordinary OIDC sign-in returns — an `id_token` and the site delegation. Anyone who can
+// reach an enabled Home can connect as these identities; that is what "connect as this account" means,
+// and it is why a Home only enables it for accounts that exist to be shared.
+//
+// NO HOSTNAMES (ADR-0021): the caller supplies its Home origin, as with everything else in this package.
+const trimOrigin = (o) => o.replace(/\/$/, '');
+/**
+ * List the identities this Home offers.
+ *
+ * Returns `[]` for every non-success — a Home that does not offer the feature, an origin that is not a
+ * Home, a network failure. That is deliberate: the ONLY use of this list is deciding whether to show an
+ * affordance, and "show nothing" is the correct outcome in all of those cases. It never throws, so a
+ * Home being unreachable cannot break an app's header.
+ */
+export async function listQuickConnect(config) {
+    const doFetch = config.fetchImpl ?? fetch;
+    try {
+        const res = await doFetch(`${trimOrigin(config.homeOrigin)}/connect/demo-personas`, {
+            method: 'GET',
+            headers: { accept: 'application/json' },
+        });
+        if (!res.ok)
+            return [];
+        const body = (await res.json());
+        return Array.isArray(body.personas) ? body.personas : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Connect as one of them.
+ *
+ * THROWS on failure, unlike the list above, and the asymmetry is intentional: listing decides whether to
+ * offer a choice, where silence is a fine answer; connecting is a user action, where silence would leave
+ * someone looking at a button that did nothing. A failed connect must say so.
+ */
+export async function connectAsQuickConnect(config, handleOrSa) {
+    const doFetch = config.fetchImpl ?? fetch;
+    const isSa = /^0x[0-9a-fA-F]{40}$/.test(handleOrSa);
+    const res = await doFetch(`${trimOrigin(config.homeOrigin)}/connect/demo-signin`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ ...(isSa ? { sa: handleOrSa } : { handle: handleOrSa }), client_id: config.clientId }),
+    });
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        throw new Error(body.error ?? `quick connect failed (${res.status})`);
+    }
+    if (typeof body.id_token !== 'string' || !body.delegation) {
+        // A session without BOTH halves is not a session. The token authenticates and the delegation
+        // authorizes; an app that accepted one without the other would be authenticated and unable to act,
+        // or acting without having authenticated — and would discover it much later (ADR-0041).
+        throw new Error('quick connect returned an incomplete session (missing id_token or delegation)');
+    }
+    return {
+        sub: String(body.sub ?? ''),
+        agentName: body.agent_name ?? null,
+        idToken: body.id_token,
+        delegation: body.delegation,
+        homeSession: typeof body.homeSession === 'string' ? body.homeSession : undefined,
+        homeSessionExpiresIn: typeof body.homeSessionExpiresIn === 'number' ? body.homeSessionExpiresIn : undefined,
+    };
+}
+//# sourceMappingURL=quick-connect.js.map

package/dist/quick-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-connect.js","sourceRoot":"","sources":["../src/quick-connect.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,EAAE;AACF,uGAAuG;AACvG,mGAAmG;AACnG,mGAAmG;AACnG,oGAAoG;AACpG,oEAAoE;AACpE,EAAE;AACF,uGAAuG;AACvG,wGAAwG;AACxG,qGAAqG;AACrG,kFAAkF;AAClF,EAAE;AACF,wGAAwG;AACxG,wGAAwG;AACxG,uGAAuG;AACvG,6EAA6E;AAC7E,EAAE;AACF,yGAAyG;AAyCzG,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAA0B;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,wBAAwB,EAAE;YAClF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0C,CAAC;QACzE,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA0B,EAC1B,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,sBAAsB,EAAE;QAChF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;KAC9G,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAiD,CAAC;IAClG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,yBAAyB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1D,6FAA6F;QAC7F,mGAAmG;QACnG,wFAAwF;QACxF,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QAC3B,SAAS,EAAG,IAAI,CAAC,UAA4B,IAAI,IAAI;QACrD,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAChF,oBAAoB,EAClB,OAAO,IAAI,CAAC,oBAAoB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS;KACxF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/connect-client",
-  "version": "1.0.0-alpha.1",
+  "version": "1.0.0-alpha.11",
   "description": "Generic relying-party connect client: hand off to the central-auth Home (FedCM-first → OIDC redirect/popup), exchange the code for an SA-signed scoped delegation. The relying half of spec 230/259; no credential ever originates in the relying app.",
   "license": "MIT",
   "repository": {
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@agenticprimitives/fedcm-rp": "1.0.0-alpha.6",
-    "@agenticprimitives/types": "1.0.0-alpha.13"
+    "@agenticprimitives/types": "1.0.0-alpha.21"
   },
   "devDependencies": {
     "@types/node": "^22.7.0",