@andco/sdk 0.0.1

package/dist/server/index.d.ts

@@ -0,0 +1,21 @@
+import { AndcoClient, type AndcoClientOptions } from "../client.js";
+export type AndcoServerOptions = AndcoClientOptions;
+/**
+ * Creates an Andco Instance for a server.
+ *
+ * It holds no session. Credentials arrive per request through `with(...)`, which is what makes one
+ * module-scoped instance safe to share across concurrent requests: there is no field for one user's
+ * credentials to leak into another's response.
+ *
+ * It refuses to run in a browser, because a confidential client secret must never reach one.
+ *
+ * @example
+ * ```ts
+ * export const andco = createAndcoInstanceForServer({ clientId, clientSecret });
+ *
+ * // in a request handler
+ * const { data } = await bank.use(andco.with(session)).client.http.GET("/accounts").throwOnError();
+ * ```
+ */
+export declare function createAndcoInstanceForServer(options: AndcoServerOptions): AndcoClient;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGpE,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAOrF"}

package/dist/server/index.js

@@ -0,0 +1,27 @@
+import { AndcoClient } from "../client.js";
+import { ANDCO_ERROR_CODES, AndcoError } from "../errors.js";
+/**
+ * Creates an Andco Instance for a server.
+ *
+ * It holds no session. Credentials arrive per request through `with(...)`, which is what makes one
+ * module-scoped instance safe to share across concurrent requests: there is no field for one user's
+ * credentials to leak into another's response.
+ *
+ * It refuses to run in a browser, because a confidential client secret must never reach one.
+ *
+ * @example
+ * ```ts
+ * export const andco = createAndcoInstanceForServer({ clientId, clientSecret });
+ *
+ * // in a request handler
+ * const { data } = await bank.use(andco.with(session)).client.http.GET("/accounts").throwOnError();
+ * ```
+ */
+export function createAndcoInstanceForServer(options) {
+    if (typeof window !== "undefined") {
+        throw new AndcoError(ANDCO_ERROR_CODES.BROWSER_FORBIDDEN, {
+            message: "createAndcoInstanceForServer cannot run in a browser",
+        });
+    }
+    return new AndcoClient(options);
+}

package/dist/server-metadata.generated.d.ts

@@ -0,0 +1,4 @@
+import type * as oidc from "openid-client";
+/** The baked metadata, re-rooted on one deployment's issuer. */
+export declare function andcoServerMetadata(issuer: string): oidc.ServerMetadata;
+//# sourceMappingURL=server-metadata.generated.d.ts.map

package/dist/server-metadata.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-metadata.generated.d.ts","sourceRoot":"","sources":["../src/server-metadata.generated.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,KAAK,IAAI,MAAM,eAAe,CAAC;AAsC3C,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,cAAc,CAEvE"}

package/dist/server-metadata.generated.js

@@ -0,0 +1,49 @@
+// WARNING: GENERATED FILE. DO NOT EDIT BY HAND.
+//
+// The Authorization Server's own description of itself, read once at build time instead of on every
+// application's first sign-in. ADR-0021 explains why it is baked and what breaks when it is stale:
+// every value here is one the server owns, and a wrong one fails silently at the last step of a
+// sign-in. `{issuer}` is substituted with the configured `endpointAuth`.
+//
+// Regenerate: pnpm --filter @andco/sdk run refresh:server-metadata
+// Source: https://auth.localhost/auth/v1/.well-known/openid-configuration
+// Generated: 2026-09-19T01:19:04.372Z
+const TEMPLATE = {
+    issuer: "{issuer}",
+    authorization_endpoint: "{issuer}/oauth/authorize",
+    token_endpoint: "{issuer}/oauth/token",
+    device_authorization_endpoint: "{issuer}/oauth/device/authorize",
+    jwks_uri: "{issuer}/.well-known/jwks.json",
+    userinfo_endpoint: "{issuer}/oauth/userinfo",
+    registration_endpoint: "{issuer}/oauth/clients/register",
+    scopes_supported: ["openid", "profile", "email", "phone", "offline_access"],
+    response_types_supported: ["code"],
+    response_modes_supported: ["query"],
+    grant_types_supported: ["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"],
+    subject_types_supported: ["public"],
+    id_token_signing_alg_values_supported: ["RS256", "HS256", "ES256"],
+    token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post", "none"],
+    claims_supported: [
+        "sub",
+        "aud",
+        "iss",
+        "exp",
+        "iat",
+        "auth_time",
+        "nonce",
+        "email",
+        "email_verified",
+        "phone_number",
+        "phone_number_verified",
+        "name",
+        "picture",
+        "preferred_username",
+        "updated_at",
+    ],
+    code_challenge_methods_supported: ["S256", "plain"],
+    pushed_authorization_request_endpoint: "{issuer}/oauth/par",
+};
+/** The baked metadata, re-rooted on one deployment's issuer. */
+export function andcoServerMetadata(issuer) {
+    return JSON.parse(JSON.stringify(TEMPLATE).replaceAll("{issuer}", issuer));
+}

package/dist/session-store.d.ts

@@ -0,0 +1,83 @@
+import type { AndcoConfig } from "./config.js";
+import { type AndcoCredentials, type AndcoSession } from "./credentials.js";
+import { AndcoError, Result } from "./errors.js";
+import type { AndcoOAuth } from "./oauth.js";
+import { type AndcoLock, type AndcoStorage } from "./storage.js";
+/** Reads a session that arrived from somewhere other than storage, such as a URL callback. */
+export type AndcoSessionSource = () => Promise<Result<AndcoSession | null>>;
+export type AndcoSessionStoreOptions = {
+    config: AndcoConfig;
+    oauth: AndcoOAuth;
+    storage?: AndcoStorage;
+    /** A session the caller already resolved. Makes the first snapshot real instead of unresolved. */
+    initialSession?: AndcoSession | null;
+    /** Serializes refresh beyond this runtime. Defaults to in-process only. */
+    lock?: AndcoLock;
+    /** Consulted once during the load, before storage. Used for URL callbacks. */
+    source?: AndcoSessionSource;
+    /** Whether a loaded session is written back to storage. */
+    persist?: boolean;
+};
+/**
+ * The credential as a resource, and the only stateful object in the SDK.
+ *
+ * Two rules make it safe to construct anywhere, including inside a render that a framework may
+ * throw away:
+ *
+ * Construction is pure. Nothing is read, fetched, or written when the store is built.
+ *
+ * The load is lazy and starts on the first *read* — a subscription, an await on `ready`, or a token
+ * resolution. It never starts from `getSnapshot`. React calls the snapshot getter during render and
+ * the subscriber in commit, so a render that is never committed never triggers a load. That is what
+ * makes a discarded construction inert, and it matters most for an authorization code, which is
+ * single-use: a discarded store that exchanged one would leave the retained store with nothing.
+ *
+ * @example
+ * ```ts
+ * const session = useSyncExternalStore(
+ *   store.subscribe.bind(store),
+ *   store.getSnapshot.bind(store),
+ *   store.getServerSnapshot.bind(store),
+ * );
+ * ```
+ */
+export declare class AndcoSessionStore implements AndcoCredentials {
+    #private;
+    constructor(options: AndcoSessionStoreOptions);
+    /**
+     * The current value. `undefined` is Instance Readiness: the load has not finished. It is not the
+     * same as `null`, which means there is no session, and an application that renders them the same
+     * way flashes a signed-out state on every load.
+     *
+     * Pure by contract. Reading this never starts the load.
+     */
+    getSnapshot(): AndcoSession | null | undefined;
+    /** What a server render sees: the hydration value, or unresolved. Never touches storage. */
+    getServerSnapshot(): AndcoSession | null | undefined;
+    /** Observes changes and starts the load. The returned function is the unsubscribe. */
+    subscribe(listener: () => void): () => void;
+    /**
+     * Settles when the initial load finishes.
+     *
+     * Only code that reads the synchronous snapshot needs this — a test asserting there is no
+     * session, or a script branching before it does work. The ordinary path needs nothing, because
+     * `accessTokenFor` awaits the load itself.
+     */
+    get ready(): Promise<Result<void>>;
+    /**
+     * Resolves a token for one Resource Indicator, refreshing when the current one is stale.
+     *
+     * Refresh is lazy and never scheduled. No timer exists anywhere in the SDK, which is what lets a
+     * discarded instance be inert and removes any need for instance identity.
+     */
+    accessTokenFor(resource: string): Promise<string | null>;
+    /**
+     * Replaces the stored session. This is the supported way to restore a saved credential, which
+     * previously required writing a JSON blob into the SDK's private storage key because no such
+     * method existed.
+     */
+    set(session: AndcoSession | null): Promise<Result<void>>;
+}
+/** Raised when a store is asked for something only a browser can provide. */
+export declare function browserRequired(): AndcoError;
+//# sourceMappingURL=session-store.d.ts.map

package/dist/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../src/session-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAuB,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAqB,UAAU,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,YAAY,EAAgC,MAAM,cAAc,CAAC;AAE/F,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;AAE5E,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,kGAAkG;IAClG,cAAc,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC,2EAA2E;IAC3E,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,iBAAkB,YAAW,gBAAgB;;gBAWrC,OAAO,EAAE,wBAAwB;IASpD;;;;;;OAMG;IACI,WAAW,IAAI,YAAY,GAAG,IAAI,GAAG,SAAS;IAIrD,4FAA4F;IACrF,iBAAiB,IAAI,YAAY,GAAG,IAAI,GAAG,SAAS;IAI3D,sFAAsF;IAC/E,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAQlD;;;;;;OAMG;IACH,IAAW,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAExC;IAED;;;;;OAKG;IACU,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAsBrE;;;;OAIG;IACU,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAsDtE;AAgBD,6EAA6E;AAC7E,wBAAgB,eAAe,IAAI,UAAU,CAE5C"}

package/dist/session-store.js

@@ -0,0 +1,186 @@
+import { isExpired, tokenFor } from "./credentials.js";
+import { ANDCO_ERROR_CODES, AndcoError, Result } from "./errors.js";
+import { InProcessLock, MemoryStorage } from "./storage.js";
+/**
+ * The credential as a resource, and the only stateful object in the SDK.
+ *
+ * Two rules make it safe to construct anywhere, including inside a render that a framework may
+ * throw away:
+ *
+ * Construction is pure. Nothing is read, fetched, or written when the store is built.
+ *
+ * The load is lazy and starts on the first *read* — a subscription, an await on `ready`, or a token
+ * resolution. It never starts from `getSnapshot`. React calls the snapshot getter during render and
+ * the subscriber in commit, so a render that is never committed never triggers a load. That is what
+ * makes a discarded construction inert, and it matters most for an authorization code, which is
+ * single-use: a discarded store that exchanged one would leave the retained store with nothing.
+ *
+ * @example
+ * ```ts
+ * const session = useSyncExternalStore(
+ *   store.subscribe.bind(store),
+ *   store.getSnapshot.bind(store),
+ *   store.getServerSnapshot.bind(store),
+ * );
+ * ```
+ */
+export class AndcoSessionStore {
+    #options;
+    #storage;
+    #lock;
+    #listeners = new Set();
+    #key;
+    #hydrated;
+    #snapshot;
+    #load;
+    constructor(options) {
+        this.#options = options;
+        this.#storage = options.storage ?? new MemoryStorage();
+        this.#lock = options.lock ?? new InProcessLock();
+        this.#key = `andco.session.${options.config.clientId}`;
+        this.#hydrated = options.initialSession;
+        this.#snapshot = options.initialSession;
+    }
+    /**
+     * The current value. `undefined` is Instance Readiness: the load has not finished. It is not the
+     * same as `null`, which means there is no session, and an application that renders them the same
+     * way flashes a signed-out state on every load.
+     *
+     * Pure by contract. Reading this never starts the load.
+     */
+    getSnapshot() {
+        return this.#snapshot;
+    }
+    /** What a server render sees: the hydration value, or unresolved. Never touches storage. */
+    getServerSnapshot() {
+        return this.#hydrated;
+    }
+    /** Observes changes and starts the load. The returned function is the unsubscribe. */
+    subscribe(listener) {
+        this.#listeners.add(listener);
+        void this.#ensureLoaded();
+        return () => {
+            this.#listeners.delete(listener);
+        };
+    }
+    /**
+     * Settles when the initial load finishes.
+     *
+     * Only code that reads the synchronous snapshot needs this — a test asserting there is no
+     * session, or a script branching before it does work. The ordinary path needs nothing, because
+     * `accessTokenFor` awaits the load itself.
+     */
+    get ready() {
+        return this.#ensureLoaded();
+    }
+    /**
+     * Resolves a token for one Resource Indicator, refreshing when the current one is stale.
+     *
+     * Refresh is lazy and never scheduled. No timer exists anywhere in the SDK, which is what lets a
+     * discarded instance be inert and removes any need for instance identity.
+     */
+    async accessTokenFor(resource) {
+        await this.#ensureLoaded();
+        const current = this.#snapshot;
+        if (!current)
+            return null;
+        if (!isExpired(current))
+            return tokenFor(current, resource);
+        // Serialized per resource: refreshing one Resource Server's token must not block another's.
+        const refreshed = await this.#lock.acquire(`${this.#key}:${resource}`, async () => {
+            const latest = this.#snapshot;
+            if (!latest)
+                return null;
+            // Another holder of the lock may have refreshed while this one waited.
+            if (!isExpired(latest))
+                return latest;
+            if (!latest.refreshToken)
+                return null;
+            const result = await this.#options.oauth.refresh(latest.refreshToken);
+            if (result.error)
+                return null;
+            await this.#write(result.data);
+            return result.data;
+        });
+        return refreshed ? tokenFor(refreshed, resource) : null;
+    }
+    /**
+     * Replaces the stored session. This is the supported way to restore a saved credential, which
+     * previously required writing a JSON blob into the SDK's private storage key because no such
+     * method existed.
+     */
+    async set(session) {
+        // A caller setting a session has answered the load, so mark it settled rather than racing it.
+        this.#load ??= Promise.resolve(Result.ok(undefined));
+        try {
+            await this.#write(session);
+            return Result.ok(undefined);
+        }
+        catch (cause) {
+            return Result.fail(AndcoError.from(cause, ANDCO_ERROR_CODES.STORAGE_FAILED));
+        }
+    }
+    #ensureLoaded() {
+        this.#load ??= this.#loadOnce();
+        return this.#load;
+    }
+    async #loadOnce() {
+        try {
+            const fromSource = this.#options.source ? await this.#options.source() : null;
+            if (fromSource?.error) {
+                this.#publish(this.#snapshot ?? null);
+                return Result.fail(fromSource.error);
+            }
+            if (fromSource?.data) {
+                await this.#write(fromSource.data);
+                return Result.ok(undefined);
+            }
+            if (this.#hydrated !== undefined) {
+                this.#publish(this.#hydrated);
+                return Result.ok(undefined);
+            }
+            const stored = await this.#storage.getItem(this.#key);
+            this.#publish(stored ? parseSession(stored) : null);
+            return Result.ok(undefined);
+        }
+        catch (cause) {
+            this.#publish(this.#snapshot ?? null);
+            return Result.fail(AndcoError.from(cause, ANDCO_ERROR_CODES.STORAGE_FAILED));
+        }
+    }
+    async #write(session) {
+        if (this.#options.persist !== false) {
+            if (session)
+                await this.#storage.setItem(this.#key, JSON.stringify(session));
+            else
+                await this.#storage.removeItem(this.#key);
+        }
+        this.#publish(session);
+    }
+    #publish(session) {
+        this.#snapshot = session;
+        for (const listener of [...this.#listeners])
+            listener();
+    }
+}
+/** Reads a persisted session, treating anything unrecognisable as absent rather than throwing. */
+function parseSession(value) {
+    try {
+        const parsed = JSON.parse(value);
+        if (!parsed || typeof parsed !== "object")
+            return null;
+        const candidate = parsed;
+        if (typeof candidate.accessToken !== "string" || typeof candidate.expiresAt !== "number")
+            return null;
+        if (!candidate.user || typeof candidate.user.id !== "string")
+            return null;
+        return candidate;
+    }
+    catch {
+        return null;
+    }
+}
+/** Raised when a store is asked for something only a browser can provide. */
+export function browserRequired() {
+    return new AndcoError(ANDCO_ERROR_CODES.BROWSER_REQUIRED);
+}

package/dist/storage.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Where an Andco session is persisted.
+ *
+ * Every operation may answer synchronously or with a promise. The synchronous-only contract this
+ * replaces is the reason the Andco CLI had to build its own asynchronous credential store and then
+ * bridge it by writing a JSON blob into the SDK's private storage key: a keychain cannot answer
+ * synchronously, so there was no legal way to supply one.
+ *
+ * @example
+ * ```ts
+ * const secureStore: AndcoStorage = {
+ *   getItem: (key) => SecureStore.getItemAsync(key),
+ *   setItem: (key, value) => SecureStore.setItemAsync(key, value),
+ *   removeItem: (key) => SecureStore.deleteItemAsync(key),
+ * };
+ * ```
+ */
+export interface AndcoStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
+}
+/** Keeps a session only for the lifetime of the process. The default outside a browser. */
+export declare class MemoryStorage implements AndcoStorage {
+    #private;
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+/** Adapts a Web Storage object. Its synchronous methods satisfy the asynchronous-capable contract. */
+export declare class WebStorage implements AndcoStorage {
+    private readonly storage;
+    constructor(storage: Storage);
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+/**
+ * Serializes an operation per key.
+ *
+ * Refresh tokens rotate, so two concurrent refreshes destroy a session: the first rotates the token
+ * and every other one fails against a token that no longer exists. In-process single-flight covers
+ * one runtime; this covers several, which is what a serverless deployment and multiple browser tabs
+ * need. Not offering it is why both example backends invented their own locking, differently.
+ *
+ * @example
+ * ```ts
+ * const lock: AndcoLock = {
+ *   acquire: (key, operation) => redlock.using([`andco:${key}`], 5000, operation),
+ * };
+ * ```
+ */
+export interface AndcoLock {
+    acquire<T>(key: string, operation: () => Promise<T>): Promise<T>;
+}
+/** Serializes per key within one runtime. The default, and enough for a single process. */
+export declare class InProcessLock implements AndcoLock {
+    #private;
+    acquire<T>(key: string, operation: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=storage.d.ts.map

package/dist/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,2FAA2F;AAC3F,qBAAa,aAAc,YAAW,YAAY;;IAGzC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAInC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAGrC;AAED,sGAAsG;AACtG,qBAAa,UAAW,YAAW,YAAY;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,OAAO;IAE7C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAInC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAGrC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAClE;AAED,2FAA2F;AAC3F,qBAAa,aAAc,YAAW,SAAS;;IAGhC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAe9E"}

package/dist/storage.js

@@ -0,0 +1,47 @@
+/** Keeps a session only for the lifetime of the process. The default outside a browser. */
+export class MemoryStorage {
+    #values = new Map();
+    getItem(key) {
+        return this.#values.get(key) ?? null;
+    }
+    setItem(key, value) {
+        this.#values.set(key, value);
+    }
+    removeItem(key) {
+        this.#values.delete(key);
+    }
+}
+/** Adapts a Web Storage object. Its synchronous methods satisfy the asynchronous-capable contract. */
+export class WebStorage {
+    storage;
+    constructor(storage) {
+        this.storage = storage;
+    }
+    getItem(key) {
+        return this.storage.getItem(key);
+    }
+    setItem(key, value) {
+        this.storage.setItem(key, value);
+    }
+    removeItem(key) {
+        this.storage.removeItem(key);
+    }
+}
+/** Serializes per key within one runtime. The default, and enough for a single process. */
+export class InProcessLock {
+    #queues = new Map();
+    async acquire(key, operation) {
+        const previous = this.#queues.get(key) ?? Promise.resolve();
+        const run = previous.then(operation, operation);
+        // The stored link never rejects, so one failed operation cannot wedge the key for the next.
+        const link = run.then(() => undefined, () => undefined);
+        this.#queues.set(key, link);
+        try {
+            return await run;
+        }
+        finally {
+            if (this.#queues.get(key) === link)
+                this.#queues.delete(key);
+        }
+    }
+}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@andco/sdk",
+  "version": "0.0.1",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./browser": {
+      "types": "./dist/browser/index.d.ts",
+      "import": "./dist/browser/index.js",
+      "default": "./dist/browser/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "import": "./dist/server/index.js",
+      "default": "./dist/server/index.js"
+    },
+    "./cli": {
+      "types": "./dist/cli/index.d.ts",
+      "import": "./dist/cli/index.js",
+      "default": "./dist/cli/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@andco/openapi-fetch": "0.0.1",
+    "@andco/protocol": "0.0.1",
+    "openid-client": "^6.8.8"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^6.0.3"
+  },
+  "license": "Apache-2.0",
+  "description": "Andco SDK: OAuth authorization, sessions and API access for browser and server.",
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
+    "build": "pnpm run clean && tsc",
+    "refresh:server-metadata": "node --use-system-ca scripts/refresh-server-metadata.mjs",
+    "dev": "tsc --watch --preserveWatchOutput",
+    "check-types": "tsc --noEmit",
+    "lint": "tsc --noEmit",
+    "test": "vitest run",
+    "ui:check": "node -e \"\""
+  }
+}