@andco/sdk 0.0.2 → 0.0.4

package/dist/browser/popup.js

@@ -28,7 +28,8 @@ export function andcoPopupPresentationId() {
     return PRESENTATION_ID_PATTERN.test(presentationId) ? presentationId : null;
 }
 /**
- * Hands this document's callback to the window that opened it, then closes.
+ * Hands this document's callback — an authorization or an Intent outcome — to the window that
+ * opened it, then closes.
  *
  * The popup cannot complete the exchange itself: the PKCE verifier was generated by the opener and
  * never left it. So this is a courier, not a consumer — it carries the callback URL back and dies.
@@ -41,7 +42,11 @@ export function relayAndcoPopupCallback(allowedOrigins, options = {}) {
     if (typeof window === "undefined")
         return { status: "not_callback" };
     const url = options.callbackUrl ? new URL(options.callbackUrl, window.location.href) : new URL(window.location.href);
-    const isCallback = Boolean(options.callbackUrl) || url.searchParams.has("code") || url.searchParams.has("error");
+    const isCallback = Boolean(options.callbackUrl) ||
+        url.searchParams.has("code") ||
+        url.searchParams.has("error") ||
+        // An Intent callback carries no authorization code; its outcome is the whole payload.
+        url.searchParams.has("andco_intent_result");
     if (!isCallback)
         return { status: "not_callback" };
     const presentationId = andcoPopupPresentationId();
@@ -62,8 +67,9 @@ export function relayAndcoPopupCallback(allowedOrigins, options = {}) {
     const message = openerOrigin === window.location.origin ? sdkMessage(presentationId, url) : protocolResult(presentationId, url);
     // Strip before leaving. If closing is refused, the code must not remain visible in the address
     // bar or in the window name.
-    for (const parameter of ["code", "state", "error", "error_description"])
+    for (const parameter of ["code", "state", "error", "error_description", "andco_intent_result", "intent_id"]) {
         url.searchParams.delete(parameter);
+    }
     window.history.replaceState(window.history.state, "", url);
     window.name = "";
     window.opener?.postMessage(message, openerOrigin);
@@ -75,14 +81,25 @@ function sdkMessage(presentationId, url) {
 }
 function protocolResult(presentationId, url) {
     const envelope = { protocol: ANDCO_SDK_PROTOCOL, version: ANDCO_PROTOCOL_VERSION, presentationId };
+    // An Intent reports a lifecycle outcome and nothing else. Whether money moved is read from the
+    // Resource Server afterwards, never carried in a window message.
+    const intent = url.searchParams.get("andco_intent_result");
+    if (intent === "complete") {
+        return { ...envelope, type: "intent.complete" };
+    }
+    else if (intent) {
+        return { ...envelope, type: "intent.dismiss" };
+    }
     const code = url.searchParams.get("code");
-    if (code)
+    if (code) {
         return { ...envelope, type: "oauth.authorization_code", authorizationCode: code };
+    }
     const error = url.searchParams.get("error") ?? "invalid_request";
     // `access_denied` is the only OAuth error that carries a decision, and it is the one the
     // Authorization Server returns when the user declines.
-    if (error === "access_denied")
+    if (error === "access_denied") {
         return { ...envelope, type: "oauth.dismiss" };
+    }
     const description = url.searchParams.get("error_description");
     return {
         ...envelope,
@@ -105,12 +122,19 @@ function protocolResult(presentationId, url) {
  * ```
  */
 export function openAndcoPopupWindow(options) {
-    const popup = window.open(options.url?.href ?? "about:blank", `${ANDCO_POPUP_NAME_PREFIX}${options.presentationId}`, windowFeatures({ width: 620, height: 720 }));
+    const name = `${ANDCO_POPUP_NAME_PREFIX}${options.presentationId}`;
+    const href = options.url?.href ?? "about:blank";
+    console.debug("[openAndcoPopupWindow] opening %s %s", options.target ?? "popup", name);
+    // Without window features a browser opens a tab; with them, a popup window.
+    const popup = options.target === "newtab"
+        ? window.open(href, name)
+        : window.open(href, name, windowFeatures({ width: 620, height: 720 }));
     if (!popup) {
         return {
             blocked: true,
             navigate: () => { },
             result: Promise.resolve(Result.fail(ANDCO_ERROR_CODES.POPUP_BLOCKED)),
+            focus: () => { },
             close: () => { },
         };
     }
@@ -154,15 +178,20 @@ export function openAndcoPopupWindow(options) {
             popup.close();
             settle(Result.fail(ANDCO_ERROR_CODES.POPUP_TIMEOUT));
         }, POPUP_TIMEOUT_MS);
-        options.signal?.addEventListener("abort", () => {
+        const abort = () => {
             popup.close();
             settle(Result.ok(null));
-        });
+        };
+        if (options.signal?.aborted)
+            abort();
+        else
+            options.signal?.addEventListener("abort", abort, { once: true });
     });
     return {
         blocked: false,
         navigate: (url) => popup.location.assign(url.href),
         result,
+        focus: () => popup.focus(),
         close: () => popup.close(),
     };
 }

package/dist/cli/index.d.ts

@@ -1,6 +1,7 @@
 import { AndcoClient, type AndcoClientOptions } from "../client.js";
 import { Result } from "../errors.js";
-import type { AndcoPresenter, AndcoPresentOptions } from "../presenter.js";
+import { AndcoPresenter, type AndcoPresentOptions } from "../presenter.js";
+/** Browser launch, terminal output, and callback timeout overrides for CLI authorization. */
 export type AndcoCliPresenterOptions = {
     /** Opens the authorization URL. Defaults to printing it, so nothing is assumed about the host. */
     open?: (url: URL) => void | Promise<void>;
@@ -28,11 +29,12 @@ export type AndcoCliPresenterOptions = {
  * const { data: session } = await andco.auth.signIn();
  * ```
  */
-export declare class AndcoCliPresenter implements AndcoPresenter {
+export declare class AndcoPresenterCli extends AndcoPresenter {
     private readonly options;
     constructor(options?: AndcoCliPresenterOptions);
     present(presentation: AndcoPresentOptions): Promise<Result<URL | null>>;
 }
+/** Instance configuration with an optional CLI authorization presenter. */
 export type AndcoCliOptions = Omit<AndcoClientOptions, "presenter"> & {
     presenter?: AndcoPresenter;
 };

package/dist/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAqB,MAAM,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAG3E,MAAM,MAAM,wBAAwB,GAAG;IACrC,kGAAkG;IAClG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,iBAAkB,YAAW,cAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,wBAA6B;IAE7D,OAAO,CAAC,YAAY,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;CAiC9E;AAED,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG;IACpE,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,eAAe,GAAG,WAAW,CAE/E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAqB,MAAM,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAG3E,6FAA6F;AAC7F,MAAM,MAAM,wBAAwB,GAAG;IACrC,kGAAkG;IAClG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,iBAAkB,SAAQ,cAAc;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,wBAA6B;IAI7D,OAAO,CAAC,YAAY,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;CAqC9E;AAED,2EAA2E;AAC3E,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG;IACpE,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,eAAe,GAAG,WAAW,CAE/E"}

package/dist/cli/index.js

@@ -1,6 +1,7 @@
 import { AndcoClient } from "../client.js";
 import { isLoopback } from "../config.js";
 import { ANDCO_ERROR_CODES, Result } from "../errors.js";
+import { AndcoPresenter } from "../presenter.js";
 import { LoopbackServer } from "./server.js";
 /**
  * Presents an authorization from a terminal, using a one-shot loopback receiver.
@@ -21,9 +22,10 @@ import { LoopbackServer } from "./server.js";
  * const { data: session } = await andco.auth.signIn();
  * ```
  */
-export class AndcoCliPresenter {
+export class AndcoPresenterCli extends AndcoPresenter {
     options;
     constructor(options = {}) {
+        super();
         this.options = options;
     }
     async present(presentation) {
@@ -44,9 +46,14 @@ export class AndcoCliPresenter {
             });
         }
         try {
+            // Resolved after the receiver is bound: a pushed request is created on demand, and there is
+            // nothing to push before the callback it must name exists.
+            const resolved = await AndcoPresenter.present(presentation.url);
+            if (resolved.error)
+                return Result.fail(resolved.error);
             // The bound port may differ from the configured one when it asked for any free port, and the
             // authorization request must carry the exact URI the server will redirect to.
-            const url = new URL(presentation.url.href);
+            const url = new URL(resolved.data.href);
             url.searchParams.set("redirect_uri", receiver.redirectUri.href);
             if (this.options.open)
                 await this.options.open(url);
@@ -68,5 +75,5 @@ export class AndcoCliPresenter {
  * credential is `andco.session.set(...)`, not a write into a private storage key.
  */
 export function createAndcoInstanceForCLI(options) {
-    return new AndcoClient({ ...options, presenter: options.presenter ?? new AndcoCliPresenter() });
+    return new AndcoClient({ ...options, presenter: options.presenter ?? new AndcoPresenterCli() });
 }

package/dist/cli/server.d.ts

@@ -1,9 +1,14 @@
+/** Local OAuth callback receiver. The caller owns state/PKCE validation and server cleanup. */
 export declare class LoopbackServer {
     #private;
     private constructor();
+    /** Starts listening; a missing port selects an available port reflected in `redirectUri`. */
     static start(configured: URL): Promise<LoopbackServer>;
+    /** Exact callback URL including the port allocated by the operating system. */
     get redirectUri(): URL;
+    /** Waits for a callback or returns `null` on timeout. Call `close()` after either outcome. */
     wait(timeoutMs: number): Promise<URL | null>;
+    /** Closes the listener and any remaining connections. */
     close(): Promise<void>;
     private listen;
     private static hostFor;

package/dist/cli/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/cli/server.ts"],"names":[],"mappings":"AAEA,qBAAa,cAAc;;IAKzB,OAAO;WAKM,KAAK,CAAC,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;IAc5D,IAAI,WAAW,IAAI,GAAG,CAErB;IAED,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAS5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiDtB,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,MAAM,CAAC,OAAO;CAGvB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/cli/server.ts"],"names":[],"mappings":"AAEA,+FAA+F;AAC/F,qBAAa,cAAc;;IAKzB,OAAO;IAKP,6FAA6F;WAChF,KAAK,CAAC,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;IAc5D,+EAA+E;IAC/E,IAAI,WAAW,IAAI,GAAG,CAErB;IAED,8FAA8F;IAC9F,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAS5C,yDAAyD;IACzD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiDtB,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,MAAM,CAAC,OAAO;CAGvB"}

package/dist/cli/server.js

@@ -1,4 +1,5 @@
 import { createServer } from "node:http";
+/** Local OAuth callback receiver. The caller owns state/PKCE validation and server cleanup. */
 export class LoopbackServer {
     #server;
     #resolveCallback;
@@ -7,6 +8,7 @@ export class LoopbackServer {
         this.#redirectUri = configured;
         this.#server = this.#buildServer();
     }
+    /** Starts listening; a missing port selects an available port reflected in `redirectUri`. */
     static async start(configured) {
         const receiver = new LoopbackServer(configured);
         await receiver.listen();
@@ -19,9 +21,11 @@ export class LoopbackServer {
         receiver.#redirectUri.port = String(address.port);
         return receiver;
     }
+    /** Exact callback URL including the port allocated by the operating system. */
     get redirectUri() {
         return this.#redirectUri;
     }
+    /** Waits for a callback or returns `null` on timeout. Call `close()` after either outcome. */
     wait(timeoutMs) {
         return new Promise((resolve) => {
             this.#resolveCallback = resolve;
@@ -30,6 +34,7 @@ export class LoopbackServer {
             timer.unref?.();
         });
     }
+    /** Closes the listener and any remaining connections. */
     close() {
         return new Promise((resolve) => {
             this.#server.closeAllConnections?.();

package/dist/client.d.ts

@@ -1,16 +1,22 @@
-import type { AndCoRandomSource } from "@andco/protocol";
 import { AndcoAuth } from "./auth.js";
 import { type AndcoConfig, type AndcoConfigInput } from "./config.js";
 import { type AndcoCredentials, type AndcoSession } from "./credentials.js";
+import { type AndcoGlobals } from "./globals.js";
+import { AndcoGrants } from "./grants-api.js";
+import type { AndcoInflight } from "./inflight.js";
 import { AndcoIntents } from "./intents.js";
 import { type AndcoAuthorizationRequest, AndcoOAuth, type AndcoTransportMode } from "./oauth.js";
-import type { AndcoPresenter } from "./presenter.js";
+import { AndcoPresenter } from "./presenter.js";
+import { AndcoResource } from "./resource.js";
 import { AndcoRest } from "./rest.js";
 import { type AndcoSessionSource, AndcoSessionStore } from "./session-store.js";
-import type { AndcoLock, AndcoStorage } from "./storage.js";
+import type { AndcoStorage } from "./storage.js";
+import { AndcoTokens } from "./tokens.js";
 /** A Resource Server Definition: immutable, and able to bind itself to a client. */
 export interface AndcoResourceServer<Client> {
+    /** Registered Resource Server ID used in authorization contributions. */
     readonly id: string;
+    /** OAuth Resource Indicator used to select the matching bearer credential. */
     readonly resource: string;
     /**
      * Produces an operational client for this Resource Server from resolved credentials.
@@ -21,15 +27,11 @@ export interface AndcoResourceServer<Client> {
      */
     use(credentials: AndcoCredentials): Client;
 }
-/** Platform capabilities the SDK reads off the runtime, grouped so a future addition is not a breaking change. */
-export type AndcoGlobals = {
-    fetch: typeof globalThis.fetch;
-    /** Threaded into the Protocol Contract's `RANDOM_UUID`, so a runtime without Web Crypto can supply its own. */
-    crypto: AndCoRandomSource;
-};
+/** Configuration and runtime capabilities shared by browser, server, and CLI instances. */
 export type AndcoClientOptions = AndcoConfigInput & {
     /** Confidential credential. Its presence is what makes this a confidential OAuth client. */
     clientSecret?: string | null;
+    /** Overrides runtime fetch and randomness; omitted capabilities use platform defaults. */
     globals?: Partial<AndcoGlobals>;
     /** Authorization Transport Policy. Defaults to `auto`. */
     transport?: AndcoTransportMode;
@@ -37,14 +39,66 @@ export type AndcoClientOptions = AndcoConfigInput & {
     presenter?: AndcoPresenter;
     /** Persists a transaction so it survives a full-page redirect. */
     persistTransaction?: (request: AndcoAuthorizationRequest) => void | Promise<void>;
+    /** Session persistence adapter. Defaults to memory unless a runtime factory supplies one. */
     storage?: AndcoStorage;
     /** A session the caller already resolved, so the first snapshot is real rather than unresolved. */
     initialSession?: AndcoSession | null;
-    lock?: AndcoLock;
+    /** Shares one refresh among concurrent callers. Defaults to sharing within this runtime. */
+    inflight?: AndcoInflight;
     /** Consulted once during the load, before storage. This is where a URL callback enters. */
     source?: AndcoSessionSource;
+    /** Writes session changes to storage unless `false`; defaults to `true`. */
     persist?: boolean;
 };
+/**
+ * The eight collaborator fields shared, verbatim, by {@link AndcoClient} and both of the authorized
+ * views behind `with(...)` and `authorized()`. Declaring them once here is what keeps adding a field
+ * to the instance from requiring three synchronized edits.
+ *
+ * This is a construction seam, not a claim that the three are interchangeable: each subclass still
+ * decides for itself — per the ADR-0023 invariants documented at `AndcoAuthedClientImpl` and
+ * `AndcoAuthorizedViewImpl` — whether a given field's value is freshly built or borrowed by reference
+ * from an owner. The base constructor only stores whatever it is handed.
+ */
+declare class AndcoClientFields {
+    readonly config: AndcoConfig;
+    readonly clientSecret: string | null;
+    readonly globals: AndcoGlobals;
+    readonly oauth: AndcoOAuth;
+    readonly rest: AndcoRest;
+    readonly intents: AndcoIntents;
+    readonly auth: AndcoAuth;
+    readonly session: AndcoSessionStore;
+    /** Offline verification of access tokens with the Authorization Server JWKS. */
+    readonly tokens: AndcoTokens;
+    /** Live Grant lookup for a token. */
+    readonly grants: AndcoGrants;
+    protected constructor(fields: {
+        config: AndcoConfig;
+        clientSecret: string | null;
+        globals: AndcoGlobals;
+        oauth: AndcoOAuth;
+        rest: AndcoRest;
+        intents: AndcoIntents;
+        auth: AndcoAuth;
+        session: AndcoSessionStore;
+        tokens: AndcoTokens;
+        grants: AndcoGrants;
+    });
+    /**
+     * Acts as the Resource Server identified by `resource`: verifies tokens and protects routes.
+     *
+     * @example
+     * ```ts
+     * const orders = andco.resource({ resource: "https://casa-norte.example/api" });
+     * app.use("/api/orders/*", orders.protect({ scopes: ["orders:read"] }).hono());
+     * ```
+     */
+    resource(options: {
+        resource: string;
+        resourceMetadata?: string;
+    }): AndcoResource;
+}
 /**
  * An Andco Instance without resolved credentials.
  *
@@ -65,15 +119,7 @@ export type AndcoClientOptions = AndcoConfigInput & {
  * const bound = andco.with(await sessionFromCookie());
  * ```
  */
-export declare class AndcoClient {
-    readonly config: AndcoConfig;
-    readonly clientSecret: string | null;
-    readonly globals: AndcoGlobals;
-    readonly oauth: AndcoOAuth;
-    readonly rest: AndcoRest;
-    readonly intents: AndcoIntents;
-    readonly auth: AndcoAuth;
-    readonly session: AndcoSessionStore;
+export declare class AndcoClient extends AndcoClientFields {
     /** Runtime discriminant: `false` here, `true` on the value `with(...)` returns. */
     readonly isAuthed: false;
     constructor(options: AndcoClientOptions);
@@ -132,4 +178,5 @@ export declare class AndcoClient {
 export type AndcoClientAuthed = Omit<AndcoClient, "isAuthed" | "with" | "authorized"> & AndcoCredentials & {
     readonly isAuthed: true;
 };
+export {};
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAyB,MAAM,aAAa,CAAC;AAC7F,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAyC,MAAM,kBAAkB,CAAC;AAEnH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,KAAK,yBAAyB,EAAE,UAAU,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,kBAAkB,EAAE,iBAAiB,EAAmB,MAAM,oBAAoB,CAAC;AACjG,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5D,oFAAoF;AACpF,MAAM,WAAW,mBAAmB,CAAC,MAAM;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,GAAG,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,CAAC;CAC5C;AAED,kHAAkH;AAClH,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/B,+GAA+G;IAC/G,MAAM,EAAE,iBAAiB,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG;IAClD,4FAA4F;IAC5F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAChC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,wFAAwF;IACxF,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,yBAAyB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,mGAAmG;IACnG,cAAc,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,WAAW;IACtB,SAAgB,MAAM,EAAE,WAAW,CAAC;IACpC,SAAgB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,SAAgB,OAAO,EAAE,YAAY,CAAC;IACtC,SAAgB,KAAK,EAAE,UAAU,CAAC;IAClC,SAAgB,IAAI,EAAE,SAAS,CAAC;IAChC,SAAgB,OAAO,EAAE,YAAY,CAAC;IACtC,SAAgB,IAAI,EAAE,SAAS,CAAC;IAChC,SAAgB,OAAO,EAAE,iBAAiB,CAAC;IAC3C,mFAAmF;IACnF,SAAgB,QAAQ,EAAG,KAAK,CAAU;gBAEvB,OAAO,EAAE,kBAAkB;IAmC9C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,IAAI,CAAC,WAAW,EAAE,gBAAgB,GAAG,YAAY,GAAG,MAAM,GAAG,iBAAiB;IAIrF;;;;;;;;;;;;;;;;;;OAkBG;IACI,UAAU,IAAI,iBAAiB;WAIxB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,GAAG,MAAM,GAAG,gBAAgB;CASpG;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC,GACnF,gBAAgB,GAAG;IACjB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAyB,MAAM,aAAa,CAAC;AAC7F,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAyC,MAAM,kBAAkB,CAAC;AAEnH,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,KAAK,yBAAyB,EAAE,UAAU,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,kBAAkB,EAAE,iBAAiB,EAAmB,MAAM,oBAAoB,CAAC;AACjG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,oFAAoF;AACpF,MAAM,WAAW,mBAAmB,CAAC,MAAM;IACzC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,GAAG,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,CAAC;CAC5C;AAED,2FAA2F;AAC3F,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG;IAClD,4FAA4F;IAC5F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAChC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,wFAAwF;IACxF,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,yBAAyB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,6FAA6F;IAC7F,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,mGAAmG;IACnG,cAAc,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;;;;;;;GASG;AACH,cAAM,iBAAiB;IACrB,SAAgB,MAAM,EAAE,WAAW,CAAC;IACpC,SAAgB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,SAAgB,OAAO,EAAE,YAAY,CAAC;IACtC,SAAgB,KAAK,EAAE,UAAU,CAAC;IAClC,SAAgB,IAAI,EAAE,SAAS,CAAC;IAChC,SAAgB,OAAO,EAAE,YAAY,CAAC;IACtC,SAAgB,IAAI,EAAE,SAAS,CAAC;IAChC,SAAgB,OAAO,EAAE,iBAAiB,CAAC;IAC3C,gFAAgF;IAChF,SAAgB,MAAM,EAAE,WAAW,CAAC;IACpC,qCAAqC;IACrC,SAAgB,MAAM,EAAE,WAAW,CAAC;IAEpC,SAAS,aAAa,MAAM,EAAE;QAC5B,MAAM,EAAE,WAAW,CAAC;QACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,OAAO,EAAE,YAAY,CAAC;QACtB,KAAK,EAAE,UAAU,CAAC;QAClB,IAAI,EAAE,SAAS,CAAC;QAChB,OAAO,EAAE,YAAY,CAAC;QACtB,IAAI,EAAE,SAAS,CAAC;QAChB,OAAO,EAAE,iBAAiB,CAAC;QAC3B,MAAM,EAAE,WAAW,CAAC;QACpB,MAAM,EAAE,WAAW,CAAC;KACrB;IAaD;;;;;;;;OAQG;IACI,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa;CAGzF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,WAAY,SAAQ,iBAAiB;IAChD,mFAAmF;IACnF,SAAgB,QAAQ,EAAG,KAAK,CAAU;gBAEvB,OAAO,EAAE,kBAAkB;IA6C9C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,IAAI,CAAC,WAAW,EAAE,gBAAgB,GAAG,YAAY,GAAG,MAAM,GAAG,iBAAiB;IAIrF;;;;;;;;;;;;;;;;;;OAkBG;IACI,UAAU,IAAI,iBAAiB;WAIxB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,GAAG,MAAM,GAAG,gBAAgB;CASpG;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC,GACnF,gBAAgB,GAAG;IACjB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB,CAAC"}

package/dist/client.js

@@ -2,10 +2,63 @@ import { AndcoAuth } from "./auth.js";
 import { AndcoConfig as Config } from "./config.js";
 import { credentialsFromSession, isCredentials } from "./credentials.js";
 import { Result } from "./errors.js";
+import { resolveGlobals } from "./globals.js";
+import { AndcoGrants } from "./grants-api.js";
 import { AndcoIntents } from "./intents.js";
 import { AndcoOAuth } from "./oauth.js";
+import { AndcoPresenter } from "./presenter.js";
+import { AndcoResource } from "./resource.js";
 import { AndcoRest } from "./rest.js";
 import { AndcoSessionStore, browserRequired } from "./session-store.js";
+import { AndcoTokens } from "./tokens.js";
+/**
+ * The eight collaborator fields shared, verbatim, by {@link AndcoClient} and both of the authorized
+ * views behind `with(...)` and `authorized()`. Declaring them once here is what keeps adding a field
+ * to the instance from requiring three synchronized edits.
+ *
+ * This is a construction seam, not a claim that the three are interchangeable: each subclass still
+ * decides for itself — per the ADR-0023 invariants documented at `AndcoAuthedClientImpl` and
+ * `AndcoAuthorizedViewImpl` — whether a given field's value is freshly built or borrowed by reference
+ * from an owner. The base constructor only stores whatever it is handed.
+ */
+class AndcoClientFields {
+    config;
+    clientSecret;
+    globals;
+    oauth;
+    rest;
+    intents;
+    auth;
+    session;
+    /** Offline verification of access tokens with the Authorization Server JWKS. */
+    tokens;
+    /** Live Grant lookup for a token. */
+    grants;
+    constructor(fields) {
+        this.config = fields.config;
+        this.clientSecret = fields.clientSecret;
+        this.globals = fields.globals;
+        this.oauth = fields.oauth;
+        this.rest = fields.rest;
+        this.intents = fields.intents;
+        this.auth = fields.auth;
+        this.session = fields.session;
+        this.tokens = fields.tokens;
+        this.grants = fields.grants;
+    }
+    /**
+     * Acts as the Resource Server identified by `resource`: verifies tokens and protects routes.
+     *
+     * @example
+     * ```ts
+     * const orders = andco.resource({ resource: "https://casa-norte.example/api" });
+     * app.use("/api/orders/*", orders.protect({ scopes: ["orders:read"] }).hono());
+     * ```
+     */
+    resource(options) {
+        return new AndcoResource({ ...options, tokens: this.tokens, grants: this.grants });
+    }
+}
 /**
  * An Andco Instance without resolved credentials.
  *
@@ -26,50 +79,52 @@ import { AndcoSessionStore, browserRequired } from "./session-store.js";
  * const bound = andco.with(await sessionFromCookie());
  * ```
  */
-export class AndcoClient {
-    config;
-    clientSecret;
-    globals;
-    oauth;
-    rest;
-    intents;
-    auth;
-    session;
+export class AndcoClient extends AndcoClientFields {
     /** Runtime discriminant: `false` here, `true` on the value `with(...)` returns. */
     isAuthed = false;
     constructor(options) {
-        this.config = Config.from(options);
-        this.clientSecret = options.clientSecret ?? null;
-        this.globals = {
-            fetch: options.globals?.fetch ?? globalThis.fetch.bind(globalThis),
-            crypto: options.globals?.crypto ?? globalThis.crypto,
-        };
-        this.oauth = new AndcoOAuth({
-            config: this.config,
-            fetch: this.globals.fetch,
-            clientSecret: this.clientSecret,
+        const config = Config.from(options);
+        const clientSecret = options.clientSecret ?? null;
+        const globals = resolveGlobals(options.globals);
+        const oauth = new AndcoOAuth({
+            config,
+            globals,
+            clientSecret,
             transport: options.transport,
         });
         // The store is real even without a presenter: it is what lets `rest` stay one object across a
         // sign-in, and what gives `auth` something to operate on regardless of runtime.
-        this.session = new AndcoSessionStore({
-            config: this.config,
-            oauth: this.oauth,
+        const session = new AndcoSessionStore({
+            config,
+            oauth,
             storage: options.storage,
             initialSession: options.initialSession,
-            lock: options.lock,
+            inflight: options.inflight,
             source: options.source,
             persist: options.persist,
         });
-        this.auth = new AndcoAuth({
-            oauth: this.oauth,
-            store: this.session,
-            presenter: options.presenter ?? statelessPresenter(),
+        // One presenter for the whole instance: authorization and Intent are the same seam, so a
+        // runtime that can present one can present the other. Not public — nothing outside the
+        // instance chooses how it presents, and every mirror of this type would have to carry it.
+        const presenter = options.presenter ?? new AndcoPresenterStateless();
+        const auth = new AndcoAuth({
+            config,
+            oauth,
+            store: session,
+            presenter,
             persistTransaction: options.persistTransaction,
-            crypto: this.globals.crypto,
+            globals,
         });
-        this.rest = new AndcoRest({ config: this.config, fetch: this.globals.fetch, credentials: this.session });
-        this.intents = new AndcoIntents(this.rest, this.globals.crypto);
+        const rest = new AndcoRest({ config, globals, credentials: session });
+        const intents = new AndcoIntents({
+            rest,
+            config,
+            presenter,
+            globals,
+        });
+        const tokens = new AndcoTokens({ config, globals });
+        const grants = new AndcoGrants({ config, globals });
+        super({ config, clientSecret, globals, oauth, rest, intents, auth, session, tokens, grants });
     }
     /**
      * Binds *explicit* credentials for one unit of work, owning its own REST surface.
@@ -131,45 +186,45 @@ export class AndcoClient {
     }
 }
 /** Presents nothing; every authorization attempt fails clearly instead of doing nothing silently. */
-function statelessPresenter() {
-    return {
-        async present() {
-            return Result.fail(browserRequired());
-        },
-    };
+class AndcoPresenterStateless extends AndcoPresenter {
+    async present() {
+        return Result.fail(browserRequired());
+    }
 }
 /**
  * The implementation behind `with(...)`. Not exported: `AndcoClientAuthed` is the entire public
  * contract, so a caller never has a reason to name this type.
  */
-class AndcoAuthedClientImpl {
+class AndcoAuthedClientImpl extends AndcoClientFields {
     credentials;
     isAuthed = true;
-    config;
-    clientSecret;
-    globals;
-    oauth;
-    rest;
-    intents;
-    auth;
-    session;
     constructor(owner, credentials) {
-        this.credentials = credentials;
-        this.config = owner.config;
-        this.clientSecret = owner.clientSecret;
-        this.globals = owner.globals;
-        this.oauth = owner.oauth;
-        this.rest = new AndcoRest({ config: owner.config, fetch: owner.globals.fetch, credentials });
-        this.intents = new AndcoIntents(this.rest, owner.globals.crypto);
+        const rest = new AndcoRest({ config: owner.config, globals: owner.globals, credentials });
+        // No presenter: `with(...)` is the per-request server shape, and a request presents nothing.
+        const intents = new AndcoIntents({ rest, config: owner.config, globals: owner.globals });
         // In-memory and unlinked from `credentials`: it exists only so `auth` has something to operate
         // on, since a bare token or a caller-supplied resolver carries no persistable session shape.
-        this.session = new AndcoSessionStore({ config: owner.config, oauth: owner.oauth, persist: false });
-        this.auth = new AndcoAuth({
+        const session = new AndcoSessionStore({ config: owner.config, oauth: owner.oauth, persist: false });
+        const auth = new AndcoAuth({
+            config: owner.config,
             oauth: owner.oauth,
-            store: this.session,
-            presenter: statelessPresenter(),
-            crypto: owner.globals.crypto,
+            store: session,
+            presenter: new AndcoPresenterStateless(),
+            globals: owner.globals,
         });
+        super({
+            config: owner.config,
+            clientSecret: owner.clientSecret,
+            globals: owner.globals,
+            oauth: owner.oauth,
+            rest,
+            intents,
+            auth,
+            session,
+            tokens: owner.tokens,
+            grants: owner.grants,
+        });
+        this.credentials = credentials;
     }
     accessTokenFor(resource) {
         return this.credentials.accessTokenFor(resource);
@@ -181,27 +236,23 @@ class AndcoAuthedClientImpl {
  * unchanged across a sign-in, satisfying "one REST surface per instance" even where a framework
  * adapter hands out a fresh `AndcoClientAuthed` reference on every Authorized Identity change.
  */
-class AndcoAuthorizedViewImpl {
+class AndcoAuthorizedViewImpl extends AndcoClientFields {
     owner;
     isAuthed = true;
-    config;
-    clientSecret;
-    globals;
-    oauth;
-    rest;
-    intents;
-    auth;
-    session;
     constructor(owner) {
+        super({
+            config: owner.config,
+            clientSecret: owner.clientSecret,
+            globals: owner.globals,
+            oauth: owner.oauth,
+            rest: owner.rest,
+            intents: owner.intents,
+            auth: owner.auth,
+            session: owner.session,
+            tokens: owner.tokens,
+            grants: owner.grants,
+        });
         this.owner = owner;
-        this.config = owner.config;
-        this.clientSecret = owner.clientSecret;
-        this.globals = owner.globals;
-        this.oauth = owner.oauth;
-        this.rest = owner.rest;
-        this.intents = owner.intents;
-        this.auth = owner.auth;
-        this.session = owner.session;
     }
     /** Delegates to the instance's own session store on every call, so a rotated token is still picked up. */
     accessTokenFor(resource) {

package/dist/config.d.ts

@@ -5,7 +5,7 @@ export type AndcoTheme = "base";
  * An OAuth scope. Known Andco scopes are suggested; a Resource Server may define its own.
  *
  * The Protocol Contract already knows the scope vocabulary, so this is that type rather than a bare
- * `string`: an editor completes `bank_accounts:read` without closing the door on a scope Andco has
+ * `string`: an editor completes `offline_access` without closing the door on a scope Andco has
  * not shipped yet.
  */
 export type AndcoScope = AndCoScope;
@@ -75,6 +75,7 @@ export declare class AndcoConfig {
     widgetURL(release: number, surface?: "button"): URL;
     /** Whether an origin may participate in popup messaging for this instance. */
     allowsPopupOrigin(origin: string): boolean;
+    /** Serializes configuration to constructor input without credentials or runtime collaborators. */
     toJSON(): AndcoConfigInput;
 }
 /** Loopback over plain HTTP is accepted so local development and CLI callbacks work unmodified. */