@andco/sdk 0.0.2 → 0.0.4

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,cAAc,EAEpB,MAAM,iBAAiB,CAAC;AAGzB,wDAAwD;AACxD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAChC;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC;AAEpC,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC5B,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC3B,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC9B,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,mFAAmF;IACnF,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC,CAAC;AAMF;;;;;;;;;;;;GAYG;AACH,qBAAa,WAAW;IACtB,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,SAAS,EAAE,QAAQ,CAAC;QAAE,IAAI,EAAE,GAAG,CAAC;QAAC,GAAG,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,CAAC,CAAC;IAC1E,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,UAAU,EAAE,GAAG,GAAG,SAAS,CAAC;IAC5C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,KAAK,EAAE,UAAU,CAAC;IAClC,SAAgB,SAAS,EAAE,cAAc,CAAC;IAC1C,SAAgB,aAAa,EAAE,SAAS,UAAU,EAAE,CAAC;IACrD,SAAgB,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzD,OAAO;IAkCP,mGAAmG;WACrF,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,WAAW;IAIxD,mDAAmD;IAC5C,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,WAAW;IAI9D;;;OAGG;IACI,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG;IAOjC,oDAAoD;IAC7C,MAAM,IAAI,GAAG;IAIpB,qEAAqE;IAC9D,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,QAAmB,GAAG,GAAG;IAIpE,8EAA8E;IACvE,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI1C,MAAM,IAAI,gBAAgB;CAelC;AAED,mGAAmG;AACnG,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAQ5C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,cAAc,EAEpB,MAAM,iBAAiB,CAAC;AAGzB,wDAAwD;AACxD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAChC;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC;AAEpC,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC5B,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC3B,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC9B,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,mFAAmF;IACnF,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC,CAAC;AAMF;;;;;;;;;;;;GAYG;AACH,qBAAa,WAAW;IACtB,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,SAAS,EAAE,QAAQ,CAAC;QAAE,IAAI,EAAE,GAAG,CAAC;QAAC,GAAG,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,CAAC,CAAC;IAC1E,SAAgB,UAAU,EAAE,MAAM,CAAC;IACnC,SAAgB,UAAU,EAAE,GAAG,GAAG,SAAS,CAAC;IAC5C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,KAAK,EAAE,UAAU,CAAC;IAClC,SAAgB,SAAS,EAAE,cAAc,CAAC;IAC1C,SAAgB,aAAa,EAAE,SAAS,UAAU,EAAE,CAAC;IACrD,SAAgB,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzD,OAAO;IAkCP,mGAAmG;WACrF,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,WAAW;IAIxD,mDAAmD;IAC5C,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,WAAW;IAI9D;;;OAGG;IACI,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG;IAOjC,oDAAoD;IAC7C,MAAM,IAAI,GAAG;IAIpB,qEAAqE;IAC9D,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,QAAmB,GAAG,GAAG;IAIpE,8EAA8E;IACvE,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIjD,kGAAkG;IAC3F,MAAM,IAAI,gBAAgB;CAelC;AAED,mGAAmG;AACnG,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAQ5C"}

package/dist/config.js

@@ -83,6 +83,7 @@ export class AndcoConfig {
     allowsPopupOrigin(origin) {
         return this.allowedPopupOrigins.has(origin);
     }
+    /** Serializes configuration to constructor input without credentials or runtime collaborators. */
     toJSON() {
         return {
             clientId: this.clientId,

package/dist/credentials.d.ts

@@ -1,9 +1,37 @@
+import type { AndcoConfig } from "./config.js";
+import type { GrantReference } from "./grants.js";
 /** The authenticated subject of a session, as far as the SDK is concerned. */
 export type AndcoUser = {
     id: string;
     name: string | null;
     email: string | null;
     avatarUrl: string | null;
+    /**
+     * Whether the Authorization Server has verified the email address.
+     *
+     * `true` and `false` are both affirmative claims the server made; `null` means the server said
+     * nothing about it. Absence must never be treated as verified, which is why this is required
+     * rather than optional: every constructor of an `AndcoUser` must say what it knows, instead of
+     * silently forgetting to say anything.
+     */
+    emailVerified: boolean | null;
+    /**
+     * The Profile's phone number, as UserInfo's `phone` claim carries it. `null` unless the `phone`
+     * scope was granted and the Profile has a number on file.
+     *
+     * @example
+     * ```ts
+     * await andco.auth.signIn({ scopes: ["openid", "phone"] });
+     * andco.session.getSnapshot()?.user.phone; // "+56999999999"
+     * ```
+     */
+    phone: string | null;
+    /**
+     * `true` when the Authorization Server confirmed the phone number; `null` when it said nothing,
+     * which includes a number not yet confirmed and a session without the `phone` scope. Like
+     * `emailVerified`, absence never means verified.
+     */
+    phoneVerified: boolean | null;
 };
 /**
  * One set of credentials issued by Andco.
@@ -23,12 +51,23 @@ export type AndcoSession = {
     /** Access tokens keyed by exact Resource Indicator URI. Absent means `accessToken` serves all. */
     resourceAccessTokens?: Readonly<Record<string, string>>;
 };
+/**
+ * Per-request authorization controls a transport hands to the credentials.
+ *
+ * Only an explicit `grant` exists: the Authorization Server selects the Grant from the client,
+ * the subject and the resource, so the SDK never inspects request paths or bodies to guess it.
+ */
+export type AndcoCredentialRequest = {
+    /** Exact Grant to use for this request instead of the server's selection. */
+    readonly grant?: GrantReference;
+};
 /**
  * The entire contract the Andco core knows about authorization.
  *
- * Keeping it to one resource-keyed method is what lets an application go on owning its sessions:
+ * Keeping one required resource-keyed method lets an application go on owning its sessions:
  * a Better Auth account, a Passport session, a row in your own table, or a plain closure all
- * satisfy it without adopting the SDK's persistence.
+ * satisfy it without adopting the SDK's persistence. Service credentials also receive the explicit
+ * `grant` control and may provide request-local authority through `forOperation()`.
  *
  * @example
  * ```ts
@@ -38,8 +77,23 @@ export type AndcoSession = {
  * ```
  */
 export interface AndcoCredentials {
-    /** Resolves a token for one Resource Indicator, refreshing lazily when the current one is stale. */
-    accessTokenFor(resource: string): Promise<string | null>;
+    /** Resolves a token for one audience, refreshing or reauthenticating lazily. */
+    accessTokenFor(resource: string, request?: AndcoCredentialRequest): Promise<string | null>;
+    /** Isolates and pins one operation's authority across pages, polling and retries. */
+    forOperation?(): AndcoCredentials;
+    /**
+     * The configuration of the client that issued these credentials, when there is one.
+     *
+     * `andco.with()`, `andco.authorized()` and `service.credentials()` carry it, so a Resource Server
+     * Definition bound to them reads the OAuth `client_id` and API endpoint from here instead of
+     * asking for them a second time. A hand-written resolver may omit it.
+     *
+     * @example
+     * ```ts
+     * const bank = new Bank(andco.with(accessToken)); // clientId and endpoint come from andco.config
+     * ```
+     */
+    readonly config?: AndcoConfig;
 }
 /** Seconds of remaining lifetime under which a token is treated as stale and refreshed. */
 export declare const ANDCO_REFRESH_SKEW_SECONDS = 30;

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,kGAAkG;IAClG,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,SAAgC,GAAG,OAAO,CAEpG;AAED,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY/E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,YAAY,GAAG,gBAAgB,CAE9E;AAED,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,GAAG,KAAK,IAAI,gBAAgB,CAE/F;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAMnF"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B;;;;;;;;;OASG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;;OAIG;IACH,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,kGAAkG;IAClG,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;CACjC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3F,qFAAqF;IACrF,YAAY,CAAC,IAAI,gBAAgB,CAAC;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,SAAgC,GAAG,OAAO,CAEpG;AAED,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY/E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,YAAY,GAAG,gBAAgB,CAE9E;AAED,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,GAAG,KAAK,IAAI,gBAAgB,CAE/F;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAWnF"}

package/dist/errors.d.ts

@@ -1,3 +1,4 @@
+import { type AndcoErrorCode } from "@andco/protocol";
 /**
  * The single error type every Andco operation reports.
  *
@@ -34,7 +35,7 @@ export declare class AndcoError extends Error {
         details?: Readonly<Record<string, unknown>>;
     });
     /** Normalizes anything thrown by a dependency into an `AndcoError`. */
-    static from(cause: unknown, fallbackCode: string): AndcoError;
+    static from(cause: unknown, fallbackCode: SdkErrorCode): AndcoError;
     /** Whether a value is an `AndcoError`. */
     static is(cause: unknown): cause is AndcoError;
 }
@@ -137,29 +138,30 @@ export declare const Result: {
     /** Wraps a value as a successful result. */
     ok<T>(data: T): Result<T>;
     /** Wraps a failure as a result, accepting either a code or an existing error. */
-    fail<T = never>(error: AndcoError | string, options?: {
+    fail<T = never>(error: AndcoError | SdkErrorCode, options?: {
         message?: string;
         status?: number;
         cause?: unknown;
     }): Result<T>;
 };
-/** Error codes the SDK itself raises, as opposed to those relayed from the Authorization Server. */
-export declare const ANDCO_ERROR_CODES: {
-    readonly BROWSER_REQUIRED: "browser_required";
-    readonly BROWSER_UNAVAILABLE: "browser_unavailable";
-    readonly BROWSER_FORBIDDEN: "browser_forbidden";
-    readonly INVALID_CALLBACK: "invalid_callback";
-    readonly INVALID_CONFIGURATION: "invalid_configuration";
-    readonly HANDSHAKE_TIMEOUT: "handshake_timeout";
-    readonly INVALID_IFRAME: "invalid_iframe";
-    readonly INVALID_INTENT_ID: "invalid_intent_id";
-    readonly INVALID_RESPONSE: "invalid_response";
-    readonly POPUP_BLOCKED: "popup_blocked";
-    readonly POPUP_TIMEOUT: "popup_timeout";
-    readonly PRESENTATION_UNSUPPORTED: "presentation_unsupported";
-    readonly SAME_ORIGIN_ENDPOINT: "same_origin_endpoint";
-    readonly SESSION_MISSING: "session_missing";
-    readonly STORAGE_FAILED: "storage_failed";
-    readonly UNTRUSTED_ORIGIN: "untrusted_origin";
-};
+/**
+ * Re-exported so `@andco/sdk` consumers reach the one vocabulary without importing `@andco/protocol`
+ * directly. It used to be a second catalogue declared here, with the same public name as the one in
+ * protocol and different values for the eight conditions both named -- a comparison against the
+ * wrong import never matched, and nothing said which was which.
+ */
+export { ANDCO_ERROR_CODES, type AndcoErrorCode } from "@andco/protocol";
+/**
+ * The vocabulary of codes the SDK may write to `AndcoError.code` on its own initiative — every
+ * member of {@link ANDCO_ERROR_CODES}, derived rather than duplicated.
+ *
+ * This closes the entry points the SDK alone uses to raise its own errors — `AndcoError.from`'s
+ * `fallbackCode` and `Result.fail`'s string shorthand — so a typo or an ad hoc string can no longer
+ * slip in unnoticed. It does not close `AndcoError.code` itself, nor the `AndcoError` constructor:
+ * both must keep accepting a plain `string`, because `AndcoError` is the one error type every Andco
+ * operation reports, including codes this repository does not own — the Authorization Server's own
+ * OAuth error identifiers (RFC 6749) foremost among them — and integrators are expected to construct
+ * one directly for their own domain errors, as `apps/example-oauth-nextjs` already does.
+ */
+export type SdkErrorCode = AndcoErrorCode;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,6DAA6D;IAC7D,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C;;;;;;OAMG;IACH,SAAgB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;gBAGrE,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAO;IASnH,uEAAuE;WACzD,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,UAAU;IAMpE,0CAA0C;WAC5B,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU;CAGtD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,aAAc,SAAQ,UAAU;IAC3C,sGAAsG;IACtG,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,0FAA0F;IAC1F,SAAgB,QAAQ,EAAE,QAAQ,CAAC;gBAGjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;QACP,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC7C;IAQH;;;;;;;;;;;;;;;;OAgBG;WACW,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,aAAa;IAiBnF;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAU/B;IAEH,oGAAoG;IACpG,OAAO,CAAC,MAAM,CAAC,MAAM;IAUrB,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,MAAM;IAerB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;CAMxB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAErF;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM;IACjB,4CAA4C;OACzC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAIzB,iFAAiF;SAC5E,CAAC,iBACG,UAAU,GAAG,MAAM,YACjB;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,MAAM,CAAC,CAAC,CAAC;CAGb,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;CAiBpB,CAAC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACzE;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,6DAA6D;IAC7D,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C;;;;;;OAMG;IACH,SAAgB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;gBAGrE,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAO;IASnH,uEAAuE;WACzD,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,GAAG,UAAU;IAM1E,0CAA0C;WAC5B,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU;CAGtD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,aAAc,SAAQ,UAAU;IAC3C,sGAAsG;IACtG,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,0FAA0F;IAC1F,SAAgB,QAAQ,EAAE,QAAQ,CAAC;gBAGjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;QACP,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC7C;IAQH;;;;;;;;;;;;;;;;OAgBG;WACW,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,aAAa;IA0BnF;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAU/B;IAEH,oGAAoG;IACpG,OAAO,CAAC,MAAM,CAAC,MAAM;IAUrB,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,MAAM;IAerB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;CAMxB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAErF;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM;IACjB,4CAA4C;OACzC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAIzB,iFAAiF;SAC5E,CAAC,iBACG,UAAU,GAAG,YAAY,YACvB;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,MAAM,CAAC,CAAC,CAAC;CAGb,CAAC;AAEF;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,YAAY,GAAG,cAAc,CAAC"}

package/dist/errors.js

@@ -1,3 +1,4 @@
+import { ANDCO_ERROR_CODES } from "@andco/protocol";
 /**
  * The single error type every Andco operation reports.
  *
@@ -93,6 +94,15 @@ export class AndcoAPIError extends AndcoError {
      * ```
      */
     static fromOpenAPIFetch(payload, response) {
+        if (payload instanceof AndcoError) {
+            return new AndcoAPIError(payload.code, {
+                response,
+                status: payload.status,
+                message: payload.message,
+                details: payload.details,
+                cause: payload,
+            });
+        }
         const { message, details } = AndcoAPIError.bodyOf(payload);
         const error = new AndcoAPIError(AndcoAPIError.codeOf(payload), {
             response,
@@ -132,7 +142,7 @@ export class AndcoAPIError extends AndcoError {
                 return error;
             }
         }
-        return "request_failed";
+        return ANDCO_ERROR_CODES.REQUEST_FAILED;
     }
     /** Keeps the rest of the error body, and promotes `message` so it reaches `error.message`. */
     static bodyOf(payload) {
@@ -176,22 +186,10 @@ export const Result = {
         return { data: null, error: typeof error === "string" ? new AndcoError(error, options) : error };
     },
 };
-/** Error codes the SDK itself raises, as opposed to those relayed from the Authorization Server. */
-export const ANDCO_ERROR_CODES = {
-    BROWSER_REQUIRED: "browser_required",
-    BROWSER_UNAVAILABLE: "browser_unavailable",
-    BROWSER_FORBIDDEN: "browser_forbidden",
-    INVALID_CALLBACK: "invalid_callback",
-    INVALID_CONFIGURATION: "invalid_configuration",
-    HANDSHAKE_TIMEOUT: "handshake_timeout",
-    INVALID_IFRAME: "invalid_iframe",
-    INVALID_INTENT_ID: "invalid_intent_id",
-    INVALID_RESPONSE: "invalid_response",
-    POPUP_BLOCKED: "popup_blocked",
-    POPUP_TIMEOUT: "popup_timeout",
-    PRESENTATION_UNSUPPORTED: "presentation_unsupported",
-    SAME_ORIGIN_ENDPOINT: "same_origin_endpoint",
-    SESSION_MISSING: "session_missing",
-    STORAGE_FAILED: "storage_failed",
-    UNTRUSTED_ORIGIN: "untrusted_origin",
-};
+/**
+ * Re-exported so `@andco/sdk` consumers reach the one vocabulary without importing `@andco/protocol`
+ * directly. It used to be a second catalogue declared here, with the same public name as the one in
+ * protocol and different values for the eight conditions both named -- a comparison against the
+ * wrong import never matched, and nothing said which was which.
+ */
+export { ANDCO_ERROR_CODES } from "@andco/protocol";

package/dist/globals.d.ts

@@ -0,0 +1,25 @@
+import type { AndCoRandomSource } from "@andco/protocol";
+/**
+ * Platform capabilities the SDK reads off the runtime, grouped so a future addition is not a
+ * breaking change.
+ *
+ * Every collaborator takes the whole group rather than the one capability it happens to use today,
+ * which is what makes that promise real: adding a capability here reaches `rest`, `oauth`, `auth`,
+ * and `intents` without touching a single constructor signature.
+ */
+export type AndcoGlobals = {
+    fetch: typeof globalThis.fetch;
+    /** Threaded into the Protocol Contract's `RANDOM_UUID`, so a runtime without Web Crypto can supply its own. */
+    crypto: AndCoRandomSource;
+};
+/**
+ * Fills a partial runtime out with the platform's own, so a collaborator always receives a resolved
+ * group and never has to know what the default for a missing capability is.
+ *
+ * @example
+ * ```ts
+ * const rest = new AndcoRest({ config, credentials, globals: resolveGlobals({ fetch: tracedFetch }) });
+ * ```
+ */
+export declare function resolveGlobals(globals?: Partial<AndcoGlobals>): AndcoGlobals;
+//# sourceMappingURL=globals.d.ts.map

package/dist/globals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"globals.d.ts","sourceRoot":"","sources":["../src/globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/B,+GAA+G;IAC/G,MAAM,EAAE,iBAAiB,CAAC;CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,OAAO,CAAC,YAAY,CAAM,GAAG,YAAY,CAKhF"}

package/dist/globals.js

@@ -0,0 +1,15 @@
+/**
+ * Fills a partial runtime out with the platform's own, so a collaborator always receives a resolved
+ * group and never has to know what the default for a missing capability is.
+ *
+ * @example
+ * ```ts
+ * const rest = new AndcoRest({ config, credentials, globals: resolveGlobals({ fetch: tracedFetch }) });
+ * ```
+ */
+export function resolveGlobals(globals = {}) {
+    return {
+        fetch: globals.fetch ?? globalThis.fetch.bind(globalThis),
+        crypto: globals.crypto ?? globalThis.crypto,
+    };
+}

package/dist/grants-api.d.ts

@@ -0,0 +1,34 @@
+import type { AndCoRestPaths } from "@andco/protocol/transport";
+import type { AndcoConfig } from "./config.js";
+import { Result } from "./errors.js";
+import type { AndcoGlobals } from "./globals.js";
+/** The live Grant a bearer token carries, as `GET /authorization` reports it. */
+export type AndcoGrantAuthorization = AndCoRestPaths["/authorization"]["get"]["responses"][200]["content"]["application/json"];
+/**
+ * Looks up the live Grant behind a token.
+ *
+ * A token proves who signed it; only the Authorization Server knows whether the Grant is still
+ * active and which RAR details were consented. This is what a Resource Server calls when scopes in
+ * the token are not enough.
+ *
+ * @example
+ * ```ts
+ * const { data: grant, error } = await andco.grants.get(accessToken);
+ * const orders = grant?.authorizationDetails.find((detail) => detail.type === "orders");
+ * ```
+ */
+export declare class AndcoGrants {
+    #private;
+    constructor(options: {
+        config: AndcoConfig;
+        globals: AndcoGlobals;
+    });
+    /**
+     * Fetches the Grant carried by a bearer token with `GET /authorization`.
+     *
+     * Only the token overload exists: the API has no endpoint that reads a Grant by id, so a Grant id
+     * fails with `not_implemented` instead of guessing one.
+     */
+    get(token: string): Promise<Result<AndcoGrantAuthorization>>;
+}
+//# sourceMappingURL=grants-api.d.ts.map

package/dist/grants-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-api.d.ts","sourceRoot":"","sources":["../src/grants-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAc,MAAM,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,iFAAiF;AACjF,MAAM,MAAM,uBAAuB,GACjC,cAAc,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAI3F;;;;;;;;;;;;GAYG;AACH,qBAAa,WAAW;;gBAIH,OAAO,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,YAAY,CAAA;KAAE;IAK1E;;;;;OAKG;IACU,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;CAoB1E"}

package/dist/grants-api.js

@@ -0,0 +1,48 @@
+import { AndcoError, Result } from "./errors.js";
+import { AndcoRest } from "./rest.js";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+/**
+ * Looks up the live Grant behind a token.
+ *
+ * A token proves who signed it; only the Authorization Server knows whether the Grant is still
+ * active and which RAR details were consented. This is what a Resource Server calls when scopes in
+ * the token are not enough.
+ *
+ * @example
+ * ```ts
+ * const { data: grant, error } = await andco.grants.get(accessToken);
+ * const orders = grant?.authorizationDetails.find((detail) => detail.type === "orders");
+ * ```
+ */
+export class AndcoGrants {
+    #config;
+    #globals;
+    constructor(options) {
+        this.#config = options.config;
+        this.#globals = options.globals;
+    }
+    /**
+     * Fetches the Grant carried by a bearer token with `GET /authorization`.
+     *
+     * Only the token overload exists: the API has no endpoint that reads a Grant by id, so a Grant id
+     * fails with `not_implemented` instead of guessing one.
+     */
+    async get(token) {
+        if (UUID.test(token)) {
+            console.debug("[grants.get] a grant id was given, but no endpoint reads a Grant by id");
+            return Result.fail(new AndcoError("not_implemented", { message: "Grants can only be read with the token that carries them" }));
+        }
+        const rest = new AndcoRest({
+            config: this.#config,
+            globals: this.#globals,
+            credentials: { accessTokenFor: async () => token },
+        });
+        const { data, error } = await rest.http.GET("/authorization");
+        if (error || !data) {
+            console.debug("[grants.get] lookup failed status=%s code=%s", error?.status, error?.code);
+            return Result.fail(error ?? new AndcoError("invalid_response"));
+        }
+        console.debug("[grants.get] grant %s active=%s", data.grantId, data.active);
+        return Result.ok(data);
+    }
+}

package/dist/grants.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Metadata of a Grant an Organization approved for a Service; never a bearer credential or proof
+ * of live consent. `service.listGrants()` returns these.
+ */
+export type Grant = import("@andco/protocol").ServiceGrant;
+/** A Grant or its id, for the explicit `grant` override. */
+export type GrantReference = string | Grant;
+/**
+ * Reads the id of a Grant reference, refusing anything that is not a UUID.
+ *
+ * @example
+ * grantId("0190f3a2-6f1c-7c4e-9a51-3b2d1e0f4a5b"); // the same string
+ * grantId(grant); // grant.id
+ */
+export declare function grantId(grant: GrantReference): string;
+//# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,KAAK,GAAG,OAAO,iBAAiB,EAAE,YAAY,CAAC;AAC3D,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,CAAC;AAE5C;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAKrD"}

package/dist/grants.js

@@ -0,0 +1,13 @@
+/**
+ * Reads the id of a Grant reference, refusing anything that is not a UUID.
+ *
+ * @example
+ * grantId("0190f3a2-6f1c-7c4e-9a51-3b2d1e0f4a5b"); // the same string
+ * grantId(grant); // grant.id
+ */
+export function grantId(grant) {
+    const id = typeof grant === "string" ? grant : grant.id;
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id))
+        throw new TypeError("Grant ID must be a UUID");
+    return id;
+}

package/dist/index.d.ts

@@ -1,13 +1,19 @@
 export { RANDOM_UUID } from "@andco/protocol";
 export { AndcoAuth, type AndcoAuthOptions, type AndcoSignInOptions } from "./auth.js";
-export { AndcoClient, type AndcoClientAuthed, type AndcoClientOptions, type AndcoGlobals, type AndcoResourceServer, } from "./client.js";
+export { AndcoClient, type AndcoClientAuthed, type AndcoClientOptions, type AndcoResourceServer } from "./client.js";
 export { AndcoConfig, type AndcoConfigInput, type AndcoScope, type AndcoTheme, isLoopback, } from "./config.js";
-export { ANDCO_REFRESH_SKEW_SECONDS, type AndcoCredentials, type AndcoSession, type AndcoUser, credentialsFromSession, isCredentials, isExpired, sessionIdentityKey, tokenFor, } from "./credentials.js";
+export { ANDCO_REFRESH_SKEW_SECONDS, type AndcoCredentialRequest, type AndcoCredentials, type AndcoSession, type AndcoUser, credentialsFromSession, isCredentials, isExpired, sessionIdentityKey, tokenFor, } from "./credentials.js";
 export { ANDCO_ERROR_CODES, AndcoAPIError, AndcoError, Result } from "./errors.js";
-export { type AndcoEventPage, type AndcoEventSubscriptionOptions, type AndcoFinancialEvent, type AndcoIntent, type AndcoIntentCreateOptions, type AndcoIntentId, AndcoIntents, } from "./intents.js";
+export { type AndcoGlobals, resolveGlobals } from "./globals.js";
+export type { Grant, GrantReference } from "./grants.js";
+export { type AndcoGrantAuthorization, AndcoGrants } from "./grants-api.js";
+export { type AndcoInflight, MemoryInflight } from "./inflight.js";
+export { type AndcoEventPage, type AndcoEventSubscriptionOptions, type AndcoFinancialEvent, type AndcoIntent, type AndcoIntentApproveOptions, type AndcoIntentCancelOptions, type AndcoIntentCreateOptions, type AndcoIntentId, type AndcoIntentPresentationController, type AndcoIntentPresentationStatus, type AndcoIntentPresentOptions, type AndcoIntentPresentSource, type AndcoIntentReference, type AndcoIntentRejectOptions, type AndcoIntentSubscribeOptions, AndcoIntents, type AndcoIntentsOptions, type AndcoIntentURLOptions, type AndcoIntentWatch, type AndcoIntentWatchOptions, type AndcoIntentWatchStatus, type AndcoPresentationResult, type AndcoPresentationStorage, } from "./intents.js";
 export { type AndcoAuthorizationDetail, type AndcoAuthorizationOptions, type AndcoAuthorizationRequest, type AndcoDeviceAuthorization, AndcoOAuth, type AndcoOAuthOptions, type AndcoResourceAuthorization, type AndcoTransportMode, } from "./oauth.js";
-export type { AndcoPresentation, AndcoPresenter, AndcoPresentOptions } from "./presenter.js";
-export { type AndcoHttpClient, type AndcoPageOptions, type AndcoRequestOptions, AndcoRest, type AndcoRestOptions, } from "./rest.js";
+export { type AndcoIntentPresentation, type AndcoPresentation, AndcoPresenter, type AndcoPresentIntent, type AndcoPresentOAuth, type AndcoPresentOptions, type AndcoPresentTarget, } from "./presenter.js";
+export { type AndcoDetailRequirement, type AndcoProtection, type AndcoProtectOptions, type AndcoProtectOutcome, AndcoResource, } from "./resource.js";
+export { type AndcoGrantOptions, type AndcoHttpClient, type AndcoPageOptions, type AndcoRequestOptions, AndcoRest, type AndcoRestOptions, } from "./rest.js";
 export { type AndcoSessionSource, AndcoSessionStore, type AndcoSessionStoreOptions } from "./session-store.js";
-export { type AndcoLock, type AndcoStorage, InProcessLock, MemoryStorage, WebStorage, } from "./storage.js";
+export { type AndcoStorage, LocalStorage, MemoryStorage, SessionStorage, } from "./storage.js";
+export { type AndcoTokenClaims, AndcoTokens, type AndcoTokenVerifyOptions, } from "./tokens.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EACL,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,sBAAsB,EACtB,aAAa,EACb,SAAS,EACT,kBAAkB,EAClB,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,GACxB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,SAAS,EACT,KAAK,gBAAgB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC/G,OAAO,EACL,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,aAAa,EACb,aAAa,EACb,UAAU,GACX,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACrH,OAAO,EACL,WAAW,EACX,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,sBAAsB,EACtB,aAAa,EACb,SAAS,EACT,kBAAkB,EAClB,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,KAAK,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACjE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,KAAK,uBAAuB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,KAAK,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,KAAK,iCAAiC,EACtC,KAAK,6BAA6B,EAClC,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,GACxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,SAAS,EACT,KAAK,gBAAgB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC/G,OAAO,EACL,KAAK,YAAY,EACjB,YAAY,EACZ,aAAa,EACb,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,gBAAgB,EACrB,WAAW,EACX,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,11 +1,17 @@
 export { RANDOM_UUID } from "@andco/protocol";
 export { AndcoAuth } from "./auth.js";
-export { AndcoClient, } from "./client.js";
+export { AndcoClient } from "./client.js";
 export { AndcoConfig, isLoopback, } from "./config.js";
 export { ANDCO_REFRESH_SKEW_SECONDS, credentialsFromSession, isCredentials, isExpired, sessionIdentityKey, tokenFor, } from "./credentials.js";
 export { ANDCO_ERROR_CODES, AndcoAPIError, AndcoError, Result } from "./errors.js";
+export { resolveGlobals } from "./globals.js";
+export { AndcoGrants } from "./grants-api.js";
+export { MemoryInflight } from "./inflight.js";
 export { AndcoIntents, } from "./intents.js";
 export { AndcoOAuth, } from "./oauth.js";
+export { AndcoPresenter, } from "./presenter.js";
+export { AndcoResource, } from "./resource.js";
 export { AndcoRest, } from "./rest.js";
 export { AndcoSessionStore } from "./session-store.js";
-export { InProcessLock, MemoryStorage, WebStorage, } from "./storage.js";
+export { LocalStorage, MemoryStorage, SessionStorage, } from "./storage.js";
+export { AndcoTokens, } from "./tokens.js";

package/dist/inflight.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shares one running operation among every caller that asks for the same key.
+ *
+ * The first caller for a key starts the operation; callers arriving while it runs receive the same
+ * promise instead of starting another. Whatever the operation settles with, resolution or
+ * rejection, reaches every waiter, and the key is cleared so the next call starts fresh.
+ *
+ * Unlike a lock this never queues: N concurrent refreshes cost one token request, not N in a row.
+ * The default shares within one runtime only. Supply your own to share across processes, for
+ * example by claiming the key in a store that every instance reads.
+ *
+ * @example
+ * ```ts
+ * const inflight: AndcoInflight = {
+ *   run: (key, operation) => coordinator.singleFlight(`andco:${key}`, operation),
+ * };
+ * ```
+ */
+export interface AndcoInflight {
+    run<T>(key: string, operation: () => Promise<T>): Promise<T>;
+}
+/**
+ * Shares in-flight operations within one runtime, as DataLoader's promise cache does: the promise
+ * is stored on start and deleted on settle, so nothing is cached beyond the operation's lifetime.
+ * The default.
+ */
+export declare class MemoryInflight implements AndcoInflight {
+    #private;
+    run<T>(key: string, operation: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=inflight.d.ts.map

package/dist/inflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inflight.d.ts","sourceRoot":"","sources":["../src/inflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;;;GAIG;AACH,qBAAa,cAAe,YAAW,aAAa;;IAG3C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAqBpE"}

package/dist/inflight.js

@@ -0,0 +1,26 @@
+/**
+ * Shares in-flight operations within one runtime, as DataLoader's promise cache does: the promise
+ * is stored on start and deleted on settle, so nothing is cached beyond the operation's lifetime.
+ * The default.
+ */
+export class MemoryInflight {
+    #running = new Map();
+    run(key, operation) {
+        const shared = this.#running.get(key);
+        if (shared) {
+            console.debug("[AndcoInflight] sharing the running operation for %s", key);
+            return shared;
+        }
+        console.debug("[AndcoInflight] starting %s", key);
+        // Wrapped so a synchronous throw becomes a rejection that is also cleared on settle.
+        const started = (async () => operation())();
+        this.#running.set(key, started);
+        const settle = (outcome) => {
+            if (this.#running.get(key) === started)
+                this.#running.delete(key);
+            console.debug("[AndcoInflight] %s %s", outcome, key);
+        };
+        started.then(() => settle("settled"), () => settle("failed"));
+        return started;
+    }
+}