@andco/sdk 0.0.2 → 0.0.4

package/dist/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,2FAA2F;AAC3F,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;AAEF,gGAAgG;AAChG,MAAM,MAAM,mBAAmB,GAAG;IAChC,gDAAgD;IAChD,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,gGAAgG;IAChG,oBAAoB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACzD;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,8FAA8F;AAC9F,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,uBAAuB,CAAC,GAAG,QAAQ,CAAC;AAE7E,wDAAwD;AACxD,KAAK,eAAe,GAAG;IAAE,GAAG,EAAE;QAAE,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IAAC,GAAG,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAA;CAAE,CAAC;AAC/G,yDAAyD;AACzD,KAAK,kBAAkB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;CAAE,CAAC;AACrF,0DAA0D;AAC1D,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,wEAAwE;IACxE,IAAI,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC/F,6EAA6E;IAC7E,OAAO,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5G,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,aAAa;;IACxB,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,uFAAuF;IACvF,SAAgB,gBAAgB,EAAE,MAAM,CAAC;gBAItB,OAAO,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,qEAAqE;QACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,MAAM,EAAE,WAAW,CAAC;QACpB,MAAM,EAAE,WAAW,CAAC;KACrB;IAOD;;;;;;;;;OASG;IACI,QAAQ,CAAC,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO;;;;;;IASrE,wFAAwF;IACjF,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,eAAe;CAqFnE"}

package/dist/resource.js

@@ -0,0 +1,151 @@
+import { Result } from "./errors.js";
+/**
+ * One Resource Server's view of Andco: verify the bearer token, fetch the live Grant, and answer
+ * 401 or 403 the way RFC 6750 and RFC 9728 describe.
+ *
+ * @example
+ * ```ts
+ * const orders = andco.resource({ resource: "https://casa-norte.example/api" });
+ *
+ * // Fetch-style handler (Next route handlers, Workers, Bun, Deno)
+ * export async function GET(request: Request) {
+ *   const outcome = await orders.protect({ scopes: ["orders:read"] })(request);
+ *   if (outcome instanceof Response) return outcome; // 401 or 403, already built
+ *   return Response.json(await listOrders(outcome.data.subject));
+ * }
+ *
+ * // Hono
+ * app.use("/api/orders/*", orders.protect({ authorizationDetails: [{ type: "orders", actions: ["read"] }] }).hono());
+ *
+ * // Express
+ * router.get("/api/orders", orders.protect({ scopes: ["orders:read"] }).express(), handler);
+ * ```
+ */
+export class AndcoResource {
+    resource;
+    /** Where `WWW-Authenticate` points clients for this resource's metadata (RFC 9728). */
+    resourceMetadata;
+    #tokens;
+    #grants;
+    constructor(options) {
+        this.resource = options.resource;
+        this.resourceMetadata = options.resourceMetadata ?? wellKnownUrl(options.resource);
+        this.#tokens = options.tokens;
+        this.#grants = options.grants;
+    }
+    /**
+     * The document to publish at {@link resourceMetadata}, so clients can discover the Authorization Server.
+     *
+     * @example
+     * ```ts
+     * app.get("/.well-known/oauth-protected-resource/api", (_req, res) =>
+     *   res.json(orders.metadata({ scopesSupported: ["orders:read"] })),
+     * );
+     * ```
+     */
+    metadata(options = {}) {
+        return {
+            resource: this.resource,
+            authorization_servers: [this.#tokens.issuer],
+            bearer_methods_supported: ["header"],
+            scopes_supported: options.scopesSupported,
+        };
+    }
+    /** Builds a guard requiring a live Grant for this resource that satisfies `options`. */
+    protect(options = {}) {
+        const guard = (request) => this.#check(request, options);
+        return Object.assign(guard, {
+            hono: () => async (context, next) => {
+                const outcome = await guard(context.req.raw);
+                if (outcome instanceof Response)
+                    return outcome;
+                context.set("andcoGrant", outcome.data);
+                await next();
+                return undefined;
+            },
+            express: () => async (request, response, next) => {
+                const authorization = request.headers["authorization"];
+                const headers = new Headers();
+                if (typeof authorization === "string")
+                    headers.set("Authorization", authorization);
+                const outcome = await guard(new Request(this.resource, { headers }));
+                if (outcome instanceof Response) {
+                    response.status(outcome.status);
+                    outcome.headers.forEach((value, name) => response.setHeader(name, value));
+                    response.send(await outcome.text());
+                    return;
+                }
+                response.locals["andcoGrant"] = outcome.data;
+                next();
+            },
+        });
+    }
+    async #check(request, options) {
+        const token = /^Bearer ([^\s]+)$/i.exec(request.headers.get("Authorization") ?? "")?.[1];
+        if (!token) {
+            console.debug("[resource.protect] no bearer token for %s", this.resource);
+            return this.#reject(401, "missing_token");
+        }
+        if (options.verify) {
+            const verified = await this.#tokens.verify(token, { audience: this.resource });
+            if (verified.error)
+                return this.#reject(401, "invalid_token", { description: verified.error.message });
+        }
+        const { data: grant, error } = await this.#grants.get(token);
+        if (error) {
+            console.debug("[resource.protect] grant lookup failed status=%s code=%s", error.status, error.code);
+            if (error.status === 401 || error.status === 404)
+                return this.#reject(401, "invalid_token");
+            return this.#reject(503, "temporarily_unavailable");
+        }
+        if (!grant.active)
+            return this.#reject(401, "invalid_token");
+        if (grant.resource !== this.resource) {
+            console.debug("[resource.protect] grant resource %s is not %s", grant.resource, this.resource);
+            return this.#reject(403, "insufficient_authorization");
+        }
+        const missingScopes = (options.scopes ?? []).filter((scope) => !grant.scopes.includes(scope));
+        if (missingScopes.length) {
+            console.debug("[resource.protect] grant lacks scopes %o", missingScopes);
+            return this.#reject(403, "insufficient_scope", { scope: options.scopes.join(" ") });
+        }
+        const missingDetail = (options.authorizationDetails ?? []).find((need) => !satisfies(grant, need));
+        if (missingDetail) {
+            console.debug("[resource.protect] grant lacks detail %o", missingDetail);
+            return this.#reject(403, "insufficient_authorization", { detail: missingDetail });
+        }
+        return Result.ok(grant);
+    }
+    #reject(status, error, extra = {}) {
+        const headers = new Headers({ "Content-Type": "application/json", "Cache-Control": "no-store" });
+        if (status === 401) {
+            // RFC 6750: a request with no credentials carries no error code.
+            const attributes = [
+                error === "missing_token" ? null : `error="${error}"`,
+                `resource_metadata="${this.resourceMetadata}"`,
+            ];
+            headers.set("WWW-Authenticate", `Bearer ${attributes.filter(Boolean).join(", ")}`);
+        }
+        else if (status === 403 && error === "insufficient_scope") {
+            headers.set("WWW-Authenticate", `Bearer error="insufficient_scope", scope="${extra.scope}", resource_metadata="${this.resourceMetadata}"`);
+        }
+        return new Response(JSON.stringify({ error, error_description: extra.description, required: extra.detail }), {
+            status,
+            headers,
+        });
+    }
+}
+function satisfies(grant, need) {
+    return grant.authorizationDetails.some((detail) => {
+        if (detail["type"] !== need.type)
+            return false;
+        const actions = Array.isArray(detail["actions"]) ? detail["actions"] : [];
+        return (need.actions ?? []).every((action) => actions.includes(action));
+    });
+}
+/** RFC 9728: the well-known segment goes between the origin and the resource's own path. */
+function wellKnownUrl(resource) {
+    const url = new URL(resource);
+    const path = url.pathname.replace(/\/+$/, "");
+    return new URL(`/.well-known/oauth-protected-resource${path}`, url.origin).href;
+}

package/dist/rest.d.ts

@@ -1,11 +1,15 @@
-import { type ResultClientFor } from "@andco/openapi-fetch";
-import { type AndCoRestClient } from "@andco/protocol/transport";
+import { type ResultClient } from "@andco/openapi-fetch";
+import { type AndCoRestClient, type AndCoRestPaths } from "@andco/protocol/transport";
 import type { AndcoConfig } from "./config.js";
 import type { AndcoCredentials } from "./credentials.js";
 import { AndcoAPIError } from "./errors.js";
+import type { AndcoGlobals } from "./globals.js";
+import type { GrantReference } from "./grants.js";
+/** API configuration and a credential resolver evaluated for each request. */
 export type AndcoRestOptions = {
     config: AndcoConfig;
-    fetch: typeof globalThis.fetch;
+    /** Platform capabilities; only `fetch` is read today. `resolveGlobals()` builds one. */
+    globals: AndcoGlobals;
     credentials: AndcoCredentials;
     /** Resource Indicator whose token authorizes these requests. Defaults to the configured API. */
     resource?: string;
@@ -15,6 +19,19 @@ export type AndcoPageOptions = {
     after?: string;
     limit?: number;
 };
+/**
+ * Andco authorization controls for one call, passed after the openapi-fetch options and never sent
+ * as query data. Without `grant` the Authorization Server selects the Grant.
+ *
+ * @example
+ * ```ts
+ * await service.rest.http.GET("/accounts", undefined, { grant: grantId });
+ * ```
+ */
+export type AndcoGrantOptions = {
+    grant?: GrantReference;
+};
+/** Per-request query, headers, cancellation, and write idempotency options. */
 export type AndcoRequestOptions = {
     /** Query parameters. Array values repeat the key, which is what the Andco API expects. */
     query?: Record<string, string | number | boolean | readonly string[] | undefined>;
@@ -24,7 +41,7 @@ export type AndcoRequestOptions = {
     idempotencyKey?: string;
 };
 /** `AndcoRest.http`'s type: the generated OAuth resource client, with `AndcoAPIError` as its error. */
-export type AndcoHttpClient = ResultClientFor<AndCoRestClient, AndcoAPIError>;
+export type AndcoHttpClient = ResultClient<AndCoRestPaths, "application/json", AndcoAPIError, AndcoGrantOptions>;
 /**
  * Typed access to the Andco resource API.
  *
@@ -53,6 +70,8 @@ export declare class AndcoRest {
      * The raw OAuth resource client generated from the API's OpenAPI contract. Use this for low-level access to the API endpoints.
      */
     readonly raw: AndCoRestClient;
+    /** Creates request-local authority for one iterator, subscription or explicitly grouped retry. */
+    forOperation(): AndcoRest;
     constructor(options: AndcoRestOptions);
 }
 //# sourceMappingURL=rest.d.ts.map

package/dist/rest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../src/rest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAc,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,KAAK,eAAe,EAAyB,MAAM,2BAA2B,CAAC;AACxF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,gBAAgB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,MAAM,MAAM,mBAAmB,GAAG;IAChC,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,uGAAuG;AACvG,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;AAE9E;;;;;;;;;;;;GAYG;AACH,qBAAa,SAAS;;IAMpB;;;;;;;OAOG;IACH,SAAgB,IAAI,EAAE,eAAe,CAAC;IAEtC;;OAEG;IACH,SAAgB,GAAG,EAAE,eAAe,CAAC;gBAElB,OAAO,EAAE,gBAAgB;CAc7C"}
+{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../src/rest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAc,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAyB,MAAM,2BAA2B,CAAC;AAC7G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,WAAW,CAAC;IACpB,wFAAwF;IACxF,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,gBAAgB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3D,+EAA+E;AAC/E,MAAM,MAAM,mBAAmB,GAAG;IAChC,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,uGAAuG;AACvG,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAAC;AAEjH;;;;;;;;;;;;GAYG;AACH,qBAAa,SAAS;;IAOpB;;;;;;;OAOG;IACH,SAAgB,IAAI,EAAE,eAAe,CAAC;IAEtC;;OAEG;IACH,SAAgB,GAAG,EAAE,eAAe,CAAC;IAErC,kGAAkG;IAC3F,YAAY,IAAI,SAAS;gBAWb,OAAO,EAAE,gBAAgB;CA0C7C"}

package/dist/rest.js

@@ -16,9 +16,10 @@ import { AndcoAPIError } from "./errors.js";
  */
 export class AndcoRest {
     #config;
-    #fetch;
+    #globals;
     #credentials;
     #resource;
+    #middleware = [];
     /**
      * Typed OAuth resource client generated from the API's OpenAPI contract.
      * @example
@@ -32,16 +33,56 @@ export class AndcoRest {
      * The raw OAuth resource client generated from the API's OpenAPI contract. Use this for low-level access to the API endpoints.
      */
     raw;
+    /** Creates request-local authority for one iterator, subscription or explicitly grouped retry. */
+    forOperation() {
+        const rest = new AndcoRest({
+            config: this.#config,
+            globals: this.#globals,
+            credentials: this.#credentials.forOperation?.() ?? this.#credentials,
+            resource: this.#resource,
+        });
+        rest.raw.use(...this.#middleware);
+        return rest;
+    }
     constructor(options) {
         this.#config = options.config;
-        this.#fetch = options.fetch;
+        this.#globals = options.globals;
         this.#credentials = options.credentials;
         this.#resource = options.resource ?? options.config.endpoints.api.origin;
-        this.raw = createAndCoRestClient({
+        const create = (controls = {}) => createAndCoRestClient({
             endpoint: this.#config.endpoints.api,
             apiVersion: this.#config.apiVersion,
-            accessToken: () => this.#credentials.accessTokenFor(this.#resource),
-            fetch: this.#fetch,
+            accessToken: () => this.#credentials.accessTokenFor(this.#resource, { grant: controls.grant }),
+            fetch: this.#globals.fetch,
+        });
+        const base = create();
+        const middleware = this.#middleware;
+        const methods = new Set(["GET", "PUT", "POST", "DELETE", "OPTIONS", "HEAD", "PATCH", "TRACE", "request"]);
+        this.raw = new Proxy(base, {
+            get(target, property, receiver) {
+                if (property === "use")
+                    return (...items) => {
+                        middleware.push(...items);
+                    };
+                if (property === "eject")
+                    return (...items) => {
+                        for (const item of items) {
+                            const i = middleware.indexOf(item);
+                            if (i >= 0)
+                                middleware.splice(i, 1);
+                        }
+                    };
+                if (typeof property !== "string" || !methods.has(property))
+                    return Reflect.get(target, property, receiver);
+                return (...args) => {
+                    const index = property === "request" ? 3 : 2;
+                    const controls = (args[index] ?? {});
+                    const client = create(controls);
+                    client.use(...middleware);
+                    const call = Reflect.get(client, property);
+                    return call.apply(client, args.slice(0, index));
+                };
+            },
         });
         this.http = withResult(this.raw, AndcoAPIError.fromOpenAPIFetch);
     }

package/dist/server/index.d.ts

@@ -1,4 +1,5 @@
 import { AndcoClient, type AndcoClientOptions } from "../client.js";
+/** Server instance configuration; bind caller credentials separately with `with(...)`. */
 export type AndcoServerOptions = AndcoClientOptions;
 /**
  * Creates an Andco Instance for a server.
@@ -18,4 +19,6 @@ export type AndcoServerOptions = AndcoClientOptions;
  * ```
  */
 export declare function createAndcoInstanceForServer(options: AndcoServerOptions): AndcoClient;
+export type { Grant, GrantReference } from "../grants.js";
+export { AndcoAuthorizationRequiredError, AndcoService, type AndcoServiceCredentialsOptions, type AndcoServiceOptions, type AndcoServiceSubject, createAndcoService, } from "../service.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGpE,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAOrF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGpE,0FAA0F;AAC1F,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAOrF;AACD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EACL,+BAA+B,EAC/B,YAAY,EACZ,KAAK,8BAA8B,EACnC,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,kBAAkB,GACnB,MAAM,eAAe,CAAC"}

package/dist/server/index.js

@@ -25,3 +25,4 @@ export function createAndcoInstanceForServer(options) {
     }
     return new AndcoClient(options);
 }
+export { AndcoAuthorizationRequiredError, AndcoService, createAndcoService, } from "../service.js";

package/dist/server-metadata.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-metadata.generated.d.ts","sourceRoot":"","sources":["../src/server-metadata.generated.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,KAAK,IAAI,MAAM,eAAe,CAAC;AAsC3C,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,cAAc,CAEvE"}
+{"version":3,"file":"server-metadata.generated.d.ts","sourceRoot":"","sources":["../src/server-metadata.generated.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,KAAK,IAAI,MAAM,eAAe,CAAC;AA0C3C,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,cAAc,CAEvE"}

package/dist/server-metadata.generated.js

@@ -6,8 +6,8 @@
 // sign-in. `{issuer}` is substituted with the configured `endpointAuth`.
 //
 // Regenerate: pnpm --filter @andco/sdk run refresh:server-metadata
-// Source: https://auth.localhost/auth/v1/.well-known/openid-configuration
-// Generated: 2026-09-19T01:19:04.372Z
+// Source: https://oauth.localhost/auth/v1/.well-known/openid-configuration
+// Generated: 2026-09-30T18:33:31.034Z
 const TEMPLATE = {
     issuer: "{issuer}",
     authorization_endpoint: "{issuer}/oauth/authorize",
@@ -15,11 +15,15 @@ const TEMPLATE = {
     device_authorization_endpoint: "{issuer}/oauth/device/authorize",
     jwks_uri: "{issuer}/.well-known/jwks.json",
     userinfo_endpoint: "{issuer}/oauth/userinfo",
-    registration_endpoint: "{issuer}/oauth/clients/register",
     scopes_supported: ["openid", "profile", "email", "phone", "offline_access"],
     response_types_supported: ["code"],
     response_modes_supported: ["query"],
-    grant_types_supported: ["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"],
+    grant_types_supported: [
+        "authorization_code",
+        "refresh_token",
+        "urn:ietf:params:oauth:grant-type:device_code",
+        "client_credentials",
+    ],
     subject_types_supported: ["public"],
     id_token_signing_alg_values_supported: ["RS256", "HS256", "ES256"],
     token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post", "none"],

package/dist/service.d.ts

@@ -0,0 +1,109 @@
+import { type GrantedOrganizationSubject } from "@andco/protocol";
+import { AndcoConfig, type AndcoConfigInput } from "./config.js";
+import type { AndcoCredentials } from "./credentials.js";
+import { AndcoError } from "./errors.js";
+import { type AndcoGlobals } from "./globals.js";
+import { type Grant, type GrantReference } from "./grants.js";
+import { AndcoIntents } from "./intents.js";
+import { AndcoRest } from "./rest.js";
+/**
+ * Whose resources a Service acts on: always an Organization, named by its identifier.
+ *
+ * @example
+ * const subject: AndcoServiceSubject = { type: "organization", identifier: "123" };
+ */
+export type AndcoServiceSubject = GrantedOrganizationSubject;
+export interface AndcoServiceOptions extends AndcoConfigInput {
+    clientSecret: string;
+    /**
+     * The Organization this Service acts for when a call does not name one: `service.rest` and
+     * `service.credentials()` use it. Omit it when every call passes its own `subject`.
+     *
+     * @example
+     * ```ts
+     * createAndcoService({ clientId, clientSecret, subject: { type: "organization", identifier: "123" } });
+     * ```
+     */
+    subject?: AndcoServiceSubject;
+    globals?: Partial<AndcoGlobals>;
+    /** Registered Resource Indicator, independent of the HTTP endpoint origin. */
+    resource?: string;
+}
+export interface AndcoServiceCredentialsOptions {
+    /** The Organization to act for; defaults to the Service's `subject`. */
+    subject?: AndcoServiceSubject;
+    /** Exact Grant to use instead of the server's selection, e.g. when several qualify. */
+    grant?: GrantReference;
+}
+export interface AndcoServiceListGrantsOptions {
+    /** The Organization whose Grants to list; defaults to the Service's `subject`. */
+    subject?: AndcoServiceSubject;
+    /** Resource Indicator; defaults to the Service's resource. */
+    resource?: string;
+}
+/** No approved Grant covers this subject and resource. Version one never opens a login flow. */
+export declare class AndcoAuthorizationRequiredError extends AndcoError {
+    readonly subject: AndcoServiceSubject;
+    readonly resource: string;
+    constructor(subject: AndcoServiceSubject, resource: string);
+}
+/**
+ * Confidential client acting for Organizations through Grants approved in Platform.
+ *
+ * Each call sends the subject and the resource, and the Authorization Server selects the Grant.
+ * When more than one Grant qualifies the exchange fails with `ambiguous_grant`, whose `details`
+ * name the candidate ids; pass one as `grant` to pin it. Access tokens live in memory only.
+ *
+ * @example
+ * ```ts
+ * const service = createAndcoService({ clientId, clientSecret });
+ * const bank = new Bank(service.credentials({ subject: { type: "organization", identifier: "123" } }));
+ * const { data } = await bank.client.http.GET("/accounts").throwOnError();
+ * await service.intents({ subject: { type: "organization", identifier: "123" } }).approve(transferId);
+ * ```
+ */
+export declare class AndcoService {
+    #private;
+    readonly config: AndcoConfig;
+    readonly rest: AndcoRest;
+    constructor(options: AndcoServiceOptions);
+    /**
+     * Credentials for Bank or another Resource Server definition, acting for one Organization.
+     *
+     * @example
+     * ```ts
+     * const bank = new Bank(service.credentials({ subject: { type: "organization", identifier: "123" } }));
+     * ```
+     */
+    credentials(options?: AndcoServiceCredentialsOptions): AndcoCredentials;
+    /**
+     * The Intent lifecycle (`approve`, `reject`, `cancel`, `get`, `events`, `subscribe`) acting for
+     * one Organization: the same {@link AndcoIntents} `andco.intents` exposes, authorized with
+     * `credentials(options)`. A method rather than a property, like `credentials()`, because the
+     * subject and the Grant are chosen per call; without options it acts for the Service's `subject`.
+     * Presentation needs a person and a browser, so `present()` and `presentationURL()` are not for a
+     * Service.
+     *
+     * @example
+     * ```ts
+     * const intents = service.intents({ subject: { type: "organization", identifier: "123" } });
+     * await intents.approve(transferId); // the server selects the Grant holding bank_transfer approve
+     * await service.intents({ grant: approverGrantId }).reject(transferId, { reason: "over_budget" });
+     * const { data: transfer } = await service.intents().get(transferId);
+     * ```
+     */
+    intents(options?: AndcoServiceCredentialsOptions): AndcoIntents;
+    /**
+     * Lists the active Grants the server would select from for one subject and resource.
+     *
+     * @example
+     * ```ts
+     * const grants = await service.listGrants({ subject: { type: "organization", identifier: "123" } });
+     * const bank = new Bank(service.credentials({ subject, grant: grants[0] }));
+     * ```
+     */
+    listGrants(options?: AndcoServiceListGrantsOptions): Promise<readonly Grant[]>;
+}
+/** Constructs a service lazily; does not perform network I/O or approve access. */
+export declare function createAndcoService(options: AndcoServiceOptions): AndcoService;
+//# sourceMappingURL=service.d.ts.map

package/dist/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,0BAA0B,EAIhC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,KAAK,KAAK,EAAE,KAAK,cAAc,EAAW,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAE7D,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AACD,MAAM,WAAW,8BAA8B;IAC7C,wEAAwE;IACxE,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,uFAAuF;IACvF,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AACD,MAAM,WAAW,6BAA6B;IAC5C,kFAAkF;IAClF,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AACD,gGAAgG;AAChG,qBAAa,+BAAgC,SAAQ,UAAU;aAE3C,OAAO,EAAE,mBAAmB;aAC5B,QAAQ,EAAE,MAAM;gBADhB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM;CAOnC;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,YAAY;;IACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;gBAOb,OAAO,EAAE,mBAAmB;IAmBxC;;;;;;;OAOG;IACH,WAAW,CAAC,OAAO,GAAE,8BAAmC,GAAG,gBAAgB;IAM3E;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,OAAO,GAAE,8BAAmC,GAAG,YAAY;IAenE;;;;;;;;OAQG;IACG,UAAU,CAAC,OAAO,GAAE,6BAAkC,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC;CAiHzF;AAiBD,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAE7E"}