@andco/sdk 0.0.3 → 0.0.4

package/dist/browser/controller.js

@@ -1,6 +1,34 @@
 import { ANDCO_ERROR_CODES as ANDCO_PROTOCOL_ERROR_CODES, ANDCO_RELEASE, callbackStateCreate } from "@andco/protocol";
 import { ANDCO_ERROR_CODES, AndcoError } from "../errors.js";
 import { AndcoButtonBridge } from "./frame.js";
+/**
+ * Sandbox restrictions the hosted iframe grants: scripts to run, same-origin to reach its own
+ * storage, and a popup that may escape the sandbox because it is a separate top-level browsing
+ * context the sandbox does not otherwise constrain.
+ *
+ * This is a containment boundary, not a per-binding style choice, so it is declared exactly once
+ * here rather than copied into every framework binding.
+ */
+const IFRAME_SANDBOX = "allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox";
+/** Keeps the Project's own URL out of the request the hosted iframe makes. */
+const IFRAME_REFERRER_POLICY = "no-referrer";
+/** The part of the default iframe style every binding shares regardless of size. */
+const IFRAME_BASE_STYLE = { border: "0", display: "block" };
+/**
+ * The hosted control's default box.
+ *
+ * A bare iframe is 300x150 with a border, and the hosted control fills whatever box it is given, so
+ * without a default an application sees a bordered grey slab. React, Vue, and Svelte apply this
+ * directly to the `<iframe>` they render.
+ */
+const DEFAULT_SIZE = { height: "3rem", width: "18rem" };
+const IFRAME_DEFAULT_STYLE = { ...IFRAME_BASE_STYLE, ...DEFAULT_SIZE };
+/** Renders a style record — property names only, no camelCase — as inline CSS text. */
+function frameStyleText(style) {
+    return Object.entries(style)
+        .map(([property, value]) => `${property}:${value}`)
+        .join(";");
+}
 /**
  * Coordinates one hosted Andco iframe without owning how a framework renders it.
  *
@@ -11,6 +39,15 @@ import { AndcoButtonBridge } from "./frame.js";
  * Render `snapshot.iframeURL` in your platform's own iframe element, then hand that element to
  * `connect()` once it mounts.
  *
+ * The frame's fixed attributes and default sizing are published as static data —
+ * {@link AndcoButtonController.IFRAME_SANDBOX}, {@link AndcoButtonController.IFRAME_REFERRER_POLICY},
+ * {@link AndcoButtonController.IFRAME_DEFAULT_STYLE}, and {@link AndcoButtonController.frameProps} for
+ * the snapshot-derived `src`/`hidden` pair — so every binding applies the same contract to its own
+ * element instead of redeclaring it. `sdk-script`'s custom element is the one exception on sizing: it
+ * sizes itself through a stylesheet layer (using {@link AndcoButtonController.DEFAULT_SIZE}, so the
+ * visible default stays the same) and stretches its internal iframe to fill it, so that an author's
+ * own CSS on `andco-button` wins without touching the iframe's inline style.
+ *
  * @example
  * ```ts
  * const controller = new AndcoButtonController({ client: andco, onComplete: reload });
@@ -19,6 +56,31 @@ import { AndcoButtonBridge } from "./frame.js";
  * ```
  */
 export class AndcoButtonController {
+    /** @see {@link IFRAME_SANDBOX} */
+    static IFRAME_SANDBOX = IFRAME_SANDBOX;
+    /** @see {@link IFRAME_REFERRER_POLICY} */
+    static IFRAME_REFERRER_POLICY = IFRAME_REFERRER_POLICY;
+    /** @see {@link IFRAME_BASE_STYLE} */
+    static IFRAME_BASE_STYLE = IFRAME_BASE_STYLE;
+    /** @see {@link DEFAULT_SIZE} */
+    static DEFAULT_SIZE = DEFAULT_SIZE;
+    /** @see {@link IFRAME_DEFAULT_STYLE} */
+    static IFRAME_DEFAULT_STYLE = IFRAME_DEFAULT_STYLE;
+    /**
+     * Renders a style record as inline CSS text, for a binding that needs a string rather than an
+     * object — Svelte's `style` attribute and `sdk-script`'s `HTMLElement.style.cssText`.
+     */
+    static frameStyleText = frameStyleText;
+    /**
+     * The two iframe attributes a snapshot drives, mapped from protocol terms to DOM ones.
+     *
+     * Every binding applies this on top of {@link AndcoButtonController.IFRAME_SANDBOX} and
+     * {@link AndcoButtonController.IFRAME_REFERRER_POLICY}: those two are fixed, this pair changes
+     * with the connection.
+     */
+    static frameProps(snapshot) {
+        return { src: snapshot.iframeURL, hidden: !snapshot.ready };
+    }
     #options;
     #listeners = new Set();
     #bridge;
@@ -51,7 +113,7 @@ export class AndcoButtonController {
     connect(iframe) {
         this.disconnect();
         this.#iframe = iframe;
-        console.debug("[AndcoButtonController] connecting: %o", { iframeURL: this.#snapshot.iframeURL });
+        console.debug("[AndcoButtonController] connecting: %s", this.#snapshot.iframeURL);
         this.#publish({ status: "connecting", ready: false, error: null });
         try {
             this.#bridge = new AndcoButtonBridge(iframe, {
@@ -81,7 +143,7 @@ export class AndcoButtonController {
                     const timedOut = event.error.code === ANDCO_PROTOCOL_ERROR_CODES.HANDSHAKE_TIMEOUT;
                     if (timedOut && !this.#timedOutOnce && this.#iframe) {
                         this.#timedOutOnce = true;
-                        console.debug("[AndcoButtonController] handshake timed out", { action: "reconnect", retry: 1 });
+                        console.debug("[AndcoButtonController] handshake timed out; reconnecting once");
                         this.connect(this.#iframe);
                         return;
                     }
@@ -94,6 +156,7 @@ export class AndcoButtonController {
         }
         return () => this.disconnect();
     }
+    /** Detaches the iframe bridge while retaining listeners and the last iframe for reuse. */
     disconnect() {
         this.#bridge?.destroy();
         this.#bridge = undefined;
@@ -114,14 +177,13 @@ export class AndcoButtonController {
             // A deliberate retry (the app calling this after showing the error) earns its own one-shot
             // auto-reconnect on a future timeout, same as the very first connect did.
             this.#timedOutOnce = false;
-            console.debug("[AndcoButtonController] restarting after an error, reconnecting: %o", {
-                code: this.#snapshot.error?.code,
-            });
+            console.debug("[AndcoButtonController] restarting after an error, reconnecting: %O", this.#snapshot.error);
             this.connect(this.#iframe);
             return;
         }
         this.#publish({ status: this.#bridge ? "ready" : "idle", error: null });
     }
+    /** Releases the bridge, iframe reference, and all snapshot listeners. */
     destroy() {
         this.disconnect();
         this.#iframe = undefined;
@@ -144,6 +206,8 @@ export class AndcoButtonController {
         const state = callbackStateCreate(this.#options.client.config.endpoints.widget.origin, presentationId);
         if (this.#options.flow === "intent")
             return this.#presentIntent(generation, presentationId, state);
+        if (this.#options.presentation === "redirect")
+            return this.#presentRedirect(generation, presentationId);
         const prepared = await this.#options.client.oauth.createAuthorizationRequest({
             ...(this.#options.authorization ?? {}),
             state,
@@ -155,11 +219,35 @@ export class AndcoButtonController {
         this.#pending = prepared.data;
         this.#bridge?.resolvePresentation(presentationId, prepared.data.authorizationUrl.href);
     }
+    /**
+     * Presents the authorization by replacing this document.
+     *
+     * The hosted surface cannot do it: its sandbox grants no top navigation, so a URL resolved back to
+     * the iframe would only reach a popup that was never opened. The instance's own sign-in already
+     * knows how to redirect — it prepares the request, persists the transaction for the next load, and
+     * assigns the location — so the control delegates to it rather than repeating those steps. Nothing
+     * settles here on success: the document is gone, and the session arrives through Callback
+     * Consumption on the next load.
+     */
+    async #presentRedirect(generation, presentationId) {
+        console.debug("[AndcoButtonController] presenting by redirect: presentationId=%s", presentationId);
+        const signedIn = await this.#options.client.auth.signIn({
+            ...(this.#options.authorization ?? {}),
+            presentation: "redirect",
+        });
+        if (generation !== this.#generation)
+            return;
+        if (signedIn.error) {
+            // Tell the surface the presentation is over so it leaves its busy state; there is no popup to close.
+            this.#bridge?.resolvePresentation(presentationId);
+            return this.#fail(signedIn.error);
+        }
+    }
     /**
      * Resolves the Intent this control presents, reusing the instance's own URL construction.
      *
      * It does not build the URL itself. Two constructions of one presentation URL is exactly how the
-     * direct and hosted paths drifted before, which is why `intents.presentationURL` is published.
+     * direct and hosted paths drifted before, which is why `intents.presentationURLFor` is published.
      */
     async #presentIntent(generation, presentationId, state) {
         const client = this.#options.client;
@@ -189,19 +277,21 @@ export class AndcoButtonController {
         catch (cause) {
             return this.#fail(AndcoError.from(cause, ANDCO_ERROR_CODES.INVALID_CONFIGURATION));
         }
-        if (generation !== this.#generation)
+        if (generation !== this.#generation) {
             return;
-        const url = await client.intents.presentationURL({
-            intentId: resolvedId,
+        }
+        const url = await client.intents.presentationURLFor(resolvedId, {
             presentation: "popup",
             returnTo,
             errorReturnTo: returnTo,
             state,
         });
-        if (generation !== this.#generation)
+        if (generation !== this.#generation) {
             return;
-        if (url.error)
+        }
+        else if (url.error) {
             return this.#fail(url.error);
+        }
         this.#intentId = resolvedId;
         this.#bridge?.resolvePresentation(presentationId, url.data.href);
     }
@@ -243,7 +333,7 @@ export class AndcoButtonController {
     #fail(error, event) {
         // An app that never wired `onError` must not lose the failure entirely — a button that just sits
         // there disabled, with nothing in the console, is what made the last one of these hard to find.
-        console.error("[AndcoButtonController] %s: %o", error.code, { message: error.message, details: error.details });
+        console.error("[AndcoButtonController] %O", error);
         this.#publish({ status: "error", error });
         this.#options.onError?.(error, event);
     }

package/dist/browser/frame.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frame.d.ts","sourceRoot":"","sources":["../../src/browser/frame.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,eAAe,EAEpB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,gCAAgC,EACrC,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAEhC,MAAM,iBAAiB,CAAC;AAGzB,iEAAiE;AACjE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC3C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC3C,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,gCAAgC,GAAG,uBAAuB,GAAG,wBAAwB,KAAK,IAAI,CAAC;IACpH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,KAAK,IAAI,CAAC;IAC9E,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC7D,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAC/C,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAY1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAZ1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAM;IAC1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,IAAI,CAA0B;IACtC,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,SAAS,CAAS;gBAGP,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,iBAAiB;IAkB7C,OAAO,CAAC,aAAa;IAWrB,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,OAAO;IAkDf,OAAO,CAAC,QAAQ,CAAC,aAAa,CAM5B;IAEF,OAAO,CAAC,QAAQ,CAAC,UAAU,CA8BzB;IAEF,OAAO,CAAC,QAAQ,CAAC,cAAc,CA0B7B;IAEF,+DAA+D;IAC/D,OAAO,CAAC,IAAI;IASZ;;;;;;;;;OASG;IACI,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,GAAG;IAWrE;;;;;;OAMG;IACI,0BAA0B,CAAC,OAAO,EAAE,gBAAgB;IAI3D,oEAAoE;IAC7D,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,WAAW,CAAC;IAU3F,0EAA0E;IACnE,OAAO;CASf"}
+{"version":3,"file":"frame.d.ts","sourceRoot":"","sources":["../../src/browser/frame.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,eAAe,EAEpB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,gCAAgC,EACrC,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EAErB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAEhC,MAAM,iBAAiB,CAAC;AAGzB,iEAAiE;AACjE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC3C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC3C,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,gCAAgC,GAAG,uBAAuB,GAAG,wBAAwB,KAAK,IAAI,CAAC;IACpH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,KAAK,IAAI,CAAC;IAC9E,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC7D,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAC/C,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAY1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAZ1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAM;IAC1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,IAAI,CAA0B;IACtC,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,SAAS,CAAS;gBAGP,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,iBAAiB;IAkB7C,OAAO,CAAC,aAAa;IAWrB,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,OAAO;IAmDf,OAAO,CAAC,QAAQ,CAAC,aAAa,CAM5B;IAEF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAgCzB;IAEF,OAAO,CAAC,QAAQ,CAAC,cAAc,CA2B7B;IAEF,+DAA+D;IAC/D,OAAO,CAAC,IAAI;IASZ;;;;;;;;;OASG;IACI,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,GAAG;IAWrE;;;;;;OAMG;IACI,0BAA0B,CAAC,OAAO,EAAE,gBAAgB;IAI3D,oEAAoE;IAC7D,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,WAAW,CAAC;IAU3F,0EAA0E;IACnE,OAAO;CASf"}

package/dist/browser/frame.js

@@ -34,7 +34,7 @@ export class AndcoButtonBridge {
         if (this.url.origin === window.location.origin) {
             throw new AndcoError(ANDCO_ERROR_CODES.SAME_ORIGIN_ENDPOINT, { details: { endpointButton: this.url.href } });
         }
-        console.debug("[AndcoButtonBridge] created: %o", { endpointButton: this.url.href });
+        console.debug("[AndcoButtonBridge] created: %s", this.url.href);
         iframe.addEventListener("load", this.startHandshake);
         this.startHandshake();
     }
@@ -62,11 +62,7 @@ export class AndcoButtonBridge {
                     return;
                 this.settled = true;
                 this.stopHandshake();
-                console.debug("[AndcoButtonBridge] handshake settled: %o", {
-                    attempts: this.handshakeAttempts,
-                    transport: this.transport,
-                    elapsedMs: Date.now() - this.handshakeStartedAt,
-                });
+                console.debug("[AndcoButtonBridge] handshake settled: attempts=%d transport=%s elapsedMs=%d", this.handshakeAttempts, this.transport, Date.now() - this.handshakeStartedAt);
                 this.options.onReady?.(message);
                 return;
             }
@@ -75,7 +71,7 @@ export class AndcoButtonBridge {
                     this.settled = true;
                     this.stopHandshake();
                 }
-                console.warn("[AndcoButtonBridge] hosted surface reported an error: %o", message.error);
+                console.warn("[AndcoButtonBridge] hosted surface reported an error: %O", message.error);
                 this.options.onError?.(message);
                 return;
             }
@@ -142,9 +138,7 @@ export class AndcoButtonBridge {
             // makes the very first attempt throw a targetOrigin mismatch; the 250ms retry loop recovers
             // once the iframe has actually navigated, so a transient failure here is not fatal — but it is
             // worth a log line, since a run that never recovers looks identical to this from the outside.
-            console.debug("[AndcoButtonBridge] init attempt %d could not post yet, retrying: %o", this.handshakeAttempts, {
-                cause,
-            });
+            console.debug("[AndcoButtonBridge] init attempt %d could not post yet, retrying: %O", this.handshakeAttempts, cause);
         }
     };
     startHandshake = () => {
@@ -160,10 +154,7 @@ export class AndcoButtonBridge {
             this.settled = true;
             this.stopHandshake();
             this.closePort();
-            console.error("[AndcoButtonBridge] handshake timed out: %o", {
-                attempts: this.handshakeAttempts,
-                endpointButton: this.url.href,
-            });
+            console.error("[AndcoButtonBridge] handshake timed out: attempts=%d endpointButton=%s", this.handshakeAttempts, this.url.href);
             const message = {
                 protocol: ANDCO_SDK_PROTOCOL,
                 version: ANDCO_PROTOCOL_VERSION,
@@ -228,7 +219,7 @@ export class AndcoButtonBridge {
     destroy() {
         if (this.destroyed)
             return;
-        console.debug("[AndcoButtonBridge] destroyed: %o", { settled: this.settled, attempts: this.handshakeAttempts });
+        console.debug("[AndcoButtonBridge] destroyed: settled=%s attempts=%d", this.settled, this.handshakeAttempts);
         this.destroyed = true;
         window.removeEventListener("message", this.receiveWindow);
         this.iframe.removeEventListener("load", this.startHandshake);

package/dist/browser/index.d.ts

@@ -1,6 +1,7 @@
 import { AndcoClient, type AndcoClientOptions } from "../client.js";
+import { Result } from "../errors.js";
 import type { AndcoAuthorizationRequest } from "../oauth.js";
-import { type AndcoPresenter } from "../presenter.js";
+import { AndcoPresenter, type AndcoPresentOptions } from "../presenter.js";
 export { AndcoButtonController, type AndcoButtonControllerOptions, type AndcoButtonFlow, type AndcoButtonSnapshot, type AndcoButtonStatus, } from "./controller.js";
 export { AndcoButtonBridge, type AndcoFrameOptions } from "./frame.js";
 export { type AndcoPopupMessage, type AndcoPopupWindow, type AndcoRelayOutcome, andcoPopupPresentationId, isAndcoNativeHost, openAndcoPopup, openAndcoPopupWindow, relayAndcoPopupCallback, } from "./popup.js";
@@ -17,7 +18,12 @@ export { type AndcoPopupMessage, type AndcoPopupWindow, type AndcoRelayOutcome,
  * an authorization may be pushed, and an Intent is created on demand. Resolving first is what got
  * the window blocked.
  */
-export declare function browserPresenter(): AndcoPresenter;
+export declare class AndcoPresenterBrowser extends AndcoPresenter {
+    #private;
+    focus(presentationId: string): void;
+    present(options: AndcoPresentOptions): Promise<Result<URL | null>>;
+}
+/** Public-client options for browser sign-in, callback relay, and transaction recovery. */
 export type AndcoBrowserOptions = Omit<AndcoClientOptions, "presenter" | "source" | "clientSecret"> & {
     /** Rejected by type: a confidential credential must never reach a browser. */
     clientSecret?: never;

package/dist/browser/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/browser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIpE,OAAO,KAAK,EAAE,yBAAyB,EAAc,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,iBAAiB,CAAC;AAItE,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,EACjC,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,IAAI,cAAc,CAqCjD;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,QAAQ,GAAG,cAAc,CAAC,GAAG;IACpG,8EAA8E;IAC9E,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,iGAAiG;IACjG,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,uEAAuE;IACvE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,+FAA+F;IAC/F,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,mBAAmB,GAAG,WAAW,CAmBvF;AA0CD,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAMnH"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/browser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGpE,OAAO,EAAqB,MAAM,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,yBAAyB,EAAc,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAI3E,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,EACjC,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAsB,SAAQ,cAAc;;IAI9C,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAKtC,OAAO,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;CA8CzE;AAED,2FAA2F;AAC3F,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,QAAQ,GAAG,cAAc,CAAC,GAAG;IACpG,8EAA8E;IAC9E,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,iGAAiG;IACjG,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,uEAAuE;IACvE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,+FAA+F;IAC/F,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,mBAAmB,GAAG,WAAW,CAkBvF;AA0CD,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAMnH"}

package/dist/browser/index.js

@@ -1,7 +1,7 @@
 import { AndcoClient } from "../client.js";
 import { ANDCO_ERROR_CODES, Result } from "../errors.js";
-import { PRESENT_TARGET } from "../presenter.js";
-import { WebStorage } from "../storage.js";
+import { AndcoPresenter } from "../presenter.js";
+import { LocalStorage } from "../storage.js";
 import { andcoPopupPresentationId, isAndcoNativeHost, openAndcoPopupWindow, relayAndcoPopupCallback } from "./popup.js";
 export { AndcoButtonController, } from "./controller.js";
 export { AndcoButtonBridge } from "./frame.js";
@@ -19,42 +19,57 @@ export { andcoPopupPresentationId, isAndcoNativeHost, openAndcoPopup, openAndcoP
  * an authorization may be pushed, and an Intent is created on demand. Resolving first is what got
  * the window blocked.
  */
-export function browserPresenter() {
-    return {
-        async present(options) {
-            if (typeof window === "undefined")
-                return Result.fail(ANDCO_ERROR_CODES.BROWSER_REQUIRED);
-            if (options.kind === "oauth" && options.presentation === "redirect") {
-                const resolved = await PRESENT_TARGET(options.url);
-                if (resolved.error)
-                    return Result.fail(resolved.error);
-                window.location.assign(resolved.data.href);
-                // The document is being replaced. The result arrives on the next load, not here.
-                return Result.ok(null);
-            }
-            if (isAndcoNativeHost() && window.__ANDCO_NATIVE_POPUP_HANDLER__ !== true) {
-                return Result.fail(ANDCO_ERROR_CODES.PRESENTATION_UNSUPPORTED, {
-                    message: "the native Host cannot present a popup without navigating the Miniapp",
-                });
+export class AndcoPresenterBrowser extends AndcoPresenter {
+    /** Windows still open, by Presentation ID, so {@link AndcoPresenterBrowser.focus} can find them. */
+    #open = new Map();
+    focus(presentationId) {
+        console.debug("[AndcoPresenterBrowser.focus] %s open=%s", presentationId, this.#open.has(presentationId));
+        this.#open.get(presentationId)?.focus();
+    }
+    async present(options) {
+        if (typeof window === "undefined")
+            return Result.fail(ANDCO_ERROR_CODES.BROWSER_REQUIRED);
+        if (options.presentation === "redirect") {
+            const resolved = await AndcoPresenter.present(options.url);
+            if (resolved.error) {
+                console.error("[AndcoPresenterBrowser] for options %O got error: %O", options, resolved.error);
+                return Result.fail(resolved.error);
             }
-            const popup = openAndcoPopupWindow({
-                presentationId: options.presentationId,
-                expectedOrigin: options.returnTo.origin,
-                signal: options.signal,
+            console.debug("[AndcoPresenterBrowser] will window location assign: %s", resolved.data.href);
+            window.location.assign(resolved.data.href);
+            // The document is being replaced. The result arrives on the next load, not here.
+            return Result.ok(null);
+        }
+        if (isAndcoNativeHost() && window["__ANDCO_NATIVE_POPUP_HANDLER__"] !== true) {
+            return Result.fail(ANDCO_ERROR_CODES.PRESENTATION_UNSUPPORTED, {
+                message: "the native Host cannot present a popup without navigating the Miniapp",
             });
-            // Abandon before the server work: a blocked window that still started an authorization or
-            // created an Intent would leave a transaction nobody can complete.
-            if (popup.blocked)
-                return Result.fail(ANDCO_ERROR_CODES.POPUP_BLOCKED);
-            const resolved = await PRESENT_TARGET(options.url);
+        }
+        const popup = openAndcoPopupWindow({
+            presentationId: options.presentationId,
+            expectedOrigin: options.returnTo.origin,
+            signal: options.signal,
+            target: options.kind === "intent" && options.presentation === "newtab" ? "newtab" : "popup",
+        });
+        // Abandon before the server work: a blocked window that still started an authorization or
+        // created an Intent would leave a transaction nobody can complete.
+        if (popup.blocked) {
+            return Result.fail(ANDCO_ERROR_CODES.POPUP_BLOCKED);
+        }
+        this.#open.set(options.presentationId, popup);
+        try {
+            const resolved = await AndcoPresenter.present(options.url);
             if (resolved.error) {
                 popup.close();
                 return Result.fail(resolved.error);
             }
             popup.navigate(resolved.data);
-            return popup.result;
-        },
-    };
+            return await popup.result;
+        }
+        finally {
+            this.#open.delete(options.presentationId);
+        }
+    }
 }
 const TRANSACTION_KEY = "andco.transaction";
 /**
@@ -79,8 +94,8 @@ const TRANSACTION_KEY = "andco.transaction";
  * ```
  */
 export function createAndcoInstanceForBrowser(options) {
-    const presenter = options.presenter ?? browserPresenter();
-    const storage = options.storage ?? (typeof window === "undefined" ? undefined : new WebStorage(window.sessionStorage));
+    const presenter = options.presenter ?? new AndcoPresenterBrowser();
+    const storage = options.storage ?? (typeof window === "undefined" ? undefined : new LocalStorage());
     // Annotated because `source` closes over `client`; the closure only runs on the first read.
     const client = new AndcoClient({
         ...options,

package/dist/browser/popup.d.ts

@@ -74,6 +74,8 @@ export type AndcoPopupWindow = {
     navigate(url: URL): void;
     /** Settles with the relayed callback, `null` on dismissal, or an error. */
     readonly result: Promise<Result<URL | null>>;
+    /** Brings the window to the front; a browser may decline when no user activation is current. */
+    focus(): void;
     close(): void;
 };
 /**
@@ -95,6 +97,8 @@ export declare function openAndcoPopupWindow(options: {
     expectedOrigin: string;
     url?: URL;
     signal?: AbortSignal;
+    /** `"newtab"` opens a tab instead of a sized window; the relay back is the same. Default `"popup"`. */
+    target?: "popup" | "newtab";
 }): AndcoPopupWindow;
 /** Opens a popup straight to its destination and waits for the relayed callback. */
 export declare function openAndcoPopup(options: {

package/dist/browser/popup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"popup.d.ts","sourceRoot":"","sources":["../../src/browser/popup.ts"],"names":[],"mappings":"AAOA,OAAO,EAAqB,UAAU,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAMrE,mGAAmG;AACnG,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,CAAC,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,GAC1B;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAE9C,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,uEAAuE;QACvE,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,sFAAsF;QACtF,8BAA8B,CAAC,EAAE,OAAO,CAAC;QACzC,kBAAkB,CAAC,EAAE;YAAE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC7D;CACF;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,IAAI,OAAO,CAM3C;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,IAAI,CAMxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,EACnC,OAAO,GAAE;IACP;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;CACvB,GACL,iBAAiB,CAyCnB;AA6BD,sFAAsF;AACtF,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,gBAAgB,CA+DnB;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACtC,GAAG,EAAE,GAAG,CAAC;IACT,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAE9B"}
+{"version":3,"file":"popup.d.ts","sourceRoot":"","sources":["../../src/browser/popup.ts"],"names":[],"mappings":"AAOA,OAAO,EAAqB,UAAU,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAMrE,mGAAmG;AACnG,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,CAAC,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,GAC1B;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAE9C,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,uEAAuE;QACvE,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,sFAAsF;QACtF,8BAA8B,CAAC,EAAE,OAAO,CAAC;QACzC,kBAAkB,CAAC,EAAE;YAAE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC7D;CACF;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,IAAI,OAAO,CAM3C;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,IAAI,CAMxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,EACnC,OAAO,GAAE;IACP;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;CACvB,GACL,iBAAiB,CAyCnB;AAoCD,sFAAsF;AACtF,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IAC7C,gGAAgG;IAChG,KAAK,IAAI,IAAI,CAAC;IACd,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,uGAAuG;IACvG,MAAM,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC7B,GAAG,gBAAgB,CAsEnB;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACtC,GAAG,EAAE,GAAG,CAAC;IACT,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAE9B"}

package/dist/browser/popup.js

@@ -84,18 +84,22 @@ function protocolResult(presentationId, url) {
     // An Intent reports a lifecycle outcome and nothing else. Whether money moved is read from the
     // Resource Server afterwards, never carried in a window message.
     const intent = url.searchParams.get("andco_intent_result");
-    if (intent === "complete")
+    if (intent === "complete") {
         return { ...envelope, type: "intent.complete" };
-    if (intent)
+    }
+    else if (intent) {
         return { ...envelope, type: "intent.dismiss" };
+    }
     const code = url.searchParams.get("code");
-    if (code)
+    if (code) {
         return { ...envelope, type: "oauth.authorization_code", authorizationCode: code };
+    }
     const error = url.searchParams.get("error") ?? "invalid_request";
     // `access_denied` is the only OAuth error that carries a decision, and it is the one the
     // Authorization Server returns when the user declines.
-    if (error === "access_denied")
+    if (error === "access_denied") {
         return { ...envelope, type: "oauth.dismiss" };
+    }
     const description = url.searchParams.get("error_description");
     return {
         ...envelope,
@@ -118,12 +122,19 @@ function protocolResult(presentationId, url) {
  * ```
  */
 export function openAndcoPopupWindow(options) {
-    const popup = window.open(options.url?.href ?? "about:blank", `${ANDCO_POPUP_NAME_PREFIX}${options.presentationId}`, windowFeatures({ width: 620, height: 720 }));
+    const name = `${ANDCO_POPUP_NAME_PREFIX}${options.presentationId}`;
+    const href = options.url?.href ?? "about:blank";
+    console.debug("[openAndcoPopupWindow] opening %s %s", options.target ?? "popup", name);
+    // Without window features a browser opens a tab; with them, a popup window.
+    const popup = options.target === "newtab"
+        ? window.open(href, name)
+        : window.open(href, name, windowFeatures({ width: 620, height: 720 }));
     if (!popup) {
         return {
             blocked: true,
             navigate: () => { },
             result: Promise.resolve(Result.fail(ANDCO_ERROR_CODES.POPUP_BLOCKED)),
+            focus: () => { },
             close: () => { },
         };
     }
@@ -167,15 +178,20 @@ export function openAndcoPopupWindow(options) {
             popup.close();
             settle(Result.fail(ANDCO_ERROR_CODES.POPUP_TIMEOUT));
         }, POPUP_TIMEOUT_MS);
-        options.signal?.addEventListener("abort", () => {
+        const abort = () => {
             popup.close();
             settle(Result.ok(null));
-        });
+        };
+        if (options.signal?.aborted)
+            abort();
+        else
+            options.signal?.addEventListener("abort", abort, { once: true });
     });
     return {
         blocked: false,
         navigate: (url) => popup.location.assign(url.href),
         result,
+        focus: () => popup.focus(),
         close: () => popup.close(),
     };
 }

package/dist/cli/index.d.ts

@@ -1,6 +1,7 @@
 import { AndcoClient, type AndcoClientOptions } from "../client.js";
 import { Result } from "../errors.js";
-import { type AndcoPresenter, type AndcoPresentOptions } from "../presenter.js";
+import { AndcoPresenter, type AndcoPresentOptions } from "../presenter.js";
+/** Browser launch, terminal output, and callback timeout overrides for CLI authorization. */
 export type AndcoCliPresenterOptions = {
     /** Opens the authorization URL. Defaults to printing it, so nothing is assumed about the host. */
     open?: (url: URL) => void | Promise<void>;
@@ -12,10 +13,6 @@ export type AndcoCliPresenterOptions = {
 /**
  * Presents an authorization from a terminal, using a one-shot loopback receiver.
  *
- * Intents are refused rather than mishandled: a terminal has no surface on which a person can
- * review and confirm a financial operation, and rewriting `redirect_uri` — which is what this
- * presenter does — is meaningless for an Intent.
- *
  * Every command-line integrator needs this exact thing, and until now every one wrote it: bind a
  * loopback port, refuse anything that is not the registered path, check the state, answer once, and
  * shut down. The Andco CLI's own version is ninety lines. Getting any of it wrong — accepting a
@@ -32,11 +29,12 @@ export type AndcoCliPresenterOptions = {
  * const { data: session } = await andco.auth.signIn();
  * ```
  */
-export declare class AndcoCliPresenter implements AndcoPresenter {
+export declare class AndcoPresenterCli extends AndcoPresenter {
     private readonly options;
     constructor(options?: AndcoCliPresenterOptions);
     present(presentation: AndcoPresentOptions): Promise<Result<URL | null>>;
 }
+/** Instance configuration with an optional CLI authorization presenter. */
 export type AndcoCliOptions = Omit<AndcoClientOptions, "presenter"> & {
     presenter?: AndcoPresenter;
 };

package/dist/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAqB,MAAM,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAkB,MAAM,iBAAiB,CAAC;AAGhG,MAAM,MAAM,wBAAwB,GAAG;IACrC,kGAAkG;IAClG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,iBAAkB,YAAW,cAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,wBAA6B;IAE7D,OAAO,CAAC,YAAY,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;CAwC9E;AAED,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG;IACpE,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,eAAe,GAAG,WAAW,CAE/E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAqB,MAAM,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAG3E,6FAA6F;AAC7F,MAAM,MAAM,wBAAwB,GAAG;IACrC,kGAAkG;IAClG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,iBAAkB,SAAQ,cAAc;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,wBAA6B;IAI7D,OAAO,CAAC,YAAY,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;CAqC9E;AAED,2EAA2E;AAC3E,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG;IACpE,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,eAAe,GAAG,WAAW,CAE/E"}

package/dist/cli/index.js

@@ -1,15 +1,11 @@
 import { AndcoClient } from "../client.js";
 import { isLoopback } from "../config.js";
 import { ANDCO_ERROR_CODES, Result } from "../errors.js";
-import { PRESENT_TARGET } from "../presenter.js";
+import { AndcoPresenter } from "../presenter.js";
 import { LoopbackServer } from "./server.js";
 /**
  * Presents an authorization from a terminal, using a one-shot loopback receiver.
  *
- * Intents are refused rather than mishandled: a terminal has no surface on which a person can
- * review and confirm a financial operation, and rewriting `redirect_uri` — which is what this
- * presenter does — is meaningless for an Intent.
- *
  * Every command-line integrator needs this exact thing, and until now every one wrote it: bind a
  * loopback port, refuse anything that is not the registered path, check the state, answer once, and
  * shut down. The Andco CLI's own version is ninety lines. Getting any of it wrong — accepting a
@@ -26,17 +22,13 @@ import { LoopbackServer } from "./server.js";
  * const { data: session } = await andco.auth.signIn();
  * ```
  */
-export class AndcoCliPresenter {
+export class AndcoPresenterCli extends AndcoPresenter {
     options;
     constructor(options = {}) {
+        super();
         this.options = options;
     }
     async present(presentation) {
-        if (presentation.kind === "intent") {
-            return Result.fail(ANDCO_ERROR_CODES.PRESENTATION_UNSUPPORTED, {
-                message: "a terminal cannot present an Intent for review and confirmation",
-            });
-        }
         const configured = presentation.returnTo;
         if (configured.protocol !== "http:" || !isLoopback(configured)) {
             return Result.fail(ANDCO_ERROR_CODES.INVALID_CONFIGURATION, {
@@ -54,7 +46,9 @@ export class AndcoCliPresenter {
             });
         }
         try {
-            const resolved = await PRESENT_TARGET(presentation.url);
+            // Resolved after the receiver is bound: a pushed request is created on demand, and there is
+            // nothing to push before the callback it must name exists.
+            const resolved = await AndcoPresenter.present(presentation.url);
             if (resolved.error)
                 return Result.fail(resolved.error);
             // The bound port may differ from the configured one when it asked for any free port, and the
@@ -81,5 +75,5 @@ export class AndcoCliPresenter {
  * credential is `andco.session.set(...)`, not a write into a private storage key.
  */
 export function createAndcoInstanceForCLI(options) {
-    return new AndcoClient({ ...options, presenter: options.presenter ?? new AndcoCliPresenter() });
+    return new AndcoClient({ ...options, presenter: options.presenter ?? new AndcoPresenterCli() });
 }

package/dist/cli/server.d.ts

@@ -1,9 +1,14 @@
+/** Local OAuth callback receiver. The caller owns state/PKCE validation and server cleanup. */
 export declare class LoopbackServer {
     #private;
     private constructor();
+    /** Starts listening; a missing port selects an available port reflected in `redirectUri`. */
     static start(configured: URL): Promise<LoopbackServer>;
+    /** Exact callback URL including the port allocated by the operating system. */
     get redirectUri(): URL;
+    /** Waits for a callback or returns `null` on timeout. Call `close()` after either outcome. */
     wait(timeoutMs: number): Promise<URL | null>;
+    /** Closes the listener and any remaining connections. */
     close(): Promise<void>;
     private listen;
     private static hostFor;

package/dist/cli/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/cli/server.ts"],"names":[],"mappings":"AAEA,qBAAa,cAAc;;IAKzB,OAAO;WAKM,KAAK,CAAC,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;IAc5D,IAAI,WAAW,IAAI,GAAG,CAErB;IAED,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAS5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiDtB,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,MAAM,CAAC,OAAO;CAGvB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/cli/server.ts"],"names":[],"mappings":"AAEA,+FAA+F;AAC/F,qBAAa,cAAc;;IAKzB,OAAO;IAKP,6FAA6F;WAChF,KAAK,CAAC,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;IAc5D,+EAA+E;IAC/E,IAAI,WAAW,IAAI,GAAG,CAErB;IAED,8FAA8F;IAC9F,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAS5C,yDAAyD;IACzD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiDtB,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,MAAM,CAAC,OAAO;CAGvB"}