@andco/sdk 0.0.3 → 0.0.4

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,6DAA6D;IAC7D,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C;;;;;;OAMG;IACH,SAAgB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;gBAGrE,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAO;IASnH,uEAAuE;WACzD,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,UAAU;IAMpE,0CAA0C;WAC5B,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU;CAGtD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,aAAc,SAAQ,UAAU;IAC3C,sGAAsG;IACtG,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,0FAA0F;IAC1F,SAAgB,QAAQ,EAAE,QAAQ,CAAC;gBAGjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;QACP,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC7C;IAQH;;;;;;;;;;;;;;;;OAgBG;WACW,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,aAAa;IAiBnF;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAU/B;IAEH,oGAAoG;IACpG,OAAO,CAAC,MAAM,CAAC,MAAM;IAUrB,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,MAAM;IAerB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;CAMxB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAErF;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM;IACjB,4CAA4C;OACzC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAIzB,iFAAiF;SAC5E,CAAC,iBACG,UAAU,GAAG,MAAM,YACjB;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,MAAM,CAAC,CAAC,CAAC;CAGb,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;CAiBpB,CAAC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACzE;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,6DAA6D;IAC7D,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C;;;;;;OAMG;IACH,SAAgB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;gBAGrE,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAO;IASnH,uEAAuE;WACzD,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,GAAG,UAAU;IAM1E,0CAA0C;WAC5B,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU;CAGtD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,aAAc,SAAQ,UAAU;IAC3C,sGAAsG;IACtG,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,0FAA0F;IAC1F,SAAgB,QAAQ,EAAE,QAAQ,CAAC;gBAGjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;QACP,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC7C;IAQH;;;;;;;;;;;;;;;;OAgBG;WACW,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,aAAa;IA0BnF;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAU/B;IAEH,oGAAoG;IACpG,OAAO,CAAC,MAAM,CAAC,MAAM;IAUrB,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,MAAM;IAerB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;CAMxB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAErF;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM;IACjB,4CAA4C;OACzC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAIzB,iFAAiF;SAC5E,CAAC,iBACG,UAAU,GAAG,YAAY,YACvB;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,MAAM,CAAC,CAAC,CAAC;CAGb,CAAC;AAEF;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,YAAY,GAAG,cAAc,CAAC"}

package/dist/errors.js

@@ -1,3 +1,4 @@
+import { ANDCO_ERROR_CODES } from "@andco/protocol";
 /**
  * The single error type every Andco operation reports.
  *
@@ -93,6 +94,15 @@ export class AndcoAPIError extends AndcoError {
      * ```
      */
     static fromOpenAPIFetch(payload, response) {
+        if (payload instanceof AndcoError) {
+            return new AndcoAPIError(payload.code, {
+                response,
+                status: payload.status,
+                message: payload.message,
+                details: payload.details,
+                cause: payload,
+            });
+        }
         const { message, details } = AndcoAPIError.bodyOf(payload);
         const error = new AndcoAPIError(AndcoAPIError.codeOf(payload), {
             response,
@@ -132,7 +142,7 @@ export class AndcoAPIError extends AndcoError {
                 return error;
             }
         }
-        return "request_failed";
+        return ANDCO_ERROR_CODES.REQUEST_FAILED;
     }
     /** Keeps the rest of the error body, and promotes `message` so it reaches `error.message`. */
     static bodyOf(payload) {
@@ -176,22 +186,10 @@ export const Result = {
         return { data: null, error: typeof error === "string" ? new AndcoError(error, options) : error };
     },
 };
-/** Error codes the SDK itself raises, as opposed to those relayed from the Authorization Server. */
-export const ANDCO_ERROR_CODES = {
-    BROWSER_REQUIRED: "browser_required",
-    BROWSER_UNAVAILABLE: "browser_unavailable",
-    BROWSER_FORBIDDEN: "browser_forbidden",
-    INVALID_CALLBACK: "invalid_callback",
-    INVALID_CONFIGURATION: "invalid_configuration",
-    HANDSHAKE_TIMEOUT: "handshake_timeout",
-    INVALID_IFRAME: "invalid_iframe",
-    INVALID_INTENT_ID: "invalid_intent_id",
-    INVALID_RESPONSE: "invalid_response",
-    POPUP_BLOCKED: "popup_blocked",
-    POPUP_TIMEOUT: "popup_timeout",
-    PRESENTATION_UNSUPPORTED: "presentation_unsupported",
-    SAME_ORIGIN_ENDPOINT: "same_origin_endpoint",
-    SESSION_MISSING: "session_missing",
-    STORAGE_FAILED: "storage_failed",
-    UNTRUSTED_ORIGIN: "untrusted_origin",
-};
+/**
+ * Re-exported so `@andco/sdk` consumers reach the one vocabulary without importing `@andco/protocol`
+ * directly. It used to be a second catalogue declared here, with the same public name as the one in
+ * protocol and different values for the eight conditions both named -- a comparison against the
+ * wrong import never matched, and nothing said which was which.
+ */
+export { ANDCO_ERROR_CODES } from "@andco/protocol";

package/dist/globals.d.ts

@@ -0,0 +1,25 @@
+import type { AndCoRandomSource } from "@andco/protocol";
+/**
+ * Platform capabilities the SDK reads off the runtime, grouped so a future addition is not a
+ * breaking change.
+ *
+ * Every collaborator takes the whole group rather than the one capability it happens to use today,
+ * which is what makes that promise real: adding a capability here reaches `rest`, `oauth`, `auth`,
+ * and `intents` without touching a single constructor signature.
+ */
+export type AndcoGlobals = {
+    fetch: typeof globalThis.fetch;
+    /** Threaded into the Protocol Contract's `RANDOM_UUID`, so a runtime without Web Crypto can supply its own. */
+    crypto: AndCoRandomSource;
+};
+/**
+ * Fills a partial runtime out with the platform's own, so a collaborator always receives a resolved
+ * group and never has to know what the default for a missing capability is.
+ *
+ * @example
+ * ```ts
+ * const rest = new AndcoRest({ config, credentials, globals: resolveGlobals({ fetch: tracedFetch }) });
+ * ```
+ */
+export declare function resolveGlobals(globals?: Partial<AndcoGlobals>): AndcoGlobals;
+//# sourceMappingURL=globals.d.ts.map

package/dist/globals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"globals.d.ts","sourceRoot":"","sources":["../src/globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/B,+GAA+G;IAC/G,MAAM,EAAE,iBAAiB,CAAC;CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,OAAO,CAAC,YAAY,CAAM,GAAG,YAAY,CAKhF"}

package/dist/globals.js

@@ -0,0 +1,15 @@
+/**
+ * Fills a partial runtime out with the platform's own, so a collaborator always receives a resolved
+ * group and never has to know what the default for a missing capability is.
+ *
+ * @example
+ * ```ts
+ * const rest = new AndcoRest({ config, credentials, globals: resolveGlobals({ fetch: tracedFetch }) });
+ * ```
+ */
+export function resolveGlobals(globals = {}) {
+    return {
+        fetch: globals.fetch ?? globalThis.fetch.bind(globalThis),
+        crypto: globals.crypto ?? globalThis.crypto,
+    };
+}

package/dist/grants-api.d.ts

@@ -0,0 +1,34 @@
+import type { AndCoRestPaths } from "@andco/protocol/transport";
+import type { AndcoConfig } from "./config.js";
+import { Result } from "./errors.js";
+import type { AndcoGlobals } from "./globals.js";
+/** The live Grant a bearer token carries, as `GET /authorization` reports it. */
+export type AndcoGrantAuthorization = AndCoRestPaths["/authorization"]["get"]["responses"][200]["content"]["application/json"];
+/**
+ * Looks up the live Grant behind a token.
+ *
+ * A token proves who signed it; only the Authorization Server knows whether the Grant is still
+ * active and which RAR details were consented. This is what a Resource Server calls when scopes in
+ * the token are not enough.
+ *
+ * @example
+ * ```ts
+ * const { data: grant, error } = await andco.grants.get(accessToken);
+ * const orders = grant?.authorizationDetails.find((detail) => detail.type === "orders");
+ * ```
+ */
+export declare class AndcoGrants {
+    #private;
+    constructor(options: {
+        config: AndcoConfig;
+        globals: AndcoGlobals;
+    });
+    /**
+     * Fetches the Grant carried by a bearer token with `GET /authorization`.
+     *
+     * Only the token overload exists: the API has no endpoint that reads a Grant by id, so a Grant id
+     * fails with `not_implemented` instead of guessing one.
+     */
+    get(token: string): Promise<Result<AndcoGrantAuthorization>>;
+}
+//# sourceMappingURL=grants-api.d.ts.map

package/dist/grants-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-api.d.ts","sourceRoot":"","sources":["../src/grants-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAc,MAAM,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,iFAAiF;AACjF,MAAM,MAAM,uBAAuB,GACjC,cAAc,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAI3F;;;;;;;;;;;;GAYG;AACH,qBAAa,WAAW;;gBAIH,OAAO,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,YAAY,CAAA;KAAE;IAK1E;;;;;OAKG;IACU,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;CAoB1E"}

package/dist/grants-api.js

@@ -0,0 +1,48 @@
+import { AndcoError, Result } from "./errors.js";
+import { AndcoRest } from "./rest.js";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+/**
+ * Looks up the live Grant behind a token.
+ *
+ * A token proves who signed it; only the Authorization Server knows whether the Grant is still
+ * active and which RAR details were consented. This is what a Resource Server calls when scopes in
+ * the token are not enough.
+ *
+ * @example
+ * ```ts
+ * const { data: grant, error } = await andco.grants.get(accessToken);
+ * const orders = grant?.authorizationDetails.find((detail) => detail.type === "orders");
+ * ```
+ */
+export class AndcoGrants {
+    #config;
+    #globals;
+    constructor(options) {
+        this.#config = options.config;
+        this.#globals = options.globals;
+    }
+    /**
+     * Fetches the Grant carried by a bearer token with `GET /authorization`.
+     *
+     * Only the token overload exists: the API has no endpoint that reads a Grant by id, so a Grant id
+     * fails with `not_implemented` instead of guessing one.
+     */
+    async get(token) {
+        if (UUID.test(token)) {
+            console.debug("[grants.get] a grant id was given, but no endpoint reads a Grant by id");
+            return Result.fail(new AndcoError("not_implemented", { message: "Grants can only be read with the token that carries them" }));
+        }
+        const rest = new AndcoRest({
+            config: this.#config,
+            globals: this.#globals,
+            credentials: { accessTokenFor: async () => token },
+        });
+        const { data, error } = await rest.http.GET("/authorization");
+        if (error || !data) {
+            console.debug("[grants.get] lookup failed status=%s code=%s", error?.status, error?.code);
+            return Result.fail(error ?? new AndcoError("invalid_response"));
+        }
+        console.debug("[grants.get] grant %s active=%s", data.grantId, data.active);
+        return Result.ok(data);
+    }
+}

package/dist/grants.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Metadata of a Grant an Organization approved for a Service; never a bearer credential or proof
+ * of live consent. `service.listGrants()` returns these.
+ */
+export type Grant = import("@andco/protocol").ServiceGrant;
+/** A Grant or its id, for the explicit `grant` override. */
+export type GrantReference = string | Grant;
+/**
+ * Reads the id of a Grant reference, refusing anything that is not a UUID.
+ *
+ * @example
+ * grantId("0190f3a2-6f1c-7c4e-9a51-3b2d1e0f4a5b"); // the same string
+ * grantId(grant); // grant.id
+ */
+export declare function grantId(grant: GrantReference): string;
+//# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,KAAK,GAAG,OAAO,iBAAiB,EAAE,YAAY,CAAC;AAC3D,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,CAAC;AAE5C;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAKrD"}

package/dist/grants.js

@@ -0,0 +1,13 @@
+/**
+ * Reads the id of a Grant reference, refusing anything that is not a UUID.
+ *
+ * @example
+ * grantId("0190f3a2-6f1c-7c4e-9a51-3b2d1e0f4a5b"); // the same string
+ * grantId(grant); // grant.id
+ */
+export function grantId(grant) {
+    const id = typeof grant === "string" ? grant : grant.id;
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id))
+        throw new TypeError("Grant ID must be a UUID");
+    return id;
+}

package/dist/index.d.ts

@@ -1,13 +1,19 @@
 export { RANDOM_UUID } from "@andco/protocol";
 export { AndcoAuth, type AndcoAuthOptions, type AndcoSignInOptions } from "./auth.js";
-export { AndcoClient, type AndcoClientAuthed, type AndcoClientOptions, type AndcoGlobals, type AndcoResourceServer, } from "./client.js";
+export { AndcoClient, type AndcoClientAuthed, type AndcoClientOptions, type AndcoResourceServer } from "./client.js";
 export { AndcoConfig, type AndcoConfigInput, type AndcoScope, type AndcoTheme, isLoopback, } from "./config.js";
-export { ANDCO_REFRESH_SKEW_SECONDS, type AndcoCredentials, type AndcoSession, type AndcoUser, credentialsFromSession, isCredentials, isExpired, sessionIdentityKey, tokenFor, } from "./credentials.js";
+export { ANDCO_REFRESH_SKEW_SECONDS, type AndcoCredentialRequest, type AndcoCredentials, type AndcoSession, type AndcoUser, credentialsFromSession, isCredentials, isExpired, sessionIdentityKey, tokenFor, } from "./credentials.js";
 export { ANDCO_ERROR_CODES, AndcoAPIError, AndcoError, Result } from "./errors.js";
-export { type AndcoEventPage, type AndcoEventSubscriptionOptions, type AndcoFinancialEvent, type AndcoIntent, type AndcoIntentCreateOptions, type AndcoIntentId, type AndcoIntentPresentOptions, AndcoIntents, type AndcoIntentsOptions, type AndcoPresentationResult, } from "./intents.js";
+export { type AndcoGlobals, resolveGlobals } from "./globals.js";
+export type { Grant, GrantReference } from "./grants.js";
+export { type AndcoGrantAuthorization, AndcoGrants } from "./grants-api.js";
+export { type AndcoInflight, MemoryInflight } from "./inflight.js";
+export { type AndcoEventPage, type AndcoEventSubscriptionOptions, type AndcoFinancialEvent, type AndcoIntent, type AndcoIntentApproveOptions, type AndcoIntentCancelOptions, type AndcoIntentCreateOptions, type AndcoIntentId, type AndcoIntentPresentationController, type AndcoIntentPresentationStatus, type AndcoIntentPresentOptions, type AndcoIntentPresentSource, type AndcoIntentReference, type AndcoIntentRejectOptions, type AndcoIntentSubscribeOptions, AndcoIntents, type AndcoIntentsOptions, type AndcoIntentURLOptions, type AndcoIntentWatch, type AndcoIntentWatchOptions, type AndcoIntentWatchStatus, type AndcoPresentationResult, type AndcoPresentationStorage, } from "./intents.js";
 export { type AndcoAuthorizationDetail, type AndcoAuthorizationOptions, type AndcoAuthorizationRequest, type AndcoDeviceAuthorization, AndcoOAuth, type AndcoOAuthOptions, type AndcoResourceAuthorization, type AndcoTransportMode, } from "./oauth.js";
-export { type AndcoPresentation, type AndcoPresenter, type AndcoPresentIntent, type AndcoPresentOAuth, type AndcoPresentOptions, type AndcoPresentTarget, PRESENT_TARGET, } from "./presenter.js";
-export { type AndcoHttpClient, type AndcoPageOptions, type AndcoRequestOptions, AndcoRest, type AndcoRestOptions, } from "./rest.js";
+export { type AndcoIntentPresentation, type AndcoPresentation, AndcoPresenter, type AndcoPresentIntent, type AndcoPresentOAuth, type AndcoPresentOptions, type AndcoPresentTarget, } from "./presenter.js";
+export { type AndcoDetailRequirement, type AndcoProtection, type AndcoProtectOptions, type AndcoProtectOutcome, AndcoResource, } from "./resource.js";
+export { type AndcoGrantOptions, type AndcoHttpClient, type AndcoPageOptions, type AndcoRequestOptions, AndcoRest, type AndcoRestOptions, } from "./rest.js";
 export { type AndcoSessionSource, AndcoSessionStore, type AndcoSessionStoreOptions } from "./session-store.js";
-export { type AndcoLock, type AndcoStorage, InProcessLock, MemoryStorage, WebStorage, } from "./storage.js";
+export { type AndcoStorage, LocalStorage, MemoryStorage, SessionStorage, } from "./storage.js";
+export { type AndcoTokenClaims, AndcoTokens, type AndcoTokenVerifyOptions, } from "./tokens.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EACL,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,sBAAsB,EACtB,aAAa,EACb,SAAS,EACT,kBAAkB,EAClB,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,GACxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,SAAS,EACT,KAAK,gBAAgB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC/G,OAAO,EACL,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,aAAa,EACb,aAAa,EACb,UAAU,GACX,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACrH,OAAO,EACL,WAAW,EACX,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,sBAAsB,EACtB,aAAa,EACb,SAAS,EACT,kBAAkB,EAClB,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,KAAK,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACjE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,KAAK,uBAAuB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,KAAK,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,KAAK,iCAAiC,EACtC,KAAK,6BAA6B,EAClC,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,GACxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,SAAS,EACT,KAAK,gBAAgB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC/G,OAAO,EACL,KAAK,YAAY,EACjB,YAAY,EACZ,aAAa,EACb,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,gBAAgB,EACrB,WAAW,EACX,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,12 +1,17 @@
 export { RANDOM_UUID } from "@andco/protocol";
 export { AndcoAuth } from "./auth.js";
-export { AndcoClient, } from "./client.js";
+export { AndcoClient } from "./client.js";
 export { AndcoConfig, isLoopback, } from "./config.js";
 export { ANDCO_REFRESH_SKEW_SECONDS, credentialsFromSession, isCredentials, isExpired, sessionIdentityKey, tokenFor, } from "./credentials.js";
 export { ANDCO_ERROR_CODES, AndcoAPIError, AndcoError, Result } from "./errors.js";
+export { resolveGlobals } from "./globals.js";
+export { AndcoGrants } from "./grants-api.js";
+export { MemoryInflight } from "./inflight.js";
 export { AndcoIntents, } from "./intents.js";
 export { AndcoOAuth, } from "./oauth.js";
-export { PRESENT_TARGET, } from "./presenter.js";
+export { AndcoPresenter, } from "./presenter.js";
+export { AndcoResource, } from "./resource.js";
 export { AndcoRest, } from "./rest.js";
 export { AndcoSessionStore } from "./session-store.js";
-export { InProcessLock, MemoryStorage, WebStorage, } from "./storage.js";
+export { LocalStorage, MemoryStorage, SessionStorage, } from "./storage.js";
+export { AndcoTokens, } from "./tokens.js";

package/dist/inflight.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shares one running operation among every caller that asks for the same key.
+ *
+ * The first caller for a key starts the operation; callers arriving while it runs receive the same
+ * promise instead of starting another. Whatever the operation settles with, resolution or
+ * rejection, reaches every waiter, and the key is cleared so the next call starts fresh.
+ *
+ * Unlike a lock this never queues: N concurrent refreshes cost one token request, not N in a row.
+ * The default shares within one runtime only. Supply your own to share across processes, for
+ * example by claiming the key in a store that every instance reads.
+ *
+ * @example
+ * ```ts
+ * const inflight: AndcoInflight = {
+ *   run: (key, operation) => coordinator.singleFlight(`andco:${key}`, operation),
+ * };
+ * ```
+ */
+export interface AndcoInflight {
+    run<T>(key: string, operation: () => Promise<T>): Promise<T>;
+}
+/**
+ * Shares in-flight operations within one runtime, as DataLoader's promise cache does: the promise
+ * is stored on start and deleted on settle, so nothing is cached beyond the operation's lifetime.
+ * The default.
+ */
+export declare class MemoryInflight implements AndcoInflight {
+    #private;
+    run<T>(key: string, operation: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=inflight.d.ts.map

package/dist/inflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inflight.d.ts","sourceRoot":"","sources":["../src/inflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED;;;;GAIG;AACH,qBAAa,cAAe,YAAW,aAAa;;IAG3C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAqBpE"}

package/dist/inflight.js

@@ -0,0 +1,26 @@
+/**
+ * Shares in-flight operations within one runtime, as DataLoader's promise cache does: the promise
+ * is stored on start and deleted on settle, so nothing is cached beyond the operation's lifetime.
+ * The default.
+ */
+export class MemoryInflight {
+    #running = new Map();
+    run(key, operation) {
+        const shared = this.#running.get(key);
+        if (shared) {
+            console.debug("[AndcoInflight] sharing the running operation for %s", key);
+            return shared;
+        }
+        console.debug("[AndcoInflight] starting %s", key);
+        // Wrapped so a synchronous throw becomes a rejection that is also cleared on settle.
+        const started = (async () => operation())();
+        this.#running.set(key, started);
+        const settle = (outcome) => {
+            if (this.#running.get(key) === started)
+                this.#running.delete(key);
+            console.debug("[AndcoInflight] %s %s", outcome, key);
+        };
+        started.then(() => settle("settled"), () => settle("failed"));
+        return started;
+    }
+}