@de./sdk 2.1.0 → 2.1.1

package/dist/allend/OTPAuth/index.d.ts

@@ -1,13 +1,17 @@
+import type { SigninBody, CreateAccountBody } from '@de./types';
 import type { AccessOptions, UserSession } from '../../types/access';
 import AccessManager from '../Access';
 import { type Res } from '../../utils';
-export type SigninBody = {
-    phone: string;
-    /** Device fingerprint — an object or its JSON string. */
-    device: string | Record<string, any>;
-    /** ISO 3166-1 alpha-2. */
-    country?: string;
-};
+/**
+ * Request bodies come from `@de./types`, which is what de.auth validates
+ * against — these were hand-declared here, and said `country?: string` where
+ * de.auth wants the Country OBJECT. Its schema is additionalProperties:false,
+ * so a caller trusting the SDK's type was answered `body/country must be
+ * object`. Nothing caught it because this client could not be constructed at
+ * all: AccessManager demanded a workspace context and a bearer token, which
+ * sign-in is what produces.
+ */
+export type { SigninBody, CreateAccountBody, VerificationBody, Country } from '@de./types';
 export type SigninResult = {
     /** What the caller must do next — verification, or account creation first. */
     next: string;
@@ -19,16 +23,6 @@ export type SigninResult = {
      */
     testVCode?: number;
 };
-export type CreateAccountBody = {
-    phone: string;
-    agreeTerms: boolean | string;
-    firstName?: string;
-    lastName?: string;
-    photo?: string;
-    type?: string;
-    country?: string;
-    newsletters?: boolean | string;
-};
 export type VerifyResult = {
     ctoken?: string;
     deviceId?: string;
@@ -51,7 +45,7 @@ export default class OTPAuth extends AccessManager {
     resendSms(body: {
         phone: string;
     }): Promise<Res<void>>;
-    /** GET, with the scope in the querystring — not a POST. */
+    /** A state change, so a POST — it was a GET, which is cacheable. */
     signout(querystring?: {
         allDevices?: boolean | string;
     }): Promise<Res<void>>;

package/dist/allend/OTPAuth/index.js

@@ -7,29 +7,39 @@ const Access_1 = __importDefault(require("../Access"));
 const utils_1 = require("../../utils");
 class OTPAuth extends Access_1.default {
     constructor(access) {
-        super(access, 'ASI');
+        /**
+         * de.auth admits an agent that does not start with `De.service` only if
+         * the request carries an Authorization header — and the whole point of
+         * this client is the flow that has no token yet. The SDK's default
+         * platform is `proxy`, so every sign-in through it was answered 412
+         * before reaching a handler.
+         *
+         * `service` is the platform this client is for; a caller that knows
+         * better can still say so.
+         */
+        super({ ...access, platform: access.platform || 'service' }, 'ASI');
     }
     // ── Sign-in ───────────────────────────────────────────────────────────────
     /** Step 1 — sends the code. */
     async signin(body) {
         if (!body.phone)
             throw new Error('<phone> argument required');
-        return this.request({ url: '/signin', method: 'POST', body });
+        return this.request({ url: '/auth/otp/send', method: 'POST', body });
     }
     /** Step 2 — exchanges the code for a session. */
     async verify(body) {
-        return this.request({ url: '/verification', method: 'POST', body });
+        return this.request({ url: '/auth/otp/verify', method: 'POST', body });
     }
     /** Step 1a — for a phone de.auth has never seen. */
     async setAccount(body) {
-        return this.request({ url: '/set-account', method: 'POST', body });
+        return this.request({ url: '/auth/account/create', method: 'POST', body });
     }
     async resendSms(body) {
-        return this.request({ url: '/resend/sms', method: 'POST', body });
+        return this.request({ url: '/auth/otp/resend', method: 'POST', body });
     }
-    /** GET, with the scope in the querystring — not a POST. */
+    /** A state change, so a POST — it was a GET, which is cacheable. */
     async signout(querystring) {
-        return this.request({ url: `/signout${(0, utils_1.qs)(querystring)}`, method: 'GET' });
+        return this.request({ url: `/auth/session/revoke${(0, utils_1.qs)(querystring)}`, method: 'POST' });
     }
     // ── The signed-in person ──────────────────────────────────────────────────
     /**

package/dist/allend/OTPAuth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/allend/OTPAuth/index.ts"],"names":[],"mappings":";;;;;AACA,uDAAqC;AACrC,uCAA0C;AAuD1C,MAAqB,OAAQ,SAAQ,gBAAa;IACjD,YAAa,MAAqB;QACjC,KAAK,CAAE,MAAM,EAAE,KAAK,CAAE,CAAA;IACvB,CAAC;IAED,6EAA6E;IAE7E,+BAA+B;IAC/B,KAAK,CAAC,MAAM,CAAE,IAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,KAAK;YAAG,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAE9D,OAAO,IAAI,CAAC,OAAO,CAAoB,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACjF,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,MAAM,CAAE,IAAwD;QACrE,OAAO,IAAI,CAAC,OAAO,CAAoB,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,UAAU,CAAE,IAAuB;QACxC,OAAO,IAAI,CAAC,OAAO,CAAwB,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,KAAK,CAAC,SAAS,CAAE,IAAuB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAY,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,OAAO,CAAE,WAA+C;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAY,EAAE,GAAG,EAAE,WAAW,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,6EAA6E;IAE7E;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAE,OAAoB,EAAE,KAAK,GAAG,iCAAiC;QAC5E,OAAO,IAAI,CAAC,OAAO,CAAuB;YACzC,GAAG,EAAE,eAAe,IAAA,UAAE,EAAC,EAAE,KAAK,EAAE,CAAC,EAAE;YACnC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACR,eAAe,EAAG,OAAO,CAAC,KAAK;gBAC/B,gBAAgB,EAAE,OAAO,CAAC,MAAM;aAChC;SACD,CAAC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAE,WAA+B;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAqB,EAAE,GAAG,EAAE,QAAQ,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,CAAC,MAAM,CAAE,WAAgC;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAW,EAAE,GAAG,EAAE,eAAe,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,KAAK,CAAC,aAAa,CAAE,IAAyB;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAW,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,KAAK,CAAC,cAAc,CAAE,IAAyB;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAW,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,KAAK,CAAC,MAAM,CAAE,IAAyB;QACtC,OAAO,IAAI,CAAC,OAAO,CAAY,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACzE,CAAC;CACD;AAxED,0BAwEC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/allend/OTPAuth/index.ts"],"names":[],"mappings":";;;;;AAEA,uDAAqC;AACrC,uCAA0C;AAoD1C,MAAqB,OAAQ,SAAQ,gBAAa;IACjD,YAAa,MAAqB;QACjC;;;;;;;;;WASG;QACH,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,EAAE,KAAK,CAAE,CAAA;IACrE,CAAC;IAED,6EAA6E;IAE7E,+BAA+B;IAC/B,KAAK,CAAC,MAAM,CAAE,IAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,KAAK;YAAG,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAE9D,OAAO,IAAI,CAAC,OAAO,CAAoB,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACxF,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,MAAM,CAAE,IAAwD;QACrE,OAAO,IAAI,CAAC,OAAO,CAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,UAAU,CAAE,IAAuB;QACxC,OAAO,IAAI,CAAC,OAAO,CAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAClG,CAAC;IAED,KAAK,CAAC,SAAS,CAAE,IAAuB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAY,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,OAAO,CAAE,WAA+C;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAY,EAAE,GAAG,EAAE,uBAAuB,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACpG,CAAC;IAED,6EAA6E;IAE7E;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAE,OAAoB,EAAE,KAAK,GAAG,iCAAiC;QAC5E,OAAO,IAAI,CAAC,OAAO,CAAuB;YACzC,GAAG,EAAE,eAAe,IAAA,UAAE,EAAC,EAAE,KAAK,EAAE,CAAC,EAAE;YACnC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACR,eAAe,EAAG,OAAO,CAAC,KAAK;gBAC/B,gBAAgB,EAAE,OAAO,CAAC,MAAM;aAChC;SACD,CAAC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAE,WAA+B;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAqB,EAAE,GAAG,EAAE,QAAQ,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,CAAC,MAAM,CAAE,WAAgC;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAW,EAAE,GAAG,EAAE,eAAe,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,KAAK,CAAC,aAAa,CAAE,IAAyB;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAW,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,KAAK,CAAC,cAAc,CAAE,IAAyB;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAW,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,KAAK,CAAC,MAAM,CAAE,IAAyB;QACtC,OAAO,IAAI,CAAC,OAAO,CAAY,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACzE,CAAC;CACD;AAlFD,0BAkFC"}

package/dist/utils/index.d.ts

@@ -23,6 +23,20 @@ export type Res<T = any> = {
  * property fails that test outright.
  */
 export type Data<T> = 'data' extends keyof T ? T['data'] : undefined;
+/**
+ * Serialize a querystring for a De. route.
+ *
+ * Array values are appended as repeated keys — `state=A&state=B` — which is
+ * what Fastify's query parser turns back into an array. `String( value )` on
+ * an array produces `A,B`, a single comma-joined string, and the route answers
+ * `querystring/state must be array`: the schema is right, the request never
+ * matched it. Every array parameter the SDK sent was malformed this way, the
+ * same shape of fault as the coordinates object that once serialized to
+ * `[object Object]`.
+ *
+ * @param params - Query parameters; null and undefined values are dropped
+ * @return - `?a=1&b=2`, or an empty string when there is nothing to send
+ */
 export declare const qs: (params?: Record<string, any>) => string;
 declare const _default: {
     Stream: typeof Stream;

package/dist/utils/index.js

@@ -5,13 +5,33 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.qs = void 0;
 const stream_1 = __importDefault(require("./stream"));
+/**
+ * Serialize a querystring for a De. route.
+ *
+ * Array values are appended as repeated keys — `state=A&state=B` — which is
+ * what Fastify's query parser turns back into an array. `String( value )` on
+ * an array produces `A,B`, a single comma-joined string, and the route answers
+ * `querystring/state must be array`: the schema is right, the request never
+ * matched it. Every array parameter the SDK sent was malformed this way, the
+ * same shape of fault as the coordinates object that once serialized to
+ * `[object Object]`.
+ *
+ * @param params - Query parameters; null and undefined values are dropped
+ * @return - `?a=1&b=2`, or an empty string when there is nothing to send
+ */
 const qs = (params) => {
     if (!params)
         return '';
-    const q = new URLSearchParams(Object.fromEntries(Object.entries(params)
-        .filter(([, v]) => v != null)
-        .map(([k, v]) => [k, String(v)]))).toString();
-    return q ? `?${q}` : '';
+    const q = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)) {
+        if (value === null || value === undefined)
+            continue;
+        Array.isArray(value)
+            ? value.forEach(each => each !== null && each !== undefined && q.append(key, String(each)))
+            : q.append(key, String(value));
+    }
+    const query = q.toString();
+    return query ? `?${query}` : '';
 };
 exports.qs = qs;
 exports.default = { Stream: stream_1.default };

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;AACA,sDAA6B;AAsBtB,MAAM,EAAE,GAAG,CAAE,MAA4B,EAAW,EAAE;IAC3D,IAAI,CAAC,MAAM;QAAG,OAAO,EAAE,CAAA;IACvB,MAAM,CAAC,GAAG,IAAI,eAAe,CAC3B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAE,MAAM,CAAE;SACjB,MAAM,CAAE,CAAE,CAAC,EAAE,CAAC,CAAC,EAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAE;SAChC,GAAG,CAAE,CAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAE,CAAC,CAAE,CAAC,CAAE,CAC7C,CACF,CAAC,QAAQ,EAAE,CAAA;IACZ,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACzB,CAAC,CAAA;AAVY,QAAA,EAAE,MAUd;AAED,kBAAe,EAAE,MAAM,EAAN,gBAAM,EAAE,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;AACA,sDAA6B;AAsB7B;;;;;;;;;;;;;GAaG;AACI,MAAM,EAAE,GAAG,CAAE,MAA4B,EAAW,EAAE;IAC3D,IAAI,CAAC,MAAM;QAAG,OAAO,EAAE,CAAA;IAEvB,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAA;IAE/B,KAAK,MAAM,CAAE,GAAG,EAAE,KAAK,CAAE,IAAI,MAAM,CAAC,OAAO,CAAE,MAAM,CAAE,EAAE,CAAC;QACtD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAG,SAAQ;QAEpD,KAAK,CAAC,OAAO,CAAE,KAAK,CAAE;YACpB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAE,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAE,GAAG,EAAE,MAAM,CAAE,IAAI,CAAE,CAAE,CAAE;YACjG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAE,GAAG,EAAE,MAAM,CAAE,KAAK,CAAE,CAAE,CAAA;IACtC,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC1B,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACjC,CAAC,CAAA;AAfY,QAAA,EAAE,MAed;AAED,kBAAe,EAAE,MAAM,EAAN,gBAAM,EAAE,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@de./sdk",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Complete SDK pack for MSI (Map Service Interface), IoTClient and DClient services — web, server and React Native",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -43,10 +43,10 @@
   "dependencies": {
     "@de./types": "^2.1.0",
     "events": "^3.3.0",
-    "iframe.io": "^1.1.0",
+    "iframe.io": "^1.3.0",
     "node-fetch": "2.6.1",
     "socket.io-client": "^4.6.1",
-    "webview.io": "^1.1.0"
+    "webview.io": "^1.2.0"
   },
   "peerDependencies": {
     "react": ">=16.8.0",
@@ -54,9 +54,15 @@
     "react-native-webview": ">=11.0.0"
   },
   "peerDependenciesMeta": {
-    "react": { "optional": true },
-    "react-native": { "optional": true },
-    "react-native-webview": { "optional": true }
+    "react": {
+      "optional": true
+    },
+    "react-native": {
+      "optional": true
+    },
+    "react-native-webview": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@babel/core": "^7.26.0",

package/src/allend/Access.ts

@@ -56,10 +56,26 @@ export default class AccessManager {
 
   constructor( options: AccessOptions, atype: AccessType ){
     if( !options ) throw new Error('Undefined Access Configuration')
-    if( !options.context ) throw new Error('Undefined Context Reference. Check https://doc.dedot.io/sdk/auth')
-    if( !options.accessToken ) throw new Error('Undefined Access Token. Check https://doc.dedot.io/sdk/auth')
-    
-    this.context = options.context
+
+    /**
+     * A workspace context and a bearer token identify a CALLER to de.arch, and
+     * every API client needs both. de.auth answers a different question — who
+     * the PERSON is — and the sign-in flow is what produces a session in the
+     * first place: at `POST /auth/otp/send` there is no workspace to name and
+     * no token to bear.
+     *
+     * Requiring them of every access type meant `OTPAuth` threw in its own
+     * constructor and could never be used for the one thing it exists to do.
+     * That is why de.simulation's bootstrap and Hot's `getUser` both talk to
+     * de.auth over raw fetch, and why nothing ever caught that this client
+     * addressed `/v1/auth/otp` — a route de.auth has never served.
+     */
+    if( atype !== 'ASI' ){
+      if( !options.context ) throw new Error('Undefined Context Reference. Check https://doc.dedot.io/sdk/auth')
+      if( !options.accessToken ) throw new Error('Undefined Access Token. Check https://doc.dedot.io/sdk/auth')
+    }
+
+    this.context = options.context || ''
     this.atype = atype
     this.version = options.version || 1
     this.platform = options.platform || 'proxy'

package/src/allend/LSP/agents.ts

@@ -5,7 +5,10 @@ import type {
 	LSPAgentUpdateValidation,
 	LSPAgentAssignVehicleValidation,
 	LSPAgentUnassignVehicleValidation,
-	LSPAgentRemoveValidation
+	LSPAgentRemoveValidation,
+	LSPAgentEnrolValidation,
+	LSPAgentEnrolmentRetrieveValidation,
+	LSPAgentEnrolmentUpdateValidation
 } from '@de./types/aux/agents'
 import type {
 	LSPConsolidationScheduleValidation,
@@ -22,6 +25,48 @@ import { qs, type Http, type Res, type Data } from '../../utils'
 export default class LSPAgents {
 	constructor( private http: Http ){}
 
+	// ── Self-enrolment ──────────────────────────────────────────────────────
+	//
+	// The invitation flow needs an operator to name each agent, which is right
+	// when a provider picks riders one at a time and wrong for a platform that
+	// already runs its own verification. Enrolment keeps what invitation was
+	// buying — the agent lands in this provider's context, and the provider
+	// agreed to take them — but takes the agreement from a standing policy
+	// instead of a per-person act.
+
+	/** The provider's standing enrolment policy. Operator-scoped. */
+	async enrolmentPolicy(): Promise<LSPAgentEnrolmentRetrieveValidation['response']> {
+		return await this.http.request<LSPAgentEnrolmentRetrieveValidation['response']>({
+			url: '/lsp/agents/enrolment',
+			method: 'GET'
+		})
+	}
+
+	/** Set it. Off unless `enabled` says otherwise. Operator-scoped. */
+	async setEnrolmentPolicy( body: LSPAgentEnrolmentUpdateValidation['body'] ): Promise<LSPAgentEnrolmentUpdateValidation['response']> {
+		return await this.http.request<LSPAgentEnrolmentUpdateValidation['response']>({
+			url: '/lsp/agents/enrolment',
+			method: 'PUT',
+			body
+		})
+	}
+
+	/**
+	 * Join this provider as an agent.
+	 *
+	 * Authorized as the person joining — the uid on the token — so a platform
+	 * enrols on someone's behalf by minting for them, exactly as it would to
+	 * redeem an invitation. `status`, `grade` and the zone come from the
+	 * provider's policy, not from the body.
+	 */
+	async enrol( body: LSPAgentEnrolValidation['body'] ): Promise<LSPAgentEnrolValidation['response']> {
+		return await this.http.request<LSPAgentEnrolValidation['response']>({
+			url: '/lsp/agents/enrolment',
+			method: 'POST',
+			body
+		})
+	}
+
 	async list( querystring?: LSPAgentListValidation['querystring'] ): Promise<LSPAgentListValidation['response']> {
 		return await this.http.request<LSPAgentListValidation['response']>({
 			url: `/lsp/agents${qs( querystring )}`,

package/src/allend/MSI/Handles.ts

@@ -46,13 +46,21 @@ export default class Handles extends EventEmitter {
   /**
    * Create new stream through which user's current location
    * details will be pushed to the API level.
-   * 
-   * @param usertype - (Default: `client`) Type of user at the current location
+   *
+   * This took a `usertype` of `client | agent` and sent it as the payload of
+   * `pin:current:location`. The gateway's handler takes an acknowledgement in
+   * that position and its `geolocator.pin()` takes no arguments at all, so the
+   * value was bound to `callback`, failed the `typeof … == 'function'` test and
+   * was discarded — `myLocation('agent')` and `myLocation('client')` did the
+   * same thing. `Controls.pinCurrentLocation()` emits the same event correctly,
+   * with only the ack. Removed rather than kept as decoration; distinguishing
+   * the marker by user type is a gateway feature that does not exist yet.
+   *
    * @return - Readable stream
    */
-  myLocation( usertype?: 'client' | 'agent' ){
+  myLocation(){
     if( !this.chn ) return
-    this.chn?.emit('pin:current:location', usertype || 'client' )
+    this.chn?.emit('pin:current:location')
 
     const stream = new Stream()
 

package/src/allend/MSI/index.ts

@@ -217,6 +217,26 @@ export default class MSI extends EventEmitter {
    */
   isReady(){ return this.chn && this.isConnected }
 
+  /**
+   * Tear the gateway down.
+   *
+   * Every `load()` adds a `message` listener to the window and an iframe to
+   * the page, and neither went away: a single-page host that mounts a map on
+   * a route accumulated one of each per visit, all of them still parsing
+   * traffic from the gateway. The React Native entry already unwinds this on
+   * unmount; the web entry had no way to.
+   */
+  destroy(){
+    this.chn?.disconnect()
+    this.chn = undefined
+    this.isConnected = false
+
+    const container = document.getElementById( this.element )
+    if( container ) container.innerHTML = ''
+
+    this.removeAllListeners()
+  }
+
   /**
    * Extend the kit's functionalities
    * 

package/src/allend/MSI/native.tsx

@@ -1,6 +1,6 @@
 import type { MapOptions } from '../../types'
 
-import React, { useRef, useEffect, useState, useCallback, forwardRef, useImperativeHandle } from 'react'
+import React, { useRef, useEffect, useState, useCallback, useMemo, forwardRef, useImperativeHandle } from 'react'
 import { View, StyleSheet, AppState, type AppStateStatus, Platform } from 'react-native'
 import { WebView } from 'react-native-webview'
 import WIO from 'webview.io'
@@ -8,6 +8,7 @@ import Handles from './Handles'
 import Controls from './Controls'
 import Plugins, { type Plugin } from './Plugins'
 import resolveAccessToken from './token'
+import belongsToGateway from './origin'
 
 export interface MSIInterface {
   controls: Controls
@@ -115,6 +116,18 @@ export default forwardRef<MSIRef, MSIProps>( ( props, ref ) => {
   apiRef = useRef<MSIInterface | null>( null ),
   isInitializedRef = useRef( false ),
 
+  /**
+   * The bridge is built once, so its handlers close over the props of the
+   * render that built it. `bind` resolves the access token at connect time
+   * precisely so a reconnect picks up a rotated one -- but reading it from a
+   * captured `props` gave back whatever `getAccessToken` closed over at mount,
+   * which for the usual `() => token` is the token the host held then. Every
+   * reconnect after a rotation would have re-bound with a dead token. Same for
+   * the callbacks: a host passing inline handlers had the mount-time ones
+   * called forever.
+   */
+  propsRef = useRef( props ),
+
   [ isConnected, setIsConnected ] = useState( false ),
   [ isReady, setIsReady ] = useState( false ),
 
@@ -128,13 +141,46 @@ export default forwardRef<MSIRef, MSIProps>( ( props, ref ) => {
           ? error
           : new Error( typeof error === 'string' ? error : error?.error || 'Unknown MSI error')
 
-    props.onError?.( normalized )
-  }, [ props.onError ] ),
+    propsRef.current.onError?.( normalized )
+  }, [] ),
 
   initializeConnection = useCallback( () => {
     if( !wioRef.current || !webViewRef.current ) return
     wioRef.current.initiate( webViewRef, baseURL )
-  }, [ baseURL ] )
+  }, [ baseURL ] ),
+
+  /**
+   * Refuse to navigate anywhere but the gateway -- see `belongsToGateway`.
+   */
+  isGatewayURL = useCallback( ( url: string ) => belongsToGateway( baseURL, url ), [ baseURL ] ),
+
+  /**
+   * One options object for both ends of the bridge.
+   *
+   * `getInjectedJavaScript()` bakes the transport's own configuration into the
+   * script the WebView runs — the auth secret, the skew tolerance, the replay
+   * window. It used to be called on a throwaway `new WIO({ type: 'WEBVIEW' })`
+   * constructed inline in the JSX, which shares nothing with the instance that
+   * actually holds the connection: the embedded side would have been handed a
+   * null secret and default tolerances no matter what the host was configured
+   * with. Nothing configures cryptoAuth today, so it never showed.
+   */
+  wioOptions = useMemo( () => ({
+    type: 'WEBVIEW' as const,
+    debug: props.env === 'dev',
+    allowedIncomingEvents: ALLOWED_INCOMING_EVENTS,
+    maxMessagesPerSecond: 100,
+    connectionTimeout: 15000,
+    connectionPingInterval: 2000,
+    maxConnectionAttempts: 5,
+    autoReconnect: true,
+    heartbeatInterval: 30000
+  }), [ props.env ] ),
+
+  // Rebuilt only when those options change, rather than on every render.
+  injectedBridge = useMemo( () => new WIO( wioOptions ).getInjectedJavaScript(), [ wioOptions ] )
+
+  useEffect( () => { propsRef.current = props } )
 
   // Expose the control surface to the host
   useImperativeHandle( ref, () => ({
@@ -149,17 +195,7 @@ export default forwardRef<MSIRef, MSIProps>( ( props, ref ) => {
   }), [ isConnected, isReady, initializeConnection ] )
 
   useEffect( () => {
-    const wio = wioRef.current = new WIO({
-      type: 'WEBVIEW',
-      debug: props.env === 'dev',
-      allowedIncomingEvents: ALLOWED_INCOMING_EVENTS,
-      maxMessagesPerSecond: 100,
-      connectionTimeout: 15000,
-      connectionPingInterval: 2000,
-      maxConnectionAttempts: 5,
-      autoReconnect: true,
-      heartbeatInterval: 30000
-    })
+    const wio = wioRef.current = new WIO( wioOptions )
 
     wio
     .on('connect', async () => {
@@ -168,11 +204,11 @@ export default forwardRef<MSIRef, MSIProps>( ( props, ref ) => {
          * Resolve the token here rather than at mount, so a reconnect after a
          * backgrounded app or a dropped bridge binds with a current token.
          */
-        const { getAccessToken, onReady, onError, onLoaded, style, ...config } = props
+        const { getAccessToken, onReady, onError, onLoaded, style, ...config } = propsRef.current
 
         await wio.emitAsync('bind', {
           ...config,
-          accessToken: resolveAccessToken( props ),
+          accessToken: resolveAccessToken( propsRef.current ),
           origin: 'react-native'
         }, BIND_TIMEOUT )
 
@@ -182,7 +218,7 @@ export default forwardRef<MSIRef, MSIProps>( ( props, ref ) => {
     })
     .on('ready', () => {
       setIsReady( true )
-      props.onReady?.()
+      propsRef.current.onReady?.()
     })
     .on('disconnect', () => {
       setIsConnected( false )
@@ -201,19 +237,21 @@ export default forwardRef<MSIRef, MSIProps>( ( props, ref ) => {
     })
 
     /**
-     * Pause gateway work while backgrounded, and re-establish the bridge on
-     * resume -- iOS in particular tears down the WebView's socket.
+     * Re-establish the bridge on resume -- iOS in particular tears down the
+     * WebView's socket while the app is backgrounded.
+     *
+     * This used to also emit `app:background` / `app:foreground`, which read
+     * like the gateway paused its work. It never did: the gateway has no
+     * handler for either, and its own allowlist dropped them before they got
+     * that far. Nor should there be a blanket one -- a rider streaming their
+     * position must keep streaming with the phone in their pocket, so whether
+     * backgrounding stops anything is the host's call, made through
+     * `controls.untrackLiveLocation()` and its counterpart.
      */
     const subscription = AppState.addEventListener('change', ( state: AppStateStatus ) => {
-      if( state === 'background' ){
-        wio.emit('app:background')
-        return
-      }
-
-      if( state === 'active' ){
-        wio.emit('app:foreground')
-        !wio.isConnected() && initializeConnection()
-      }
+      state === 'active'
+      && !wio.isConnected()
+      && initializeConnection()
     })
 
     return () => {
@@ -231,16 +269,16 @@ export default forwardRef<MSIRef, MSIProps>( ( props, ref ) => {
 
     const
     chn = wioRef.current,
-    controls = new Controls( chn, props ),
-    handles = new Handles( chn, controls, props ),
-    plugins = new Plugins( chn, handles, controls, props )
+    controls = new Controls( chn, propsRef.current ),
+    handles = new Handles( chn, controls, propsRef.current ),
+    plugins = new Plugins( chn, handles, controls, propsRef.current )
 
     plugins.mount( REGISTERED_PLUGINS )
 
     apiRef.current = { controls, handles, plugins }
     isInitializedRef.current = true
 
-    props.onLoaded?.( apiRef.current )
+    propsRef.current.onLoaded?.( apiRef.current )
   }, [ isConnected, isReady ] )
 
   const onMessage = ( event: any ) => {
@@ -274,7 +312,7 @@ export default forwardRef<MSIRef, MSIProps>( ( props, ref ) => {
         style={styles.webview}
         injectedJavaScript={`
           ${props.env === 'dev' ? injectedConsole() : ''}
-          ${new WIO({ type: 'WEBVIEW' }).getInjectedJavaScript()}
+          ${injectedBridge}
         `}
         javaScriptEnabled
         domStorageEnabled
@@ -287,6 +325,7 @@ export default forwardRef<MSIRef, MSIProps>( ( props, ref ) => {
         bounces={false}
         scrollEnabled={false}
         originWhitelist={[ baseURL ]}
+        onShouldStartLoadWithRequest={( { url }: any ) => isGatewayURL( url )}
         onMessage={onMessage}
         onLoadEnd={initializeConnection}
         onError={( { nativeEvent }: any ) => reportError( new Error( nativeEvent?.description || 'WebView error') )}

package/src/allend/MSI/origin.ts

@@ -0,0 +1,20 @@
+/**
+ * Whether a URL belongs to the MSI gateway itself.
+ *
+ * React Native's `originWhitelist` is prefix-matched and unanchored at the
+ * end, so a whitelist of `https://msi.dedot.io` also admits
+ * `https://msi.dedot.io.example.com`. That matters more in a WebView than it
+ * would in a browser: the injected bridge — and the auth secret baked into
+ * it — runs in whatever page the WebView ends up on. So the origin has to
+ * match exactly, and only a path, query or fragment separator may follow it.
+ *
+ * @param baseURL - Gateway origin, without a trailing slash
+ * @param url - URL the WebView is asking to navigate to
+ * @return - Whether the navigation is to the gateway
+ */
+export default function belongsToGateway( baseURL: string, url: string ): boolean {
+  if( !url || !baseURL ) return false
+  if( url === 'about:blank' || url === baseURL ) return true
+
+  return [ '/', '?', '#' ].some( separator => url.startsWith( baseURL + separator ) )
+}