@enbox/auth 0.4.0 → 0.6.0

package/dist/esm/{flows/wallet-connect.js → connect/wallet.js}

@@ -1,7 +1,7 @@
 /**
- * Wallet connect (OIDC/QR) flow.
+ * Wallet connect (Enbox Connect relay) flow.
  *
- * Connects to an external wallet via the WalletConnect relay protocol,
+ * Connects to an external wallet via the Enbox Connect relay protocol,
  * importing a delegated DID with permission grants.
  * This replaces the "Mode B/C" paths in Enbox.connect().
  * @module
@@ -27,11 +27,11 @@ var __rest = (this && this.__rest) || function (s, e) {
     return t;
 };
 import { Convert } from '@enbox/common';
-import { WalletConnect } from '@enbox/agent';
+import { registerWithDwnEndpoints } from '../registration.js';
+import { WalletConnect } from '../wallet-connect-client.js';
+import { DEFAULT_DWN_ENDPOINTS, STORAGE_KEYS } from '../types.js';
 import { DwnInterface, DwnPermissionGrant } from '@enbox/agent';
-import { AuthSession } from '../identity-session.js';
-import { registerWithDwnEndpoints } from './dwn-registration.js';
-import { STORAGE_KEYS } from '../types.js';
+import { ensureVaultReady, finalizeSession, resolvePassword, startSyncIfEnabled } from './lifecycle.js';
 /**
  * Process connected grants by storing them in the local DWN as the owner.
  *
@@ -87,12 +87,21 @@ export function walletConnect(ctx, options) {
             throw new Error('[@enbox/auth] Sync must be enabled when using wallet connect. ' +
                 'Remove sync: "off" or set an interval like "15s".');
         }
-        // Run the full OIDC wallet connect flow.
+        // Ensure the agent is initialized and started before the relay flow.
+        const isFirstLaunch = yield userAgent.firstLaunch();
+        const password = yield resolvePassword(ctx, undefined, isFirstLaunch);
+        yield ensureVaultReady({
+            userAgent,
+            emitter,
+            password,
+            isFirstLaunch,
+        });
+        // Run the Enbox Connect relay flow.
         // permissionRequests are already agent-level ConnectPermissionRequest objects.
         const result = yield WalletConnect.initClient({
             displayName: options.displayName,
             connectServerUrl: options.connectServerUrl,
-            walletUri: (_b = options.walletUri) !== null && _b !== void 0 ? _b : 'web5://connect',
+            walletUri: (_b = options.walletUri) !== null && _b !== void 0 ? _b : 'enbox://connect',
             permissionRequests: options.permissionRequests,
             onWalletUriReady: options.onWalletUriReady,
             validatePin: options.validatePin,
@@ -123,12 +132,13 @@ export function walletConnect(ctx, options) {
             });
             // Register with DWN endpoints (if registration options are provided).
             if (ctx.registration) {
-                const dwnEndpoints = (_c = ctx.defaultDwnEndpoints) !== null && _c !== void 0 ? _c : ['https://enbox-dwn.fly.dev'];
+                const dwnEndpoints = (_c = ctx.defaultDwnEndpoints) !== null && _c !== void 0 ? _c : DEFAULT_DWN_ENDPOINTS;
                 yield registerWithDwnEndpoints({
                     userAgent: userAgent,
                     dwnEndpoints,
                     agentDid: userAgent.agentDid.uri,
                     connectedDid,
+                    storage: storage,
                 }, ctx.registration);
             }
             // Register sync for the connected identity.
@@ -161,39 +171,23 @@ export function walletConnect(ctx, options) {
             const message = error instanceof Error ? error.message : String(error);
             throw new Error(`[@enbox/auth] Wallet connect failed: ${message}`);
         }
-        // Start sync.
-        const syncMode = sync === undefined ? 'live' : 'poll';
-        const syncInterval = sync !== null && sync !== void 0 ? sync : (syncMode === 'live' ? '5m' : '2m');
-        userAgent.sync.startSync({ mode: syncMode, interval: syncInterval })
-            .catch((err) => {
-            console.error('[@enbox/auth] Sync failed:', err);
-        });
         const delegateDid = delegatePortableDid.uri;
-        // Persist session info.
-        yield storage.set(STORAGE_KEYS.PREVIOUSLY_CONNECTED, 'true');
-        yield storage.set(STORAGE_KEYS.ACTIVE_IDENTITY, connectedDid);
-        yield storage.set(STORAGE_KEYS.DELEGATE_DID, delegateDid);
-        yield storage.set(STORAGE_KEYS.CONNECTED_DID, connectedDid);
-        const identityInfo = {
-            didUri: connectedDid,
-            name: identity.metadata.name,
-            connectedDid: identity.metadata.connectedDid,
-        };
-        const session = new AuthSession({
-            agent: userAgent,
-            did: connectedDid,
+        // Start sync.
+        startSyncIfEnabled(userAgent, sync);
+        // Persist session info, build AuthSession, and emit lifecycle events.
+        return finalizeSession({
+            userAgent,
+            emitter,
+            storage,
+            connectedDid,
             delegateDid,
-            identity: identityInfo,
-        });
-        emitter.emit('identity-added', { identity: identityInfo });
-        emitter.emit('session-start', {
-            session: {
-                did: session.did,
-                delegateDid,
-                identity: identityInfo,
+            identityName: identity.metadata.name,
+            identityConnectedDid: identity.metadata.connectedDid,
+            extraStorageKeys: {
+                [STORAGE_KEYS.DELEGATE_DID]: delegateDid,
+                [STORAGE_KEYS.CONNECTED_DID]: connectedDid,
             },
         });
-        return session;
     });
 }
-//# sourceMappingURL=wallet-connect.js.map
+//# sourceMappingURL=wallet.js.map

package/dist/esm/connect/wallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet.js","sourceRoot":"","sources":["../../../src/connect/wallet.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;AAQH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAExG;;;;;;;;GAQG;AACH,MAAM,UAAgB,sBAAsB,CAAC,MAI5C;;QACC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC9C,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAE7C,KAAK,MAAM,YAAY,IAAI,MAAM,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAErD,6DAA6D;YAC7D,kDAAkD;YAClD,MAAM,EAAE,WAAW,KAAoB,YAAY,EAA3B,UAAU,UAAK,YAAY,EAA7C,eAA8B,CAAe,CAAC;YACpD,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,YAAY,EAAc,CAAC,CAAC,CAAC;YAEzF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC;gBAC9C,KAAK,EAAS,IAAI;gBAClB,MAAM,EAAQ,WAAW;gBACzB,MAAM,EAAQ,WAAW;gBACzB,WAAW,EAAG,YAAY,CAAC,YAAY;gBACvC,WAAW,EAAG,IAAI;gBAClB,UAAU;gBACV,UAAU;aACX,CAAC,CAAC;YAEH,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,oDAAoD,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAC1E,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAI,KAAK,CAAC,KAAgE,CAAC,QAAQ,CAAC;YAClG,IAAI,QAAQ,EAAE,CAAC;gBACb,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,kBAAkB,CAAC,CAAC;IACjC,CAAC;CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAgB,aAAa,CACjC,GAAgB,EAChB,OAA6B;;;QAE7B,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,GAAG,CAAC,WAAW,CAAC;QAE7C,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAChE,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAEtE,MAAM,gBAAgB,CAAC;YACrB,SAAS;YACT,OAAO;YACP,QAAQ;YACR,aAAa;SACd,CAAC,CAAC;QAEH,oCAAoC;QACpC,+EAA+E;QAC/E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC;YAC5C,WAAW,EAAU,OAAO,CAAC,WAAW;YACxC,gBAAgB,EAAK,OAAO,CAAC,gBAAgB;YAC7C,SAAS,EAAY,MAAA,OAAO,CAAC,SAAS,mCAAI,iBAAiB;YAC3D,kBAAkB,EAAG,OAAO,CAAC,kBAAkB;YAC/C,gBAAgB,EAAK,OAAO,CAAC,gBAAgB;YAC7C,WAAW,EAAU,OAAO,CAAC,WAAW;SACzC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;QAErE,2CAA2C;QAC3C,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACzC,gBAAgB,EAAE;oBAChB,WAAW,EAAG,mBAAmB;oBACjC,QAAQ,EAAM;wBACZ,YAAY;wBACZ,IAAI,EAAK,SAAS;wBAClB,GAAG,EAAM,mBAAmB,CAAC,GAAG;wBAChC,MAAM,EAAG,SAAS,CAAC,QAAQ,CAAC,GAAG;qBAChC;iBACF;aACF,CAAC,CAAC;YAEH,uDAAuD;YACvD,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CAAC;gBACtD,KAAK,EAAS,SAAS;gBACvB,WAAW,EAAG,mBAAmB,CAAC,GAAG;gBACrC,MAAM,EAAQ,cAAc;aAC7B,CAAC,CAAC;YAEH,sEAAsE;YACtE,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACrB,MAAM,YAAY,GAAG,MAAA,GAAG,CAAC,mBAAmB,mCAAI,qBAAqB,CAAC;gBACtE,MAAM,wBAAwB,CAC5B;oBACE,SAAS,EAAG,SAAS;oBACrB,YAAY;oBACZ,QAAQ,EAAI,SAAS,CAAC,QAAQ,CAAC,GAAG;oBAClC,YAAY;oBACZ,OAAO,EAAK,OAAO;iBACpB,EACD,GAAG,CAAC,YAAY,CACjB,CAAC;YACJ,CAAC;YAED,4CAA4C;YAC5C,MAAM,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBACpC,GAAG,EAAO,YAAY;gBACtB,OAAO,EAAG;oBACR,WAAW,EAAG,mBAAmB,CAAC,GAAG;oBACrC,SAAS,EAAK,kBAAkB;iBACjC;aACF,CAAC,CAAC;YAEH,4DAA4D;YAC5D,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,uBAAuB;YACvB,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;wBACzB,MAAM,EAAM,QAAQ,CAAC,GAAG,CAAC,GAAG;wBAC5B,MAAM,EAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM;wBACpC,SAAS,EAAG,IAAI;qBACjB,CAAC,CAAC;gBACL,CAAC;gBAAC,QAAQ,iBAAiB,IAAnB,CAAC,CAAC,iBAAiB,CAAC,CAAC;gBAE7B,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;gBAChE,CAAC;gBAAC,QAAQ,iBAAiB,IAAnB,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC/B,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC;QAE5C,cAAc;QACd,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAEpC,sEAAsE;QACtE,OAAO,eAAe,CAAC;YACrB,SAAS;YACT,OAAO;YACP,OAAO;YACP,YAAY;YACZ,WAAW;YACX,YAAY,EAAW,QAAQ,CAAC,QAAQ,CAAC,IAAI;YAC7C,oBAAoB,EAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY;YACrD,gBAAgB,EAAO;gBACrB,CAAC,YAAY,CAAC,YAAY,CAAC,EAAI,WAAW;gBAC1C,CAAC,YAAY,CAAC,aAAa,CAAC,EAAG,YAAY;aAC5C;SACF,CAAC,CAAC;IACL,CAAC;CAAA"}

package/dist/esm/{flows/dwn-discovery.js → discovery.js}

@@ -7,26 +7,21 @@
  *
  * ## Discovery channels (browser, highest to lowest priority)
  *
- * 1. **URL fragment payload** — A `dwn://register` redirect just landed
+ * 1. **URL fragment payload** — A `dwn://connect` redirect just landed
  *    on the page with the endpoint in `#`. Highest priority because it's
  *    fresh and explicit.
  * 2. **Persisted endpoint** (localStorage) — A previously discovered
  *    endpoint restored and re-validated via `GET /info`.
- * 3. **Agent-level discovery** (transparent, runs on every `sendRequest`)
- *    — `~/.enbox/dwn.json` discovery file (Node/Bun only; skipped in
- *    browsers) and sequential port probing on `127.0.0.1:{3000,55500–55509}`.
- *    This channel works even if the browser-specific functions here
- *    return `false`.
  *
  * ## Discovery channels (CLI / native, all transparent)
  *
- * In Node/Bun environments, all discovery happens automatically inside
+ * In Node/Bun environments, the agent's `LocalDwnDiscovery` reads the
+ * `~/.enbox/dwn.json` discovery file automatically inside
  * `AgentDwnApi.getLocalDwnEndpoint()`. The browser-specific functions
  * in this module (`checkUrlForDwnDiscoveryPayload`, `requestLocalDwnDiscovery`)
- * are not needed — the agent reads `~/.enbox/dwn.json` and probes ports
- * on its own.
+ * are not needed in those environments.
  *
- * @see https://github.com/enboxorg/enbox/issues/589
+ * @see https://github.com/enboxorg/enbox/issues/677
  * @module
  */
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
@@ -38,13 +33,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { buildDwnRegisterUrl, readDwnDiscoveryPayloadFromUrl } from '@enbox/agent';
-import { STORAGE_KEYS } from '../types.js';
+import { EnboxRpcClient } from '@enbox/dwn-clients';
+import { buildDwnConnectUrl, localDwnServerName, normalizeBaseUrl, readDwnDiscoveryPayloadFromUrl } from '@enbox/agent';
+import { STORAGE_KEYS } from './types.js';
 /**
  * Check the current page URL for a `DwnDiscoveryPayload` in the fragment.
  *
  * This is called once at the start of a connection flow to detect whether
- * the user was just redirected back from a `dwn://register` handler. If a
+ * the user was just redirected back from a `dwn://connect` handler. If a
  * valid payload is found, the endpoint is persisted and the fragment is
  * cleared to prevent double-reads.
  *
@@ -67,6 +63,80 @@ export function checkUrlForDwnDiscoveryPayload() {
     }
     return payload.endpoint;
 }
+// ─── Standalone (pre-agent) discovery ───────────────────────────
+/**
+ * Validate a local DWN endpoint by calling `GET /info` and checking
+ * that the server identifies itself as `@enbox/dwn-server`.
+ *
+ * This function has **zero** agent or vault dependencies — it only uses
+ * the network. It is safe to call before the agent exists.
+ *
+ * @param endpoint - The candidate endpoint URL.
+ * @returns The normalised endpoint if valid, `undefined` otherwise.
+ */
+function validateEndpointStandalone(endpoint) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const normalized = normalizeBaseUrl(endpoint);
+        try {
+            const rpc = new EnboxRpcClient();
+            const serverInfo = yield rpc.getServerInfo(normalized);
+            if (serverInfo.server === localDwnServerName) {
+                return normalized;
+            }
+        }
+        catch (_a) {
+            // Server not reachable or not ours.
+        }
+        return undefined;
+    });
+}
+/**
+ * Run local DWN discovery **before the agent exists**.
+ *
+ * This is the standalone counterpart of {@link applyLocalDwnDiscovery} and
+ * is designed to be called in `AuthManager.create()`, before
+ * `EnboxUserAgent.create()`, so the agent creation can decide whether to
+ * spin up an in-process DWN or operate in remote mode.
+ *
+ * Discovery channels (highest → lowest priority):
+ * 1. **URL fragment payload** — A `dwn://connect` redirect just landed.
+ * 2. **Persisted endpoint** (localStorage) — A previously discovered
+ *    endpoint, re-validated via `GET /info`.
+ *
+ * When a valid endpoint is found it is persisted to storage. When a
+ * previously-persisted endpoint is stale, it is removed.
+ *
+ * @param storage - The auth storage adapter (for reading/writing the
+ *   cached endpoint).
+ * @returns The validated endpoint URL, or `undefined` if no local DWN
+ *   server is available.
+ */
+export function discoverLocalDwn(storage) {
+    return __awaiter(this, void 0, void 0, function* () {
+        // Channel 1: Fresh redirect payload in the URL fragment.
+        const freshEndpoint = checkUrlForDwnDiscoveryPayload();
+        if (freshEndpoint) {
+            const validated = yield validateEndpointStandalone(freshEndpoint);
+            if (validated) {
+                yield persistLocalDwnEndpoint(storage, validated);
+                return validated;
+            }
+            // Payload was in the URL but the server is unreachable — fall through.
+        }
+        // Channel 2: Persisted endpoint from a previous session.
+        const cached = yield storage.get(STORAGE_KEYS.LOCAL_DWN_ENDPOINT);
+        if (cached) {
+            const validated = yield validateEndpointStandalone(cached);
+            if (validated) {
+                return validated;
+            }
+            // Stale — server no longer running.
+            yield clearLocalDwnEndpoint(storage);
+        }
+        return undefined;
+    });
+}
+// ─── Storage helpers ────────────────────────────────────────────
 /**
  * Persist a discovered local DWN endpoint in auth storage.
  *
@@ -121,25 +191,18 @@ export function restoreLocalDwnEndpoint(agent, storage) {
  * Run the full local DWN discovery sequence for a browser connection flow.
  *
  * This function handles the **receiving** side of local DWN discovery in
- * the browser. It does NOT trigger the `dwn://register` redirect — use
+ * the browser. It does NOT trigger the `dwn://connect` redirect — use
  * {@link requestLocalDwnDiscovery} for that.
  *
  * The discovery channels, from highest to lowest priority:
  *
- * 1. **URL fragment payload** — A `dwn://register` redirect just landed on
+ * 1. **URL fragment payload** — A `dwn://connect` redirect just landed on
  *    this page with the DWN endpoint in `#`. This is the highest-priority
  *    signal because it's fresh and explicit.
  *
  * 2. **Persisted endpoint** (localStorage) — A previously discovered
  *    endpoint is restored and re-validated via `GET /info`.
  *
- * 3. **Agent-level discovery** (transparent) — Even if this function
- *    returns `false`, the agent's `LocalDwnDiscovery` will independently
- *    try the discovery file (`~/.enbox/dwn.json`) and port probing on
- *    every `sendRequest()` call. Those channels are not available in
- *    browsers (no filesystem access, CORS may block probes), but they
- *    work transparently in Node/Bun CLI environments.
- *
  * When an `emitter` is provided, this function emits:
  * - `'local-dwn-available'` with the endpoint when discovery succeeds.
  * - `'local-dwn-unavailable'` when no local DWN could be reached.
@@ -176,36 +239,30 @@ export function applyLocalDwnDiscovery(agent, storage, emitter) {
         return restored;
     });
 }
-// ─── dwn://register trigger ─────────────────────────────────────
+// ─── dwn://connect trigger ──────────────────────────────────────
 /**
- * Initiate the `dwn://register` flow by opening the register URL.
+ * Initiate the `dwn://connect` flow by opening the connect URL.
  *
- * This asks the operating system to route `dwn://register?callback=<url>`
+ * This asks the operating system to route `dwn://connect?callback=<url>`
  * to the registered handler (electrobun-dwn), which will redirect the
  * user's browser back to `callbackUrl` with the local DWN endpoint
  * encoded in the URL fragment.
  *
- * **Important:** There is no reliable cross-browser API to detect whether
- * a `dwn://` handler is installed. If no handler is registered, this call
- * will silently fail or show an OS-level error dialog. Use
- * {@link probeLocalDwn} first to check if a local DWN is already
- * reachable via port probing — if it is, you can skip the register flow
- * entirely and call {@link applyLocalDwnDiscovery} instead.
+ * **Note:** There is no reliable cross-browser API to detect whether a
+ * `dwn://` handler is installed. If no handler is registered, this call
+ * will silently fail or show an OS-level error dialog.
  *
  * @param callbackUrl - The URL to redirect back to. Defaults to the
  *   current page URL (without its fragment) if running in a browser.
- * @returns `true` if the register URL was opened, `false` if no
+ * @returns `true` if the connect URL was opened, `false` if no
  *   callback URL could be determined (e.g. no `globalThis.location`).
  *
  * @example
  * ```ts
- * // Check if local DWN is already available via direct probe.
- * const alreadyAvailable = await probeLocalDwn();
- * if (!alreadyAvailable) {
- *   // No local DWN found — trigger the dwn://register flow.
- *   requestLocalDwnDiscovery();
- *   // The page will reload with the endpoint in the URL fragment.
- * }
+ * // Trigger the dwn://connect flow to discover a local DWN.
+ * requestLocalDwnDiscovery();
+ * // The page will reload with the endpoint in the URL fragment.
+ * // On the next connect/restore, applyLocalDwnDiscovery() reads it.
  * ```
  */
 export function requestLocalDwnDiscovery(callbackUrl) {
@@ -213,7 +270,7 @@ export function requestLocalDwnDiscovery(callbackUrl) {
     if (!resolvedCallback) {
         return false;
     }
-    const registerUrl = buildDwnRegisterUrl(resolvedCallback);
+    const registerUrl = buildDwnConnectUrl(resolvedCallback);
     // Open the dwn:// URL. Use window.open() rather than location.href
     // assignment to avoid navigating away from the current page if the
     // OS handler isn't installed.
@@ -228,48 +285,6 @@ export function requestLocalDwnDiscovery(callbackUrl) {
     }
     return false;
 }
-/**
- * Probe whether a local DWN server is reachable via direct HTTP fetch.
- *
- * Attempts `GET http://127.0.0.1:{port}/info` on the well-known port
- * candidates and returns the endpoint URL of the first server that
- * responds with a valid `@enbox/dwn-server` identity.
- *
- * This is useful in browsers to check if a local DWN is available
- * *before* triggering the `dwn://register` redirect flow — if the
- * server is already reachable (CORS permitting), the redirect is
- * unnecessary.
- *
- * @returns The local DWN endpoint URL, or `undefined` if no server
- *   was found. Returns `undefined` (rather than throwing) on CORS
- *   errors or network failures.
- */
-export function probeLocalDwn() {
-    return __awaiter(this, void 0, void 0, function* () {
-        // Import port candidates from @enbox/agent. Using a dynamic import
-        // here keeps the function self-contained and avoids circular deps.
-        const { localDwnPortCandidates, localDwnHostCandidates } = yield import('@enbox/agent');
-        for (const port of localDwnPortCandidates) {
-            for (const host of localDwnHostCandidates) {
-                const endpoint = `http://${host}:${port}`;
-                try {
-                    const response = yield fetch(`${endpoint}/info`, { signal: AbortSignal.timeout(2000) });
-                    if (!response.ok) {
-                        continue;
-                    }
-                    const serverInfo = yield response.json();
-                    if ((serverInfo === null || serverInfo === void 0 ? void 0 : serverInfo.server) === '@enbox/dwn-server') {
-                        return endpoint;
-                    }
-                }
-                catch (_a) {
-                    // Network error, CORS block, or timeout — try next candidate.
-                }
-            }
-        }
-        return undefined;
-    });
-}
 // ─── Internal helpers ───────────────────────────────────────────
 /** Return the current page URL without the fragment, or `undefined`. */
 function currentPageUrl() {
@@ -278,4 +293,4 @@ function currentPageUrl() {
     }
     return globalThis.location.href.split('#')[0];
 }
-//# sourceMappingURL=dwn-discovery.js.map
+//# sourceMappingURL=discovery.js.map

package/dist/esm/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;;;;;;;;;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAC;AAKxH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,8BAA8B;IAC5C,IAAI,OAAO,UAAU,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,8BAA8B,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,kEAAkE;IAClE,qDAAqD;IACrD,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,WAAW,IAAI,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACjF,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC;AAED,mEAAmE;AAEnE;;;;;;;;;GASG;AACH,SAAe,0BAA0B,CAAC,QAAgB;;QACxD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YACvD,IAAI,UAAU,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBAC7C,OAAO,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;QAAC,WAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAgB,gBAAgB,CACpC,OAAuB;;QAEvB,yDAAyD;QACzD,MAAM,aAAa,GAAG,8BAA8B,EAAE,CAAC;QACvD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,aAAa,CAAC,CAAC;YAClE,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAClD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,uEAAuE;QACzE,CAAC;QAED,yDAAyD;QACzD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QAClE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,oCAAoC;YACpC,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CAAA;AAED,mEAAmE;AAEnE;;;;;GAKG;AACH,MAAM,UAAgB,uBAAuB,CAC3C,OAAuB,EACvB,QAAgB;;QAEhB,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAgB,qBAAqB,CACzC,OAAuB;;QAEvB,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC;CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAgB,uBAAuB,CAC3C,KAAqB,EACrB,OAAuB;;QAEvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,4DAA4D;YAC5D,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAgB,sBAAsB,CAC1C,KAAqB,EACrB,OAAuB,EACvB,OAA0B;;QAE1B,kFAAkF;QAClF,MAAM,aAAa,GAAG,8BAA8B,EAAE,CAAC;QAEvD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAC;YAC1E,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,uBAAuB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBACtD,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;gBAClE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,yEAAyE;QAC3E,CAAC;QAED,sCAAsC;QACtC,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE/D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;YACpE,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CAAA;AAED,mEAAmE;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAoB;IAC3D,MAAM,gBAAgB,GAAG,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,cAAc,EAAE,CAAC;IACzD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAEzD,mEAAmE;IACnE,mEAAmE;IACnE,8BAA8B;IAC9B,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC1C,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8DAA8D;IAC9D,IAAI,OAAO,UAAU,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC/C,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,WAAW,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AAEnE,wEAAwE;AACxE,SAAS,cAAc;IACrB,IAAI,OAAO,UAAU,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/esm/index.js

@@ -36,15 +36,19 @@
 // Core classes
 export { AuthManager } from './auth-manager.js';
 export { AuthSession } from './identity-session.js';
-export { VaultManager } from './vault/vault-manager.js';
 export { AuthEventEmitter } from './events.js';
+// Password providers
+export { PasswordProvider } from './password-provider.js';
 // Re-export agent classes so consumers can construct custom agents/vaults
 // without a direct @enbox/agent dependency.
 export { EnboxUserAgent, HdIdentityVault } from '@enbox/agent';
 // Wallet-connect helpers
-export { processConnectedGrants } from './flows/wallet-connect.js';
+export { processConnectedGrants } from './connect/wallet.js';
+export { WalletConnect } from './wallet-connect-client.js';
+// Registration token storage helpers
+export { loadTokensFromStorage, saveTokensToStorage } from './registration.js';
 // Local DWN discovery (browser dwn:// protocol integration)
-export { applyLocalDwnDiscovery, checkUrlForDwnDiscoveryPayload, clearLocalDwnEndpoint, persistLocalDwnEndpoint, probeLocalDwn, requestLocalDwnDiscovery, restoreLocalDwnEndpoint, } from './flows/dwn-discovery.js';
+export { applyLocalDwnDiscovery, checkUrlForDwnDiscoveryPayload, clearLocalDwnEndpoint, discoverLocalDwn, persistLocalDwnEndpoint, requestLocalDwnDiscovery, restoreLocalDwnEndpoint, } from './discovery.js';
 // Storage adapters
 export { BrowserStorage, LevelStorage, MemoryStorage, createDefaultStorage } from './storage/storage.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,eAAe;AACf,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,0EAA0E;AAC1E,4CAA4C;AAC5C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/D,yBAAyB;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,4DAA4D;AAC5D,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,mBAAmB;AACnB,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,eAAe;AACf,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,qBAAqB;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,0EAA0E;AAC1E,4CAA4C;AAC5C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/D,yBAAyB;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAG3D,qCAAqC;AACrC,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE/E,4DAA4D;AAC5D,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB,mBAAmB;AACnB,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}