@enbox/auth 0.6.32 → 0.6.33

package/dist/types/types.d.ts

@@ -3,7 +3,7 @@
  * Public types for the authentication and identity management SDK.
  */
 import type { PortableDid } from '@enbox/dids';
-import type { ConnectPermissionRequest, DelegateContextKey, DelegateDecryptionKey, DwnDataEncodedRecordsWriteMessage, DwnProtocolDefinition, EnboxUserAgent, HdIdentityVault, LocalDwnStrategy, PortableIdentity } from '@enbox/agent';
+import type { AgentSessionIdentity, ConnectPermissionRequest, DelegateContextKey, DelegateDecryptionKey, DwnDataEncodedRecordsWriteMessage, DwnProtocolDefinition, EnboxUserAgent, HdIdentityVault, LocalDwnStrategy, PortableIdentity } from '@enbox/agent';
 import type { PasswordProvider } from './password-provider.js';
 export type { ConnectPermissionRequest, DelegateContextKey, DelegateDecryptionKey, HdIdentityVault, IdentityVaultBackup, LocalDwnStrategy, PortableIdentity } from '@enbox/agent';
 export type { EnboxUserAgent } from '@enbox/agent';
@@ -58,18 +58,15 @@ export interface AuthEventMap {
 }
 /** A type-safe event handler for a specific event. */
 export type AuthEventHandler<E extends AuthEvent = AuthEvent> = (payload: AuthEventMap[E]) => void;
-/** Lightweight metadata about a stored identity. */
-export interface IdentityInfo {
-    /** The DID URI for this identity. */
-    didUri: string;
-    /** Human-readable name. */
-    name: string;
-    /**
-     * Present when this identity is a delegate of another DID
-     * (i.e. connected via wallet connect).
-     */
-    connectedDid?: string;
-}
+/**
+ * Lightweight metadata about a stored identity.
+ *
+ * @deprecated Prefer {@link AgentSessionIdentity} from `@enbox/agent` — this
+ *   alias exists for `@enbox/auth`'s self-contained public surface but the
+ *   canonical name lives in the agent package. The two are structurally
+ *   identical; new code should import `AgentSessionIdentity` directly.
+ */
+export type IdentityInfo = AgentSessionIdentity;
 /** Serializable session info for the `session-start` event. */
 export interface AuthSessionInfo {
     did: string;
@@ -426,6 +423,14 @@ export interface HandlerConnectOptions {
      * on `AuthManager.create()`.
      */
     connectHandler?: ConnectHandler;
+    /**
+     * Vault password for this call (overrides the manager default).
+     *
+     * The handler flow still needs to unlock the local agent's vault to receive
+     * delegated grants — passing `password` per-call lets callers override the
+     * default supplied to `AuthManager.create()`.
+     */
+    password?: string;
     /** Override manager default sync interval. */
     sync?: SyncOption;
 }

package/dist/types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,iCAAiC,EAAE,qBAAqB,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEvO,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,YAAY,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGlL,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;AAI/D;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,QAAQ,GACR,UAAU,GACV,WAAW,CAAC;AAIhB,mDAAmD;AACnD,MAAM,MAAM,SAAS,GACjB,cAAc,GACd,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,qBAAqB,GACrB,uBAAuB,CAAC;AAE5B,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE;QAAE,QAAQ,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,SAAS,CAAA;KAAE,CAAC;IAC5D,eAAe,EAAE;QAAE,OAAO,EAAE,eAAe,CAAA;KAAE,CAAC;IAC9C,aAAa,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B,gBAAgB,EAAE;QAAE,QAAQ,EAAE,YAAY,CAAA;KAAE,CAAC;IAC7C,kBAAkB,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,mEAAmE;IACnE,qBAAqB,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,6GAA6G;IAC7G,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAChD;AAED,sDAAsD;AACtD,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAC1D,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AAIrC,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IAEf,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAID,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,IAAI,CAAC;IAEtB,8CAA8C;IAC9C,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAEpC;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAErF;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAE3D;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,KAAK,IAAI,CAAC;IAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,mBAAmB,EAAE,WAAW,CAAC;IAEjC,qDAAqD;IACrD,cAAc,EAAE,iCAAiC,EAAE,CAAC;IAEpD,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAEjD;;;OAGG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAE3C;;;OAGG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvC,qFAAqF;IACrF,kBAAkB,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACvE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,aAAa,CAAC,MAAM,EAAE;QACpB,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;KAChD,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;CACxC;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,cAAc,CAAC;IAEvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAE7B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAEpC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,cAAc,CAAC;IAEzB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAEpC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,sCAAsC;IACtC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAEnC;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,yBAAyB;IACzB,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAE7B;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAID;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GACvB,qBAAqB,GACrB;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC;AAErE,0DAA0D;AAC1D,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAE3F,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,UAAU,EAAmE,CAAC;AAEhH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC;IAE9B;;;OAGG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,cAAc,GAAG,qBAAqB,GAAG,mBAAmB,CAAC;AAEzE,qDAAqD;AACrD,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IAEpB,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;OAOG;IACH,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;IAE/C,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAExC,+CAA+C;IAC/C,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,kCAAkC;IAClC,cAAc,EAAE,MAAM,CAAC;IAEvB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IAEjB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,0DAA0D;AAC1D,MAAM,WAAW,yBAAyB;IACxC,4CAA4C;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC;IAEnC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,sDAAsD;AACtD,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzC,4BAA4B;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C,oBAAoB;IACpB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC,6BAA6B;IAC7B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAID,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAElE,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,UAAgC,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,YAAY;IACvB,oDAAoD;;IAGpD,+CAA+C;;IAG/C,4DAA4D;;IAG5D,yDAAyD;;IAGzD;;;;OAIG;;IAGH;;;OAGG;;IAGH;;;;OAIG;;IAGH;;;;;;OAMG;;IAGH;;;;;;OAMG;;IAGH;;;OAGG;;IAGH;;;;;;;OAOG;;CAEK,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,iCAAiC,EAAE,qBAAqB,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE7P,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,YAAY,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGlL,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;AAI/D;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,QAAQ,GACR,UAAU,GACV,WAAW,CAAC;AAIhB,mDAAmD;AACnD,MAAM,MAAM,SAAS,GACjB,cAAc,GACd,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,qBAAqB,GACrB,uBAAuB,CAAC;AAE5B,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE;QAAE,QAAQ,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,SAAS,CAAA;KAAE,CAAC;IAC5D,eAAe,EAAE;QAAE,OAAO,EAAE,eAAe,CAAA;KAAE,CAAC;IAC9C,aAAa,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B,gBAAgB,EAAE;QAAE,QAAQ,EAAE,YAAY,CAAA;KAAE,CAAC;IAC7C,kBAAkB,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,mEAAmE;IACnE,qBAAqB,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,6GAA6G;IAC7G,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAChD;AAED,sDAAsD;AACtD,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAC1D,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AAIrC;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAEhD,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAID,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,IAAI,CAAC;IAEtB,8CAA8C;IAC9C,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAEpC;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAErF;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAE3D;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,KAAK,IAAI,CAAC;IAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,mBAAmB,EAAE,WAAW,CAAC;IAEjC,qDAAqD;IACrD,cAAc,EAAE,iCAAiC,EAAE,CAAC;IAEpD,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAEjD;;;OAGG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAE3C;;;OAGG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvC,qFAAqF;IACrF,kBAAkB,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACvE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,aAAa,CAAC,MAAM,EAAE;QACpB,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;KAChD,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;CACxC;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,cAAc,CAAC;IAEvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAE7B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAEpC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,cAAc,CAAC;IAEzB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAEpC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,sCAAsC;IACtC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAEnC;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,yBAAyB;IACzB,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAE7B;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAID;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GACvB,qBAAqB,GACrB;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC;AAErE,0DAA0D;AAC1D,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAE3F,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,UAAU,EAAmE,CAAC;AAEhH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC;IAE9B;;;OAGG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,cAAc,GAAG,qBAAqB,GAAG,mBAAmB,CAAC;AAEzE,qDAAqD;AACrD,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IAEpB,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;OAOG;IACH,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;IAE/C,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAExC,+CAA+C;IAC/C,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,kCAAkC;IAClC,cAAc,EAAE,MAAM,CAAC;IAEvB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IAEjB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,0DAA0D;AAC1D,MAAM,WAAW,yBAAyB;IACxC,4CAA4C;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC;IAEnC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,sDAAsD;AACtD,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzC,4BAA4B;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C,oBAAoB;IACpB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC,6BAA6B;IAC7B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAID,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAElE,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,UAAgC,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,YAAY;IACvB,oDAAoD;;IAGpD,+CAA+C;;IAG/C,4DAA4D;;IAG5D,yDAAyD;;IAGzD;;;;OAIG;;IAGH;;;OAGG;;IAGH;;;;OAIG;;IAGH;;;;;;OAMG;;IAGH;;;;;;OAMG;;IAGH;;;OAGG;;IAGH;;;;;;;OAOG;;CAEK,CAAC"}

package/dist/types/wallet-connect-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-connect-client.d.ts","sourceRoot":"","sources":["../../src/wallet-connect-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAsB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACxG,OAAO,KAAK,EAAyB,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAQhF;;;;;;GAMG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IAEpB,sFAAsF;IACtF,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;IAE/C;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAExC;;;;;OAKG;IACH,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACpC,CAAC;AAEF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,+DAA+D;IAC/D,UAAU,EAAE,qBAAqB,CAAC;IAElC,uDAAuD;IACvD,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B,CAAC;AAEF;;;GAGG;AACH,iBAAe,UAAU,CAAC,EACxB,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,GACZ,EAAE,0BAA0B,GAAG,OAAO,CAAC;IACtC,cAAc,EAAE,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACvD,mBAAmB,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;IACjE,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IACxE,mBAAmB,CAAC,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;IAClE,2BAA2B,CAAC,EAAE,oBAAoB,CAAC,6BAA6B,CAAC,CAAC;IAClF,kBAAkB,CAAC,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;CACjE,GAAG,SAAS,CAAC,CA2Gb;AAED;;;;;;;GAOG;AACH,iBAAS,kCAAkC,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,yBAAyB,GAAG,wBAAwB,CAsE5H;AAED,eAAO,MAAM,aAAa;;;CAAqD,CAAC"}
+{"version":3,"file":"wallet-connect-client.d.ts","sourceRoot":"","sources":["../../src/wallet-connect-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAsB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACxG,OAAO,KAAK,EAAyB,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAQhF;;;;;;GAMG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IAEpB,sFAAsF;IACtF,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;IAE/C;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAExC;;;;;OAKG;IACH,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACpC,CAAC;AAEF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,+DAA+D;IAC/D,UAAU,EAAE,qBAAqB,CAAC;IAElC,uDAAuD;IACvD,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B,CAAC;AAEF;;;GAGG;AACH,iBAAe,UAAU,CAAC,EACxB,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,GACZ,EAAE,0BAA0B,GAAG,OAAO,CAAC;IACtC,cAAc,EAAE,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACvD,mBAAmB,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;IACjE,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IACxE,mBAAmB,CAAC,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;IAClE,2BAA2B,CAAC,EAAE,oBAAoB,CAAC,6BAA6B,CAAC,CAAC;IAClF,kBAAkB,CAAC,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;CACjE,GAAG,SAAS,CAAC,CA6Gb;AAED;;;;;;;GAOG;AACH,iBAAS,kCAAkC,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,yBAAyB,GAAG,wBAAwB,CAsE5H;AAED,eAAO,MAAM,aAAa;;;CAAqD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enbox/auth",
-  "version": "0.6.32",
+  "version": "0.6.33",
   "description": "Headless authentication and identity management SDK for Enbox",
   "type": "module",
   "main": "./dist/esm/index.js",
@@ -37,6 +37,10 @@
     ".": {
       "types": "./dist/types/index.d.ts",
       "import": "./dist/esm/index.js"
+    },
+    "./auth-manager": {
+      "types": "./dist/types/auth-manager.d.ts",
+      "import": "./dist/esm/auth-manager.js"
     }
   },
   "keywords": [
@@ -56,12 +60,12 @@
     "bun": ">=1.0.0"
   },
   "dependencies": {
-    "@enbox/agent": "0.7.0",
-    "@enbox/common": "0.1.0",
-    "@enbox/crypto": "0.1.0",
-    "@enbox/dids": "0.1.0",
-    "@enbox/dwn-clients": "0.4.0",
-    "@enbox/dwn-sdk-js": "0.3.5",
+    "@enbox/agent": "0.7.1",
+    "@enbox/common": "0.1.1",
+    "@enbox/crypto": "0.1.1",
+    "@enbox/dids": "0.1.1",
+    "@enbox/dwn-clients": "0.4.1",
+    "@enbox/dwn-sdk-js": "0.3.6",
     "level": "8.0.1"
   },
   "devDependencies": {

package/src/auth-manager.ts

@@ -3,10 +3,19 @@
  *
  * Replaces `Enbox.connect()` (formerly `Web5.connect()`) with a composable,
  * multi-identity-aware auth system that works in both browser and CLI environments.
+ *
+ * NOTE: this file is also exposed as the `@enbox/auth/auth-manager` subpath
+ * export so `@enbox/api` can import the AuthManager class without pulling in
+ * the full barrel. The subpath is **internal to the monorepo** — external
+ * consumers should import from `@enbox/auth` (or `@enbox/browser`) instead;
+ * the subpath's file layout is not part of any stability guarantee.
+ *
+ * @internal
  * @module
  */
 
-import type { BearerIdentity, HdIdentityVault, PortableIdentity } from '@enbox/agent';
+import type { RecordsWriteMessage } from '@enbox/dwn-sdk-js';
+import type { AgentSessionIdentity, BearerIdentity, DwnDataEncodedRecordsWriteMessage, HdIdentityVault, PortableIdentity } from '@enbox/agent';
 
 import type { FlowContext } from './connect/lifecycle.js';
 import type { PasswordProvider } from './password-provider.js';
@@ -20,7 +29,6 @@ import type {
   DisconnectOptions,
   HandlerConnectOptions,
   HeadlessConnectOptions,
-  IdentityInfo,
   ImportFromPhraseOptions,
   ImportFromPortableOptions,
   LocalConnectOptions,
@@ -241,12 +249,14 @@ export class AuthManager {
       const restored = await restoreSession(this._flowContext());
       if (restored) { return restored; }
 
-      // 2. Route to the appropriate flow.
+      // 2. Route to the appropriate flow. `_isLocalConnect` is a type guard
+      // so the two branches receive correctly narrowed `options` types
+      // without casts.
       if (this._isLocalConnect(options)) {
-        return localConnect(this._flowContext(), options as LocalConnectOptions);
+        return localConnect(this._flowContext(), options);
       }
 
-      return this._handlerConnect(options as HandlerConnectOptions | undefined);
+      return this._handlerConnect(options);
     });
   }
 
@@ -305,6 +315,7 @@ export class AuthManager {
    * This replaces the manual `previouslyConnected` localStorage pattern.
    */
   async restoreSession(options?: RestoreSessionOptions): Promise<AuthSession | undefined> {
+    this._guardShutdown();
     this._guardConcurrency();
     this._isConnecting = true;
 
@@ -345,6 +356,7 @@ export class AuthManager {
    * ```
    */
   async connectHeadless(options?: HeadlessConnectOptions): Promise<AuthSession> {
+    this._guardShutdown();
     let password = options?.password ?? this._defaultPassword;
     const isFirstLaunch = await this._userAgent.firstLaunch();
 
@@ -385,7 +397,7 @@ export class AuthManager {
 
     const { connectedDid, delegateDid } = resolveIdentityDids(identity);
 
-    const identityInfo: IdentityInfo = {
+    const identityInfo: AgentSessionIdentity = {
       didUri       : connectedDid,
       name         : identity.metadata.name,
       connectedDid : identity.metadata.connectedDid,
@@ -496,17 +508,17 @@ export class AuthManager {
                 messageType   : DwnInterface.RecordsRead,
                 messageParams : { filter: { recordId: grantId } },
               });
-              if (readReply.status.code !== 200 || !readReply.entry) { continue; }
+              if (readReply.status.code !== 200 || !readReply.entry?.recordsWrite) { continue; }
               // Reconstruct DwnDataEncodedRecordsWriteMessage: RecordsRead returns
               // data as a stream, but PermissionGrant.parse needs encodedData.
               const grantDataBytes = readReply.entry.data
                 ? await DataStream.toBytes(readReply.entry.data)
                 : new Uint8Array(0);
-              const grantMsgWithData = {
+              const grantMsgWithData: DwnDataEncodedRecordsWriteMessage = {
                 ...readReply.entry.recordsWrite,
                 encodedData: Convert.uint8Array(grantDataBytes).toBase64Url(),
               };
-              const grant = DwnPermissionGrant.parse(grantMsgWithData as any);
+              const grant = DwnPermissionGrant.parse(grantMsgWithData);
 
               // Self-healing: ensure the revocation grant is on the remote
               // DWN. The best-effort fanout at connect time may have failed.
@@ -519,7 +531,19 @@ export class AuthManager {
                     messageParams : { filter: { recordId: revocationGrantId } },
                   });
                   if (revGrantReply.status.code === 200 && revGrantReply.entry?.recordsWrite) {
-                    const { encodedData: revGrantEncoded, ...revGrantRaw } = revGrantReply.entry.recordsWrite as any;
+                    // Strip `encodedData` from the wire payload — the
+                    // bytes are sent via `data` (Blob) on the next line.
+                    // `RecordsWriteMessage` doesn't declare `encodedData`,
+                    // but the wire-format reply may include it; widen the
+                    // local type to acknowledge that without `any`.
+                    // NOSONAR S4325 false positive: the cast is required to
+                    // typecheck the destructuring of the undeclared
+                    // optional `encodedData` property; removing it fails
+                    // TS2339. Sonar reads the intersection-with-optional-
+                    // field as a no-op widening, which it isn't here.
+                    type RecordsWriteWireMessage = RecordsWriteMessage & { encodedData?: string };
+                    const { encodedData: _encoded, ...revGrantRaw } =
+                      revGrantReply.entry.recordsWrite as RecordsWriteWireMessage; // NOSONAR
                     const revGrantData = revGrantReply.entry.data
                       ? new Blob([await DataStream.toBytes(revGrantReply.entry.data) as BlobPart])
                       : undefined;
@@ -552,7 +576,7 @@ export class AuthManager {
               // delivery, the owner-side authority source won't see it.
               let remoteDelivered = false;
               if (revocationMessage && remoteDwnUrls.length > 0) {
-                const { encodedData, ...rawMessage } = revocationMessage as any;
+                const { encodedData, ...rawMessage } = revocationMessage;
                 const data = encodedData
                   ? new Blob([Convert.base64Url(encodedData).toUint8Array() as BlobPart])
                   : undefined;
@@ -783,7 +807,7 @@ export class AuthManager {
    * Each identity has a DID URI, name, and optional connected DID
    * (for wallet-connected/delegated identities).
    */
-  async listIdentities(): Promise<IdentityInfo[]> {
+  async listIdentities(): Promise<AgentSessionIdentity[]> {
     const identities = await this._userAgent.identity.list();
     return identities.map((identity: BearerIdentity) => ({
       didUri       : identity.did.uri,
@@ -815,7 +839,7 @@ export class AuthManager {
     await this._storage.set(STORAGE_KEYS.PREVIOUSLY_CONNECTED, 'true');
     await this._storage.set(STORAGE_KEYS.ACTIVE_IDENTITY, connectedDid);
 
-    const identityInfo: IdentityInfo = {
+    const identityInfo: AgentSessionIdentity = {
       didUri       : connectedDid,
       name         : identity.metadata.name,
       connectedDid : identity.metadata.connectedDid,
@@ -954,45 +978,37 @@ export class AuthManager {
   /**
    * Determine whether the given options indicate a local connect flow.
    *
-   * Local connect is indicated by the presence of `password`,
-   * `createIdentity`, or `recoveryPhrase` — signals that the caller
-   * is managing its own vault/identity lifecycle. In non-browser
-   * environments, local connect is the fallback.
+   * Handler intent is asserted by the presence of a non-empty `protocols`
+   * array OR a non-null `connectHandler`; everything else (including the
+   * no-options case, an empty `protocols: []`, and `null` values from JS
+   * callers) routes to local. An empty `protocols` array is intentionally
+   * NOT a handler signal — it carries no permission scopes for the handler
+   * to authorize, so treating it as handler-flow would produce a zero-grant
+   * "connected" session indistinguishable from a denied connect.
+   *
+   * Acts as a TypeScript type guard: a `true` return narrows `options` to
+   * `LocalConnectOptions | undefined` at call sites, so the routing in
+   * {@link AuthManager.connect} can dispatch without unsafe casts.
    */
-  private _isLocalConnect(options?: ConnectOptions): boolean {
-    const o = (options ?? {}) as Record<string, unknown>;
-
-    // If any local-connect-specific keys are present, it's definitely local.
-    const hasLocalSignals = (
-      o.password !== undefined ||
-      o.createIdentity !== undefined ||
-      o.recoveryPhrase !== undefined ||
-      o.dwnEndpoints !== undefined ||
-      o.metadata !== undefined
-    );
-    if (hasLocalSignals) { return true; }
-
-    // If any handler-connect signals are present, use the handler flow.
-    const hasHandlerSignals = (
-      o.protocols !== undefined ||
-      o.connectHandler !== undefined
-    );
-    if (hasHandlerSignals) { return false; }
-
-    // No explicit signals → default to local connect.
-    // Callers that want handler-based connect must provide protocols
-    // or a connectHandler.
+  private _isLocalConnect(options?: ConnectOptions): options is LocalConnectOptions | undefined {
+    if (options === undefined || options === null) { return true; }
+    if ('protocols' in options && Array.isArray(options.protocols) && options.protocols.length > 0) { return false; }
+    if ('connectHandler' in options && options.connectHandler !== undefined && options.connectHandler !== null) { return false; }
     return true;
   }
 
   /**
    * Run a handler-based (delegated) connect flow.
    *
-   * 1. Initialize the vault (agent-only, no identity).
-   * 2. Normalize protocol permission requests.
-   * 3. Delegate to the connect handler for credential acquisition.
-   * 4. Import the delegate DID, process grants, set up sync.
-   * 5. Finalize and return the AuthSession.
+   * Handler resolution happens BEFORE any vault I/O so a misconfigured call
+   * (no handler reachable) fails fast without mutating on-disk state.
+   *
+   * 1. Resolve the connect handler (fast-fail when none is reachable).
+   * 2. Initialize the vault (agent-only, no identity).
+   * 3. Normalize protocol permission requests.
+   * 4. Delegate to the connect handler for credential acquisition.
+   * 5. Import the delegate DID, process grants, set up sync.
+   * 6. Finalize and return the AuthSession.
    */
   private async _handlerConnect(
     options?: HandlerConnectOptions,
@@ -1001,15 +1017,8 @@ export class AuthManager {
     const { userAgent, emitter, storage } = ctx;
     const sync = options?.sync ?? ctx.defaultSync;
 
-    // 1. Initialize vault (agent-only, no identity).
-    const isFirstLaunch = await userAgent.firstLaunch();
-    const password = await resolvePassword(ctx, undefined, isFirstLaunch);
-    await ensureVaultReady({ userAgent, emitter, password, isFirstLaunch });
-
-    // 2. Normalize protocol requests.
-    const permissionRequests = normalizeProtocolRequests(options?.protocols);
-
-    // 3. Resolve the handler.
+    // 1. Resolve the handler FIRST. Anything past this point may mutate the
+    //    vault on disk, so misconfiguration must fail before that happens.
     const handler = options?.connectHandler ?? this._connectHandler;
     if (!handler) {
       throw new Error(
@@ -1019,6 +1028,16 @@ export class AuthManager {
       );
     }
 
+    // 2. Initialize vault (agent-only, no identity). The per-call password
+    //    (when supplied via `HandlerConnectOptions.password`) wins over the
+    //    manager default, matching the behavior of the local-connect flow.
+    const isFirstLaunch = await userAgent.firstLaunch();
+    const password = await resolvePassword(ctx, options?.password, isFirstLaunch);
+    await ensureVaultReady({ userAgent, emitter, password, isFirstLaunch });
+
+    // 3. Normalize protocol requests.
+    const permissionRequests = normalizeProtocolRequests(options?.protocols);
+
     // 4. Delegate to the handler.
     const result = await handler.requestAccess({ permissionRequests });
     if (!result) {
@@ -1033,14 +1052,22 @@ export class AuthManager {
     const identity = await importDelegateAndSetupSync({
       userAgent, delegatePortableDid, connectedDid, delegateGrants,
       delegateDecryptionKeys, delegateContextKeys, delegateMultiPartyProtocols,
-      sessionRevocations,
       flowName: 'Connect',
     });
 
-    // 6. Finalize session.
+    // 6. Finalize session. Pass the transient delegate state explicitly
+    // so `persistOrClearDelegateSecrets` doesn't need to read it back
+    // off the identity (which was the old `(identity as any)._foo`
+    // smuggling pattern).
     return finalizeDelegateSession({
       userAgent, emitter, storage, identity,
-      connectedDid, delegateDid: delegatePortableDid.uri, sync,
+      connectedDid, delegateDid   : delegatePortableDid.uri, sync,
+      delegateState : {
+        delegateDecryptionKeys,
+        delegateContextKeys,
+        delegateMultiPartyProtocols,
+        sessionRevocations,
+      },
     });
   }
 
@@ -1070,8 +1097,13 @@ export class AuthManager {
    * Consolidates the duplicated concurrency guard, `_isConnecting` flag management,
    * session assignment, and state transition across `connect()`, `walletConnect()`,
    * `importFromPhrase()`, and `importFromPortable()`.
+   *
+   * Also short-circuits if the manager has already been shut down — using
+   * a closed manager would otherwise fail deep inside sync/storage with an
+   * unhelpful error.
    */
   private async _withConnect(fn: () => Promise<AuthSession>): Promise<AuthSession> {
+    this._guardShutdown();
     this._guardConcurrency();
     this._isConnecting = true;
 
@@ -1186,4 +1218,13 @@ export class AuthManager {
       );
     }
   }
+
+  private _guardShutdown(): void {
+    if (this._isShutDown) {
+      throw new Error(
+        '[@enbox/auth] AuthManager has been shut down and cannot be reused. ' +
+        'Create a new instance via AuthManager.create().'
+      );
+    }
+  }
 }

package/src/connect/lifecycle.ts

@@ -15,11 +15,11 @@
  */
 
 import type { PortableDid } from '@enbox/dids';
-import type { BearerIdentity, DelegateContextKey, DelegateDecryptionKey, DwnDataEncodedRecordsWriteMessage, EnboxUserAgent } from '@enbox/agent';
+import type { AgentSessionIdentity, BearerIdentity, DelegateContextKey, DelegateDecryptionKey, DwnDataEncodedRecordsWriteMessage, EnboxUserAgent } from '@enbox/agent';
 
 import type { AuthEventEmitter } from '../events.js';
 import type { PasswordProvider } from '../password-provider.js';
-import type { IdentityInfo, RegistrationOptions, StorageAdapter, SyncOption } from '../types.js';
+import type { RegistrationOptions, StorageAdapter, SyncOption } from '../types.js';
 
 import { Convert } from '@enbox/common';
 import type { GenericMessage } from '@enbox/dwn-sdk-js';
@@ -91,11 +91,15 @@ export async function resolvePassword(
 
   password ??= INSECURE_DEFAULT_PASSWORD;
 
-  if (password === INSECURE_DEFAULT_PASSWORD) {
+  // Two cases reach this branch: no password was supplied at any level
+  // (and we fell through to the insecure default), or the caller explicitly
+  // supplied an empty string. Both produce a vault with effectively zero
+  // password protection — surface a single warning in both cases.
+  if (password === INSECURE_DEFAULT_PASSWORD || password.length === 0) {
     console.warn(
-      '[@enbox/auth] SECURITY WARNING: No password set. Using insecure default. ' +
-      'Set a password via AuthManager.create({ password }) or connect({ password }) ' +
-      'to protect your identity vault.'
+      '[@enbox/auth] SECURITY WARNING: No password set (or an empty string was supplied). ' +
+      'Using an insecure default; this leaves the identity vault unprotected. ' +
+      'Set a non-empty password via AuthManager.create({ password }) or connect({ password }).'
     );
   }
 
@@ -270,9 +274,11 @@ export function deriveSyncScopeFromGrants(grants: DwnPermissionGrant[]): 'all' |
   const protocols = new Set<string>();
 
   for (const grant of grants) {
-    const scope = grant.scope as any;
-
-    // Only Messages.Read grants authorize sync.
+    // Only Messages.Read grants authorize sync. The discriminated union
+    // (`PermissionScope = Messages | Protocols | Records`) narrows
+    // `scope.protocol` to `string | undefined` after the interface +
+    // method checks — no cast needed.
+    const { scope } = grant;
     if (scope.interface !== 'Messages' || scope.method !== 'Read') {
       continue;
     }
@@ -282,7 +288,7 @@ export function deriveSyncScopeFromGrants(grants: DwnPermissionGrant[]): 'all' |
       continue;
     }
 
-    const protocol = scope.protocol as string | undefined;
+    const protocol = scope.protocol;
     if (protocol === undefined) {
       // Unrestricted Messages.Read — delegate can sync all protocols.
       return 'all';
@@ -331,10 +337,15 @@ export async function deriveActiveSyncScope(
   if (revocationResponse.reply.status.code !== 200) { return []; }
 
   // Build the set of revoked grant IDs from revocation parent context.
+  // `descriptor.parentId` is the canonical location; the top-level
+  // `parentId` is a legacy/alternate-format fallback. Typed narrowly
+  // (no `any`) so additions to the shape land in the type system.
   const revokedGrantIds = new Set<string>();
   if (revocationResponse.reply.entries) {
     for (const entry of revocationResponse.reply.entries as DwnDataEncodedRecordsWriteMessage[]) {
-      const parentId = (entry as any).descriptor?.parentId ?? (entry as any).parentId;
+      const parentId =
+        entry.descriptor.parentId
+        ?? (entry as { parentId?: string }).parentId;
       if (parentId) { revokedGrantIds.add(parentId); }
     }
   }
@@ -586,13 +597,12 @@ export async function importDelegateAndSetupSync(params: {
   delegateDecryptionKeys?: DelegateDecryptionKey[];
   delegateContextKeys?: DelegateContextKey[];
   delegateMultiPartyProtocols?: string[];
-  sessionRevocations?: { grantId: string; revocationGrantId: string }[];
   flowName: string;
 }): Promise<BearerIdentity> {
   const {
     userAgent, delegatePortableDid, connectedDid, delegateGrants,
     delegateDecryptionKeys, delegateContextKeys, delegateMultiPartyProtocols,
-    sessionRevocations, flowName,
+    flowName,
   } = params;
 
   let identity: BearerIdentity | undefined;
@@ -683,20 +693,11 @@ export async function importDelegateAndSetupSync(params: {
     // Doing a manual pull first would double the startup burst and can
     // trigger rate limits on the remote DWN.
 
-    // Store protocol keys on the identity for finalize to persist.
-    if (delegateDecryptionKeys && delegateDecryptionKeys.length > 0) {
-      (identity as any)._delegateDecryptionKeys = delegateDecryptionKeys;
-    }
-    if (delegateContextKeys && delegateContextKeys.length > 0) {
-      (identity as any)._delegateContextKeys = delegateContextKeys;
-    }
-    if (delegateMultiPartyProtocols && delegateMultiPartyProtocols.length > 0) {
-      (identity as any)._delegateMultiPartyProtocols = delegateMultiPartyProtocols;
-    }
-    if (sessionRevocations && sessionRevocations.length > 0) {
-      (identity as any)._sessionRevocations = sessionRevocations;
-    }
-
+    // Delegate protocol keys / multi-party state / revocation map are
+    // passed back to the caller explicitly via the return value so
+    // `finalizeDelegateSession` can persist them. (The previous flow
+    // smuggled them through `(identity as any)._foo`, which traded
+    // type safety for one fewer return value.)
     return identity;
   } catch (error: unknown) {
     if (identity) {
@@ -720,6 +721,21 @@ export async function importDelegateAndSetupSync(params: {
 
 // ─── finalizeDelegateSession ────────────────────────────────────
 
+/**
+ * Transient state produced by a successful delegated connect flow that
+ * `finalizeDelegateSession` persists into the SecretStore + storage
+ * adapter. Passed explicitly through the call chain rather than
+ * smuggled via private fields on `BearerIdentity`.
+ *
+ * @internal
+ */
+export type DelegateSessionState = {
+  delegateDecryptionKeys?: DelegateDecryptionKey[];
+  delegateContextKeys?: DelegateContextKey[];
+  delegateMultiPartyProtocols?: string[];
+  sessionRevocations?: { grantId: string; revocationGrantId: string }[];
+};
+
 /**
  * Build an `AuthSession` for a delegated connect flow (DWeb Connect or
  * relay WalletConnect). Starts sync and persists delegate/connected DID
@@ -735,8 +751,12 @@ export async function finalizeDelegateSession(params: {
   connectedDid: string;
   delegateDid: string;
   sync: SyncOption | undefined;
+  delegateState?: DelegateSessionState;
 }): Promise<AuthSession> {
-  const { userAgent, emitter, storage, identity, connectedDid, delegateDid, sync } = params;
+  const {
+    userAgent, emitter, storage, identity, connectedDid, delegateDid, sync,
+    delegateState = {},
+  } = params;
 
   await startSyncIfEnabled(userAgent, sync);
 
@@ -752,7 +772,7 @@ export async function finalizeDelegateSession(params: {
   // Persist or clear delegate keys/revocations. Clearing stale values
   // from prior sessions prevents a reconnect with fewer capabilities
   // from retaining old decryption material.
-  await persistOrClearDelegateSecrets(userAgent, storage, identity, extraStorageKeys);
+  await persistOrClearDelegateSecrets(userAgent, storage, extraStorageKeys, delegateState);
 
   // Wire post-connect context key persistence: when the owner creates a
   // new multi-party context, the agent injects the key into the delegate
@@ -837,8 +857,8 @@ export async function finalizeSession(params: {
   await Promise.all(storageWrites);
 
   // When identityName is undefined, no user identity exists (agent-only session).
-  // Build an IdentityInfo with the agent DID as a fallback.
-  const identityInfo: IdentityInfo = {
+  // Build an AgentSessionIdentity with the agent DID as a fallback.
+  const identityInfo: AgentSessionIdentity = {
     didUri       : connectedDid,
     name         : identityName ?? 'Agent',
     connectedDid : identityConnectedDid,
@@ -869,11 +889,15 @@ export async function finalizeSession(params: {
 async function persistOrClearDelegateSecrets(
   userAgent: EnboxUserAgent,
   storage: StorageAdapter,
-  identity: BearerIdentity,
   extraStorageKeys: Record<string, string>,
+  delegateState: DelegateSessionState,
 ): Promise<void> {
-  const delegateDecryptionKeys = (identity as any)._delegateDecryptionKeys as DelegateDecryptionKey[] | undefined;
-  const delegateContextKeys = (identity as any)._delegateContextKeys as DelegateContextKey[] | undefined;
+  const {
+    delegateDecryptionKeys,
+    delegateContextKeys,
+    delegateMultiPartyProtocols,
+    sessionRevocations,
+  } = delegateState;
 
   // Persist or clear keys in the SecretStore + legacy StorageAdapter.
   const secretWrites: Promise<void>[] = [];
@@ -895,14 +919,12 @@ async function persistOrClearDelegateSecrets(
     try { await storage.remove(STORAGE_KEYS.DELEGATE_CONTEXT_KEYS); } catch { /* best-effort */ }
   }
 
-  const delegateMultiPartyProtocols = (identity as any)._delegateMultiPartyProtocols as string[] | undefined;
   if (delegateMultiPartyProtocols?.length) {
     extraStorageKeys[STORAGE_KEYS.DELEGATE_MULTI_PARTY_PROTOCOLS] = JSON.stringify(delegateMultiPartyProtocols);
   } else {
     try { await storage.remove(STORAGE_KEYS.DELEGATE_MULTI_PARTY_PROTOCOLS); } catch { /* best-effort */ }
   }
 
-  const sessionRevocations = (identity as any)._sessionRevocations as { grantId: string; revocationGrantId: string }[] | undefined;
   if (sessionRevocations?.length) {
     extraStorageKeys[STORAGE_KEYS.SESSION_REVOCATIONS] = JSON.stringify(sessionRevocations);
   } else {