@loams/client 0.1.1 → 0.1.2

package/README.md

@@ -2,7 +2,7 @@
 
 # The TypeScript SDK (`@loams/client`)
 
-> **Preview.** `0.1.1` tracks the Loams preview server and may change between previews; pin an exact version. Installed with `npm install @loams/client@preview`.
+> **Preview.** `0.1.2` tracks the Loams preview server and may change between previews; pin an exact version. Installed with `npm install @loams/client@preview`.
 
 Design §44 §7 and §10.2: the SDK is a `Loams` object with namespaced modules,
 generated from the `loams.options.v1` annotations on the protos, over the
@@ -29,7 +29,7 @@ generator inputs stay outside the workspace, next to `proto/`.
 npm i @loams/client        # and @loams/live for Live's stubs
 ```
 
-`0.1.1` tracks Loams 0.1.1; in 0.x the API may change between minor versions.
+`0.1.2` tracks Loams 0.1.2; in 0.x the API may change between minor versions.
 
 ## Using it
 
@@ -55,8 +55,13 @@ try {
 ```
 
 One port serves the Connect protocol, gRPC and gRPC-Web (D600), so the same
-object works in a browser, in Node, in Deno and in Bun. The default transport is
-Connect over `fetch`. For HTTP/2 gRPC on a server:
+object works in a browser, in Node and in Bun. The default transport is
+Connect over `fetch`.
+
+Deno is not supported (design 79, D1790): Deno's team is ending the runtime's
+development. The default `fetch` transport uses only standard Web APIs, so the
+SDK may still run on Deno, but we don't test it there or promise it works.
+Moving off Deno? See [Moving from Deno to Bun](https://github.com/ostrium-labs/loams/blob/dev/docs/guides/migrate-deno-to-bun.md). For HTTP/2 gRPC on a server:
 
 ```ts
 import { Loams, createNodeTransport } from '@loams/client/node';
@@ -143,6 +148,25 @@ scenario as a program, type-checked in CI. The session's token is used only for
 collection and SQL reads: a graph's token names one graph (SDKP-17). Durable
 workflows use the Resonate SDK pointed at `LOAMS_ENDPOINT/durable/` (SDKP-1).
 
+## Cloudflare Workers
+
+`@loams/client` runs in Cloudflare Workers (workerd) with no `nodejs_compat` flag and no `fetch` override. The
+default transport detects workerd (`navigator.userAgent === "Cloudflare-Workers"`) and sends
+`redirect: "manual"`, because connect-web's default `redirect: "error"` is rejected by Workers. Loams calls never
+redirect, so nothing changes for them. Other runtimes are untouched: in a browser `manual` would hide a redirect
+as an opaque response.
+
+```ts
+const loams = new Loams({ endpoint: env.LOAMS_URL, token: env.LOAMS_TOKEN });
+```
+
+To control `fetch` yourself (a proxy, a service binding, a test double), pass it through the transport options;
+it is used exactly as given, so set `redirect: "manual"` in it if you also run in workerd:
+
+```ts
+new Loams({ endpoint, transportOptions: { fetch: env.GATEWAY.fetch.bind(env.GATEWAY) } });
+```
+
 ## What is generated and what is hand-written
 
 Design §44 §7.3 draws the line, and this SDK follows it exactly.

package/dist/index.d.ts

@@ -15,5 +15,6 @@ export { paginate, pageFields, type PageFetcher, type PageRequestOptions } from
 export { BASE_DELAY_MS, DEFAULT_MAX_RETRIES, MAX_DELAY_MS, MAX_SERVER_DELAY_MS, backoffMs, isRetryableCode, shouldRetry, sleep, } from './runtime/retry.js';
 export { watch, type CursorOf, type ResumeOptions, type StreamOpener } from './runtime/streams.js';
 export { apiKey, envToken, oidcExchange, refreshing, staticToken, type TokenSource, } from './runtime/token-source.js';
+export { JWT_BEARER_GRANT, MACHINE_KEY_ASSERTION_TTL_S, MACHINE_KEY_REFRESH_EARLY_S, machineKey, type MachineKeyFile, type MachineKeyOptions, } from './runtime/machine-key.js';
 export { createLoamsTransport, headersInterceptor, type TransportOptions, } from './runtime/transports.js';
 export { uuidv7, uuidv7Time } from './runtime/uuidv7.js';

package/dist/index.js

@@ -37,5 +37,6 @@ export { paginate, pageFields } from './runtime/pagination.js';
 export { BASE_DELAY_MS, DEFAULT_MAX_RETRIES, MAX_DELAY_MS, MAX_SERVER_DELAY_MS, backoffMs, isRetryableCode, shouldRetry, sleep, } from './runtime/retry.js';
 export { watch } from './runtime/streams.js';
 export { apiKey, envToken, oidcExchange, refreshing, staticToken, } from './runtime/token-source.js';
+export { JWT_BEARER_GRANT, MACHINE_KEY_ASSERTION_TTL_S, MACHINE_KEY_REFRESH_EARLY_S, machineKey, } from './runtime/machine-key.js';
 export { createLoamsTransport, headersInterceptor, } from './runtime/transports.js';
 export { uuidv7, uuidv7Time } from './runtime/uuidv7.js';

package/dist/loams.d.ts

@@ -22,7 +22,7 @@ export interface LoamsOptions {
     auth?: TokenSource | string;
     /**
      * The transport. Defaults to Connect over `fetch` pointed at `endpoint`,
-     * which is the browser, Node, Deno and Bun path (see `runtime/transports.ts`).
+     * which is the browser, Node and Bun path (see `runtime/transports.ts`).
      * `@loams/client/node` exports `createNodeTransport` for HTTP/2 gRPC.
      *
      * A transport carries its own base URL, so a transport passed here must be

package/dist/loams.js

@@ -192,7 +192,7 @@ export class Loams {
         this.system.invalidate();
     }
 }
-/** The process environment, where there is one (Node, Deno, Bun); empty in a
+/** The process environment, where there is one (Node, Bun); empty in a
  * browser. */
 function readEnvironment() {
     const scope = globalThis;

package/dist/node.js

@@ -1,4 +1,4 @@
-// `@loams/client/node`: the Node, Deno and Bun entry point.
+// `@loams/client/node`: the Node and Bun entry point.
 //
 //   import { Loams, createNodeTransport } from '@loams/client/node';
 //

package/dist/runtime/machine-key.d.ts

@@ -0,0 +1,33 @@
+import type { TokenSource } from './token-source.js';
+/** How long an assertion is valid, in seconds. */
+export declare const MACHINE_KEY_ASSERTION_TTL_S = 300;
+/** How long before expiry a token is traded again, in seconds. */
+export declare const MACHINE_KEY_REFRESH_EARLY_S = 60;
+/** The RFC 7523 grant type. */
+export declare const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+/** A machine user's key file, as the identity provider hands it out. */
+export interface MachineKeyFile {
+    type?: string;
+    keyId: string;
+    key: string;
+    userId: string;
+}
+export interface MachineKeyOptions {
+    /** The key file's JSON text, or the parsed file. */
+    keyFile: string | MachineKeyFile;
+    /** The identity provider's issuer URL (`https://auth.loams.dev`). */
+    issuer: string;
+    /** The Loams project's id at the identity provider: the audience Loams checks. */
+    project: string;
+    /** Injected for tests and for hosts with their own `fetch`. */
+    fetch?: typeof globalThis.fetch;
+    /** The clock, in milliseconds (tests). */
+    now?: () => number;
+}
+/**
+ * An agent's token source from its machine key (module header). The key is checked when the
+ * source is built; it is imported into WebCrypto on first use.
+ */
+export declare function machineKey(options: MachineKeyOptions): TokenSource & {
+    readonly userId: string;
+};

package/dist/runtime/machine-key.js

@@ -0,0 +1,174 @@
+// An agent's token from its identity provider's private-key JWT key (design 76 §10, D1607;
+// plan IA1, IA4 Task 2).
+//
+// An agent is a machine user at the identity provider (Zitadel). Its key file is the JSON the
+// provider hands out once (`{"type": "serviceaccount", "keyId", "key", "userId"}`). The source
+// signs an RFC 7523 assertion (RS256, `kid` = `keyId`, `iss` = `sub` = `userId`, `aud` = the
+// issuer, valid for 5 minutes) with WebCrypto, trades it at `<issuer>/oauth/v2/token` for an
+// access token whose audience is the Loams project
+// (`urn:zitadel:iam:org:project:id:<project>:aud`), caches it, and trades again a minute
+// before it expires or when the server answers `token_expired`. Concurrent callers share one
+// trade. The private key never leaves the process. A sandboxed agent holds no key: agentd
+// vends it a 15-minute token file instead (D1618).
+/** How long an assertion is valid, in seconds. */
+export const MACHINE_KEY_ASSERTION_TTL_S = 300;
+/** How long before expiry a token is traded again, in seconds. */
+export const MACHINE_KEY_REFRESH_EARLY_S = 60;
+/** The RFC 7523 grant type. */
+export const JWT_BEARER_GRANT = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
+const b64url = (bytes) => {
+    let text = '';
+    for (const b of bytes) {
+        text += String.fromCharCode(b);
+    }
+    return btoa(text).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/u, '');
+};
+const utf8 = (text) => Uint8Array.from(new TextEncoder().encode(text));
+function derLength(n) {
+    if (n < 0x80) {
+        return Uint8Array.of(n);
+    }
+    const out = [];
+    for (let v = n; v > 0; v >>= 8) {
+        out.unshift(v & 0xff);
+    }
+    return Uint8Array.of(0x80 | out.length, ...out);
+}
+function der(tag, ...parts) {
+    const body = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let at = 0;
+    for (const p of parts) {
+        body.set(p, at);
+        at += p.length;
+    }
+    const length = derLength(body.length);
+    const out = new Uint8Array(1 + length.length + body.length);
+    out[0] = tag;
+    out.set(length, 1);
+    out.set(body, 1 + length.length);
+    return out;
+}
+/** PKCS #1 `RSAPrivateKey` wrapped as PKCS #8, which is what WebCrypto imports. */
+function pkcs1ToPkcs8(pkcs1) {
+    const version = Uint8Array.of(0x02, 0x01, 0x00);
+    // rsaEncryption (1.2.840.113549.1.1.1) with NULL parameters.
+    const algorithm = Uint8Array.of(0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00);
+    return der(0x30, version, algorithm, der(0x04, pkcs1));
+}
+function pemToPkcs8(pem) {
+    const match = /-----BEGIN (RSA )?PRIVATE KEY-----([\s\S]+?)-----END (RSA )?PRIVATE KEY-----/u.exec(pem);
+    if (match === null) {
+        throw new Error('machineKey: the key is not a PEM private key');
+    }
+    const bytes = Uint8Array.from(atob((match[2] ?? '').replace(/\s+/gu, '')), (c) => c.charCodeAt(0));
+    return match[1] === undefined ? bytes : pkcs1ToPkcs8(bytes);
+}
+function parseKeyFile(keyFile) {
+    let file;
+    if (typeof keyFile === 'string') {
+        try {
+            file = JSON.parse(keyFile);
+        }
+        catch {
+            throw new Error('machineKey: not a machine key file');
+        }
+    }
+    else {
+        file = keyFile;
+    }
+    if (file.type !== undefined && file.type !== '' && file.type !== 'serviceaccount') {
+        throw new Error(`machineKey: a ${JSON.stringify(file.type)} key is not a machine user's key`);
+    }
+    if (!file.keyId || !file.userId || !file.key) {
+        throw new Error('machineKey: the key file has no keyId, key or userId');
+    }
+    return file;
+}
+/**
+ * An agent's token source from its machine key (module header). The key is checked when the
+ * source is built; it is imported into WebCrypto on first use.
+ */
+export function machineKey(options) {
+    const file = parseKeyFile(options.keyFile);
+    const issuer = options.issuer.replace(/\/+$/u, '');
+    if (!/^https?:\/\/[^/]+/u.test(issuer)) {
+        throw new Error(`machineKey: the issuer ${JSON.stringify(issuer)} is not a URL`);
+    }
+    if (options.project === '') {
+        throw new Error('machineKey: the Loams project id (the audience) is empty');
+    }
+    const pkcs8 = pemToPkcs8(file.key);
+    const scope = `openid urn:zitadel:iam:org:project:id:${options.project}:aud`;
+    const doFetch = options.fetch ?? globalThis.fetch;
+    const now = options.now ?? Date.now;
+    let signingKey;
+    let cached;
+    let inFlight;
+    const assertion = async (issuedAtMs) => {
+        signingKey ??= globalThis.crypto.subtle.importKey('pkcs8', pkcs8, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['sign']);
+        const iat = Math.floor(issuedAtMs / 1000);
+        const header = b64url(utf8(JSON.stringify({ alg: 'RS256', typ: 'JWT', kid: file.keyId })));
+        const claims = b64url(utf8(JSON.stringify({
+            iss: file.userId,
+            sub: file.userId,
+            aud: issuer,
+            iat,
+            exp: iat + MACHINE_KEY_ASSERTION_TTL_S,
+        })));
+        const signing = `${header}.${claims}`;
+        const signature = await globalThis.crypto.subtle.sign('RSASSA-PKCS1-v1_5', await signingKey, utf8(signing));
+        return `${signing}.${b64url(new Uint8Array(signature))}`;
+    };
+    const trade = () => {
+        inFlight ??= (async () => {
+            const started = now();
+            const response = await doFetch(`${issuer}/oauth/v2/token`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    grant_type: JWT_BEARER_GRANT,
+                    scope,
+                    assertion: await assertion(started),
+                }).toString(),
+            });
+            if (!response.ok) {
+                const text = (await response.text()).slice(0, 512);
+                throw new Error(`the token endpoint refused the machine key (${response.status}): ${text}`);
+            }
+            const body = (await response.json());
+            if (!body.access_token) {
+                throw new Error('the token endpoint answered no access_token');
+            }
+            const life = body.expires_in ?? 900;
+            const early = Math.min(MACHINE_KEY_REFRESH_EARLY_S, life / 2);
+            cached = { token: body.access_token, refreshAt: started + (life - early) * 1000 };
+            return body.access_token;
+        })()
+            .catch((error) => {
+            cached = undefined;
+            throw error;
+        })
+            .finally(() => {
+            inFlight = undefined;
+        });
+        return inFlight;
+    };
+    return {
+        userId: file.userId,
+        token: async () => {
+            if (cached !== undefined && now() < cached.refreshAt) {
+                return cached.token;
+            }
+            try {
+                return await trade();
+            }
+            catch {
+                // A failed trade sends no credential; `refresh()` reports the reason.
+                return undefined;
+            }
+        },
+        refresh: async () => {
+            await trade();
+        },
+    };
+}

package/dist/runtime/token-source.d.ts

@@ -32,7 +32,7 @@ export declare function envToken(environment?: Record<string, string | undefined
  * rather than one per request.
  */
 export declare function refreshing(fetchToken: () => Promise<string>): TokenSource;
-/** The RFC 8693 token exchange a person signed in through Authentik needs
+/** The RFC 8693 token exchange a person signed in at the IdP needs
  * (design §44 §7.4, D608; §19 §5.2).
  *
  * The instance's `/oauth/token` protocol endpoint takes the identity token and

package/dist/runtime/token-source.js

@@ -64,7 +64,7 @@ export function refreshing(fetchToken) {
     };
     return source;
 }
-/** The RFC 8693 token exchange a person signed in through Authentik needs
+/** The RFC 8693 token exchange a person signed in at the IdP needs
  * (design §44 §7.4, D608; §19 §5.2).
  *
  * The instance's `/oauth/token` protocol endpoint takes the identity token and

package/dist/runtime/transports.d.ts

@@ -33,11 +33,32 @@ export interface TransportOptions {
      * it; this only tells the transport what the request will look like.
      */
     interceptors?: Parameters<typeof createConnectTransport>[0]['interceptors'];
+    /**
+     * The `fetch` the transport calls, for a runtime whose `fetch` needs
+     * wrapping (a proxy, a test double, instrumentation). When set it is used
+     * as given. When unset, the global `fetch` is used, wrapped to send
+     * `redirect: "manual"` in Cloudflare Workers (see `workersFetch`).
+     */
+    fetch?: typeof globalThis.fetch;
 }
+/** True in Cloudflare Workers (workerd), which identifies itself this way. */
+export declare function isWorkerd(): boolean;
+/**
+ * Wraps `fetch` to send `redirect: "manual"`.
+ *
+ * connect-web sets `redirect: "error"` on every request, which Workers rejects
+ * ("Invalid redirect value, must be one of 'follow' or 'manual'"). Loams calls
+ * never redirect, so `manual` loses nothing there; it is applied only in
+ * workerd because in a browser `manual` turns a redirect into an opaque
+ * response that hides the failure `error` reports.
+ */
+export declare function workersFetch(inner: typeof globalThis.fetch): typeof globalThis.fetch;
+/** The `fetch` a transport built from `options` uses, or undefined for connect-web's default. */
+export declare function transportFetch(options: TransportOptions): typeof globalThis.fetch | undefined;
 /**
  * The default transport: Connect over `fetch`.
  *
- * Works in a browser, in Node 18+ (which has `fetch`), in Deno and in Bun, and
+ * Works in a browser, in Node 18+ (which has `fetch`) and in Bun, and
  * speaks both the Connect unary protocol and gRPC-Web, which is what the server
  * serves on the same port (D600). This is the browser path as a first-class
  * case, not a fallback: it is the default in every runtime.

package/dist/runtime/transports.js

@@ -7,7 +7,7 @@
 //   over `fetch`, which is what `@connectrpc/connect-web` implements. Because
 //   the API serves gRPC-Web on the same port as everything else, the same
 //   client code runs in a browser with no proxy and no sidecar.
-// - **Node, Deno and Bun** can do HTTP/2 gRPC. `@connectrpc/connect-node`
+// - **Node and Bun** can do HTTP/2 gRPC. `@connectrpc/connect-node`
 //   implements it over `node:http2`, and the server's plaintext listener means
 //   no ALPN to negotiate — the client asks for HTTP/2 with prior knowledge.
 //
@@ -17,22 +17,48 @@
 // HTTP/2 transport in a browser bundle would be a build error, which is the
 // right failure.
 import { createConnectTransport } from '@connectrpc/connect-web';
+/** True in Cloudflare Workers (workerd), which identifies itself this way. */
+export function isWorkerd() {
+    return typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers';
+}
+/**
+ * Wraps `fetch` to send `redirect: "manual"`.
+ *
+ * connect-web sets `redirect: "error"` on every request, which Workers rejects
+ * ("Invalid redirect value, must be one of 'follow' or 'manual'"). Loams calls
+ * never redirect, so `manual` loses nothing there; it is applied only in
+ * workerd because in a browser `manual` turns a redirect into an opaque
+ * response that hides the failure `error` reports.
+ */
+export function workersFetch(inner) {
+    return (input, init) => inner(input, init === undefined ? init : { ...init, redirect: 'manual' });
+}
+/** The `fetch` a transport built from `options` uses, or undefined for connect-web's default. */
+export function transportFetch(options) {
+    if (options.fetch !== undefined) {
+        return options.fetch;
+    }
+    // Resolve the global lazily so a later polyfill or test stub is honoured.
+    return isWorkerd() ? workersFetch((input, init) => globalThis.fetch(input, init)) : undefined;
+}
 /**
  * The default transport: Connect over `fetch`.
  *
- * Works in a browser, in Node 18+ (which has `fetch`), in Deno and in Bun, and
+ * Works in a browser, in Node 18+ (which has `fetch`) and in Bun, and
  * speaks both the Connect unary protocol and gRPC-Web, which is what the server
  * serves on the same port (D600). This is the browser path as a first-class
  * case, not a fallback: it is the default in every runtime.
  */
 export function createLoamsTransport(options = {}) {
     const interceptors = transportInterceptors(options);
+    const fetchImpl = transportFetch(options);
     return createConnectTransport({
         baseUrl: options.baseUrl ?? '',
         useBinaryFormat: options.useBinaryFormat ?? true,
         ...(options.defaultTimeoutMs === undefined
             ? {}
             : { defaultTimeoutMs: options.defaultTimeoutMs }),
+        ...(fetchImpl === undefined ? {} : { fetch: fetchImpl }),
         ...(interceptors.length === 0 ? {} : { interceptors }),
     });
 }

package/dist/vendor/proto/gen/loams/auth/v1/auth_pb.d.ts

@@ -110,7 +110,8 @@ export declare const ListProvidersResponseSchema: GenMessage<ListProvidersRespon
  */
 export type CompleteSetupRequest = Message<"loams.auth.v1.CompleteSetupRequest"> & {
     /**
-     * The token `loams` printed at first start; not needed from loopback.
+     * This engine's LOAMS_SETUP_TOKEN. Required when authentication is on;
+     * ignored with LOAMS_AUTH_MODE=off.
      *
      * @generated from field: string setup_token = 1;
      */
@@ -333,7 +334,11 @@ export declare enum OidcProviderKind {
     /**
      * @generated from enum value: OIDC_PROVIDER_KIND_GENERIC = 7;
      */
-    GENERIC = 7
+    GENERIC = 7,
+    /**
+     * @generated from enum value: OIDC_PROVIDER_KIND_ZITADEL = 8;
+     */
+    ZITADEL = 8
 }
 /**
  * Describes the enum loams.auth.v1.OidcProviderKind.

package/dist/vendor/proto/gen/loams/auth/v1/auth_pb.js

@@ -9,7 +9,7 @@ import { file_loams_options_v1_options } from "../../options/v1/options_pb.js";
 /**
  * Describes the file loams/auth/v1/auth.proto.
  */
-export const file_loams_auth_v1_auth = /*@__PURE__*/ fileDesc("Chhsb2Ftcy9hdXRoL3YxL2F1dGgucHJvdG8SDWxvYW1zLmF1dGgudjEiVwoMT2lkY1Byb3ZpZGVyEgoKAmlkGAEgASgJEgwKBG5hbWUYAiABKAkSLQoEa2luZBgDIAEoDjIfLmxvYW1zLmF1dGgudjEuT2lkY1Byb3ZpZGVyS2luZCK6AQoHU2Vzc2lvbhIiCgR1c2VyGAEgASgLMhQubG9hbXMuYWRtaW4udjEuVXNlchIgCgNvcmcYAiABKAsyEy5sb2Ftcy5hZG1pbi52MS5PcmcSJQoEcm9sZRgDIAEoDjIXLmxvYW1zLmFkbWluLnYxLk9yZ1JvbGUSEgoKY3NyZl90b2tlbhgEIAEoCRIuCgpleHBpcmVzX2F0GAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCIWChRMaXN0UHJvdmlkZXJzUmVxdWVzdCJ0ChVMaXN0UHJvdmlkZXJzUmVzcG9uc2USEAoIcGFzc3dvcmQYASABKAgSDAoEdG90cBgCIAEoCBIQCghwYXNza2V5cxgDIAEoCBIpCgRvaWRjGAQgAygLMhsubG9hbXMuYXV0aC52MS5PaWRjUHJvdmlkZXIibAoUQ29tcGxldGVTZXR1cFJlcXVlc3QSEwoLc2V0dXBfdG9rZW4YASABKAkSEAoIb3JnX25hbWUYAiABKAkSDAoEbmFtZRgDIAEoCRINCgVlbWFpbBgEIAEoCRIQCghwYXNzd29yZBgFIAEoCSJAChVDb21wbGV0ZVNldHVwUmVzcG9uc2USJwoHc2Vzc2lvbhgBIAEoCzIWLmxvYW1zLmF1dGgudjEuU2Vzc2lvbiITChFHZXRTZXNzaW9uUmVxdWVzdCI9ChJHZXRTZXNzaW9uUmVzcG9uc2USJwoHc2Vzc2lvbhgBIAEoCzIWLmxvYW1zLmF1dGgudjEuU2Vzc2lvbiJKChRDcmVhdGVTZXNzaW9uUmVxdWVzdBINCgVlbWFpbBgBIAEoCRIQCghwYXNzd29yZBgCIAEoCRIRCgl0b3RwX2NvZGUYAyABKAkiQAoVQ3JlYXRlU2Vzc2lvblJlc3BvbnNlEicKB3Nlc3Npb24YASABKAsyFi5sb2Ftcy5hdXRoLnYxLlNlc3Npb24iFgoURGVsZXRlU2Vzc2lvblJlcXVlc3QiFwoVRGVsZXRlU2Vzc2lvblJlc3BvbnNlItgBChREZWNpZGVDb25zZW50UmVxdWVzdBIwCghkZWNpc2lvbhgBIAEoDjIeLmxvYW1zLmF1dGgudjEuQ29uc2VudERlY2lzaW9uEhEKCWNsaWVudF9pZBgCIAEoCRIUCgxyZWRpcmVjdF91cmkYAyABKAkSDQoFc2NvcGUYBCABKAkSEAoIYXVkaWVuY2UYBSABKAkSDQoFc3RhdGUYBiABKAkSFgoOY29kZV9jaGFsbGVuZ2UYByABKAkSHQoVY29kZV9jaGFsbGVuZ2VfbWV0aG9kGAggASgJIiwKFURlY2lkZUNvbnNlbnRSZXNwb25zZRITCgtyZWRpcmVjdF90bxgBIAEoCSqPAgoQT2lkY1Byb3ZpZGVyS2luZBIiCh5PSURDX1BST1ZJREVSX0tJTkRfVU5TUEVDSUZJRUQQABIfChtPSURDX1BST1ZJREVSX0tJTkRfS0VZQ0xPQUsQARIbChdPSURDX1BST1ZJREVSX0tJTkRfT0tUQRACEhwKGE9JRENfUFJPVklERVJfS0lORF9FTlRSQRADEh0KGU9JRENfUFJPVklERVJfS0lORF9HT09HTEUQBBIgChxPSURDX1BST1ZJREVSX0tJTkRfQVVUSEVOVElLEAUSGgoWT0lEQ19QUk9WSURFUl9LSU5EX0RFWBAGEh4KGk9JRENfUFJPVklERVJfS0lORF9HRU5FUklDEAcqagoPQ29uc2VudERlY2lzaW9uEiAKHENPTlNFTlRfREVDSVNJT05fVU5TUEVDSUZJRUQQABIaChZDT05TRU5UX0RFQ0lTSU9OX0FMTE9XEAESGQoVQ09OU0VOVF9ERUNJU0lPTl9ERU5ZEAIy/QUKC0F1dGhTZXJ2aWNlEnIKDUxpc3RQcm92aWRlcnMSIy5sb2Ftcy5hdXRoLnYxLkxpc3RQcm92aWRlcnNSZXF1ZXN0GiQubG9hbXMuYXV0aC52MS5MaXN0UHJvdmlkZXJzUmVzcG9uc2UiFpACAZK1GA8SDWxpc3RQcm92aWRlcnMSbwoNQ29tcGxldGVTZXR1cBIjLmxvYW1zLmF1dGgudjEuQ29tcGxldGVTZXR1cFJlcXVlc3QaJC5sb2Ftcy5hdXRoLnYxLkNvbXBsZXRlU2V0dXBSZXNwb25zZSITkrUYDxINY29tcGxldGVTZXR1cBJmCgpHZXRTZXNzaW9uEiAubG9hbXMuYXV0aC52MS5HZXRTZXNzaW9uUmVxdWVzdBohLmxvYW1zLmF1dGgudjEuR2V0U2Vzc2lvblJlc3BvbnNlIhOQAgGStRgMEgpnZXRTZXNzaW9uEm8KDUNyZWF0ZVNlc3Npb24SIy5sb2Ftcy5hdXRoLnYxLkNyZWF0ZVNlc3Npb25SZXF1ZXN0GiQubG9hbXMuYXV0aC52MS5DcmVhdGVTZXNzaW9uUmVzcG9uc2UiE5K1GA8SDWNyZWF0ZVNlc3Npb24ScgoNRGVsZXRlU2Vzc2lvbhIjLmxvYW1zLmF1dGgudjEuRGVsZXRlU2Vzc2lvblJlcXVlc3QaJC5sb2Ftcy5hdXRoLnYxLkRlbGV0ZVNlc3Npb25SZXNwb25zZSIWkAICkrUYDxINZGVsZXRlU2Vzc2lvbhJvCg1EZWNpZGVDb25zZW50EiMubG9hbXMuYXV0aC52MS5EZWNpZGVDb25zZW50UmVxdWVzdBokLmxvYW1zLmF1dGgudjEuRGVjaWRlQ29uc2VudFJlc3BvbnNlIhOStRgPEg1kZWNpZGVDb25zZW50GkuKtRhHCgRhdXRoEj9TaWduLWluIHByb3ZpZGVycywgZmlyc3QtcnVuIHNldHVwLCBzZXNzaW9ucyBhbmQgT0F1dGggY29uc2VudC5iBnByb3RvMw", [file_google_protobuf_timestamp, file_loams_admin_v1_common, file_loams_admin_v1_org, file_loams_options_v1_options]);
+export const file_loams_auth_v1_auth = /*@__PURE__*/ fileDesc("Chhsb2Ftcy9hdXRoL3YxL2F1dGgucHJvdG8SDWxvYW1zLmF1dGgudjEiVwoMT2lkY1Byb3ZpZGVyEgoKAmlkGAEgASgJEgwKBG5hbWUYAiABKAkSLQoEa2luZBgDIAEoDjIfLmxvYW1zLmF1dGgudjEuT2lkY1Byb3ZpZGVyS2luZCK6AQoHU2Vzc2lvbhIiCgR1c2VyGAEgASgLMhQubG9hbXMuYWRtaW4udjEuVXNlchIgCgNvcmcYAiABKAsyEy5sb2Ftcy5hZG1pbi52MS5PcmcSJQoEcm9sZRgDIAEoDjIXLmxvYW1zLmFkbWluLnYxLk9yZ1JvbGUSEgoKY3NyZl90b2tlbhgEIAEoCRIuCgpleHBpcmVzX2F0GAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCIWChRMaXN0UHJvdmlkZXJzUmVxdWVzdCJ0ChVMaXN0UHJvdmlkZXJzUmVzcG9uc2USEAoIcGFzc3dvcmQYASABKAgSDAoEdG90cBgCIAEoCBIQCghwYXNza2V5cxgDIAEoCBIpCgRvaWRjGAQgAygLMhsubG9hbXMuYXV0aC52MS5PaWRjUHJvdmlkZXIibAoUQ29tcGxldGVTZXR1cFJlcXVlc3QSEwoLc2V0dXBfdG9rZW4YASABKAkSEAoIb3JnX25hbWUYAiABKAkSDAoEbmFtZRgDIAEoCRINCgVlbWFpbBgEIAEoCRIQCghwYXNzd29yZBgFIAEoCSJAChVDb21wbGV0ZVNldHVwUmVzcG9uc2USJwoHc2Vzc2lvbhgBIAEoCzIWLmxvYW1zLmF1dGgudjEuU2Vzc2lvbiITChFHZXRTZXNzaW9uUmVxdWVzdCI9ChJHZXRTZXNzaW9uUmVzcG9uc2USJwoHc2Vzc2lvbhgBIAEoCzIWLmxvYW1zLmF1dGgudjEuU2Vzc2lvbiJKChRDcmVhdGVTZXNzaW9uUmVxdWVzdBINCgVlbWFpbBgBIAEoCRIQCghwYXNzd29yZBgCIAEoCRIRCgl0b3RwX2NvZGUYAyABKAkiQAoVQ3JlYXRlU2Vzc2lvblJlc3BvbnNlEicKB3Nlc3Npb24YASABKAsyFi5sb2Ftcy5hdXRoLnYxLlNlc3Npb24iFgoURGVsZXRlU2Vzc2lvblJlcXVlc3QiFwoVRGVsZXRlU2Vzc2lvblJlc3BvbnNlItgBChREZWNpZGVDb25zZW50UmVxdWVzdBIwCghkZWNpc2lvbhgBIAEoDjIeLmxvYW1zLmF1dGgudjEuQ29uc2VudERlY2lzaW9uEhEKCWNsaWVudF9pZBgCIAEoCRIUCgxyZWRpcmVjdF91cmkYAyABKAkSDQoFc2NvcGUYBCABKAkSEAoIYXVkaWVuY2UYBSABKAkSDQoFc3RhdGUYBiABKAkSFgoOY29kZV9jaGFsbGVuZ2UYByABKAkSHQoVY29kZV9jaGFsbGVuZ2VfbWV0aG9kGAggASgJIiwKFURlY2lkZUNvbnNlbnRSZXNwb25zZRITCgtyZWRpcmVjdF90bxgBIAEoCSqvAgoQT2lkY1Byb3ZpZGVyS2luZBIiCh5PSURDX1BST1ZJREVSX0tJTkRfVU5TUEVDSUZJRUQQABIfChtPSURDX1BST1ZJREVSX0tJTkRfS0VZQ0xPQUsQARIbChdPSURDX1BST1ZJREVSX0tJTkRfT0tUQRACEhwKGE9JRENfUFJPVklERVJfS0lORF9FTlRSQRADEh0KGU9JRENfUFJPVklERVJfS0lORF9HT09HTEUQBBIgChxPSURDX1BST1ZJREVSX0tJTkRfQVVUSEVOVElLEAUSGgoWT0lEQ19QUk9WSURFUl9LSU5EX0RFWBAGEh4KGk9JRENfUFJPVklERVJfS0lORF9HRU5FUklDEAcSHgoaT0lEQ19QUk9WSURFUl9LSU5EX1pJVEFERUwQCCpqCg9Db25zZW50RGVjaXNpb24SIAocQ09OU0VOVF9ERUNJU0lPTl9VTlNQRUNJRklFRBAAEhoKFkNPTlNFTlRfREVDSVNJT05fQUxMT1cQARIZChVDT05TRU5UX0RFQ0lTSU9OX0RFTlkQAjL9BQoLQXV0aFNlcnZpY2UScgoNTGlzdFByb3ZpZGVycxIjLmxvYW1zLmF1dGgudjEuTGlzdFByb3ZpZGVyc1JlcXVlc3QaJC5sb2Ftcy5hdXRoLnYxLkxpc3RQcm92aWRlcnNSZXNwb25zZSIWkAIBkrUYDxINbGlzdFByb3ZpZGVycxJvCg1Db21wbGV0ZVNldHVwEiMubG9hbXMuYXV0aC52MS5Db21wbGV0ZVNldHVwUmVxdWVzdBokLmxvYW1zLmF1dGgudjEuQ29tcGxldGVTZXR1cFJlc3BvbnNlIhOStRgPEg1jb21wbGV0ZVNldHVwEmYKCkdldFNlc3Npb24SIC5sb2Ftcy5hdXRoLnYxLkdldFNlc3Npb25SZXF1ZXN0GiEubG9hbXMuYXV0aC52MS5HZXRTZXNzaW9uUmVzcG9uc2UiE5ACAZK1GAwSCmdldFNlc3Npb24SbwoNQ3JlYXRlU2Vzc2lvbhIjLmxvYW1zLmF1dGgudjEuQ3JlYXRlU2Vzc2lvblJlcXVlc3QaJC5sb2Ftcy5hdXRoLnYxLkNyZWF0ZVNlc3Npb25SZXNwb25zZSITkrUYDxINY3JlYXRlU2Vzc2lvbhJyCg1EZWxldGVTZXNzaW9uEiMubG9hbXMuYXV0aC52MS5EZWxldGVTZXNzaW9uUmVxdWVzdBokLmxvYW1zLmF1dGgudjEuRGVsZXRlU2Vzc2lvblJlc3BvbnNlIhaQAgKStRgPEg1kZWxldGVTZXNzaW9uEm8KDURlY2lkZUNvbnNlbnQSIy5sb2Ftcy5hdXRoLnYxLkRlY2lkZUNvbnNlbnRSZXF1ZXN0GiQubG9hbXMuYXV0aC52MS5EZWNpZGVDb25zZW50UmVzcG9uc2UiE5K1GA8SDWRlY2lkZUNvbnNlbnQaS4q1GEcKBGF1dGgSP1NpZ24taW4gcHJvdmlkZXJzLCBmaXJzdC1ydW4gc2V0dXAsIHNlc3Npb25zIGFuZCBPQXV0aCBjb25zZW50LmIGcHJvdG8z", [file_google_protobuf_timestamp, file_loams_admin_v1_common, file_loams_admin_v1_org, file_loams_options_v1_options]);
 /**
  * Describes the message loams.auth.v1.OidcProvider.
  * Use `create(OidcProviderSchema)` to create a new message.
@@ -119,6 +119,10 @@ export var OidcProviderKind;
      * @generated from enum value: OIDC_PROVIDER_KIND_GENERIC = 7;
      */
     OidcProviderKind[OidcProviderKind["GENERIC"] = 7] = "GENERIC";
+    /**
+     * @generated from enum value: OIDC_PROVIDER_KIND_ZITADEL = 8;
+     */
+    OidcProviderKind[OidcProviderKind["ZITADEL"] = 8] = "ZITADEL";
 })(OidcProviderKind || (OidcProviderKind = {}));
 /**
  * Describes the enum loams.auth.v1.OidcProviderKind.

package/dist/vendor/proto/gen/loams/instance/v1/instance_pb.d.ts

@@ -71,7 +71,8 @@ export type GetInstanceResponse = Message<"loams.instance.v1.GetInstanceResponse
      */
     jwksUri: string;
     /**
-     * How people sign in. Authentik is the identity provider (§37 §6.5).
+     * How people sign in: the instance's OIDC issuer (Zitadel, design §76), a
+     * pairing code, or none (§37 §6.5).
      *
      * @generated from field: repeated loams.instance.v1.SignInMethod sign_in_methods = 9;
      */
@@ -183,7 +184,7 @@ export type SignInMethod = Message<"loams.instance.v1.SignInMethod"> & {
      */
     kind: SignInKind;
     /**
-     * The OIDC issuer for KIND_AUTHENTIK (Authentik's application issuer URL).
+     * The OIDC issuer for SIGN_IN_KIND_OIDC and SIGN_IN_KIND_OIDC_DEVICE_CODE.
      *
      * @generated from field: string issuer = 2;
      */
@@ -427,15 +428,18 @@ export declare enum SignInKind {
      */
     NONE = 1,
     /**
-     * OIDC authorization code + PKCE at the instance's Authentik (§38).
+     * Deprecated: use SIGN_IN_KIND_OIDC (D1619). Kept so the wire value still
+     * decodes; no server sends it.
      *
-     * @generated from enum value: SIGN_IN_KIND_AUTHENTIK = 2;
+     * @generated from enum value: SIGN_IN_KIND_AUTHENTIK = 2 [deprecated = true];
+     * @deprecated
      */
     AUTHENTIK = 2,
     /**
-     * Authentik's device authorization flow (RFC 8628).
+     * Deprecated: use SIGN_IN_KIND_OIDC_DEVICE_CODE (D1619).
      *
-     * @generated from enum value: SIGN_IN_KIND_AUTHENTIK_DEVICE_CODE = 3;
+     * @generated from enum value: SIGN_IN_KIND_AUTHENTIK_DEVICE_CODE = 3 [deprecated = true];
+     * @deprecated
      */
     AUTHENTIK_DEVICE_CODE = 3,
     /**
@@ -443,7 +447,19 @@ export declare enum SignInKind {
      *
      * @generated from enum value: SIGN_IN_KIND_PAIRING = 4;
      */
-    PAIRING = 4
+    PAIRING = 4,
+    /**
+     * OIDC authorization code + PKCE at the instance's issuer (design §76).
+     *
+     * @generated from enum value: SIGN_IN_KIND_OIDC = 5;
+     */
+    OIDC = 5,
+    /**
+     * The issuer's device authorization flow (RFC 8628).
+     *
+     * @generated from enum value: SIGN_IN_KIND_OIDC_DEVICE_CODE = 6;
+     */
+    OIDC_DEVICE_CODE = 6
 }
 /**
  * Describes the enum loams.instance.v1.SignInKind.

package/dist/vendor/proto/gen/loams/instance/v1/instance_pb.js

@@ -18,7 +18,7 @@ import { file_loams_options_v1_options } from "../../options/v1/options_pb.js";
 /**
  * Describes the file loams/instance/v1/instance.proto.
  */
-export const file_loams_instance_v1_instance = /*@__PURE__*/ fileDesc("CiBsb2Ftcy9pbnN0YW5jZS92MS9pbnN0YW5jZS5wcm90bxIRbG9hbXMuaW5zdGFuY2UudjEiFAoSR2V0SW5zdGFuY2VSZXF1ZXN0IpYFChNHZXRJbnN0YW5jZVJlc3BvbnNlEhMKC2luc3RhbmNlX2lkGAEgASgJEgwKBG5hbWUYAiABKAkSKwoHZWRpdGlvbhgDIAEoDjIaLmxvYW1zLmluc3RhbmNlLnYxLkVkaXRpb24SFgoOc2VydmVyX3ZlcnNpb24YBCABKAkSFAoMYXBpX3ZlcnNpb25zGAUgAygJEkYKCGZlYXR1cmVzGAYgAygLMjQubG9hbXMuaW5zdGFuY2UudjEuR2V0SW5zdGFuY2VSZXNwb25zZS5GZWF0dXJlc0VudHJ5Eg4KBmlzc3VlchgHIAEoCRIQCghqd2tzX3VyaRgIIAEoCRI4Cg9zaWduX2luX21ldGhvZHMYCSADKAsyHy5sb2Ftcy5pbnN0YW5jZS52MS5TaWduSW5NZXRob2QSEAoIdGxzX3BpbnMYCiABKAkSKwoEcHVzaBgLIAEoCzIdLmxvYW1zLmluc3RhbmNlLnYxLlB1c2hDb25maWcSVAoQbWluX2FwcF92ZXJzaW9ucxgMIAMoCzI6LmxvYW1zLmluc3RhbmNlLnYxLkdldEluc3RhbmNlUmVzcG9uc2UuTWluQXBwVmVyc2lvbnNFbnRyeRIWCg5zZXR1cF9yZXF1aXJlZBgNIAEoCBIUCgxrZXlfcm90YXRpb24YDiABKAkSMgoIc2VydmljZXMYDyADKAsyIC5sb2Ftcy5pbnN0YW5jZS52MS5TZXJ2aWNlU3RhdHVzGi8KDUZlYXR1cmVzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgIOgI4ARo1ChNNaW5BcHBWZXJzaW9uc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiaAoNU2VydmljZVN0YXR1cxIPCgdwYWNrYWdlGAEgASgJEg8KB3ZlcnNpb24YAiABKAkSEQoJYXZhaWxhYmxlGAMgASgIEhAKCHNlcnZpY2VzGAQgAygJEhAKCHVuc3RhYmxlGAUgASgIInQKDFNpZ25Jbk1ldGhvZBIrCgRraW5kGAEgASgOMh0ubG9hbXMuaW5zdGFuY2UudjEuU2lnbkluS2luZBIOCgZpc3N1ZXIYAiABKAkSEQoJY2xpZW50X2lkGAMgASgJEhQKDGRpc3BsYXlfbmFtZRgEIAEoCSKhAQoKUHVzaENvbmZpZxITCgtnYXRld2F5X3VybBgBIAEoCRI6CgdhcHBfaWRzGAIgAygLMikubG9hbXMuaW5zdGFuY2UudjEuUHVzaENvbmZpZy5BcHBJZHNFbnRyeRITCgt1bmlmaWVkcHVzaBgDIAEoCBotCgtBcHBJZHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIg8KDVdob0FtSVJlcXVlc3QiswIKDldob0FtSVJlc3BvbnNlEi8KCXByaW5jaXBhbBgBIAEoCzIcLmxvYW1zLmluc3RhbmNlLnYxLlByaW5jaXBhbBIxCgthY3Rvcl9jaGFpbhgCIAMoCzIcLmxvYW1zLmluc3RhbmNlLnYxLlByaW5jaXBhbBIjCgNvcmcYAyABKAsyFi5sb2Ftcy5pbnN0YW5jZS52MS5PcmcSNAoMZW52aXJvbm1lbnRzGAQgAygLMh4ubG9hbXMuaW5zdGFuY2UudjEuRW52aXJvbm1lbnQSLAoGZGV2aWNlGAUgASgLMhwubG9hbXMuaW5zdGFuY2UudjEuRGV2aWNlUmVmEjQKEGF1dGhlbnRpY2F0ZWRfYXQYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wImwKCVByaW5jaXBhbBIKCgJpZBgBIAEoCRIuCgRraW5kGAIgASgOMiAubG9hbXMuaW5zdGFuY2UudjEuUHJpbmNpcGFsS2luZBIUCgxkaXNwbGF5X25hbWUYAyABKAkSDQoFZW1haWwYBCABKAkiHwoDT3JnEgoKAmlkGAEgASgJEgwKBG5hbWUYAiABKAkiXgoLRW52aXJvbm1lbnQSCgoCaWQYASABKAkSDwoHcHJvamVjdBgCIAEoCRIMCgRuYW1lGAMgASgJEhEKCW5hbWVzcGFjZRgEIAEoCRIRCglwcm90ZWN0ZWQYBSABKAgiJQoJRGV2aWNlUmVmEgoKAmlkGAEgASgJEgwKBG5hbWUYAiABKAkqWAoHRWRpdGlvbhIXChNFRElUSU9OX1VOU1BFQ0lGSUVEEAASDwoLRURJVElPTl9PU1MQARIRCg1FRElUSU9OX0NMT1VEEAISEAoMRURJVElPTl9CWU9DEAMqnwEKClNpZ25JbktpbmQSHAoYU0lHTl9JTl9LSU5EX1VOU1BFQ0lGSUVEEAASFQoRU0lHTl9JTl9LSU5EX05PTkUQARIaChZTSUdOX0lOX0tJTkRfQVVUSEVOVElLEAISJgoiU0lHTl9JTl9LSU5EX0FVVEhFTlRJS19ERVZJQ0VfQ09ERRADEhgKFFNJR05fSU5fS0lORF9QQUlSSU5HEAQqhgEKDVByaW5jaXBhbEtpbmQSHgoaUFJJTkNJUEFMX0tJTkRfVU5TUEVDSUZJRUQQABIXChNQUklOQ0lQQUxfS0lORF9VU0VSEAESIgoeUFJJTkNJUEFMX0tJTkRfU0VSVklDRV9BQ0NPVU5UEAISGAoUUFJJTkNJUEFMX0tJTkRfQUdFTlQQAzKqAgoPSW5zdGFuY2VTZXJ2aWNlEnIKC0dldEluc3RhbmNlEiUubG9hbXMuaW5zdGFuY2UudjEuR2V0SW5zdGFuY2VSZXF1ZXN0GiYubG9hbXMuaW5zdGFuY2UudjEuR2V0SW5zdGFuY2VSZXNwb25zZSIUkAIBkrUYDRILZ2V0SW5zdGFuY2USXgoGV2hvQW1JEiAubG9hbXMuaW5zdGFuY2UudjEuV2hvQW1JUmVxdWVzdBohLmxvYW1zLmluc3RhbmNlLnYxLldob0FtSVJlc3BvbnNlIg+QAgGStRgIEgZ3aG9BbUkaQ4q1GD8KCGluc3RhbmNlEjNXaGF0IHRoaXMgaW5zdGFuY2UgaXMsIGFuZCB3aG8gdGhlIGNhbGxlciBpcyBvbiBpdC5iBnByb3RvMw", [file_google_protobuf_timestamp, file_loams_options_v1_options]);
+export const file_loams_instance_v1_instance = /*@__PURE__*/ fileDesc("CiBsb2Ftcy9pbnN0YW5jZS92MS9pbnN0YW5jZS5wcm90bxIRbG9hbXMuaW5zdGFuY2UudjEiFAoSR2V0SW5zdGFuY2VSZXF1ZXN0IpYFChNHZXRJbnN0YW5jZVJlc3BvbnNlEhMKC2luc3RhbmNlX2lkGAEgASgJEgwKBG5hbWUYAiABKAkSKwoHZWRpdGlvbhgDIAEoDjIaLmxvYW1zLmluc3RhbmNlLnYxLkVkaXRpb24SFgoOc2VydmVyX3ZlcnNpb24YBCABKAkSFAoMYXBpX3ZlcnNpb25zGAUgAygJEkYKCGZlYXR1cmVzGAYgAygLMjQubG9hbXMuaW5zdGFuY2UudjEuR2V0SW5zdGFuY2VSZXNwb25zZS5GZWF0dXJlc0VudHJ5Eg4KBmlzc3VlchgHIAEoCRIQCghqd2tzX3VyaRgIIAEoCRI4Cg9zaWduX2luX21ldGhvZHMYCSADKAsyHy5sb2Ftcy5pbnN0YW5jZS52MS5TaWduSW5NZXRob2QSEAoIdGxzX3BpbnMYCiABKAkSKwoEcHVzaBgLIAEoCzIdLmxvYW1zLmluc3RhbmNlLnYxLlB1c2hDb25maWcSVAoQbWluX2FwcF92ZXJzaW9ucxgMIAMoCzI6LmxvYW1zLmluc3RhbmNlLnYxLkdldEluc3RhbmNlUmVzcG9uc2UuTWluQXBwVmVyc2lvbnNFbnRyeRIWCg5zZXR1cF9yZXF1aXJlZBgNIAEoCBIUCgxrZXlfcm90YXRpb24YDiABKAkSMgoIc2VydmljZXMYDyADKAsyIC5sb2Ftcy5pbnN0YW5jZS52MS5TZXJ2aWNlU3RhdHVzGi8KDUZlYXR1cmVzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgIOgI4ARo1ChNNaW5BcHBWZXJzaW9uc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiaAoNU2VydmljZVN0YXR1cxIPCgdwYWNrYWdlGAEgASgJEg8KB3ZlcnNpb24YAiABKAkSEQoJYXZhaWxhYmxlGAMgASgIEhAKCHNlcnZpY2VzGAQgAygJEhAKCHVuc3RhYmxlGAUgASgIInQKDFNpZ25Jbk1ldGhvZBIrCgRraW5kGAEgASgOMh0ubG9hbXMuaW5zdGFuY2UudjEuU2lnbkluS2luZBIOCgZpc3N1ZXIYAiABKAkSEQoJY2xpZW50X2lkGAMgASgJEhQKDGRpc3BsYXlfbmFtZRgEIAEoCSKhAQoKUHVzaENvbmZpZxITCgtnYXRld2F5X3VybBgBIAEoCRI6CgdhcHBfaWRzGAIgAygLMikubG9hbXMuaW5zdGFuY2UudjEuUHVzaENvbmZpZy5BcHBJZHNFbnRyeRITCgt1bmlmaWVkcHVzaBgDIAEoCBotCgtBcHBJZHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIg8KDVdob0FtSVJlcXVlc3QiswIKDldob0FtSVJlc3BvbnNlEi8KCXByaW5jaXBhbBgBIAEoCzIcLmxvYW1zLmluc3RhbmNlLnYxLlByaW5jaXBhbBIxCgthY3Rvcl9jaGFpbhgCIAMoCzIcLmxvYW1zLmluc3RhbmNlLnYxLlByaW5jaXBhbBIjCgNvcmcYAyABKAsyFi5sb2Ftcy5pbnN0YW5jZS52MS5PcmcSNAoMZW52aXJvbm1lbnRzGAQgAygLMh4ubG9hbXMuaW5zdGFuY2UudjEuRW52aXJvbm1lbnQSLAoGZGV2aWNlGAUgASgLMhwubG9hbXMuaW5zdGFuY2UudjEuRGV2aWNlUmVmEjQKEGF1dGhlbnRpY2F0ZWRfYXQYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wImwKCVByaW5jaXBhbBIKCgJpZBgBIAEoCRIuCgRraW5kGAIgASgOMiAubG9hbXMuaW5zdGFuY2UudjEuUHJpbmNpcGFsS2luZBIUCgxkaXNwbGF5X25hbWUYAyABKAkSDQoFZW1haWwYBCABKAkiHwoDT3JnEgoKAmlkGAEgASgJEgwKBG5hbWUYAiABKAkiXgoLRW52aXJvbm1lbnQSCgoCaWQYASABKAkSDwoHcHJvamVjdBgCIAEoCRIMCgRuYW1lGAMgASgJEhEKCW5hbWVzcGFjZRgEIAEoCRIRCglwcm90ZWN0ZWQYBSABKAgiJQoJRGV2aWNlUmVmEgoKAmlkGAEgASgJEgwKBG5hbWUYAiABKAkqWAoHRWRpdGlvbhIXChNFRElUSU9OX1VOU1BFQ0lGSUVEEAASDwoLRURJVElPTl9PU1MQARIRCg1FRElUSU9OX0NMT1VEEAISEAoMRURJVElPTl9CWU9DEAMq4QEKClNpZ25JbktpbmQSHAoYU0lHTl9JTl9LSU5EX1VOU1BFQ0lGSUVEEAASFQoRU0lHTl9JTl9LSU5EX05PTkUQARIeChZTSUdOX0lOX0tJTkRfQVVUSEVOVElLEAIaAggBEioKIlNJR05fSU5fS0lORF9BVVRIRU5USUtfREVWSUNFX0NPREUQAxoCCAESGAoUU0lHTl9JTl9LSU5EX1BBSVJJTkcQBBIVChFTSUdOX0lOX0tJTkRfT0lEQxAFEiEKHVNJR05fSU5fS0lORF9PSURDX0RFVklDRV9DT0RFEAYqhgEKDVByaW5jaXBhbEtpbmQSHgoaUFJJTkNJUEFMX0tJTkRfVU5TUEVDSUZJRUQQABIXChNQUklOQ0lQQUxfS0lORF9VU0VSEAESIgoeUFJJTkNJUEFMX0tJTkRfU0VSVklDRV9BQ0NPVU5UEAISGAoUUFJJTkNJUEFMX0tJTkRfQUdFTlQQAzKqAgoPSW5zdGFuY2VTZXJ2aWNlEnIKC0dldEluc3RhbmNlEiUubG9hbXMuaW5zdGFuY2UudjEuR2V0SW5zdGFuY2VSZXF1ZXN0GiYubG9hbXMuaW5zdGFuY2UudjEuR2V0SW5zdGFuY2VSZXNwb25zZSIUkAIBkrUYDRILZ2V0SW5zdGFuY2USXgoGV2hvQW1JEiAubG9hbXMuaW5zdGFuY2UudjEuV2hvQW1JUmVxdWVzdBohLmxvYW1zLmluc3RhbmNlLnYxLldob0FtSVJlc3BvbnNlIg+QAgGStRgIEgZ3aG9BbUkaQ4q1GD8KCGluc3RhbmNlEjNXaGF0IHRoaXMgaW5zdGFuY2UgaXMsIGFuZCB3aG8gdGhlIGNhbGxlciBpcyBvbiBpdC5iBnByb3RvMw", [file_google_protobuf_timestamp, file_loams_options_v1_options]);
 /**
  * Describes the message loams.instance.v1.GetInstanceRequest.
  * Use `create(GetInstanceRequestSchema)` to create a new message.
@@ -116,15 +116,18 @@ export var SignInKind;
      */
     SignInKind[SignInKind["NONE"] = 1] = "NONE";
     /**
-     * OIDC authorization code + PKCE at the instance's Authentik (§38).
+     * Deprecated: use SIGN_IN_KIND_OIDC (D1619). Kept so the wire value still
+     * decodes; no server sends it.
      *
-     * @generated from enum value: SIGN_IN_KIND_AUTHENTIK = 2;
+     * @generated from enum value: SIGN_IN_KIND_AUTHENTIK = 2 [deprecated = true];
+     * @deprecated
      */
     SignInKind[SignInKind["AUTHENTIK"] = 2] = "AUTHENTIK";
     /**
-     * Authentik's device authorization flow (RFC 8628).
+     * Deprecated: use SIGN_IN_KIND_OIDC_DEVICE_CODE (D1619).
      *
-     * @generated from enum value: SIGN_IN_KIND_AUTHENTIK_DEVICE_CODE = 3;
+     * @generated from enum value: SIGN_IN_KIND_AUTHENTIK_DEVICE_CODE = 3 [deprecated = true];
+     * @deprecated
      */
     SignInKind[SignInKind["AUTHENTIK_DEVICE_CODE"] = 3] = "AUTHENTIK_DEVICE_CODE";
     /**
@@ -133,6 +136,18 @@ export var SignInKind;
      * @generated from enum value: SIGN_IN_KIND_PAIRING = 4;
      */
     SignInKind[SignInKind["PAIRING"] = 4] = "PAIRING";
+    /**
+     * OIDC authorization code + PKCE at the instance's issuer (design §76).
+     *
+     * @generated from enum value: SIGN_IN_KIND_OIDC = 5;
+     */
+    SignInKind[SignInKind["OIDC"] = 5] = "OIDC";
+    /**
+     * The issuer's device authorization flow (RFC 8628).
+     *
+     * @generated from enum value: SIGN_IN_KIND_OIDC_DEVICE_CODE = 6;
+     */
+    SignInKind[SignInKind["OIDC_DEVICE_CODE"] = 6] = "OIDC_DEVICE_CODE";
 })(SignInKind || (SignInKind = {}));
 /**
  * Describes the enum loams.instance.v1.SignInKind.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loams/client",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "The Loams SDK for TypeScript and JavaScript: one Loams object with namespaced modules over the unified Connect API, generated from proto/.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ostrium-labs/loams/tree/dev/sdks/typescript",
@@ -43,7 +43,7 @@
     "@connectrpc/connect": "2.2.0",
     "@connectrpc/connect-node": "2.2.0",
     "@connectrpc/connect-web": "2.2.0",
-    "@loams/live": "0.1.1"
+    "@loams/live": "0.1.2"
   },
   "publishConfig": {
     "access": "public"