@poppykit/client 0.4.1 → 0.6.0

package/dist/auth/client-auth.js

@@ -1,10 +1,13 @@
+import { supportsOperations } from '../protocol/operations.js';
+import { parseAlternative } from '../network/tasks.js';
+import { registeredRedirect } from '../network/redirect.js';
 import { acquireOwner, releaseOwner, localOwnerAlive } from './ownership.js';
 import { createHash } from 'node:crypto';
 import { calculateJwkThumbprint } from 'jose';
 import { parseJson, parseProtocolError, parseTokenResponse, retryAfterMilliseconds } from '../protocol/wire.js';
-import { validateClientId } from '../network/discovery.js';
+import { validateClientId, signInMethods, companyIdentifier, mediatedSignIn, MEDIATED_GRANT } from '../network/discovery.js';
 import { dpopChallenge, schemeChallenge } from './challenge.js';
-import { resolveApiTarget, mcpScheme, browserDestination, validateFeedback } from '../integrations.js';
+import { resolveApiTarget, serviceAuthorization, browserDestination, validateFeedback } from '../integrations.js';
 export class AuthFailure extends Error {
     code;
     connectionId;
@@ -19,6 +22,13 @@ export class AuthFailure extends Error {
         this.name = 'AuthFailure';
     }
 }
+class MediatedCodeRequired extends AuthFailure {
+    challenge;
+    constructor(challenge) {
+        super('code_required');
+        this.challenge = challenge;
+    }
+}
 const EC = { name: 'ECDSA', namedCurve: 'P-256' };
 const ES256 = { name: 'ECDSA', hash: 'SHA-256' };
 const SKEW_MS = 30_000;
@@ -33,7 +43,7 @@ function providerFailure(error, connectionId) {
             : ['invalid_response', 'binding_conflict', 'expired', 'consumed', 'canceled'].includes(String(code)) ? 'provider_invalid_response' : 'provider_unavailable', connectionId);
 }
 // OAuth codes the token endpoint may return (spec 4.2, RFC 6749/8707); anything else is reported as token_error.
-const SAFE_ERRORS = new Set(['invalid_request', 'invalid_client', 'invalid_grant', 'unauthorized_client', 'unsupported_grant_type', 'invalid_scope', 'invalid_target', 'invalid_session', 'account_mismatch', 'invalid_dpop_proof', 'use_dpop_nonce', 'extension_required', 'rate_limited']);
+const SAFE_ERRORS = new Set(['invalid_request', 'invalid_client', 'invalid_grant', 'unauthorized_client', 'unsupported_grant_type', 'invalid_scope', 'invalid_target', 'account_mismatch', 'invalid_dpop_proof', 'use_dpop_nonce', 'extension_required', 'rate_limited']);
 const b64 = (data) => Buffer.from(data).toString('base64url');
 const randomId = (prefix = '') => prefix + b64(crypto.getRandomValues(new Uint8Array(16)));
 const own = (record, key) => Object.hasOwn(record, key) ? record[key] : undefined;
@@ -84,7 +94,31 @@ function parseCallback(callbackUrl) {
     return { params, base };
 }
 export function initialClientAuthState() {
-    return { version: 1, epoch: randomId(), owner: null, identities: {}, connections: {}, grants: {}, operations: {}, cleanup: {} };
+    return { version: 3, epoch: randomId(), owner: null, identities: {}, connections: {}, grants: {}, operations: {}, cleanup: {} };
+}
+/** Upgrade a complete namespace under its writer lock; dispatched/staged work still goes through recover(). */
+export function upgradeClientAuthState(state) {
+    if (state.version === 3)
+        return;
+    if (state.version !== 1 && state.version !== 2)
+        throw new Error('unsupported auth state version');
+    for (const connection of Object.values(state.connections)) {
+        connection.needsSessionKey = true;
+        connection.slots = {};
+    }
+    for (const operation of Object.values(state.operations))
+        if (operation.phase === 'prepared') {
+            operation.phase = 'terminal';
+            operation.status = 'cancelled';
+            const connection = own(state.connections, operation.connectionId);
+            if (connection)
+                (connection.signingCleanup ??= []).push(...(operation.direct ? [operation.direct.verifierRef] : []), ...(operation.device ? [operation.device.codeRef] : []));
+            operation.result = null;
+            const grant = operation.grantId ? own(state.grants, operation.grantId) : undefined;
+            if (grant?.operationId === operation.id)
+                grant.operationId = null;
+        }
+    state.version = 3;
 }
 function publicEcJwk(value, code) {
     const jwk = (value ?? {});
@@ -125,9 +159,9 @@ export function createClientAuth(options) {
         if (state.owner && (state.owner.namespace !== namespace || state.owner.clientId !== clientId || state.owner.localUserId !== localUserId))
             throw new AuthFailure('owner_mismatch');
     }
-    async function load(selection) { const state = await store.read(selection); checkOwner(state); return state; }
+    async function load(selection) { const state = await store.read(selection); checkOwner(state); upgradeClientAuthState(state); return state; }
     function transaction(selection, change) {
-        return store.transaction(selection, state => { checkOwner(state); state.owner ??= owner; return change(state); });
+        return store.transaction(selection, state => { checkOwner(state); upgradeClientAuthState(state); state.owner ??= owner; return change(state); });
     }
     async function record(connectionId) {
         const found = typeof connectionId === 'string' ? own((await load({ connectionId })).connections, connectionId) : undefined;
@@ -138,12 +172,12 @@ export function createClientAuth(options) {
     function destinations(metadata) {
         const auth = metadata.authorization;
         return JSON.stringify([auth?.issuer, auth?.token_endpoint, auth?.revocation_endpoint, auth?.authorization_endpoint, auth?.device_authorization_endpoint,
-            metadata.document.auth?.mediated?.endpoint, metadata.document.agent?.protocols, metadata.document.apis, metadata.document.web, metadata.document.feedback]);
+            metadata.document.extensions?.['mediated-sign-in'], metadata.document.agent?.protocols, metadata.document.apis, metadata.document.web, metadata.document.feedback]);
     }
     async function verified(metadata) {
         let fresh;
         try {
-            fresh = await options.metadata.resolveCompany(new URL(metadata.url).hostname);
+            fresh = await options.metadata.resolveCompany(new URL(metadata.url).host);
         }
         catch {
             throw new AuthFailure('discovery_failed');
@@ -211,18 +245,112 @@ export function createClientAuth(options) {
             return signature;
         });
     }
-    async function proof(key, method, url, token) {
+    async function proof(key, method, url, token, browserCode) {
         const htu = new URL(url);
         htu.search = '';
         htu.hash = '';
         const payload = { jti: randomId(), htm: method, htu: htu.href, iat: Math.floor(now() / 1000) };
         if (token !== undefined)
             payload.ath = b64(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(token))));
-        const nonce = nonces.get(htu.origin);
+        const nonce = browserCode ?? nonces.get(htu.origin);
         if (nonce !== undefined)
             payload.nonce = nonce;
         return compact({ typ: 'dpop+jwt', alg: 'ES256', jwk: key.jwk }, payload, async (input) => new Uint8Array(await crypto.subtle.sign(ES256, key.privateKey, input)));
     }
+    const signing = new Map();
+    async function cleanupSigning(connection) {
+        for (const ref of connection.signingCleanup ?? []) {
+            try {
+                await secrets.remove(ref);
+            }
+            catch {
+                return;
+            }
+            await transaction({ connectionId: connection.id }, state => {
+                const live = own(state.connections, connection.id);
+                live.signingCleanup = (live.signingCleanup ?? []).filter(value => value !== ref);
+                if (!live.signingCleanup.length)
+                    delete live.signingCleanup;
+            });
+        }
+    }
+    async function signingConnection(connection) {
+        await cleanupSigning(connection);
+        connection = await record(connection.id);
+        if ((connection.signingCleanup?.length ?? 0) >= 128)
+            throw new AuthFailure('storage_cleanup_pending');
+        if (connection.sessionSigning && connection.sessionSigning.expiresAt > now() + SKEW_MS)
+            return connection;
+        let pending = signing.get(connection.id);
+        if (!pending) {
+            pending = (async () => {
+                const keyRef = await newSessionKey(), key = await loadDpopKey(keyRef);
+                const at = Math.floor(now() / 1800000) * 1800;
+                let expiresAt = (at + 3600) * 1000;
+                let delegation, committing = false;
+                try {
+                    if (options.assertions && !connection.anonymous) {
+                        if (!options.assertions.delegate)
+                            throw new AuthFailure('provider_delegation_unavailable');
+                        let result;
+                        try {
+                            result = await options.assertions.delegate({ operationId: randomId('dlg_'), jwk: key.jwk });
+                        }
+                        catch (error) {
+                            throw providerFailure(error);
+                        }
+                        if (!result || typeof result.delegation !== 'string' || !result.delegation || !Number.isFinite(result.expiresAt) || result.expiresAt * 1000 <= now() || result.expiresAt * 1000 > now() + 3600000 + SKEW_MS)
+                            throw new AuthFailure('provider_invalid_response');
+                        delegation = result.delegation;
+                        expiresAt = result.expiresAt * 1000;
+                    }
+                    else
+                        delegation = await signIdentity({ typ: 'pap-delegation+jwt' }, { iss: clientId, cnf: { jwk: key.jwk }, iat: at, exp: at + 3600, jti: randomId() }, key.thumbprint);
+                    const delegationRef = await secrets.stage(delegation);
+                    committing = true;
+                    const current = await commit({ connectionId: connection.id }, [keyRef, delegationRef], (state, drop) => {
+                        const live = own(state.connections, connection.id);
+                        if (live.generation !== connection.generation || live.userId !== connection.userId || live.sessionId !== connection.sessionId)
+                            throw new AuthFailure('state_changed');
+                        if (live.sessionSigning && live.sessionSigning.expiresAt > now() + SKEW_MS)
+                            drop.push(keyRef, delegationRef);
+                        else {
+                            if (live.sessionSigning)
+                                (live.signingCleanup ??= []).push(live.sessionSigning.keyRef, live.sessionSigning.delegationRef);
+                            live.sessionSigning = { keyRef, delegationRef, expiresAt };
+                        }
+                        return live;
+                    });
+                    await cleanupSigning(current);
+                    return current;
+                }
+                catch (error) {
+                    if (!committing)
+                        await secrets.remove(keyRef);
+                    throw error;
+                }
+            })().finally(() => signing.delete(connection.id));
+            signing.set(connection.id, pending);
+        }
+        return pending;
+    }
+    async function sessionHeader(connection, request, token) {
+        if (connection.anonymous && token !== undefined)
+            throw new AuthFailure('anonymous_account_access');
+        connection = await signingConnection(connection);
+        const material = connection.sessionSigning;
+        if (!connection.sessionId || !connection.userId || material.expiresAt <= now())
+            throw new AuthFailure('invalid_session');
+        const delegation = await secrets.read(material.delegationRef), key = await loadDpopKey(material.keyRef);
+        if (!delegation)
+            throw new AuthFailure('missing_key');
+        const url = new URL(request.url);
+        url.search = '';
+        url.hash = '';
+        const claims = { iss: clientId, aud: connection.issuer, sid: connection.sessionId, sub: connection.userId,
+            htm: request.method, htu: url.href, iat: Math.floor(now() / 1000), jti: randomId(), ...(token === undefined ? {} : { ath: sha256(token) }) };
+        return compact({ typ: 'poppy-session+jwt', alg: 'ES256', kid: key.thumbprint, pap_dlg: delegation }, claims, async (input) => new Uint8Array(await crypto.subtle.sign(ES256, key.privateKey, input)));
+    }
     function rememberNonce(url, response) {
         const nonce = response.headers.get('dpop-nonce');
         if (nonce)
@@ -234,7 +362,7 @@ export function createClientAuth(options) {
     }
     async function assertion(purpose, issuer, key, sub = clientId, operationId = randomId('op_')) {
         if (!options.assertions)
-            return signIdentity({ typ: purpose === 'session' ? 'JWT' : 'client-authentication+jwt' }, assertionClaims(sub, issuer), key.thumbprint);
+            return signIdentity({ typ: 'client-authentication+jwt' }, assertionClaims(sub, issuer), key.thumbprint);
         let result;
         try {
             result = await options.assertions.assert({ operationId, issuer, purpose });
@@ -262,21 +390,25 @@ export function createClientAuth(options) {
             : delay === undefined ? undefined : String(Math.floor(now() + delay));
         return new AuthFailure(code, undefined, delay, deadline);
     }
-    // Token endpoint request with client assertion and fresh DPoP proof (spec 4.1-4.3); sessionSub adds a session assertion.
+    // OAuth requests use client authentication and optional DPoP, independently of Sessions.
     // Throws transport_error only when the request may have reached the issuer without a readable answer.
-    async function tokenRequest(metadata, dpopKeyRef, fields, sessionSub, localIdentity = false) {
+    async function tokenRequest(metadata, dpopKeyRef, fields, operationId) {
         const authorization = (await verified(metadata)).authorization;
         const endpoint = authorization.token_endpoint;
         const key = await loadDpopKey(dpopKeyRef);
         const scheme = await resourceScheme(metadata, fields.resource ?? null);
         for (let attempt = 0;; attempt++) {
+            if (attempt > 0 && operationId && own((await load({ operationId })).operations, operationId)?.cancelRequested)
+                throw new AuthFailure('cancelled');
+            const issuedAt = now();
             const body = new URLSearchParams(fields);
-            if (sessionSub !== null)
-                body.set('assertion', localIdentity ? await signIdentity({ typ: 'JWT' }, assertionClaims(sessionSub, authorization.issuer), key.thumbprint) : await assertion('session', authorization.issuer, key, sessionSub));
             body.set('client_id', clientId);
             body.set('client_assertion_type', CLIENT_ASSERTION);
-            body.set('client_assertion', localIdentity ? await signIdentity({ typ: 'client-authentication+jwt' }, assertionClaims(clientId, authorization.issuer), key.thumbprint) : await assertion('client-authentication', authorization.issuer, key));
-            const request = new Request(endpoint, { method: 'POST', body, headers: { accept: 'application/json', dpop: await proof(key, 'POST', endpoint) } });
+            body.set('client_assertion', await assertion('client-authentication', authorization.issuer, key));
+            const headers = new Headers({ accept: 'application/json' });
+            if (scheme === 'DPoP')
+                headers.set('dpop', await proof(key, 'POST', endpoint));
+            const request = new Request(endpoint, { method: 'POST', body, headers });
             let response, text;
             try {
                 response = await transport.fetch(request);
@@ -298,12 +430,21 @@ export function createClientAuth(options) {
             catch { /* reported below */ }
             if (response.status === 200) {
                 try {
-                    return { token: parseTokenResponse(json), scheme };
+                    const token = parseTokenResponse(json);
+                    if (token.token_type === 'DPoP' && !headers.has('dpop'))
+                        throw 0;
+                    return { token, scheme: token.token_type };
                 }
                 catch {
                     throw new AuthFailure('invalid_response');
                 }
             }
+            if (response.status === 400 && json && typeof json === 'object' && 'error' in json && json.error === 'code_required') {
+                const value = json;
+                if (typeof value.sign_in_id !== 'string' || !/^[A-Za-z0-9_-]{1,256}$/.test(value.sign_in_id) || typeof value.sent_to !== 'string' || value.sent_to.length > 512 || !Number.isSafeInteger(value.expires_in) || value.expires_in <= 0 || !Number.isSafeInteger(issuedAt + value.expires_in * 1000))
+                    throw new AuthFailure('invalid_response');
+                throw new MediatedCodeRequired({ id: value.sign_in_id, sentTo: value.sent_to, expiresAt: issuedAt + value.expires_in * 1000 });
+            }
             let error = response.status === 429 ? 'rate_limited' : 'token_error';
             try {
                 if (response.status !== 429)
@@ -319,33 +460,19 @@ export function createClientAuth(options) {
     async function resourceScheme(metadata, resource) {
         const mcp = metadata.document.apis?.find(api => api.type === 'mcp' && api.url === resource);
         if (!mcp)
-            return 'DPoP';
-        if (mcp.resource !== undefined && mcp.resource !== mcp.url)
-            throw new AuthFailure('invalid_target');
+            return metadata.authorization?.dpop_signing_alg_values_supported?.includes('ES256') ? 'DPoP' : 'Bearer';
         try {
-            const scheme = await mcpScheme(transport, metadata.authorization.issuer, mcp.url);
-            // Bearer MCP tokens cannot authorize a conversation, even when discovery reuses their resource identifier.
-            if (scheme === 'Bearer' && metadata.document.agent?.protocols.some(protocol => protocol.resource === resource))
-                throw 0;
-            return scheme;
+            return (await serviceAuthorization(metadata, options.metadata, transport, mcp.url, { mcp: true })).scheme;
         }
         catch {
             throw new AuthFailure('invalid_target');
         }
     }
-    // Signed-out Session Token via the JWT bearer grant (spec 4.2); renewal passes session_id.
-    async function signedOutToken(metadata, userId, dpopKeyRef, sessionId, resource, anonymous = false) {
-        const fields = { grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer' };
-        if (sessionId !== null)
-            fields.session_id = sessionId;
-        if (resource !== null)
-            fields.resource = resource;
-        const { token, scheme } = await tokenRequest(metadata, dpopKeyRef, fields, userId, anonymous);
-        if (token.token_type !== scheme)
-            throw new AuthFailure('unsupported_token_type');
-        if (token.signed_in !== false || token.scope !== '' || (sessionId !== null && token.session_id !== sessionId))
-            throw new AuthFailure('invalid_response');
-        return token;
+    async function newSessionKey() {
+        // shortcut: SecretStore stores a private JWK; use a host signer when non-extractable key persistence is available.
+        const pair = await crypto.subtle.generateKey(EC, true, ['sign', 'verify']);
+        const { kty, crv, x, y, d } = await crypto.subtle.exportKey('jwk', pair.privateKey);
+        return secrets.stage(JSON.stringify({ kty, crv, x, y, d }));
     }
     async function identityFor(issuer, anonymous = false) {
         if (anonymous && !identity)
@@ -353,10 +480,6 @@ export function createClientAuth(options) {
         const existing = anonymous ? undefined : own((await load({ issuer })).identities, issuer);
         if (existing)
             return existing;
-        // shortcut: extractable key, because the SecretStore holds the private JWK as a string and Node cannot persist a non-extractable CryptoKey; move to a KMS/OS-keystore signer when the host platform offers one.
-        const pair = await crypto.subtle.generateKey(EC, true, ['sign', 'verify']);
-        const { kty, crv, x, y, d } = await crypto.subtle.exportKey('jwk', pair.privateKey);
-        const dpopKeyRef = await secrets.stage(JSON.stringify({ kty, crv, x, y, d }));
         let userId = randomId('usr_');
         if (options.providerIdentity && !anonymous) {
             let bound;
@@ -364,22 +487,35 @@ export function createClientAuth(options) {
                 bound = await options.providerIdentity.identity(issuer);
             }
             catch (error) {
-                await secrets.remove(dpopKeyRef);
                 throw providerFailure(error);
             }
-            if (!bound || bound.clientId !== clientId || typeof bound.userId !== 'string' || !bound.userId) {
-                await secrets.remove(dpopKeyRef);
+            if (!bound || bound.clientId !== clientId || typeof bound.userId !== 'string' || !bound.userId)
                 throw new AuthFailure('provider_invalid_response');
-            }
             userId = bound.userId;
         }
         if (anonymous)
-            return { userId, dpopKeyRef };
-        const winner = await transaction({ issuer }, state => own(state.identities, issuer) ?? (state.identities[issuer] = { userId, dpopKeyRef }));
-        // A concurrent start won; our staged key was never referenced by any record.
-        if (winner.dpopKeyRef !== dpopKeyRef)
-            await secrets.remove(dpopKeyRef);
-        return winner;
+            return { userId };
+        return transaction({ issuer }, state => own(state.identities, issuer) ?? (state.identities[issuer] = { userId }));
+    }
+    async function freshSessionKey(connection, operationId) {
+        const ref = await newSessionKey();
+        const current = await commit({ connectionId: connection.id }, [ref], (state, drop) => {
+            const live = own(state.connections, connection.id);
+            if (live.generation !== connection.generation || live.dpopKeyRef !== connection.dpopKeyRef) {
+                drop.push(ref);
+                return live;
+            }
+            // Legacy keys may still be referenced by another old connection, so never delete them here.
+            if (!live.needsSessionKey)
+                drop.push(live.dpopKeyRef);
+            live.dpopKeyRef = ref;
+            delete live.needsSessionKey;
+            live.generation++;
+            if (operationId)
+                own(state.operations, operationId).connectionGeneration = live.generation;
+            return live;
+        });
+        return current;
     }
     // Commits a change that may stage or release secrets. When our own fence check rejects it, nothing references the
     // staged secrets, so they are removed; references the committed change pushed to `drop` are removed after commit.
@@ -436,26 +572,9 @@ export function createClientAuth(options) {
         };
     }
     async function signedOutRenewal(connection, resource) {
-        // Expiry counts from before dispatch so a slow response never extends the token's believed lifetime.
-        const issuedAt = now(), operationId = randomId('op_');
-        let token;
-        try {
-            token = await signedOutToken(connection.metadata, connection.userId, connection.dpopKeyRef, connection.sessionId, resource, connection.anonymous);
-        }
-        catch (error) {
-            // The Session ended (spec 4.2): start a new signed-out one. Signed-out renewal never touches an account.
-            if (!(error instanceof AuthFailure && error.code === 'invalid_session'))
-                throw error;
-            token = await signedOutToken(connection.metadata, connection.userId, connection.dpopKeyRef, null, resource, connection.anonymous);
-        }
-        const secretRef = await stageSessionToken(token.access_token);
-        return commit({ connectionId: connection.id }, [secretRef], (state, drop) => {
+        return transaction({ connectionId: connection.id }, state => {
             const current = own(state.connections, connection.id);
-            if (!current || current.generation !== connection.generation || current.status !== 'signed_out' || current.sessionId !== connection.sessionId)
-                throw new AuthFailure('state_changed', connection.id);
-            switchSession(current, token.session_id, drop);
-            replaceSlot(current, resource, { secretRef, tokenType: token.token_type, dpopKeyRef: current.dpopKeyRef, scopes: [], expiresAt: issuedAt + token.expires_in * 1000, generation: current.generation }, drop);
-            return finish(state, renewOperation(state, operationId, current, null, issuedAt, resource, []), 'completed');
+            return finish(state, renewOperation(state, randomId('op_'), current, null, now(), resource, []), 'completed');
         });
     }
     // Account Token refresh (spec 4.8). The grant claim allows one rotation in flight per grant across processes,
@@ -492,8 +611,9 @@ export function createClientAuth(options) {
             }
             if (refreshToken === null)
                 return await endRefresh(operationId, 'failed', 'missing_credential');
-            const sessionId = claim.connection.sessionId;
-            const fields = { grant_type: 'refresh_token', refresh_token: refreshToken, session_id: sessionId };
+            if (claim.connection.needsSessionKey)
+                claim.connection = await freshSessionKey(claim.connection, operationId);
+            const fields = { grant_type: 'refresh_token', refresh_token: refreshToken };
             if (resource !== null)
                 fields.resource = resource;
             if (scopes)
@@ -510,21 +630,10 @@ export function createClientAuth(options) {
             if (!dispatched)
                 return await endRefresh(operationId, 'failed', 'state_changed');
             const issuedAt = now();
-            const send = () => tokenRequest(claim.connection.metadata, claim.connection.dpopKeyRef, fields, null);
-            let acquired, newSession = false;
+            const send = () => tokenRequest(claim.connection.metadata, claim.connection.dpopKeyRef, fields);
+            let acquired;
             try {
-                try {
-                    acquired = await send();
-                }
-                catch (error) {
-                    // A definite invalid_session (a 4xx OAuth code) left the Account Token unused, so this is a new request, not a resend:
-                    // without session_id the Company starts a new Session signed in to the same account (spec 4.8).
-                    if (!(error instanceof AuthFailure && error.code === 'invalid_session'))
-                        throw error;
-                    delete fields.session_id;
-                    newSession = true;
-                    acquired = await send();
-                }
+                acquired = await send();
             }
             catch (error) {
                 if (error instanceof AuthFailure && error.retryAfterMs !== undefined)
@@ -536,11 +645,11 @@ export function createClientAuth(options) {
                 return await endRefresh(operationId, 'failed', code);
             }
             const { token, scheme } = acquired;
-            const granted = token.scope.split(' ').filter(Boolean);
+            const granted = (token.scope ?? claim.requested.join(' ')).split(' ').filter(Boolean);
             let problem = null;
             if (token.token_type !== scheme)
                 problem = 'unsupported_token_type';
-            else if (token.signed_in !== true || (newSession ? token.session_id === sessionId : token.session_id !== sessionId) || granted.some(scope => !claim.requested.includes(scope)))
+            else if (granted.some(scope => !claim.requested.includes(scope)))
                 problem = 'invalid_response';
             let refreshRef = null, accessRef = null;
             try {
@@ -560,7 +669,7 @@ export function createClientAuth(options) {
             if (problem || accessRef === null)
                 return await endRefresh(operationId, 'failed', problem ?? 'storage_error', refreshRef);
             const staged = {
-                accessRef, refreshRef, tokenType: token.token_type, sessionId: token.session_id, scopes: granted, signedIn: true, expiresAt: issuedAt + token.expires_in * 1000,
+                accessRef, refreshRef, tokenType: token.token_type, sessionId: claim.connection.sessionId, scopes: granted, signedIn: true, expiresAt: issuedAt + (token.expires_in ?? 60) * 1000,
                 refreshExpiresAt: token.refresh_token_expires_in === undefined ? null : issuedAt + token.refresh_token_expires_in * 1000,
             };
             // Its own commit, so a crash before activation leaves the new Account Token referenced for recover (interface 4).
@@ -603,19 +712,28 @@ export function createClientAuth(options) {
         const grant = operation.grantId === null ? undefined : own(state.grants, operation.grantId);
         if (grant?.operationId === operation.id) {
             grant.operationId = null;
-            if (connection.grantId === grant.id && connection.generation === operation.connectionGeneration) {
+            if (Object.values(state.connections).some(peer => peer.grantId === grant.id)) {
                 if (error === 'invalid_grant') {
                     // Expired or revoked: the Session continues signed out and the User signs in again only on request (spec 4.8, 4.9).
-                    drop.push(grant.secretRef, ...Object.values(connection.slots).map(slot => slot.secretRef));
+                    drop.push(grant.secretRef);
                     delete state.grants[grant.id];
-                    connection.grantId = null;
-                    connection.status = 'signed_out';
-                    connection.slots = {};
+                    for (const peer of Object.values(state.connections))
+                        if (peer.grantId === grant.id) {
+                            drop.push(...Object.values(peer.slots).map(slot => slot.secretRef));
+                            peer.grantId = null;
+                            peer.status = 'signed_out';
+                            peer.slots = {};
+                            peer.generation++;
+                        }
                 }
                 else if (status === 'uncertain' || rotated) {
                     // The Account Token we hold may already be replaced; only a fresh sign-in is safe.
                     grant.status = 'uncertain';
-                    connection.status = 'uncertain';
+                    for (const peer of Object.values(state.connections))
+                        if (peer.grantId === grant.id) {
+                            peer.status = 'uncertain';
+                            peer.generation++;
+                        }
                 }
             }
         }
@@ -625,24 +743,25 @@ export function createClientAuth(options) {
         const staged = operation.staged;
         const connection = own(state.connections, operation.connectionId);
         const grant = operation.grantId === null ? undefined : own(state.grants, operation.grantId);
-        if (!grant || grant.operationId !== operation.id || grant.generation !== operation.grantGeneration || connection.grantId !== grant.id || connection.generation !== operation.connectionGeneration) {
-            // A sign-out or replacement won the race; the late Account Token cannot activate and awaits revocation.
+        if (!grant || grant.operationId !== operation.id || grant.generation !== operation.grantGeneration) {
             if (staged.refreshRef !== null)
                 retire(state, `cln_${operation.id}`, connection, staged.refreshRef);
             drop.push(staged.accessRef);
-            if (grant?.operationId === operation.id)
-                grant.operationId = null;
             return finish(state, operation, 'failed', { error: 'state_changed' });
         }
         grant.operationId = null;
         grant.generation++;
         if (staged.refreshRef !== null) {
-            // The Company rotated the Account Token; the old one is dead and is never sent again (spec 4.8).
             drop.push(grant.secretRef);
             grant.secretRef = staged.refreshRef;
             if (staged.refreshExpiresAt !== null)
                 grant.expiresAt = staged.refreshExpiresAt;
         }
+        // Rotation belongs to the grant even if its initiating Session was replaced meanwhile.
+        if (connection.grantId !== grant.id || connection.generation !== operation.connectionGeneration) {
+            drop.push(staged.accessRef);
+            return finish(state, operation, 'failed', { error: 'state_changed' });
+        }
         switchSession(connection, staged.sessionId, drop);
         // Only this resource's credential changes; other resources' credentials survive (IMPLEMENTATION 3).
         replaceSlot(connection, operation.resource, { secretRef: staged.accessRef, tokenType: staged.tokenType ?? 'DPoP', dpopKeyRef: connection.dpopKeyRef, scopes: staged.scopes, expiresAt: staged.expiresAt, generation: connection.generation }, drop);
@@ -707,6 +826,8 @@ export function createClientAuth(options) {
         const connection = await record(connectionId);
         if (connection.status === 'disconnected')
             throw new AuthFailure('disconnected', connectionId);
+        if (connection.status === 'uncertain')
+            throw new AuthFailure('grant_uncertain', connectionId);
         const slot = own(connection.slots, slotKey(connection.sessionId, resource));
         return slot && slot.secretRef !== stale && slot.expiresAt - SKEW_MS > now() ? slot : renewShared(connectionId, resource);
     }
@@ -716,7 +837,7 @@ export function createClientAuth(options) {
         // A lost exchange or rotation may have issued an Account Token we never saw, so it can never be claimed revoked.
         if (operations.some(op => op.status === 'uncertain') || items.some(item => item.status === 'uncertain'))
             return 'uncertain';
-        return items.length || operations.some(op => op.phase === 'dispatched' || op.phase === 'staged') ? 'pending' : 'complete';
+        return items.length || operations.some(op => op.phase !== 'terminal' && op.phase !== 'prepared') || (own(state.connections, connectionId)?.signingCleanup?.length ?? 0) ? 'pending' : 'complete';
     }
     // RFC 7009 revocation with a fresh client assertion (spec 4.9). Replay is safe, so anything but 200 stays pending.
     async function revoke(connection, item, token) {
@@ -744,14 +865,17 @@ export function createClientAuth(options) {
         }
     }
     async function cleanupNow(connectionId) {
-        const connection = await record(connectionId);
-        const items = Object.values((await load({ connectionId })).cleanup).filter(item => item.connectionId === connectionId && item.status === 'pending');
+        const connection = await record(connectionId), selection = connection.anonymous ? { connectionId } : { account: { issuer: connection.issuer, userId: connection.userId } };
+        const snapshot = await load(selection);
+        for (const peer of Object.values(snapshot.connections))
+            await cleanupSigning(peer);
+        const items = Object.values(snapshot.cleanup).filter(item => item.status === 'pending');
         for (const item of items) {
             const token = await secrets.read(item.secretRef);
-            const revoked = token !== null && await revoke(connection, item, token);
+            const revoked = token !== null && await revoke(own(snapshot.connections, item.connectionId), item, token);
             if (token !== null && !revoked)
                 continue;
-            await commit({ connectionId }, [], (state, drop) => {
+            await commit({ connectionId: item.connectionId }, [], (state, drop) => {
                 const current = own(state.cleanup, item.id);
                 if (current?.secretRef !== item.secretRef)
                     return;
@@ -763,17 +887,17 @@ export function createClientAuth(options) {
                     current.status = 'uncertain';
             });
         }
-        const state = await load({ connectionId });
-        return { connection: publicConnection(state, own(state.connections, connectionId)), cleanup: cleanupStatus(state, connectionId) };
+        const state = await load(selection), statuses = Object.keys(state.connections).map(id => cleanupStatus(state, id));
+        return { connection: publicConnection(state, own(state.connections, connectionId)), cleanup: statuses.includes('uncertain') ? 'uncertain' : statuses.includes('pending') ? 'pending' : 'complete' };
     }
     function targetOf(connection) {
         const entry = connection.metadata.document.agent?.protocols.find(protocol => protocol.type === 'poppy');
         if (!entry)
             throw new AuthFailure('no_conversation', connection.id);
-        return { issuer: connection.issuer, endpoint: entry.endpoint, ...(entry.resource === undefined ? {} : { resource: entry.resource }) };
+        return { issuer: connection.issuer, endpoint: entry.endpoint };
     }
     function outcomeOf(state, operation) {
-        return operation.result ?? { operationId: operation.id, status: 'pending', connection: publicConnection(state, own(state.connections, operation.connectionId)), nextAction: 'wait' };
+        return operation.result ?? { operationId: operation.id, status: operation.status, connection: publicConnection(state, own(state.connections, operation.connectionId)), ...(operation.phase === 'terminal' ? {} : { nextAction: 'wait' }) };
     }
     // The terminal result is recorded once and returned verbatim to duplicate callbacks.
     function finish(state, operation, status, extra = {}) {
@@ -826,24 +950,25 @@ export function createClientAuth(options) {
             drop.push(staged.accessRef);
             return finish(state, operation, problem === 'cancelled' ? 'cancelled' : 'failed', { error: problem, grantedScopes: [...granted], missingScopes });
         }
-        if (previous) {
+        if (previous && !Object.values(state.connections).some(row => row.id !== target.id && row.grantId === previous.id)) {
             retire(state, `cln_${previous.id}`, target, previous.secretRef);
             delete state.grants[previous.id];
         }
         const grantId = randomId('grt_');
         state.grants[grantId] = { id: grantId, issuer: target.issuer, userId: target.userId, secretRef: staged.refreshRef, scopes: granted,
             expiresAt: staged.refreshExpiresAt, generation: 1, status: 'active', operationId: null };
+        switchSession(target, staged.sessionId, drop);
         target.grantId = grantId;
         target.status = 'signed_in';
         target.generation++;
         drop.push(...Object.values(target.slots).map(slot => slot.secretRef));
-        target.slots = { [slotKey(staged.sessionId, operation.resource)]: { secretRef: staged.accessRef, tokenType: 'DPoP', dpopKeyRef: target.dpopKeyRef,
+        target.slots = { [slotKey(staged.sessionId, operation.resource)]: { secretRef: staged.accessRef, tokenType: staged.tokenType ?? 'DPoP', dpopKeyRef: target.dpopKeyRef,
                 scopes: granted, expiresAt: staged.expiresAt, generation: target.generation } };
         return finish(state, operation, 'completed', { grantedScopes: [...granted], missingScopes });
     }
     async function acceptSignIn(operationId, token, issuedAt) {
         const snapshot = await load({ operationId }), operation = own(snapshot.operations, operationId);
-        const granted = token.scope.split(' ').filter(Boolean);
+        const granted = (token.scope ?? operation.scopes.join(' ')).split(' ').filter(Boolean);
         let refreshRef = null;
         try {
             if (token.refresh_token !== undefined)
@@ -852,19 +977,19 @@ export function createClientAuth(options) {
         catch {
             return await terminate(operationId, 'uncertain', 'storage_error');
         }
-        if (token.token_type !== 'DPoP' || token.signed_in !== true || token.session_id !== operation.signInSessionId || !refreshRef ||
+        if (!refreshRef ||
             !granted.length || new Set(granted).size !== granted.length || granted.some(scope => !operation.scopes.includes(scope))) {
             return commit({ operationId }, [], (state, drop) => {
                 const current = own(state.operations, operationId);
                 if (refreshRef)
                     retire(state, `cln_${operationId}`, own(state.connections, current.connectionId), refreshRef);
                 drop.push(...privateRefs(current));
-                return current.phase === 'terminal' ? outcomeOf(state, current) : finish(state, current, 'failed', { error: token.token_type !== 'DPoP' ? 'unsupported_token_type' : 'invalid_response' });
+                return current.phase === 'terminal' ? outcomeOf(state, current) : finish(state, current, 'failed', { error: 'invalid_response' });
             });
         }
         const accessRef = await stageSessionToken(token.access_token);
-        const staged = { accessRef, refreshRef, sessionId: token.session_id, scopes: granted, signedIn: true,
-            expiresAt: issuedAt + token.expires_in * 1000, refreshExpiresAt: token.refresh_token_expires_in === undefined ? null : issuedAt + token.refresh_token_expires_in * 1000 };
+        const staged = { accessRef, refreshRef, tokenType: token.token_type, sessionId: randomId('ses_'), scopes: granted, signedIn: true,
+            expiresAt: issuedAt + (token.expires_in ?? 60) * 1000, refreshExpiresAt: token.refresh_token_expires_in === undefined ? null : issuedAt + token.refresh_token_expires_in * 1000 };
         // Stage before activation: recovery can finish locally without exchanging a consumed credential again.
         const recorded = await transaction({ operationId }, state => {
             const current = own(state.operations, operationId);
@@ -887,6 +1012,8 @@ export function createClientAuth(options) {
     }
     async function claimSignIn(operationId, executionOwner, preSend = false) {
         const snapshot = await load({ operationId }), operation = own(snapshot.operations, operationId);
+        if (operation.phase === 'prepared' && !operation.signInSessionKey)
+            return terminate(operationId, 'failed', 'restart_required');
         await currentConnection(operation.connectionId);
         return await transaction({ operationId }, state => {
             const current = own(state.operations, operationId);
@@ -943,7 +1070,7 @@ export function createClientAuth(options) {
                 throw new AuthFailure('invalid_response');
             }
             const { device_code, user_code, verification_uri, verification_uri_complete, expires_in, interval = 5 } = value ?? {};
-            const hosts = [new URL(connection.issuer).hostname, ...metadata.authorization.poppy_domains];
+            const hosts = [new URL(connection.issuer).hostname, ...metadata.authorization.protected_resources.map(resource => new URL(resource).hostname)];
             if (typeof device_code !== 'string' || !device_code || typeof user_code !== 'string' || !user_code || typeof verification_uri !== 'string' || !allowedHost(verification_uri, hosts) ||
                 (verification_uri_complete !== undefined && (typeof verification_uri_complete !== 'string' || !allowedHost(verification_uri_complete, hosts))) ||
                 typeof expires_in !== 'number' || !Number.isSafeInteger(expires_in) || expires_in <= 0 || expires_in > 86400 || typeof interval !== 'number' || !Number.isSafeInteger(interval) || interval < 1 || interval > 86400)
@@ -994,12 +1121,12 @@ export function createClientAuth(options) {
             const { operation, connection } = claim, code = await secrets.read(operation.device.codeRef);
             if (!code)
                 return await terminate(operationId, 'failed', 'missing_credential');
-            const issuedAt = now(), fields = { grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code: code, session_id: operation.signInSessionId };
+            const issuedAt = now(), fields = { grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code: code };
             if (operation.resource)
                 fields.resource = operation.resource;
             let token;
             try {
-                token = (await tokenRequest(connection.metadata, connection.dpopKeyRef, fields, null)).token;
+                token = (await tokenRequest(connection.metadata, connection.dpopKeyRef, fields)).token;
             }
             catch (error) {
                 if (error instanceof AuthFailure && ['authorization_pending', 'slow_down', 'rate_limited'].includes(error.code)) {
@@ -1035,41 +1162,26 @@ export function createClientAuth(options) {
             const claim = await claimSignIn(operationId, executionOwner, true);
             if (!('operation' in claim))
                 return claim;
-            const { operation, connection } = claim, mediated = connection.metadata.document.auth.mediated;
-            if (!options.trustedInput)
-                return await terminate(operationId, 'failed', 'trusted_input_required');
+            const { operation, connection } = claim, mediated = mediatedSignIn(connection.metadata.document);
+            if (!mediated || !options.trustedInput)
+                return terminate(operationId, 'failed', 'trusted_input_required');
             const fields = operation.mediated ? [{ name: 'code', label: 'One-time code', secret: true }] : mediated.fields;
-            let values;
             try {
-                values = await options.trustedInput.collect({ operationId, issuer: connection.issuer, organization: { ...connection.metadata.document.organization }, fields: structuredClone(fields),
-                    ...(operation.mediated ? { challenge: { id: operation.mediated.challengeId, sentTo: operation.mediated.sentTo, expiresAt: operation.expiresAt } } : {}) });
+                sensitive = await options.trustedInput.collect({ operationId, issuer: connection.issuer, organization: { ...connection.metadata.document.organization }, fields: structuredClone(fields), ...(operation.mediated ? { challenge: { id: operation.mediated.challengeId, sentTo: operation.mediated.sentTo, expiresAt: operation.expiresAt } } : {}) });
             }
             catch {
-                return await terminate(operationId, 'failed', 'input_unavailable');
+                return terminate(operationId, 'failed', 'input_unavailable');
             }
-            sensitive = values;
+            const values = sensitive;
             if (values === null)
-                return await terminate(operationId, 'cancelled');
-            if (!values || Object.keys(values).length !== fields.length || !fields.every(field => Object.hasOwn(values, field.name) && typeof values[field.name] === 'string' && values[field.name].length > 0 && values[field.name].length <= 4096))
-                return await terminate(operationId, 'failed', 'invalid_input');
-            const endpoint = operation.mediated ? `${mediated.endpoint.replace(/\/$/, '')}/${encodeURIComponent(operation.mediated.challengeId)}` : mediated.endpoint;
-            let credential = await credentialFor(connection.id, operation.resource, null), token = await secrets.read(credential.secretRef);
-            if (!token) {
-                credential = await credentialFor(connection.id, operation.resource, credential.secretRef);
-                token = await secrets.read(credential.secretRef);
-            }
-            if (!token)
-                return await terminate(operationId, 'failed', 'missing_credential');
-            if (connection.sessionId !== (await record(connection.id)).sessionId || now() >= operation.expiresAt)
-                return await terminate(operationId, 'expired');
-            let response, json;
-            const issuedAt = now(), key = await loadDpopKey(connection.dpopKeyRef);
+                return terminate(operationId, 'cancelled');
+            if (Object.keys(values).length !== fields.length || !fields.every(field => Object.hasOwn(values, field.name) && typeof values[field.name] === 'string' && values[field.name].length > 0 && values[field.name].length <= 4096))
+                return terminate(operationId, 'failed', 'invalid_input');
             const dispatch = await transaction({ operationId }, state => {
-                const current = own(state.operations, operationId);
+                const current = own(state.operations, operationId), live = own(state.connections, current.connectionId);
                 if (current.phase !== 'prepared' || current.owner?.id !== executionOwner.id || current.cancelRequested)
                     return false;
-                const live = own(state.connections, current.connectionId);
-                if (live.generation !== current.connectionGeneration || live.sessionId !== current.signInSessionId || current.expiresAt <= now()) {
+                if (live.generation !== current.connectionGeneration || current.expiresAt <= now()) {
                     finish(state, current, 'cancelled');
                     return false;
                 }
@@ -1078,69 +1190,48 @@ export function createClientAuth(options) {
             });
             if (!dispatch)
                 return (await api.operation(operationId));
+            const params = { grant_type: MEDIATED_GRANT, ...(operation.mediated ? { sign_in_id: operation.mediated.challengeId, one_time_code: values.code } : { scope: operation.scopes.join(' '), ...values }) };
+            if (operation.resource)
+                params.resource = operation.resource;
+            const issuedAt = now();
             try {
-                // Bounded nonce retry only; credentials remain exclusively within this trusted call.
-                for (let attempt = 0; attempt < 2; attempt++) {
-                    if (attempt > 0 && own((await load({ operationId })).operations, operationId)?.cancelRequested)
-                        return await terminate(operationId, 'cancelled');
-                    response = await transport.fetch(new Request(endpoint, { method: 'POST', headers: { 'content-type': 'application/json', authorization: `DPoP ${token}`, dpop: await proof(key, 'POST', endpoint, token) },
-                        body: JSON.stringify(operation.mediated ? { code: values.code } : { scope: operation.scopes.join(' '), credentials: values }) }));
-                    rememberNonce(endpoint, response);
-                    if (response.status === 401 && attempt === 0 && dpopChallenge(response.headers.get('www-authenticate'))?.error === 'use_dpop_nonce' && response.headers.has('dpop-nonce')) {
-                        await response.body?.cancel();
-                        continue;
-                    }
-                    break;
-                }
-                if (response.status === 429 || response.status === 503)
-                    await holdOff(connection.id, responseFailure(response, 'rate_limited'));
-                json = parseJson(await response.text());
-            }
-            catch {
-                return await terminate(operationId, response?.status === 429 ? 'failed' : 'uncertain', response?.status === 429 ? 'rate_limited' : 'lost_response');
-            }
-            const echoed = Object.values(values);
-            for (const name of Object.keys(values))
-                delete values[name];
-            values = null;
-            if (response.status !== 200) {
-                const error = responseFailure(response, response.status === 429 ? 'rate_limited' : response.status >= 400 && response.status < 500 && typeof json?.error === 'string' && SAFE_ERRORS.has(json.error) ? json.error : 'token_error');
-                return await remoteFailure(operationId, error);
+                const { token } = await tokenRequest(connection.metadata, connection.dpopKeyRef, params, operationId);
+                return await acceptSignIn(operationId, token, issuedAt);
             }
-            if (json?.status === 'complete') {
-                let result;
-                try {
-                    result = parseTokenResponse(json);
-                }
-                catch {
-                    return await terminate(operationId, 'uncertain', 'invalid_response');
+            catch (error) {
+                if (error instanceof MediatedCodeRequired) {
+                    const challenge = error.challenge;
+                    if (operation.mediated && operation.mediated.challengeId !== challenge.id)
+                        return terminate(operationId, 'failed', 'invalid_response');
+                    const sentTo = Object.values(values).some(value => challenge.sentTo.includes(value)) ? 'The company sent a one-time code.' : challenge.sentTo;
+                    return transaction({ operationId }, state => {
+                        const current = own(state.operations, operationId);
+                        if (current.phase !== 'dispatched')
+                            return outcomeOf(state, current);
+                        if (current.cancelRequested)
+                            return finish(state, current, 'cancelled');
+                        current.phase = 'prepared';
+                        delete current.owner;
+                        current.expiresAt = Math.min(current.expiresAt, challenge.expiresAt);
+                        current.mediated = { challengeId: challenge.id, sentTo };
+                        return outcomeOf(state, current);
+                    });
                 }
-                return await acceptSignIn(operationId, result, issuedAt);
+                if (!(error instanceof AuthFailure))
+                    throw error;
+                if (['access_denied', 'invalid_grant', 'expired_token', 'cancelled'].includes(error.code))
+                    return terminate(operationId, error.code === 'expired_token' ? 'expired' : error.code === 'cancelled' ? 'cancelled' : 'denied', error.code);
+                return remoteFailure(operationId, error);
+            }
+            finally {
+                for (const name of Object.keys(params))
+                    delete params[name];
             }
-            if (json?.status === 'failed' || json?.status === 'expired')
-                return await terminate(operationId, json.status === 'expired' ? 'expired' : 'denied');
-            const code = json?.code, expiresAt = typeof json?.expires_at === 'string' ? Date.parse(json.expires_at) : NaN;
-            if (json?.status !== 'code_required' || typeof json.sign_in_id !== 'string' || !/^[A-Za-z0-9_-]{1,256}$/.test(json.sign_in_id) ||
-                (operation.mediated && operation.mediated.challengeId !== json.sign_in_id) || typeof code?.sent_to !== 'string' || code.sent_to.length > 512 || !Number.isFinite(expiresAt) || expiresAt <= now())
-                return await terminate(operationId, 'failed', 'invalid_response');
-            const sentTo = echoed.some(value => value.length > 2 && code.sent_to.includes(value)) ? 'The company sent a one-time code.' : code.sent_to;
-            return await transaction({ operationId }, state => {
-                const current = own(state.operations, operationId);
-                if (current.phase !== 'dispatched')
-                    return outcomeOf(state, current);
-                if (current.cancelRequested)
-                    return finish(state, current, 'cancelled');
-                current.phase = 'prepared';
-                delete current.owner;
-                current.expiresAt = Math.min(current.expiresAt, expiresAt);
-                current.mediated = { challengeId: json.sign_in_id, sentTo };
-                return outcomeOf(state, current);
-            });
         }
         catch (error) {
-            if (!(error instanceof AuthFailure))
+            if (own((await load({ operationId })).operations, operationId)?.phase === 'staged')
                 throw error;
-            return await remoteFailure(operationId, error);
+            return remoteFailure(operationId, error);
         }
         finally {
             if (sensitive)
@@ -1149,61 +1240,120 @@ export function createClientAuth(options) {
             releaseOwner(executionOwner);
         }
     }
-    async function sendAuthorized(connectionId, request, target, requiredScopes, scheme = 'DPoP', retryRejected = true) {
-        const connection = await record(connectionId);
+    async function sendAuthorized(connectionId, request, target, requiredScopes, scheme = 'DPoP', retryRejected = true, service, expectedContext) {
         const url = new URL(request.url), endpoint = new URL(target.endpoint), base = endpoint.pathname.replace(/\/$/, '');
         if (!safeHttps(request.url) || url.origin !== endpoint.origin || (url.pathname !== endpoint.pathname && !url.pathname.startsWith(`${base}/`)))
             throw new AuthFailure('invalid_target', connectionId);
-        if (connection.status === 'disconnected')
-            throw new AuthFailure('disconnected', connectionId);
-        checkCooldown(connection);
-        const resource = target.resource ?? null, wait = url.searchParams.get('wait');
+        let resource = target.resource ?? null;
+        const wait = url.searchParams.get('wait');
         const waitMs = wait !== null && /^\d+$/.test(wait) ? Math.min(Number(wait), MAX_WAIT_SECONDS) * 1000 : 0;
-        let credential = await credentialFor(connectionId, resource, null), nonceRetried = false, renewed = false;
+        let restarted = false, nonceRetried = false, renewed = false, discovered = false;
         for (;;) {
-            if (credential.tokenType !== scheme)
-                throw new AuthFailure('invalid_target', connectionId);
-            if (!requiredScopes.every(scope => credential.scopes.includes(scope))) {
+            const connection = await record(connectionId);
+            if (expectedContext && (expectedContext.companyId !== connection.issuer || expectedContext.clientId !== clientId || expectedContext.userId !== connection.userId || expectedContext.authority !== (connection.status === 'signed_in' && connection.grantId ? 'grant:' + connection.grantId : 'session:' + connection.sessionId)))
+                throw new AuthFailure('business_owner_changed', connectionId);
+            if (connection.status === 'disconnected')
+                throw new AuthFailure('disconnected', connectionId);
+            if (connection.status === 'uncertain')
+                throw new AuthFailure('grant_uncertain', connectionId);
+            checkCooldown(connection);
+            let credential, token;
+            if (connection.status === 'signed_in') {
+                if (service && !discovered) {
+                    try {
+                        resource = (await serviceAuthorization(connection.metadata, options.metadata, transport, target.endpoint, { mcp: service === 'mcp' })).resource ?? null;
+                    }
+                    catch {
+                        throw new AuthFailure('invalid_target', connectionId);
+                    }
+                    discovered = true;
+                }
+                try {
+                    credential = await credentialFor(connectionId, resource, null);
+                }
+                catch (error) {
+                    if ((await record(connectionId)).status === 'signed_out')
+                        continue;
+                    throw error;
+                }
+                const value = await secrets.read(credential.secretRef);
+                if (value === null) {
+                    if (renewed)
+                        throw new AuthFailure('missing_credential', connectionId);
+                    renewed = true;
+                    await credentialFor(connectionId, resource, credential.secretRef);
+                    continue;
+                }
+                token = value;
+            }
+            if (!requiredScopes.every(scope => credential?.scopes.includes(scope))) {
                 const requirement = await api.authorization(connectionId, requiredScopes);
                 if (!renewed && requirement.sufficient) {
                     renewed = true;
-                    credential = await renewShared(connectionId, resource);
+                    await renewShared(connectionId, resource);
                     continue;
                 }
                 throw new AuthFailure('insufficient_scope', connectionId);
             }
-            const token = await secrets.read(credential.secretRef);
-            if (token === null) {
-                if (renewed)
-                    throw new AuthFailure('missing_credential', connectionId);
-                renewed = true;
-                credential = await credentialFor(connectionId, resource, credential.secretRef);
-                continue;
-            }
             const headers = new Headers(request.headers);
-            headers.delete('cookie');
-            headers.delete('dpop');
-            headers.set('authorization', `${scheme} ${token}`);
-            if (scheme === 'DPoP')
-                headers.set('dpop', await proof(await loadDpopKey(credential.dpopKeyRef), request.method, request.url, token));
+            for (const name of ['cookie', 'authorization', 'dpop', 'poppy-session'])
+                headers.delete(name);
+            if (token !== undefined) {
+                headers.set('authorization', `${credential.tokenType} ${token}`);
+                if (credential.tokenType === 'DPoP')
+                    headers.set('dpop', await proof(await loadDpopKey(credential.dpopKeyRef), request.method, request.url, token));
+            }
+            headers.set('poppy-session', await sessionHeader(connection, request, token));
+            if ((await record(connectionId)).generation !== connection.generation)
+                continue;
             const authorized = new Request(request.clone(), { headers, credentials: 'omit', redirect: 'error' });
             const streaming = request.headers.get('accept')?.split(',').some(value => value.trim().split(';')[0] === 'text/event-stream');
             const response = await (streaming && transport.stream ? transport.stream(authorized) : transport.fetch(authorized, { waitMs }));
             rememberNonce(request.url, response);
             if (response.status === 429 || response.status === 503)
                 await holdOff(connectionId, responseFailure(response, 'rate_limited'));
+            if (response.status === 400) {
+                let invalid = false;
+                try {
+                    invalid = parseProtocolError(parseJson(await response.clone().text())).error === 'invalid_session';
+                }
+                catch { /* Not a Session refusal. */ }
+                if (invalid && !restarted) {
+                    await response.body?.cancel().catch(() => { });
+                    restarted = true;
+                    await transaction({ connectionId }, state => {
+                        const live = own(state.connections, connectionId);
+                        if (live.generation !== connection.generation)
+                            return;
+                        live.sessionId = randomId('ses_');
+                        live.generation++;
+                        live.slots = Object.fromEntries(Object.entries(live.slots).map(([key, slot]) => [slotKey(live.sessionId, JSON.parse(key)[1]), slot]));
+                    });
+                    if (!retryRejected)
+                        return response;
+                    continue;
+                }
+            }
             if (response.status !== 401 || !retryRejected)
                 return response;
-            const error = schemeChallenge(response.headers.get('www-authenticate'), scheme)?.error;
+            const challenge = schemeChallenge(response.headers.get('www-authenticate'), credential?.tokenType ?? scheme), error = challenge?.error;
             if (error === 'use_dpop_nonce' && !nonceRetried && response.headers.has('dpop-nonce')) {
                 await response.body?.cancel().catch(() => { });
                 nonceRetried = true;
                 continue;
             }
-            if (error === 'invalid_token' && !renewed) {
+            if (error === 'invalid_token' && credential && !renewed) {
                 await response.body?.cancel().catch(() => { });
                 renewed = true;
-                credential = await credentialFor(connectionId, resource, credential.secretRef);
+                if (service && challenge?.resource_metadata) {
+                    try {
+                        resource = (await serviceAuthorization(connection.metadata, options.metadata, transport, target.endpoint, { mcp: service === 'mcp', metadataUrl: challenge.resource_metadata, refresh: true })).resource ?? null;
+                    }
+                    catch {
+                        throw new AuthFailure('invalid_target', connectionId);
+                    }
+                }
+                await credentialFor(connectionId, resource, credential.secretRef);
                 continue;
             }
             return response;
@@ -1218,24 +1368,31 @@ export function createClientAuth(options) {
             catch {
                 throw new AuthFailure('discovery_failed');
             }
-            if (!metadata.authorization)
-                throw new AuthFailure('no_auth');
-            const issuer = metadata.authorization.issuer;
+            const issuer = companyIdentifier(metadata);
             const anonymous = input?.anonymous === true;
-            const { userId, dpopKeyRef } = await identityFor(issuer, anonymous);
+            if (input?.accountFrom !== undefined && (anonymous || typeof input.accountFrom !== 'string'))
+                throw new AuthFailure('invalid_account_source');
+            const { userId } = await identityFor(issuer, anonymous);
+            const epoch = (await load({ issuer })).epoch;
+            const dpopKeyRef = await newSessionKey();
             const createdAt = now();
-            const token = await signedOutToken(metadata, userId, dpopKeyRef, null, null, anonymous);
-            const secretRef = await stageSessionToken(token.access_token);
-            const id = randomId('con_'), operationId = randomId('op_');
-            return commit({ issuer, history: true }, [secretRef], state => {
+            const id = randomId('con_'), operationId = randomId('op_'), sessionId = randomId('ses_');
+            return commit(input?.accountFrom ? { account: { issuer, userId }, history: true } : { issuer, history: true }, [dpopKeyRef], state => {
                 // A reset or competing identity since we signed means this session belongs to no current identity.
-                if (!anonymous && own(state.identities, issuer)?.dpopKeyRef !== dpopKeyRef)
+                if (state.epoch !== epoch || (!anonymous && own(state.identities, issuer)?.userId !== userId))
                     throw new AuthFailure('state_changed');
                 const connection = {
-                    id, domain, issuer, metadata, userId, dpopKeyRef, sessionId: token.session_id, generation: 1, status: 'signed_out', grantId: null,
-                    slots: { [slotKey(token.session_id, null)]: { secretRef, tokenType: 'DPoP', dpopKeyRef, scopes: [], expiresAt: createdAt + token.expires_in * 1000, generation: 1 } },
+                    id, domain, issuer, metadata, userId, dpopKeyRef, sessionId, generation: 1, status: 'signed_out', grantId: null,
+                    slots: {},
                     ...(anonymous ? { anonymous: true } : {}),
                 };
+                if (input?.accountFrom) {
+                    const source = own(state.connections, input.accountFrom), grant = source?.grantId ? own(state.grants, source.grantId) : undefined;
+                    if (!source || source.anonymous || source.issuer !== issuer || source.userId !== userId || source.status !== 'signed_in' || !grant || grant.status !== 'active' || (grant.expiresAt !== null && grant.expiresAt <= now()))
+                        throw new AuthFailure('state_changed');
+                    connection.grantId = grant.id;
+                    connection.status = 'signed_in';
+                }
                 state.connections[id] = connection;
                 pruneHistory(state);
                 const result = { operationId, status: 'completed', connection: publicConnection(state, connection) };
@@ -1263,13 +1420,10 @@ export function createClientAuth(options) {
             const connection = await currentConnection(connectionId), state = await load({ connectionId });
             const grantedScopes = publicConnection(state, connection).scopes;
             const grant = connection.grantId ? own(state.grants, connection.grantId) : undefined;
-            const methods = ['direct', 'device', 'mediated'].flatMap(method => {
-                const supported = connection.metadata.document.auth?.[method];
-                return supported ? [{ method, scopes: [...supported.scopes] }] : [];
-            });
+            const methods = signInMethods(connection.metadata);
             const required = [...new Set(requiredScopes)], missingScopes = required.filter(scope => !grantedScopes.includes(scope));
             return { requiredScopes: required, grantedScopes, missingScopes, sufficient: connection.status === 'signed_in' && grant?.status === 'active' && (grant.expiresAt === null || grant.expiresAt > now()) && !missingScopes.length,
-                methods, organization: { ...connection.metadata.document.organization } };
+                methods, scopeDescriptions: { ...connection.metadata.document.auth?.scopes }, organization: { ...connection.metadata.document.organization } };
         },
         async beginSignIn(connectionId, input) {
             let found = await currentConnection(connectionId);
@@ -1282,12 +1436,12 @@ export function createClientAuth(options) {
             const method = input?.method ?? 'direct';
             if (!['direct', 'device', 'mediated'].includes(method))
                 throw new AuthFailure('unsupported_method', connectionId);
-            const supported = found.metadata.document.auth?.[method];
+            const supported = signInMethods(found.metadata).find(item => item.method === method);
             const authorizationEndpoint = found.metadata.authorization?.authorization_endpoint;
             if (!supported || (method === 'direct' && !authorizationEndpoint) || (method === 'device' && !found.metadata.authorization?.device_authorization_endpoint))
                 throw new AuthFailure(`${method}_unavailable`, connectionId);
             const { scopes, redirectUri, browserBinding, requiredExistingScopes } = input ?? {};
-            if (!Array.isArray(scopes) || !scopes.length || new Set(scopes).size !== scopes.length || !scopes.every(scope => typeof scope === 'string' && supported.scopes.includes(scope)))
+            if (!Array.isArray(scopes) || !scopes.length || new Set(scopes).size !== scopes.length || !scopes.every(scope => typeof scope === 'string' && (/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(scope) && (method !== 'mediated' || supported.scopes.includes(scope)))))
                 throw new AuthFailure('invalid_scope', connectionId);
             const requirement = await api.authorization(connectionId, scopes);
             if (requiredExistingScopes !== undefined && (!Array.isArray(requiredExistingScopes) || !requiredExistingScopes.every(scope => requirement.grantedScopes.includes(scope))))
@@ -1297,32 +1451,22 @@ export function createClientAuth(options) {
             checkCooldown(found);
             if (method === 'mediated' && !options.trustedInput)
                 throw new AuthFailure('trusted_input_required', connectionId);
-            if (method === 'direct' && (typeof redirectUri !== 'string' || !options.redirectUris.includes(redirectUri) || !URL.canParse(redirectUri) || !safeHttps(redirectUri) || new URL(redirectUri).hostname !== new URL(clientId).hostname || CALLBACK_PARAMS.some(name => new URL(redirectUri).searchParams.has(name))))
+            if (method === 'direct' && (typeof redirectUri !== 'string' || !registeredRedirect(redirectUri, options.redirectUris, clientId) || CALLBACK_PARAMS.some(name => new URL(redirectUri).searchParams.has(name))))
                 throw new AuthFailure('invalid_redirect', connectionId);
             // The host derives this from its authenticated browser session; a short value would be guessable.
             if (method === 'direct' && (typeof browserBinding !== 'string' || browserBinding.length < 22))
                 throw new AuthFailure('invalid_binding', connectionId);
-            // Ask for the conversation resource up front so the signed-in token is usable there (spec 4.3 "Narrower tokens").
-            const resource = found.metadata.document.agent?.protocols.find(protocol => protocol.type === 'poppy')?.resource ?? null;
-            if (await resourceScheme(found.metadata, resource) !== 'DPoP')
-                throw new AuthFailure('invalid_target', connectionId);
-            // The code exchange names this Session (spec 4.5). A stale credential means it may have ended, so renew first,
-            // which replaces an ended Session; a failed renewal leaves the Session as it was for the issuer to judge.
-            const renew = () => credentialFor(connectionId, resource, null).catch(error => { if (!(error instanceof AuthFailure))
-                throw error; });
-            if (found.status === 'signed_out' || found.status === 'signed_in')
-                await renew();
-            let connection = await record(connectionId);
-            // An expired Account Token ends the refresh as invalid_grant, leaving the connection signed out on a possibly ended Session.
-            if (found.status === 'signed_in' && connection.status === 'signed_out') {
-                await renew();
-                connection = await record(connectionId);
-            }
+            // Service metadata, rather than an obsolete discovery field, selects narrower tokens.
+            const conversation = found.metadata.document.agent?.protocols.find(protocol => protocol.type === 'poppy');
+            const resource = conversation ? (await serviceAuthorization(found.metadata, options.metadata, transport, conversation.endpoint)).resource ?? null : null;
+            const connection = await record(connectionId);
             // An uncertain grant recovers only through a fresh sign-in; a disconnected connection never signs in again (spec 4.9).
             if (connection.status === 'disconnected' || connection.sessionId === null)
                 throw new AuthFailure('sign_in_unavailable', connectionId);
             const state = b64(crypto.getRandomValues(new Uint8Array(32)));
             const verifier = b64(crypto.getRandomValues(new Uint8Array(32)));
+            const sessionKey = (await loadDpopKey(connection.dpopKeyRef)).thumbprint;
+            const proofBound = method === 'direct' && await resourceScheme(found.metadata, resource) === 'DPoP';
             const verifierRef = method === 'direct' ? await secrets.stage(verifier) : null;
             const createdAt = now(), operationId = randomId('op_');
             const outcome = await commit({ connectionId, history: true }, [verifierRef], draft => {
@@ -1333,7 +1477,7 @@ export function createClientAuth(options) {
                 const operation = draft.operations[operationId] = {
                     epoch: draft.epoch, id: operationId, kind: 'sign_in', connectionId, connectionGeneration: current.generation, grantId: current.grantId, grantGeneration: null,
                     phase: 'prepared', status: 'pending', createdAt, expiresAt: createdAt + SIGN_IN_MS, resource, scopes: [...scopes],
-                    method, signInSessionId: connection.sessionId, requiredExistingScopes: requiredExistingScopes ?? requirement.grantedScopes,
+                    method, signInSessionId: connection.sessionId, signInSessionKey: sessionKey, requiredExistingScopes: requiredExistingScopes ?? requirement.grantedScopes,
                     direct: method === 'direct' ? { stateHash: sha256(state), verifierRef: verifierRef, browserHash: sha256(browserBinding), redirectUri: redirectUri, issuer: current.issuer, clientId, sessionId: connection.sessionId } : null,
                     staged: null, result: null,
                 };
@@ -1347,6 +1491,8 @@ export function createClientAuth(options) {
             const query = { response_type: 'code', client_id: clientId, redirect_uri: redirectUri, scope: scopes.join(' '), state, code_challenge: sha256(verifier), code_challenge_method: 'S256' };
             for (const [name, value] of Object.entries(query))
                 url.searchParams.set(name, value);
+            if (proofBound)
+                url.searchParams.set('dpop_jkt', sessionKey);
             if (resource !== null)
                 url.searchParams.set('resource', resource);
             return { outcome, authorizationUrl: url.href };
@@ -1366,6 +1512,8 @@ export function createClientAuth(options) {
                 if (!found || !direct || direct.browserHash !== browserHash || !redirectMatches(base, new URL(direct.redirectUri)) || params.iss !== direct.issuer)
                     throw new AuthFailure('invalid_callback');
                 checkCooldown(await record(found.connectionId));
+                if (found.phase === 'prepared' && !found.signInSessionKey)
+                    return terminate(found.id, 'failed', 'restart_required');
                 const operationId = found.id;
                 const verifier = found.phase === 'prepared' && params.code !== undefined ? await secrets.read(direct.verifierRef) : null;
                 const at = now();
@@ -1377,7 +1525,7 @@ export function createClientAuth(options) {
                     if (operation.phase !== 'prepared')
                         return outcomeOf(state, operation);
                     const connection = own(state.connections, operation.connectionId);
-                    if (connection.generation !== operation.connectionGeneration)
+                    if (connection.generation !== operation.connectionGeneration || connection.sessionId !== operation.signInSessionId)
                         return finish(state, operation, 'failed', { error: 'state_changed' });
                     if (at >= operation.expiresAt)
                         return finish(state, operation, 'expired');
@@ -1395,13 +1543,13 @@ export function createClientAuth(options) {
                     return claim;
                 }
                 const { connection, operation } = claim;
-                const fields = { grant_type: 'authorization_code', code: params.code, redirect_uri: direct.redirectUri, code_verifier: verifier, session_id: direct.sessionId };
+                const fields = { grant_type: 'authorization_code', code: params.code, redirect_uri: direct.redirectUri, code_verifier: verifier };
                 if (operation.resource !== null)
                     fields.resource = operation.resource;
                 const issuedAt = now();
                 let token;
                 try {
-                    token = (await tokenRequest(connection.metadata, connection.dpopKeyRef, fields, null)).token;
+                    token = (await tokenRequest(connection.metadata, connection.dpopKeyRef, fields)).token;
                 }
                 catch (error) {
                     if (error instanceof AuthFailure)
@@ -1477,6 +1625,8 @@ export function createClientAuth(options) {
                             result = activateSignIn(state, operation, drop);
                         else if (operation.phase !== 'prepared')
                             result = finish(state, operation, 'uncertain', { error: 'lost_response' });
+                        else if (operation.kind === 'sign_in' && !operation.signInSessionKey)
+                            result = finish(state, operation, 'failed', { error: 'restart_required' });
                         else if (at >= operation.expiresAt)
                             result = finish(state, operation, 'expired');
                         else
@@ -1499,38 +1649,52 @@ export function createClientAuth(options) {
                 throw new AuthFailure('invalid_scope', connectionId);
             return renewal(await currentConnection(connectionId), resource, scopes ?? null);
         },
-        // Sign-out wins over in-flight sign-in and refresh: disconnection and the new generation commit before anything goes remote (IMPLEMENTATION 4).
+        // Opaque grants have no standard account identifier; revoke all grants for this local User and Company.
         async signOut(connectionId) {
-            await record(connectionId);
-            await commit({ connectionId }, [], (state, drop) => {
-                const connection = own(state.connections, connectionId);
-                if (connection.status === 'disconnected')
-                    return;
-                connection.generation++;
-                connection.status = 'disconnected';
-                drop.push(...Object.values(connection.slots).map(slot => slot.secretRef));
-                connection.slots = {};
-                if (connection.anonymous) {
-                    drop.push(connection.dpopKeyRef);
-                    connection.userId = '';
-                    connection.sessionId = null;
-                }
-                const grant = connection.grantId === null ? undefined : own(state.grants, connection.grantId);
-                if (grant) {
-                    retire(state, `cln_${grant.id}`, connection, grant.secretRef);
-                    delete state.grants[grant.id];
-                }
-                connection.grantId = null;
-                for (const operation of Object.values(state.operations)) {
-                    if (operation.connectionId !== connectionId || operation.epoch !== state.epoch || operation.phase !== 'prepared')
+            const selected = await record(connectionId), selection = selected.anonymous ? { connectionId } : { account: { issuer: selected.issuer, userId: selected.userId } };
+            await commit(selection, [], (state, drop) => {
+                for (const connection of Object.values(state.connections)) {
+                    if (connection.status === 'disconnected')
                         continue;
-                    finish(state, operation, 'cancelled');
-                    drop.push(...privateRefs(operation));
+                    connection.generation++;
+                    connection.status = connection.anonymous ? 'disconnected' : 'signed_out';
+                    drop.push(...Object.values(connection.slots).map(slot => slot.secretRef));
+                    connection.slots = {};
+                    if (connection.anonymous) {
+                        if (connection.sessionSigning)
+                            (connection.signingCleanup ??= []).push(connection.sessionSigning.keyRef, connection.sessionSigning.delegationRef);
+                        delete connection.sessionSigning;
+                        (connection.signingCleanup ??= []).push(connection.dpopKeyRef);
+                        connection.userId = '';
+                        connection.sessionId = null;
+                    }
+                    const grant = connection.grantId === null ? undefined : own(state.grants, connection.grantId);
+                    if (grant) {
+                        retire(state, `cln_${grant.id}`, connection, grant.secretRef);
+                        delete state.grants[grant.id];
+                    }
+                    connection.grantId = null;
+                    for (const operation of Object.values(state.operations)) {
+                        if (operation.connectionId !== connection.id || operation.epoch !== state.epoch || operation.phase !== 'prepared')
+                            continue;
+                        finish(state, operation, 'cancelled');
+                        drop.push(...privateRefs(operation));
+                    }
                 }
             });
             return cleanupNow(connectionId);
         },
         retryCleanup: cleanupNow,
+        async businessContext(connectionId) {
+            const connection = await currentConnection(connectionId);
+            if (!connection.sessionId || !['signed_out', 'signed_in'].includes(connection.status))
+                throw new AuthFailure('invalid_state', connectionId);
+            const client = await options.metadata.resolveClient(options.clientId);
+            return { companyId: connection.issuer, companyName: connection.metadata.document.organization.name,
+                clientId: options.clientId, userId: connection.userId,
+                authority: connection.status === 'signed_in' && connection.grantId ? 'grant:' + connection.grantId : 'session:' + connection.sessionId,
+                operations: supportsOperations(client) && supportsOperations(connection.metadata.document) };
+        },
         async apiTarget(connectionId, apiUrl, destination) {
             const connection = await currentConnection(connectionId);
             try {
@@ -1540,17 +1704,17 @@ export function createClientAuth(options) {
                 throw new AuthFailure('invalid_target', connectionId);
             }
         },
-        async apiFetch(connectionId, request, target, requiredScopes = []) {
+        async apiFetch(connectionId, request, target, requiredScopes = [], expectedContext) {
             const expected = await api.apiTarget(connectionId, target.apiUrl, target.endpoint);
             if (expected.kind !== target.kind || expected.issuer !== target.issuer || expected.endpoint !== target.endpoint || expected.resource !== target.resource || expected.scheme !== target.scheme)
                 throw new AuthFailure('invalid_target', connectionId);
             if (expected.kind === 'mcp' && request.url !== expected.endpoint)
                 throw new AuthFailure('invalid_target', connectionId);
-            return sendAuthorized(connectionId, request, expected, requiredScopes, expected.scheme);
+            return sendAuthorized(connectionId, request, expected, requiredScopes, expected.scheme, true, expected.kind, expectedContext);
         },
         async joinBrowser(connectionId, returnTo, controller) {
             const connection = await currentConnection(connectionId), endpoint = connection.metadata.document.web?.browser_session_endpoint;
-            if (!endpoint || !connection.sessionId || connection.status === 'disconnected' || connection.status === 'uncertain' || controller?.kind !== 'agent-controlled' || typeof controller.postForm !== 'function')
+            if (!endpoint || !connection.sessionId || connection.status === 'disconnected' || connection.status === 'uncertain' || controller?.kind !== 'agent-controlled' || typeof controller.loadJoinForm !== 'function' || typeof controller.postForm !== 'function' || typeof controller.navigate !== 'function')
                 throw new AuthFailure('invalid_browser', connectionId);
             try {
                 browserDestination(returnTo, connection.metadata.document.organization.domain);
@@ -1558,26 +1722,27 @@ export function createClientAuth(options) {
             catch {
                 throw new AuthFailure('invalid_target', connectionId);
             }
-            const key = await loadDpopKey(connection.dpopKeyRef);
-            let value;
-            if (options.assertions && !connection.anonymous) {
-                let result;
-                try {
-                    result = await options.assertions.assert({ purpose: 'browser', operationId: randomId('op_'), issuer: connection.issuer, sessionId: connection.sessionId, returnTo });
-                }
-                catch (error) {
-                    throw providerFailure(error, connectionId);
-                }
-                value = providerAssertion(result, connectionId);
-            }
-            else
-                value = await signIdentity({ typ: 'poppy-browser+jwt' }, { ...assertionClaims(connection.userId, endpoint), session_id: connection.sessionId, return_to: returnTo }, key.thumbprint);
             try {
-                await controller.postForm({ url: endpoint, fields: { assertion: value }, validateRedirect(status, location) {
-                        if (status !== 303 || location !== returnTo)
+                const { code } = await controller.loadJoinForm(endpoint);
+                if (typeof code !== 'string' || !code || code.length > 256)
+                    throw new Error('code');
+                const live = await currentConnection(connectionId);
+                if (live.generation !== connection.generation || live.dpopKeyRef !== connection.dpopKeyRef || live.status !== connection.status)
+                    throw new Error('state changed');
+                const authorize = new URL(endpoint);
+                authorize.pathname = authorize.pathname.replace(/\/$/, '') + '/authorize';
+                const response = await sendAuthorized(connectionId, new Request(authorize, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ code }) }), { issuer: connection.issuer, endpoint }, []);
+                if (response.status !== 204)
+                    throw new AuthFailure('browser_authorization_failed', connectionId);
+                await response.body?.cancel();
+                await controller.postForm({ url: endpoint, fields: { code }, validateRedirect(status, location) {
+                        if (status !== 303)
                             throw new AuthFailure('invalid_browser_redirect', connectionId);
-                        return returnTo;
+                        const destination = new URL(location, endpoint).href;
+                        browserDestination(destination, connection.metadata.document.organization.domain);
+                        return destination;
                     } });
+                await controller.navigate(returnTo);
             }
             catch {
                 throw new AuthFailure('browser_failed', connectionId);
@@ -1589,14 +1754,29 @@ export function createClientAuth(options) {
             if (!endpoint)
                 throw new AuthFailure('feedback_unavailable', connectionId);
             const response = await sendAuthorized(connectionId, new Request(endpoint, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(report) }), { issuer: connection.issuer, endpoint }, [], 'DPoP', false);
-            if (response.status !== 202 || (await response.text()) !== '')
-                throw new AuthFailure('feedback_failed', connectionId);
+            try {
+                const text = await response.text();
+                if (response.status === 202 && text === '')
+                    return;
+                if (response.status === 200)
+                    return parseAlternative(parseJson(text), connection.metadata.document);
+            }
+            catch { /* Do not expose company response/parser details. */ }
+            throw new AuthFailure('feedback_failed', connectionId);
+        },
+        async excludedTasks(connectionId) {
+            const connection = await currentConnection(connectionId);
+            if (!connection.metadata.document.excluded_tasks)
+                return [];
+            if (!options.metadata.resolveExcludedTasks)
+                throw new AuthFailure('excluded_tasks_unavailable', connectionId);
+            return options.metadata.resolveExcludedTasks(connection.metadata.document);
         },
-        async authorizedFetch(connectionId, request, target, requiredScopes = []) {
+        async authorizedFetch(connectionId, request, target, requiredScopes = [], expectedContext) {
             const connection = await currentConnection(connectionId), expected = targetOf(connection);
             if (target.issuer !== expected.issuer || target.endpoint !== expected.endpoint || target.resource !== expected.resource)
                 throw new AuthFailure('invalid_target', connectionId);
-            return sendAuthorized(connectionId, request, expected, requiredScopes);
+            return sendAuthorized(connectionId, request, expected, requiredScopes, 'DPoP', true, 'conversation', expectedContext);
         },
     };
     return api;