@withone/connect 0.9.0 → 0.11.0

package/dist/server/index.esm.js

@@ -70,6 +70,18 @@ function tenancyHeaders(accessToken) {
   }
 }
 
+/** When a refresh token stops working, in epoch milliseconds, from its
+ *  `exp` claim. Null when the token carries no readable expiry, in which
+ *  case only One can say whether it still works. */
+function refreshTokenExpiresAt(refreshToken) {
+  try {
+    const payload = JSON.parse(Buffer.from(refreshToken.split(".")[1], "base64url").toString());
+    return typeof payload.exp === "number" && Number.isFinite(payload.exp) ? payload.exp * 1000 : null;
+  } catch {
+    return null;
+  }
+}
+
 /** The scopes the token was granted, from its claims. Display only. */
 function tokenScopes(accessToken) {
   try {
@@ -89,8 +101,8 @@ function tokenScopes(accessToken) {
 
 /**
  * Where the app keeps each user's tokens: its database, a cache, an
- * encrypted cookie. The SDK never sees a token outside these three
- * calls. `userId` is the app's own id for its user.
+ * encrypted cookie. The SDK never sees a token outside these calls.
+ * `userId` is the app's own id for its user.
  */
 
 /** The transaction cookie the authorize leg sets and the callback reads. */
@@ -99,6 +111,14 @@ function tokenScopes(accessToken) {
 
 /** One catalog action for a platform. */
 
+/**
+ * - `not_connected`: no tokens are stored for this user.
+ * - `refresh_failed`: One declared the grant dead (revoked, expired or
+ *   reused). The tokens were cleared; ask the user to connect again.
+ * - `request_failed`: One answered with an error or could not be
+ *   reached. During a refresh the tokens are kept, so retry later.
+ */
+
 class OneConnectError extends Error {
   constructor(code, message, status) {
     super(message);
@@ -126,12 +146,26 @@ class OneConnectError extends Error {
  *   const reply = await oneConnect.runAction(userId, { connectionKey, actionId, method, path });
  *
  * The Next.js and Node adapters turn the first two into route handlers.
+ *
+ * Refresh. One's access token lives an hour by default, its refresh token 30
+ * days; every refresh rotates both, and One treats a second use of a
+ * rotated refresh token as theft and revokes the whole grant. So the
+ * client refreshes one user at a time (in this process always, across
+ * processes through `tokenStore.withLock`), re-reads the store before
+ * spending a refresh token, clears tokens only when One declares the
+ * grant dead, and never lets a failing old pair delete a newer one.
  */
 
 /** Refresh this long before expiry, so a call never races the clock. */
 const REFRESH_MARGIN_MS = 60_000;
 const CATALOG_PAGE_SIZE = 100;
 const CATALOG_MAX_PAGES = 20;
+
+/** What One's token endpoint answered. A network failure throws instead. */
+
+/** The one refusal that means the grant is gone for good: revoked by the
+ *  user, expired, or burned by a reused refresh token (RFC 6749 §5.2). */
+const isDeadGrant = answer => !answer.ok && answer.status === 400 && answer.error === "invalid_grant";
 function createOneConnect(config) {
   const oneApiUrl = (config.oneApiUrl ?? DEFAULT_ONE_API_URL).replace(/\/+$/, "");
   const authorizeUrl = `${oneApiUrl}/oauth/authorize`;
@@ -152,7 +186,7 @@ function createOneConnect(config) {
     if (message) url.searchParams.set(RETURN_MESSAGE_PARAM, message);
     return url.toString();
   };
-  const exchange = async body => {
+  const postToken = async body => {
     const response = await fetch(tokenUrl, {
       method: "POST",
       headers: {
@@ -161,10 +195,40 @@ function createOneConnect(config) {
       },
       body
     });
-    if (!response.ok) {
-      throw new OneConnectError("request_failed", `One refused the token request (HTTP ${response.status}).`, response.status);
+    if (response.ok) return {
+      ok: true,
+      body: await response.json()
+    };
+    let error;
+    try {
+      const refusal = await response.json();
+      if (typeof refusal.error === "string") error = refusal.error;
+    } catch {
+      /* not an OAuth error body: a proxy page or a server error */
+    }
+    return {
+      ok: false,
+      status: response.status,
+      error
+    };
+  };
+  const exchange = async body => {
+    const answer = await postToken(body);
+    if (!answer.ok) {
+      throw new OneConnectError("request_failed", `One refused the token request (HTTP ${answer.status}).`, answer.status);
     }
-    return await response.json();
+    return answer.body;
+  };
+
+  /** Runs `run` under the app's cross-process lock for this user, when
+   *  the store has one. */
+  const locked = (userId, run) => tokenStore.withLock ? tokenStore.withLock(userId, run) : run();
+
+  /** Whether either token of the pair stops working within `withinMs`. */
+  const expiresWithin = (tokens, withinMs) => {
+    const horizon = Date.now() + withinMs;
+    const refreshExpiresAt = refreshTokenExpiresAt(tokens.refreshToken);
+    return tokens.expiresAt <= horizon || refreshExpiresAt !== null && refreshExpiresAt <= horizon;
   };
   const toTokens = response => ({
     accessToken: response.access_token,
@@ -214,7 +278,9 @@ function createOneConnect(config) {
         redirect_uri: config.redirectUri,
         code_verifier: verifier
       })));
-      await tokenStore.saveTokens(input.userId, tokens);
+      // Under the lock, so a refresh in flight on another server cannot
+      // interleave with this save.
+      await locked(input.userId, () => tokenStore.saveTokens(input.userId, tokens));
     } catch (error) {
       const status = error instanceof OneConnectError ? error.status : undefined;
       return fail("failed", status ? `One rejected the code exchange (HTTP ${status}).` : "One could not be reached to complete the connection.");
@@ -225,39 +291,81 @@ function createOneConnect(config) {
       clearCookieName: cookieName
     };
   };
-  const refreshTokens = userId => {
+  const notConnected = () => new OneConnectError("not_connected", "This user is not connected.");
+
+  /**
+   * The grant behind `failed` is dead. Clears it, unless a newer pair
+   * landed while it was failing (a reconnect's callback, another
+   * server's refresh): that pair is returned instead, because the user
+   * did nothing wrong and deleting it would disconnect them.
+   */
+  const retire = async (userId, failed, status) => {
+    const latest = await tokenStore.loadTokens(userId);
+    if (latest && latest.refreshToken !== failed.refreshToken) return latest;
+    await tokenStore.clearTokens(userId, failed);
+    throw new OneConnectError("refresh_failed", "The connection to One has expired or was revoked. Ask the user to connect again.", status);
+  };
+
+  /**
+   * The one place a refresh token is spent. Under the app's lock it
+   * re-reads the store, and refreshes only when `stillNeeded` says the
+   * stored pair still needs it: another process may have refreshed while
+   * this one waited, and spending the same refresh token twice makes One
+   * revoke the grant.
+   */
+  const refreshUnderLock = (userId, stillNeeded) => locked(userId, async () => {
+    const current = await tokenStore.loadTokens(userId);
+    if (!current) throw notConnected();
+    if (!stillNeeded(current)) return current;
+
+    // An expired refresh token cannot work, and One answers one with a
+    // server error rather than invalid_grant, so settle it here.
+    const refreshExpiresAt = refreshTokenExpiresAt(current.refreshToken);
+    if (refreshExpiresAt !== null && refreshExpiresAt <= Date.now()) return retire(userId, current);
+    let answer;
+    try {
+      answer = await postToken(new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: current.refreshToken
+      }));
+    } catch {
+      throw new OneConnectError("request_failed", "One could not be reached to refresh the connection. The tokens were kept; try again.");
+    }
+    if (answer.ok) {
+      // Both tokens: One rotates the pair on every refresh.
+      const next = toTokens(answer.body);
+      await tokenStore.saveTokens(userId, next);
+      return next;
+    }
+    if (isDeadGrant(answer)) return retire(userId, current, answer.status);
+    // A server error, a rate limit, a misconfigured secret: nothing says
+    // the grant is gone, so keep the tokens and let the caller retry.
+    throw new OneConnectError("request_failed", `One could not refresh the connection (HTTP ${answer.status}). The tokens were kept; try again.`, answer.status);
+  });
+
+  /** One refresh per user in this process; concurrent callers share it. */
+  const singleFlight = (userId, job) => {
     const inFlight = refreshing.get(userId);
     if (inFlight) return inFlight;
-    const job = (async () => {
-      const current = await tokenStore.loadTokens(userId);
-      if (!current) throw new OneConnectError("not_connected", "This user is not connected.");
-      try {
-        const next = toTokens(await exchange(new URLSearchParams({
-          grant_type: "refresh_token",
-          refresh_token: current.refreshToken
-        })));
-        // Both tokens: One rotates the pair on every refresh.
-        await tokenStore.saveTokens(userId, next);
-        return next;
-      } catch (error) {
-        // The family is dead: revoked, expired or reused. Keeping the
-        // pair would only fail again; the user has to reconnect.
-        await tokenStore.clearTokens(userId);
-        const status = error instanceof OneConnectError ? error.status : undefined;
-        throw new OneConnectError("refresh_failed", "The connection to One has expired or was revoked. Ask the user to connect again.", status);
-      } finally {
-        refreshing.delete(userId);
-      }
-    })();
-    refreshing.set(userId, job);
-    return job;
+    const running = job().finally(() => refreshing.delete(userId));
+    refreshing.set(userId, running);
+    return running;
   };
-  const getAccessToken = async userId => {
+  const refreshTokens = userId => singleFlight(userId, async () => {
+    const before = await tokenStore.loadTokens(userId);
+    if (!before) throw notConnected();
+    // Rotate the pair seen now; a pair someone else rotated since is
+    // already fresh.
+    return refreshUnderLock(userId, current => current.refreshToken === before.refreshToken);
+  });
+  const refreshIfExpiring = async (userId, options = {}) => {
+    const withinMs = options.withinMs ?? REFRESH_MARGIN_MS;
     const tokens = await tokenStore.loadTokens(userId);
-    if (!tokens) throw new OneConnectError("not_connected", "This user is not connected.");
-    if (Date.now() < tokens.expiresAt - REFRESH_MARGIN_MS) return tokens.accessToken;
-    return (await refreshTokens(userId)).accessToken;
+    if (!tokens) throw notConnected();
+    if (!expiresWithin(tokens, withinMs)) return tokens;
+    return singleFlight(userId, () => refreshUnderLock(userId, current => expiresWithin(current, withinMs)));
   };
+  const getAccessToken = async userId => (await refreshIfExpiring(userId)).accessToken;
   const oneFetch = async (userId, path, init = {}) => {
     const accessToken = await getAccessToken(userId);
     const headers = new Headers(init.headers);
@@ -333,6 +441,7 @@ function createOneConnect(config) {
     getAccessToken,
     getTokens: userId => tokenStore.loadTokens(userId),
     refreshTokens,
+    refreshIfExpiring,
     disconnect: userId => tokenStore.clearTokens(userId),
     listConnections,
     listActions,
@@ -341,4 +450,4 @@ function createOneConnect(config) {
   };
 }
 
-export { OneConnectError, createOneConnect, tenancyHeaders, tokenScopes };
+export { OneConnectError, createOneConnect, refreshTokenExpiresAt, tenancyHeaders, tokenScopes };

package/dist/server/oauth.d.ts

@@ -20,5 +20,9 @@ export declare function basicAuthorization(clientId: string, clientSecret: strin
  *  these headers, and without them the call runs in the user's personal
  *  space. The access token's claims name the tenant, so echo them. */
 export declare function tenancyHeaders(accessToken: string): Record<string, string>;
+/** When a refresh token stops working, in epoch milliseconds, from its
+ *  `exp` claim. Null when the token carries no readable expiry, in which
+ *  case only One can say whether it still works. */
+export declare function refreshTokenExpiresAt(refreshToken: string): number | null;
 /** The scopes the token was granted, from its claims. Display only. */
 export declare function tokenScopes(accessToken: string): string[];

package/dist/server/types.d.ts

@@ -11,13 +11,44 @@ export interface OneConnectTokens {
 }
 /**
  * Where the app keeps each user's tokens: its database, a cache, an
- * encrypted cookie. The SDK never sees a token outside these three
- * calls. `userId` is the app's own id for its user.
+ * encrypted cookie. The SDK never sees a token outside these calls.
+ * `userId` is the app's own id for its user.
  */
 export interface OneConnectTokenStore {
     saveTokens: (userId: string, tokens: OneConnectTokens) => Promise<void>;
     loadTokens: (userId: string) => Promise<OneConnectTokens | null>;
-    clearTokens: (userId: string) => Promise<void>;
+    /**
+     * Deletes the user's tokens.
+     *
+     * `failed` is set when the SDK clears because One declared that pair
+     * dead. Delete only when the stored refresh token is still
+     * `failed.refreshToken`: a newer pair saved in the meantime (a
+     * reconnect, another server's refresh) must survive. `failed` is
+     * undefined for `disconnect`, which always deletes.
+     */
+    clearTokens: (userId: string, failed?: OneConnectTokens) => Promise<void>;
+    /**
+     * Runs `run` while holding a lock on this user that every server and
+     * worker of the app shares: a Postgres advisory lock, a Redis lock, a
+     * row lock. The SDK loads, refreshes and saves the user's tokens
+     * inside it.
+     *
+     * Required when the app runs more than one process (serverless,
+     * several instances, a background worker). One rotates the refresh
+     * token on every use and treats a second use of the old one as theft,
+     * revoking the whole grant, so two processes refreshing the same user
+     * at once disconnect that user. Without a lock the SDK can only stop
+     * that inside a single process.
+     *
+     * Hold it for at least 60 seconds before any timeout: it spans one
+     * call to One's token endpoint.
+     */
+    withLock?: <T>(userId: string, run: () => Promise<T>) => Promise<T>;
+}
+export interface RefreshIfExpiringOptions {
+    /** Refresh when the access token or the refresh token expires within
+     *  this many milliseconds. One minute when omitted. */
+    withinMs?: number;
 }
 export interface OneConnectServerConfig {
     /** The app's client id from the dashboard. */
@@ -128,6 +159,13 @@ export interface RunActionResult {
     blockedByGrant: boolean;
     data: unknown;
 }
+/**
+ * - `not_connected`: no tokens are stored for this user.
+ * - `refresh_failed`: One declared the grant dead (revoked, expired or
+ *   reused). The tokens were cleared; ask the user to connect again.
+ * - `request_failed`: One answered with an error or could not be
+ *   reached. During a refresh the tokens are kept, so retry later.
+ */
 export type OneConnectErrorCode = "not_connected" | "refresh_failed" | "request_failed";
 export declare class OneConnectError extends Error {
     readonly code: OneConnectErrorCode;

package/dist/types.d.ts

@@ -60,11 +60,9 @@ export interface ConnectButtonOptions {
     variant?: ConnectButtonVariant;
     /** Matches the host page, not One's page (that is connect.appTheme). */
     theme?: OneConnectTheme;
-    /** Connector chips. The first three render; the rest fold into the
-     *  "+N" chip together with moreCount. */
+    /** Connector chips. The first three render; the rest fold into a "+N"
+     *  chip, so that count only ever describes this list. */
     platforms?: ConnectButtonPlatformInput[];
-    /** Extra count for the "+N" chip, e.g. 274 for "the whole catalog". */
-    moreCount?: number;
     /** Sub-line on the block variant, shown while idle. */
     description?: string;
     /** Fill of the accent variant; One's lime when omitted. */

package/dist/vue.cjs.js

@@ -1 +1 @@
-"use strict";var e=require("vue"),t=require("@withone/connect");const o=e.defineComponent({name:"OneConnectButton",props:{authorizeUrl:{type:String,required:!0},appTheme:{type:String,default:void 0},label:{type:String,default:void 0},variant:{type:String,default:void 0},theme:{type:String,default:void 0},platforms:{type:Array,default:void 0},moreCount:{type:Number,default:void 0},description:{type:String,default:void 0},accentColor:{type:String,default:void 0},connectedLabel:{type:String,default:void 0}},emits:{success:()=>!0,error:e=>"string"==typeof e},setup(o,{emit:n}){const r=e.ref(null);let u=null;const i=()=>{var e;null===(e=u)||void 0===e||e.destroy(),u=null,r.value&&(u=t.mountConnectButton(r.value,t.optionsFromProps({...o},{onSuccess:()=>n("success"),onError:e=>n("error",e)})))};return e.onMounted(i),e.watch(()=>t.propsIdentity({...o}),i),e.onBeforeUnmount(()=>{var e;null===(e=u)||void 0===e||e.destroy(),u=null}),()=>e.h("div",{ref:r})}});exports.ConnectButton=o;
+"use strict";var e=require("vue"),t=require("@withone/connect");const n=e.defineComponent({name:"OneConnectButton",props:{authorizeUrl:{type:String,required:!0},appTheme:{type:String,default:void 0},label:{type:String,default:void 0},variant:{type:String,default:void 0},theme:{type:String,default:void 0},platforms:{type:Array,default:void 0},description:{type:String,default:void 0},accentColor:{type:String,default:void 0},connectedLabel:{type:String,default:void 0}},emits:{success:()=>!0,error:e=>"string"==typeof e},setup(n,{emit:o}){const r=e.ref(null);let i=null;const u=()=>{var e;null===(e=i)||void 0===e||e.destroy(),i=null,r.value&&(i=t.mountConnectButton(r.value,t.optionsFromProps({...n},{onSuccess:()=>o("success"),onError:e=>o("error",e)})))};return e.onMounted(u),e.watch(()=>t.propsIdentity({...n}),u),e.onBeforeUnmount(()=>{var e;null===(e=i)||void 0===e||e.destroy(),i=null}),()=>e.h("div",{ref:r})}});exports.ConnectButton=n;

package/dist/vue.d.ts

@@ -25,10 +25,6 @@ export declare const ConnectButton: import("vue").DefineComponent<import("vue").
         type: PropType<ConnectButtonPlatformInput[]>;
         default: undefined;
     };
-    moreCount: {
-        type: NumberConstructor;
-        default: undefined;
-    };
     description: {
         type: StringConstructor;
         default: undefined;
@@ -71,10 +67,6 @@ export declare const ConnectButton: import("vue").DefineComponent<import("vue").
         type: PropType<ConnectButtonPlatformInput[]>;
         default: undefined;
     };
-    moreCount: {
-        type: NumberConstructor;
-        default: undefined;
-    };
     description: {
         type: StringConstructor;
         default: undefined;
@@ -97,7 +89,6 @@ export declare const ConnectButton: import("vue").DefineComponent<import("vue").
     platforms: ConnectButtonPlatformInput[];
     description: string;
     appTheme: OneConnectTheme;
-    moreCount: number;
     accentColor: string;
     connectedLabel: string;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, true, {}, any>;

package/dist/vue.esm.js

@@ -1 +1 @@
-import{defineComponent as e,ref as t,onMounted as r,watch as o,onBeforeUnmount as n,h as i}from"vue";import{propsIdentity as l,mountConnectButton as u,optionsFromProps as d}from"@withone/connect";const a=e({name:"OneConnectButton",props:{authorizeUrl:{type:String,required:!0},appTheme:{type:String,default:void 0},label:{type:String,default:void 0},variant:{type:String,default:void 0},theme:{type:String,default:void 0},platforms:{type:Array,default:void 0},moreCount:{type:Number,default:void 0},description:{type:String,default:void 0},accentColor:{type:String,default:void 0},connectedLabel:{type:String,default:void 0}},emits:{success:()=>!0,error:e=>"string"==typeof e},setup(e,{emit:a}){const p=t(null);let s=null;const v=()=>{var t;null===(t=s)||void 0===t||t.destroy(),s=null,p.value&&(s=u(p.value,d({...e},{onSuccess:()=>a("success"),onError:e=>a("error",e)})))};return r(v),o(()=>l({...e}),v),n(()=>{var e;null===(e=s)||void 0===e||e.destroy(),s=null}),()=>i("div",{ref:p})}});export{a as ConnectButton};
+import{defineComponent as e,ref as t,onMounted as r,watch as o,onBeforeUnmount as n,h as i}from"vue";import{propsIdentity as l,mountConnectButton as u,optionsFromProps as d}from"@withone/connect";const a=e({name:"OneConnectButton",props:{authorizeUrl:{type:String,required:!0},appTheme:{type:String,default:void 0},label:{type:String,default:void 0},variant:{type:String,default:void 0},theme:{type:String,default:void 0},platforms:{type:Array,default:void 0},description:{type:String,default:void 0},accentColor:{type:String,default:void 0},connectedLabel:{type:String,default:void 0}},emits:{success:()=>!0,error:e=>"string"==typeof e},setup(e,{emit:a}){const p=t(null);let s=null;const c=()=>{var t;null===(t=s)||void 0===t||t.destroy(),s=null,p.value&&(s=u(p.value,d({...e},{onSuccess:()=>a("success"),onError:e=>a("error",e)})))};return r(c),o(()=>l({...e}),c),n(()=>{var e;null===(e=s)||void 0===e||e.destroy(),s=null}),()=>i("div",{ref:p})}});export{a as ConnectButton};

package/dist/wrapper-options.d.ts

@@ -15,7 +15,6 @@ export interface ConnectButtonProps {
     theme?: OneConnectTheme;
     /** Connector slugs, or objects to override name or logo. */
     platforms?: ConnectButtonPlatformInput[];
-    moreCount?: number;
     description?: string;
     accentColor?: string;
     connectedLabel?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/connect",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "One Connect for your app: the button your users press, the two backend routes as one import, and a server client that calls One with the grant. Users keep their connections in One; your app holds only what they granted.",
   "files": [
     "dist",

package/skills/one-connect/SKILL.md

@@ -72,7 +72,9 @@ export const oneConnect = createOneConnect({
   tokenStore: {
     saveTokens: (userId, tokens) => /* write to this app's database, encrypted, keyed by its user */,
     loadTokens: (userId) => /* read; null when the user never connected */,
-    clearTokens: (userId) => /* delete */,
+    clearTokens: (userId, failed) => /* delete; when `failed` is set, only if the stored refreshToken is still failed.refreshToken */,
+    // Required when the app runs more than one process (serverless, several instances, a worker):
+    withLock: (userId, run) => /* run() while holding a per-user lock all processes share, e.g. pg_advisory_xact_lock */,
   },
 });
 ```
@@ -81,6 +83,14 @@ export const oneConnect = createOneConnect({
 id as the key. Implement the store on whatever the app already uses; do not
 add a database for it.
 
+One rotates the refresh token on every refresh and revokes the whole grant if
+an old one is used again. So when two processes could refresh the same user,
+`withLock` is not optional: without it, a web request and a worker refreshing
+together disconnect the user. The README's "Tokens" section has a Postgres
+version. For background work, call `refreshIfExpiring(userId, { withinMs })`:
+every few minutes with a window of minutes to keep access tokens warm, and
+once a day with a window of days so idle users' 30-day refresh tokens renew.
+
 ## 4 - The two routes
 
 Next.js App Router (also Remix, SvelteKit, Hono, Bun: anything with the web `Request`):
@@ -170,14 +180,22 @@ grant; the provider was never called. Do not retry. Any other `/v1` call:
 `oneConnect.fetch(userId, "/connections", init)`.
 
 `OneConnectError` codes: `not_connected` (no tokens stored), `refresh_failed`
-(One refused the refresh; the tokens were cleared; ask the user to connect
-again), `request_failed` (One answered with an error; `status` carries it).
+(One declared the grant dead: revoked, expired or reused; the tokens were
+cleared; ask the user to connect again), `request_failed` (One answered with
+an error or could not be reached; `status` carries it; during a refresh the
+tokens are KEPT, so retry later rather than asking the user to reconnect).
+
+To ask users for more tools later, edit the app's permission set in the
+dashboard. The next Connect shows only the new tools as "needs one more
+connection" and the callback stores the new pair; no code change.
 
 ## 7 - Rules
 
 - Never put the secret in a client bundle, a log line or an error report.
 - Store tokens encrypted, keyed by the app's user. Delete them when the user
-  is deleted. The client deletes them itself when a refresh fails.
+  is deleted. The client deletes them itself only when One declares the
+  grant dead, and never deletes a newer pair saved in the meantime.
+- Give the store `withLock` whenever more than one process can refresh.
 - The registered redirect URI and `ONE_REDIRECT_URI` must be the same string.
 - Do not build a completion page. The callback redirect is the completion.
 - Do not write the OAuth steps by hand when the package exposes them.

package/src/button.ts

@@ -58,8 +58,13 @@ const DARK: Palette = {
   shadow: "0 1px 2px rgba(0,0,0,.4), 0 8px 24px rgba(0,0,0,.35)",
 };
 
-const ONE_MARK_SVG =
-  '<svg viewBox="0 0 24 24" width="12" height="12" fill="none" stroke="currentColor" stroke-width="2.4" style="flex-shrink:0"><circle cx="12" cy="12" r="8.5"/></svg>';
+/** One's lockup — the mark and the wordmark as one asset, every fill set
+ *  to `currentColor` so a single copy works on either palette. Inlined
+ *  rather than fetched: this is the trust mark, and it has to draw even
+ *  behind a strict content policy or offline. Source:
+ *  core-ui/public/logo/logo-full-dark.svg (viewBox 3152x990). */
+const ONE_LOCKUP_SVG =
+  '<svg viewBox="0 0 3152 990" width="35" height="11" fill="none" aria-hidden="true" style="flex-shrink:0;display:block"><path d="M1698.02 793.203C1525.75 793.203 1401 666.834 1401 495.102C1401 323.909 1524.67 197 1698.02 197C1870.83 197 1996.12 323.909 1996.12 495.102C1996.12 666.834 1869.75 793.203 1698.02 793.203ZM1698.02 694.916C1801.71 694.916 1884.88 615.53 1884.88 495.102C1884.88 374.133 1801.71 295.827 1698.02 295.827C1594.87 295.827 1511.71 373.053 1511.71 495.102C1511.71 616.61 1595.41 694.916 1698.02 694.916Z" fill="currentColor"/><path d="M2326.71 197.54C2480.62 197.54 2565.95 289.887 2565.95 467.56V779.702H2455.24V468.64C2455.24 361.172 2411.5 292.587 2308.35 292.587C2217.63 292.587 2140.4 356.852 2140.4 484.841V779.702H2030.77V211.041H2140.4V272.065C2185.76 225.082 2248.41 197.54 2326.71 197.54Z" fill="currentColor"/><path d="M3151.98 493.481C3151.98 514.003 3150.36 520.483 3148.74 529.124H2700.51C2715.63 637.672 2794.47 686.815 2922.46 686.815C3031.01 686.815 3099.6 650.633 3116.88 643.072V747.84C3100.68 755.4 3023.45 793.203 2908.96 793.203C2699.97 793.203 2588.18 661.434 2588.18 497.802C2588.18 332.55 2702.67 197 2871.7 197C3031.55 197 3151.98 317.969 3151.98 493.481ZM2876.02 300.688C2784.75 300.688 2720.49 345.511 2702.67 434.617H3050.45C3034.79 344.971 2967.29 300.688 2876.02 300.688Z" fill="currentColor"/><path d="M537.494 782.175C641.011 827.7 767.922 858.83 880.501 839.875C983.155 822.599 1069.64 764.946 1094.39 659.271C1114.47 573.493 1088.54 481.273 1047.27 405.311C983.124 287.246 874.768 183.791 759.847 114.657C644.926 45.5225 507.181 -5.02605 372.102 0.398669C289.698 3.69665 205.938 26.536 146.544 85.6685C112.069 119.989 88.3818 171.231 83.1266 219.823C78.1642 265.64 84.3749 310.317 99.8478 354.007C168.243 547.14 354.009 701.467 537.51 782.191L537.494 782.175ZM751.956 818.053C583.05 796.2 415.7 707.108 292.472 593.004C222.536 528.246 159.366 444.979 125.985 355.471C102.961 293.734 96.3956 223.367 122.41 161.969C137.158 127.14 160.367 98.244 190.743 75.9133C275.581 13.5752 395.819 6.99464 495.977 26.8596C608.848 49.252 713.875 99.4615 806.712 166.515C907.085 239.025 999.537 339.922 1048.42 454.627C1072.45 511.001 1083.99 570.103 1075.64 630.869C1067.38 690.957 1034.57 742.353 983.987 775.379C917.626 818.715 830.861 828.255 751.972 818.053H751.956Z" fill="currentColor"/><path d="M1103.27 661.228C1086.68 755.313 1024.9 818.622 934.021 848.69C821.751 885.846 685.146 860.263 576.251 818.915C452.515 771.942 340.336 699.91 245.157 607.813C209.002 572.83 177.255 534.456 148.837 493.031C100.384 422.402 61.7024 335.19 65.8326 248.071C68.2213 197.769 83.987 159.241 111.403 116.938C45.8289 171.308 31.404 262.511 47.1543 342.002C53.4728 373.841 62.9815 403.23 76.528 432.958C100.338 485.202 130.914 532.992 167.747 577.238C255.452 682.573 367.83 765.13 491.073 824.124C614.317 883.118 769.307 920.691 900.471 889.128C985.788 868.601 1061.47 816.095 1090.83 730.856C1098.18 708.71 1104.61 686.564 1103.25 661.244L1103.27 661.228Z" fill="currentColor"/><path d="M883.297 963.502C923.15 947.074 960.877 926.022 988.309 893.967C954.265 917.839 920.931 934.807 882.403 944.993C751.747 979.53 595.123 942.589 474.731 886.57C422.102 862.082 372.617 834.018 325.181 800.591C205.128 715.984 89.4825 597.996 36.7762 458.756C20.2092 414.973 11.7793 370.404 11.5327 323.739C11.4249 302.641 15.4627 283.747 19.0226 263.004C-2.52219 310.486 -3.66265 380.915 5.21419 431.617C32.0605 584.881 147.151 721.146 266.988 813.983C343.443 873.224 436.403 924.913 528.424 954.672C620.444 984.431 713.851 999.426 808.491 983.598C834.459 979.252 858.362 973.781 883.297 963.502Z" fill="currentColor"/><path d="M1045.09 830.737C1053.55 816.158 1061.75 802.95 1066.99 787.061C1043.75 824.541 1013.3 854.408 974.29 874.982C947.752 888.991 920.228 899.27 890.577 905.219C864.578 910.428 839.673 914.481 812.781 914.851C739.716 915.852 668.717 903.092 599.459 880.854C418.686 822.8 238.422 697.6 127.985 543.165C94.8819 496.87 68.8679 447.847 50.7135 394.031C28.1978 324.45 25.7782 258.69 53.4104 189.078C36.1345 211.825 26.9956 237.793 20.4151 264.916C18.3654 282.732 14.713 299.345 15.0828 317.561C15.9613 360.774 23.5436 402.692 38.477 443.562C73.1522 538.464 134.936 621.869 207.368 691.913C307.34 788.587 426.762 862.268 558.127 907.993C689.491 953.718 871.975 973.768 992.614 885.446C1013.28 870.312 1029.39 851.773 1045.07 830.752L1045.09 830.737Z" fill="currentColor"/><path d="M552.552 745.664C671.079 797.831 835.825 835.526 954.768 769.12C999.137 744.354 1031.99 705.626 1047.99 657.312C1086.75 540.264 1020.28 405.817 947.124 315.631C855.536 202.745 729.688 114.516 592.76 66.0323C506.349 35.4412 418.968 22.0797 328.211 37.46C262.313 48.6177 195.29 81.7054 157.563 138.234C118.912 196.133 115.891 270.785 136.758 335.882C176.519 459.926 276.769 570.763 381.01 646.277C434.995 685.391 491.662 718.864 552.567 745.664H552.552ZM210.162 422.955C199.898 402.381 189.141 382.701 184.733 360.385C182.267 347.918 184.625 333.477 184.564 320.64C184.44 293.223 194.072 269.059 209.992 247.93C219.609 235.17 229.456 224.844 243.018 215.906C341.218 151.179 476.051 175.991 576.763 223.904C661.971 264.435 737.394 321.534 796.11 395.862C836.919 447.52 871.193 513.634 880.502 579.501C888.238 634.272 873.243 695.485 826.763 729.189C807.853 742.905 785.045 751.721 761.728 755.974C721.921 763.217 688.802 758.008 649.565 748.916C594.27 736.094 542.488 715.212 492.279 688.889C441.977 662.521 396.745 631.483 353.008 595.436C314.372 563.597 280.252 537.845 248.458 498.007L248.274 497.837L221.504 461.945L211.379 445.84C194.103 418.408 177.398 391.346 165.238 361.202C151.291 326.604 142.676 291.852 143.678 254.279C146.19 160.564 203.766 96.7467 290.238 67.82C434.394 19.5985 611.561 79.4246 735.298 157.636C825.099 214.411 904.435 286.581 963.321 375.134C989.767 414.894 1010.42 456.998 1023.78 502.646C1049.84 591.66 1036.79 685.884 957.404 742.659C890.257 790.68 785.6 793.146 707.295 776.486C680.403 769.736 654.065 766.007 629.222 754.818C732.107 783.93 882.397 797.723 963.938 715.35C990.599 688.412 1007.55 656.218 1013.75 618.537C1020.87 575.232 1016.12 531.634 1002.62 489.931C985.498 437.071 956.34 384.026 922.405 340.289C876.911 281.665 823.188 230.531 762.468 187.981C681.112 130.975 588.783 88.887 490.799 71.0872C425.595 59.2514 349.463 60.4072 287.557 85.0959C256.441 97.5019 228.501 114.5 205.924 138.85C158.303 190.2 147.176 256.036 161.539 323.383C166.856 348.334 175.456 371.296 185.596 394.737C194.488 415.295 222.676 461.883 236.022 477.649L226.729 456.196L210.162 423.001V422.955ZM832.342 286.936C756.904 211.544 666.44 154.076 564.896 120.249C526.553 107.473 487.948 99.4899 447.648 96.084C401.26 92.1696 356.167 96.7313 312.215 111.341C222.337 141.208 169.399 217.277 175.255 312.333C177.567 324.847 179.555 335.774 180.603 348.503C152.971 264.944 174.454 175.236 251.356 125.581C310.797 87.2072 387.39 78.2071 456.694 86.7603C503.714 92.5549 555.387 106.656 599.078 124.317C706.016 167.546 800.764 234.615 876.741 321.395C912.002 361.664 942.085 405.756 963.876 454.532C996.779 528.166 1011.85 610.046 965.895 681.369C952.379 702.359 935.427 718.818 914.283 731.871C884.432 747.421 852.947 758.671 818.872 761.06C839.523 755.959 859.404 750.981 878.637 740.424C929.186 717.061 964.601 671.567 974.818 616.488C987.671 547.245 964.693 475.429 930.881 415.357C903.834 367.305 871.471 326.049 832.311 286.905L832.342 286.936ZM890.673 420.18C861.623 370.387 825.515 327.621 783.288 287.999C721.659 230.161 650.028 185.345 570.598 156.033C513.623 135.013 454.506 124.394 393.786 128.108C353.316 130.59 315.728 139.867 280.498 159.516C245.268 179.166 216.819 204.918 201.023 240.394L188.617 268.242C204.583 180.445 278.325 132.054 361.931 119.355C412.757 111.634 462.658 116.643 512.421 129.048C596.905 150.116 674.1 189.923 743.45 242.028C816.607 296.999 885.526 373.531 924.578 456.982C949.713 510.675 965.094 571.61 949.837 630.234C939.018 671.768 912.511 706.566 875.308 727.987C847.013 744.292 816.191 754.679 783.242 758.101C825.915 745.926 863.75 731.917 895.327 698.799C913.512 679.72 926.535 657.62 933.054 631.714C951.347 558.989 927.49 483.274 890.642 420.134L890.673 420.18ZM726.19 279.369C625.678 198.799 493.404 141.917 362.655 156.973C343.854 159.131 326.547 164.17 308.639 169.195C301.18 171.29 295.201 177.732 286.493 176.253C378.313 130.081 492.063 149.545 583.143 188.119C684.102 230.87 775.952 302.825 840.664 391.069C871.794 433.527 895.805 479.652 909.506 530.386C918.382 563.273 920.232 596.654 911.941 629.294C905.622 654.153 895.481 677.778 875.786 694.9C893.987 666.327 905.452 637.693 907.086 604.128C908.72 570.562 903.141 536.565 891.567 503.57C861.392 417.53 797.066 336.19 726.205 279.384L726.19 279.369Z" fill="currentColor"/></svg>';
 const ARROW_SVG =
   '<svg class="owcb-arrow" width="14" height="14" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M6 3l5 5-5 5"/></svg>';
 const TICK_SVG =
@@ -104,7 +109,7 @@ function buildStack(
   chipRing: string,
 ): HTMLElement | null {
   const platforms = normalizePlatforms(options.platforms);
-  if (platforms.length === 0 && !options.moreCount) return null;
+  if (platforms.length === 0) return null;
   const stack = document.createElement("span");
   stack.className = "owcb-stack";
   stack.setAttribute("aria-hidden", "true");
@@ -124,9 +129,9 @@ function buildStack(
     chip.appendChild(img);
     stack.appendChild(chip);
   }
-  const extra =
-    (options.moreCount ?? 0) +
-    Math.max(0, platforms.length - MAX_VISIBLE_CHIPS);
+  // Only ever the apps the caller listed beyond the first three: the chip
+  // can never claim a number that has nothing to do with them.
+  const extra = Math.max(0, platforms.length - MAX_VISIBLE_CHIPS);
   if (extra > 0) {
     const more = document.createElement("span");
     more.className = "owcb-chip owcb-more";
@@ -237,8 +242,7 @@ export const mountConnectButton = (
       foot.style.borderTop = `1px solid ${palette.line}`;
       foot.innerHTML =
         `<span style="font-size:11px;color:${palette.muted}">Secured by</span>` +
-        `<span style="display:inline-flex;color:${palette.foreground}">${ONE_MARK_SVG}</span>` +
-        `<span style="font-size:12px;font-weight:600;letter-spacing:-0.02em;color:${palette.foreground}">one</span>`;
+        `<span style="display:inline-flex;color:${palette.foreground}">${ONE_LOCKUP_SVG}</span>`;
       button.appendChild(foot);
       return;
     }
@@ -295,7 +299,7 @@ export const mountConnectButton = (
  * HTMLElement.
  *
  * Attributes: authorize-url (required), app-theme, label, variant,
- * theme, platforms ("stripe, notion" or a JSON array), more-count,
+ * theme, platforms ("stripe, notion" or a JSON array),
  * description, accent-color, connected-label.
  * Events: "success" and "error" (detail: message), plus the matching
  * onSuccess and onError function properties that React 19, Vue and
@@ -314,7 +318,6 @@ export function registerConnectButton(): void {
       "variant",
       "theme",
       "platforms",
-      "more-count",
       "description",
       "accent-color",
       "connected-label",
@@ -344,9 +347,6 @@ export function registerConnectButton(): void {
       const authorizeUrl = this.getAttribute("authorize-url");
       if (!authorizeUrl) return;
 
-      const moreCountRaw = this.getAttribute("more-count");
-      const moreCount = moreCountRaw ? parseInt(moreCountRaw, 10) : NaN;
-
       this.handle = mountConnectButton(this, {
         connect: {
           authorizeUrl,
@@ -364,7 +364,6 @@ export function registerConnectButton(): void {
         variant: attributeAs(this, "variant", ["default", "accent", "block"]),
         theme: attributeAs(this, "theme", ["light", "dark"]),
         platforms: parsePlatformsAttribute(this.getAttribute("platforms")),
-        moreCount: Number.isFinite(moreCount) ? moreCount : undefined,
         description: this.getAttribute("description") ?? undefined,
         accentColor: this.getAttribute("accent-color") ?? undefined,
         connectedLabel: this.getAttribute("connected-label") ?? undefined,