nanocodex 0.6.6 → 0.6.7

package/cloud/Dialog.mjs

@@ -2,6 +2,9 @@ import { DialogBusyError, UserRejectedRequestError } from "./Errors.mjs";
 
 export const DEFAULT_HOST = "https://nanocodex.gakonst.workers.dev/connect-dialog/";
 
+const APPEARANCE_PARAMETER = "nanocodex_appearance";
+const MAX_APPEARANCE_LENGTH = 1024;
+
 const iframeInstances = new Map();
 const popupInstances = new Map();
 
@@ -22,6 +25,7 @@ export function from(parameters) {
 
 export function iframe(options = {}) {
   const host = new URL(options.host ?? DEFAULT_HOST).toString();
+  const appearance = serializeAppearance(options.appearance);
   return from({
     key: options.key ?? "nanocodex-iframe",
     name: options.name ?? "Nanocodex Connect",
@@ -35,7 +39,7 @@ export function iframe(options = {}) {
           },
         };
       }
-      const source = dialogUrl(host, "iframe", appId);
+      const source = dialogUrl(host, "iframe", appId, appearance);
       let instance = iframeInstances.get(source);
       if (!instance) {
         instance = createIframeInstance(source);
@@ -48,6 +52,7 @@ export function iframe(options = {}) {
 
 export function popup(options = {}) {
   const host = new URL(options.host ?? DEFAULT_HOST).toString();
+  const appearance = serializeAppearance(options.appearance);
   return from({
     key: options.key ?? "nanocodex-popup",
     name: options.name ?? "Nanocodex Connect",
@@ -61,7 +66,7 @@ export function popup(options = {}) {
           },
         };
       }
-      const source = dialogUrl(host, "popup", appId);
+      const source = dialogUrl(host, "popup", appId, appearance);
       let instance = popupInstances.get(source);
       if (!instance) {
         instance = createPopupInstance(source, options);
@@ -141,7 +146,7 @@ function createIframeInstance(host) {
     if (frame && modal) return;
     modal = document.createElement("dialog");
     modal.setAttribute("aria-label", "Nanocodex Connect permissions");
-    modal.style.cssText = "border:0;padding:0;background:transparent;max-width:none;max-height:none";
+    modal.style.cssText = "border:0;outline:0;padding:0;margin:0;background:transparent;max-width:none;max-height:none;width:100vw;height:100dvh";
     modal.addEventListener("cancel", (event) => {
       event.preventDefault();
       rejectActive(new UserRejectedRequestError());
@@ -161,7 +166,7 @@ function createIframeInstance(host) {
       `publickey-credentials-create ${dialogOrigin}`,
       "payment",
     ].join("; ");
-    frame.style.cssText = "border:0;width:min(440px,calc(100vw - 24px));height:min(720px,calc(100vh - 24px));background:#161616";
+    frame.style.cssText = "border:0;width:100vw;height:100dvh;background:transparent";
     frame.style.display = "none";
     modal.append(frame);
     document.body.append(modal);
@@ -202,6 +207,8 @@ function createIframeInstance(host) {
     const url = new URL(nextHost ?? host);
     if (!url.searchParams.has("origin")) url.searchParams.set("origin", window.location.origin);
     url.searchParams.set("mode", "iframe");
+    // Accounts may supply a fresh host URL; retain this dialog's visual options.
+    setAppearance(url, new URL(host).searchParams.get(APPEARANCE_PARAMETER));
     const source = url.toString();
     if (walletFrame && walletModal && walletHost === source) return;
     walletModal?.remove();
@@ -319,7 +326,7 @@ function createIframeInstance(host) {
 function createPopupInstance(host, options) {
   const source = host;
   const targetName = options.target ?? "nanocodex-connect";
-  const features = options.features ?? "popup=yes,width=440,height=720,resizable=yes,scrollbars=yes";
+  const features = options.features ?? "popup=yes,width=808,height=780,resizable=yes,scrollbars=yes";
   let walletWindow;
 
   function showWallet() {
@@ -350,11 +357,12 @@ function createPopupInstance(host, options) {
   };
 }
 
-function dialogUrl(host, mode, appId) {
+function dialogUrl(host, mode, appId, appearance) {
   const url = new URL(host);
   url.searchParams.set("app_id", appId);
   url.searchParams.set("origin", window.location.origin);
   url.searchParams.set("mode", mode);
+  setAppearance(url, appearance);
   return url.toString();
 }
 
@@ -364,3 +372,41 @@ function requiredString(value, label) {
   }
   return value;
 }
+
+function setAppearance(url, appearance) {
+  // Explicit SDK options own this parameter, including clearing stale host values.
+  url.searchParams.delete(APPEARANCE_PARAMETER);
+  if (appearance) url.searchParams.set(APPEARANCE_PARAMETER, appearance);
+}
+
+function serializeAppearance(appearance) {
+  if (appearance === undefined) return undefined;
+  if (!appearance || typeof appearance !== "object" || Array.isArray(appearance)) {
+    throw new TypeError("Dialog appearance must be an object");
+  }
+  const keys = ["theme", "accentColor", "fontFamily", "borderRadius"];
+  if (Object.keys(appearance).some((key) => !keys.includes(key))) {
+    throw new TypeError("Dialog appearance contains an unsupported option");
+  }
+  const { theme, accentColor, fontFamily, borderRadius } = appearance;
+  if (theme !== undefined && !["light", "dark", "system"].includes(theme)) {
+    throw new TypeError("Dialog appearance theme must be light, dark, or system");
+  }
+  if (accentColor !== undefined && (typeof accentColor !== "string" || !/^#[\da-f]{6}$/i.test(accentColor))) {
+    throw new TypeError("Dialog appearance accentColor must be a six-digit hex color");
+  }
+  if (fontFamily !== undefined && (typeof fontFamily !== "string" || fontFamily.length > 160
+    || !/^[a-zA-Z0-9 ,"'_-]+$/.test(fontFamily) || !fontFamily.trim())) {
+    throw new TypeError("Dialog appearance fontFamily must be a font list of at most 160 characters");
+  }
+  if (borderRadius !== undefined && (typeof borderRadius !== "number" || !Number.isFinite(borderRadius)
+    || borderRadius < 0 || borderRadius > 24)) {
+    throw new TypeError("Dialog appearance borderRadius must be between 0 and 24 pixels");
+  }
+  // Pick known scalar fields, never invoking a caller's toJSON or carrying CSS.
+  const serialized = JSON.stringify({ theme, accentColor, fontFamily, borderRadius });
+  if (serialized.length > MAX_APPEARANCE_LENGTH) {
+    throw new TypeError("Dialog appearance is too large");
+  }
+  return serialized;
+}

package/cloud/Transport.d.mts

@@ -1,6 +1,4 @@
 export const DEFAULT_API_URL: "https://api.nanocodex.xyz";
-export const MOCK_ACCOUNT_ADDRESS: `0x${string}`;
-export const MOCK_MACHINE_USD_ADDRESS: `0x${string}`;
 
 export type Request = Readonly<{
   path: string;
@@ -36,12 +34,3 @@ export function http(url?: string | undefined, options?: Readonly<{
   key?: string | undefined;
   name?: string | undefined;
 }>): Transport<"http">;
-
-export function mock(options?: Readonly<{
-  accountAddress?: `0x${string}` | undefined;
-  appName?: string | undefined;
-  appOrigin?: string | undefined;
-  key?: string | undefined;
-  machineUsdAddress?: `0x${string}` | undefined;
-  name?: string | undefined;
-}>): Transport<"mock">;

package/cloud/Transport.mjs

@@ -1,9 +1,6 @@
-import { HttpError, InvalidResponseError } from "./Errors.mjs";
-import { Hex, PersonalMessage } from "ox";
+import { HttpError } from "./Errors.mjs";
 
 export const DEFAULT_API_URL = "https://api.nanocodex.xyz";
-export const MOCK_ACCOUNT_ADDRESS = "0x8ba1f109551bd432803012645ac136ddd64dba72";
-export const MOCK_MACHINE_USD_ADDRESS = "0x20c0000000000000000000000000000000000001";
 
 export function from(parameters) {
   if (!parameters || typeof parameters !== "object") {
@@ -70,388 +67,6 @@ export function http(url = DEFAULT_API_URL, options = {}) {
   });
 }
 
-export function mock(options = {}) {
-  const accountAddress = options.accountAddress ?? MOCK_ACCOUNT_ADDRESS;
-  const machineUsdAddress = options.machineUsdAddress ?? MOCK_MACHINE_USD_ADDRESS;
-  const appName = options.appName ?? "Acme Workspace";
-  const grants = new Map();
-  let sequence = 0;
-
-  return from({
-    key: options.key ?? "mock",
-    name: options.name ?? "Nanocodex mock",
-    type: "mock",
-    setup({ appId }) {
-      return {
-        baseUrl: "memory://nanocodex",
-        async request(request) {
-          if (request.method === "POST" && request.path === "/v1/connections") {
-            const authorization = request.body?.key_authorization;
-            const keyId = authorization?.keyId ?? authorization?.address;
-            if (typeof keyId !== "string") throw new InvalidResponseError("key authorization is missing keyId");
-            const expiry = authorization.expiry ?? Math.floor(Date.now() / 1000) + 30 * 86_400;
-            const connectors = requestedConnectors(request.body?.requested_connectors);
-            const mcpConnections = requestedMcpConnections(request.body?.requested_mcp_connections);
-            const grantId = mockHex(`${appId}:${accountAddress}:${keyId}`, 32);
-            const connectorConnections = mockConnectorConnections(connectors, grantId);
-            const wire = {
-              grant_token: `mock-grant-${grantId.slice(2)}`,
-              account_address: accountAddress,
-              agent_id: `agent_${grantId.slice(2, 14)}`,
-              grant: {
-                id: grantId,
-                permission: request.body?.permission ?? "agent.run",
-                status: "active",
-                expires_at: expiry,
-                capabilities: [
-                  "nanocodex.agent",
-                  "mercator.boost",
-                  "mpp.mach",
-                  ...connectors,
-                  ...mcpConnections.map(({ id }) => `mcp:${id}`),
-                ],
-                connector_connections: connectorConnections,
-                mcp_connections: mcpConnections,
-              },
-              access_key: {
-                address: keyId,
-                chain_id: String(authorization.chainId ?? 4217),
-                key_id: keyId,
-                key_type: authorization.keyType ?? "p256",
-                limits: authorization.limits ?? [{ token: machineUsdAddress, limit: "10000000", period: 86_400 }],
-                scopes: authorization.scopes ?? [],
-                witness: authorization.witness ?? mockHex(`${grantId}:witness`, 32),
-                expiry,
-                authorization: request.body?.signed_key_authorization ?? "0x01",
-              },
-              mpp: {
-                token: machineUsdAddress,
-                symbol: "MACH",
-                balance_status: "ready",
-                settlement_token: "0x20C000000000000000000000b9537d11c60E8b50",
-                settlement_symbol: "USDC.e",
-                settlement_balance_atomics: "0",
-                limit_atomics: "10000000",
-                max_per_request_atomics: "250000",
-                period: 86_400,
-                balance_atomics: "0",
-                spent_atomics: "0",
-              },
-            };
-            grants.set(grantId, wire);
-            return wire;
-          }
-
-          if (request.method === "GET" && request.path.match(/^\/v1\/grants\/0x[0-9a-f]+$/)) {
-            return requiredGrant(grants, request.path.split("/")[3]);
-          }
-
-          if (request.method === "POST" && request.path === "/v1/connections/prepare") {
-            const permission = request.body?.permission;
-            if (typeof permission !== "string" || permission.length === 0) {
-              throw new TypeError("connection permission must be a non-empty string");
-            }
-            const resources = request.body?.resources ?? [];
-            if (!Array.isArray(resources) || resources.some((resource) => typeof resource !== "string" || resource.length === 0)) {
-              throw new TypeError("connection resources must be non-empty strings");
-            }
-            const connectors = connectorResources(resources);
-            const id = `req_${++sequence}`;
-            const accessPolicy = request.body?.authorize_access_key;
-            const keyId = accessPolicy?.address ?? mockHex(`${appId}:${accountAddress}:${permission}:key`, 20);
-            const tokenLimit = accessPolicy?.limits?.find((limit) => limit.token === machineUsdAddress);
-            const expiry = accessPolicy?.expiry ?? Math.floor(Date.now() / 1000) + 30 * 86_400;
-            const dailyLimit = tokenLimit?.limit ?? "10000000";
-            const period = tokenLimit?.period ?? 86_400;
-            const appOrigin = options.appOrigin ?? "https://app.example";
-            const appUrl = new URL(appOrigin);
-            const nonce = mockHex(`${id}:siwe-nonce`, 8).slice(2);
-            const issuedAt = new Date().toISOString();
-            const authMessage = [
-              `${appUrl.host} wants you to sign in with your Ethereum account:`,
-              "0x0000000000000000000000000000000000000000",
-              "",
-              `${appName} wants to connect your Nanocodex agent.`,
-              "",
-              `URI: ${appUrl.origin}`,
-              "Version: 1",
-              "Chain ID: 4217",
-              `Nonce: ${nonce}`,
-              `Issued At: ${issuedAt}`,
-              ...(resources.length > 0
-                ? ["Resources:", ...resources.map((resource) => `- ${resource}`)]
-                : []),
-            ].join("\n");
-            return {
-              request_id: id,
-              app: { id: appId, name: appName, origin: appOrigin },
-              account_address: accountAddress,
-              auth: {
-                message: authMessage,
-                resources,
-              },
-              permission: {
-                id: permission,
-                title: "Use your Nanocodex agent",
-                description: "Run an app-owned Nanocodex agent with your approved capabilities.",
-                connectors: [
-                  { id: "agent", name: "Nanocodex", detail: "Instantiate the real Nanocodex runtime in this app" },
-                  { id: "mercator", name: "BOOST with Mercator", detail: "Find and compose the right tools, paying per call through MPP" },
-                  ...connectors.map((provider) => ({
-                    id: provider,
-                    name: connectorName(provider),
-                    detail: `Use the connected ${connectorName(provider)} account through the grant`,
-                  })),
-                ],
-              },
-              access_key: {
-                address: keyId,
-                chain_id: accessPolicy?.chainId ?? "4217",
-                key_id: keyId,
-                public_key: accessPolicy?.publicKey ?? mockHex(`${id}:public`, 65),
-                key_type: accessPolicy?.keyType ?? "p256",
-                limits: accessPolicy?.limits ?? [{ token: machineUsdAddress, limit: dailyLimit, period }],
-                scopes: accessPolicy?.scopes ?? [],
-                witness: PersonalMessage.getSignPayload(Hex.fromString(authMessage)),
-                expiry,
-              },
-              mpp: {
-                token: machineUsdAddress,
-                symbol: "MACH",
-                settlement_token: "0x20C000000000000000000000b9537d11c60E8b50",
-                settlement_symbol: "USDC.e",
-                settlement_balance_atomics: "0",
-                limit_atomics: dailyLimit,
-                period,
-                max_per_request_atomics: "250000",
-              },
-            };
-          }
-
-          if (request.method === "POST" && request.path === "/v1/connections/complete") {
-            const prepared = request.body?.prepared;
-            const approval = request.body?.approval;
-            if (!prepared || !approval || approval.approved !== true) {
-              throw new InvalidResponseError("connection approval is malformed");
-            }
-            const approvedCapabilities = approval.capabilities;
-            if (
-              approvedCapabilities?.keyAuthorization?.witness !== prepared.access_key.witness
-              || approvedCapabilities?.personalSign?.message !== prepared.auth.message
-              || typeof approvedCapabilities?.personalSign?.keyAuthorization !== "string"
-              || typeof approvedCapabilities?.signature !== "string"
-            ) {
-              throw new InvalidResponseError("connection approval is not bound to the SIWE challenge and key authorization");
-            }
-            const grantId = mockHex(`${prepared.app.id}:${prepared.account_address}:${prepared.access_key.key_id}`, 32);
-            const wire = {
-              grant_token: `mock-grant-${grantId.slice(2)}`,
-              account_address: prepared.account_address,
-              agent_id: `agent_${grantId.slice(2, 14)}`,
-              grant: {
-                id: grantId,
-                permission: prepared.permission.id,
-                status: "active",
-                expires_at: prepared.access_key.expiry,
-                capabilities: prepared.permission.connectors.map(({ id }) => id),
-              },
-              access_key: prepared.access_key,
-              mpp: {
-                ...prepared.mpp,
-                balance_atomics: "0",
-                balance_status: "ready",
-                spent_atomics: "0",
-              },
-            };
-            grants.set(grantId, wire);
-            return wire;
-          }
-
-          if (request.method === "POST" && request.path === "/v1/connections/disconnect") {
-            return undefined;
-          }
-
-          if (request.method === "GET" && request.path.match(/^\/v1\/grants\/0x[0-9a-f]+\/mpp\/balance$/)) {
-            const wire = requiredGrant(grants, request.path.split("/")[3]);
-            wire.mpp = { ...wire.mpp, balance_status: "ready" };
-            return wire;
-          }
-
-          if (request.method === "POST" && request.path.match(/^\/v1\/grants\/0x[0-9a-f]+\/revoke$/)) {
-            const grantId = request.path.split("/")[3];
-            const wire = requiredGrant(grants, grantId);
-            wire.grant = { ...wire.grant, status: "revoked" };
-            return wire.grant;
-          }
-
-          if (request.method === "GET" && request.path === "/v1/machine-usd/config") {
-            return {
-              chain_id: 4217,
-              min_usd_amount_cents: 500,
-              max_usd_amount_cents: 10_000,
-              stripe_publishable_key: "pk_test_nanocodex",
-              token_address: machineUsdAddress,
-            };
-          }
-
-          if (request.method === "POST" && request.path.match(/^\/v1\/grants\/0x[0-9a-f]+\/fund$/)) {
-            const grantId = request.path.split("/")[3];
-            const wire = requiredActiveGrant(grants, grantId);
-            const usdAmountCents = request.body?.usd_amount_cents;
-            if (!Number.isSafeInteger(usdAmountCents) || usdAmountCents < 500 || usdAmountCents > 10_000) {
-              throw new TypeError("MACH amount must be from 500 through 10000 cents");
-            }
-            const amount = BigInt(usdAmountCents) * 10_000n;
-            wire.mpp = {
-              ...wire.mpp,
-              balance_atomics: String(BigInt(wire.mpp.balance_atomics) + amount),
-            };
-            return {
-              order: {
-                id: `ord_${++sequence}`,
-                status: "complete",
-                usd_amount_cents: usdAmountCents,
-                machine_usd_amount_atomics: String(amount),
-                issuance_transaction_hash: mockHex(`fund:${sequence}`, 32),
-              },
-              connection: wire,
-            };
-          }
-
-          if (request.method === "POST" && request.path.match(/^\/v1\/grants\/0x[0-9a-f]+\/mpp\/charge$/)) {
-            const grantId = request.path.split("/")[3];
-            const wire = requiredActiveGrant(grants, grantId);
-            const amount = BigInt(request.body?.amount_atomics ?? "-1");
-            const max = BigInt(wire.mpp.max_per_request_atomics);
-            const spent = BigInt(wire.mpp.spent_atomics);
-            const limit = BigInt(wire.mpp.limit_atomics);
-            const balance = BigInt(wire.mpp.balance_atomics);
-            if (amount <= 0n) throw new TypeError("MPP amount must be positive");
-            if (amount > max) throw new HttpError(403, "This payment exceeds the per-request permission.", { code: "mpp_request_limit_exceeded" });
-            if (spent + amount > limit) throw new HttpError(403, "This payment exceeds the daily MPP permission.", { code: "mpp_period_limit_exceeded" });
-            if (amount > balance) throw new HttpError(402, "Add MACH before paying for this capability.", { code: "machine_usd_required" });
-            wire.mpp = {
-              ...wire.mpp,
-              balance_atomics: String(balance - amount),
-              spent_atomics: String(spent + amount),
-            };
-            return {
-              receipt: {
-                id: `mpp_${++sequence}`,
-                amount_atomics: String(amount),
-                origin: request.body?.origin,
-                transaction_hash: mockHex(`mpp:${sequence}`, 32),
-              },
-              connection: wire,
-            };
-          }
-
-          throw new HttpError(404, `No mock route for ${request.method ?? "GET"} ${request.path}`, {
-            code: "mock_route_not_found",
-          });
-        },
-      };
-    },
-  });
-}
-
-function requiredGrant(grants, grantId) {
-  const grant = grants.get(grantId);
-  if (!grant) throw new HttpError(404, "Nanocodex grant not found", { code: "grant_not_found" });
-  return grant;
-}
-
-function requestedConnectors(value) {
-  if (value === undefined) return [];
-  if (!Array.isArray(value)) throw new TypeError("requested_connectors must be an array");
-  const supported = [
-    "github",
-    "gmail",
-    "gdrive",
-    "gcalendar",
-    "gtasks",
-    "gdocs",
-    "gsheets",
-    "gslides",
-    "gcontacts",
-    "slack",
-    "x",
-    "spotify",
-    "soundcloud",
-  "link",
-    "chatgpt",
-  ];
-  if (value.some((provider) => !supported.includes(provider))) {
-    throw new TypeError("requested_connectors contains an unsupported provider");
-  }
-  return supported.filter((provider) => value.includes(provider));
-}
-
-function requestedMcpConnections(value) {
-  if (value === undefined) return [];
-  if (!Array.isArray(value) || value.length > 16
-    || value.some((id) => typeof id !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(id))
-    || new Set(value).size !== value.length) {
-    throw new TypeError("requested_mcp_connections must contain exact hosted connection IDs");
-  }
-  return value.map((id) => ({ id, name: "MCP connection" }));
-}
-
-function connectorResources(resources) {
-  return requestedConnectors(resources
-    .filter((resource) => resource.startsWith("urn:nanocodex:connector:"))
-    .map((resource) => resource.slice("urn:nanocodex:connector:".length)));
-}
-
-function connectorName(provider) {
-  return ({
-    github: "GitHub",
-    gmail: "Gmail",
-    gdrive: "Google Drive",
-    gcalendar: "Google Calendar",
-    gtasks: "Google Tasks",
-    gdocs: "Google Docs",
-    gsheets: "Google Sheets",
-    gslides: "Google Slides",
-    gcontacts: "Google Contacts",
-    slack: "Slack",
-    x: "X",
-    spotify: "Spotify",
-    soundcloud: "SoundCloud",
-  link: "Stripe Link",
-    chatgpt: "ChatGPT",
-  })[provider];
-}
-
-function mockConnectorConnections(connectors, grantId) {
-  return Object.fromEntries(connectors
-    .filter((connector) => connector !== "chatgpt")
-    .map((connector) => [
-      connector,
-      [mockHex(`${grantId}:${connector}:connection`, 32).slice(2, 45)],
-    ]));
-}
-
-function requiredActiveGrant(grants, grantId) {
-  const grant = requiredGrant(grants, grantId);
-  if (grant.grant.status !== "active") {
-    throw new HttpError(403, "This Nanocodex grant has been revoked.", { code: "grant_revoked" });
-  }
-  return grant;
-}
-
-function mockHex(seed, bytes) {
-  let state = 2166136261;
-  let output = "";
-  for (let index = 0; output.length < bytes * 2; index += 1) {
-    const code = seed.charCodeAt(index % seed.length) + index;
-    state ^= code;
-    state = Math.imul(state, 16777619) >>> 0;
-    output += state.toString(16).padStart(8, "0");
-  }
-  return `0x${output.slice(0, bytes * 2)}`;
-}
-
 function requiredString(value, label) {
   if (typeof value !== "string" || value.length === 0) {
     throw new TypeError(`${label} must be a non-empty string`);

package/cloud/actions/account.d.mts

@@ -7,3 +7,15 @@ export declare namespace logout {
 
 /** Signs out the Nanocodex account without revoking its app grant or access key. */
 export function logout(client: Client): logout.ReturnType;
+
+export declare namespace links {
+  type Options = Readonly<{
+    connect?: "claude" | "chatgpt" | "openai" | "mcp" | "cloudflare" | "github" | "google" | "slack" | "x" | "spotify" | "soundcloud" | "link" | "whatsapp" | undefined;
+    add?: "login" | "api_key" | "card" | "address" | "phone" | "totp" | undefined;
+  }>;
+  type Result = Readonly<{ connections: string; vault: string; wallet: string; access: string }>;
+  type ReturnType = Promise<Result>;
+}
+
+/** Public navigation only; these URLs do not carry account authorization. */
+export function links(client: Client, options?: links.Options): links.ReturnType;

package/cloud/actions/account.mjs

@@ -17,3 +17,14 @@ export async function logout(client) {
   const cleanupFailure = cleanup.find((result) => result.status === "rejected");
   if (cleanupFailure?.status === "rejected") throw cleanupFailure.reason;
 }
+
+/** Discovers ordinary account navigation URLs; opening them uses browser sign-in. */
+export function links(client, options = {}) {
+  const query = new URLSearchParams();
+  for (const key of Object.keys(options)) {
+    if (key !== "connect" && key !== "add") throw new TypeError(`Unknown account links option: ${key}`);
+    if (options[key] !== undefined) query.set(key, options[key]);
+  }
+  const suffix = query.size ? `?${query}` : "";
+  return client.request({ method: "GET", path: `/v1/account/links${suffix}` });
+}

package/cloud/actions/agent.mjs

@@ -17,6 +17,9 @@ export async function create(client, options) {
   if (!connection || typeof connection !== "object") {
     throw new TypeError("agent.create requires an active connection");
   }
+  if (connection.grant?.permission === "services.use" || !connection.agentId) {
+    throw new Error("This Connect grant has no agent authority.");
+  }
   if (connection.grant?.status !== "active") {
     throw new Error("The Connect authorization is not active.");
   }

package/cloud/actions/connection.d.mts

@@ -47,6 +47,8 @@ export type AuthorizeAccessKey = Readonly<{
 }>;
 
 export type Capabilities = Readonly<{
+  /** Exact standalone Vault and phone authority. */
+  services?: import("../../services/index.mjs").ServiceCapabilities | undefined;
   /** SIWE authentication folded into the same passkey ceremony. */
   auth?: Auth | undefined;
   /** Access key authorized by the same passkey ceremony. */
@@ -111,7 +113,7 @@ export function disconnect(client: Client, options?: disconnect.Options | undefi
 export declare namespace reconnect {
   type Options = Readonly<{
     /** Reject a retained grant outside these app capability boundaries. */
-    capabilities?: Pick<Capabilities, "agent" | "cloudAccounts"> | undefined;
+    capabilities?: Pick<Capabilities, "agent" | "cloudAccounts" | "services"> | undefined;
     /** Defaults to the retained connection mode, then to hosted. */
     authorization?: "access_key" | "hosted" | undefined;
     tools?: readonly NamedTool[] | undefined;