dkey-client 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 99835816bfd5af46b6dfa9307f51d65a3be4983ff2dca632ba4f9e5d50a19ef3
+  data.tar.gz: fb3a63d174dd5c5f868cb2f10c4051f87f9dea45ed1e2e21f57bacdc232d6cad
+SHA512:
+  metadata.gz: ad8fe46a8c6d67c1b07cbca2f0ce9149fd47f2b2a0d7a5d59b4831514f183058794cd51379ad1c891805214749f6374cfccb07f0a7e71af4be5dda1a43b6372a
+  data.tar.gz: 56fc9d07537fdef920e5023fb387d176d709e13e7026ac59ccd5f641a18be775f9d3f82409766e67826111406b8736eb69939add8b9ee07f710b77e2f0429880

data/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+## Unreleased
+
+## 0.1.0
+
+- Initial release, extracted from Guestit Core's `Providers::Stargate::Dkey`.
+- `Dkey::AccessGrants::Create` — `PUT lock/codecard`, time-controlled codecards only.
+- `Dkey::AccessGrants::Delete` — `PATCH lock/codecard/:id/deactivate`, idempotent.
+- `Dkey::Locks::Index` — `GET lock/unit/:unit_id`, the unit's locks in one call.
+- `Dkey::AccessTokens::Upsert` — `POST login`, mints and stores the auth token via the injected token store.

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Guestit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,151 @@
+# dkey-client
+
+A Ruby client for the [Telkey (dKey) API](https://manager.telkey.com/api/v2/). Each endpoint is one operation class
+that returns a [dry-monads](https://dry-rb.org/gems/dry-monads/) `Result`. The gem handles authentication, retries
+and response normalization. It does not depend on Rails, only on ActiveSupport and Faraday. Your app supplies the
+account credentials, the unit id and the auth-token store.
+
+[Guestit](https://guestit.se) built it and runs it in production.
+
+Requires Ruby 4.0 or later.
+
+## Installation
+
+```ruby
+# Gemfile
+gem 'dkey-client'
+```
+
+Bundler loads it for you. Outside Bundler, `require 'dkey'`.
+
+## Configuration
+
+```ruby
+Dkey.configure do |config|
+  config.client_id   = ENV.fetch('TELKEY_CLIENT_ID') # the api_key; doubles as the X-User-Id header
+  config.secret      = ENV.fetch('TELKEY_SECRET')    # the api_secret
+  config.unit_id     = ENV.fetch('TELKEY_UNIT_ID')
+  config.token_store = MyTokenStore.new              # optional, defaults to Dkey::MemoryTokenStore
+end
+```
+
+| Setting | Default | What it does |
+| --- | --- | --- |
+| `client_id` | `nil` | The account's api key, sent as the `X-User-Id` header and used to log in. |
+| `secret` | `nil` | The account's api secret, used to log in. |
+| `unit_id` | `nil` | The unit every lock listing scopes to. |
+| `base_url` | `https://manager.telkey.com/api/v2/` | API root. |
+| `timeout` | `nil` | Faraday request timeout in seconds. |
+| `token_store` | `Dkey::MemoryTokenStore.new` | Where the minted auth token persists. |
+
+## Auth tokens
+
+Telkey mints an auth token on `POST login` and the response carries no expiry, so the gem holds a token for 12
+hours and then logs in again. Every authenticated call sends `X-User-Id` (the client id) and `X-Auth-Token` (the
+minted token); `AccessTokens::Upsert` reads the store first and only logs in when the stored token is missing or
+expired.
+
+A token store answers `read` (the token or `nil`) and `save(access_token:, expires_at:)`; a token responds to
+`access_token` and `expired?`. The default `Dkey::MemoryTokenStore` keeps the token per process — inject a real
+store to share it across processes or survive deploys.
+
+## Usage
+
+Operations live under `Dkey::<Resource>::<Action>`. Build a fresh instance for every call:
+
+```ruby
+result = Dkey::Locks::Index.new.call
+
+if result.success?
+  result.value!   # => [{ external_id: 'A1B2C3', name: 'Front door', status: 'online', charge: nil, keys: [...] }]
+else
+  result.failure  # => a Dkey::Error or a Faraday::Error
+end
+```
+
+`call` never raises. It returns `Success(value)` or `Failure(error)`. `call!` returns the `Success` and raises the
+error where `call` would return a `Failure`. Response bodies come back as hashes with symbol keys.
+
+The gem covers codecards (`AccessGrants::Create`, `AccessGrants::Delete`), the unit's locks (`Locks::Index`) and
+the login (`AccessTokens::Upsert`, which the client calls for you). [CHANGELOG.md](CHANGELOG.md) lists every
+operation.
+
+### Grants and locks
+
+A grant is a codecard: a time-bound guest link for one lock. Telkey has no reusable keys and no permanent grants,
+so only the time-controlled kind (`kind: 'tca'`) is supported, always with a validity window; anything else is
+refused before any request:
+
+```ruby
+Dkey::AccessGrants::Create.new.call(
+  attributes: {
+    access_id: 'A1B2C3', # the lock's serial number
+    kind: 'tca',
+    label: 'Guest',
+    start_date: Time.utc(2026, 11, 10),
+    end_date: Time.utc(2026, 11, 12)
+  }
+)
+```
+
+`Create` returns only a share link (`https://…/a/<token>`); the token is the codecard id the `Delete` call
+deactivates, and the full link rides along in `metadata[:raw]` for the guest. Deactivation is idempotent:
+re-revoking an already-deactivated codecard still returns 200, while an unknown id answers 403.
+
+`Locks::Index` returns every lock of the configured unit in one call — Telkey has no filters and no paging. The
+wire reports no connectivity or battery level, so a listed lock reads as `online` with a blank charge, and an
+empty lock label falls back to the serial number.
+
+### Errors
+
+| Class | Raised when |
+| --- | --- |
+| `Dkey::ArgumentError` | The arguments are unusable. Raised before any request, with a message the host can show as it is. |
+| `Dkey::ApiError` | Telkey answered with an error status. `#status` holds the HTTP status. |
+| `Dkey::Error` | The parent of the two above, also raised when the client id, secret or unit id is missing. |
+
+### Retries and delivery
+
+Reads retry 429/502/503/504, timeouts and connection-level failures with backoff. A codecard create and the login
+never retry, since `PUT /lock/codecard` has no provider idempotency key. The deactivation is idempotent and retries
+a connection-level failure only. After a failed write:
+
+```ruby
+error.is_a?(Dkey::ApiError) && error.unapplied? # the write certainly did not take, so a retry is safe
+```
+
+Anything else (a server error, a timeout after the request left) leaves delivery unknown: read back before
+retrying.
+
+## Type signatures
+
+The gem ships RBS for its public API in `sig/dkey.rbs`. `rbs collection install` picks it up from your
+`Gemfile.lock`, so Steep sees it with no extra setup.
+
+## Development
+
+```sh
+bundle install
+bundle exec rake        # specs and RuboCop
+bundle exec rspec       # specs only
+bundle exec rubocop -A  # autocorrect; review every change
+```
+
+The specs run offline against recorded VCR cassettes in `spec/fixtures/cassettes`. Recording a new cassette needs
+live credentials for a Telkey account. Scrub the client id, the secret, the unit id and the auth token (the
+spec_helper filters handle all four) and any real lock serials or codecard tokens from the cassette before you
+commit it — this repo is public.
+
+## Releasing
+
+1. Bump `Dkey::VERSION` in `lib/dkey/version.rb` and move the `Unreleased` notes in `CHANGELOG.md` under the new
+   version.
+2. Commit on `staging` and run `bundle exec rake`.
+3. Run `gem signin` once per machine. The gem requires MFA, so every push asks for a one-time code.
+4. Run `bundle exec rake release`. It builds `pkg/dkey-client-<version>.gem`, tags `v<version>`, pushes the branch
+   and the tag, and pushes the gem to RubyGems.
+5. Fast-forward `production` to the release tag.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

data/lib/dkey/access_grants/create.rb

@@ -0,0 +1,63 @@
+module Dkey
+  module AccessGrants
+    # Creates a codecard: a time-bound guest link for one lock. Telkey has no
+    # reusable keys and no permanent grants, so only the time-controlled kind is
+    # supported, always with a validity window.
+    class Create
+      include Dkey::Operation
+
+      # @rbs (attributes: ::Hash[::Symbol, untyped]) -> Dry::Monads::Result[::Hash[::Symbol, untyped]]
+      def call(attributes:)
+        argument! 'Access ID is required.' if attributes[:access_id].blank?
+        argument! 'Regular grants are not supported by the Telkey provider.' unless attributes[:kind] == KIND_TIME_CONTROLLED
+        argument! 'Start date and end date are both required.' if attributes[:start_date].blank? || attributes[:end_date].blank?
+        argument! 'End date must be after start date.' if attributes[:start_date].in_time_zone >= attributes[:end_date].in_time_zone
+
+        Success(create_codecard(attributes))
+      end
+
+      private
+
+      # @rbs (::Hash[::Symbol, untyped] attributes) -> ::Hash[::Symbol, untyped]
+      def create_codecard(attributes)
+        data = codecard_data(Dkey.request(:put, 'lock/codecard', params: codecard_payload(attributes)))
+        external_id = codecard_id(data)
+        raise Error, 'Dkey codecard id is required' if external_id.blank?
+
+        { external_id:, metadata: { raw: data } }
+      end
+
+      # @rbs (::Hash[::Symbol, untyped] attributes) -> ::Hash[::Symbol, untyped]
+      def codecard_payload(attributes)
+        {
+          valid_from: iso8601(attributes[:start_date]),
+          valid_to: iso8601(attributes[:end_date]),
+          locks: [attributes[:access_id]],
+          label: attributes[:label].presence,
+          key_type: 0
+        }.compact
+      end
+
+      # @rbs (::Hash[::Symbol, untyped] body) -> ::Hash[::Symbol, untyped]
+      def codecard_data(body)
+        body.is_a?(Hash) ? (body[:data].presence || {}) : {}
+      end
+
+      # Telkey returns only a share link (https://…/a/<token>); the <token> is the codecard id
+      # used to deactivate it later. The full link is kept in metadata for the guest.
+
+      # @rbs (::Hash[::Symbol, untyped] data) -> ::String?
+      def codecard_id(data)
+        link = data[:link]
+        return if link.blank?
+
+        link[%r{/a/([^/?#]+)}, 1] || link[%r{/([^/?#]+)/?\z}, 1]
+      end
+
+      # @rbs ((::Date | ::Time) value) -> ::String
+      def iso8601(value)
+        value.in_time_zone.utc.iso8601
+      end
+    end
+  end
+end

data/lib/dkey/access_grants/delete.rb

@@ -0,0 +1,29 @@
+module Dkey
+  module AccessGrants
+    # Deactivates a codecard. Telkey deactivation is idempotent: re-revoking an
+    # already-deactivated codecard still returns 200. (An unknown codecard id
+    # returns 403, which surfaces as a failure.)
+    class Delete
+      include Dkey::Operation
+
+      # @rbs (attributes: ::Hash[::Symbol, untyped]) -> Dry::Monads::Result[bool]
+      def call(attributes:)
+        argument! 'External ID is required.' if attributes[:external_id].blank?
+        argument! 'Regular grants are not supported by the Telkey provider.' unless attributes[:kind] == KIND_TIME_CONTROLLED
+
+        deactivate_codecard(attributes)
+
+        Success(true)
+      end
+
+      private
+
+      # @rbs (::Hash[::Symbol, untyped] attributes) -> untyped
+      def deactivate_codecard(attributes)
+        path = format('lock/codecard/%<id>s/deactivate', id: ERB::Util.url_encode(attributes[:external_id]))
+
+        Dkey.request(:patch, path)
+      end
+    end
+  end
+end

data/lib/dkey/access_grants.rb

@@ -0,0 +1,9 @@
+module Dkey
+  # Telkey issues only time-bound codecards, so the one grant kind the
+  # access-grant operations accept is time-controlled (tca). The host passes its
+  # own grant vocabulary through and gets a refusal before the wire for any
+  # other kind.
+  module AccessGrants
+    KIND_TIME_CONTROLLED = 'tca'.freeze #: ::String
+  end
+end

data/lib/dkey/access_tokens/upsert.rb

@@ -0,0 +1,38 @@
+module Dkey
+  module AccessTokens
+    # Logs in with the account's api credentials and stores the minted auth token.
+    # The login response carries no expiry, so the token is held for TOKEN_TTL and
+    # then re-minted.
+    class Upsert
+      include Dkey::Operation
+
+      TOKEN_TTL = 12.hours
+
+      # @rbs () -> Dry::Monads::Result[untyped]
+      def call
+        Success(store.read || mint)
+      end
+
+      private
+
+      # @rbs () -> untyped
+      def store
+        Dkey.config.token_store
+      end
+
+      # @rbs () -> untyped
+      def mint
+        body = Dkey.request(:post, 'login', params: { api_key: Dkey.client_id, api_secret: Dkey.secret }, headers: {})
+
+        store.save(access_token: auth_token(body), expires_at: TOKEN_TTL.from_now)
+      end
+
+      # @rbs (untyped body) -> ::String
+      def auth_token(body)
+        token = body.dig(:data, :authToken) if body.is_a?(Hash)
+
+        token.presence || raise(Error, 'Dkey login response is missing an auth token.')
+      end
+    end
+  end
+end

data/lib/dkey/api_error.rb

@@ -0,0 +1,20 @@
+module Dkey
+  # A rejected Telkey response, carrying the HTTP status. #unapplied? marks a
+  # refusal where the write certainly did not land, so a retry is safe; anything
+  # else (a server error, a timeout after a write) leaves delivery unknown.
+  class ApiError < Error
+    attr_reader :status #: ::Integer
+
+    # @rbs (::String message, status: ::Integer) -> void
+    def initialize(message, status:)
+      super(message)
+
+      @status = status
+    end
+
+    # @rbs () -> bool
+    def unapplied?
+      status.between?(400, 499) && [408, 409].exclude?(status)
+    end
+  end
+end

data/lib/dkey/client.rb

@@ -0,0 +1,70 @@
+module Dkey
+  BASE_URL = 'https://manager.telkey.com/api/v2/'.freeze #: ::String
+
+  CONNECTION_LEVEL_ERRORS = [Faraday::ConnectionFailed, Faraday::SSLError].freeze #: ::Array[untyped]
+
+  # A codecard PUT creates a grant without a provider idempotency key and the
+  # login POST mints a token, so neither ever retries. A read retries a refused
+  # status, a timeout and a connection-level failure. The deactivation PATCH is
+  # idempotent and retries a connection-level failure only.
+  RETRY_OPTIONS = {
+    max: 3,
+    interval: 0.5,
+    interval_randomness: 0.5,
+    backoff_factor: 2,
+    retry_statuses: [429, 502, 503, 504],
+    methods: Faraday::Retry::Middleware::IDEMPOTENT_METHODS - [:put],
+    exceptions: [*Faraday::Retry::Middleware::DEFAULT_EXCEPTIONS, *CONNECTION_LEVEL_ERRORS],
+    retry_if: ->(env, exception) do
+      next false if %i[post put].include?(env.method)
+
+      CONNECTION_LEVEL_ERRORS.any? { |klass| exception.is_a?(klass) }
+    end
+  }.freeze #: ::Hash[::Symbol, untyped]
+
+  # @rbs () -> Faraday::Connection
+  def self.connection
+    @connection ||= Faraday.new(url: config.base_url, headers: { 'Accept' => 'application/json' }) do |builder|
+      builder.request :json
+      builder.request :retry, RETRY_OPTIONS
+      builder.response :json, parser_options: { symbolize_names: true, mode: :rails, decoder: [Oj, :load] }
+      builder.options[:timeout] = config.timeout
+    end
+  end
+
+  # @rbs (::Symbol method, ::String path, ?params: untyped, ?headers: ::Hash[::String, ::String]) -> untyped
+  def self.request(method, path, params: nil, headers: auth_headers)
+    response = connection.public_send(method, path, params, headers)
+
+    return response.body if response.success?
+
+    raise ApiError.new(error_message(response), status: response.status)
+  end
+
+  # Telkey identifies the account by its api_key, which doubles as the X-User-Id header value.
+
+  # @rbs () -> ::String
+  def self.client_id
+    config.client_id.presence || raise(Error, 'Dkey client_id is required.')
+  end
+
+  # @rbs () -> ::String
+  def self.secret
+    config.secret.presence || raise(Error, 'Dkey secret is required.')
+  end
+
+  # @rbs () -> ::Hash[::String, ::String]
+  private_class_method def self.auth_headers
+    { 'X-User-Id' => client_id, 'X-Auth-Token' => AccessTokens::Upsert.new.call!.value!.access_token }
+  end
+
+  # Telkey returns error details under :error_message.
+
+  # @rbs (Faraday::Response response) -> ::String
+  private_class_method def self.error_message(response)
+    body = response.body
+    message = body.is_a?(Hash) ? body[:error_message] : nil
+
+    message.presence || body.to_s.presence || "Provider request failed with status #{response.status}"
+  end
+end

data/lib/dkey/config.rb

@@ -0,0 +1,18 @@
+module Dkey
+  # Injected by the host app (see the Dkey.configure initializer): the account's
+  # client id (the api_key, which doubles as the X-User-Id header value), the
+  # secret (api_secret), the unit every lock call scopes to, and the store the
+  # minted auth token persists in. Keeping these out of the gem is what makes it
+  # host-agnostic.
+  #
+  # Telkey mints an auth token per login, so unlike a static-token provider the
+  # gem needs a token store; the default MemoryTokenStore keeps it per process.
+  class Config
+    attr_accessor :client_id, :secret, :unit_id, :base_url, :timeout, :token_store
+
+    def initialize
+      @base_url = BASE_URL
+      @token_store = MemoryTokenStore.new
+    end
+  end
+end

data/lib/dkey/error.rb

@@ -0,0 +1,6 @@
+module Dkey
+  class Error < StandardError; end
+
+  # Raised by operations before any network call when the arguments are unusable.
+  class ArgumentError < Error; end
+end

data/lib/dkey/locks/index.rb

@@ -0,0 +1,44 @@
+module Dkey
+  module Locks
+    # Lists the unit's locks. Telkey has no lock list filters and no paging: one
+    # call returns every lock of the configured unit.
+    class Index
+      include Dkey::Operation
+
+      # The wire reports no connectivity or battery level, so a listed lock reads
+      # as online and the charge is left blank.
+      STATUS_ONLINE = 'online'.freeze
+
+      # @rbs () -> Dry::Monads::Result[::Array[::Hash[::Symbol, untyped]]]
+      def call
+        unit_id = Dkey.config.unit_id.presence || raise(Error, 'Dkey unit_id is not configured.')
+
+        body = Dkey.request(:get, "lock/unit/#{unit_id}")
+
+        Success(locks(body).map { |item| attributes(item) })
+      end
+
+      private
+
+      # @rbs (::Hash[::Symbol, untyped] body) -> ::Array[::Hash[::Symbol, untyped]]
+      def locks(body)
+        body.dig(:data, :locks).presence || []
+      end
+
+      # Labels are often empty, so fall back to the serial number.
+
+      # @rbs (::Hash[::Symbol, untyped] item) -> ::Hash[::Symbol, untyped]
+      def attributes(item)
+        name = item[:label].presence || item[:serialNumber]
+
+        {
+          external_id: item[:serialNumber],
+          name:,
+          status: STATUS_ONLINE,
+          charge: nil,
+          keys: [{ external_id: item[:serialNumber], name: }]
+        }
+      end
+    end
+  end
+end

data/lib/dkey/memory_token_store.rb

@@ -0,0 +1,22 @@
+module Dkey
+  # Default in-memory auth-token store. A process restart re-logs in; a host that
+  # needs the token shared across processes or surviving restarts injects its own
+  # store with the same read/save contract (see Dkey.configure).
+  class MemoryTokenStore
+    Token = Struct.new(:access_token, :expires_at, keyword_init: true) do
+      def expired?
+        expires_at < Time.now
+      end
+    end
+
+    # @rbs () -> Token?
+    def read
+      @token if @token && !@token.expired?
+    end
+
+    # @rbs (access_token: ::String, expires_at: untyped) -> Token
+    def save(access_token:, expires_at:)
+      @token = Token.new(access_token:, expires_at:)
+    end
+  end
+end

data/lib/dkey/operation.rb

@@ -0,0 +1,32 @@
+module Dkey
+  # Shared monadic contract for the client operations: #call returns a Result,
+  # #call! unwraps it and raises the underlying failure. An error raised inside
+  # #call becomes Failure(error), mirroring the host's operation base.
+  module Operation
+    def self.included(base)
+      base.include Dry::Monads[:result]
+      base.prepend(Call)
+    end
+
+    module Call
+      def call(*, **, &)
+        super
+      rescue StandardError => e
+        Failure(e)
+      end
+    end
+
+    def call!(...)
+      result = call(...)
+      raise result.failure if result.failure?
+
+      result
+    end
+
+    private
+
+    def argument!(message)
+      raise Dkey::ArgumentError, message
+    end
+  end
+end

data/lib/dkey/version.rb

@@ -0,0 +1,3 @@
+module Dkey
+  VERSION = '0.1.0'.freeze
+end

data/lib/dkey-client.rb

@@ -0,0 +1 @@
+require_relative 'dkey'

data/lib/dkey.rb

@@ -0,0 +1,34 @@
+require 'active_support'
+require 'active_support/core_ext'
+require 'dry/monads'
+require 'erb'
+require 'faraday'
+require 'faraday/retry'
+require 'oj'
+
+require_relative 'dkey/version'
+require_relative 'dkey/error'
+require_relative 'dkey/api_error'
+require_relative 'dkey/memory_token_store'
+require_relative 'dkey/config'
+require_relative 'dkey/operation'
+require_relative 'dkey/client'
+require_relative 'dkey/access_grants'
+require_relative 'dkey/access_tokens/upsert'
+require_relative 'dkey/access_grants/create'
+require_relative 'dkey/access_grants/delete'
+require_relative 'dkey/locks/index'
+
+module Dkey
+  class << self
+    # @rbs () { (Config) -> void } -> void
+    def configure
+      yield(config)
+    end
+
+    # @rbs () -> Config
+    def config
+      @config ||= Config.new
+    end
+  end
+end

data/sig/dkey.rbs

@@ -0,0 +1,92 @@
+# Public API of the gem, mirroring the inline `# @rbs` annotations in lib/.
+# Shipped with the gem so host apps pick it up through `rbs collection`.
+module Dkey
+  VERSION: ::String
+
+  BASE_URL: ::String
+  CONNECTION_LEVEL_ERRORS: ::Array[untyped]
+  RETRY_OPTIONS: ::Hash[::Symbol, untyped]
+
+  def self.configure: () { (Config) -> void } -> void
+  def self.config: () -> Config
+
+  def self.connection: () -> untyped
+  def self.request: (::Symbol method, ::String path, ?params: untyped, ?headers: ::Hash[::String, ::String]) -> untyped
+  def self.client_id: () -> ::String
+  def self.secret: () -> ::String
+
+  class Error < ::StandardError
+  end
+
+  # Raised by operations before any network call when the arguments are unusable.
+  class ArgumentError < Error
+  end
+
+  # A rejected Telkey response; #unapplied? marks a write that never landed.
+  class ApiError < Error
+    attr_reader status: ::Integer
+
+    def initialize: (::String message, status: ::Integer) -> void
+
+    def unapplied?: () -> bool
+  end
+
+  class Config
+    attr_accessor client_id: ::String?
+    attr_accessor secret: ::String?
+    attr_accessor unit_id: ::String?
+    attr_accessor base_url: ::String
+    attr_accessor timeout: (::Integer | ::Float)?
+    attr_accessor token_store: untyped
+  end
+
+  class MemoryTokenStore
+    class Token
+      attr_accessor access_token: ::String
+      attr_accessor expires_at: untyped
+
+      def expired?: () -> bool
+    end
+
+    def read: () -> Token?
+    def save: (access_token: ::String, expires_at: untyped) -> Token
+  end
+
+  # #call! returns the same Result as #call, raising the failure instead of
+  # wrapping it — hence the `alias call! call` on every operation below.
+  module Operation
+    def call!: (*untyped, **untyped) -> untyped
+  end
+
+  module AccessTokens
+    class Upsert
+      TOKEN_TTL: ::ActiveSupport::Duration
+
+      def call: () -> ::Dry::Monads::Result[untyped]
+      alias call! call
+    end
+  end
+
+  module AccessGrants
+    KIND_TIME_CONTROLLED: ::String
+
+    class Create
+      def call: (attributes: ::Hash[::Symbol, untyped]) -> ::Dry::Monads::Result[::Hash[::Symbol, untyped]]
+      alias call! call
+    end
+
+    class Delete
+      def call: (attributes: ::Hash[::Symbol, untyped]) -> ::Dry::Monads::Result[bool]
+      alias call! call
+    end
+  end
+
+  module Locks
+    class Index
+      STATUS_ONLINE: ::String
+
+      def call: () -> ::Dry::Monads::Result[::Array[::Hash[::Symbol, untyped]]]
+      alias call! call
+    end
+  end
+end

metadata

@@ -0,0 +1,133 @@
+--- !ruby/object:Gem::Specification
+name: dkey-client
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Guestit
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '8.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '8.1'
+- !ruby/object:Gem::Dependency
+  name: dry-monads
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.10'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.10'
+- !ruby/object:Gem::Dependency
+  name: faraday
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.14'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.14'
+- !ruby/object:Gem::Dependency
+  name: faraday-retry
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.4'
+- !ruby/object:Gem::Dependency
+  name: oj
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.17'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.17'
+description: 'One operation per Telkey dKey API endpoint, returning dry-monads Results,
+  with retries and response normalization. Framework-free: the host injects the account
+  credentials, the unit id and the auth-token store.'
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- lib/dkey-client.rb
+- lib/dkey.rb
+- lib/dkey/access_grants.rb
+- lib/dkey/access_grants/create.rb
+- lib/dkey/access_grants/delete.rb
+- lib/dkey/access_tokens/upsert.rb
+- lib/dkey/api_error.rb
+- lib/dkey/client.rb
+- lib/dkey/config.rb
+- lib/dkey/error.rb
+- lib/dkey/locks/index.rb
+- lib/dkey/memory_token_store.rb
+- lib/dkey/operation.rb
+- lib/dkey/version.rb
+- sig/dkey.rbs
+homepage: https://github.com/guestitab/dkey-client
+licenses:
+- MIT
+metadata:
+  allowed_push_host: https://rubygems.org
+  source_code_uri: https://github.com/guestitab/dkey-client
+  changelog_uri: https://github.com/guestitab/dkey-client/blob/staging/CHANGELOG.md
+  bug_tracker_uri: https://github.com/guestitab/dkey-client/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '4.0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.23
+specification_version: 4
+summary: Ruby client for the Telkey (dKey) API
+test_files: []