@adukilabs/sdk 0.0.0-stage → 0.1.2

package/dist/errors.js

@@ -0,0 +1,206 @@
+// Errors mirror the Kotlin SDK's AdukiException hierarchy (aduki-kt core/errors).
+/** Base class of every error the SDK throws. */
+export class AdukiError extends Error {
+    constructor(message, options = {}) {
+        super(message, options.cause === undefined ? undefined : { cause: options.cause });
+        this.name = new.target.name;
+    }
+}
+/**
+ * Transport failure or a non-2xx answer that is not a 401. `status` is the
+ * HTTP status when there was one (undefined: the server was not reached).
+ * `retryAfter` holds the seconds the server asked to wait, when it said.
+ * The subclasses below name the answers a client acts on; see `refusal`.
+ */
+export class NetworkError extends AdukiError {
+    constructor(message, options = {}) {
+        super(message, options);
+        this.status = options.status;
+        this.kind = options.kind ?? '';
+        this.details = options.details;
+        this.retryAfter = options.retryAfter;
+    }
+}
+/** `429`: too many requests (`rate.limited`, `mail.queue_busy`, or the gateway's plain 429). Wait `retryAfter` seconds when given. */
+export class RateLimitedError extends NetworkError {
+}
+/** `403 auth.stepup`: the action needs a fresh second factor; the session stays valid. */
+export class StepUpError extends NetworkError {
+}
+/**
+ * A package limit or quota was reached: `403 plan.limit` or `507 quota.exceeded`.
+ * `key`, `limit` and `used` come from the details when the server sent them.
+ */
+export class LimitError extends NetworkError {
+    constructor(message, options = {}) {
+        super(message, options);
+        const details = options.details && typeof options.details === 'object' ? options.details : {};
+        this.key = typeof details.key === 'string' ? details.key : '';
+        this.limit = typeof details.limit === 'number' ? details.limit : undefined;
+        this.used = typeof details.used === 'number' ? details.used : undefined;
+    }
+}
+/** `410 sync.reset`: the sync token is no longer known; sync again without one. */
+export class SyncResetError extends NetworkError {
+}
+/** A `5xx` answer (`server.error`, `auth.unavailable`, a gateway 502, 503 or 504); `retryAfter` when the server said. */
+export class ServerError extends NetworkError {
+}
+/** The kinds after which the session is over and its tokens are useless (aduki-kt `Unauthorized.ENDED`). */
+export const ENDED = Object.freeze(['auth.invalid', 'auth.reused', 'auth.revoked', 'auth.expired']);
+/** The server refused the credentials (401): wrong password, spent refresh token, stale token. */
+export class UnauthorizedError extends AdukiError {
+    constructor(message, options = {}) {
+        super(message, options);
+        this.status = 401;
+        this.kind = options.kind ?? '';
+        this.details = options.details;
+    }
+    /**
+     * True when the kind says the session is over (`auth.invalid`,
+     * `auth.reused`, `auth.revoked`, `auth.expired`); false for other kinds
+     * (`auth.factor`, `auth.stale`, `auth.dpop`) and for a 401 without one.
+     */
+    get ended() {
+        return ENDED.includes(this.kind);
+    }
+}
+/**
+ * `401 auth.dpop` or `401 auth.nonce`: the DPoP proof was refused (a key or
+ * clock problem), not the credentials (aduki-kt `AdukiException.Proof`). A
+ * subclass of UnauthorizedError, so existing `instanceof` checks still match.
+ */
+export class ProofError extends UnauthorizedError {
+}
+/** `details.reason` of a refusal, or ''. */
+function reasonOf(details) {
+    const value = details && typeof details === 'object' ? details.reason : undefined;
+    return typeof value === 'string' ? value : '';
+}
+/**
+ * `401` with `details.reason = "token.required"`: the server needs the Aduki
+ * ID token and its proof with the request (the Chats handshake on an Aduki
+ * deployment). A client that cannot send them is too old: tell the user to
+ * update instead of retrying.
+ */
+export class TokenRequiredError extends UnauthorizedError {
+}
+/**
+ * `401` with `details.reason = "session.expired"` or `"session.ended"`: the
+ * Chats session is over (its time ran out, or Aduki ID ended the sign-in
+ * session that authorized it). Repeat the handshake; after `session.ended`
+ * that needs a current token (the person may have to sign in again).
+ */
+export class SessionEndedError extends UnauthorizedError {
+    /** `session.expired` or `session.ended` */
+    get reason() {
+        return reasonOf(this.details);
+    }
+}
+/**
+ * `403` with `details.reason = "subject"` (the token is for another account
+ * than the device's) or `"jkt.mismatch"` (the device is bound to another
+ * Aduki ID key than the token's). Retrying with the same key does not help.
+ */
+export class IdentityMismatchError extends NetworkError {
+    /** `subject` or `jkt.mismatch` */
+    get reason() {
+        return reasonOf(this.details);
+    }
+}
+/**
+ * `403 access.denied` with `details.reason = "client"`: the route is not for
+ * a program. A workspace's service client (machine access) is refused where
+ * only a person may act: in Store shares, links, devices, reports, search,
+ * tickets and the change feed; in Space the strict and money routes. Another
+ * token does not help: the route needs a person signed in.
+ */
+export class ClientRefusedError extends NetworkError {
+    /** always `client` */
+    get reason() {
+        return reasonOf(this.details);
+    }
+}
+/**
+ * A 2xx authentication answer that could not be used. `refresh` carries a
+ * rotated refresh token the answer did include, so callers never lose a token
+ * the server already swapped in.
+ */
+export class AuthError extends AdukiError {
+    constructor(message, options = {}) {
+        super(message, options);
+        this.refresh = options.refresh ?? '';
+    }
+}
+/** A protocol violation: bad state, issuer mismatch, bad id token, missing field. */
+export class ProtocolError extends AdukiError {
+}
+/** A storage backend failed. */
+export class StorageError extends AdukiError {
+}
+/**
+ * The one mapping from a refused answer to a typed error, used by every
+ * service module. A 401 is UnauthorizedError (`auth.dpop`, `auth.nonce`:
+ * ProofError; `details.reason` `token.required`: TokenRequiredError;
+ * `session.expired`, `session.ended`: SessionEndedError); a 429
+ * RateLimitedError; a 403 with `details.reason` `subject` or `jkt.mismatch`
+ * IdentityMismatchError; a 403 with `details.reason` `client`
+ * ClientRefusedError; `403 auth.stepup` StepUpError;
+ * `plan.limit` and `quota.exceeded` LimitError; `sync.reset` SyncResetError;
+ * a 5xx ServerError; anything else NetworkError. Every one but the 401s is a
+ * NetworkError with `status`, `kind`, `details` and `retryAfter` (from the
+ * `Retry-After` header, else `details.retry_after` or `details.retry`).
+ */
+export function refusal({ status, kind = '', message, details, retry, what }) {
+    const text = message || `HTTP ${status}`;
+    const reason = reasonOf(details);
+    if (status === 401) {
+        const Type = reason === 'token.required' ? TokenRequiredError
+            : reason === 'session.expired' || reason === 'session.ended' ? SessionEndedError
+                : kind === 'auth.dpop' || kind === 'auth.nonce' ? ProofError : UnauthorizedError;
+        return new Type(kind ? `${kind}: ${text}` : text, { kind, details });
+    }
+    const options = { status, kind, details };
+    const wait = retryAfter(retry) ?? waited(details);
+    if (wait !== undefined)
+        options.retryAfter = wait;
+    const full = `${what ?? 'Request'} failed: ${text}`;
+    if (status === 429)
+        return new RateLimitedError(full, options);
+    if (status === 403 && (reason === 'subject' || reason === 'jkt.mismatch'))
+        return new IdentityMismatchError(full, options);
+    if (status === 403 && reason === 'client')
+        return new ClientRefusedError(full, options);
+    if (kind === 'auth.stepup')
+        return new StepUpError(full, options);
+    if (kind === 'plan.limit' || kind === 'quota.exceeded')
+        return new LimitError(full, options);
+    if (kind === 'sync.reset')
+        return new SyncResetError(full, options);
+    if (status >= 500 && status <= 599)
+        return new ServerError(full, options);
+    return new NetworkError(full, options);
+}
+/**
+ * The seconds of a `Retry-After` value (delta seconds or an HTTP date), or
+ * undefined when absent or unreadable. Never negative.
+ */
+export function retryAfter(value, now = Date.now()) {
+    const text = value?.trim();
+    if (!text)
+        return undefined;
+    if (/^\d+$/.test(text))
+        return Number(text);
+    const at = Date.parse(text);
+    if (Number.isNaN(at))
+        return undefined;
+    return Math.max(0, Math.ceil((at - now) / 1000));
+}
+/** `details.retry_after` (Aduki Mail) or `details.retry` (Aduki ID) in seconds. */
+function waited(details) {
+    if (!details || typeof details !== 'object')
+        return undefined;
+    const o = details;
+    const value = o.retry_after ?? o.retry;
+    return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? Math.ceil(value) : undefined;
+}

package/dist/http.d.ts

@@ -0,0 +1,11 @@
+/** `base` and `path` joined with exactly one slash. */
+export declare const url: (base: string, path: string) => string;
+/** Runs fetch and turns a transport failure into NetworkError (an abort is passed through). */
+export declare function send(fetcher: typeof fetch, input: Request | string | URL, init?: RequestInit): Promise<Response>;
+/** The headers and body of a JSON request. */
+export declare const json: (body: unknown) => {
+    headers: {
+        'Content-Type': string;
+    };
+    body: string;
+};

package/dist/http.js

@@ -0,0 +1,22 @@
+// Small HTTP helpers shared by every service module (Aduki ID today; mail and
+// the other APIs next): joining a base and a path, a JSON request body, and a
+// fetch that reports a transport failure as NetworkError.
+import { NetworkError } from './errors.js';
+/** `base` and `path` joined with exactly one slash. */
+export const url = (base, path) => `${base.replace(/\/+$/, '')}/${path}`;
+/** Runs fetch and turns a transport failure into NetworkError (an abort is passed through). */
+export async function send(fetcher, input, init) {
+    try {
+        return await fetcher(input, init);
+    }
+    catch (cause) {
+        if (cause instanceof Error && cause.name === 'AbortError')
+            throw cause;
+        throw new NetworkError(`Request failed: ${cause instanceof Error ? cause.message : cause}`, { cause });
+    }
+}
+/** The headers and body of a JSON request. */
+export const json = (body) => ({
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+});

package/dist/jmap.d.ts

@@ -0,0 +1,100 @@
+import { AdukiError } from './errors.js';
+export declare const CORE = "urn:ietf:params:jmap:core";
+export declare const MAIL = "urn:ietf:params:jmap:mail";
+export declare const SUBMISSION = "urn:ietf:params:jmap:submission";
+/** Aduki body reading: `Email/get` takes `aduki:bodyMode` (ADK-MAIL-001 section 1.4, v47). */
+export declare const READING = "urn:aduki:params:jmap:reading";
+/** Core and mail: enough for `Mailbox`, `Email` and `Thread`. */
+export declare const USING: readonly string[];
+/** An authenticated fetch for one audience: `Session` and `Client` both have it. */
+export interface AudienceFetch {
+    fetch(audience: string, input: Request | string | URL, init?: RequestInit): Promise<Response>;
+}
+/** The part of the JMAP session resource the SDK uses. */
+export interface JmapSession {
+    /** the primary mail account id */
+    account: string;
+    api: string;
+    /** URL template with `{accountId}` */
+    upload: string;
+    /** URL template with `{accountId}`, `{blobId}`, `{name}`, `{type}` */
+    download: string;
+    /** URL template with `{types}`, `{closeafter}`, `{ping}` */
+    eventSource: string;
+    /** every session capability advertised */
+    capabilities: string[];
+    /** `urn:ietf:params:jmap:core` limits (`maxSizeUpload`, `maxCallsInRequest`, ...) */
+    limits: Record<string, unknown>;
+    /** the server reads bodies (`aduki:bodyMode`), see READING */
+    reading: boolean;
+}
+/** One method call: `[name, arguments, call id]`. */
+export type Invocation = [name: string, args: Record<string, unknown>, id: string];
+/** An uploaded blob. */
+export interface Uploaded {
+    blob: string;
+    type: string;
+    size: number;
+}
+/**
+ * A JMAP method error (`["error", {type, description}, id]`) or a per-object
+ * refusal of a `/set` call (`notCreated`, `notUpdated`, `notDestroyed`).
+ * `type` is the JMAP error type (`invalidArguments`, `forbiddenFrom`,
+ * `notFound`, ...); `id` names the object for a per-object refusal.
+ */
+export declare class JmapError extends AdukiError {
+    type: string;
+    description: string;
+    properties: string[];
+    method: string;
+    id: string;
+    constructor(method: string, error: Record<string, any>, id?: string);
+}
+export interface JmapOptions {
+    /** where the token comes from: a `Session` or a `Client` from `createClient` */
+    session: AudienceFetch;
+    /** the mail host root without `/v1` (default `https://mail.aduki.pro`) */
+    root?: string | undefined;
+    /** the token audience (default `mail`) */
+    audience?: string | undefined;
+}
+export declare const ROOT = "https://mail.aduki.pro";
+export declare class Jmap {
+    #private;
+    constructor(options: JmapOptions);
+    /** Sends an authenticated request to the mail host (a path or an absolute URL). */
+    fetch(input: string, init?: RequestInit): Promise<Response>;
+    /** The session (`GET /jmap/session`), fetched once; `refresh` fetches it again. */
+    session(refresh?: boolean): Promise<JmapSession>;
+    /** The primary mail account id. */
+    account(): Promise<string>;
+    /**
+     * Runs `calls` in one request and returns every response in order
+     * (`[name, args, id]`). A method `error` response throws JmapError;
+     * per-object refusals (`notCreated`, ...) are left to the caller.
+     */
+    call(calls: Invocation[], using?: readonly string[]): Promise<Invocation[]>;
+    /**
+     * Runs one method with `accountId` set and returns its arguments (the
+     * first response with the call id; implicit responses are dropped).
+     */
+    method(name: string, args?: Record<string, unknown>, using?: readonly string[]): Promise<Record<string, any>>;
+    /** Uploads `data` as a blob of `type` (RFC 8620 section 6.1). */
+    upload(data: Blob | ArrayBuffer | Uint8Array, type?: string): Promise<Uploaded>;
+    /**
+     * Downloads blob `blob` (RFC 8620 section 6.2). Returns the open response
+     * (read it with `blob()`, `arrayBuffer()` or `body`); a failure throws.
+     * `name` and `type` label the download (`Content-Disposition`, `Content-Type`).
+     */
+    download(blob: string, options?: {
+        name?: string;
+        type?: string;
+    }): Promise<Response>;
+}
+/**
+ * Throws for a non-2xx answer (`envelope.rejection`): 401 is
+ * UnauthorizedError, anything else a NetworkError (or a subclass) with the
+ * status and the kind of the envelope or the type of the RFC 7807 problem
+ * document JMAP uses for request-level errors.
+ */
+export declare function refuse(response: Response, what: string): Promise<never>;

package/dist/jmap.js

@@ -0,0 +1,180 @@
+// JMAP (RFC 8620) over the authenticated fetch, shared by the services that
+// speak it (mail, contacts; `sdk/jmap`): the session resource, batched
+// method calls with back-references, and blob upload and download
+// (aduki-kt net/http/jmap.kt). JMAP ids are the REST hexes: an `Email` id is
+// a message hex, a `Mailbox` id a mailbox hex.
+import { rejection } from './envelope.js';
+import { AdukiError, ProtocolError } from './errors.js';
+import { url } from './http.js';
+export const CORE = 'urn:ietf:params:jmap:core';
+export const MAIL = 'urn:ietf:params:jmap:mail';
+export const SUBMISSION = 'urn:ietf:params:jmap:submission';
+/** Aduki body reading: `Email/get` takes `aduki:bodyMode` (ADK-MAIL-001 section 1.4, v47). */
+export const READING = 'urn:aduki:params:jmap:reading';
+/** Core and mail: enough for `Mailbox`, `Email` and `Thread`. */
+export const USING = Object.freeze([CORE, MAIL]);
+/**
+ * A JMAP method error (`["error", {type, description}, id]`) or a per-object
+ * refusal of a `/set` call (`notCreated`, `notUpdated`, `notDestroyed`).
+ * `type` is the JMAP error type (`invalidArguments`, `forbiddenFrom`,
+ * `notFound`, ...); `id` names the object for a per-object refusal.
+ */
+export class JmapError extends AdukiError {
+    constructor(method, error, id = '') {
+        const type = String(error?.type ?? 'serverFail');
+        const description = String(error?.description ?? '');
+        super(`${method} refused${id ? ` ${id}` : ''}: ${type}${description ? ` (${description})` : ''}`);
+        this.type = type;
+        this.description = description;
+        this.properties = Array.isArray(error?.properties) ? error.properties.map(String) : [];
+        this.method = method;
+        this.id = id;
+    }
+}
+export const ROOT = 'https://mail.aduki.pro';
+export class Jmap {
+    #session;
+    #root;
+    #audience;
+    #cached = null;
+    constructor(options) {
+        this.#session = options.session;
+        this.#root = (options.root ?? ROOT).replace(/\/+$/, '');
+        this.#audience = options.audience ?? 'mail';
+    }
+    /** Sends an authenticated request to the mail host (a path or an absolute URL). */
+    fetch(input, init) {
+        const target = /^https?:\/\//.test(input) ? input : url(this.#root, input.replace(/^\/+/, ''));
+        return this.#session.fetch(this.#audience, target, init);
+    }
+    /** The session (`GET /jmap/session`), fetched once; `refresh` fetches it again. */
+    session(refresh = false) {
+        if (!this.#cached || refresh) {
+            const pending = this.#load();
+            this.#cached = pending;
+            pending.catch(() => {
+                if (this.#cached === pending)
+                    this.#cached = null;
+            });
+        }
+        return this.#cached;
+    }
+    async #load() {
+        const data = await object(await this.fetch('jmap/session'), 'JMAP session');
+        const primary = data.primaryAccounts ?? {};
+        const account = String(primary[MAIL] ?? primary[CORE] ?? '');
+        if (!account)
+            throw new ProtocolError('JMAP session has no mail account');
+        const capabilities = data.capabilities && typeof data.capabilities === 'object' ? data.capabilities : {};
+        const field = (name) => {
+            const value = data[name];
+            if (typeof value !== 'string' || !value)
+                throw new ProtocolError(`JMAP session has no ${name}`);
+            return new URL(value, `${this.#root}/`).href.replace(/%7B/g, '{').replace(/%7D/g, '}');
+        };
+        return {
+            account,
+            api: field('apiUrl'),
+            upload: field('uploadUrl'),
+            download: field('downloadUrl'),
+            eventSource: typeof data.eventSourceUrl === 'string' ? field('eventSourceUrl') : '',
+            capabilities: Object.keys(capabilities),
+            limits: capabilities[CORE] && typeof capabilities[CORE] === 'object' ? { ...capabilities[CORE] } : {},
+            reading: READING in capabilities,
+        };
+    }
+    /** The primary mail account id. */
+    async account() {
+        return (await this.session()).account;
+    }
+    /**
+     * Runs `calls` in one request and returns every response in order
+     * (`[name, args, id]`). A method `error` response throws JmapError;
+     * per-object refusals (`notCreated`, ...) are left to the caller.
+     */
+    async call(calls, using = USING) {
+        const session = await this.session();
+        const body = JSON.stringify({ using: [...using], methodCalls: calls });
+        const response = await this.fetch(session.api, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body });
+        const data = await object(response, 'JMAP request');
+        if (!Array.isArray(data.methodResponses))
+            throw new ProtocolError('JMAP reply has no methodResponses');
+        return data.methodResponses.map((item, i) => {
+            if (!Array.isArray(item) || typeof item[0] !== 'string' || !item[1] || typeof item[1] !== 'object') {
+                throw new ProtocolError(`JMAP method response ${i} is malformed`);
+            }
+            const [name, args, id] = item;
+            if (name === 'error') {
+                const call = calls.find((c) => c[2] === id);
+                throw new JmapError(call?.[0] ?? 'JMAP', args);
+            }
+            return [name, args, String(id ?? '')];
+        });
+    }
+    /**
+     * Runs one method with `accountId` set and returns its arguments (the
+     * first response with the call id; implicit responses are dropped).
+     */
+    async method(name, args = {}, using = USING) {
+        const accountId = await this.account();
+        const replies = await this.call([[name, { accountId, ...args }, '0']], using);
+        const reply = replies.find((r) => r[2] === '0');
+        if (!reply)
+            throw new ProtocolError(`JMAP reply has no response to ${name}`);
+        return reply[1];
+    }
+    /** Uploads `data` as a blob of `type` (RFC 8620 section 6.1). */
+    async upload(data, type = 'application/octet-stream') {
+        const session = await this.session();
+        const target = session.upload.replace('{accountId}', encodeURIComponent(session.account));
+        const body = data instanceof Uint8Array ? new Uint8Array(data) : data;
+        const response = await this.fetch(target, { method: 'POST', headers: { 'Content-Type': type || 'application/octet-stream' }, body });
+        const out = await object(response, 'JMAP upload');
+        if (typeof out.blobId !== 'string' || !out.blobId)
+            throw new ProtocolError('JMAP upload answer has no blobId');
+        return { blob: out.blobId, type: String(out.type ?? type), size: Number(out.size) || 0 };
+    }
+    /**
+     * Downloads blob `blob` (RFC 8620 section 6.2). Returns the open response
+     * (read it with `blob()`, `arrayBuffer()` or `body`); a failure throws.
+     * `name` and `type` label the download (`Content-Disposition`, `Content-Type`).
+     */
+    async download(blob, options = {}) {
+        const session = await this.session();
+        const target = session.download
+            .replace('{accountId}', encodeURIComponent(session.account))
+            .replace('{blobId}', encodeURIComponent(blob))
+            .replace('{name}', encodeURIComponent(options.name || 'blob'))
+            .replace('{type}', encodeURIComponent(options.type || 'application/octet-stream'));
+        const response = await this.fetch(target);
+        if (!response.ok)
+            await refuse(response, 'JMAP download');
+        return response;
+    }
+}
+/** The JSON object of a 2xx answer; a failure throws (see refuse). */
+async function object(response, what) {
+    if (!response.ok)
+        await refuse(response, what);
+    const text = await response.text();
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new ProtocolError(`${what} answer is not JSON`);
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new ProtocolError(`${what} answer is not a JSON object`);
+    return value;
+}
+/**
+ * Throws for a non-2xx answer (`envelope.rejection`): 401 is
+ * UnauthorizedError, anything else a NetworkError (or a subclass) with the
+ * status and the kind of the envelope or the type of the RFC 7807 problem
+ * document JMAP uses for request-level errors.
+ */
+export async function refuse(response, what) {
+    const text = await response.text().catch(() => '');
+    throw rejection(response, text, what, { problem: true });
+}

package/dist/space/model.d.ts

@@ -0,0 +1,147 @@
+/** One page of a list: `next` is the cursor of the following page, null on the last. */
+export interface Page<T> {
+    items: T[];
+    next: string | null;
+}
+/** A success answer: the envelope's `data`, the HTTP status and the `ETag` (the row's version, without quotes). */
+export interface Reply<T> {
+    data: T;
+    status: number;
+    etag: string | null;
+}
+/** A task. The money fields are present only for members who may see them. */
+export interface Task {
+    id: string;
+    number: string;
+    title: string;
+    description: string | null;
+    priority: string;
+    status: string;
+    due: string | null;
+    client: {
+        id: string | null;
+        name: string | null;
+    } | null;
+    service: string | null;
+    team: string | null;
+    author: string | null;
+    assignees: unknown;
+    created: string;
+    updated: string;
+    archived: string | null;
+    billable?: boolean;
+    mode?: string | null;
+    rate?: number | null;
+    amount?: number | null;
+    minutes?: number;
+    currency?: string;
+    invoice?: string | null;
+    billed?: string | null;
+    [field: string]: unknown;
+}
+/** A check-in: work reported on a task, in minutes, waiting for review or reviewed. */
+export interface Checkin {
+    id: string;
+    task: string;
+    number: string;
+    account: string | null;
+    body: string;
+    minutes: number;
+    proof: string | null;
+    status: string;
+    reviewer: string | null;
+    note: string | null;
+    reviewed: string | null;
+    created: string;
+    [field: string]: unknown;
+}
+/** A support ticket. */
+export interface SupportTicket {
+    id: string;
+    number: string;
+    client: unknown;
+    contact: string | null;
+    assignee: string | null;
+    service: string | null;
+    node: string | null;
+    escalated: boolean;
+    task: unknown;
+    title: string;
+    status: string;
+    priority: string;
+    channel: string;
+    clock: string;
+    replied: string | null;
+    warned: string | null;
+    breached: string | null;
+    resolved: string | null;
+    closed: string | null;
+    created: string;
+    updated: string;
+    [field: string]: unknown;
+}
+/** A message of a ticket's thread; `id` is an integer (the thread is an append-only log); `internal` notes are staff only. */
+export interface Message {
+    id: number;
+    side: string;
+    author: string | null;
+    internal: boolean;
+    body: string;
+    created: string;
+    [field: string]: unknown;
+}
+/** A team of the workspace (from the Aduki ID directory). */
+export interface Team {
+    id: string;
+    name: string;
+    handle: string;
+    members: unknown;
+}
+/** A member of the workspace in the directory: name, handle and team ids. */
+export interface Member {
+    id: string;
+    name: string;
+    handle: string;
+    teams: string[];
+}
+/** An activity entry: the workspace's for `space.admin`, your own otherwise. */
+export interface Activity {
+    id: string;
+    /** who acted (hex); null for the system, or for a program of the workspace (then `kind` is `client`) */
+    account: string | null;
+    /** `client` when a program of the workspace acted (machine access); absent for a person or the system */
+    kind?: string;
+    entity: string;
+    action: string;
+    payload: unknown;
+    created: string;
+}
+/** The workspace settings (no secrets). */
+export interface Settings {
+    currency: string;
+    locale: string;
+    zone: string;
+    krapin: string | null;
+    /** hundredths of a percent */
+    vat: number;
+    brand: unknown;
+    prefixes: unknown;
+    cutoff: number;
+    keep: number;
+    desk: string | null;
+    smscountries: string[];
+    solo: boolean;
+    autopayroll: boolean;
+    caps: unknown;
+    updated: string;
+    [field: string]: unknown;
+}
+/** Search ids: read each by its own route. `source` is `typesense` or `postgres` (the fallback; `stale` if behind). */
+export interface Found {
+    items: {
+        collection: string;
+        id: string;
+    }[];
+    source: string;
+    stale: boolean;
+}

package/dist/store/blake3.d.ts

@@ -0,0 +1,4 @@
+/** The BLAKE3 hash (32 bytes) of `data`. */
+export declare function blake3(data: Uint8Array): Uint8Array;
+/** Lowercase hex of `bytes`. */
+export declare function hex(bytes: Uint8Array): string;