@agent-os-sdk/client 0.2.3 → 0.3.0

package/dist/client/AgentOsClient.d.ts

@@ -2,7 +2,10 @@
  * Agent OS SDK - Main Client
  *
  * Fully typed API client for Agent OS platform.
- * Supports both API Token (server) and JWT (browser) authentication.
+ *
+ * Two authentication modes:
+ * - API Token (server-to-server): aosk_* tokens with embedded claims
+ * - JWT (browser): Supabase JWT + X-Workspace-Id header
  *
  * @example
  * ```ts
@@ -17,14 +20,14 @@
  *   baseUrl: "https://api.agentos.io",
  *   auth: {
  *     type: "jwt",
- *     getToken: () => supabase.auth.getSession().then(s => s.data.session?.access_token),
- *     getWorkspaceId: () => localStorage.getItem("agentos.workspaceId")!
+ *     getToken: () => supabase.auth.getSession().then(s => s.data.session?.access_token ?? ""),
+ *     getWorkspaceId: () => localStorage.getItem("agentos.workspaceId") ?? ""
  *   }
  * });
  * ```
  */
 import { type RawClient } from "./raw.js";
-import { type AgentOsClientOptions, type AgentOsClientOptionsLegacy } from "./auth.js";
+import { type AgentOsClientOptions } from "./auth.js";
 import { AgentsModule } from "../modules/agents.js";
 import { RunsModule } from "../modules/runs.js";
 import { ThreadsModule } from "../modules/threads.js";
@@ -63,74 +66,41 @@ import { BudgetsModule } from "../modules/budgets.js";
 import { DeploymentsModule } from "../modules/deployments.js";
 import { IncidentsModule } from "../modules/incidents.js";
 import { ArtifactsModule } from "../modules/artifacts.js";
-export type { AgentOsClientOptions, AgentOsClientOptionsLegacy, AuthProvider } from "./auth.js";
-export { isApiTokenAuth, isJwtAuth, isNewAuthOptions } from "./auth.js";
+export type { AgentOsClientOptions, AuthProvider } from "./auth.js";
+export { isApiTokenAuth, isJwtAuth } from "./auth.js";
 export declare class AgentOsClient {
     private readonly _client;
     private readonly _baseUrl;
     private readonly _auth;
     private readonly _customHeaders;
-    private readonly _tenantId?;
-    private readonly _workspaceId?;
-    private readonly _token?;
-    private readonly _memberId?;
-    /** Agents API: CRUD, versions, graph */
     readonly agents: AgentsModule;
-    /** Runs API: create, stream, cancel, resume, replay */
     readonly runs: RunsModule;
-    /** Threads API: conversations, state, messages */
     readonly threads: ThreadsModule;
-    /** Tools API: definitions, registry */
     readonly tools: ToolsModule;
-    /** Knowledge API: vector stores, RAG */
     readonly knowledge: KnowledgeModule;
-    /** Triggers API: webhooks, crons */
     readonly triggers: TriggersModule;
-    /** Credentials API: BYOK secrets */
     readonly credentials: CredentialsModule;
-    /** Builder API: Meta-agent for AI-assisted agent creation */
     readonly builder: BuilderModule;
-    /** Members API: Tenant member management */
     readonly members: MembersModule;
-    /** Tenants API: Tenant settings */
     readonly tenants: TenantsModule;
-    /** Workspaces API: Workspace management */
     readonly workspaces: WorkspacesModule;
-    /** Prompts API: Prompt Hub CMS */
     readonly prompts: PromptsModule;
-    /** Traces API: OTEL observability */
     readonly traces: TracesModule;
-    /** Files API: S3 file storage */
     readonly files: FilesModule;
-    /** VectorStores API: pgvector semantic search */
     readonly vectorStores: VectorStoresModule;
-    /** Evaluation API: Datasets & experiments */
     readonly evaluation: EvaluationModule;
-    /** Checkpoints API: Time-travel debugging */
     readonly checkpoints: CheckpointsModule;
-    /** Playground API: Ephemeral sandbox */
     readonly playground: PlaygroundModule;
-    /** Crons API: Cron job scheduling */
     readonly crons: CronsModule;
-    /** DLQ API: Dead letter queue */
     readonly dlq: DlqModule;
-    /** Store API: Key-value storage */
     readonly store: StoreModule;
-    /** Audit API: Audit logs */
     readonly audit: AuditModule;
-    /** Usage API: Quotas and usage */
     readonly usage: UsageModule;
-    /** MCP API: Model Context Protocol */
     readonly mcp: McpModule;
-    /** A2A API: Agent-to-Agent protocol */
     readonly a2a: A2aModule;
-    /** Me API: Current user identity */
     readonly me: MeModule;
-    /** Info API: Server information */
     readonly info: InfoModule;
-    /** Metrics API: Prometheus metrics */
     readonly metrics: MetricsModule;
-    /** Graphs API: Validation and introspection */
     readonly graphs: GraphsModule;
     readonly handoff: HandoffModule;
     readonly flows: FlowsModule;
@@ -151,29 +121,25 @@ export declare class AgentOsClient {
         get: (agentId: string, versionId: string) => ReturnType<AgentsModule["getVersion"]>;
         create: (agentId: string, body: Parameters<AgentsModule["createVersion"]>[1]) => ReturnType<AgentsModule["createVersion"]>;
     };
-    constructor(options: AgentOsClientOptions | AgentOsClientOptionsLegacy);
+    constructor(options: AgentOsClientOptions);
     /**
-     * Validate auth configuration
+     * Validate auth configuration at construction time
      */
     private _validateAuth;
     /**
-     * Get headers for current request (sync version for modules)
+     * Resolve headers for each request (async)
+     *
+     * SECURITY INVARIANTS:
+     * - JWT: Authorization + X-Workspace-Id (REQUIRED), NO X-Tenant-Id
+     * - API Token: Authorization only, NO X-Workspace-Id, NO X-Tenant-Id
      */
-    private _getHeaders;
+    private _resolveHeaders;
     /**
-     * Get headers for current request (async version - resolves auth functions)
+     * Get resolved headers (for debugging/testing)
      */
     getHeadersAsync(): Promise<Record<string, string>>;
-    /**
-     * Get workspace ID synchronously (for modules that need it)
-     */
-    private _getWorkspaceIdSync;
-    /** Current tenant ID (legacy) */
-    get tenantId(): string;
-    /** Current workspace ID (legacy) */
-    get workspaceId(): string;
     /** Auth provider type */
-    get authType(): "api_token" | "jwt" | "legacy";
+    get authType(): "api_token" | "jwt";
     /** Raw HTTP client (use modules instead) */
     get raw(): RawClient;
 }

package/dist/client/AgentOsClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AgentOsClient.d.ts","sourceRoot":"","sources":["../../src/client/AgentOsClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EACH,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAOlC,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG1D,YAAY,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAExE,qBAAa,aAAa;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyB;IAGxD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IAGpC,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,oCAAoC;IACpC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,mCAAmC;IACnC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,2CAA2C;IAC3C,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAGtC,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6CAA6C;IAC7C,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,wCAAwC;IACxC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,4BAA4B;IAC5B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,sCAAsC;IACtC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAG9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAGpC,QAAQ,CAAC,WAAW,EAAE;QAClB,IAAI,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QAC1C,GAAG,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;QACvC,MAAM,EAAE,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;KAChD,CAAC;IAEF,QAAQ,CAAC,aAAa,EAAE;QACpB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;QACpE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QACpF,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC;KAC9H,CAAC;gBAEU,OAAO,EAAE,oBAAoB,GAAG,0BAA0B;IAmGtE;;OAEG;IACH,OAAO,CAAC,aAAa;IAarB;;OAEG;IACH,OAAO,CAAC,WAAW;IA0CnB;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAmDxD;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B,iCAAiC;IACjC,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,oCAAoC;IACpC,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,yBAAyB;IACzB,IAAI,QAAQ,IAAI,WAAW,GAAG,KAAK,GAAG,QAAQ,CAG7C;IAED,4CAA4C;IAC5C,IAAI,GAAG,IAAI,SAAS,CAEnB;CACJ"}
+{"version":3,"file":"AgentOsClient.d.ts","sourceRoot":"","sources":["../../src/client/AgentOsClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EACH,KAAK,oBAAoB,EAK5B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG1D,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtD,qBAAa,aAAa;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyB;IAGxD,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAGtC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAG9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAGpC,QAAQ,CAAC,WAAW,EAAE;QAClB,IAAI,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QAC1C,GAAG,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;QACvC,MAAM,EAAE,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;KAChD,CAAC;IAEF,QAAQ,CAAC,aAAa,EAAE;QACpB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;QACpE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QACpF,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC;KAC9H,CAAC;gBAEU,OAAO,EAAE,oBAAoB;IA6EzC;;OAEG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;;;OAMG;YACW,eAAe;IA2C7B;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAIxD,yBAAyB;IACzB,IAAI,QAAQ,IAAI,WAAW,GAAG,KAAK,CAElC;IAED,4CAA4C;IAC5C,IAAI,GAAG,IAAI,SAAS,CAEnB;CACJ"}

package/dist/client/AgentOsClient.js

@@ -2,7 +2,10 @@
  * Agent OS SDK - Main Client
  *
  * Fully typed API client for Agent OS platform.
- * Supports both API Token (server) and JWT (browser) authentication.
+ *
+ * Two authentication modes:
+ * - API Token (server-to-server): aosk_* tokens with embedded claims
+ * - JWT (browser): Supabase JWT + X-Workspace-Id header
  *
  * @example
  * ```ts
@@ -17,14 +20,14 @@
  *   baseUrl: "https://api.agentos.io",
  *   auth: {
  *     type: "jwt",
- *     getToken: () => supabase.auth.getSession().then(s => s.data.session?.access_token),
- *     getWorkspaceId: () => localStorage.getItem("agentos.workspaceId")!
+ *     getToken: () => supabase.auth.getSession().then(s => s.data.session?.access_token ?? ""),
+ *     getWorkspaceId: () => localStorage.getItem("agentos.workspaceId") ?? ""
  *   }
  * });
  * ```
  */
 import { createRawClient } from "./raw.js";
-import { isNewAuthOptions, isApiTokenAuth, isJwtAuth, isApiToken, isBrowser, } from "./auth.js";
+import { isApiTokenAuth, isJwtAuth, isBrowser, } from "./auth.js";
 import { AgentsModule } from "../modules/agents.js";
 import { RunsModule } from "../modules/runs.js";
 import { ThreadsModule } from "../modules/threads.js";
@@ -36,7 +39,7 @@ import { BuilderModule } from "../modules/builder.js";
 import { MembersModule } from "../modules/members.js";
 import { TenantsModule } from "../modules/tenants.js";
 import { WorkspacesModule } from "../modules/workspaces.js";
-// New modules
+// Platform modules
 import { PromptsModule } from "../modules/prompts.js";
 import { TracesModule } from "../modules/traces.js";
 import { FilesModule } from "../modules/files.js";
@@ -55,7 +58,7 @@ import { MeModule } from "../modules/me.js";
 import { InfoModule } from "../modules/info.js";
 import { MetricsModule } from "../modules/metrics.js";
 import { GraphsModule } from "../modules/graphs.js";
-// MOCK - Future modules (marked for replacement when backend is ready)
+// Future modules (mocked)
 import { HandoffModule } from "../modules/handoff.js";
 import { FlowsModule } from "../modules/flows.js";
 import { CapabilitiesModule } from "../modules/capabilities.js";
@@ -65,78 +68,44 @@ import { BudgetsModule } from "../modules/budgets.js";
 import { DeploymentsModule } from "../modules/deployments.js";
 import { IncidentsModule } from "../modules/incidents.js";
 import { ArtifactsModule } from "../modules/artifacts.js";
-export { isApiTokenAuth, isJwtAuth, isNewAuthOptions } from "./auth.js";
+export { isApiTokenAuth, isJwtAuth } from "./auth.js";
 export class AgentOsClient {
     _client;
     _baseUrl;
     _auth;
     _customHeaders;
-    // Legacy fields (for backwards compat)
-    _tenantId;
-    _workspaceId;
-    _token;
-    _memberId;
     // Core modules
-    /** Agents API: CRUD, versions, graph */
     agents;
-    /** Runs API: create, stream, cancel, resume, replay */
     runs;
-    /** Threads API: conversations, state, messages */
     threads;
-    /** Tools API: definitions, registry */
     tools;
-    /** Knowledge API: vector stores, RAG */
     knowledge;
-    /** Triggers API: webhooks, crons */
     triggers;
-    /** Credentials API: BYOK secrets */
     credentials;
-    /** Builder API: Meta-agent for AI-assisted agent creation */
     builder;
-    /** Members API: Tenant member management */
     members;
-    /** Tenants API: Tenant settings */
     tenants;
-    /** Workspaces API: Workspace management */
     workspaces;
-    // New modules
-    /** Prompts API: Prompt Hub CMS */
+    // Platform modules
     prompts;
-    /** Traces API: OTEL observability */
     traces;
-    /** Files API: S3 file storage */
     files;
-    /** VectorStores API: pgvector semantic search */
     vectorStores;
-    /** Evaluation API: Datasets & experiments */
     evaluation;
-    /** Checkpoints API: Time-travel debugging */
     checkpoints;
-    /** Playground API: Ephemeral sandbox */
     playground;
-    /** Crons API: Cron job scheduling */
     crons;
-    /** DLQ API: Dead letter queue */
     dlq;
-    /** Store API: Key-value storage */
     store;
-    /** Audit API: Audit logs */
     audit;
-    /** Usage API: Quotas and usage */
     usage;
-    /** MCP API: Model Context Protocol */
     mcp;
-    /** A2A API: Agent-to-Agent protocol */
     a2a;
-    /** Me API: Current user identity */
     me;
-    /** Info API: Server information */
     info;
-    /** Metrics API: Prometheus metrics */
     metrics;
-    /** Graphs API: Validation and introspection */
     graphs;
-    // MOCK - Future modules
+    // Future modules (mocked)
     handoff;
     flows;
     capabilities;
@@ -146,45 +115,24 @@ export class AgentOsClient {
     deployments;
     incidents;
     artifacts;
-    // Convenience Aliases
+    // Convenience aliases
     experiments;
     agentVersions;
     constructor(options) {
         this._baseUrl = options.baseUrl;
+        this._auth = options.auth;
         this._customHeaders = options.headers ?? {};
-        // Detect auth mode
-        if (isNewAuthOptions(options)) {
-            // New auth provider mode
-            this._auth = options.auth;
-            this._validateAuth(options);
-        }
-        else {
-            // Legacy mode - convert to new auth if possible
-            this._tenantId = options.tenantId;
-            this._workspaceId = options.workspaceId;
-            this._token = options.token;
-            this._memberId = options.memberId;
-            // Attempt to detect auth type from token
-            if (options.token && isApiToken(options.token)) {
-                // Token looks like API token - use as api_token
-                this._auth = { type: "api_token", apiKey: options.token };
-                console.warn("[AgentOS SDK] Using legacy options with API token. " +
-                    "Consider migrating to: new AgentOsClient({ auth: { type: 'api_token', apiKey: '...' } })");
-            }
-            else {
-                // Legacy JWT mode - keep using headers
-                this._auth = null;
-            }
-        }
-        // Create raw HTTP client
+        // Validate auth configuration
+        this._validateAuth(options);
+        // Create raw client with async header provider
         this._client = createRawClient({
             baseUrl: options.baseUrl,
-            headers: {}, // Headers resolved dynamically
+            headerProvider: () => this._resolveHeaders(),
         });
-        // Bound header getter
-        const getHeaders = () => this._getHeaders();
-        const getWorkspaceId = () => this._getWorkspaceIdSync();
-        const getTenantId = () => this._tenantId ?? "";
+        // Module header getter (sync fallback for backwards compat with module internals)
+        const getHeaders = () => this._customHeaders;
+        const getWorkspaceId = () => "";
+        const getTenantId = () => "";
         // Initialize core modules
         this.agents = new AgentsModule(this._client, getHeaders);
         this.runs = new RunsModule(this._client, this._baseUrl, getHeaders);
@@ -197,7 +145,7 @@ export class AgentOsClient {
         this.members = new MembersModule(this._client, getHeaders);
         this.tenants = new TenantsModule(this._client, getHeaders);
         this.workspaces = new WorkspacesModule(this._client, getTenantId, getHeaders);
-        // Initialize new modules
+        // Initialize platform modules
         this.prompts = new PromptsModule(this._client, getHeaders);
         this.traces = new TracesModule(this._client, getHeaders);
         this.files = new FilesModule(this._client, getHeaders);
@@ -216,7 +164,7 @@ export class AgentOsClient {
         this.info = new InfoModule(this._client, getHeaders);
         this.metrics = new MetricsModule(this._baseUrl, getHeaders);
         this.graphs = new GraphsModule(this._client, getHeaders);
-        // MOCK - Initialize future modules
+        // Initialize future modules (mocked)
         this.handoff = new HandoffModule(this._client, getHeaders);
         this.flows = new FlowsModule(this._client, getHeaders);
         this.capabilities = new CapabilitiesModule(this._client, getHeaders);
@@ -239,130 +187,66 @@ export class AgentOsClient {
         };
     }
     /**
-     * Validate auth configuration
+     * Validate auth configuration at construction time
      */
     _validateAuth(options) {
         const { auth, allowApiTokenInBrowser } = options;
-        // Browser guard for API tokens
+        // Browser security guard for API tokens
         if (isApiTokenAuth(auth) && isBrowser() && !allowApiTokenInBrowser) {
-            throw new Error("[AgentOS SDK] API tokens should not be used in the browser. " +
-                "They may be exposed in network requests. " +
-                "Use JWT auth for browser clients, or set allowApiTokenInBrowser: true if you understand the risks.");
-        }
-    }
-    /**
-     * Get headers for current request (sync version for modules)
-     */
-    _getHeaders() {
-        const headers = {
-            "Content-Type": "application/json",
-            ...this._customHeaders,
-        };
-        if (this._auth) {
-            // New auth mode
-            if (isApiTokenAuth(this._auth)) {
-                // API Token: Only Authorization header
-                const apiKey = typeof this._auth.apiKey === "function"
-                    ? "" // Will be resolved async
-                    : this._auth.apiKey;
-                if (apiKey) {
-                    headers["Authorization"] = `Bearer ${apiKey}`;
-                }
-                // NO X-Tenant-Id, NO X-Workspace-Id (backend resolves from claims)
-            }
-            else if (isJwtAuth(this._auth)) {
-                // JWT: Authorization + X-Workspace-Id
-                // Note: For sync header getter, we use empty strings as placeholders
-                // The actual values are resolved in _getHeadersAsync
-                // This is a limitation of the current module architecture
-            }
+            throw new Error("[AgentOS SDK] SECURITY: API tokens (aosk_*) are SERVER-SIDE only. " +
+                "Use JWT auth in the browser. Set allowApiTokenInBrowser: true only if you understand the risks.");
         }
-        else {
-            // Legacy mode - use stored values
-            if (this._token) {
-                headers["Authorization"] = `Bearer ${this._token}`;
-            }
-            if (this._tenantId) {
-                headers["X-Tenant-Id"] = this._tenantId;
-            }
-            if (this._workspaceId) {
-                headers["X-Workspace-Id"] = this._workspaceId;
-            }
-            if (this._memberId) {
-                headers["X-Member-Id"] = this._memberId;
-            }
-        }
-        return headers;
     }
     /**
-     * Get headers for current request (async version - resolves auth functions)
+     * Resolve headers for each request (async)
+     *
+     * SECURITY INVARIANTS:
+     * - JWT: Authorization + X-Workspace-Id (REQUIRED), NO X-Tenant-Id
+     * - API Token: Authorization only, NO X-Workspace-Id, NO X-Tenant-Id
      */
-    async getHeadersAsync() {
+    async _resolveHeaders() {
         const headers = {
             "Content-Type": "application/json",
             ...this._customHeaders,
         };
-        if (this._auth) {
-            if (isApiTokenAuth(this._auth)) {
-                // API Token
-                const apiKey = typeof this._auth.apiKey === "function"
-                    ? await this._auth.apiKey()
-                    : this._auth.apiKey;
+        if (isApiTokenAuth(this._auth)) {
+            // API Token: Authorization header only
+            const apiKey = typeof this._auth.apiKey === "function"
+                ? await this._auth.apiKey()
+                : this._auth.apiKey;
+            if (apiKey) {
                 headers["Authorization"] = `Bearer ${apiKey}`;
-                // NO X-Tenant-Id, NO X-Workspace-Id
-            }
-            else if (isJwtAuth(this._auth)) {
-                // JWT
-                const [token, workspaceId] = await Promise.all([
-                    this._auth.getToken(),
-                    this._auth.getWorkspaceId(),
-                ]);
-                if (!token) {
-                    throw new Error("[AgentOS SDK] JWT token not available. User may not be authenticated.");
-                }
-                if (!workspaceId) {
-                    throw new Error("[AgentOS SDK] Workspace ID not available. Please select a workspace first.");
-                }
-                headers["Authorization"] = `Bearer ${token}`;
-                headers["X-Workspace-Id"] = workspaceId;
-                // NO X-Tenant-Id (backend derives from workspace membership)
             }
+            // NO X-Workspace-Id (embedded in token claims)
+            // NO X-Tenant-Id (embedded in token claims)
         }
-        else {
-            // Legacy mode
-            if (this._token) {
-                headers["Authorization"] = `Bearer ${this._token}`;
-            }
-            if (this._tenantId) {
-                headers["X-Tenant-Id"] = this._tenantId;
-            }
-            if (this._workspaceId) {
-                headers["X-Workspace-Id"] = this._workspaceId;
+        else if (isJwtAuth(this._auth)) {
+            // JWT: Authorization + X-Workspace-Id
+            const [token, workspaceId] = await Promise.all([
+                Promise.resolve(this._auth.getToken()),
+                Promise.resolve(this._auth.getWorkspaceId()),
+            ]);
+            if (token) {
+                headers["Authorization"] = `Bearer ${token}`;
             }
-            if (this._memberId) {
-                headers["X-Member-Id"] = this._memberId;
+            // CRITICAL: Workspace ID is REQUIRED for JWT auth
+            if (!workspaceId) {
+                throw new Error("[AgentOS SDK] No active workspace selected. " +
+                    "Call getWorkspaceId() must return a valid workspace ID.");
             }
+            headers["X-Workspace-Id"] = workspaceId;
+            // NO X-Tenant-Id (backend derives from workspace membership)
         }
         return headers;
     }
     /**
-     * Get workspace ID synchronously (for modules that need it)
+     * Get resolved headers (for debugging/testing)
      */
-    _getWorkspaceIdSync() {
-        return this._workspaceId ?? "";
-    }
-    /** Current tenant ID (legacy) */
-    get tenantId() {
-        return this._tenantId ?? "";
-    }
-    /** Current workspace ID (legacy) */
-    get workspaceId() {
-        return this._workspaceId ?? "";
+    async getHeadersAsync() {
+        return this._resolveHeaders();
     }
     /** Auth provider type */
     get authType() {
-        if (!this._auth)
-            return "legacy";
         return this._auth.type;
     }
     /** Raw HTTP client (use modules instead) */

package/dist/client/auth.d.ts

@@ -1,14 +1,17 @@
 /**
  * Auth Provider Types for Agent OS SDK
  *
- * Supports two modes:
- * - JWT (browser): Uses Supabase JWT + workspace header
+ * Two modes only:
+ * - JWT (browser): Uses Supabase JWT + X-Workspace-Id header
  * - API Token (server): Uses aosk_* token with embedded claims
  */
 /**
  * API Token authentication for server-to-server integrations.
  * Token format: aosk_live_* or aosk_test_*
  *
+ * SECURITY: API tokens contain embedded workspace/tenant claims.
+ * The SDK sends ONLY Authorization header (no X-Workspace-Id, no X-Tenant-Id).
+ *
  * @example
  * ```ts
  * const client = new AgentOsClient({
@@ -24,7 +27,11 @@ export type ApiTokenAuth = {
 };
 /**
  * JWT authentication for browser/frontend clients.
- * Uses Supabase JWT with workspace header.
+ * Uses Supabase JWT with X-Workspace-Id header.
+ *
+ * SECURITY:
+ * - X-Workspace-Id is REQUIRED (throws if missing)
+ * - X-Tenant-Id is NEVER sent (backend derives from workspace membership)
  *
  * @example
  * ```ts
@@ -42,49 +49,30 @@ export type JwtAuth = {
     type: "jwt";
     /** Function to get the JWT access token */
     getToken: () => string | Promise<string>;
-    /** Function to get the current workspace ID */
+    /** Function to get the current workspace ID (REQUIRED) */
     getWorkspaceId: () => string | Promise<string>;
 };
 /**
- * Auth provider union type
+ * Auth provider union type - only two modes supported
  */
 export type AuthProvider = ApiTokenAuth | JwtAuth;
 /**
- * New auth-aware options for AgentOsClient
+ * Options for AgentOsClient - auth is REQUIRED
  */
 export type AgentOsClientOptions = {
     /** Base URL of the Agent OS Control Plane */
     baseUrl: string;
-    /** Authentication provider */
+    /** Authentication provider (REQUIRED) */
     auth: AuthProvider;
     /**
      * Allow API token in browser environment.
      * Default: false (throws error to prevent accidental exposure)
+     * Only set to true if you understand the security implications.
      */
     allowApiTokenInBrowser?: boolean;
     /** Custom headers to add to all requests */
     headers?: Record<string, string>;
 };
-/**
- * Legacy options (backwards compatibility)
- * @deprecated Use AgentOsClientOptions with auth provider instead
- */
-export type AgentOsClientOptionsLegacy = {
-    /** Base URL of the Agent OS API */
-    baseUrl: string;
-    /** Tenant ID @deprecated */
-    tenantId: string;
-    /** Workspace ID @deprecated */
-    workspaceId: string;
-    /** Auth token @deprecated */
-    token?: string;
-    /** Member ID @deprecated */
-    memberId?: string;
-    /** Custom headers */
-    headers?: Record<string, string>;
-};
-export declare function isNewAuthOptions(opts: AgentOsClientOptions | AgentOsClientOptionsLegacy): opts is AgentOsClientOptions;
-export declare function isLegacyOptions(opts: AgentOsClientOptions | AgentOsClientOptionsLegacy): opts is AgentOsClientOptionsLegacy;
 export declare function isApiTokenAuth(auth: AuthProvider): auth is ApiTokenAuth;
 export declare function isJwtAuth(auth: AuthProvider): auth is JwtAuth;
 /**

package/dist/client/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/client/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,YAAY,GAAG;IACvB,IAAI,EAAE,WAAW,CAAA;IACjB,oDAAoD;IACpD,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;CACpD,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,OAAO,GAAG;IAClB,IAAI,EAAE,KAAK,CAAA;IACX,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,+CAA+C;IAC/C,cAAc,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACjD,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,OAAO,CAAA;AAMjD;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,IAAI,EAAE,YAAY,CAAA;IAClB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACnC,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACrC,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,6BAA6B;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qBAAqB;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACnC,CAAA;AAMD,wBAAgB,gBAAgB,CAC5B,IAAI,EAAE,oBAAoB,GAAG,0BAA0B,GACxD,IAAI,IAAI,oBAAoB,CAE9B;AAED,wBAAgB,eAAe,CAC3B,IAAI,EAAE,oBAAoB,GAAG,0BAA0B,GACxD,IAAI,IAAI,0BAA0B,CAEpC;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,IAAI,YAAY,CAEvE;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,IAAI,OAAO,CAE7D;AAMD;;GAEG;AACH,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGjD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/client/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG;IACvB,IAAI,EAAE,WAAW,CAAA;IACjB,oDAAoD;IACpD,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;CACpD,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,OAAO,GAAG;IAClB,IAAI,EAAE,KAAK,CAAA;IACX,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,0DAA0D;IAC1D,cAAc,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACjD,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,OAAO,CAAA;AAMjD;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAA;IACf,yCAAyC;IACzC,IAAI,EAAE,YAAY,CAAA;IAClB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACnC,CAAA;AAMD,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,IAAI,YAAY,CAEvE;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,IAAI,OAAO,CAE7D;AAMD;;GAEG;AACH,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGjD"}

package/dist/client/auth.js

@@ -1,19 +1,13 @@
 /**
  * Auth Provider Types for Agent OS SDK
  *
- * Supports two modes:
- * - JWT (browser): Uses Supabase JWT + workspace header
+ * Two modes only:
+ * - JWT (browser): Uses Supabase JWT + X-Workspace-Id header
  * - API Token (server): Uses aosk_* token with embedded claims
  */
 // ============================================================================
 // Type Guards
 // ============================================================================
-export function isNewAuthOptions(opts) {
-    return "auth" in opts && opts.auth !== undefined;
-}
-export function isLegacyOptions(opts) {
-    return "tenantId" in opts || "workspaceId" in opts;
-}
 export function isApiTokenAuth(auth) {
     return auth.type === "api_token";
 }

package/dist/client/raw.d.ts

@@ -10,6 +10,7 @@ export type { paths, components };
 export type ClientOptions = {
     baseUrl: string;
     headers?: Record<string, string>;
+    headerProvider?: () => Promise<Record<string, string>>;
 };
 /**
  * Standard API response wrapper.