@agentforge-io/sdk-console 0.0.0-stage → 0.1.0

package/dist/http.js

@@ -0,0 +1,288 @@
+"use strict";
+// HTTP core: injectable fetch, bearer auth from a TokenStore, single-flight
+// refresh on 401 + retry once, typed errors. Runs unchanged in React Native,
+// browsers and Node: only `fetch`, `AbortController` and `setTimeout` are used
+// (no Buffer / crypto / fs, and no URLSearchParams: RN's polyfill lacks most methods).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpCore = void 0;
+exports.buildQuery = buildQuery;
+exports.seg = seg;
+const errors_1 = require("./errors");
+const DEFAULT_TIMEOUT_MS = 30000;
+/** Join a query object: skips null/undefined, arrays become `a,b`. */
+function buildQuery(query) {
+    if (!query)
+        return '';
+    // Hand-built (no URLSearchParams): React Native's polyfill lacks set/get/append.
+    const parts = [];
+    for (const [key, value] of Object.entries(query)) {
+        if (value === undefined || value === null)
+            continue;
+        let str;
+        if (Array.isArray(value)) {
+            if (!value.length)
+                continue;
+            str = value.join(',');
+        }
+        else {
+            str = String(value);
+        }
+        parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(str)}`);
+    }
+    return parts.length ? `?${parts.join('&')}` : '';
+}
+function seg(value) {
+    return encodeURIComponent(value);
+}
+class HttpCore {
+    constructor(opts) {
+        this.refreshing = null;
+        this.signingOut = null;
+        /** Bumped whenever the session is replaced or wiped; a refresh that started under an older epoch is stale. */
+        this.epoch = 0;
+        if (!opts.baseURL)
+            throw new Error('baseURL is required');
+        if (!opts.tokenStore)
+            throw new Error('tokenStore is required');
+        this.opts = opts;
+        this.baseURL = opts.baseURL.replace(/\/+$/, '');
+        this.store = opts.tokenStore;
+    }
+    /** Authenticated (or `auth: false`) JSON request. Resolves `undefined` on 204 / empty body. */
+    async request(method, path, options = {}) {
+        return this.send(method, path, options, false, 0);
+    }
+    /** Persist a session obtained from login / register / invite accept. */
+    async setSession(tokens) {
+        this.epoch++;
+        await this.store.setTokens({ accessToken: tokens.accessToken, refreshToken: tokens.refreshToken });
+    }
+    /** Invalidate any in-flight refresh without touching the store (call before
+     *  an auth call that will replace or wipe the session). */
+    beginSessionChange() {
+        this.epoch++;
+    }
+    /** Wipe the session without firing `onSignedOut` (explicit logout). */
+    async clearSession() {
+        this.epoch++;
+        await this.store.clear();
+    }
+    /** Force a refresh now (shares the in-flight one). Throws if it does not succeed. */
+    async refreshNow() {
+        const result = await this.refreshSingleFlight();
+        if (result.outcome === 'ok')
+            return result.tokens;
+        if (result.outcome === 'rejected')
+            await this.signOut('refresh_rejected');
+        if (result.outcome === 'stale') {
+            // A newer session (or a sign-out) won: hand back the live pair if there is one.
+            const accessToken = await this.store.getAccessToken();
+            const refreshToken = await this.store.getRefreshToken();
+            if (accessToken && refreshToken)
+                return { accessToken, refreshToken };
+        }
+        throw result.error;
+    }
+    // ─── internals ──────────────────────────────────────────────────────────
+    async send(method, path, options, retriedAuth, rateLimitAttempt) {
+        const authed = options.auth !== false;
+        const tokenAtSend = authed ? await this.store.getAccessToken() : null;
+        const res = await this.rawFetch(method, path, options, tokenAtSend);
+        const maxRetries = this.opts.maxRateLimitRetries ?? 2;
+        if (res.status === 429 && method === 'GET' && rateLimitAttempt < maxRetries) {
+            const header = res.headers.get('retry-after');
+            const seconds = header ? parseInt(header, 10) : NaN;
+            // Clamp so a misconfigured upstream cannot park the UI for minutes.
+            const waitMs = Number.isFinite(seconds)
+                ? Math.min(Math.max(seconds * 1000, 500), 10000)
+                : 800 * Math.pow(3, rateLimitAttempt);
+            await (this.opts.sleep ?? defaultSleep)(waitMs);
+            return this.send(method, path, options, retriedAuth, rateLimitAttempt + 1);
+        }
+        if (res.status === 401 && authed && !retriedAuth) {
+            if (await this.recoverFrom401(tokenAtSend)) {
+                return this.send(method, path, options, true, rateLimitAttempt);
+            }
+        }
+        if (res.status === 204)
+            return undefined;
+        const text = res.text;
+        if (!res.ok)
+            throw (0, errors_1.errorFromResponse)(res.status, res.statusText, text);
+        if (!text)
+            return undefined;
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw new errors_1.ApiError({ status: res.status, message: 'Invalid JSON in response', details: text });
+        }
+    }
+    /** @returns true when the request should be replayed once. */
+    async recoverFrom401(tokenAtSend) {
+        // The session was replaced while this request was in flight (a new
+        // sign-in, or another call already refreshed): replay under the new one.
+        const current = await this.store.getAccessToken();
+        if (current && current !== tokenAtSend)
+            return true;
+        const refreshToken = await this.store.getRefreshToken();
+        // Never signed in: a plain 401, nothing to tear down.
+        if (!tokenAtSend && !refreshToken)
+            return false;
+        const result = await this.refreshSingleFlight();
+        if (result.outcome === 'ok')
+            return true;
+        if (result.outcome === 'unavailable')
+            return false; // keep the session; surface the 401
+        if (result.outcome === 'stale') {
+            // Signed out meanwhile: no replay. Replace by a new sign-in: replay under it.
+            const live = await this.store.getAccessToken();
+            return !!live && live !== tokenAtSend;
+        }
+        // Rejected: lose the race gracefully if a newer sign-in landed meanwhile.
+        const latest = await this.store.getAccessToken();
+        if (latest && latest !== tokenAtSend)
+            return true;
+        await this.signOut(refreshToken ? 'refresh_rejected' : 'no_refresh_token');
+        return false;
+    }
+    /** Idempotent: waiters of the same failed refresh all land here, but only
+     *  one tears the session down and fires the callback. */
+    signOut(reason) {
+        if (this.signingOut)
+            return this.signingOut;
+        const run = (async () => {
+            const hadSession = !!((await this.store.getAccessToken()) || (await this.store.getRefreshToken()));
+            await this.store.clear();
+            if (hadSession)
+                this.opts.onSignedOut?.(reason);
+        })().finally(() => {
+            this.signingOut = null;
+        });
+        this.signingOut = run;
+        return run;
+    }
+    /** One /auth/refresh at a time: a burst of 401s awaits the same promise.
+     *  The refresh token rotates on use, so a second concurrent call would be
+     *  read as token reuse by the server and revoke the family. */
+    refreshSingleFlight() {
+        if (this.refreshing)
+            return this.refreshing;
+        const promise = this.doRefresh().finally(() => {
+            this.refreshing = null;
+        });
+        this.refreshing = promise;
+        return promise;
+    }
+    async doRefresh() {
+        const refreshToken = await this.store.getRefreshToken();
+        if (!refreshToken) {
+            return {
+                outcome: 'rejected',
+                error: new errors_1.ApiError({ status: 401, message: 'No refresh token', code: 'no_refresh_token' }),
+            };
+        }
+        const epoch = this.epoch;
+        const stale = () => ({
+            outcome: 'stale',
+            error: new errors_1.ApiError({ status: 401, message: 'Session changed during refresh', code: 'session_changed' }),
+        });
+        let res;
+        try {
+            res = await this.rawFetch('POST', '/auth/refresh', { body: { refreshToken } }, null);
+        }
+        catch (err) {
+            // Offline / timeout: the session may still be fine. Do not sign out.
+            return this.epoch !== epoch ? stale() : { outcome: 'unavailable', error: err };
+        }
+        if (this.epoch !== epoch)
+            return stale();
+        const text = res.text;
+        if (!res.ok) {
+            const error = (0, errors_1.errorFromResponse)(res.status, res.statusText, text);
+            // Only an explicit rejection of the token ends the session. 404/408/410/
+            // other 4xx (proxy, tunnel, deploy gaps), 429, 5xx: unavailable.
+            const rejected = res.status === 400 || res.status === 401 || res.status === 403;
+            return { outcome: rejected ? 'rejected' : 'unavailable', error };
+        }
+        let parsed;
+        try {
+            parsed = text ? JSON.parse(text) : undefined;
+        }
+        catch {
+            parsed = undefined;
+        }
+        if (!parsed?.accessToken || !parsed.refreshToken) {
+            return {
+                outcome: 'unavailable',
+                error: new errors_1.ApiError({ status: res.status, message: 'Malformed refresh response' }),
+            };
+        }
+        const tokens = { accessToken: parsed.accessToken, refreshToken: parsed.refreshToken };
+        if (this.epoch !== epoch)
+            return stale();
+        await this.store.setTokens(tokens);
+        return { outcome: 'ok', tokens };
+    }
+    async rawFetch(method, path, options, accessToken) {
+        const fetchImpl = this.opts.fetch ?? globalThis.fetch;
+        if (!fetchImpl)
+            throw new Error('No fetch available: pass `fetch` in the client options');
+        const headers = { Accept: 'application/json', ...this.opts.defaultHeaders };
+        if (options.body !== undefined)
+            headers['Content-Type'] = 'application/json';
+        if (accessToken)
+            headers.Authorization = `Bearer ${accessToken}`;
+        Object.assign(headers, options.headers);
+        const timeoutMs = this.opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const controller = timeoutMs > 0 && typeof AbortController !== 'undefined' ? new AbortController() : undefined;
+        const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : undefined;
+        try {
+            const res = await fetchImpl(`${this.baseURL}${path}${buildQuery(options.query)}`, {
+                method,
+                headers,
+                body: options.body === undefined ? undefined : JSON.stringify(options.body),
+                signal: controller?.signal,
+            });
+            // The deadline also covers the body: a stalled stream must not hang forever.
+            const text = res.status === 204 ? '' : await readBody(res, controller?.signal);
+            return { status: res.status, statusText: res.statusText, ok: res.ok, headers: res.headers, text };
+        }
+        catch (err) {
+            const aborted = controller?.signal.aborted === true;
+            throw new errors_1.ApiError({
+                status: 0,
+                code: aborted ? 'timeout' : 'network_error',
+                message: aborted ? `Request timed out after ${timeoutMs}ms` : err instanceof Error ? err.message : 'Network request failed',
+                cause: err,
+            });
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+}
+exports.HttpCore = HttpCore;
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Read the body, rejecting if `signal` aborts first (RN / mocks may not tie the stream to the signal). */
+function readBody(res, signal) {
+    const read = res.text().catch(() => '');
+    if (!signal)
+        return read;
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(new Error('aborted'));
+        if (signal.aborted)
+            return onAbort();
+        signal.addEventListener('abort', onAbort, { once: true });
+        read.then((t) => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(t);
+        }, (e) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(e);
+        });
+    });
+}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+export { ConsoleClient, TenantScope } from './client';
+export { ApiError, isApiError } from './errors';
+export { MemoryTokenStore } from './token-store';
+export type { AuthTokens, MaybePromise, TokenStore } from './token-store';
+export type { ConsoleClientOptions, FetchLike, QueryValue, RequestOptions, SignedOutReason } from './http';
+export * from './types';
+export { AgentsResource, ChatTokensResource } from './resources/agents';
+export { AppsResource } from './resources/apps';
+export { AuthResource } from './resources/auth';
+export { ConnectorsResource } from './resources/connectors';
+export { InvitesResource, MembersResource, PublicInvitesResource } from './resources/members';
+export { MarketplaceResource } from './resources/marketplace';
+export { PlaygroundResource } from './resources/playground';
+export { TeamHumanMembersResource, TeamsResource } from './resources/teams';
+export { TemplatesResource, TenantTemplatesResource } from './resources/templates';
+export { TenantsResource } from './resources/tenants';
+export { ToolsResource } from './resources/tools';
+export { VariablesResource } from './resources/variables';

package/dist/index.js

@@ -0,0 +1,55 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VariablesResource = exports.ToolsResource = exports.TenantsResource = exports.TenantTemplatesResource = exports.TemplatesResource = exports.TeamsResource = exports.TeamHumanMembersResource = exports.PlaygroundResource = exports.MarketplaceResource = exports.PublicInvitesResource = exports.MembersResource = exports.InvitesResource = exports.ConnectorsResource = exports.AuthResource = exports.AppsResource = exports.ChatTokensResource = exports.AgentsResource = exports.MemoryTokenStore = exports.isApiError = exports.ApiError = exports.TenantScope = exports.ConsoleClient = void 0;
+var client_1 = require("./client");
+Object.defineProperty(exports, "ConsoleClient", { enumerable: true, get: function () { return client_1.ConsoleClient; } });
+Object.defineProperty(exports, "TenantScope", { enumerable: true, get: function () { return client_1.TenantScope; } });
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "ApiError", { enumerable: true, get: function () { return errors_1.ApiError; } });
+Object.defineProperty(exports, "isApiError", { enumerable: true, get: function () { return errors_1.isApiError; } });
+var token_store_1 = require("./token-store");
+Object.defineProperty(exports, "MemoryTokenStore", { enumerable: true, get: function () { return token_store_1.MemoryTokenStore; } });
+__exportStar(require("./types"), exports);
+var agents_1 = require("./resources/agents");
+Object.defineProperty(exports, "AgentsResource", { enumerable: true, get: function () { return agents_1.AgentsResource; } });
+Object.defineProperty(exports, "ChatTokensResource", { enumerable: true, get: function () { return agents_1.ChatTokensResource; } });
+var apps_1 = require("./resources/apps");
+Object.defineProperty(exports, "AppsResource", { enumerable: true, get: function () { return apps_1.AppsResource; } });
+var auth_1 = require("./resources/auth");
+Object.defineProperty(exports, "AuthResource", { enumerable: true, get: function () { return auth_1.AuthResource; } });
+var connectors_1 = require("./resources/connectors");
+Object.defineProperty(exports, "ConnectorsResource", { enumerable: true, get: function () { return connectors_1.ConnectorsResource; } });
+var members_1 = require("./resources/members");
+Object.defineProperty(exports, "InvitesResource", { enumerable: true, get: function () { return members_1.InvitesResource; } });
+Object.defineProperty(exports, "MembersResource", { enumerable: true, get: function () { return members_1.MembersResource; } });
+Object.defineProperty(exports, "PublicInvitesResource", { enumerable: true, get: function () { return members_1.PublicInvitesResource; } });
+var marketplace_1 = require("./resources/marketplace");
+Object.defineProperty(exports, "MarketplaceResource", { enumerable: true, get: function () { return marketplace_1.MarketplaceResource; } });
+var playground_1 = require("./resources/playground");
+Object.defineProperty(exports, "PlaygroundResource", { enumerable: true, get: function () { return playground_1.PlaygroundResource; } });
+var teams_1 = require("./resources/teams");
+Object.defineProperty(exports, "TeamHumanMembersResource", { enumerable: true, get: function () { return teams_1.TeamHumanMembersResource; } });
+Object.defineProperty(exports, "TeamsResource", { enumerable: true, get: function () { return teams_1.TeamsResource; } });
+var templates_1 = require("./resources/templates");
+Object.defineProperty(exports, "TemplatesResource", { enumerable: true, get: function () { return templates_1.TemplatesResource; } });
+Object.defineProperty(exports, "TenantTemplatesResource", { enumerable: true, get: function () { return templates_1.TenantTemplatesResource; } });
+var tenants_1 = require("./resources/tenants");
+Object.defineProperty(exports, "TenantsResource", { enumerable: true, get: function () { return tenants_1.TenantsResource; } });
+var tools_1 = require("./resources/tools");
+Object.defineProperty(exports, "ToolsResource", { enumerable: true, get: function () { return tools_1.ToolsResource; } });
+var variables_1 = require("./resources/variables");
+Object.defineProperty(exports, "VariablesResource", { enumerable: true, get: function () { return variables_1.VariablesResource; } });

package/dist/resources/agents.d.ts

@@ -0,0 +1,40 @@
+import type { HttpCore } from '../http';
+import type { Agent, AgentInput, AgentList, AgentParentTeam, ChatToken, ChatTokenInput, ListAgentsInput } from '../types';
+export declare class AgentsResource {
+    private readonly http;
+    private readonly tenantId;
+    /** Public chat-widget tokens of an agent. */
+    readonly chatTokens: ChatTokensResource;
+    constructor(http: HttpCore, tenantId: string);
+    private get base();
+    /** `GET /admin/tenants/:tenantId/agents` */
+    list(input?: ListAgentsInput): Promise<AgentList>;
+    /** `POST .../agents` */
+    create(input: AgentInput): Promise<Agent>;
+    /** `GET .../agents/:agentId` */
+    get(agentId: string): Promise<Agent>;
+    /** `PATCH .../agents/:agentId` */
+    update(agentId: string, patch: Partial<AgentInput>): Promise<Agent>;
+    /** `DELETE .../agents/:agentId` (deactivates). */
+    delete(agentId: string): Promise<void>;
+    /** `GET .../agents/:agentId/parent-team` */
+    parentTeam(agentId: string): Promise<AgentParentTeam>;
+}
+export declare class ChatTokensResource {
+    private readonly http;
+    private readonly tenantId;
+    constructor(http: HttpCore, tenantId: string);
+    private base;
+    /** `GET .../agents/:agentId/chat-tokens` */
+    list(agentId: string): Promise<{
+        items: ChatToken[];
+    }>;
+    /** `POST .../agents/:agentId/chat-tokens` */
+    create(agentId: string, input: ChatTokenInput): Promise<ChatToken>;
+    /** `PATCH .../chat-tokens/:token` */
+    update(agentId: string, token: string, patch: Partial<ChatTokenInput> & {
+        isActive?: boolean;
+    }): Promise<void>;
+    /** `DELETE .../chat-tokens/:token` */
+    revoke(agentId: string, token: string): Promise<void>;
+}

package/dist/resources/agents.js

@@ -0,0 +1,67 @@
+"use strict";
+// agents of one workspace (`forTenant(id).agents`). `delete` deactivates
+// (`isActive: false`); history is kept.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChatTokensResource = exports.AgentsResource = void 0;
+const http_1 = require("../http");
+class AgentsResource {
+    constructor(http, tenantId) {
+        this.http = http;
+        this.tenantId = tenantId;
+        this.chatTokens = new ChatTokensResource(http, tenantId);
+    }
+    get base() {
+        return `/admin/tenants/${(0, http_1.seg)(this.tenantId)}/agents`;
+    }
+    /** `GET /admin/tenants/:tenantId/agents` */
+    async list(input = {}) {
+        return this.http.request('GET', this.base, { query: { ...input } });
+    }
+    /** `POST .../agents` */
+    async create(input) {
+        return this.http.request('POST', this.base, { body: input });
+    }
+    /** `GET .../agents/:agentId` */
+    async get(agentId) {
+        return this.http.request('GET', `${this.base}/${(0, http_1.seg)(agentId)}`);
+    }
+    /** `PATCH .../agents/:agentId` */
+    async update(agentId, patch) {
+        return this.http.request('PATCH', `${this.base}/${(0, http_1.seg)(agentId)}`, { body: patch });
+    }
+    /** `DELETE .../agents/:agentId` (deactivates). */
+    async delete(agentId) {
+        await this.http.request('DELETE', `${this.base}/${(0, http_1.seg)(agentId)}`);
+    }
+    /** `GET .../agents/:agentId/parent-team` */
+    async parentTeam(agentId) {
+        return this.http.request('GET', `${this.base}/${(0, http_1.seg)(agentId)}/parent-team`);
+    }
+}
+exports.AgentsResource = AgentsResource;
+class ChatTokensResource {
+    constructor(http, tenantId) {
+        this.http = http;
+        this.tenantId = tenantId;
+    }
+    base(agentId) {
+        return `/admin/tenants/${(0, http_1.seg)(this.tenantId)}/agents/${(0, http_1.seg)(agentId)}/chat-tokens`;
+    }
+    /** `GET .../agents/:agentId/chat-tokens` */
+    async list(agentId) {
+        return this.http.request('GET', this.base(agentId));
+    }
+    /** `POST .../agents/:agentId/chat-tokens` */
+    async create(agentId, input) {
+        return this.http.request('POST', this.base(agentId), { body: input });
+    }
+    /** `PATCH .../chat-tokens/:token` */
+    async update(agentId, token, patch) {
+        await this.http.request('PATCH', `${this.base(agentId)}/${(0, http_1.seg)(token)}`, { body: patch });
+    }
+    /** `DELETE .../chat-tokens/:token` */
+    async revoke(agentId, token) {
+        await this.http.request('DELETE', `${this.base(agentId)}/${(0, http_1.seg)(token)}`);
+    }
+}
+exports.ChatTokensResource = ChatTokensResource;

package/dist/resources/apps.d.ts

@@ -0,0 +1,16 @@
+import type { HttpCore } from '../http';
+import type { AppSummary, UpdateAppInput } from '../types';
+export declare class AppsResource {
+    private readonly http;
+    private readonly tenantId;
+    constructor(http: HttpCore, tenantId: string);
+    /** `GET /apps?tenantId=` */
+    list(): Promise<{
+        items: AppSummary[];
+    }>;
+    /** `GET /apps/:id?tenantId=` */
+    get(appId: string): Promise<AppSummary>;
+    /** `PATCH /apps/:id?tenantId=`: branding fields (workspace admin) and `templatePolicy`
+     *  (workspace owner only; null clears; 400 `invalid_template_policy` if malformed). */
+    update(appId: string, patch: UpdateAppInput): Promise<AppSummary>;
+}

package/dist/resources/apps.js

@@ -0,0 +1,26 @@
+"use strict";
+// apps: the platform Apps (publishers) a workspace owns. Read + edit.
+// `forTenant(id).apps`.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsResource = void 0;
+const http_1 = require("../http");
+class AppsResource {
+    constructor(http, tenantId) {
+        this.http = http;
+        this.tenantId = tenantId;
+    }
+    /** `GET /apps?tenantId=` */
+    async list() {
+        return this.http.request('GET', '/apps', { query: { tenantId: this.tenantId } });
+    }
+    /** `GET /apps/:id?tenantId=` */
+    async get(appId) {
+        return this.http.request('GET', `/apps/${(0, http_1.seg)(appId)}`, { query: { tenantId: this.tenantId } });
+    }
+    /** `PATCH /apps/:id?tenantId=`: branding fields (workspace admin) and `templatePolicy`
+     *  (workspace owner only; null clears; 400 `invalid_template_policy` if malformed). */
+    async update(appId, patch) {
+        return this.http.request('PATCH', `/apps/${(0, http_1.seg)(appId)}`, { query: { tenantId: this.tenantId }, body: patch });
+    }
+}
+exports.AppsResource = AppsResource;

package/dist/resources/auth.d.ts

@@ -0,0 +1,29 @@
+import type { HttpCore } from '../http';
+import type { AuthResult, AuthStrategies, AuthUser, LoginInput, RegisterInput } from '../types';
+export declare class AuthResource {
+    private readonly http;
+    constructor(http: HttpCore);
+    /** `POST /auth/register`. Stores the session. */
+    register(input: RegisterInput): Promise<AuthResult>;
+    /** `POST /auth/login`. Stores the session. 403 `captcha_failed` when the
+     *  server enforces Turnstile and no `captchaToken` was sent. */
+    login(input: LoginInput): Promise<AuthResult>;
+    /** `POST /auth/refresh` with the stored refresh token (single-flight with
+     *  the automatic refresh). Rotates and stores the new pair. Not needed in
+     *  normal use: a 401 refreshes by itself. */
+    refresh(): Promise<{
+        accessToken: string;
+        refreshToken: string;
+    }>;
+    /** `POST /auth/logout` (a stateless no-op server-side), then wipes the
+     *  stored tokens even if the call fails. Does not fire `onSignedOut`. */
+    logout(): Promise<void>;
+    /** `GET /auth/me` */
+    me(): Promise<AuthUser>;
+    /** `POST /auth/me/onboarding/complete` (idempotent). */
+    completeOnboarding(): Promise<void>;
+    /** `POST /auth/me/onboarding/reopen` (idempotent). */
+    reopenOnboarding(): Promise<void>;
+    /** `GET /auth/strategies` (public): which sign-in methods the server has configured. */
+    strategies(): Promise<AuthStrategies>;
+}

package/dist/resources/auth.js

@@ -0,0 +1,57 @@
+"use strict";
+// auth: dashboard-session auth. Tokens go through the TokenStore; callers never
+// touch them. Routes: apps/server identity AuthController / OAuthController.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthResource = void 0;
+class AuthResource {
+    constructor(http) {
+        this.http = http;
+    }
+    /** `POST /auth/register`. Stores the session. */
+    async register(input) {
+        const res = await this.http.request('POST', '/auth/register', { body: input, auth: false });
+        await this.http.setSession(res);
+        return res;
+    }
+    /** `POST /auth/login`. Stores the session. 403 `captcha_failed` when the
+     *  server enforces Turnstile and no `captchaToken` was sent. */
+    async login(input) {
+        const res = await this.http.request('POST', '/auth/login', { body: input, auth: false });
+        await this.http.setSession(res);
+        return res;
+    }
+    /** `POST /auth/refresh` with the stored refresh token (single-flight with
+     *  the automatic refresh). Rotates and stores the new pair. Not needed in
+     *  normal use: a 401 refreshes by itself. */
+    async refresh() {
+        return this.http.refreshNow();
+    }
+    /** `POST /auth/logout` (a stateless no-op server-side), then wipes the
+     *  stored tokens even if the call fails. Does not fire `onSignedOut`. */
+    async logout() {
+        this.http.beginSessionChange();
+        try {
+            await this.http.request('POST', '/auth/logout');
+        }
+        finally {
+            await this.http.clearSession();
+        }
+    }
+    /** `GET /auth/me` */
+    async me() {
+        return this.http.request('GET', '/auth/me');
+    }
+    /** `POST /auth/me/onboarding/complete` (idempotent). */
+    async completeOnboarding() {
+        await this.http.request('POST', '/auth/me/onboarding/complete');
+    }
+    /** `POST /auth/me/onboarding/reopen` (idempotent). */
+    async reopenOnboarding() {
+        await this.http.request('POST', '/auth/me/onboarding/reopen');
+    }
+    /** `GET /auth/strategies` (public): which sign-in methods the server has configured. */
+    async strategies() {
+        return this.http.request('GET', '/auth/strategies', { auth: false });
+    }
+}
+exports.AuthResource = AuthResource;

package/dist/resources/connectors.d.ts

@@ -0,0 +1,25 @@
+import type { HttpCore } from '../http';
+import type { AuthorizeConnectorInput, ConnectorFacets, ConnectorStatus, ListConnectorsInput } from '../types';
+export declare class ConnectorsResource {
+    private readonly http;
+    private readonly tenantId;
+    constructor(http: HttpCore, tenantId: string);
+    private get tenantHeader();
+    /** `GET /connectors/oauth/directory` */
+    directory(input?: ListConnectorsInput): Promise<{
+        items: ConnectorStatus[];
+    }>;
+    /** `GET /connectors/oauth/directory/facets` */
+    facets(): Promise<ConnectorFacets>;
+    /** `POST /connectors/oauth/:id/authorize?tenantId=&postAuthRedirect=`:
+     *  returns the provider consent URL to open in a browser; the grant is
+     *  stored for this workspace. Owner/admin only. */
+    authorize(connectorId: string, input: AuthorizeConnectorInput): Promise<{
+        url: string;
+    }>;
+    /** `POST /connectors/oauth/:id/api-key?tenantId=` for `authKind: 'api_key'`
+     *  connectors. The server pings the provider first (401 on a bad key). */
+    saveApiKey(connectorId: string, apiKey: string): Promise<{
+        connectorId: string;
+    }>;
+}