@agentforge-io/sdk-console 0.0.0-stage → 0.2.0

package/dist/http.js

@@ -0,0 +1,289 @@
+"use strict";
+// HTTP core: injectable fetch, bearer auth from a TokenStore, single-flight
+// refresh on 401 + retry once, typed errors. Runs unchanged in React Native,
+// browsers and Node: only `fetch`, `AbortController` and `setTimeout` are used
+// (no Buffer / crypto / fs, and no URLSearchParams: RN's polyfill lacks most methods).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpCore = void 0;
+exports.buildQuery = buildQuery;
+exports.seg = seg;
+const errors_1 = require("./errors");
+const DEFAULT_TIMEOUT_MS = 30000;
+/** Join a query object: skips null/undefined, arrays become `a,b`. */
+function buildQuery(query) {
+    if (!query)
+        return '';
+    // Hand-built (no URLSearchParams): React Native's polyfill lacks set/get/append.
+    const parts = [];
+    for (const [key, value] of Object.entries(query)) {
+        if (value === undefined || value === null)
+            continue;
+        let str;
+        if (Array.isArray(value)) {
+            if (!value.length)
+                continue;
+            str = value.join(',');
+        }
+        else {
+            str = String(value);
+        }
+        parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(str)}`);
+    }
+    return parts.length ? `?${parts.join('&')}` : '';
+}
+function seg(value) {
+    return encodeURIComponent(value);
+}
+class HttpCore {
+    constructor(opts) {
+        this.refreshing = null;
+        this.signingOut = null;
+        /** Bumped whenever the session is replaced or wiped; a refresh that started under an older epoch is stale. */
+        this.epoch = 0;
+        if (!opts.baseURL)
+            throw new Error('baseURL is required');
+        if (!opts.tokenStore)
+            throw new Error('tokenStore is required');
+        this.opts = opts;
+        this.baseURL = opts.baseURL.replace(/\/+$/, '');
+        this.store = opts.tokenStore;
+        this.crypto = opts.crypto;
+    }
+    /** Authenticated (or `auth: false`) JSON request. Resolves `undefined` on 204 / empty body. */
+    async request(method, path, options = {}) {
+        return this.send(method, path, options, false, 0);
+    }
+    /** Persist a session obtained from login / register / invite accept. */
+    async setSession(tokens) {
+        this.epoch++;
+        await this.store.setTokens({ accessToken: tokens.accessToken, refreshToken: tokens.refreshToken });
+    }
+    /** Invalidate any in-flight refresh without touching the store (call before
+     *  an auth call that will replace or wipe the session). */
+    beginSessionChange() {
+        this.epoch++;
+    }
+    /** Wipe the session without firing `onSignedOut` (explicit logout). */
+    async clearSession() {
+        this.epoch++;
+        await this.store.clear();
+    }
+    /** Force a refresh now (shares the in-flight one). Throws if it does not succeed. */
+    async refreshNow() {
+        const result = await this.refreshSingleFlight();
+        if (result.outcome === 'ok')
+            return result.tokens;
+        if (result.outcome === 'rejected')
+            await this.signOut('refresh_rejected');
+        if (result.outcome === 'stale') {
+            // A newer session (or a sign-out) won: hand back the live pair if there is one.
+            const accessToken = await this.store.getAccessToken();
+            const refreshToken = await this.store.getRefreshToken();
+            if (accessToken && refreshToken)
+                return { accessToken, refreshToken };
+        }
+        throw result.error;
+    }
+    // ─── internals ──────────────────────────────────────────────────────────
+    async send(method, path, options, retriedAuth, rateLimitAttempt) {
+        const authed = options.auth !== false;
+        const tokenAtSend = authed ? await this.store.getAccessToken() : null;
+        const res = await this.rawFetch(method, path, options, tokenAtSend);
+        const maxRetries = this.opts.maxRateLimitRetries ?? 2;
+        if (res.status === 429 && method === 'GET' && rateLimitAttempt < maxRetries) {
+            const header = res.headers.get('retry-after');
+            const seconds = header ? parseInt(header, 10) : NaN;
+            // Clamp so a misconfigured upstream cannot park the UI for minutes.
+            const waitMs = Number.isFinite(seconds)
+                ? Math.min(Math.max(seconds * 1000, 500), 10000)
+                : 800 * Math.pow(3, rateLimitAttempt);
+            await (this.opts.sleep ?? defaultSleep)(waitMs);
+            return this.send(method, path, options, retriedAuth, rateLimitAttempt + 1);
+        }
+        if (res.status === 401 && authed && !retriedAuth) {
+            if (await this.recoverFrom401(tokenAtSend)) {
+                return this.send(method, path, options, true, rateLimitAttempt);
+            }
+        }
+        if (res.status === 204)
+            return undefined;
+        const text = res.text;
+        if (!res.ok)
+            throw (0, errors_1.errorFromResponse)(res.status, res.statusText, text);
+        if (!text)
+            return undefined;
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw new errors_1.ApiError({ status: res.status, message: 'Invalid JSON in response', details: text });
+        }
+    }
+    /** @returns true when the request should be replayed once. */
+    async recoverFrom401(tokenAtSend) {
+        // The session was replaced while this request was in flight (a new
+        // sign-in, or another call already refreshed): replay under the new one.
+        const current = await this.store.getAccessToken();
+        if (current && current !== tokenAtSend)
+            return true;
+        const refreshToken = await this.store.getRefreshToken();
+        // Never signed in: a plain 401, nothing to tear down.
+        if (!tokenAtSend && !refreshToken)
+            return false;
+        const result = await this.refreshSingleFlight();
+        if (result.outcome === 'ok')
+            return true;
+        if (result.outcome === 'unavailable')
+            return false; // keep the session; surface the 401
+        if (result.outcome === 'stale') {
+            // Signed out meanwhile: no replay. Replace by a new sign-in: replay under it.
+            const live = await this.store.getAccessToken();
+            return !!live && live !== tokenAtSend;
+        }
+        // Rejected: lose the race gracefully if a newer sign-in landed meanwhile.
+        const latest = await this.store.getAccessToken();
+        if (latest && latest !== tokenAtSend)
+            return true;
+        await this.signOut(refreshToken ? 'refresh_rejected' : 'no_refresh_token');
+        return false;
+    }
+    /** Idempotent: waiters of the same failed refresh all land here, but only
+     *  one tears the session down and fires the callback. */
+    signOut(reason) {
+        if (this.signingOut)
+            return this.signingOut;
+        const run = (async () => {
+            const hadSession = !!((await this.store.getAccessToken()) || (await this.store.getRefreshToken()));
+            await this.store.clear();
+            if (hadSession)
+                this.opts.onSignedOut?.(reason);
+        })().finally(() => {
+            this.signingOut = null;
+        });
+        this.signingOut = run;
+        return run;
+    }
+    /** One /auth/refresh at a time: a burst of 401s awaits the same promise.
+     *  The refresh token rotates on use, so a second concurrent call would be
+     *  read as token reuse by the server and revoke the family. */
+    refreshSingleFlight() {
+        if (this.refreshing)
+            return this.refreshing;
+        const promise = this.doRefresh().finally(() => {
+            this.refreshing = null;
+        });
+        this.refreshing = promise;
+        return promise;
+    }
+    async doRefresh() {
+        const refreshToken = await this.store.getRefreshToken();
+        if (!refreshToken) {
+            return {
+                outcome: 'rejected',
+                error: new errors_1.ApiError({ status: 401, message: 'No refresh token', code: 'no_refresh_token' }),
+            };
+        }
+        const epoch = this.epoch;
+        const stale = () => ({
+            outcome: 'stale',
+            error: new errors_1.ApiError({ status: 401, message: 'Session changed during refresh', code: 'session_changed' }),
+        });
+        let res;
+        try {
+            res = await this.rawFetch('POST', '/auth/refresh', { body: { refreshToken } }, null);
+        }
+        catch (err) {
+            // Offline / timeout: the session may still be fine. Do not sign out.
+            return this.epoch !== epoch ? stale() : { outcome: 'unavailable', error: err };
+        }
+        if (this.epoch !== epoch)
+            return stale();
+        const text = res.text;
+        if (!res.ok) {
+            const error = (0, errors_1.errorFromResponse)(res.status, res.statusText, text);
+            // Only an explicit rejection of the token ends the session. 404/408/410/
+            // other 4xx (proxy, tunnel, deploy gaps), 429, 5xx: unavailable.
+            const rejected = res.status === 400 || res.status === 401 || res.status === 403;
+            return { outcome: rejected ? 'rejected' : 'unavailable', error };
+        }
+        let parsed;
+        try {
+            parsed = text ? JSON.parse(text) : undefined;
+        }
+        catch {
+            parsed = undefined;
+        }
+        if (!parsed?.accessToken || !parsed.refreshToken) {
+            return {
+                outcome: 'unavailable',
+                error: new errors_1.ApiError({ status: res.status, message: 'Malformed refresh response' }),
+            };
+        }
+        const tokens = { accessToken: parsed.accessToken, refreshToken: parsed.refreshToken };
+        if (this.epoch !== epoch)
+            return stale();
+        await this.store.setTokens(tokens);
+        return { outcome: 'ok', tokens };
+    }
+    async rawFetch(method, path, options, accessToken) {
+        const fetchImpl = this.opts.fetch ?? globalThis.fetch;
+        if (!fetchImpl)
+            throw new Error('No fetch available: pass `fetch` in the client options');
+        const headers = { Accept: 'application/json', ...this.opts.defaultHeaders };
+        if (options.body !== undefined)
+            headers['Content-Type'] = 'application/json';
+        if (accessToken)
+            headers.Authorization = `Bearer ${accessToken}`;
+        Object.assign(headers, options.headers);
+        const timeoutMs = this.opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const controller = timeoutMs > 0 && typeof AbortController !== 'undefined' ? new AbortController() : undefined;
+        const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : undefined;
+        try {
+            const res = await fetchImpl(`${this.baseURL}${path}${buildQuery(options.query)}`, {
+                method,
+                headers,
+                body: options.body === undefined ? undefined : JSON.stringify(options.body),
+                signal: controller?.signal,
+            });
+            // The deadline also covers the body: a stalled stream must not hang forever.
+            const text = res.status === 204 ? '' : await readBody(res, controller?.signal);
+            return { status: res.status, statusText: res.statusText, ok: res.ok, headers: res.headers, text };
+        }
+        catch (err) {
+            const aborted = controller?.signal.aborted === true;
+            throw new errors_1.ApiError({
+                status: 0,
+                code: aborted ? 'timeout' : 'network_error',
+                message: aborted ? `Request timed out after ${timeoutMs}ms` : err instanceof Error ? err.message : 'Network request failed',
+                cause: err,
+            });
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+}
+exports.HttpCore = HttpCore;
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Read the body, rejecting if `signal` aborts first (RN / mocks may not tie the stream to the signal). */
+function readBody(res, signal) {
+    const read = res.text().catch(() => '');
+    if (!signal)
+        return read;
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(new Error('aborted'));
+        if (signal.aborted)
+            return onAbort();
+        signal.addEventListener('abort', onAbort, { once: true });
+        read.then((t) => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(t);
+        }, (e) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(e);
+        });
+    });
+}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+export { ConsoleClient, TenantScope } from './client';
+export { ApiError, isApiError } from './errors';
+export { MemoryTokenStore } from './token-store';
+export type { AuthTokens, MaybePromise, TokenStore } from './token-store';
+export { parseOAuthReturn } from './oauth';
+export type { OAuthCrypto, OAuthReturn } from './oauth';
+export type { ConsoleClientOptions, FetchLike, QueryValue, RequestOptions, SignedOutReason } from './http';
+export * from './types';
+export { AgentsResource, ChatTokensResource } from './resources/agents';
+export { AppsResource } from './resources/apps';
+export { AuthResource } from './resources/auth';
+export { ConnectorsResource } from './resources/connectors';
+export { InvitesResource, MembersResource, PublicInvitesResource } from './resources/members';
+export { MarketplaceResource } from './resources/marketplace';
+export { PlaygroundResource } from './resources/playground';
+export { TeamHumanMembersResource, TeamsResource } from './resources/teams';
+export { TemplatesResource, TenantTemplatesResource } from './resources/templates';
+export { TenantsResource } from './resources/tenants';
+export { ToolsResource } from './resources/tools';
+export { VariablesResource } from './resources/variables';

package/dist/index.js

@@ -0,0 +1,57 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VariablesResource = exports.ToolsResource = exports.TenantsResource = exports.TenantTemplatesResource = exports.TemplatesResource = exports.TeamsResource = exports.TeamHumanMembersResource = exports.PlaygroundResource = exports.MarketplaceResource = exports.PublicInvitesResource = exports.MembersResource = exports.InvitesResource = exports.ConnectorsResource = exports.AuthResource = exports.AppsResource = exports.ChatTokensResource = exports.AgentsResource = exports.parseOAuthReturn = exports.MemoryTokenStore = exports.isApiError = exports.ApiError = exports.TenantScope = exports.ConsoleClient = void 0;
+var client_1 = require("./client");
+Object.defineProperty(exports, "ConsoleClient", { enumerable: true, get: function () { return client_1.ConsoleClient; } });
+Object.defineProperty(exports, "TenantScope", { enumerable: true, get: function () { return client_1.TenantScope; } });
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "ApiError", { enumerable: true, get: function () { return errors_1.ApiError; } });
+Object.defineProperty(exports, "isApiError", { enumerable: true, get: function () { return errors_1.isApiError; } });
+var token_store_1 = require("./token-store");
+Object.defineProperty(exports, "MemoryTokenStore", { enumerable: true, get: function () { return token_store_1.MemoryTokenStore; } });
+var oauth_1 = require("./oauth");
+Object.defineProperty(exports, "parseOAuthReturn", { enumerable: true, get: function () { return oauth_1.parseOAuthReturn; } });
+__exportStar(require("./types"), exports);
+var agents_1 = require("./resources/agents");
+Object.defineProperty(exports, "AgentsResource", { enumerable: true, get: function () { return agents_1.AgentsResource; } });
+Object.defineProperty(exports, "ChatTokensResource", { enumerable: true, get: function () { return agents_1.ChatTokensResource; } });
+var apps_1 = require("./resources/apps");
+Object.defineProperty(exports, "AppsResource", { enumerable: true, get: function () { return apps_1.AppsResource; } });
+var auth_1 = require("./resources/auth");
+Object.defineProperty(exports, "AuthResource", { enumerable: true, get: function () { return auth_1.AuthResource; } });
+var connectors_1 = require("./resources/connectors");
+Object.defineProperty(exports, "ConnectorsResource", { enumerable: true, get: function () { return connectors_1.ConnectorsResource; } });
+var members_1 = require("./resources/members");
+Object.defineProperty(exports, "InvitesResource", { enumerable: true, get: function () { return members_1.InvitesResource; } });
+Object.defineProperty(exports, "MembersResource", { enumerable: true, get: function () { return members_1.MembersResource; } });
+Object.defineProperty(exports, "PublicInvitesResource", { enumerable: true, get: function () { return members_1.PublicInvitesResource; } });
+var marketplace_1 = require("./resources/marketplace");
+Object.defineProperty(exports, "MarketplaceResource", { enumerable: true, get: function () { return marketplace_1.MarketplaceResource; } });
+var playground_1 = require("./resources/playground");
+Object.defineProperty(exports, "PlaygroundResource", { enumerable: true, get: function () { return playground_1.PlaygroundResource; } });
+var teams_1 = require("./resources/teams");
+Object.defineProperty(exports, "TeamHumanMembersResource", { enumerable: true, get: function () { return teams_1.TeamHumanMembersResource; } });
+Object.defineProperty(exports, "TeamsResource", { enumerable: true, get: function () { return teams_1.TeamsResource; } });
+var templates_1 = require("./resources/templates");
+Object.defineProperty(exports, "TemplatesResource", { enumerable: true, get: function () { return templates_1.TemplatesResource; } });
+Object.defineProperty(exports, "TenantTemplatesResource", { enumerable: true, get: function () { return templates_1.TenantTemplatesResource; } });
+var tenants_1 = require("./resources/tenants");
+Object.defineProperty(exports, "TenantsResource", { enumerable: true, get: function () { return tenants_1.TenantsResource; } });
+var tools_1 = require("./resources/tools");
+Object.defineProperty(exports, "ToolsResource", { enumerable: true, get: function () { return tools_1.ToolsResource; } });
+var variables_1 = require("./resources/variables");
+Object.defineProperty(exports, "VariablesResource", { enumerable: true, get: function () { return variables_1.VariablesResource; } });

package/dist/oauth.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Minimal crypto surface needed for PKCE. Pass it as the `crypto` client option
+ * on runtimes without a global WebCrypto (React Native). With `expo-crypto`:
+ *
+ *   crypto: {
+ *     getRandomValues: (bytes) => Crypto.getRandomValues(bytes),
+ *     sha256: async (data) => new Uint8Array(await Crypto.digest(Crypto.CryptoDigestAlgorithm.SHA256, data)),
+ *   }
+ */
+export interface OAuthCrypto {
+    /** Fill `bytes` with cryptographically secure random values. May fill in
+     *  place (return nothing) or return the filled array. */
+    getRandomValues(bytes: Uint8Array): Uint8Array | void;
+    /** SHA-256 digest (32 bytes) of `data`. */
+    sha256(data: Uint8Array): Promise<Uint8Array>;
+}
+export declare const CODE_VERIFIER_LENGTH = 64;
+/** Resolve the adapter, falling back to the global WebCrypto. Throws if neither exists. */
+export declare function resolveCrypto(adapter?: OAuthCrypto): OAuthCrypto;
+/** RFC 7636 verifier: 64 chars of the unreserved set. */
+export declare function generateCodeVerifier(c: OAuthCrypto): string;
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+/** S256 challenge: base64url(SHA-256(ASCII(verifier))), no padding. */
+export declare function codeChallengeS256(c: OAuthCrypto, verifier: string): Promise<string>;
+/** Result of `parseOAuthReturn`. */
+export type OAuthReturn = {
+    code: string;
+} | {
+    error: string;
+};
+/**
+ * Read the fragment of the URL the server redirected to: `#code=...` on
+ * success, `#error=...` on failure. Works for `https://` and custom schemes
+ * (`poodleck-console://auth/callback#code=...`). Returns `null` when the URL
+ * carries neither. If both are present, `error` wins.
+ */
+export declare function parseOAuthReturn(url: string): OAuthReturn | null;

package/dist/oauth.js

@@ -0,0 +1,97 @@
+"use strict";
+// OAuth browser-redirect sign-in helpers (PKCE, RFC 7636). Pure and runtime
+// agnostic: no Node `crypto`, no Buffer, no TextEncoder, no URLSearchParams, so
+// it runs on Hermes / React Native, browsers and Node >= 19.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODE_VERIFIER_LENGTH = void 0;
+exports.resolveCrypto = resolveCrypto;
+exports.generateCodeVerifier = generateCodeVerifier;
+exports.base64UrlEncode = base64UrlEncode;
+exports.codeChallengeS256 = codeChallengeS256;
+exports.parseOAuthReturn = parseOAuthReturn;
+const UNRESERVED = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
+const B64URL = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+/** Largest multiple of 66 below 256: bytes at or above it are rejected (no modulo bias). */
+const REJECT_FROM = 198;
+exports.CODE_VERIFIER_LENGTH = 64;
+/** Resolve the adapter, falling back to the global WebCrypto. Throws if neither exists. */
+function resolveCrypto(adapter) {
+    if (adapter)
+        return adapter;
+    const g = globalThis.crypto;
+    if (g && typeof g.getRandomValues === 'function' && g.subtle && typeof g.subtle.digest === 'function') {
+        return {
+            getRandomValues: (bytes) => g.getRandomValues(bytes),
+            sha256: async (data) => new Uint8Array(await g.subtle.digest('SHA-256', data)),
+        };
+    }
+    throw new Error('No crypto available for OAuth PKCE: pass a `crypto` adapter ({ getRandomValues, sha256 }) in the client options');
+}
+function randomBytes(c, length) {
+    const bytes = new Uint8Array(length);
+    return c.getRandomValues(bytes) ?? bytes;
+}
+/** RFC 7636 verifier: 64 chars of the unreserved set. */
+function generateCodeVerifier(c) {
+    let out = '';
+    while (out.length < exports.CODE_VERIFIER_LENGTH) {
+        const bytes = randomBytes(c, exports.CODE_VERIFIER_LENGTH * 2);
+        for (let i = 0; i < bytes.length && out.length < exports.CODE_VERIFIER_LENGTH; i++) {
+            if (bytes[i] < REJECT_FROM)
+                out += UNRESERVED[bytes[i] % UNRESERVED.length];
+        }
+    }
+    return out;
+}
+function base64UrlEncode(bytes) {
+    let out = '';
+    for (let i = 0; i < bytes.length; i += 3) {
+        const n = (bytes[i] << 16) | ((bytes[i + 1] ?? 0) << 8) | (bytes[i + 2] ?? 0);
+        out += B64URL[(n >> 18) & 63] + B64URL[(n >> 12) & 63];
+        if (i + 1 < bytes.length)
+            out += B64URL[(n >> 6) & 63];
+        if (i + 2 < bytes.length)
+            out += B64URL[n & 63];
+    }
+    return out;
+}
+/** S256 challenge: base64url(SHA-256(ASCII(verifier))), no padding. */
+async function codeChallengeS256(c, verifier) {
+    const data = new Uint8Array(verifier.length);
+    for (let i = 0; i < verifier.length; i++)
+        data[i] = verifier.charCodeAt(i) & 0xff;
+    const digest = await c.sha256(data);
+    return base64UrlEncode(digest);
+}
+/**
+ * Read the fragment of the URL the server redirected to: `#code=...` on
+ * success, `#error=...` on failure. Works for `https://` and custom schemes
+ * (`poodleck-console://auth/callback#code=...`). Returns `null` when the URL
+ * carries neither. If both are present, `error` wins.
+ */
+function parseOAuthReturn(url) {
+    if (typeof url !== 'string')
+        return null;
+    const hash = url.indexOf('#');
+    if (hash < 0)
+        return null;
+    const params = {};
+    for (const pair of url.slice(hash + 1).split('&')) {
+        if (!pair)
+            continue;
+        const eq = pair.indexOf('=');
+        const rawKey = eq < 0 ? pair : pair.slice(0, eq);
+        const rawVal = eq < 0 ? '' : pair.slice(eq + 1);
+        try {
+            params[decodeURIComponent(rawKey.replace(/\+/g, ' '))] = decodeURIComponent(rawVal.replace(/\+/g, ' '));
+        }
+        catch {
+            // malformed escape: skip this pair
+        }
+    }
+    if (params.error)
+        return { error: params.error };
+    if (params.code)
+        return { code: params.code };
+    return null;
+}

package/dist/resources/agents.d.ts

@@ -0,0 +1,40 @@
+import type { HttpCore } from '../http';
+import type { Agent, AgentInput, AgentList, AgentParentTeam, ChatToken, ChatTokenInput, ListAgentsInput } from '../types';
+export declare class AgentsResource {
+    private readonly http;
+    private readonly tenantId;
+    /** Public chat-widget tokens of an agent. */
+    readonly chatTokens: ChatTokensResource;
+    constructor(http: HttpCore, tenantId: string);
+    private get base();
+    /** `GET /admin/tenants/:tenantId/agents` */
+    list(input?: ListAgentsInput): Promise<AgentList>;
+    /** `POST .../agents` */
+    create(input: AgentInput): Promise<Agent>;
+    /** `GET .../agents/:agentId` */
+    get(agentId: string): Promise<Agent>;
+    /** `PATCH .../agents/:agentId` */
+    update(agentId: string, patch: Partial<AgentInput>): Promise<Agent>;
+    /** `DELETE .../agents/:agentId` (deactivates). */
+    delete(agentId: string): Promise<void>;
+    /** `GET .../agents/:agentId/parent-team` */
+    parentTeam(agentId: string): Promise<AgentParentTeam>;
+}
+export declare class ChatTokensResource {
+    private readonly http;
+    private readonly tenantId;
+    constructor(http: HttpCore, tenantId: string);
+    private base;
+    /** `GET .../agents/:agentId/chat-tokens` */
+    list(agentId: string): Promise<{
+        items: ChatToken[];
+    }>;
+    /** `POST .../agents/:agentId/chat-tokens` */
+    create(agentId: string, input: ChatTokenInput): Promise<ChatToken>;
+    /** `PATCH .../chat-tokens/:token` */
+    update(agentId: string, token: string, patch: Partial<ChatTokenInput> & {
+        isActive?: boolean;
+    }): Promise<void>;
+    /** `DELETE .../chat-tokens/:token` */
+    revoke(agentId: string, token: string): Promise<void>;
+}

package/dist/resources/agents.js

@@ -0,0 +1,67 @@
+"use strict";
+// agents of one workspace (`forTenant(id).agents`). `delete` deactivates
+// (`isActive: false`); history is kept.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChatTokensResource = exports.AgentsResource = void 0;
+const http_1 = require("../http");
+class AgentsResource {
+    constructor(http, tenantId) {
+        this.http = http;
+        this.tenantId = tenantId;
+        this.chatTokens = new ChatTokensResource(http, tenantId);
+    }
+    get base() {
+        return `/admin/tenants/${(0, http_1.seg)(this.tenantId)}/agents`;
+    }
+    /** `GET /admin/tenants/:tenantId/agents` */
+    async list(input = {}) {
+        return this.http.request('GET', this.base, { query: { ...input } });
+    }
+    /** `POST .../agents` */
+    async create(input) {
+        return this.http.request('POST', this.base, { body: input });
+    }
+    /** `GET .../agents/:agentId` */
+    async get(agentId) {
+        return this.http.request('GET', `${this.base}/${(0, http_1.seg)(agentId)}`);
+    }
+    /** `PATCH .../agents/:agentId` */
+    async update(agentId, patch) {
+        return this.http.request('PATCH', `${this.base}/${(0, http_1.seg)(agentId)}`, { body: patch });
+    }
+    /** `DELETE .../agents/:agentId` (deactivates). */
+    async delete(agentId) {
+        await this.http.request('DELETE', `${this.base}/${(0, http_1.seg)(agentId)}`);
+    }
+    /** `GET .../agents/:agentId/parent-team` */
+    async parentTeam(agentId) {
+        return this.http.request('GET', `${this.base}/${(0, http_1.seg)(agentId)}/parent-team`);
+    }
+}
+exports.AgentsResource = AgentsResource;
+class ChatTokensResource {
+    constructor(http, tenantId) {
+        this.http = http;
+        this.tenantId = tenantId;
+    }
+    base(agentId) {
+        return `/admin/tenants/${(0, http_1.seg)(this.tenantId)}/agents/${(0, http_1.seg)(agentId)}/chat-tokens`;
+    }
+    /** `GET .../agents/:agentId/chat-tokens` */
+    async list(agentId) {
+        return this.http.request('GET', this.base(agentId));
+    }
+    /** `POST .../agents/:agentId/chat-tokens` */
+    async create(agentId, input) {
+        return this.http.request('POST', this.base(agentId), { body: input });
+    }
+    /** `PATCH .../chat-tokens/:token` */
+    async update(agentId, token, patch) {
+        await this.http.request('PATCH', `${this.base(agentId)}/${(0, http_1.seg)(token)}`, { body: patch });
+    }
+    /** `DELETE .../chat-tokens/:token` */
+    async revoke(agentId, token) {
+        await this.http.request('DELETE', `${this.base(agentId)}/${(0, http_1.seg)(token)}`);
+    }
+}
+exports.ChatTokensResource = ChatTokensResource;

package/dist/resources/apps.d.ts

@@ -0,0 +1,16 @@
+import type { HttpCore } from '../http';
+import type { AppSummary, UpdateAppInput } from '../types';
+export declare class AppsResource {
+    private readonly http;
+    private readonly tenantId;
+    constructor(http: HttpCore, tenantId: string);
+    /** `GET /apps?tenantId=` */
+    list(): Promise<{
+        items: AppSummary[];
+    }>;
+    /** `GET /apps/:id?tenantId=` */
+    get(appId: string): Promise<AppSummary>;
+    /** `PATCH /apps/:id?tenantId=`: branding fields (workspace admin) and `templatePolicy`
+     *  (workspace owner only; null clears; 400 `invalid_template_policy` if malformed). */
+    update(appId: string, patch: UpdateAppInput): Promise<AppSummary>;
+}

package/dist/resources/apps.js

@@ -0,0 +1,26 @@
+"use strict";
+// apps: the platform Apps (publishers) a workspace owns. Read + edit.
+// `forTenant(id).apps`.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppsResource = void 0;
+const http_1 = require("../http");
+class AppsResource {
+    constructor(http, tenantId) {
+        this.http = http;
+        this.tenantId = tenantId;
+    }
+    /** `GET /apps?tenantId=` */
+    async list() {
+        return this.http.request('GET', '/apps', { query: { tenantId: this.tenantId } });
+    }
+    /** `GET /apps/:id?tenantId=` */
+    async get(appId) {
+        return this.http.request('GET', `/apps/${(0, http_1.seg)(appId)}`, { query: { tenantId: this.tenantId } });
+    }
+    /** `PATCH /apps/:id?tenantId=`: branding fields (workspace admin) and `templatePolicy`
+     *  (workspace owner only; null clears; 400 `invalid_template_policy` if malformed). */
+    async update(appId, patch) {
+        return this.http.request('PATCH', `/apps/${(0, http_1.seg)(appId)}`, { query: { tenantId: this.tenantId }, body: patch });
+    }
+}
+exports.AppsResource = AppsResource;