@agentidentity/sdk 0.1.0

package/dist/client.js

@@ -0,0 +1,985 @@
+import { generateVaultKeypair, vaultDecrypt, vaultEncrypt } from "./vault-crypto.js";
+import { AidApiError, AidConnectionError } from "./errors.js";
+export { AidApiError, AidConnectionError } from "./errors.js";
+export async function createOrganization(baseUrl, input, fetchImpl = fetch) {
+    const body = await sendRequest(fetchImpl, baseUrl, "POST", "/v1/organizations", {
+        body: { name: input.name, slug: input.slug },
+    });
+    const b = body;
+    return { id: b.id, slug: b.slug, name: b.name, adminApiKey: b.admin_api_key };
+}
+function toAuthSession(body) {
+    const b = body;
+    return { apiKey: b.api_key, orgId: b.org_id, orgName: b.org_name, orgSlug: b.org_slug };
+}
+export async function signUp(baseUrl, input, fetchImpl = fetch) {
+    const body = await sendRequest(fetchImpl, baseUrl, "POST", "/v1/auth/signup", {
+        body: { org_name: input.orgName, org_slug: input.orgSlug, email: input.email, password: input.password },
+    });
+    return toAuthSession(body);
+}
+export async function logIn(baseUrl, input, fetchImpl = fetch) {
+    const body = await sendRequest(fetchImpl, baseUrl, "POST", "/v1/auth/login", {
+        body: { email: input.email, password: input.password },
+    });
+    return toAuthSession(body);
+}
+/** Resolves after `ms`, or as soon as `signal` aborts (whichever comes first). */
+function sleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal?.aborted)
+            return resolve();
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            resolve();
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+export class AgentClient {
+    baseUrl;
+    apiKey;
+    fetchImpl;
+    timeoutMs;
+    maxRetries;
+    identities;
+    mail;
+    events;
+    apiKeys;
+    webhooks;
+    vault;
+    tunnels;
+    contacts;
+    contactRules;
+    a2a;
+    domains;
+    providerAccounts;
+    providers;
+    /** Liveness and readiness probes. Unauthenticated on the server, but exposed here so callers
+     *  can reuse one configured client rather than hand-rolling a fetch. */
+    status;
+    constructor(options) {
+        this.baseUrl = options.baseUrl.replace(/\/$/, "");
+        this.apiKey = options.apiKey;
+        this.fetchImpl = options.fetch ?? fetch;
+        this.timeoutMs = options.timeoutMs ?? 30_000;
+        this.maxRetries = options.maxRetries ?? 2;
+        this.identities = {
+            create: async (input) => toIdentitySummary(await this.request("POST", "/v1/identities", {
+                body: { handle: input.handle, display_name: input.displayName },
+            })),
+            list: async () => {
+                const body = await this.request("GET", "/v1/identities");
+                return body.map(toIdentitySummary);
+            },
+            get: async (id) => toIdentityDetail(await this.request("GET", `/v1/identities/${encodeURIComponent(id)}`)),
+            suspend: async (id, reason) => {
+                await this.request("POST", `/v1/identities/${encodeURIComponent(id)}/suspend`, { body: { reason } });
+            },
+            reinstate: async (id) => {
+                await this.request("POST", `/v1/identities/${encodeURIComponent(id)}/reinstate`);
+            },
+            listSuspensions: async () => {
+                const body = await this.request("GET", "/v1/identities/suspensions");
+                return body.map(toIdentitySuspension);
+            },
+        };
+        this.mail = {
+            send: async (input) => {
+                const headers = {};
+                if (input.idempotencyKey !== undefined)
+                    headers["idempotency-key"] = input.idempotencyKey;
+                const body = await this.request("POST", `/v1/identities/${encodeURIComponent(input.identityId)}/mail/send`, {
+                    headers,
+                    body: {
+                        to: Array.isArray(input.to) ? input.to : [input.to],
+                        ...(input.cc !== undefined ? { cc: input.cc } : {}),
+                        ...(input.subject !== undefined ? { subject: input.subject } : {}),
+                        ...(input.text !== undefined ? { text: input.text } : {}),
+                        ...(input.html !== undefined ? { html: input.html } : {}),
+                        ...(input.inReplyToMessageId !== undefined
+                            ? { in_reply_to_message_id: input.inReplyToMessageId }
+                            : {}),
+                        ...(toAttachmentInputs(input.attachments) !== undefined
+                            ? { attachments: toAttachmentInputs(input.attachments) }
+                            : {}),
+                    },
+                });
+                return toMailMessage(body);
+            },
+            listMessages: async (identityId) => {
+                const body = await this.request("GET", `/v1/identities/${encodeURIComponent(identityId)}/mail/messages`);
+                return body.map(toMailMessage);
+            },
+            getThread: async (identityId, threadId) => toMailThread(await this.request("GET", `/v1/identities/${encodeURIComponent(identityId)}/mail/threads/${encodeURIComponent(threadId)}`)),
+            saveDraft: async (input) => toMailMessage(await this.request("POST", `/v1/identities/${encodeURIComponent(input.identityId)}/mail/drafts`, {
+                body: {
+                    ...(input.to !== undefined ? { to: input.to } : {}),
+                    ...(input.cc !== undefined ? { cc: input.cc } : {}),
+                    ...(input.subject !== undefined ? { subject: input.subject } : {}),
+                    ...(input.text !== undefined ? { text: input.text } : {}),
+                    ...(input.html !== undefined ? { html: input.html } : {}),
+                    ...(input.inReplyToMessageId !== undefined
+                        ? { in_reply_to_message_id: input.inReplyToMessageId }
+                        : {}),
+                    ...(toAttachmentInputs(input.attachments) !== undefined
+                        ? { attachments: toAttachmentInputs(input.attachments) }
+                        : {}),
+                },
+            })),
+            listDrafts: async (identityId) => {
+                const body = await this.request("GET", `/v1/identities/${encodeURIComponent(identityId)}/mail/drafts`);
+                return body.map(toMailMessage);
+            },
+            updateDraft: async (identityId, messageId, input) => toMailMessage(await this.request("PATCH", `/v1/identities/${encodeURIComponent(identityId)}/mail/drafts/${encodeURIComponent(messageId)}`, {
+                body: {
+                    ...(input.to !== undefined ? { to: input.to } : {}),
+                    ...(input.cc !== undefined ? { cc: input.cc } : {}),
+                    ...(input.subject !== undefined ? { subject: input.subject } : {}),
+                    ...(input.text !== undefined ? { text: input.text } : {}),
+                    ...(input.html !== undefined ? { html: input.html } : {}),
+                    ...(toAttachmentInputs(input.attachments) !== undefined
+                        ? { attachments: toAttachmentInputs(input.attachments) }
+                        : {}),
+                },
+            })),
+            deleteDraft: async (identityId, messageId) => {
+                await this.request("DELETE", `/v1/identities/${encodeURIComponent(identityId)}/mail/drafts/${encodeURIComponent(messageId)}`);
+            },
+            sendDraft: async (identityId, messageId) => toMailMessage(await this.request("POST", `/v1/identities/${encodeURIComponent(identityId)}/mail/drafts/${encodeURIComponent(messageId)}/send`)),
+            markSpam: async (identityId, messageId) => toMailMessage(await this.request("POST", `/v1/identities/${encodeURIComponent(identityId)}/mail/messages/${encodeURIComponent(messageId)}/mark-spam`)),
+            unmarkSpam: async (identityId, messageId) => toMailMessage(await this.request("POST", `/v1/identities/${encodeURIComponent(identityId)}/mail/messages/${encodeURIComponent(messageId)}/unmark-spam`)),
+            listAttachments: async (identityId, messageId) => {
+                const body = await this.request("GET", `/v1/identities/${encodeURIComponent(identityId)}/mail/messages/${encodeURIComponent(messageId)}/attachments`);
+                return body.map(toAttachment);
+            },
+            downloadAttachment: async (identityId, messageId, attachmentId) => {
+                const url = `${this.baseUrl.replace(/\/$/, "")}/v1/identities/${encodeURIComponent(identityId)}/mail/messages/${encodeURIComponent(messageId)}/attachments/${encodeURIComponent(attachmentId)}/download`;
+                const res = await this.fetchImpl(url, { headers: { authorization: `Bearer ${this.apiKey}` } });
+                if (!res.ok) {
+                    const text = await res.text().catch(() => undefined);
+                    let data;
+                    try {
+                        data = text ? JSON.parse(text) : undefined;
+                    }
+                    catch {
+                        data = text;
+                    }
+                    throw new AidApiError(res.status, data);
+                }
+                const contentType = res.headers.get("content-type") ?? "application/octet-stream";
+                const disposition = res.headers.get("content-disposition") ?? "";
+                const filenameMatch = /filename="([^"]*)"/.exec(disposition);
+                const bytes = new Uint8Array(await res.arrayBuffer());
+                return { contentType, filename: filenameMatch?.[1] ?? "attachment", bytes };
+            },
+        };
+        this.events = {
+            wait: async (input, options) => {
+                const params = new URLSearchParams({ type: input.type });
+                if (input.identityId !== undefined)
+                    params.set("identity_id", input.identityId);
+                if (input.aggregateType !== undefined)
+                    params.set("aggregate_type", input.aggregateType);
+                if (input.aggregateId !== undefined)
+                    params.set("aggregate_id", input.aggregateId);
+                if (input.filter?.threadId !== undefined)
+                    params.set("thread_id", input.filter.threadId);
+                if (input.since !== undefined) {
+                    params.set("since", input.since instanceof Date ? input.since.toISOString() : input.since);
+                }
+                if (input.timeoutMs !== undefined)
+                    params.set("timeout_ms", String(input.timeoutMs));
+                // This endpoint deliberately holds the connection open, so the client's normal request
+                // deadline would abort a perfectly healthy long-poll. Allow the server's own window
+                // plus a margin for travel, and fall back to a generous default when unspecified.
+                const pollWindowMs = (input.timeoutMs ?? 25_000) + 10_000;
+                // `T` only narrows payload types for callers; the decoded shape is the same either
+                // way, so the assertion is confined to this one line rather than leaking to callers.
+                return toWaitForEventResult(await this.request("GET", `/v1/events/wait?${params.toString()}`, {
+                    timeoutMs: pollWindowMs,
+                    ...(options?.signal !== undefined ? { signal: options.signal } : {}),
+                }));
+            },
+            subscribe: (input) => {
+                // Cursor discipline is the whole point of this helper. A hand-written loop typically
+                // does `since = new Date()` after each wait returns, which (a) uses the *client's*
+                // clock against server-assigned timestamps, so skew silently skips events, and (b)
+                // covers the gap between the event's own createdAt and the reset. Advancing strictly
+                // to the last delivered event's createdAt has neither problem.
+                // `wait` is an arrow bound to the client, so detaching it here is safe and avoids
+                // aliasing `this` into the iterator object below.
+                const waitForEvent = this.events.wait;
+                const pollTimeoutMs = input.pollTimeoutMs ?? 25_000;
+                let cursor = input.since === undefined
+                    ? undefined
+                    : input.since instanceof Date
+                        ? input.since.toISOString()
+                        : input.since;
+                let attempt = 0;
+                let done = false;
+                const iterator = {
+                    [Symbol.asyncIterator]() {
+                        return iterator;
+                    },
+                    async next() {
+                        for (;;) {
+                            if (done || input.signal?.aborted)
+                                return { done: true, value: undefined };
+                            try {
+                                const result = await waitForEvent({
+                                    ...input,
+                                    timeoutMs: pollTimeoutMs,
+                                    ...(cursor !== undefined ? { since: cursor } : {}),
+                                }, ...(input.signal !== undefined ? [{ signal: input.signal }] : []));
+                                attempt = 0;
+                                if (result.timedOut || !result.event)
+                                    continue;
+                                cursor = result.event.createdAt;
+                                return { done: false, value: result.event };
+                            }
+                            catch (err) {
+                                if (input.signal?.aborted)
+                                    return { done: true, value: undefined };
+                                attempt += 1;
+                                if (input.onError?.(err, attempt) === false) {
+                                    done = true;
+                                    return { done: true, value: undefined };
+                                }
+                                // Exponential backoff, capped — a server restart shouldn't become a hot loop.
+                                const delay = Math.min(1000 * 2 ** (attempt - 1), 30_000);
+                                await sleep(delay, input.signal);
+                            }
+                        }
+                    },
+                    async return() {
+                        done = true;
+                        return { done: true, value: undefined };
+                    },
+                };
+                return iterator;
+            },
+            list: async (options) => {
+                const params = new URLSearchParams();
+                if (options?.limit !== undefined)
+                    params.set("limit", String(options.limit));
+                if (options?.before !== undefined)
+                    params.set("before", options.before);
+                const query = params.toString();
+                const body = await this.request("GET", `/v1/events${query ? `?${query}` : ""}`);
+                return body.map(toEvent);
+            },
+            replay: async (id) => {
+                const body = await this.request("POST", `/v1/events/${encodeURIComponent(id)}/replay`);
+                return body;
+            },
+        };
+        this.apiKeys = {
+            list: async () => {
+                const body = await this.request("GET", "/v1/api-keys");
+                return body.map(toApiKeySummary);
+            },
+            create: async (input) => toCreatedApiKey(await this.request("POST", "/v1/api-keys", {
+                body: {
+                    name: input.name,
+                    ...(input.identityId !== undefined ? { identity_id: input.identityId } : {}),
+                },
+            })),
+            revoke: async (id) => toApiKeySummary(await this.request("POST", `/v1/api-keys/${encodeURIComponent(id)}/revoke`)),
+        };
+        this.webhooks = {
+            list: async () => {
+                const body = await this.request("GET", "/v1/webhooks");
+                return body.map(toWebhookEndpoint);
+            },
+            create: async (input) => toCreatedWebhookEndpoint(await this.request("POST", "/v1/webhooks", {
+                body: {
+                    url: input.url,
+                    ...(input.identityId !== undefined ? { identity_id: input.identityId } : {}),
+                    ...(input.eventTypes !== undefined ? { event_types: input.eventTypes } : {}),
+                },
+            })),
+            listDeliveries: async (options) => {
+                const params = new URLSearchParams();
+                if (options?.limit !== undefined)
+                    params.set("limit", String(options.limit));
+                if (options?.before !== undefined)
+                    params.set("before", options.before);
+                const query = params.toString();
+                const body = await this.request("GET", `/v1/webhooks/deliveries${query ? `?${query}` : ""}`);
+                return body.map(toWebhookDelivery);
+            },
+        };
+        this.vault = {
+            generateIdentityKey: async (identityId) => {
+                const keypair = generateVaultKeypair();
+                await this.request("PUT", `/v1/identities/${encodeURIComponent(identityId)}/vault-key`, {
+                    body: { public_key: keypair.publicKey },
+                });
+                return keypair;
+            },
+            listSecrets: async () => {
+                const body = await this.request("GET", "/v1/vault/secrets");
+                return body.map(toVaultSecretSummary);
+            },
+            createSecret: async (input) => {
+                const identity = await this.identities.get(input.identityId);
+                if (!identity.vaultPublicKey) {
+                    throw new Error(`identity ${input.identityId} has no vault key registered — call vault.generateIdentityKey() first`);
+                }
+                const envelope = vaultEncrypt(Buffer.from(input.plaintext, "utf8"), identity.vaultPublicKey);
+                return toVaultSecretSummary(await this.request("POST", "/v1/vault/secrets", {
+                    body: {
+                        name: input.name,
+                        identity_id: input.identityId,
+                        ciphertext: envelope.ciphertext,
+                        ephemeral_public_key: envelope.ephemeralPublicKey,
+                    },
+                }));
+            },
+            rotateSecret: async (secretId, keypair) => {
+                const current = await this.request("GET", `/v1/vault/secrets/${encodeURIComponent(secretId)}/envelope`);
+                const envelope = toVaultEnvelope(current);
+                const plaintext = vaultDecrypt(envelope, keypair.publicKey, keypair.privateKey);
+                const fresh = vaultEncrypt(plaintext, keypair.publicKey);
+                return toVaultSecretSummary(await this.request("POST", `/v1/vault/secrets/${encodeURIComponent(secretId)}/rotate`, {
+                    body: { ciphertext: fresh.ciphertext, ephemeral_public_key: fresh.ephemeralPublicKey },
+                }));
+            },
+            createLease: async (secretId, input) => toCreatedLease(await this.request("POST", `/v1/vault/secrets/${encodeURIComponent(secretId)}/lease`, {
+                body: {
+                    operation: input.operation,
+                    ...(input.ttlSeconds !== undefined ? { ttl_seconds: input.ttlSeconds } : {}),
+                    ...(input.identityId !== undefined ? { identity_id: input.identityId } : {}),
+                },
+            })),
+            redeemLease: async (leaseId, keypair) => {
+                const body = await this.request("POST", `/v1/vault/leases/${encodeURIComponent(leaseId)}/redeem`);
+                const envelope = toVaultEnvelope(body);
+                const plaintext = vaultDecrypt(envelope, keypair.publicKey, keypair.privateKey);
+                return { secret: plaintext.toString("utf8") };
+            },
+            listLeases: async (options) => {
+                const params = new URLSearchParams();
+                if (options?.limit !== undefined)
+                    params.set("limit", String(options.limit));
+                const query = params.toString();
+                const body = await this.request("GET", `/v1/vault/leases${query ? `?${query}` : ""}`);
+                return body.map(toVaultLease);
+            },
+        };
+        this.tunnels = {
+            create: async (identityId, input) => toTunnel(await this.request("POST", `/v1/identities/${encodeURIComponent(identityId)}/tunnels`, {
+                body: { ...(input?.hostname !== undefined ? { hostname: input.hostname } : {}) },
+            })),
+            list: async (identityId) => {
+                const body = await this.request("GET", `/v1/identities/${encodeURIComponent(identityId)}/tunnels`);
+                return body.map(toTunnel);
+            },
+            get: async (tunnelId) => toTunnel(await this.request("GET", `/v1/tunnels/${encodeURIComponent(tunnelId)}`)),
+        };
+        this.contacts = {
+            create: async (input) => toContact(await this.request("POST", "/v1/contacts", { body: fromContactInput(input) })),
+            list: async (options) => {
+                const query = options?.status ? `?status=${encodeURIComponent(options.status)}` : "";
+                const body = await this.request("GET", `/v1/contacts${query}`);
+                return body.map(toContact);
+            },
+            get: async (id) => toContact(await this.request("GET", `/v1/contacts/${encodeURIComponent(id)}`)),
+            update: async (id, input) => toContact(await this.request("PATCH", `/v1/contacts/${encodeURIComponent(id)}`, { body: fromContactInput(input) })),
+            delete: async (id) => {
+                await this.request("DELETE", `/v1/contacts/${encodeURIComponent(id)}`);
+            },
+            approve: async (id) => toContact(await this.request("POST", `/v1/contacts/${encodeURIComponent(id)}/approve`)),
+            reject: async (id) => {
+                await this.request("POST", `/v1/contacts/${encodeURIComponent(id)}/reject`);
+            },
+        };
+        this.contactRules = {
+            create: async (input) => toContactRule(await this.request("POST", "/v1/contact-rules", {
+                body: {
+                    ...(input.identityId !== undefined ? { identity_id: input.identityId } : {}),
+                    match_address: input.matchAddress,
+                    action: input.action,
+                },
+            })),
+            list: async () => {
+                const body = await this.request("GET", "/v1/contact-rules");
+                return body.map(toContactRule);
+            },
+            delete: async (id) => {
+                await this.request("DELETE", `/v1/contact-rules/${encodeURIComponent(id)}`);
+            },
+        };
+        this.a2a = {
+            createTrustRule: async (input) => toA2ATrustRule(await this.request("POST", "/v1/a2a/trust-rules", {
+                body: { identity_id: input.identityId, peer_identity_id: input.peerIdentityId },
+            })),
+            listTrustRules: async () => {
+                const body = await this.request("GET", "/v1/a2a/trust-rules");
+                return body.map(toA2ATrustRule);
+            },
+            deleteTrustRule: async (id) => {
+                await this.request("DELETE", `/v1/a2a/trust-rules/${encodeURIComponent(id)}`);
+            },
+            sendTask: async (input) => toA2ATask(await this.request("POST", "/v1/a2a/tasks", {
+                body: { target_identity_id: input.targetIdentityId, message: input.message },
+            })),
+            getTask: async (id) => toA2ATask(await this.request("GET", `/v1/a2a/tasks/${encodeURIComponent(id)}`)),
+            listTasks: async (identityId) => {
+                const body = await this.request("GET", `/v1/a2a/tasks?identity_id=${encodeURIComponent(identityId)}`);
+                return body.map(toA2ATask);
+            },
+            updateTask: async (id, input) => toA2ATask(await this.request("PATCH", `/v1/a2a/tasks/${encodeURIComponent(id)}`, {
+                body: { state: input.state, ...(input.result !== undefined ? { result: input.result } : {}) },
+            })),
+            getAgentCard: async (identityId) => toAgentCard(await this.request("GET", `/v1/identities/${encodeURIComponent(identityId)}/a2a/agent-card.json`)),
+            listAgentOverviews: async () => {
+                const body = await this.request("GET", "/v1/a2a/agents");
+                return body.map(toA2AAgentOverview);
+            },
+            setEnabled: async (identityId, enabled) => {
+                await this.request("POST", `/v1/identities/${encodeURIComponent(identityId)}/a2a/enabled`, {
+                    body: { enabled },
+                });
+            },
+            setSkills: async (identityId, skills) => {
+                await this.request("PUT", `/v1/identities/${encodeURIComponent(identityId)}/a2a/skills`, {
+                    body: { skills },
+                });
+            },
+            setListed: async (identityId, listed) => {
+                await this.request("PUT", `/v1/identities/${encodeURIComponent(identityId)}/a2a/listed`, {
+                    body: { listed },
+                });
+            },
+            searchDirectory: async (query) => {
+                const params = new URLSearchParams();
+                if (query !== undefined)
+                    params.set("q", query);
+                const qs = params.toString();
+                const body = await this.request("GET", `/v1/a2a/directory${qs ? `?${qs}` : ""}`);
+                return body.map(toA2ADirectoryEntry);
+            },
+            createInvitation: async (input) => toA2AInvitation(await this.request("POST", "/v1/a2a/invitations", {
+                body: {
+                    from_identity_id: input.fromIdentityId,
+                    to_identity_id: input.toIdentityId,
+                    ...(input.message !== undefined ? { message: input.message } : {}),
+                },
+            })),
+            listInvitations: async () => {
+                const body = await this.request("GET", "/v1/a2a/invitations");
+                return body.map(toA2AInvitationWithContext);
+            },
+            acceptInvitation: async (id) => toA2AInvitation(await this.request("POST", `/v1/a2a/invitations/${encodeURIComponent(id)}/accept`)),
+            declineInvitation: async (id) => toA2AInvitation(await this.request("POST", `/v1/a2a/invitations/${encodeURIComponent(id)}/decline`)),
+            revokeInvitation: async (id) => toA2AInvitation(await this.request("POST", `/v1/a2a/invitations/${encodeURIComponent(id)}/revoke`)),
+        };
+        this.domains = {
+            add: async (domain) => toDomain(await this.request("POST", "/v1/domains", { body: { domain } })),
+            list: async () => {
+                const body = await this.request("GET", "/v1/domains");
+                return body.map(toDomain);
+            },
+            verify: async (id) => toDomain(await this.request("POST", `/v1/domains/${encodeURIComponent(id)}/verify`)),
+            delete: async (id) => {
+                await this.request("DELETE", `/v1/domains/${encodeURIComponent(id)}`);
+            },
+            deliverability: async (id) => toDeliverabilityGuidance(await this.request("GET", `/v1/domains/${encodeURIComponent(id)}/deliverability`)),
+        };
+        this.status = {
+            health: async () => (await this.request("GET", "/v1/health")),
+            ready: async () => (await this.request("GET", "/v1/ready")),
+        };
+        this.providerAccounts = {
+            create: async (input) => toProviderAccount(await this.request("POST", "/v1/provider-accounts", {
+                body: { kind: input.kind, config: input.config },
+            })),
+            list: async () => {
+                const body = await this.request("GET", "/v1/provider-accounts");
+                return body.map(toProviderAccount);
+            },
+            delete: async (id) => {
+                await this.request("DELETE", `/v1/provider-accounts/${encodeURIComponent(id)}`);
+            },
+        };
+        this.providers = {
+            health: async () => toProviderHealth(await this.request("GET", "/v1/providers/health")),
+        };
+    }
+    async whoami() {
+        return toWhoAmI(await this.request("GET", "/v1/me"));
+    }
+    /** Attaches a real email+password login to the org this API key belongs to — for orgs
+     *  bootstrapped the old way (a raw admin key, no account behind it). Org-admin key only. */
+    async claimAccount(input) {
+        return toAuthSession(await this.request("POST", "/v1/auth/claim", { body: { email: input.email, password: input.password } }));
+    }
+    async request(method, path, options = {}) {
+        return sendRequest(this.fetchImpl, this.baseUrl, method, path, {
+            timeoutMs: this.timeoutMs,
+            maxRetries: this.maxRetries,
+            ...options,
+            headers: { authorization: `Bearer ${this.apiKey}`, ...options.headers },
+        });
+    }
+}
+/** Methods safe to replay after a network failure, since repeating them can't create duplicates. */
+const IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE"]);
+/**
+ * Whether a failed attempt is worth repeating.
+ *
+ * A network-level failure on a non-idempotent method is deliberately *not* retried: the request
+ * may well have been applied before the connection dropped, and replaying it would send the mail
+ * twice. Explicit backpressure (429) and the server's own `retryable` flag are honoured for every
+ * method, because those mean the request demonstrably was not processed.
+ */
+function isRetryable(method, error) {
+    if (error instanceof AidApiError) {
+        if (error.status === 429)
+            return true;
+        if (error.retryable)
+            return true;
+        if (error.status >= 500 && IDEMPOTENT_METHODS.has(method))
+            return true;
+        return false;
+    }
+    if (error instanceof AidConnectionError)
+        return IDEMPOTENT_METHODS.has(method);
+    // Anything else came from a caller-supplied `fetch`, not from the transport — including
+    // framework control flow such as Next.js `redirect()`, which works by throwing. Retrying or
+    // rewriting those would break the caller's own semantics, so they pass straight through.
+    return false;
+}
+/** Honours `Retry-After` when the server sends one, else exponential backoff with jitter. */
+function backoffMs(attempt, retryAfter) {
+    if (retryAfter) {
+        const seconds = Number(retryAfter);
+        if (Number.isFinite(seconds) && seconds >= 0)
+            return Math.min(seconds * 1000, 30_000);
+    }
+    const base = Math.min(250 * 2 ** attempt, 8_000);
+    return base + Math.random() * base * 0.25;
+}
+async function sendRequest(fetchImpl, baseUrl, method, path, options) {
+    const headers = { ...options.headers };
+    let payload;
+    if (options.body !== undefined) {
+        headers["content-type"] = "application/json";
+        payload = JSON.stringify(options.body);
+    }
+    const maxRetries = options.maxRetries ?? 0;
+    const timeoutMs = options.timeoutMs ?? 0;
+    let lastRetryAfter = null;
+    for (let attempt = 0;; attempt++) {
+        // A per-attempt deadline, combined with the caller's own signal so either can cancel. Without
+        // this a stalled connection hangs the caller forever.
+        const timeoutSignal = timeoutMs > 0 ? AbortSignal.timeout(timeoutMs) : undefined;
+        const signals = [options.signal, timeoutSignal].filter((s) => s !== undefined);
+        const signal = signals.length > 1 ? AbortSignal.any(signals) : signals[0];
+        try {
+            const res = await fetchImpl(`${baseUrl.replace(/\/$/, "")}${path}`, {
+                method,
+                headers,
+                ...(payload !== undefined ? { body: payload } : {}),
+                ...(signal !== undefined ? { signal } : {}),
+            });
+            const text = await res.text();
+            let data;
+            try {
+                data = text.length > 0 ? JSON.parse(text) : undefined;
+            }
+            catch {
+                // A SyntaxError, matching what JSON.parse itself raises — and distinguishable from a
+                // transport failure, since this response demonstrably came back from the API.
+                throw new SyntaxError(`unexpected non-JSON response (status ${res.status}): ${text.slice(0, 200)}`);
+            }
+            if (!res.ok) {
+                lastRetryAfter = res.headers.get("retry-after");
+                throw new AidApiError(res.status, data);
+            }
+            return data;
+        }
+        catch (raw) {
+            // The caller cancelled: surface that untouched, so `err.name === "AbortError"` and any
+            // signal-based control flow still works the way callers expect.
+            if (options.signal?.aborted)
+                throw raw;
+            // Only genuine transport failures get rewritten: `fetch` rejects with a TypeError when it
+            // cannot reach the host, and our own deadline shows up as an abort. Everything else —
+            // an AidApiError, a parse failure, or whatever a caller-supplied `fetch` chose to throw
+            // (Next.js `redirect()`, for one) — is passed through exactly as it was raised.
+            const timedOut = timeoutSignal?.aborted ?? false;
+            const err = raw instanceof TypeError || timedOut
+                ? new AidConnectionError(method, `${baseUrl.replace(/\/$/, "")}${path}`, raw, timedOut)
+                : raw;
+            if (attempt >= maxRetries || !isRetryable(method, err))
+                throw err;
+            await sleep(backoffMs(attempt, lastRetryAfter), options.signal);
+            lastRetryAfter = null;
+        }
+    }
+}
+function toAttachmentInputs(inputs) {
+    if (!inputs?.length)
+        return undefined;
+    return inputs.map((a) => ({
+        filename: a.filename,
+        content_type: a.contentType,
+        content_base64: Buffer.from(a.content).toString("base64"),
+        ...(a.contentId !== undefined ? { content_id: a.contentId } : {}),
+    }));
+}
+function toAttachment(body) {
+    const b = body;
+    return {
+        id: b.id,
+        filename: b.filename,
+        contentType: b.content_type,
+        sizeBytes: b.size_bytes,
+        sha256: b.sha256,
+        contentId: b.content_id,
+    };
+}
+function toIdentitySummary(body) {
+    const b = body;
+    return {
+        id: b.id,
+        handle: b.handle,
+        status: b.status,
+        mailboxAddress: b.mailbox_address,
+        vaultPublicKey: b.vault_public_key,
+    };
+}
+function toIdentityDetail(body) {
+    const b = body;
+    return {
+        id: b.id,
+        handle: b.handle,
+        displayName: b.display_name,
+        status: b.status,
+        vaultPublicKey: b.vault_public_key,
+    };
+}
+function toMailMessage(body) {
+    const b = body;
+    return {
+        id: b.id,
+        threadId: b.thread_id,
+        direction: b.direction,
+        status: b.status,
+        lastError: b.last_error ?? null,
+        providerMessageId: b.provider_message_id,
+        from: b.from,
+        to: b.to,
+        cc: b.cc,
+        subject: b.subject,
+        textBody: b.text_body,
+        htmlBody: b.html_body,
+        folder: b.folder,
+        createdAt: b.created_at,
+    };
+}
+function toMailThread(body) {
+    const b = body;
+    return { id: b.id, subject: b.subject, messages: b.messages.map(toMailMessage) };
+}
+function toWhoAmI(body) {
+    const b = body;
+    return { actorType: b.actor_type, actorId: b.actor_id, orgId: b.org_id, orgSlug: b.org_slug, orgName: b.org_name };
+}
+function toApiKeySummary(body) {
+    const b = body;
+    return {
+        id: b.id,
+        identityId: b.identity_id,
+        name: b.name,
+        keyPrefix: b.key_prefix,
+        scopes: b.scopes,
+        revokedAt: b.revoked_at,
+        createdAt: b.created_at,
+    };
+}
+function toCreatedApiKey(body) {
+    const b = body;
+    return { id: b.id, key: b.key, keyPrefix: b.key_prefix };
+}
+function toWebhookEndpoint(body) {
+    const b = body;
+    return {
+        id: b.id,
+        identityId: b.identity_id,
+        url: b.url,
+        eventTypes: b.event_types,
+        status: b.status,
+        createdAt: b.created_at,
+    };
+}
+function toCreatedWebhookEndpoint(body) {
+    const b = body;
+    return {
+        id: b.id,
+        identityId: b.identity_id,
+        url: b.url,
+        secret: b.secret,
+        eventTypes: b.event_types,
+        createdAt: b.created_at,
+    };
+}
+function toWebhookDelivery(body) {
+    const b = body;
+    return {
+        id: b.id,
+        webhookEndpointId: b.webhook_endpoint_id,
+        endpointUrl: b.endpoint_url,
+        eventId: b.event_id,
+        eventType: b.event_type,
+        attemptCount: b.attempt_count,
+        status: b.status,
+        nextAttemptAt: b.next_attempt_at,
+        lastError: b.last_error,
+        deliveredAt: b.delivered_at,
+        eventCreatedAt: b.event_created_at,
+    };
+}
+function toVaultSecretSummary(body) {
+    const b = body;
+    return {
+        id: b.id,
+        identityId: b.identity_id,
+        name: b.name,
+        version: b.version,
+        status: b.status,
+        createdAt: b.created_at,
+    };
+}
+function toVaultEnvelope(body) {
+    const b = body;
+    return { ciphertext: b.ciphertext, ephemeralPublicKey: b.ephemeral_public_key };
+}
+function toCreatedLease(body) {
+    const b = body;
+    return { leaseId: b.lease_id, operation: b.operation, expiresAt: b.expires_at };
+}
+function toContact(body) {
+    const b = body;
+    return {
+        id: b.id,
+        prefix: b.prefix,
+        firstName: b.first_name,
+        middleName: b.middle_name,
+        lastName: b.last_name,
+        suffix: b.suffix,
+        displayName: b.display_name,
+        company: b.company,
+        jobTitle: b.job_title,
+        emails: b.emails,
+        phones: b.phones,
+        websites: b.websites,
+        addresses: b.addresses.map((a) => ({
+            label: a.label,
+            street: a.street,
+            city: a.city,
+            state: a.state,
+            postalCode: a.postal_code,
+            country: a.country,
+        })),
+        dates: b.dates,
+        customFields: b.custom_fields,
+        notes: b.notes,
+        status: b.status,
+        sourceIdentityId: b.source_identity_id,
+        createdAt: b.created_at,
+        updatedAt: b.updated_at,
+    };
+}
+function fromContactInput(input) {
+    return {
+        ...(input.prefix !== undefined ? { prefix: input.prefix } : {}),
+        ...(input.firstName !== undefined ? { first_name: input.firstName } : {}),
+        ...(input.middleName !== undefined ? { middle_name: input.middleName } : {}),
+        ...(input.lastName !== undefined ? { last_name: input.lastName } : {}),
+        ...(input.suffix !== undefined ? { suffix: input.suffix } : {}),
+        ...(input.displayName !== undefined ? { display_name: input.displayName } : {}),
+        ...(input.company !== undefined ? { company: input.company } : {}),
+        ...(input.jobTitle !== undefined ? { job_title: input.jobTitle } : {}),
+        ...(input.emails !== undefined ? { emails: input.emails } : {}),
+        ...(input.phones !== undefined ? { phones: input.phones } : {}),
+        ...(input.websites !== undefined ? { websites: input.websites } : {}),
+        ...(input.addresses !== undefined
+            ? {
+                addresses: input.addresses.map((a) => ({
+                    label: a.label,
+                    street: a.street,
+                    city: a.city,
+                    state: a.state,
+                    postal_code: a.postalCode,
+                    country: a.country,
+                })),
+            }
+            : {}),
+        ...(input.dates !== undefined ? { dates: input.dates } : {}),
+        ...(input.customFields !== undefined ? { custom_fields: input.customFields } : {}),
+        ...(input.notes !== undefined ? { notes: input.notes } : {}),
+    };
+}
+function toContactRule(body) {
+    const b = body;
+    return {
+        id: b.id,
+        identityId: b.identity_id,
+        channel: b.channel,
+        matchAddress: b.match_address,
+        action: b.action,
+        createdAt: b.created_at,
+    };
+}
+function toA2ATrustRule(body) {
+    const b = body;
+    return { id: b.id, identityId: b.identity_id, peerIdentityId: b.peer_identity_id, createdAt: b.created_at };
+}
+function toA2ATask(body) {
+    const b = body;
+    return {
+        id: b.id,
+        targetIdentityId: b.target_identity_id,
+        callerIdentityId: b.caller_identity_id,
+        state: b.state,
+        message: b.message,
+        result: b.result,
+        createdAt: b.created_at,
+        updatedAt: b.updated_at,
+    };
+}
+function toAgentCard(body) {
+    return body;
+}
+function toA2AAgentOverview(body) {
+    const b = body;
+    return {
+        identityId: b.identity_id,
+        handle: b.handle,
+        enabled: b.enabled,
+        skills: b.skills,
+        listed: b.listed,
+        inboundTasks: b.inbound_tasks,
+        outboundTasks: b.outbound_tasks,
+    };
+}
+function toA2ADirectoryEntry(body) {
+    const b = body;
+    return { identityId: b.identity_id, handle: b.handle, orgName: b.org_name, skills: b.skills };
+}
+function toA2AInvitation(body) {
+    const b = body;
+    return {
+        id: b.id,
+        fromIdentityId: b.from_identity_id,
+        toIdentityId: b.to_identity_id,
+        status: b.status,
+        message: b.message,
+        createdAt: b.created_at,
+        respondedAt: b.responded_at,
+    };
+}
+function toA2AInvitationWithContext(body) {
+    const b = body;
+    return { ...toA2AInvitation(body), fromHandle: b.from_handle, toHandle: b.to_handle, direction: b.direction };
+}
+function toDomain(body) {
+    const b = body;
+    return {
+        id: b.id,
+        domain: b.domain,
+        status: b.status,
+        verification: {
+            recordType: b.verification.record_type,
+            recordName: b.verification.record_name,
+            recordValue: b.verification.record_value,
+        },
+        verifiedAt: b.verified_at,
+        createdAt: b.created_at,
+    };
+}
+function toDeliverabilityGuidance(body) {
+    const b = body;
+    return {
+        providerKind: b.provider_kind,
+        records: b.records.map((r) => ({
+            purpose: r.purpose,
+            recordType: r.record_type,
+            recordName: r.record_name,
+            recordValue: r.record_value,
+            note: r.note,
+        })),
+    };
+}
+function toProviderAccount(body) {
+    const b = body;
+    return { id: b.id, kind: b.kind, status: b.status, createdAt: b.created_at };
+}
+function toProviderHealth(body) {
+    const b = body;
+    return { healthy: b.healthy, detail: b.detail, source: b.source };
+}
+function toIdentitySuspension(body) {
+    const b = body;
+    return {
+        id: b.id,
+        identityId: b.identity_id,
+        reason: b.reason,
+        suspendedBy: b.suspended_by,
+        suspendedAt: b.suspended_at,
+        reinstatedAt: b.reinstated_at,
+        reinstatedBy: b.reinstated_by,
+    };
+}
+function toVaultLease(body) {
+    const b = body;
+    return {
+        id: b.id,
+        secretId: b.secret_id,
+        secretName: b.secret_name,
+        identityId: b.identity_id,
+        identityHandle: b.identity_handle,
+        operation: b.operation,
+        expiresAt: b.expires_at,
+        consumedAt: b.consumed_at,
+        createdAt: b.created_at,
+    };
+}
+function toTunnel(body) {
+    const b = body;
+    return {
+        id: b.id,
+        identityId: b.identity_id,
+        hostname: b.hostname,
+        status: b.status,
+        connected: b.connected,
+        edgeUrl: b.edge_url,
+        lastConnectedAt: b.last_connected_at,
+        lastDisconnectedAt: b.last_disconnected_at,
+        createdAt: b.created_at,
+    };
+}
+function toEvent(raw) {
+    const b = raw;
+    return {
+        id: b.id,
+        type: b.type,
+        identityId: b.identity_id,
+        aggregateType: b.aggregate_type,
+        aggregateId: b.aggregate_id,
+        payload: b.payload,
+        createdAt: b.created_at,
+    };
+}
+function toWaitForEventResult(body) {
+    const b = body;
+    return { event: b.event ? toEvent(b.event) : null, timedOut: b.timed_out };
+}