@ai-matrx/api 0.1.4 → 0.1.6

package/dist/{chunk-DMJ3ZRN7.cjs → chunk-UO3H55R3.cjs}

@@ -1,8 +1,8 @@
 'use strict';
 
 var chunk2SXAAKGV_cjs = require('./chunk-2SXAAKGV.cjs');
-var chunk5WJLKYH6_cjs = require('./chunk-5WJLKYH6.cjs');
 var uuid = require('@ai-matrx/kit/uuid');
+var credentials = require('@ai-matrx/auth/credentials');
 
 // src/core/backend-errors.ts
 var BackendApiError = class extends Error {
@@ -818,8 +818,6 @@ var DEPLOYMENTS = {
   }
 };
 var DOMAINS = ["account", "agents", "ai", "apps", "architecture", "audio", "chat", "code", "commerce", "communications", "computer", "content", "crm", "data", "education", "files", "human-resources", "integrations", "intelligence", "knowledge", "legal", "marketing", "masterwork", "media", "platform", "publish", "web", "workflows"];
-
-// src/api.ts
 var DEFAULT_CONNECT_TIMEOUT_MS = 15e3;
 function defaultRequestId() {
   const c = globalThis.crypto;
@@ -881,7 +879,7 @@ async function errorFrom(response, path) {
   return new MatrxApiError({ status: response.status, path, serverDetail });
 }
 function createApi(options = {}) {
-  const credentials = chunk5WJLKYH6_cjs.toCredentialsPort(options.credentials);
+  const credentials$1 = credentials.toCredentialsPort(options.credentials);
   const environment = options.environment ?? "production";
   const mintRequestId = options.requestId ?? defaultRequestId;
   const retryAttempts = Math.max(1, options.retryAttempts ?? 3);
@@ -915,7 +913,7 @@ function createApi(options = {}) {
       ...options.headers,
       ...call?.headers,
       Accept: acceptFor(op.s),
-      [chunk5WJLKYH6_cjs.MATRX_HEADERS.requestId]: requestId
+      [credentials.MATRX_HEADERS.requestId]: requestId
     };
     let body;
     if (args?.body !== void 0 && op.m !== "GET" && op.m !== "HEAD") {
@@ -926,8 +924,8 @@ function createApi(options = {}) {
         headers["Content-Type"] = "application/json";
       }
     }
-    Object.assign(headers, chunk5WJLKYH6_cjs.credentialToHeaders(await credentials.get()));
-    if (orgId !== null) headers[chunk5WJLKYH6_cjs.MATRX_HEADERS.organization] = orgId;
+    Object.assign(headers, credentials.credentialToHeaders(await credentials$1.get()));
+    if (orgId !== null) headers[credentials.MATRX_HEADERS.organization] = orgId;
     options.onRequest?.({ operation: op.n, method: op.m, url, requestId, deployment: op.d });
     const attempt = () => chunk2SXAAKGV_cjs.resilientFetch(
       url,

package/dist/code.cjs

@@ -1,8 +1,7 @@
 'use strict';
 
-var chunkDMJ3ZRN7_cjs = require('./chunk-DMJ3ZRN7.cjs');
+var chunkUO3H55R3_cjs = require('./chunk-UO3H55R3.cjs');
 require('./chunk-2SXAAKGV.cjs');
-require('./chunk-5WJLKYH6.cjs');
 
 // src/generated/code.ts
 var $codingSessionBridge = { m: "POST", p: "/coding-sessions/bridge", d: "aidream", a: "user", o: "exempt", n: "code.coding_session_bridge" };
@@ -47,7 +46,7 @@ function claudeManagedCapabilities(api, args, options) {
 }
 var $claudeManagedStream = { m: "POST", p: "/coding-sessions/claude/stream", d: "aidream", a: "user", o: "required", s: "ndjson", n: "code.claude_managed_stream" };
 function claudeManagedStream(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $claudeManagedStream, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $claudeManagedStream, args, options);
 }
 var $cancelClaudeManagedRuntime = { m: "POST", p: "/coding-sessions/claude/runtimes/{runtime_id}/cancel", d: "aidream", a: "user", o: "required", n: "code.cancel_claude_managed_runtime" };
 function cancelClaudeManagedRuntime(api, args, options) {
@@ -59,7 +58,7 @@ function codexManagedCapabilities(api, args, options) {
 }
 var $codexManagedStream = { m: "POST", p: "/coding-sessions/codex/stream", d: "aidream", a: "user", o: "required", s: "ndjson", n: "code.codex_managed_stream" };
 function codexManagedStream(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $codexManagedStream, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $codexManagedStream, args, options);
 }
 var $cancelCodexManagedRuntime = { m: "POST", p: "/coding-sessions/codex/runtimes/{runtime_id}/cancel", d: "aidream", a: "user", o: "required", n: "code.cancel_codex_managed_runtime" };
 function cancelCodexManagedRuntime(api, args, options) {
@@ -135,7 +134,7 @@ function claudeManagedCapabilitiesOnHostedBox(api, args, options) {
 }
 var $claudeManagedStreamOnHostedBox = { m: "POST", p: "/coding-sessions/claude/stream", d: "hosted-box", a: "user", o: "required", s: "ndjson", n: "code.claude_managed_stream" };
 function claudeManagedStreamOnHostedBox(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $claudeManagedStreamOnHostedBox, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $claudeManagedStreamOnHostedBox, args, options);
 }
 var $cancelClaudeManagedRuntimeOnHostedBox = { m: "POST", p: "/coding-sessions/claude/runtimes/{runtime_id}/cancel", d: "hosted-box", a: "user", o: "required", n: "code.cancel_claude_managed_runtime" };
 function cancelClaudeManagedRuntimeOnHostedBox(api, args, options) {
@@ -147,7 +146,7 @@ function codexManagedCapabilitiesOnHostedBox(api, args, options) {
 }
 var $codexManagedStreamOnHostedBox = { m: "POST", p: "/coding-sessions/codex/stream", d: "hosted-box", a: "user", o: "required", s: "ndjson", n: "code.codex_managed_stream" };
 function codexManagedStreamOnHostedBox(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $codexManagedStreamOnHostedBox, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $codexManagedStreamOnHostedBox, args, options);
 }
 var $cancelCodexManagedRuntimeOnHostedBox = { m: "POST", p: "/coding-sessions/codex/runtimes/{runtime_id}/cancel", d: "hosted-box", a: "user", o: "required", n: "code.cancel_codex_managed_runtime" };
 function cancelCodexManagedRuntimeOnHostedBox(api, args, options) {
@@ -371,7 +370,7 @@ function runtimeResumable(api, args, options) {
 }
 var $runtimeEvents = { m: "GET", p: "/coding-session/runtime/{runtime_id}/events", d: "matrx-local", a: "loopback_token", o: "exempt", s: "sse", n: "code.runtime_events" };
 function runtimeEvents(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $runtimeEvents, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $runtimeEvents, args, options);
 }
 var $getCodexUsageAllowance = { m: "GET", p: "/codex-usage/allowance", d: "matrx-local", a: "loopback_token", o: "exempt", n: "code.get_codex_usage_allowance" };
 function getCodexUsageAllowance(api, args, options) {

package/dist/code.d.cts

@@ -1,6 +1,6 @@
-import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent, S as SseEvent } from './index-DCyEAVSW.cjs';
+import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent, S as SseEvent } from './index-Xx6L_pWk.cjs';
 import { JsonValue } from './schemas.cjs';
-import './credentials.cjs';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/code.d.ts

@@ -1,6 +1,6 @@
-import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent, S as SseEvent } from './index-BUb7OxrB.js';
+import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent, S as SseEvent } from './index-Xx6L_pWk.js';
 import { JsonValue } from './schemas.js';
-import './credentials.js';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/code.js

@@ -1,6 +1,5 @@
-import { openStream } from './chunk-6UOESA3L.js';
+import { openStream } from './chunk-2FJPWNXG.js';
 import './chunk-KIEAFMKB.js';
-import './chunk-VTZKJMSY.js';
 
 // src/generated/code.ts
 var $codingSessionBridge = { m: "POST", p: "/coding-sessions/bridge", d: "aidream", a: "user", o: "exempt", n: "code.coding_session_bridge" };

package/dist/commerce.d.cts

@@ -1,5 +1,5 @@
-import { A as Api, C as CallOptions } from './index-DCyEAVSW.cjs';
-import './credentials.cjs';
+import { A as Api, C as CallOptions } from './index-Xx6L_pWk.cjs';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/commerce.d.ts

@@ -1,5 +1,5 @@
-import { A as Api, C as CallOptions } from './index-BUb7OxrB.js';
-import './credentials.js';
+import { A as Api, C as CallOptions } from './index-Xx6L_pWk.js';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/communications.cjs

@@ -1,8 +1,7 @@
 'use strict';
 
-var chunkDMJ3ZRN7_cjs = require('./chunk-DMJ3ZRN7.cjs');
+var chunkUO3H55R3_cjs = require('./chunk-UO3H55R3.cjs');
 require('./chunk-2SXAAKGV.cjs');
-require('./chunk-5WJLKYH6.cjs');
 
 // src/generated/communications.ts
 var $conversationRelayPreparation = { m: "POST", p: "/communications/voice/conversation-relay/session-reference", d: "aidream", a: "scoped", o: "required", n: "communications.conversation_relay_preparation" };
@@ -103,7 +102,7 @@ function agentStop(api, args, options) {
 }
 var $intelligenceAsk = { m: "POST", p: "/v1/meet/intelligence/ask", d: "aidream", a: "scoped", o: "required", s: "ndjson", n: "communications.intelligence_ask" };
 function intelligenceAsk(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $intelligenceAsk, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $intelligenceAsk, args, options);
 }
 var $meetingRecord = { m: "GET", p: "/v1/meet/record", d: "aidream", a: "scoped", o: "required", n: "communications.meeting_record" };
 function meetingRecord(api, args, options) {
@@ -143,11 +142,11 @@ function meetingGoogleCalendar(api, args, options) {
 }
 var $meetingBrief = { m: "POST", p: "/v1/meet/meetings/{meeting_id}/brief", d: "aidream", a: "user", o: "required", s: "ndjson", n: "communications.meeting_brief" };
 function meetingBrief(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $meetingBrief, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $meetingBrief, args, options);
 }
 var $agendaDraft = { m: "POST", p: "/v1/meet/agenda-draft", d: "aidream", a: "user", o: "required", s: "ndjson", n: "communications.agenda_draft" };
 function agendaDraft(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $agendaDraft, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $agendaDraft, args, options);
 }
 var $meetingModerate = { m: "POST", p: "/v1/meet/moderate", d: "aidream", a: "scoped", o: "required", n: "communications.meeting_moderate" };
 function meetingModerate(api, args, options) {

package/dist/communications.d.cts

@@ -1,6 +1,6 @@
-import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-DCyEAVSW.cjs';
+import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-Xx6L_pWk.cjs';
 import { JsonValue, CalendarCreateResult } from './schemas.cjs';
-import './credentials.cjs';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/communications.d.ts

@@ -1,6 +1,6 @@
-import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-BUb7OxrB.js';
+import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-Xx6L_pWk.js';
 import { JsonValue, CalendarCreateResult } from './schemas.js';
-import './credentials.js';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/communications.js

@@ -1,6 +1,5 @@
-import { openStream } from './chunk-6UOESA3L.js';
+import { openStream } from './chunk-2FJPWNXG.js';
 import './chunk-KIEAFMKB.js';
-import './chunk-VTZKJMSY.js';
 
 // src/generated/communications.ts
 var $conversationRelayPreparation = { m: "POST", p: "/communications/voice/conversation-relay/session-reference", d: "aidream", a: "scoped", o: "required", n: "communications.conversation_relay_preparation" };

package/dist/computer.cjs

@@ -1,8 +1,7 @@
 'use strict';
 
-var chunkDMJ3ZRN7_cjs = require('./chunk-DMJ3ZRN7.cjs');
+var chunkUO3H55R3_cjs = require('./chunk-UO3H55R3.cjs');
 require('./chunk-2SXAAKGV.cjs');
-require('./chunk-5WJLKYH6.cjs');
 
 // src/generated/computer.ts
 var $localProxyProxyToLocalPc = { m: "GET", p: "/local-proxy/{app_instance_id}/{path}", d: "aidream", a: "guest", o: "required", n: "computer.local_proxy_proxy_to_local_pc" };
@@ -51,11 +50,11 @@ function getAccessLogs(api, args, options) {
 }
 var $streamSystemLog = { m: "GET", p: "/logs/stream", d: "matrx-local", a: "loopback_token", o: "exempt", s: "sse", n: "computer.stream_system_log" };
 function streamSystemLog(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $streamSystemLog, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $streamSystemLog, args, options);
 }
 var $streamAccessLog = { m: "GET", p: "/logs/access/stream", d: "matrx-local", a: "loopback_token", o: "exempt", s: "sse", n: "computer.stream_access_log" };
 function streamAccessLog(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $streamAccessLog, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $streamAccessLog, args, options);
 }
 var $pushNotification = { m: "POST", p: "/notify", d: "matrx-local", a: "loopback_token", o: "exempt", n: "computer.push_notification" };
 function pushNotification(api, args, options) {

package/dist/computer.d.cts

@@ -1,5 +1,5 @@
-import { A as Api, C as CallOptions, a as ApiStream, S as SseEvent } from './index-DCyEAVSW.cjs';
-import './credentials.cjs';
+import { A as Api, C as CallOptions, a as ApiStream, S as SseEvent } from './index-Xx6L_pWk.cjs';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/computer.d.ts

@@ -1,5 +1,5 @@
-import { A as Api, C as CallOptions, a as ApiStream, S as SseEvent } from './index-BUb7OxrB.js';
-import './credentials.js';
+import { A as Api, C as CallOptions, a as ApiStream, S as SseEvent } from './index-Xx6L_pWk.js';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/computer.js

@@ -1,6 +1,5 @@
-import { openStream } from './chunk-6UOESA3L.js';
+import { openStream } from './chunk-2FJPWNXG.js';
 import './chunk-KIEAFMKB.js';
-import './chunk-VTZKJMSY.js';
 
 // src/generated/computer.ts
 var $localProxyProxyToLocalPc = { m: "GET", p: "/local-proxy/{app_instance_id}/{path}", d: "aidream", a: "guest", o: "required", n: "computer.local_proxy_proxy_to_local_pc" };

package/dist/content.cjs

@@ -1,8 +1,7 @@
 'use strict';
 
-var chunkDMJ3ZRN7_cjs = require('./chunk-DMJ3ZRN7.cjs');
+var chunkUO3H55R3_cjs = require('./chunk-UO3H55R3.cjs');
 require('./chunk-2SXAAKGV.cjs');
-require('./chunk-5WJLKYH6.cjs');
 
 // src/generated/content.ts
 var $esignOutsiderOpen = { m: "POST", p: "/esign/signing/outsider/open", d: "aidream", a: "scoped", o: "exempt", n: "content.esign_outsider_open" };
@@ -123,15 +122,15 @@ function processBlocks(api, args, options) {
 }
 var $processBlocksStream = { m: "POST", p: "/utilities/block-processing/process/stream", d: "aidream", a: "guest", o: "exempt", s: "ndjson", n: "content.process_blocks_stream" };
 function processBlocksStream(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $processBlocksStream, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $processBlocksStream, args, options);
 }
 var $simulateProviderRetryStream = { m: "POST", p: "/utilities/block-processing/simulate/provider-retry", d: "aidream", a: "guest", o: "required", s: "ndjson", n: "content.simulate_provider_retry_stream" };
 function simulateProviderRetryStream(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $simulateProviderRetryStream, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $simulateProviderRetryStream, args, options);
 }
 var $processFile = { m: "POST", p: "/content-processing/{cld_file_id}", d: "aidream", a: "guest", o: "required", s: "ndjson", n: "content.process_file" };
 function processFile(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $processFile, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $processFile, args, options);
 }
 var $generateOffice = { m: "POST", p: "/office/generate", d: "aidream", a: "guest", o: "required", n: "content.generate_office" };
 function generateOffice(api, args, options) {

package/dist/content.d.cts

@@ -1,6 +1,6 @@
-import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-DCyEAVSW.cjs';
+import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-Xx6L_pWk.cjs';
 import { JsonValue } from './schemas.cjs';
-import './credentials.cjs';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/content.d.ts

@@ -1,6 +1,6 @@
-import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-BUb7OxrB.js';
+import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-Xx6L_pWk.js';
 import { JsonValue } from './schemas.js';
-import './credentials.js';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/content.js

@@ -1,6 +1,5 @@
-import { openStream } from './chunk-6UOESA3L.js';
+import { openStream } from './chunk-2FJPWNXG.js';
 import './chunk-KIEAFMKB.js';
-import './chunk-VTZKJMSY.js';
 
 // src/generated/content.ts
 var $esignOutsiderOpen = { m: "POST", p: "/esign/signing/outsider/open", d: "aidream", a: "scoped", o: "exempt", n: "content.esign_outsider_open" };

package/dist/credentials.cjs

@@ -1,22 +1,4 @@
 'use strict';
 
-var chunk5WJLKYH6_cjs = require('./chunk-5WJLKYH6.cjs');
+require('./chunk-PJXXT3GB.cjs');
 
-
-
-Object.defineProperty(exports, "API_KEY_PREFIX", {
-  enumerable: true,
-  get: function () { return chunk5WJLKYH6_cjs.API_KEY_PREFIX; }
-});
-Object.defineProperty(exports, "MATRX_HEADERS", {
-  enumerable: true,
-  get: function () { return chunk5WJLKYH6_cjs.MATRX_HEADERS; }
-});
-Object.defineProperty(exports, "credentialToHeaders", {
-  enumerable: true,
-  get: function () { return chunk5WJLKYH6_cjs.credentialToHeaders; }
-});
-Object.defineProperty(exports, "toCredentialsPort", {
-  enumerable: true,
-  get: function () { return chunk5WJLKYH6_cjs.toCredentialsPort; }
-});

package/dist/credentials.d.cts

@@ -1,82 +1 @@
-/**
- * The credentials port — the ONE credential→header mapping for every client
- * of every AI Matrx server (package lines v3 §3.4; API-key lane C16).
- *
- * Five credential kinds, one mapping, in exactly one place. The kind names are
- * the contract's own `x-matrx-auth` tier names, so a generated operation's
- * tier and the credential that satisfies it read the same in every language
- * (TypeScript here; the Python `matrx-api` and future Swift/Kotlin clients
- * share these header names and shapes — see {@link MATRX_HEADERS}):
- *
- * - `user`    — a signed-in person: `Authorization: Bearer <Supabase JWT>`.
- * - `guest`   — a fingerprint: `X-Fingerprint-ID: <id>`.
- * - `api_key` — an AI Matrx API key: `Authorization: Bearer mx_live_...`.
- *   The server's ONE AuthMiddleware disambiguates by shape (`mx_` prefix vs
- *   three-dot JWT), so `user` and `api_key` ride the same header.
- * - `service` — one of our servers calling another: the server secret as
- *   `Authorization: Bearer <secret>` (or in `secretHeader`), plus the acting
- *   person in `X-Matrx-User-Id` when there is one
- *   (`matrx_connect.service_auth`).
- * - `scoped`  — a short-lived capability token (sandbox, desktop app, broker
- *   client): `Authorization: Bearer <token>` (`matrx_connect.scoped_tokens`).
- *   Short-lived means the PORT re-reads it per call: hand a `CredentialsPort`
- *   whose `get()` returns the current token.
- *
- * No polling, no readiness loop: readiness is the port's promise.
- */
-/** Header names every AI Matrx client and server shares (TS, Python, native). */
-declare const MATRX_HEADERS: {
-    readonly authorization: "Authorization";
-    readonly fingerprint: "X-Fingerprint-ID";
-    readonly organization: "X-Organization-Id";
-    readonly actingUser: "X-Matrx-User-Id";
-    readonly requestId: "X-Request-Id";
-};
-/** The credential kinds — identical to the contract's `x-matrx-auth` tiers that carry a credential. */
-type MatrxCredentialKind = MatrxCredential["kind"];
-/** A credential a Matrx client can present. */
-type MatrxCredential = {
-    kind: "user";
-    accessToken: string;
-} | {
-    kind: "guest";
-    fingerprintId: string;
-} | {
-    kind: "api_key";
-    apiKey: string;
-} | {
-    kind: "service";
-    /** The server secret (an existing env value, e.g. MATRX_AIDREAM_SERVICE_TOKEN). */
-    secret: string;
-    /** The person the call acts for, when there is one (`X-Matrx-User-Id`). */
-    actingUserId?: string;
-    /** Where the secret rides. Default `Authorization` (as a Bearer value). */
-    secretHeader?: string;
-} | {
-    kind: "scoped";
-    token: string;
-};
-/**
- * The async source of the current credential. `get()` resolves when the host
- * knows its auth state (null = anonymous); `onChange` lets transports refresh
- * cached headers when the credential rotates.
- */
-interface CredentialsPort {
-    get(): Promise<MatrxCredential | null>;
-    onChange?(cb: () => void): () => void;
-}
-/** Prefix that marks a bearer token as an AI Matrx API key, never a JWT. */
-declare const API_KEY_PREFIX = "mx_";
-/**
- * Map a credential to the exact request headers the AI Matrx platform expects.
- * This is the single place that knowledge lives — transports spread the result
- * into their request headers and add `X-Organization-Id` from the org context
- * binding separately.
- */
-declare function credentialToHeaders(credential: MatrxCredential | null): Record<string, string>;
-/** What `createApi({ credentials })` accepts: a fixed credential, a getter, or a port. */
-type CredentialsSetting = MatrxCredential | null | (() => MatrxCredential | null | Promise<MatrxCredential | null>) | CredentialsPort;
-/** Normalize the ONE credentials setting into a `CredentialsPort`. */
-declare function toCredentialsPort(setting: CredentialsSetting | undefined): CredentialsPort;
-
-export { API_KEY_PREFIX, type CredentialsPort, type CredentialsSetting, MATRX_HEADERS, type MatrxCredential, type MatrxCredentialKind, credentialToHeaders, toCredentialsPort };
+export * from '@ai-matrx/auth/credentials';

package/dist/credentials.d.ts

@@ -1,82 +1 @@
-/**
- * The credentials port — the ONE credential→header mapping for every client
- * of every AI Matrx server (package lines v3 §3.4; API-key lane C16).
- *
- * Five credential kinds, one mapping, in exactly one place. The kind names are
- * the contract's own `x-matrx-auth` tier names, so a generated operation's
- * tier and the credential that satisfies it read the same in every language
- * (TypeScript here; the Python `matrx-api` and future Swift/Kotlin clients
- * share these header names and shapes — see {@link MATRX_HEADERS}):
- *
- * - `user`    — a signed-in person: `Authorization: Bearer <Supabase JWT>`.
- * - `guest`   — a fingerprint: `X-Fingerprint-ID: <id>`.
- * - `api_key` — an AI Matrx API key: `Authorization: Bearer mx_live_...`.
- *   The server's ONE AuthMiddleware disambiguates by shape (`mx_` prefix vs
- *   three-dot JWT), so `user` and `api_key` ride the same header.
- * - `service` — one of our servers calling another: the server secret as
- *   `Authorization: Bearer <secret>` (or in `secretHeader`), plus the acting
- *   person in `X-Matrx-User-Id` when there is one
- *   (`matrx_connect.service_auth`).
- * - `scoped`  — a short-lived capability token (sandbox, desktop app, broker
- *   client): `Authorization: Bearer <token>` (`matrx_connect.scoped_tokens`).
- *   Short-lived means the PORT re-reads it per call: hand a `CredentialsPort`
- *   whose `get()` returns the current token.
- *
- * No polling, no readiness loop: readiness is the port's promise.
- */
-/** Header names every AI Matrx client and server shares (TS, Python, native). */
-declare const MATRX_HEADERS: {
-    readonly authorization: "Authorization";
-    readonly fingerprint: "X-Fingerprint-ID";
-    readonly organization: "X-Organization-Id";
-    readonly actingUser: "X-Matrx-User-Id";
-    readonly requestId: "X-Request-Id";
-};
-/** The credential kinds — identical to the contract's `x-matrx-auth` tiers that carry a credential. */
-type MatrxCredentialKind = MatrxCredential["kind"];
-/** A credential a Matrx client can present. */
-type MatrxCredential = {
-    kind: "user";
-    accessToken: string;
-} | {
-    kind: "guest";
-    fingerprintId: string;
-} | {
-    kind: "api_key";
-    apiKey: string;
-} | {
-    kind: "service";
-    /** The server secret (an existing env value, e.g. MATRX_AIDREAM_SERVICE_TOKEN). */
-    secret: string;
-    /** The person the call acts for, when there is one (`X-Matrx-User-Id`). */
-    actingUserId?: string;
-    /** Where the secret rides. Default `Authorization` (as a Bearer value). */
-    secretHeader?: string;
-} | {
-    kind: "scoped";
-    token: string;
-};
-/**
- * The async source of the current credential. `get()` resolves when the host
- * knows its auth state (null = anonymous); `onChange` lets transports refresh
- * cached headers when the credential rotates.
- */
-interface CredentialsPort {
-    get(): Promise<MatrxCredential | null>;
-    onChange?(cb: () => void): () => void;
-}
-/** Prefix that marks a bearer token as an AI Matrx API key, never a JWT. */
-declare const API_KEY_PREFIX = "mx_";
-/**
- * Map a credential to the exact request headers the AI Matrx platform expects.
- * This is the single place that knowledge lives — transports spread the result
- * into their request headers and add `X-Organization-Id` from the org context
- * binding separately.
- */
-declare function credentialToHeaders(credential: MatrxCredential | null): Record<string, string>;
-/** What `createApi({ credentials })` accepts: a fixed credential, a getter, or a port. */
-type CredentialsSetting = MatrxCredential | null | (() => MatrxCredential | null | Promise<MatrxCredential | null>) | CredentialsPort;
-/** Normalize the ONE credentials setting into a `CredentialsPort`. */
-declare function toCredentialsPort(setting: CredentialsSetting | undefined): CredentialsPort;
-
-export { API_KEY_PREFIX, type CredentialsPort, type CredentialsSetting, MATRX_HEADERS, type MatrxCredential, type MatrxCredentialKind, credentialToHeaders, toCredentialsPort };
+export * from '@ai-matrx/auth/credentials';

package/dist/credentials.js

@@ -1 +1 @@
-export { API_KEY_PREFIX, MATRX_HEADERS, credentialToHeaders, toCredentialsPort } from './chunk-VTZKJMSY.js';
+import './chunk-K27FH34N.js';

package/dist/crm.cjs

@@ -1,8 +1,7 @@
 'use strict';
 
-var chunkDMJ3ZRN7_cjs = require('./chunk-DMJ3ZRN7.cjs');
+var chunkUO3H55R3_cjs = require('./chunk-UO3H55R3.cjs');
 require('./chunk-2SXAAKGV.cjs');
-require('./chunk-5WJLKYH6.cjs');
 
 // src/generated/crm.ts
 var $listSendingIdentities = { m: "GET", p: "/sending-identities", d: "aidream", a: "user", o: "optional", n: "crm.list_sending_identities" };
@@ -131,7 +130,7 @@ function mediaResearchPreviewDoor(api, args, options) {
 }
 var $mediaResearchRunDoor = { m: "POST", p: "/crm/outreach-lists/{list_id}/media-research/run", d: "aidream", a: "guest", o: "required", s: "ndjson", n: "crm.media_research_run_door" };
 function mediaResearchRunDoor(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $mediaResearchRunDoor, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $mediaResearchRunDoor, args, options);
 }
 var $previewBulkEnrichment = { m: "POST", p: "/crm/enrichment/bulk/preview", d: "aidream", a: "guest", o: "required", n: "crm.preview_bulk_enrichment" };
 function previewBulkEnrichment(api, args, options) {

package/dist/crm.d.cts

@@ -1,6 +1,6 @@
-import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-DCyEAVSW.cjs';
+import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-Xx6L_pWk.cjs';
 import { JsonValue } from './schemas.cjs';
-import './credentials.cjs';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/crm.d.ts

@@ -1,6 +1,6 @@
-import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-BUb7OxrB.js';
+import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-Xx6L_pWk.js';
 import { JsonValue } from './schemas.js';
-import './credentials.js';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/crm.js

@@ -1,6 +1,5 @@
-import { openStream } from './chunk-6UOESA3L.js';
+import { openStream } from './chunk-2FJPWNXG.js';
 import './chunk-KIEAFMKB.js';
-import './chunk-VTZKJMSY.js';
 
 // src/generated/crm.ts
 var $listSendingIdentities = { m: "GET", p: "/sending-identities", d: "aidream", a: "user", o: "optional", n: "crm.list_sending_identities" };

package/dist/data.d.cts

@@ -1,6 +1,6 @@
-import { A as Api, C as CallOptions } from './index-DCyEAVSW.cjs';
+import { A as Api, C as CallOptions } from './index-Xx6L_pWk.cjs';
 import { JsonValue } from './schemas.cjs';
-import './credentials.cjs';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/data.d.ts

@@ -1,6 +1,6 @@
-import { A as Api, C as CallOptions } from './index-BUb7OxrB.js';
+import { A as Api, C as CallOptions } from './index-Xx6L_pWk.js';
 import { JsonValue } from './schemas.js';
-import './credentials.js';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.

package/dist/education.cjs

@@ -1,21 +1,20 @@
 'use strict';
 
-var chunkDMJ3ZRN7_cjs = require('./chunk-DMJ3ZRN7.cjs');
+var chunkUO3H55R3_cjs = require('./chunk-UO3H55R3.cjs');
 require('./chunk-2SXAAKGV.cjs');
-require('./chunk-5WJLKYH6.cjs');
 
 // src/generated/education.ts
 var $sourceCard = { m: "POST", p: "/education/images/source-card", d: "aidream", a: "guest", o: "required", s: "ndjson", n: "education.source_card" };
 function sourceCard(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $sourceCard, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $sourceCard, args, options);
 }
 var $generateCard = { m: "POST", p: "/education/images/generate-card", d: "aidream", a: "guest", o: "required", s: "ndjson", n: "education.generate_card" };
 function generateCard(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $generateCard, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $generateCard, args, options);
 }
 var $sourceSet = { m: "POST", p: "/education/images/source-set", d: "aidream", a: "guest", o: "required", s: "ndjson", n: "education.source_set" };
 function sourceSet(api, args, options) {
-  return chunkDMJ3ZRN7_cjs.openStream(api, $sourceSet, args, options);
+  return chunkUO3H55R3_cjs.openStream(api, $sourceSet, args, options);
 }
 var TABLE = {};
 function call(api, key, args, options) {

package/dist/education.d.cts

@@ -1,5 +1,5 @@
-import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-DCyEAVSW.cjs';
-import './credentials.cjs';
+import { A as Api, C as CallOptions, a as ApiStream, N as NdjsonEvent } from './index-Xx6L_pWk.cjs';
+import '@ai-matrx/auth/credentials';
 
 /**
  * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.