@aimee.shop/sdk 0.0.1

package/dist/core/auth/lazy-interactive.authenticator.js

@@ -0,0 +1,112 @@
+import { AuthenticationError } from '../errors/index.js';
+/**
+ * Lazy-loading wrapper for InteractiveAuthenticator.
+ *
+ * Uses dynamic import() to load the real InteractiveAuthenticator only when needed,
+ * avoiding static imports of Node.js built-ins (readline) that break browser builds.
+ *
+ * In browser environments, this authenticator:
+ * - Returns false from canAuthenticate()
+ * - Throws AuthenticationError if getAuthHeaders() is called
+ */
+export class LazyInteractiveAuthenticator {
+    name = 'interactive';
+    priority = 3;
+    realAuthenticator = null;
+    loadPromise = null;
+    loadError = null;
+    /**
+     * Check if this authenticator can authenticate.
+     * Returns false in browser environments or non-TTY terminals.
+     */
+    canAuthenticate() {
+        if (!this.isNodeEnvironment() || !this.isTTY()) {
+            return false;
+        }
+        if (this.realAuthenticator) {
+            return this.realAuthenticator.canAuthenticate();
+        }
+        if (this.loadError) {
+            return false;
+        }
+        // Optimistic - will verify when actually authenticating
+        return true;
+    }
+    /**
+     * Check if current credentials/tokens are expired.
+     * Returns true until real authenticator is loaded.
+     */
+    isExpired() {
+        return this.realAuthenticator?.isExpired() ?? true;
+    }
+    /**
+     * Get authorization headers. Triggers lazy load of InteractiveAuthenticator.
+     */
+    async getAuthHeaders() {
+        if (!this.isNodeEnvironment()) {
+            throw new AuthenticationError('Interactive authentication is not available in browser environments. ' +
+                'Please provide an API key or use Cognito credentials instead.');
+        }
+        if (!this.isTTY()) {
+            throw new AuthenticationError('Interactive authentication requires a TTY environment. ' +
+                'Please provide credentials via config or environment variables.');
+        }
+        const authenticator = await this.loadAuthenticator();
+        return authenticator.getAuthHeaders();
+    }
+    /**
+     * Refresh credentials if possible.
+     */
+    async refresh() {
+        if (this.realAuthenticator) {
+            await this.realAuthenticator.refresh();
+        }
+    }
+    /**
+     * Lazily load the real InteractiveAuthenticator.
+     * Caches the result to avoid repeated imports.
+     */
+    async loadAuthenticator() {
+        if (this.realAuthenticator) {
+            return this.realAuthenticator;
+        }
+        if (this.loadError) {
+            throw this.loadError;
+        }
+        if (this.loadPromise) {
+            return this.loadPromise;
+        }
+        this.loadPromise = this.doLoad();
+        try {
+            this.realAuthenticator = await this.loadPromise;
+            return this.realAuthenticator;
+        }
+        catch (error) {
+            this.loadError = error instanceof Error ? error : new Error(String(error));
+            throw this.loadError;
+        }
+        finally {
+            this.loadPromise = null;
+        }
+    }
+    async doLoad() {
+        const { InteractiveAuthenticator } = await import('./interactive.authenticator.js');
+        return new InteractiveAuthenticator();
+    }
+    /**
+     * Check if running in a Node.js environment.
+     */
+    isNodeEnvironment() {
+        return (typeof process !== 'undefined' && process.versions != null && process.versions.node != null);
+    }
+    /**
+     * Check if running in a TTY environment.
+     */
+    isTTY() {
+        if (!this.isNodeEnvironment()) {
+            return false;
+        }
+        return !!(process.stdout?.isTTY && process.stdin?.isTTY);
+    }
+}
+//# sourceMappingURL=lazy-interactive.authenticator.js.map

package/dist/core/auth/lazy-interactive.authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lazy-interactive.authenticator.js","sourceRoot":"","sources":["../../../../../src/core/auth/lazy-interactive.authenticator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,OAAO,4BAA4B;IAC9B,IAAI,GAAG,aAAa,CAAC;IACrB,QAAQ,GAAG,CAAC,CAAC;IAEd,iBAAiB,GAAyB,IAAI,CAAC;IAC/C,WAAW,GAAkC,IAAI,CAAC;IAClD,SAAS,GAAiB,IAAI,CAAC;IAEvC;;;OAGG;IACH,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,wDAAwD;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,iBAAiB,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,mBAAmB,CAC3B,uEAAuE;gBACrE,+DAA+D,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,mBAAmB,CAC3B,yDAAyD;gBACvD,iEAAiE,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACrD,OAAO,aAAa,CAAC,cAAc,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,SAAS,CAAC;QACvB,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,CAAC,iBAAiB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;YAChD,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3E,MAAM,IAAI,CAAC,SAAS,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACpF,OAAO,IAAI,wBAAwB,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,iBAAiB;QACvB,OAAO,CACL,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAC5F,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK;QACX,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/dist/core/auth/token.authenticator.d.ts

@@ -0,0 +1,20 @@
+import type { Authenticator } from './authenticator.js';
+/**
+ * Token-based authenticator for browser environments.
+ * Uses a callback function to get a fresh access token before each request.
+ * This is ideal for frontend apps that manage their own auth session (e.g., Cognito in browser).
+ *
+ * When no token is available (user not logged in), returns empty headers.
+ * The AuthChain will then fall through to try the next authenticator.
+ */
+export declare class TokenAuthenticator implements Authenticator {
+    private readonly getToken;
+    readonly name = "token";
+    readonly priority = 0;
+    constructor(getToken: () => Promise<string | null>);
+    canAuthenticate(): boolean;
+    getAuthHeaders(): Promise<Record<string, string>>;
+    isExpired(): boolean;
+    refresh(): Promise<void>;
+}
+//# sourceMappingURL=token.authenticator.d.ts.map

package/dist/core/auth/token.authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.authenticator.d.ts","sourceRoot":"","sources":["../../../../../src/core/auth/token.authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;GAOG;AACH,qBAAa,kBAAmB,YAAW,aAAa;IAI1C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAHrC,QAAQ,CAAC,IAAI,WAAW;IACxB,QAAQ,CAAC,QAAQ,KAAK;gBAEO,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAEnE,eAAe,IAAI,OAAO;IAMpB,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAevD,SAAS,IAAI,OAAO;IAMd,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAI/B"}

package/dist/core/auth/token.authenticator.js

@@ -0,0 +1,45 @@
+/**
+ * Token-based authenticator for browser environments.
+ * Uses a callback function to get a fresh access token before each request.
+ * This is ideal for frontend apps that manage their own auth session (e.g., Cognito in browser).
+ *
+ * When no token is available (user not logged in), returns empty headers.
+ * The AuthChain will then fall through to try the next authenticator.
+ */
+export class TokenAuthenticator {
+    getToken;
+    name = 'token';
+    priority = 0; // Highest priority - if token getter is provided, use it first
+    constructor(getToken) {
+        this.getToken = getToken;
+    }
+    canAuthenticate() {
+        // We can authenticate as long as we have a token getter function.
+        // Actual token availability is checked in getAuthHeaders().
+        return !!this.getToken;
+    }
+    async getAuthHeaders() {
+        const token = await this.getToken();
+        if (!token) {
+            // Return empty headers - AuthChain will fall through to next authenticator.
+            // This allows graceful degradation when user is not logged in.
+            if (process.env.NODE_ENV === 'development') {
+                console.warn('[TokenAuthenticator] No access token available. User may not be logged in.');
+            }
+            return {};
+        }
+        return {
+            Authorization: `Bearer ${token}`,
+        };
+    }
+    isExpired() {
+        // Token expiration is managed by the caller (e.g., Cognito session in browser)
+        // Always return false to avoid unnecessary refresh attempts
+        return false;
+    }
+    async refresh() {
+        // No-op: token refresh is handled by the external auth system
+        // The getToken callback will return a fresh token when called
+    }
+}
+//# sourceMappingURL=token.authenticator.js.map

package/dist/core/auth/token.authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.authenticator.js","sourceRoot":"","sources":["../../../../../src/core/auth/token.authenticator.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IAIA;IAHpB,IAAI,GAAG,OAAO,CAAC;IACf,QAAQ,GAAG,CAAC,CAAC,CAAC,+DAA+D;IAEtF,YAA6B,QAAsC;QAAtC,aAAQ,GAAR,QAAQ,CAA8B;IAAG,CAAC;IAEvE,eAAe;QACb,kEAAkE;QAClE,4DAA4D;QAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,4EAA4E;YAC5E,+DAA+D;YAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YAC7F,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO;YACL,aAAa,EAAE,UAAU,KAAK,EAAE;SACjC,CAAC;IACJ,CAAC;IAED,SAAS;QACP,+EAA+E;QAC/E,4DAA4D;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO;QACX,8DAA8D;QAC9D,8DAA8D;IAChE,CAAC;CACF"}

package/dist/core/config.d.ts

@@ -0,0 +1,72 @@
+import type { AxiosRequestConfig } from 'axios';
+import type { ZiftrError } from './errors/index.js';
+import type { RetryOptions } from './retry.js';
+export type ZiftrEnvironment = 'local' | 'dev' | 'staging' | 'production';
+/**
+ * Configuration options for the Ziftr SDK
+ */
+export interface ZiftrSDKConfig {
+    apiKey?: string;
+    email?: string;
+    password?: string;
+    /**
+     * Token getter function for browser-based auth.
+     * Called before each request to get a fresh access token.
+     * Use this when the SDK is used in a browser with an existing auth session.
+     *
+     * @example
+     * ```typescript
+     * const sdk = new ZiftrSDK({
+     *   getAccessToken: () => authContext.getToken(),
+     * });
+     * ```
+     */
+    getAccessToken?: () => Promise<string | null>;
+    tenantId?: string;
+    storeId?: string;
+    environment?: ZiftrEnvironment;
+    coreApiUrl?: string;
+    rbacApiUrl?: string;
+    paymentsApiUrl?: string;
+    workflowsApiUrl?: string;
+    notificationsApiUrl?: string;
+    aiApiUrl?: string;
+    timeout?: number;
+    debug?: boolean;
+    interactive?: boolean;
+    retry?: RetryOptions;
+    onRequest?: (config: AxiosRequestConfig) => AxiosRequestConfig | Promise<AxiosRequestConfig>;
+    onResponse?: <T>(response: T) => T | Promise<T>;
+    onError?: (error: ZiftrError) => void | Promise<void>;
+}
+/**
+ * Service endpoint URLs
+ */
+export interface ServiceEndpoints {
+    coreApi: string;
+    rbacApi: string;
+    paymentsApi: string;
+    workflowsApi: string;
+    notificationsApi: string;
+    aiApi: string;
+}
+export declare const ENVIRONMENT_ENDPOINTS: Record<ZiftrEnvironment, ServiceEndpoints>;
+/**
+ * Cognito configuration per environment
+ */
+export interface CognitoConfig {
+    userPoolId: string;
+    clientId: string;
+    region: string;
+}
+/**
+ * Default SDK configuration values
+ */
+export declare const DEFAULT_CONFIG: {
+    readonly timeout: 30000;
+    readonly debug: false;
+    readonly interactive: false;
+};
+export declare function detectEnvironment(): ZiftrEnvironment;
+export declare const COGNITO_CONFIG: CognitoConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/core/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/core/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,cAAc;IAE7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAG/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;IAGrB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7F,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAkFD,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAK5E,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAqBD;;GAEG;AACH,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAQX,wBAAgB,iBAAiB,IAAI,gBAAgB,CAKpD;AAED,eAAO,MAAM,cAAc,EAAE,aAAgC,CAAC"}

package/dist/core/config.js

@@ -0,0 +1,120 @@
+/**
+ * Static map of NEXT_PUBLIC_ env var references.
+ * Next.js replaces process.env.NEXT_PUBLIC_* at compile time using static
+ * string matching. Dynamic lookups like process.env[`NEXT_PUBLIC_${name}`]
+ * are never matched. Every variable must appear as a literal property access.
+ */
+function getNextPublicEnv(name) {
+    if (typeof process === 'undefined' || !process.env)
+        return undefined;
+    switch (name) {
+        case 'ZIFTR_CORE_API_URL':
+            return process.env.NEXT_PUBLIC_ZIFTR_CORE_API_URL;
+        case 'ZIFTR_RBAC_API_URL':
+            return process.env.NEXT_PUBLIC_ZIFTR_RBAC_API_URL;
+        case 'ZIFTR_PAYMENTS_API_URL':
+            return process.env.NEXT_PUBLIC_ZIFTR_PAYMENTS_API_URL;
+        case 'ZIFTR_WORKFLOWS_API_URL':
+            return process.env.NEXT_PUBLIC_ZIFTR_WORKFLOWS_API_URL;
+        case 'ZIFTR_NOTIFICATIONS_API_URL':
+            return process.env.NEXT_PUBLIC_ZIFTR_NOTIFICATIONS_API_URL;
+        case 'ZIFTR_AI_API_URL':
+            return process.env.NEXT_PUBLIC_ZIFTR_AI_API_URL;
+        case 'ZIFTR_COGNITO_USER_POOL_ID':
+            return process.env.NEXT_PUBLIC_ZIFTR_COGNITO_USER_POOL_ID;
+        case 'ZIFTR_COGNITO_CLIENT_ID':
+            return process.env.NEXT_PUBLIC_ZIFTR_COGNITO_CLIENT_ID;
+        case 'ZIFTR_COGNITO_REGION':
+            return process.env.NEXT_PUBLIC_ZIFTR_COGNITO_REGION;
+        case 'ZIFTR_ENV':
+            return process.env.NEXT_PUBLIC_ZIFTR_ENV;
+        default:
+            return undefined;
+    }
+}
+function getEnv(name) {
+    if (typeof process !== 'undefined' && process.env) {
+        return process.env[name] ?? getNextPublicEnv(name);
+    }
+    return undefined;
+}
+function gatewayEndpoints(baseUrl) {
+    // Service clients include /v1/ and the service prefix in their paths
+    // (e.g., /v1/rbac/roles, /v1/payments/intents), so baseUrl should NOT include it
+    return {
+        coreApi: baseUrl,
+        rbacApi: baseUrl,
+        paymentsApi: baseUrl,
+        workflowsApi: baseUrl,
+        notificationsApi: baseUrl,
+        aiApi: baseUrl,
+    };
+}
+// Canonical Cloudflare edge hosts per environment (see api-routing-standard.md).
+// Each host is the bare gateway origin with NO /v1 -- clients append /v1/<service>.
+const CANONICAL_HOSTS = {
+    local: 'http://localhost:3000',
+    dev: 'https://api-dev.ziftr.ai',
+    staging: 'https://api-staging.ziftr.ai',
+    production: 'https://api.ziftr.com',
+};
+// Per-service precedence: ZIFTR_<SERVICE>_API_URL > ZIFTR_CORE_API_URL > canonical host.
+// Locally, non-core services fall back to localhost:3000 and expect a per-service override
+// (e.g. ZIFTR_RBAC_API_URL=http://localhost:3001) for direct-to-service access.
+function resolveEndpoints(env) {
+    const base = getEnv('ZIFTR_CORE_API_URL') ?? CANONICAL_HOSTS[env];
+    return {
+        ...gatewayEndpoints(base),
+        rbacApi: getEnv('ZIFTR_RBAC_API_URL') ?? base,
+        paymentsApi: getEnv('ZIFTR_PAYMENTS_API_URL') ?? base,
+        workflowsApi: getEnv('ZIFTR_WORKFLOWS_API_URL') ?? base,
+        notificationsApi: getEnv('ZIFTR_NOTIFICATIONS_API_URL') ?? base,
+        aiApi: getEnv('ZIFTR_AI_API_URL') ?? base,
+    };
+}
+// Each environment maps to a canonical gateway host; env vars override per service.
+export const ENVIRONMENT_ENDPOINTS = {
+    local: resolveEndpoints('local'),
+    dev: resolveEndpoints('dev'),
+    staging: resolveEndpoints('staging'),
+    production: resolveEndpoints('production'),
+};
+const PROD_COGNITO = {
+    userPoolId: 'us-east-2_PLACEHOLDER',
+    clientId: 'PLACEHOLDER',
+    region: 'us-east-2',
+};
+function resolveCognito() {
+    const userPoolId = getEnv('ZIFTR_COGNITO_USER_POOL_ID');
+    const clientId = getEnv('ZIFTR_COGNITO_CLIENT_ID');
+    if (userPoolId && clientId) {
+        return {
+            userPoolId,
+            clientId,
+            region: getEnv('ZIFTR_COGNITO_REGION') ?? 'us-east-2',
+        };
+    }
+    return PROD_COGNITO;
+}
+/**
+ * Default SDK configuration values
+ */
+export const DEFAULT_CONFIG = {
+    timeout: 30000,
+    debug: false,
+    interactive: false,
+};
+const VALID_ENVIRONMENTS = ['local', 'dev', 'staging', 'production'];
+function isZiftrEnvironment(env) {
+    return VALID_ENVIRONMENTS.some((validEnvironment) => validEnvironment === env);
+}
+export function detectEnvironment() {
+    const env = getEnv('ZIFTR_ENV');
+    if (env && isZiftrEnvironment(env))
+        return env;
+    if (typeof process !== 'undefined' && process.env?.NODE_ENV === 'development')
+        return 'local';
+    return 'production';
+}
+export const COGNITO_CONFIG = resolveCognito();
+//# sourceMappingURL=config.js.map

package/dist/core/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/core/config.ts"],"names":[],"mappings":"AAoEA;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAErE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,oBAAoB;YACvB,OAAO,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QACpD,KAAK,oBAAoB;YACvB,OAAO,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QACpD,KAAK,wBAAwB;YAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;QACxD,KAAK,yBAAyB;YAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC;QACzD,KAAK,6BAA6B;YAChC,OAAO,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC;QAC7D,KAAK,kBAAkB;YACrB,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAClD,KAAK,4BAA4B;YAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC;QAC5D,KAAK,yBAAyB;YAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC;QACzD,KAAK,sBAAsB;YACzB,OAAO,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;QACtD,KAAK,WAAW;YACd,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC3C;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClD,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,qEAAqE;IACrE,iFAAiF;IACjF,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,OAAO;QACpB,YAAY,EAAE,OAAO;QACrB,gBAAgB,EAAE,OAAO;QACzB,KAAK,EAAE,OAAO;KACf,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,oFAAoF;AACpF,MAAM,eAAe,GAAqC;IACxD,KAAK,EAAE,uBAAuB;IAC9B,GAAG,EAAE,0BAA0B;IAC/B,OAAO,EAAE,8BAA8B;IACvC,UAAU,EAAE,uBAAuB;CACpC,CAAC;AAEF,yFAAyF;AACzF,2FAA2F;AAC3F,gFAAgF;AAChF,SAAS,gBAAgB,CAAC,GAAqB;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,oBAAoB,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IAClE,OAAO;QACL,GAAG,gBAAgB,CAAC,IAAI,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,oBAAoB,CAAC,IAAI,IAAI;QAC7C,WAAW,EAAE,MAAM,CAAC,wBAAwB,CAAC,IAAI,IAAI;QACrD,YAAY,EAAE,MAAM,CAAC,yBAAyB,CAAC,IAAI,IAAI;QACvD,gBAAgB,EAAE,MAAM,CAAC,6BAA6B,CAAC,IAAI,IAAI;QAC/D,KAAK,EAAE,MAAM,CAAC,kBAAkB,CAAC,IAAI,IAAI;KAC1C,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAA+C;IAC/E,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC;IAChC,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC;IAC5B,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC;IACpC,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC;CAC3C,CAAC;AAWF,MAAM,YAAY,GAAkB;IAClC,UAAU,EAAE,uBAAuB;IACnC,QAAQ,EAAE,aAAa;IACvB,MAAM,EAAE,WAAW;CACpB,CAAC;AAEF,SAAS,cAAc;IACrB,MAAM,UAAU,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACnD,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,UAAU;YACV,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,sBAAsB,CAAC,IAAI,WAAW;SACtD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,OAAO,EAAE,KAAK;IACd,KAAK,EAAE,KAAK;IACZ,WAAW,EAAE,KAAK;CACV,CAAC;AAEX,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAA8B,CAAC;AAElG,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,KAAK,GAAG,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAChC,IAAI,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/C,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,aAAa;QAAE,OAAO,OAAO,CAAC;IAC9F,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAkB,cAAc,EAAE,CAAC"}

package/dist/core/errors/index.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Base error class for all Ziftr SDK errors.
+ * Provides consistent error structure with code, statusCode, and JSON serialization.
+ */
+export declare abstract class ZiftrError extends Error {
+    abstract readonly code: string;
+    abstract readonly statusCode: number;
+    constructor(message: string);
+    toJSON(): Record<string, unknown>;
+}
+/**
+ * Thrown when authentication fails (401).
+ * Examples: Invalid API key, expired token, missing credentials.
+ */
+export declare class AuthenticationError extends ZiftrError {
+    readonly code = "AUTHENTICATION_ERROR";
+    readonly statusCode = 401;
+}
+/**
+ * Thrown when authorization fails (403).
+ * Examples: Insufficient permissions, wrong tenant context.
+ */
+export declare class AuthorizationError extends ZiftrError {
+    readonly code = "AUTHORIZATION_ERROR";
+    readonly statusCode = 403;
+}
+/**
+ * Field-level validation error detail
+ */
+export interface FieldError {
+    field: string;
+    message: string;
+    code?: string;
+}
+/**
+ * Thrown when request validation fails (400).
+ * Includes field-level errors for form handling.
+ */
+export declare class ValidationError extends ZiftrError {
+    readonly code = "VALIDATION_ERROR";
+    readonly statusCode = 400;
+    readonly errors: FieldError[];
+    constructor(message: string, errors?: FieldError[]);
+    toJSON(): Record<string, unknown>;
+}
+/**
+ * Thrown when a resource is not found (404).
+ */
+export declare class NotFoundError extends ZiftrError {
+    readonly code = "NOT_FOUND";
+    readonly statusCode = 404;
+}
+/**
+ * Thrown when a request conflicts with current resource state (409).
+ * Examples: stale navigation revision (If-Match / expectedRevision mismatch).
+ */
+export declare class ConflictError extends ZiftrError {
+    readonly code = "CONFLICT";
+    readonly statusCode = 409;
+}
+/**
+ * Thrown when a conditional GET matches the current representation (304).
+ * Examples: public getNavigation with a matching If-None-Match ETag.
+ * This is a cache hit, not a failure -- catch it instead of treating as ApiError.
+ */
+export declare class NotModifiedError extends ZiftrError {
+    readonly code = "NOT_MODIFIED";
+    readonly statusCode = 304;
+}
+/**
+ * Thrown when rate limit is exceeded (429).
+ * Includes retryAfter in seconds.
+ */
+export declare class RateLimitError extends ZiftrError {
+    readonly code = "RATE_LIMIT_EXCEEDED";
+    readonly statusCode = 429;
+    readonly retryAfter: number;
+    constructor(message: string, retryAfter: number);
+    toJSON(): Record<string, unknown>;
+}
+/**
+ * Thrown when the SDK is constructed with invalid configuration
+ * (e.g. a secret key passed to a browser entry point). Client-side only;
+ * statusCode 0 because no request was made.
+ */
+export declare class ConfigurationError extends ZiftrError {
+    readonly code = "CONFIGURATION_ERROR";
+    readonly statusCode = 0;
+}
+/**
+ * Generic API error for unhandled status codes.
+ * Use when no specific error type matches.
+ */
+export declare class ApiError extends ZiftrError {
+    readonly code: string;
+    readonly statusCode: number;
+    readonly details?: unknown;
+    constructor(message: string, statusCode: number, code: string, details?: unknown);
+    toJSON(): Record<string, unknown>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/core/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/errors/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,8BAAsB,UAAW,SAAQ,KAAK;IAC5C,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEzB,OAAO,EAAE,MAAM;IAM3B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQlC;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;IACjD,QAAQ,CAAC,IAAI,0BAA0B;IACvC,QAAQ,CAAC,UAAU,OAAO;CAC3B;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,UAAU;IAChD,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,UAAU,OAAO;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,UAAU,OAAO;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;gBAElB,OAAO,EAAE,MAAM,EAAE,MAAM,GAAE,UAAU,EAAO;IAK7C,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG3C;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,UAAU;IAC3C,QAAQ,CAAC,IAAI,eAAe;IAC5B,QAAQ,CAAC,UAAU,OAAO;CAC3B;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,UAAU;IAC3C,QAAQ,CAAC,IAAI,cAAc;IAC3B,QAAQ,CAAC,UAAU,OAAO;CAC3B;AAED;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;IAC9C,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,UAAU,OAAO;CAC3B;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,UAAU;IAC5C,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,UAAU,OAAO;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;IAKtC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG3C;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,UAAU;IAChD,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,UAAU,KAAK;CACzB;AAED;;;GAGG;AACH,qBAAa,QAAS,SAAQ,UAAU;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;IAOvE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG3C"}

package/dist/core/errors/index.js

@@ -0,0 +1,119 @@
+/**
+ * Base error class for all Ziftr SDK errors.
+ * Provides consistent error structure with code, statusCode, and JSON serialization.
+ */
+export class ZiftrError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = this.constructor.name;
+        Error.captureStackTrace?.(this, this.constructor);
+    }
+    toJSON() {
+        return {
+            name: this.name,
+            code: this.code,
+            statusCode: this.statusCode,
+            message: this.message,
+        };
+    }
+}
+/**
+ * Thrown when authentication fails (401).
+ * Examples: Invalid API key, expired token, missing credentials.
+ */
+export class AuthenticationError extends ZiftrError {
+    code = 'AUTHENTICATION_ERROR';
+    statusCode = 401;
+}
+/**
+ * Thrown when authorization fails (403).
+ * Examples: Insufficient permissions, wrong tenant context.
+ */
+export class AuthorizationError extends ZiftrError {
+    code = 'AUTHORIZATION_ERROR';
+    statusCode = 403;
+}
+/**
+ * Thrown when request validation fails (400).
+ * Includes field-level errors for form handling.
+ */
+export class ValidationError extends ZiftrError {
+    code = 'VALIDATION_ERROR';
+    statusCode = 400;
+    errors;
+    constructor(message, errors = []) {
+        super(message);
+        this.errors = errors;
+    }
+    toJSON() {
+        return { ...super.toJSON(), errors: this.errors };
+    }
+}
+/**
+ * Thrown when a resource is not found (404).
+ */
+export class NotFoundError extends ZiftrError {
+    code = 'NOT_FOUND';
+    statusCode = 404;
+}
+/**
+ * Thrown when a request conflicts with current resource state (409).
+ * Examples: stale navigation revision (If-Match / expectedRevision mismatch).
+ */
+export class ConflictError extends ZiftrError {
+    code = 'CONFLICT';
+    statusCode = 409;
+}
+/**
+ * Thrown when a conditional GET matches the current representation (304).
+ * Examples: public getNavigation with a matching If-None-Match ETag.
+ * This is a cache hit, not a failure -- catch it instead of treating as ApiError.
+ */
+export class NotModifiedError extends ZiftrError {
+    code = 'NOT_MODIFIED';
+    statusCode = 304;
+}
+/**
+ * Thrown when rate limit is exceeded (429).
+ * Includes retryAfter in seconds.
+ */
+export class RateLimitError extends ZiftrError {
+    code = 'RATE_LIMIT_EXCEEDED';
+    statusCode = 429;
+    retryAfter;
+    constructor(message, retryAfter) {
+        super(message);
+        this.retryAfter = retryAfter;
+    }
+    toJSON() {
+        return { ...super.toJSON(), retryAfter: this.retryAfter };
+    }
+}
+/**
+ * Thrown when the SDK is constructed with invalid configuration
+ * (e.g. a secret key passed to a browser entry point). Client-side only;
+ * statusCode 0 because no request was made.
+ */
+export class ConfigurationError extends ZiftrError {
+    code = 'CONFIGURATION_ERROR';
+    statusCode = 0;
+}
+/**
+ * Generic API error for unhandled status codes.
+ * Use when no specific error type matches.
+ */
+export class ApiError extends ZiftrError {
+    code;
+    statusCode;
+    details;
+    constructor(message, statusCode, code, details) {
+        super(message);
+        this.statusCode = statusCode;
+        this.code = code;
+        this.details = details;
+    }
+    toJSON() {
+        return { ...super.toJSON(), details: this.details };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/core/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/errors/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAgB,UAAW,SAAQ,KAAK;IAI5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,KAAK,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IACxC,IAAI,GAAG,sBAAsB,CAAC;IAC9B,UAAU,GAAG,GAAG,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IACvC,IAAI,GAAG,qBAAqB,CAAC;IAC7B,UAAU,GAAG,GAAG,CAAC;CAC3B;AAWD;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,UAAU;IACpC,IAAI,GAAG,kBAAkB,CAAC;IAC1B,UAAU,GAAG,GAAG,CAAC;IACjB,MAAM,CAAe;IAE9B,YAAY,OAAe,EAAE,SAAuB,EAAE;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEQ,MAAM;QACb,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACpD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,UAAU;IAClC,IAAI,GAAG,WAAW,CAAC;IACnB,UAAU,GAAG,GAAG,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,OAAO,aAAc,SAAQ,UAAU;IAClC,IAAI,GAAG,UAAU,CAAC;IAClB,UAAU,GAAG,GAAG,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IACrC,IAAI,GAAG,cAAc,CAAC;IACtB,UAAU,GAAG,GAAG,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,UAAU;IACnC,IAAI,GAAG,qBAAqB,CAAC;IAC7B,UAAU,GAAG,GAAG,CAAC;IACjB,UAAU,CAAS;IAE5B,YAAY,OAAe,EAAE,UAAkB;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAEQ,MAAM;QACb,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IAC5D,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IACvC,IAAI,GAAG,qBAAqB,CAAC;IAC7B,UAAU,GAAG,CAAC,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,OAAO,QAAS,SAAQ,UAAU;IAC7B,IAAI,CAAS;IACb,UAAU,CAAS;IACnB,OAAO,CAAW;IAE3B,YAAY,OAAe,EAAE,UAAkB,EAAE,IAAY,EAAE,OAAiB;QAC9E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEQ,MAAM;QACb,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;CACF"}

package/dist/core/events/event-envelope.d.ts

@@ -0,0 +1,34 @@
+import type { DomainEventName } from './event-names.js';
+/**
+ * Consumer-facing event envelope for downstream services (analytics, audit, webhooks).
+ *
+ * Derived from the internal BaseOTELEvent wire format but flattened for consumer ergonomics:
+ * - `tenantId` flattened from `context.attributes['tenant.id']`
+ * - `traceId` flattened from `context.trace.traceId`
+ * - Internal OTEL fields (spanId, traceFlags, baggage, resource, semantic attributes) omitted
+ *
+ * @typeParam TPayload - The domain-specific event payload type. Defaults to a generic record.
+ */
+export interface BaseEventEnvelope<TPayload = Record<string, unknown>> {
+    /** Unique event identifier (UUID v4) */
+    eventId: string;
+    /** Canonical event name in dot notation (e.g., 'order.created') */
+    eventType: DomainEventName;
+    /** Event schema version (e.g., '1.0') */
+    eventVersion: string;
+    /** ISO 8601 timestamp of when the event was emitted */
+    timestamp: string;
+    /** Service that emitted the event (e.g., 'ziftr.core-api') */
+    source: string;
+    /** Tenant identifier -- always present for multi-tenant isolation */
+    tenantId: string;
+    /** Store identifier -- present when the event is scoped to a specific store */
+    storeId?: string;
+    /** User identifier -- present when the event was triggered by a user action */
+    userId?: string;
+    /** W3C trace ID for distributed tracing correlation */
+    traceId?: string;
+    /** Domain-specific event data */
+    payload: TPayload;
+}
+//# sourceMappingURL=event-envelope.d.ts.map

package/dist/core/events/event-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-envelope.d.ts","sourceRoot":"","sources":["../../../../../src/core/events/event-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,SAAS,EAAE,eAAe,CAAC;IAC3B,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,OAAO,EAAE,QAAQ,CAAC;CACnB"}