@aletheia-dev/api-client 0.1.0

package/dist/index.cjs

@@ -0,0 +1,948 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  ActorType: () => import_core9.ActorType,
+  AddListEntriesInput: () => import_core13.AddListEntriesInput,
+  AggregationPolicy: () => import_core13.AggregationPolicy,
+  ApiError: () => ApiError,
+  ApprovalCommentInput: () => import_core9.ApprovalCommentInput,
+  ApprovalDecision: () => import_core9.ApprovalDecision,
+  ApprovalOutcome: () => ApprovalOutcome,
+  AssignCaseInput: () => import_core11.AssignCaseInput,
+  AuditEvent: () => import_core9.AuditEvent,
+  AuditExportFormat: () => import_core9.AuditExportFormat,
+  AuditFilter: () => import_core9.AuditFilter,
+  Backtest: () => import_core13.Backtest,
+  BacktestProgress: () => import_core13.BacktestProgress,
+  BacktestSample: () => import_core13.BacktestSample,
+  BacktestSampleFailure: () => import_core13.BacktestSampleFailure,
+  BacktestStatus: () => import_core13.BacktestStatus,
+  BacktestSummary: () => import_core13.BacktestSummary,
+  Case: () => import_core11.Case,
+  CaseDetail: () => CaseDetail,
+  CaseFilter: () => import_core11.CaseFilter,
+  CaseNote: () => import_core11.CaseNote,
+  CaseNoteInput: () => import_core11.CaseNoteInput,
+  CasePriority: () => import_core11.CasePriority,
+  CaseQueue: () => import_core11.CaseQueue,
+  CaseQueueCount: () => CaseQueueCount,
+  CaseSlaState: () => import_core11.CaseSlaState,
+  CaseSort: () => import_core11.CaseSort,
+  CaseStatus: () => import_core11.CaseStatus,
+  CaseView: () => import_core11.CaseView,
+  CloseCaseInput: () => import_core11.CloseCaseInput,
+  Condition: () => import_core10.Condition,
+  ConditionOp: () => import_core10.ConditionOp,
+  CreateDocumentInput: () => import_core12.CreateDocumentInput,
+  CreatedSubmission: () => CreatedSubmission,
+  DEFINITION_PATHS: () => import_core9.DEFINITION_PATHS,
+  DOCUMENT_CONTENT_TYPES: () => import_core12.DOCUMENT_CONTENT_TYPES,
+  DOCUMENT_MAX_BYTES: () => import_core12.DOCUMENT_MAX_BYTES,
+  DOCUMENT_OPEN_STATUSES: () => import_core12.DOCUMENT_OPEN_STATUSES,
+  DecideCaseResult: () => DecideCaseResult,
+  DefinitionApproval: () => import_core9.DefinitionApproval,
+  DefinitionDiff: () => import_core9.DefinitionDiff,
+  DefinitionIssue: () => import_core10.DefinitionIssue,
+  DefinitionKind: () => import_core9.DefinitionKind,
+  DefinitionVersionSummary: () => import_core9.DefinitionVersionSummary,
+  DiffChange: () => import_core9.DiffChange,
+  DiffOp: () => import_core9.DiffOp,
+  DirectoryUser: () => import_core11.DirectoryUser,
+  Document: () => import_core12.Document,
+  DocumentContentType: () => import_core12.DocumentContentType,
+  DocumentDownload: () => import_core12.DocumentDownload,
+  DocumentPollTimeoutError: () => DocumentPollTimeoutError,
+  DocumentScan: () => import_core12.DocumentScan,
+  DocumentStatus: () => import_core12.DocumentStatus,
+  DocumentUploadTicket: () => import_core12.DocumentUploadTicket,
+  DryRunResult: () => DryRunResult,
+  Event: () => import_core13.Event,
+  EventKey: () => import_core13.EventKey,
+  FORBIDDEN_CODES: () => FORBIDDEN_CODES,
+  FieldTypeDescription: () => import_core10.FieldTypeDescription,
+  FileFieldValue: () => import_core12.FileFieldValue,
+  FormUiHints: () => import_core10.FormUiHints,
+  HealthStatus: () => HealthStatus,
+  IngestEventsInput: () => import_core13.IngestEventsInput,
+  IngestEventsResult: () => import_core13.IngestEventsResult,
+  IssueSeverity: () => import_core10.IssueSeverity,
+  List: () => import_core13.List,
+  ListEntry: () => import_core13.ListEntry,
+  ListImportResult: () => import_core13.ListImportResult,
+  ListKind: () => import_core13.ListKind,
+  Me: () => Me,
+  MePrincipal: () => MePrincipal,
+  NewEvent: () => import_core13.NewEvent,
+  NewListEntry: () => import_core13.NewListEntry,
+  PluginSummary: () => PluginSummary,
+  RUNTIME_CONFIG_PATH: () => RUNTIME_CONFIG_PATH,
+  ReadyStatus: () => ReadyStatus,
+  RemoveListEntriesInput: () => import_core13.RemoveListEntriesInput,
+  RemovedCount: () => RemovedCount,
+  RuleSetBody: () => import_core13.RuleSetBody,
+  RuleSetDefinition: () => import_core13.RuleSetDefinition,
+  RuleSetRule: () => import_core13.RuleSetRule,
+  RuleSetUseCase: () => import_core13.RuleSetUseCase,
+  RuleTypeDescription: () => RuleTypeDescription,
+  RuleUiHints: () => RuleUiHints,
+  RuntimeConfig: () => RuntimeConfig,
+  ScoreBand: () => import_core13.ScoreBand,
+  ScoreClamp: () => import_core13.ScoreClamp,
+  SortOrder: () => import_core11.SortOrder,
+  StartBacktestInput: () => import_core13.StartBacktestInput,
+  StepTypeDescription: () => import_core10.StepTypeDescription,
+  Subject: () => import_core15.Subject,
+  SubjectKind: () => import_core15.SubjectKind,
+  SubjectListQuery: () => import_core15.SubjectListQuery,
+  SubjectStatus: () => import_core15.SubjectStatus,
+  SubmissionDetail: () => SubmissionDetail,
+  SubmissionEmbed: () => SubmissionEmbed,
+  SubmissionStatus: () => SubmissionStatus,
+  TenantSettings: () => import_core14.TenantSettings,
+  TimelineEntry: () => import_core15.TimelineEntry,
+  TimelineKind: () => import_core15.TimelineKind,
+  TimelineQuery: () => import_core15.TimelineQuery,
+  UploadError: () => UploadError,
+  UpsertCaseQueueInput: () => import_core11.UpsertCaseQueueInput,
+  UpsertListInput: () => import_core13.UpsertListInput,
+  UpsertRuleSetInput: () => import_core13.UpsertRuleSetInput,
+  ValidationReport: () => import_core10.ValidationReport,
+  WebOrigin: () => import_core14.WebOrigin,
+  auditFilterParams: () => auditFilterParams,
+  bandFor: () => import_core13.bandFor,
+  caseListParams: () => caseListParams,
+  caseSlaState: () => import_core11.caseSlaState,
+  checkFileBeforeUpload: () => checkFileBeforeUpload,
+  createApiClient: () => createApiClient,
+  isApiError: () => isApiError,
+  isApiErrorBody: () => isApiErrorBody,
+  isForbidden: () => isForbidden,
+  isTenantNotProvisioned: () => isTenantNotProvisioned,
+  isTerminalDocumentStatus: () => isTerminalDocumentStatus,
+  isUnauthenticated: () => isUnauthenticated,
+  loadRuntimeConfig: () => loadRuntimeConfig,
+  normalizeListValue: () => import_core13.normalizeListValue,
+  pollDocument: () => pollDocument,
+  resolveConfig: () => resolveConfig,
+  uploadToStorage: () => uploadToStorage,
+  verifyExport: () => verifyExport
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/errors.ts
+var ApiError = class _ApiError extends Error {
+  constructor(message, status, code, details) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.name = "ApiError";
+  }
+  status;
+  code;
+  details;
+  /** Builds an ApiError from a response status and its (possibly non-JSON) body. */
+  static fromResponse(status, statusText, body) {
+    if (isApiErrorBody(body)) {
+      return new _ApiError(body.error.message, status, body.error.code, body.error.details);
+    }
+    const message = statusText ? `HTTP ${status} ${statusText}` : `HTTP ${status}`;
+    return new _ApiError(message, status, "http_error", body);
+  }
+};
+function isApiErrorBody(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const error = value.error;
+  if (typeof error !== "object" || error === null) return false;
+  const { code, message } = error;
+  return typeof code === "string" && typeof message === "string";
+}
+function isApiError(value) {
+  return value instanceof ApiError;
+}
+function isUnauthenticated(value) {
+  return isApiError(value) && value.code === "unauthenticated";
+}
+var FORBIDDEN_CODES = ["forbidden", "tenant_not_provisioned"];
+function isForbidden(value) {
+  return isApiError(value) && FORBIDDEN_CODES.includes(value.code);
+}
+function isTenantNotProvisioned(value) {
+  return isApiError(value) && value.code === "tenant_not_provisioned";
+}
+
+// src/audit.ts
+var import_core = require("@aletheia-dev/core");
+var import_zod = require("zod");
+
+// src/http.ts
+function buildUrl(baseUrl, path, query) {
+  const url = `${baseUrl}${path}`;
+  if (!query) return url;
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value === void 0 || value === null || value === "") continue;
+    if (typeof value === "object") {
+      for (const item of value) params.append(key, item);
+      continue;
+    }
+    params.set(key, String(value));
+  }
+  const qs = params.toString();
+  return qs ? `${url}?${qs}` : url;
+}
+async function readBody(response) {
+  const text = await response.text();
+  if (!text) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+var Http = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  async request(path, options = {}) {
+    const { baseUrl, getAccessToken, fetch: fetch2 } = this.options;
+    const method = options.method ?? "GET";
+    const headers = { accept: "application/json" };
+    const token = await getAccessToken();
+    if (token) headers.authorization = `Bearer ${token}`;
+    const init = { method, headers };
+    if (options.raw !== void 0) {
+      headers["content-type"] = options.raw.contentType;
+      init.body = options.raw.content;
+    } else if (options.body !== void 0) {
+      headers["content-type"] = "application/json";
+      init.body = JSON.stringify(options.body);
+    }
+    const response = await fetch2(buildUrl(baseUrl, path, options.query), init);
+    const body = await readBody(response);
+    if (!response.ok) {
+      throw ApiError.fromResponse(response.status, response.statusText, body);
+    }
+    return body;
+  }
+  /** Requests and parses the body with `schema` (dates are coerced by the core schemas). */
+  async parsed(schema, path, options) {
+    const body = await this.request(path, options);
+    return schema.parse(body);
+  }
+};
+function encodeSegment(value) {
+  return encodeURIComponent(value);
+}
+
+// src/audit.ts
+var AuditEventList = import_zod.z.object({ items: import_zod.z.array(import_core.AuditEvent) });
+function isoOf(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+function auditFilterParams(filter = {}) {
+  return {
+    action: filter.action,
+    actorId: filter.actorId,
+    actorType: filter.actorType,
+    resourceType: filter.resourceType,
+    resourceId: filter.resourceId,
+    from: isoOf(filter.from),
+    to: isoOf(filter.to)
+  };
+}
+function auditDomain(http, transport) {
+  const exportUrl = (format, filter) => buildUrl(transport.baseUrl, "/audit-events/export", {
+    format,
+    ...auditFilterParams(filter)
+  });
+  return {
+    list: async (query = {}) => {
+      const { limit, offset, ...filter } = query;
+      const body = await http.parsed(AuditEventList, "/audit-events", {
+        query: { ...auditFilterParams(filter), limit, offset }
+      });
+      return body.items;
+    },
+    exportUrl,
+    export: async (format, filter) => {
+      const headers = { accept: "*/*" };
+      const token = await transport.getAccessToken();
+      if (token) headers.authorization = `Bearer ${token}`;
+      const response = await transport.fetch(exportUrl(format, filter), {
+        method: "GET",
+        headers
+      });
+      if (!response.ok) {
+        const text = await response.text();
+        let body = text || void 0;
+        try {
+          body = text ? JSON.parse(text) : void 0;
+        } catch {
+        }
+        throw ApiError.fromResponse(response.status, response.statusText, body);
+      }
+      return response.blob();
+    }
+  };
+}
+var CSV_MANIFEST = /^#\s*sha256=([0-9a-fA-F]+)\s+rows=(\d+)\s*$/;
+var JsonlManifest = import_zod.z.object({
+  _manifest: import_zod.z.object({ sha256: import_zod.z.string(), rows: import_zod.z.coerce.number().int().nonnegative() })
+});
+function parseManifest(line, format) {
+  const trimmed = line.replace(/\r$/, "");
+  if (format === "csv") {
+    const match = CSV_MANIFEST.exec(trimmed);
+    return match ? { sha256: match[1].toLowerCase(), rows: Number(match[2]) } : void 0;
+  }
+  try {
+    const parsed = JsonlManifest.safeParse(JSON.parse(trimmed));
+    if (!parsed.success) return void 0;
+    return { sha256: parsed.data._manifest.sha256.toLowerCase(), rows: parsed.data._manifest.rows };
+  } catch {
+    return void 0;
+  }
+}
+async function sha256Hex(text) {
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function verifyExport(text, format) {
+  const content = text.endsWith("\n") ? text.slice(0, -1) : text;
+  const cut = content.lastIndexOf("\n");
+  const body = cut === -1 ? "" : content.slice(0, cut + 1);
+  const manifest = parseManifest(content.slice(cut + 1), format);
+  if (!manifest) {
+    return { ok: false, rows: 0, actual: await sha256Hex(text) };
+  }
+  const actual = await sha256Hex(body);
+  return { ok: actual === manifest.sha256, rows: manifest.rows, expected: manifest.sha256, actual };
+}
+
+// src/governance.ts
+var import_core2 = require("@aletheia-dev/core");
+var import_zod2 = require("zod");
+var itemsOf = (item) => import_zod2.z.union([import_zod2.z.object({ items: import_zod2.z.array(item) }).transform((body) => body.items), import_zod2.z.array(item)]);
+var ApprovalOutcome = import_zod2.z.object({
+  approval: import_core2.DefinitionApproval,
+  definition: import_zod2.z.unknown()
+});
+function definitionPath(kind, key) {
+  return `${import_core2.DEFINITION_PATHS[kind]}/${encodeSegment(key)}`;
+}
+function versionPath(kind, key, version) {
+  return `${definitionPath(kind, key)}/versions/${encodeSegment(String(version))}`;
+}
+function governanceDomain(http) {
+  return {
+    versions: (kind, key) => http.parsed(itemsOf(import_core2.DefinitionVersionSummary), `${definitionPath(kind, key)}/versions`),
+    getVersion: (kind, key, version) => http.request(versionPath(kind, key, version)),
+    diff: (kind, key, query = {}) => http.parsed(import_core2.DefinitionDiff, `${definitionPath(kind, key)}/diff`, {
+      query: { from: query.from, to: query.to }
+    }),
+    requestApproval: (kind, key, version, body = {}) => http.parsed(import_core2.DefinitionApproval, `${versionPath(kind, key, version)}/request-approval`, {
+      method: "POST",
+      body
+    }),
+    approve: (kind, key, version, body = {}) => http.parsed(ApprovalOutcome, `${versionPath(kind, key, version)}/approve`, {
+      method: "POST",
+      body
+    }),
+    reject: (kind, key, version, body = {}) => http.parsed(ApprovalOutcome, `${versionPath(kind, key, version)}/reject`, {
+      method: "POST",
+      body
+    }),
+    approvals: {
+      listOpen: (query = {}) => http.parsed(itemsOf(import_core2.DefinitionApproval), "/approvals", { query: { kind: query.kind } })
+    }
+  };
+}
+
+// src/index.ts
+var import_core9 = require("@aletheia-dev/core");
+var import_core10 = require("@aletheia-dev/core");
+
+// src/cases.ts
+var import_core3 = require("@aletheia-dev/core");
+var import_zod3 = require("zod");
+var CaseDetail = import_zod3.z.object({
+  case: import_core3.CaseView,
+  subject: import_core3.Subject,
+  run: import_core3.WorkflowRun.nullable(),
+  decisions: import_zod3.z.array(import_core3.Decision)
+});
+var DecideCaseResult = import_zod3.z.object({ case: import_core3.Case, decision: import_core3.Decision });
+var CaseQueueCount = import_zod3.z.object({
+  queueId: import_zod3.z.string(),
+  count: import_zod3.z.number().int().nonnegative()
+});
+var listOf = (item) => import_zod3.z.object({ items: import_zod3.z.array(item) });
+function arrayOf(value) {
+  if (value === void 0) return void 0;
+  return Array.isArray(value) ? value : [value];
+}
+function isoOf2(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+function caseListParams(query) {
+  return {
+    status: arrayOf(query.status),
+    priority: arrayOf(query.priority),
+    assignee: query.assignee,
+    type: query.type,
+    subjectId: query.subjectId,
+    slaState: arrayOf(query.slaState),
+    dueBefore: isoOf2(query.dueBefore),
+    search: query.search,
+    sort: query.sort,
+    order: query.order,
+    limit: query.limit,
+    offset: query.offset
+  };
+}
+function casesDomain(http) {
+  const casePath = (id, suffix = "") => `/cases/${encodeSegment(id)}${suffix}`;
+  const notePath = (id, noteId) => casePath(id, `/notes/${encodeSegment(noteId)}`);
+  const post = (path, body) => http.parsed(import_core3.CaseView, path, body === void 0 ? { method: "POST" } : { method: "POST", body });
+  return {
+    /** Cases matching `query`, in the requested order (`createdAt` desc by default). */
+    list: async (query = {}) => (await http.parsed(listOf(import_core3.CaseView), "/cases", { query: caseListParams(query) })).items,
+    get: (id) => http.parsed(CaseDetail, casePath(id)),
+    decide: (id, body) => http.parsed(DecideCaseResult, casePath(id, "/decide"), { method: "POST", body }),
+    /** Sets or clears (`assigneeId: null`) the assignee (`cases:assign`). */
+    assign: (id, body) => post(casePath(id, "/assign"), body),
+    /** Assigns the case to the caller (`cases:claim`). */
+    claim: (id) => post(casePath(id, "/claim")),
+    /**
+     * Closes the case (`cases:decide`). An undecided case gets a `reject` decision with reason
+     * code `case_closed` so its workflow run does not wait forever.
+     */
+    close: (id, body = {}) => post(casePath(id, "/close"), body),
+    /** Analyst notes on a case (`cases:notes`); edits and deletes are limited to the author or an admin. */
+    notes: {
+      list: async (id) => (await http.parsed(listOf(import_core3.CaseNote), casePath(id, "/notes"))).items,
+      create: (id, body) => http.parsed(import_core3.CaseNote, casePath(id, "/notes"), { method: "POST", body }),
+      update: (id, noteId, body) => http.parsed(import_core3.CaseNote, notePath(id, noteId), { method: "PATCH", body }),
+      remove: async (id, noteId) => {
+        await http.request(notePath(id, noteId), { method: "DELETE" });
+      }
+    }
+  };
+}
+function caseQueuesDomain(http) {
+  const queuePath = (id) => `/case-queues/${encodeSegment(id)}`;
+  return {
+    list: async () => (await http.parsed(listOf(import_core3.CaseQueue), "/case-queues")).items,
+    counts: async () => (await http.parsed(listOf(CaseQueueCount), "/case-queues/counts")).items,
+    create: (body) => http.parsed(import_core3.CaseQueue, "/case-queues", { method: "POST", body }),
+    update: (id, body) => http.parsed(import_core3.CaseQueue, queuePath(id), { method: "PUT", body }),
+    remove: async (id) => {
+      await http.request(queuePath(id), { method: "DELETE" });
+    }
+  };
+}
+function usersDomain(http) {
+  return {
+    list: async (query = {}) => (await http.parsed(listOf(import_core3.DirectoryUser), "/users", { query: { role: query.role } })).items
+  };
+}
+
+// src/index.ts
+var import_core11 = require("@aletheia-dev/core");
+
+// src/documents.ts
+var import_core4 = require("@aletheia-dev/core");
+var import_zod4 = require("zod");
+var DocumentList = import_zod4.z.object({ items: import_zod4.z.array(import_core4.Document) });
+function documentsDomain(http) {
+  const idPath = (id, suffix = "") => `/documents/${encodeSegment(id)}${suffix}`;
+  return {
+    /**
+     * Registers a pending document and returns the presigned POST to send the bytes with
+     * (`uploadToStorage`). Applicants pass their `submissionId` and the `fieldKey`.
+     */
+    create: (input) => http.parsed(import_core4.DocumentUploadTicket, "/documents", { method: "POST", body: input }),
+    /**
+     * Verifies the uploaded object and starts the scan. Resolves with status `uploaded` or
+     * `rejected` (see `rejectionReason`); throws a 409 `ApiError` when nothing was uploaded.
+     */
+    finalize: (id, opts = {}) => http.parsed(import_core4.Document, idPath(id, "/finalize"), { method: "POST", query: { ...opts } }),
+    get: (id, opts = {}) => http.parsed(import_core4.Document, idPath(id), { query: { ...opts } }),
+    list: (filters = {}) => http.parsed(DocumentList, "/documents", { query: { ...filters } }),
+    /** A 60-second presigned GET on the storage origin; open it directly, never via the API. */
+    download: (id, opts = {}) => http.parsed(import_core4.DocumentDownload, idPath(id, "/download"), { query: { ...opts } })
+  };
+}
+var UploadError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "UploadError";
+  }
+  status;
+};
+function defaultXhr() {
+  const ctor = globalThis.XMLHttpRequest;
+  if (!ctor) throw new UploadError("XMLHttpRequest is not available in this environment", 0);
+  return new ctor();
+}
+function uploadToStorage(ticket, file, opts = {}) {
+  return new Promise((resolve, reject) => {
+    if (opts.signal?.aborted) {
+      reject(new UploadError("Upload aborted", 0));
+      return;
+    }
+    const xhr = (opts.xhr ?? defaultXhr)();
+    const form = new FormData();
+    for (const [name, value] of Object.entries(ticket.upload.fields)) form.append(name, value);
+    form.append("file", file);
+    const onAbort = () => xhr.abort();
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    const settle = (fn) => {
+      opts.signal?.removeEventListener("abort", onAbort);
+      fn();
+    };
+    xhr.upload.addEventListener("progress", (event) => {
+      if (event.lengthComputable && event.total > 0) {
+        opts.onProgress?.(Math.min(1, event.loaded / event.total));
+      }
+    });
+    xhr.addEventListener(
+      "load",
+      () => settle(() => {
+        if (xhr.status >= 200 && xhr.status < 300) {
+          opts.onProgress?.(1);
+          resolve();
+        } else {
+          reject(new UploadError(`Storage refused the upload (HTTP ${xhr.status})`, xhr.status));
+        }
+      })
+    );
+    xhr.addEventListener(
+      "error",
+      () => settle(() => reject(new UploadError("Network error while uploading the file", 0)))
+    );
+    xhr.addEventListener("abort", () => settle(() => reject(new UploadError("Upload aborted", 0))));
+    xhr.addEventListener(
+      "timeout",
+      () => settle(() => reject(new UploadError("The upload timed out", 0)))
+    );
+    xhr.open("POST", ticket.upload.url);
+    xhr.send(form);
+  });
+}
+var TYPE_LABELS = "JPEG, PNG, WebP or PDF";
+function checkFileBeforeUpload(file) {
+  if (!file.name.trim()) return { ok: false, reason: "The file has no name." };
+  if (!import_core4.DOCUMENT_CONTENT_TYPES.includes(file.type)) {
+    const got = file.type || "unknown type";
+    return { ok: false, reason: `Only ${TYPE_LABELS} files are accepted (this is ${got}).` };
+  }
+  if (file.size < 1) return { ok: false, reason: "The file is empty." };
+  if (file.size > import_core4.DOCUMENT_MAX_BYTES) {
+    const mib = Math.round(import_core4.DOCUMENT_MAX_BYTES / (1024 * 1024));
+    return { ok: false, reason: `The file is larger than ${mib} MiB.` };
+  }
+  return { ok: true };
+}
+var DocumentPollTimeoutError = class extends Error {
+  constructor(documentId) {
+    super("Timed out waiting for the document scan to finish");
+    this.documentId = documentId;
+    this.name = "DocumentPollTimeoutError";
+  }
+  documentId;
+};
+function isTerminalDocumentStatus(status) {
+  return !import_core4.DOCUMENT_OPEN_STATUSES.includes(status);
+}
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    function onAbort() {
+      clearTimeout(timer);
+      reject(new Error("Polling aborted"));
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function pollDocument(client, id, opts = {}) {
+  const { intervalMs = 750, timeoutMs = 6e4, signal, submissionId } = opts;
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    const document = await client.documents.get(id, { submissionId });
+    if (isTerminalDocumentStatus(document.status)) return document;
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw new DocumentPollTimeoutError(id);
+    await sleep(Math.min(intervalMs, remaining), signal);
+  }
+}
+
+// src/index.ts
+var import_core12 = require("@aletheia-dev/core");
+var import_core13 = require("@aletheia-dev/core");
+var import_core14 = require("@aletheia-dev/core");
+var import_core15 = require("@aletheia-dev/core");
+
+// src/client.ts
+var import_zod7 = require("zod");
+var import_core8 = require("@aletheia-dev/core");
+
+// src/builder.ts
+var import_core5 = require("@aletheia-dev/core");
+var import_zod5 = require("zod");
+var itemsOf2 = (item) => import_zod5.z.object({ items: import_zod5.z.array(item) });
+function builderDomain(http) {
+  return {
+    stepTypes: async () => (await http.parsed(itemsOf2(import_core5.StepTypeDescription), "/workflow-step-types")).items,
+    fieldTypes: async () => (await http.parsed(itemsOf2(import_core5.FieldTypeDescription), "/collection-field-types")).items
+  };
+}
+function validateCall(http, path) {
+  return (body) => http.parsed(import_core5.ValidationReport, `${path}/validate`, { method: "POST", body });
+}
+
+// src/tenants.ts
+var import_core6 = require("@aletheia-dev/core");
+function tenantsDomain(http) {
+  return {
+    getSettings: () => http.parsed(import_core6.TenantSettings, "/tenants/me/settings"),
+    updateSettings: (body) => http.parsed(import_core6.TenantSettings, "/tenants/me/settings", { method: "PUT", body })
+  };
+}
+
+// src/workflow-runs.ts
+var import_core7 = require("@aletheia-dev/core");
+var import_zod6 = require("zod");
+var RunList = import_zod6.z.object({ items: import_zod6.z.array(import_core7.WorkflowRun) });
+function workflowRunsDomain(http) {
+  return {
+    start: (body) => http.parsed(import_core7.WorkflowRun, "/workflow-runs", { method: "POST", body }),
+    get: (id) => http.parsed(import_core7.WorkflowRun, `/workflow-runs/${encodeSegment(id)}`),
+    listBySubject: async (subjectId) => (await http.parsed(RunList, "/workflow-runs", { query: { subjectId } })).items,
+    history: (id) => http.request(`/workflow-runs/${encodeSegment(id)}/history`)
+  };
+}
+
+// src/client.ts
+var HealthStatus = import_zod7.z.object({ status: import_zod7.z.literal("ok") });
+var MePrincipal = import_zod7.z.object({
+  kind: import_zod7.z.enum(["human", "machine", "applicant"]),
+  subject: import_zod7.z.string(),
+  name: import_zod7.z.string().optional(),
+  email: import_zod7.z.string().optional()
+});
+var Me = import_zod7.z.object({
+  principal: MePrincipal,
+  tenantId: import_zod7.z.string(),
+  orgId: import_zod7.z.string().optional(),
+  permissions: import_zod7.z.array(import_zod7.z.string())
+});
+var CheckStatus = import_zod7.z.enum(["ok", "error"]);
+var ReadyStatus = import_zod7.z.object({
+  status: import_zod7.z.enum(["ok", "degraded"]),
+  checks: import_zod7.z.object({ db: CheckStatus, temporal: CheckStatus })
+});
+var PluginSummary = import_zod7.z.object({
+  name: import_zod7.z.string(),
+  version: import_zod7.z.string(),
+  description: import_zod7.z.string().optional(),
+  capabilities: import_zod7.z.array(import_zod7.z.string()),
+  secrets: import_zod7.z.array(import_zod7.z.string()),
+  actions: import_zod7.z.array(import_zod7.z.string()),
+  configSchema: import_zod7.z.unknown()
+});
+var RuleUiHints = import_zod7.z.object({
+  /** Config fields in display order; unlisted fields follow in schema order. */
+  fieldOrder: import_zod7.z.array(import_zod7.z.string()).optional(),
+  labels: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.string()).optional(),
+  help: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.string()).optional(),
+  /** Config fields that hold a list key; the builder renders a list picker for them. */
+  listPicker: import_zod7.z.array(import_zod7.z.string()).optional()
+});
+var RuleTypeDescription = import_zod7.z.object({
+  type: import_core8.RuleType,
+  description: import_zod7.z.string(),
+  /** JSON Schema of the rule config, produced by `z.toJSONSchema` on the API. */
+  configSchema: import_zod7.z.unknown(),
+  /** Dot-path namespaces a rule config may reference, e.g. `subject.<field>`. */
+  dataPaths: import_zod7.z.array(import_zod7.z.string()).default([]),
+  uiHints: RuleUiHints.optional()
+});
+var DryRunResult = import_zod7.z.object({
+  result: import_core8.RuleEvaluationResult,
+  rule: import_zod7.z.object({
+    key: import_zod7.z.string(),
+    version: import_zod7.z.number().int(),
+    status: import_core8.DefinitionStatus,
+    type: import_core8.RuleType
+  }),
+  /** Data namespaces the rule may reference, a hint for composing inline test data. */
+  dataPaths: import_zod7.z.array(import_zod7.z.string()).default([])
+});
+var RemovedCount = import_zod7.z.object({ removed: import_zod7.z.number().int().nonnegative() });
+var SubmissionDetail = import_zod7.z.object({
+  submission: import_core8.CollectionSubmission,
+  flow: import_core8.CollectionFlowDefinition
+});
+var SubmissionStatus = import_zod7.z.object({
+  submission: import_zod7.z.object({
+    id: import_core8.Id,
+    status: import_core8.SubmissionStatus,
+    submittedAt: import_zod7.z.coerce.date().nullable()
+  }),
+  run: import_zod7.z.object({
+    id: import_core8.Id,
+    status: import_core8.WorkflowRunStatus,
+    currentStepId: import_zod7.z.string().nullable(),
+    decision: import_zod7.z.object({ outcome: import_core8.DecisionOutcome }).nullable()
+  }).nullable()
+});
+var CreatedSubmission = import_zod7.z.object({
+  submission: import_core8.CollectionSubmission,
+  link: import_zod7.z.string().nullable()
+});
+var SubmissionEmbed = import_zod7.z.object({
+  embedOrigins: import_zod7.z.array(import_zod7.z.string()),
+  flowName: import_zod7.z.string()
+});
+var listOf2 = (item) => import_zod7.z.object({ items: import_zod7.z.array(item) });
+function isoOf3(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+function timelineParams(query) {
+  return {
+    from: isoOf3(query.from),
+    to: isoOf3(query.to),
+    kinds: query.kinds,
+    limit: query.limit,
+    offset: query.offset
+  };
+}
+function createApiClient(options) {
+  const fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+  const transport = {
+    baseUrl: options.baseUrl.replace(/\/+$/, ""),
+    getAccessToken: options.getAccessToken,
+    fetch: fetchImpl
+  };
+  const http = new Http(transport);
+  const audit = auditDomain(http, transport);
+  const list = async (item, path, query) => (await http.parsed(listOf2(item), path, { query })).items;
+  const definitions = (entity, path) => ({
+    list: () => list(entity, path),
+    get: (key) => http.parsed(entity, `${path}/${encodeSegment(key)}`),
+    upsert: (key, body) => http.parsed(entity, `${path}/${encodeSegment(key)}`, { method: "PUT", body }),
+    publish: (key) => http.parsed(entity, `${path}/${encodeSegment(key)}/publish`, { method: "POST" })
+  });
+  return {
+    health: {
+      check: () => http.parsed(HealthStatus, "/health"),
+      ready: () => http.parsed(ReadyStatus, "/health/ready")
+    },
+    /** The caller's principal, tenant and permissions as the API sees the bearer token. */
+    me: () => http.parsed(Me, "/me"),
+    subjects: {
+      create: (body) => http.parsed(import_core8.Subject, "/subjects", { method: "POST", body }),
+      /**
+       * Subjects matching `query`: `search` matches the external id and `data.name` /
+       * `data.legalName`; `riskScoreMin`/`riskScoreMax` bound the risk score (`subjects:read`).
+       */
+      list: (query = {}) => list(import_core8.Subject, "/subjects", query),
+      get: (id) => http.parsed(import_core8.Subject, `/subjects/${encodeSegment(id)}`),
+      /**
+       * The subject's history, newest first (`subjects:read`). Entries of kinds the caller may
+       * not read are omitted by the API; page with `offset`.
+       */
+      timeline: (id, query = {}) => list(import_core8.TimelineEntry, `/subjects/${encodeSegment(id)}/timeline`, timelineParams(query))
+    },
+    workflowRuns: workflowRunsDomain(http),
+    /** Review cases: filtered lists, detail, decide, assign/claim/close and notes. See `cases.ts`. */
+    cases: casesDomain(http),
+    /** Saved case filters shown in the workbench rail, with live counts. */
+    caseQueues: caseQueuesDomain(http),
+    /** The reviewer directory, for assignment and resolving assignee names. */
+    users: usersDomain(http),
+    workflowDefinitions: {
+      ...definitions(
+        import_core8.WorkflowDefinition,
+        "/workflow-definitions"
+      ),
+      /** Validates a draft body without saving; issues carry step ids. */
+      validate: validateCall(http, "/workflow-definitions")
+    },
+    /** Step and field type schemas behind the builder's forms. */
+    builder: builderDomain(http),
+    ruleDefinitions: {
+      ...definitions(
+        import_core8.RuleDefinition,
+        "/rule-definitions"
+      ),
+      /** Evaluates one rule version against a subject or inline data; nothing is recorded. */
+      dryRun: (key, body) => http.parsed(DryRunResult, `/rule-definitions/${encodeSegment(key)}/dry-run`, {
+        method: "POST",
+        body
+      })
+    },
+    ruleTypes: {
+      list: () => list(RuleTypeDescription, "/rule-types")
+    },
+    /** Versioned, ordered groups of rules with an aggregation policy (`/rule-sets`). */
+    ruleSets: definitions(
+      import_core8.RuleSetDefinition,
+      "/rule-sets"
+    ),
+    collectionFlows: {
+      ...definitions(
+        import_core8.CollectionFlowDefinition,
+        "/collection-flows"
+      ),
+      /** Validates a draft flow body without saving; issues carry step / field keys. */
+      validate: validateCall(http, "/collection-flows")
+    },
+    collectionSubmissions: {
+      /** Creates the submission and returns the applicant link alongside it. */
+      create: (body) => http.parsed(CreatedSubmission, "/collection-submissions", { method: "POST", body }),
+      get: (id) => http.parsed(SubmissionDetail, `/collection-submissions/${encodeSegment(id)}`),
+      save: (id, body) => http.parsed(import_core8.CollectionSubmission, `/collection-submissions/${encodeSegment(id)}`, {
+        method: "PATCH",
+        body
+      }),
+      submit: (id) => http.parsed(import_core8.CollectionSubmission, `/collection-submissions/${encodeSegment(id)}/submit`, {
+        method: "POST"
+      }),
+      /** Where the submission's workflow run is; readable with the applicant's token. */
+      status: (id) => http.parsed(SubmissionStatus, `/collection-submissions/${encodeSegment(id)}/status`),
+      /** Embed allow-list and flow name for the submission; readable with the applicant's token. */
+      embed: (id) => http.parsed(SubmissionEmbed, `/collection-submissions/${encodeSegment(id)}/embed`)
+    },
+    /** Subject events: the facts velocity rules aggregate over. */
+    events: {
+      /** Inserts events; re-sent idempotency keys are counted as `duplicates`, not errors. */
+      ingest: (body) => http.parsed(import_core8.IngestEventsResult, "/events", { method: "POST", body }),
+      /** Newest first. */
+      list: (query = {}) => list(import_core8.Event, "/events", { ...query, from: isoOf3(query.from), to: isoOf3(query.to) })
+    },
+    /**
+     * Replays recorded evaluations against a rule version (`backtests:run`). `start` returns the
+     * queued job; poll `get` until its status is `completed` (with `summary`) or `failed`.
+     */
+    backtests: {
+      start: (body) => http.parsed(import_core8.Backtest, "/backtests", { method: "POST", body }),
+      /** Newest first. */
+      list: (query = {}) => list(import_core8.Backtest, "/backtests", query),
+      get: (id) => http.parsed(import_core8.Backtest, `/backtests/${encodeSegment(id)}`)
+    },
+    decisions: {
+      listBySubject: (subjectId) => list(import_core8.Decision, "/decisions", { subjectId })
+    },
+    /** Filtered audit trail, exports and manifest verification (`audit:read`). See `audit.ts`. */
+    audit,
+    /** @deprecated Alias of `audit`, kept for existing callers. */
+    auditEvents: {
+      list: (query = {}) => audit.list(query)
+    },
+    /** Version history, diffs and the approval workflow of definitions. See `governance.ts`. */
+    governance: governanceDomain(http),
+    plugins: {
+      list: () => list(import_core8.PluginDefinition, "/plugins"),
+      available: () => list(PluginSummary, "/plugins/available"),
+      configure: (name, body) => http.parsed(import_core8.PluginDefinition, `/plugins/${encodeSegment(name)}`, { method: "PUT", body })
+    },
+    pluginInvocations: {
+      list: (query = {}) => list(import_core8.PluginInvocation, "/plugin-invocations", query)
+    },
+    /**
+     * Uploaded files: `create` -> `uploadToStorage` (helper) -> `finalize` -> `pollDocument`
+     * (helper) until the scan settles. See `documents.ts`.
+     */
+    documents: documentsDomain(http),
+    /** Tenant settings such as the embed origin allow-list (`tenants:settings`). */
+    tenants: tenantsDomain(http),
+    /** Tenant lists (blocklists / allowlists) and their entries. Lists are keyed, not versioned. */
+    lists: {
+      list: () => list(import_core8.List, "/lists"),
+      get: (key) => http.parsed(import_core8.List, `/lists/${encodeSegment(key)}`),
+      /** Creates the list or updates its metadata; entries are untouched. */
+      upsert: (key, body) => http.parsed(import_core8.List, `/lists/${encodeSegment(key)}`, { method: "PUT", body }),
+      remove: async (key) => {
+        await http.request(`/lists/${encodeSegment(key)}`, { method: "DELETE" });
+      },
+      entries: (key, query = {}) => list(import_core8.ListEntry, `/lists/${encodeSegment(key)}/entries`, query),
+      addEntries: (key, body) => http.parsed(import_core8.ListImportResult, `/lists/${encodeSegment(key)}/entries`, {
+        method: "POST",
+        body
+      }),
+      removeEntries: (key, body) => http.parsed(RemovedCount, `/lists/${encodeSegment(key)}/entries`, {
+        method: "DELETE",
+        body
+      }),
+      /** Uploads a CSV (one value per line, optional `value,reason,expires_at` header). */
+      importCsv: (key, csv) => http.parsed(import_core8.ListImportResult, `/lists/${encodeSegment(key)}/import`, {
+        method: "POST",
+        raw: { content: csv, contentType: "text/csv" }
+      })
+    }
+  };
+}
+
+// src/runtime-config.ts
+var import_zod8 = require("zod");
+var RuntimeConfig = import_zod8.z.object({
+  apiUrl: import_zod8.z.string(),
+  zitadelIssuer: import_zod8.z.string(),
+  zitadelProjectId: import_zod8.z.string(),
+  zitadelClientId: import_zod8.z.string(),
+  zitadelOrgDomain: import_zod8.z.string(),
+  collectionFlowUrl: import_zod8.z.string()
+}).partial();
+var RUNTIME_CONFIG_PATH = "/config.json";
+async function loadRuntimeConfig(fetchImpl = fetch) {
+  try {
+    const init = { cache: "no-store", headers: { accept: "application/json" } };
+    const response = await fetchImpl(RUNTIME_CONFIG_PATH, init);
+    if (!response.ok) return {};
+    const parsed = RuntimeConfig.safeParse(await response.json());
+    return parsed.success ? parsed.data : {};
+  } catch {
+    return {};
+  }
+}
+function present(value) {
+  return value !== void 0 && value !== "";
+}
+function resolveConfig(runtime, env, defaults) {
+  const resolved = { ...defaults };
+  for (const key of Object.keys(defaults)) {
+    const fromRuntime = runtime[key];
+    const fromEnv = env[key];
+    if (present(fromRuntime)) resolved[key] = fromRuntime;
+    else if (present(fromEnv)) resolved[key] = fromEnv;
+  }
+  return resolved;
+}
+//# sourceMappingURL=index.cjs.map