@aletheia-dev/api-client 0.1.0

package/dist/index.js

@@ -0,0 +1,1065 @@
+// src/errors.ts
+var ApiError = class _ApiError extends Error {
+  constructor(message, status, code, details) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.name = "ApiError";
+  }
+  status;
+  code;
+  details;
+  /** Builds an ApiError from a response status and its (possibly non-JSON) body. */
+  static fromResponse(status, statusText, body) {
+    if (isApiErrorBody(body)) {
+      return new _ApiError(body.error.message, status, body.error.code, body.error.details);
+    }
+    const message = statusText ? `HTTP ${status} ${statusText}` : `HTTP ${status}`;
+    return new _ApiError(message, status, "http_error", body);
+  }
+};
+function isApiErrorBody(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const error = value.error;
+  if (typeof error !== "object" || error === null) return false;
+  const { code, message } = error;
+  return typeof code === "string" && typeof message === "string";
+}
+function isApiError(value) {
+  return value instanceof ApiError;
+}
+function isUnauthenticated(value) {
+  return isApiError(value) && value.code === "unauthenticated";
+}
+var FORBIDDEN_CODES = ["forbidden", "tenant_not_provisioned"];
+function isForbidden(value) {
+  return isApiError(value) && FORBIDDEN_CODES.includes(value.code);
+}
+function isTenantNotProvisioned(value) {
+  return isApiError(value) && value.code === "tenant_not_provisioned";
+}
+
+// src/audit.ts
+import { AuditEvent } from "@aletheia-dev/core";
+import { z } from "zod";
+
+// src/http.ts
+function buildUrl(baseUrl, path, query) {
+  const url = `${baseUrl}${path}`;
+  if (!query) return url;
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value === void 0 || value === null || value === "") continue;
+    if (typeof value === "object") {
+      for (const item of value) params.append(key, item);
+      continue;
+    }
+    params.set(key, String(value));
+  }
+  const qs = params.toString();
+  return qs ? `${url}?${qs}` : url;
+}
+async function readBody(response) {
+  const text = await response.text();
+  if (!text) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+var Http = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  async request(path, options = {}) {
+    const { baseUrl, getAccessToken, fetch: fetch2 } = this.options;
+    const method = options.method ?? "GET";
+    const headers = { accept: "application/json" };
+    const token = await getAccessToken();
+    if (token) headers.authorization = `Bearer ${token}`;
+    const init = { method, headers };
+    if (options.raw !== void 0) {
+      headers["content-type"] = options.raw.contentType;
+      init.body = options.raw.content;
+    } else if (options.body !== void 0) {
+      headers["content-type"] = "application/json";
+      init.body = JSON.stringify(options.body);
+    }
+    const response = await fetch2(buildUrl(baseUrl, path, options.query), init);
+    const body = await readBody(response);
+    if (!response.ok) {
+      throw ApiError.fromResponse(response.status, response.statusText, body);
+    }
+    return body;
+  }
+  /** Requests and parses the body with `schema` (dates are coerced by the core schemas). */
+  async parsed(schema, path, options) {
+    const body = await this.request(path, options);
+    return schema.parse(body);
+  }
+};
+function encodeSegment(value) {
+  return encodeURIComponent(value);
+}
+
+// src/audit.ts
+var AuditEventList = z.object({ items: z.array(AuditEvent) });
+function isoOf(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+function auditFilterParams(filter = {}) {
+  return {
+    action: filter.action,
+    actorId: filter.actorId,
+    actorType: filter.actorType,
+    resourceType: filter.resourceType,
+    resourceId: filter.resourceId,
+    from: isoOf(filter.from),
+    to: isoOf(filter.to)
+  };
+}
+function auditDomain(http, transport) {
+  const exportUrl = (format, filter) => buildUrl(transport.baseUrl, "/audit-events/export", {
+    format,
+    ...auditFilterParams(filter)
+  });
+  return {
+    list: async (query = {}) => {
+      const { limit, offset, ...filter } = query;
+      const body = await http.parsed(AuditEventList, "/audit-events", {
+        query: { ...auditFilterParams(filter), limit, offset }
+      });
+      return body.items;
+    },
+    exportUrl,
+    export: async (format, filter) => {
+      const headers = { accept: "*/*" };
+      const token = await transport.getAccessToken();
+      if (token) headers.authorization = `Bearer ${token}`;
+      const response = await transport.fetch(exportUrl(format, filter), {
+        method: "GET",
+        headers
+      });
+      if (!response.ok) {
+        const text = await response.text();
+        let body = text || void 0;
+        try {
+          body = text ? JSON.parse(text) : void 0;
+        } catch {
+        }
+        throw ApiError.fromResponse(response.status, response.statusText, body);
+      }
+      return response.blob();
+    }
+  };
+}
+var CSV_MANIFEST = /^#\s*sha256=([0-9a-fA-F]+)\s+rows=(\d+)\s*$/;
+var JsonlManifest = z.object({
+  _manifest: z.object({ sha256: z.string(), rows: z.coerce.number().int().nonnegative() })
+});
+function parseManifest(line, format) {
+  const trimmed = line.replace(/\r$/, "");
+  if (format === "csv") {
+    const match = CSV_MANIFEST.exec(trimmed);
+    return match ? { sha256: match[1].toLowerCase(), rows: Number(match[2]) } : void 0;
+  }
+  try {
+    const parsed = JsonlManifest.safeParse(JSON.parse(trimmed));
+    if (!parsed.success) return void 0;
+    return { sha256: parsed.data._manifest.sha256.toLowerCase(), rows: parsed.data._manifest.rows };
+  } catch {
+    return void 0;
+  }
+}
+async function sha256Hex(text) {
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function verifyExport(text, format) {
+  const content = text.endsWith("\n") ? text.slice(0, -1) : text;
+  const cut = content.lastIndexOf("\n");
+  const body = cut === -1 ? "" : content.slice(0, cut + 1);
+  const manifest = parseManifest(content.slice(cut + 1), format);
+  if (!manifest) {
+    return { ok: false, rows: 0, actual: await sha256Hex(text) };
+  }
+  const actual = await sha256Hex(body);
+  return { ok: actual === manifest.sha256, rows: manifest.rows, expected: manifest.sha256, actual };
+}
+
+// src/governance.ts
+import {
+  DEFINITION_PATHS,
+  DefinitionApproval,
+  DefinitionDiff,
+  DefinitionVersionSummary
+} from "@aletheia-dev/core";
+import { z as z2 } from "zod";
+var itemsOf = (item) => z2.union([z2.object({ items: z2.array(item) }).transform((body) => body.items), z2.array(item)]);
+var ApprovalOutcome = z2.object({
+  approval: DefinitionApproval,
+  definition: z2.unknown()
+});
+function definitionPath(kind, key) {
+  return `${DEFINITION_PATHS[kind]}/${encodeSegment(key)}`;
+}
+function versionPath(kind, key, version) {
+  return `${definitionPath(kind, key)}/versions/${encodeSegment(String(version))}`;
+}
+function governanceDomain(http) {
+  return {
+    versions: (kind, key) => http.parsed(itemsOf(DefinitionVersionSummary), `${definitionPath(kind, key)}/versions`),
+    getVersion: (kind, key, version) => http.request(versionPath(kind, key, version)),
+    diff: (kind, key, query = {}) => http.parsed(DefinitionDiff, `${definitionPath(kind, key)}/diff`, {
+      query: { from: query.from, to: query.to }
+    }),
+    requestApproval: (kind, key, version, body = {}) => http.parsed(DefinitionApproval, `${versionPath(kind, key, version)}/request-approval`, {
+      method: "POST",
+      body
+    }),
+    approve: (kind, key, version, body = {}) => http.parsed(ApprovalOutcome, `${versionPath(kind, key, version)}/approve`, {
+      method: "POST",
+      body
+    }),
+    reject: (kind, key, version, body = {}) => http.parsed(ApprovalOutcome, `${versionPath(kind, key, version)}/reject`, {
+      method: "POST",
+      body
+    }),
+    approvals: {
+      listOpen: (query = {}) => http.parsed(itemsOf(DefinitionApproval), "/approvals", { query: { kind: query.kind } })
+    }
+  };
+}
+
+// src/index.ts
+import {
+  ActorType,
+  ApprovalCommentInput,
+  ApprovalDecision,
+  AuditEvent as AuditEvent2,
+  AuditExportFormat,
+  AuditFilter,
+  DEFINITION_PATHS as DEFINITION_PATHS2,
+  DefinitionApproval as DefinitionApproval2,
+  DefinitionDiff as DefinitionDiff2,
+  DefinitionKind,
+  DefinitionVersionSummary as DefinitionVersionSummary2,
+  DiffChange,
+  DiffOp
+} from "@aletheia-dev/core";
+import {
+  Condition,
+  ConditionOp,
+  DefinitionIssue,
+  FieldTypeDescription as FieldTypeDescription2,
+  FormUiHints,
+  IssueSeverity,
+  StepTypeDescription as StepTypeDescription2,
+  ValidationReport as ValidationReport2
+} from "@aletheia-dev/core";
+
+// src/cases.ts
+import {
+  Case,
+  CaseNote,
+  CaseQueue,
+  CaseView,
+  Decision,
+  DirectoryUser,
+  Subject,
+  WorkflowRun
+} from "@aletheia-dev/core";
+import { z as z3 } from "zod";
+var CaseDetail = z3.object({
+  case: CaseView,
+  subject: Subject,
+  run: WorkflowRun.nullable(),
+  decisions: z3.array(Decision)
+});
+var DecideCaseResult = z3.object({ case: Case, decision: Decision });
+var CaseQueueCount = z3.object({
+  queueId: z3.string(),
+  count: z3.number().int().nonnegative()
+});
+var listOf = (item) => z3.object({ items: z3.array(item) });
+function arrayOf(value) {
+  if (value === void 0) return void 0;
+  return Array.isArray(value) ? value : [value];
+}
+function isoOf2(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+function caseListParams(query) {
+  return {
+    status: arrayOf(query.status),
+    priority: arrayOf(query.priority),
+    assignee: query.assignee,
+    type: query.type,
+    subjectId: query.subjectId,
+    slaState: arrayOf(query.slaState),
+    dueBefore: isoOf2(query.dueBefore),
+    search: query.search,
+    sort: query.sort,
+    order: query.order,
+    limit: query.limit,
+    offset: query.offset
+  };
+}
+function casesDomain(http) {
+  const casePath = (id, suffix = "") => `/cases/${encodeSegment(id)}${suffix}`;
+  const notePath = (id, noteId) => casePath(id, `/notes/${encodeSegment(noteId)}`);
+  const post = (path, body) => http.parsed(CaseView, path, body === void 0 ? { method: "POST" } : { method: "POST", body });
+  return {
+    /** Cases matching `query`, in the requested order (`createdAt` desc by default). */
+    list: async (query = {}) => (await http.parsed(listOf(CaseView), "/cases", { query: caseListParams(query) })).items,
+    get: (id) => http.parsed(CaseDetail, casePath(id)),
+    decide: (id, body) => http.parsed(DecideCaseResult, casePath(id, "/decide"), { method: "POST", body }),
+    /** Sets or clears (`assigneeId: null`) the assignee (`cases:assign`). */
+    assign: (id, body) => post(casePath(id, "/assign"), body),
+    /** Assigns the case to the caller (`cases:claim`). */
+    claim: (id) => post(casePath(id, "/claim")),
+    /**
+     * Closes the case (`cases:decide`). An undecided case gets a `reject` decision with reason
+     * code `case_closed` so its workflow run does not wait forever.
+     */
+    close: (id, body = {}) => post(casePath(id, "/close"), body),
+    /** Analyst notes on a case (`cases:notes`); edits and deletes are limited to the author or an admin. */
+    notes: {
+      list: async (id) => (await http.parsed(listOf(CaseNote), casePath(id, "/notes"))).items,
+      create: (id, body) => http.parsed(CaseNote, casePath(id, "/notes"), { method: "POST", body }),
+      update: (id, noteId, body) => http.parsed(CaseNote, notePath(id, noteId), { method: "PATCH", body }),
+      remove: async (id, noteId) => {
+        await http.request(notePath(id, noteId), { method: "DELETE" });
+      }
+    }
+  };
+}
+function caseQueuesDomain(http) {
+  const queuePath = (id) => `/case-queues/${encodeSegment(id)}`;
+  return {
+    list: async () => (await http.parsed(listOf(CaseQueue), "/case-queues")).items,
+    counts: async () => (await http.parsed(listOf(CaseQueueCount), "/case-queues/counts")).items,
+    create: (body) => http.parsed(CaseQueue, "/case-queues", { method: "POST", body }),
+    update: (id, body) => http.parsed(CaseQueue, queuePath(id), { method: "PUT", body }),
+    remove: async (id) => {
+      await http.request(queuePath(id), { method: "DELETE" });
+    }
+  };
+}
+function usersDomain(http) {
+  return {
+    list: async (query = {}) => (await http.parsed(listOf(DirectoryUser), "/users", { query: { role: query.role } })).items
+  };
+}
+
+// src/index.ts
+import {
+  AssignCaseInput,
+  Case as Case2,
+  CaseFilter,
+  CaseNote as CaseNote2,
+  CaseNoteInput,
+  CasePriority,
+  CaseQueue as CaseQueue2,
+  CaseSlaState,
+  CaseSort,
+  CaseStatus,
+  CaseView as CaseView2,
+  CloseCaseInput,
+  DirectoryUser as DirectoryUser2,
+  SortOrder,
+  UpsertCaseQueueInput,
+  caseSlaState
+} from "@aletheia-dev/core";
+
+// src/documents.ts
+import {
+  DOCUMENT_CONTENT_TYPES,
+  DOCUMENT_MAX_BYTES,
+  DOCUMENT_OPEN_STATUSES,
+  Document,
+  DocumentDownload,
+  DocumentUploadTicket
+} from "@aletheia-dev/core";
+import { z as z4 } from "zod";
+var DocumentList = z4.object({ items: z4.array(Document) });
+function documentsDomain(http) {
+  const idPath = (id, suffix = "") => `/documents/${encodeSegment(id)}${suffix}`;
+  return {
+    /**
+     * Registers a pending document and returns the presigned POST to send the bytes with
+     * (`uploadToStorage`). Applicants pass their `submissionId` and the `fieldKey`.
+     */
+    create: (input) => http.parsed(DocumentUploadTicket, "/documents", { method: "POST", body: input }),
+    /**
+     * Verifies the uploaded object and starts the scan. Resolves with status `uploaded` or
+     * `rejected` (see `rejectionReason`); throws a 409 `ApiError` when nothing was uploaded.
+     */
+    finalize: (id, opts = {}) => http.parsed(Document, idPath(id, "/finalize"), { method: "POST", query: { ...opts } }),
+    get: (id, opts = {}) => http.parsed(Document, idPath(id), { query: { ...opts } }),
+    list: (filters = {}) => http.parsed(DocumentList, "/documents", { query: { ...filters } }),
+    /** A 60-second presigned GET on the storage origin; open it directly, never via the API. */
+    download: (id, opts = {}) => http.parsed(DocumentDownload, idPath(id, "/download"), { query: { ...opts } })
+  };
+}
+var UploadError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "UploadError";
+  }
+  status;
+};
+function defaultXhr() {
+  const ctor = globalThis.XMLHttpRequest;
+  if (!ctor) throw new UploadError("XMLHttpRequest is not available in this environment", 0);
+  return new ctor();
+}
+function uploadToStorage(ticket, file, opts = {}) {
+  return new Promise((resolve, reject) => {
+    if (opts.signal?.aborted) {
+      reject(new UploadError("Upload aborted", 0));
+      return;
+    }
+    const xhr = (opts.xhr ?? defaultXhr)();
+    const form = new FormData();
+    for (const [name, value] of Object.entries(ticket.upload.fields)) form.append(name, value);
+    form.append("file", file);
+    const onAbort = () => xhr.abort();
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    const settle = (fn) => {
+      opts.signal?.removeEventListener("abort", onAbort);
+      fn();
+    };
+    xhr.upload.addEventListener("progress", (event) => {
+      if (event.lengthComputable && event.total > 0) {
+        opts.onProgress?.(Math.min(1, event.loaded / event.total));
+      }
+    });
+    xhr.addEventListener(
+      "load",
+      () => settle(() => {
+        if (xhr.status >= 200 && xhr.status < 300) {
+          opts.onProgress?.(1);
+          resolve();
+        } else {
+          reject(new UploadError(`Storage refused the upload (HTTP ${xhr.status})`, xhr.status));
+        }
+      })
+    );
+    xhr.addEventListener(
+      "error",
+      () => settle(() => reject(new UploadError("Network error while uploading the file", 0)))
+    );
+    xhr.addEventListener("abort", () => settle(() => reject(new UploadError("Upload aborted", 0))));
+    xhr.addEventListener(
+      "timeout",
+      () => settle(() => reject(new UploadError("The upload timed out", 0)))
+    );
+    xhr.open("POST", ticket.upload.url);
+    xhr.send(form);
+  });
+}
+var TYPE_LABELS = "JPEG, PNG, WebP or PDF";
+function checkFileBeforeUpload(file) {
+  if (!file.name.trim()) return { ok: false, reason: "The file has no name." };
+  if (!DOCUMENT_CONTENT_TYPES.includes(file.type)) {
+    const got = file.type || "unknown type";
+    return { ok: false, reason: `Only ${TYPE_LABELS} files are accepted (this is ${got}).` };
+  }
+  if (file.size < 1) return { ok: false, reason: "The file is empty." };
+  if (file.size > DOCUMENT_MAX_BYTES) {
+    const mib = Math.round(DOCUMENT_MAX_BYTES / (1024 * 1024));
+    return { ok: false, reason: `The file is larger than ${mib} MiB.` };
+  }
+  return { ok: true };
+}
+var DocumentPollTimeoutError = class extends Error {
+  constructor(documentId) {
+    super("Timed out waiting for the document scan to finish");
+    this.documentId = documentId;
+    this.name = "DocumentPollTimeoutError";
+  }
+  documentId;
+};
+function isTerminalDocumentStatus(status) {
+  return !DOCUMENT_OPEN_STATUSES.includes(status);
+}
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    function onAbort() {
+      clearTimeout(timer);
+      reject(new Error("Polling aborted"));
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function pollDocument(client, id, opts = {}) {
+  const { intervalMs = 750, timeoutMs = 6e4, signal, submissionId } = opts;
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    const document = await client.documents.get(id, { submissionId });
+    if (isTerminalDocumentStatus(document.status)) return document;
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw new DocumentPollTimeoutError(id);
+    await sleep(Math.min(intervalMs, remaining), signal);
+  }
+}
+
+// src/index.ts
+import {
+  CreateDocumentInput,
+  DOCUMENT_CONTENT_TYPES as DOCUMENT_CONTENT_TYPES2,
+  DOCUMENT_MAX_BYTES as DOCUMENT_MAX_BYTES2,
+  DOCUMENT_OPEN_STATUSES as DOCUMENT_OPEN_STATUSES2,
+  Document as Document2,
+  DocumentContentType,
+  DocumentDownload as DocumentDownload2,
+  DocumentScan,
+  DocumentStatus,
+  DocumentUploadTicket as DocumentUploadTicket2,
+  FileFieldValue
+} from "@aletheia-dev/core";
+import {
+  AggregationPolicy,
+  AddListEntriesInput,
+  Backtest as Backtest2,
+  BacktestProgress,
+  BacktestSample,
+  BacktestSampleFailure,
+  BacktestStatus,
+  BacktestSummary,
+  Event as Event2,
+  EventKey,
+  IngestEventsInput,
+  IngestEventsResult as IngestEventsResult2,
+  NewEvent,
+  List as List2,
+  ListEntry as ListEntry2,
+  ListImportResult as ListImportResult2,
+  ListKind,
+  NewListEntry,
+  RemoveListEntriesInput,
+  RuleSetBody,
+  RuleSetDefinition as RuleSetDefinition2,
+  RuleSetRule,
+  RuleSetUseCase,
+  ScoreBand,
+  ScoreClamp,
+  StartBacktestInput,
+  UpsertListInput,
+  UpsertRuleSetInput,
+  bandFor,
+  normalizeListValue
+} from "@aletheia-dev/core";
+import { TenantSettings as TenantSettings2, WebOrigin } from "@aletheia-dev/core";
+import {
+  Subject as Subject3,
+  SubjectKind,
+  SubjectListQuery,
+  SubjectStatus,
+  TimelineEntry as TimelineEntry2,
+  TimelineKind,
+  TimelineQuery
+} from "@aletheia-dev/core";
+
+// src/client.ts
+import { z as z7 } from "zod";
+import {
+  Backtest,
+  CollectionFlowDefinition,
+  CollectionSubmission,
+  DefinitionStatus,
+  Decision as Decision2,
+  DecisionOutcome,
+  Event,
+  Id,
+  IngestEventsResult,
+  List,
+  ListEntry,
+  ListImportResult,
+  PluginDefinition,
+  PluginInvocation,
+  RuleDefinition,
+  RuleEvaluationResult,
+  RuleSetDefinition,
+  RuleType,
+  SubmissionStatus as CollectionSubmissionStatus,
+  Subject as Subject2,
+  TimelineEntry,
+  WorkflowDefinition,
+  WorkflowRunStatus
+} from "@aletheia-dev/core";
+
+// src/builder.ts
+import {
+  FieldTypeDescription,
+  StepTypeDescription,
+  ValidationReport
+} from "@aletheia-dev/core";
+import { z as z5 } from "zod";
+var itemsOf2 = (item) => z5.object({ items: z5.array(item) });
+function builderDomain(http) {
+  return {
+    stepTypes: async () => (await http.parsed(itemsOf2(StepTypeDescription), "/workflow-step-types")).items,
+    fieldTypes: async () => (await http.parsed(itemsOf2(FieldTypeDescription), "/collection-field-types")).items
+  };
+}
+function validateCall(http, path) {
+  return (body) => http.parsed(ValidationReport, `${path}/validate`, { method: "POST", body });
+}
+
+// src/tenants.ts
+import { TenantSettings } from "@aletheia-dev/core";
+function tenantsDomain(http) {
+  return {
+    getSettings: () => http.parsed(TenantSettings, "/tenants/me/settings"),
+    updateSettings: (body) => http.parsed(TenantSettings, "/tenants/me/settings", { method: "PUT", body })
+  };
+}
+
+// src/workflow-runs.ts
+import { WorkflowRun as WorkflowRun2 } from "@aletheia-dev/core";
+import { z as z6 } from "zod";
+var RunList = z6.object({ items: z6.array(WorkflowRun2) });
+function workflowRunsDomain(http) {
+  return {
+    start: (body) => http.parsed(WorkflowRun2, "/workflow-runs", { method: "POST", body }),
+    get: (id) => http.parsed(WorkflowRun2, `/workflow-runs/${encodeSegment(id)}`),
+    listBySubject: async (subjectId) => (await http.parsed(RunList, "/workflow-runs", { query: { subjectId } })).items,
+    history: (id) => http.request(`/workflow-runs/${encodeSegment(id)}/history`)
+  };
+}
+
+// src/client.ts
+var HealthStatus = z7.object({ status: z7.literal("ok") });
+var MePrincipal = z7.object({
+  kind: z7.enum(["human", "machine", "applicant"]),
+  subject: z7.string(),
+  name: z7.string().optional(),
+  email: z7.string().optional()
+});
+var Me = z7.object({
+  principal: MePrincipal,
+  tenantId: z7.string(),
+  orgId: z7.string().optional(),
+  permissions: z7.array(z7.string())
+});
+var CheckStatus = z7.enum(["ok", "error"]);
+var ReadyStatus = z7.object({
+  status: z7.enum(["ok", "degraded"]),
+  checks: z7.object({ db: CheckStatus, temporal: CheckStatus })
+});
+var PluginSummary = z7.object({
+  name: z7.string(),
+  version: z7.string(),
+  description: z7.string().optional(),
+  capabilities: z7.array(z7.string()),
+  secrets: z7.array(z7.string()),
+  actions: z7.array(z7.string()),
+  configSchema: z7.unknown()
+});
+var RuleUiHints = z7.object({
+  /** Config fields in display order; unlisted fields follow in schema order. */
+  fieldOrder: z7.array(z7.string()).optional(),
+  labels: z7.record(z7.string(), z7.string()).optional(),
+  help: z7.record(z7.string(), z7.string()).optional(),
+  /** Config fields that hold a list key; the builder renders a list picker for them. */
+  listPicker: z7.array(z7.string()).optional()
+});
+var RuleTypeDescription = z7.object({
+  type: RuleType,
+  description: z7.string(),
+  /** JSON Schema of the rule config, produced by `z.toJSONSchema` on the API. */
+  configSchema: z7.unknown(),
+  /** Dot-path namespaces a rule config may reference, e.g. `subject.<field>`. */
+  dataPaths: z7.array(z7.string()).default([]),
+  uiHints: RuleUiHints.optional()
+});
+var DryRunResult = z7.object({
+  result: RuleEvaluationResult,
+  rule: z7.object({
+    key: z7.string(),
+    version: z7.number().int(),
+    status: DefinitionStatus,
+    type: RuleType
+  }),
+  /** Data namespaces the rule may reference, a hint for composing inline test data. */
+  dataPaths: z7.array(z7.string()).default([])
+});
+var RemovedCount = z7.object({ removed: z7.number().int().nonnegative() });
+var SubmissionDetail = z7.object({
+  submission: CollectionSubmission,
+  flow: CollectionFlowDefinition
+});
+var SubmissionStatus = z7.object({
+  submission: z7.object({
+    id: Id,
+    status: CollectionSubmissionStatus,
+    submittedAt: z7.coerce.date().nullable()
+  }),
+  run: z7.object({
+    id: Id,
+    status: WorkflowRunStatus,
+    currentStepId: z7.string().nullable(),
+    decision: z7.object({ outcome: DecisionOutcome }).nullable()
+  }).nullable()
+});
+var CreatedSubmission = z7.object({
+  submission: CollectionSubmission,
+  link: z7.string().nullable()
+});
+var SubmissionEmbed = z7.object({
+  embedOrigins: z7.array(z7.string()),
+  flowName: z7.string()
+});
+var listOf2 = (item) => z7.object({ items: z7.array(item) });
+function isoOf3(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+function timelineParams(query) {
+  return {
+    from: isoOf3(query.from),
+    to: isoOf3(query.to),
+    kinds: query.kinds,
+    limit: query.limit,
+    offset: query.offset
+  };
+}
+function createApiClient(options) {
+  const fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+  const transport = {
+    baseUrl: options.baseUrl.replace(/\/+$/, ""),
+    getAccessToken: options.getAccessToken,
+    fetch: fetchImpl
+  };
+  const http = new Http(transport);
+  const audit = auditDomain(http, transport);
+  const list = async (item, path, query) => (await http.parsed(listOf2(item), path, { query })).items;
+  const definitions = (entity, path) => ({
+    list: () => list(entity, path),
+    get: (key) => http.parsed(entity, `${path}/${encodeSegment(key)}`),
+    upsert: (key, body) => http.parsed(entity, `${path}/${encodeSegment(key)}`, { method: "PUT", body }),
+    publish: (key) => http.parsed(entity, `${path}/${encodeSegment(key)}/publish`, { method: "POST" })
+  });
+  return {
+    health: {
+      check: () => http.parsed(HealthStatus, "/health"),
+      ready: () => http.parsed(ReadyStatus, "/health/ready")
+    },
+    /** The caller's principal, tenant and permissions as the API sees the bearer token. */
+    me: () => http.parsed(Me, "/me"),
+    subjects: {
+      create: (body) => http.parsed(Subject2, "/subjects", { method: "POST", body }),
+      /**
+       * Subjects matching `query`: `search` matches the external id and `data.name` /
+       * `data.legalName`; `riskScoreMin`/`riskScoreMax` bound the risk score (`subjects:read`).
+       */
+      list: (query = {}) => list(Subject2, "/subjects", query),
+      get: (id) => http.parsed(Subject2, `/subjects/${encodeSegment(id)}`),
+      /**
+       * The subject's history, newest first (`subjects:read`). Entries of kinds the caller may
+       * not read are omitted by the API; page with `offset`.
+       */
+      timeline: (id, query = {}) => list(TimelineEntry, `/subjects/${encodeSegment(id)}/timeline`, timelineParams(query))
+    },
+    workflowRuns: workflowRunsDomain(http),
+    /** Review cases: filtered lists, detail, decide, assign/claim/close and notes. See `cases.ts`. */
+    cases: casesDomain(http),
+    /** Saved case filters shown in the workbench rail, with live counts. */
+    caseQueues: caseQueuesDomain(http),
+    /** The reviewer directory, for assignment and resolving assignee names. */
+    users: usersDomain(http),
+    workflowDefinitions: {
+      ...definitions(
+        WorkflowDefinition,
+        "/workflow-definitions"
+      ),
+      /** Validates a draft body without saving; issues carry step ids. */
+      validate: validateCall(http, "/workflow-definitions")
+    },
+    /** Step and field type schemas behind the builder's forms. */
+    builder: builderDomain(http),
+    ruleDefinitions: {
+      ...definitions(
+        RuleDefinition,
+        "/rule-definitions"
+      ),
+      /** Evaluates one rule version against a subject or inline data; nothing is recorded. */
+      dryRun: (key, body) => http.parsed(DryRunResult, `/rule-definitions/${encodeSegment(key)}/dry-run`, {
+        method: "POST",
+        body
+      })
+    },
+    ruleTypes: {
+      list: () => list(RuleTypeDescription, "/rule-types")
+    },
+    /** Versioned, ordered groups of rules with an aggregation policy (`/rule-sets`). */
+    ruleSets: definitions(
+      RuleSetDefinition,
+      "/rule-sets"
+    ),
+    collectionFlows: {
+      ...definitions(
+        CollectionFlowDefinition,
+        "/collection-flows"
+      ),
+      /** Validates a draft flow body without saving; issues carry step / field keys. */
+      validate: validateCall(http, "/collection-flows")
+    },
+    collectionSubmissions: {
+      /** Creates the submission and returns the applicant link alongside it. */
+      create: (body) => http.parsed(CreatedSubmission, "/collection-submissions", { method: "POST", body }),
+      get: (id) => http.parsed(SubmissionDetail, `/collection-submissions/${encodeSegment(id)}`),
+      save: (id, body) => http.parsed(CollectionSubmission, `/collection-submissions/${encodeSegment(id)}`, {
+        method: "PATCH",
+        body
+      }),
+      submit: (id) => http.parsed(CollectionSubmission, `/collection-submissions/${encodeSegment(id)}/submit`, {
+        method: "POST"
+      }),
+      /** Where the submission's workflow run is; readable with the applicant's token. */
+      status: (id) => http.parsed(SubmissionStatus, `/collection-submissions/${encodeSegment(id)}/status`),
+      /** Embed allow-list and flow name for the submission; readable with the applicant's token. */
+      embed: (id) => http.parsed(SubmissionEmbed, `/collection-submissions/${encodeSegment(id)}/embed`)
+    },
+    /** Subject events: the facts velocity rules aggregate over. */
+    events: {
+      /** Inserts events; re-sent idempotency keys are counted as `duplicates`, not errors. */
+      ingest: (body) => http.parsed(IngestEventsResult, "/events", { method: "POST", body }),
+      /** Newest first. */
+      list: (query = {}) => list(Event, "/events", { ...query, from: isoOf3(query.from), to: isoOf3(query.to) })
+    },
+    /**
+     * Replays recorded evaluations against a rule version (`backtests:run`). `start` returns the
+     * queued job; poll `get` until its status is `completed` (with `summary`) or `failed`.
+     */
+    backtests: {
+      start: (body) => http.parsed(Backtest, "/backtests", { method: "POST", body }),
+      /** Newest first. */
+      list: (query = {}) => list(Backtest, "/backtests", query),
+      get: (id) => http.parsed(Backtest, `/backtests/${encodeSegment(id)}`)
+    },
+    decisions: {
+      listBySubject: (subjectId) => list(Decision2, "/decisions", { subjectId })
+    },
+    /** Filtered audit trail, exports and manifest verification (`audit:read`). See `audit.ts`. */
+    audit,
+    /** @deprecated Alias of `audit`, kept for existing callers. */
+    auditEvents: {
+      list: (query = {}) => audit.list(query)
+    },
+    /** Version history, diffs and the approval workflow of definitions. See `governance.ts`. */
+    governance: governanceDomain(http),
+    plugins: {
+      list: () => list(PluginDefinition, "/plugins"),
+      available: () => list(PluginSummary, "/plugins/available"),
+      configure: (name, body) => http.parsed(PluginDefinition, `/plugins/${encodeSegment(name)}`, { method: "PUT", body })
+    },
+    pluginInvocations: {
+      list: (query = {}) => list(PluginInvocation, "/plugin-invocations", query)
+    },
+    /**
+     * Uploaded files: `create` -> `uploadToStorage` (helper) -> `finalize` -> `pollDocument`
+     * (helper) until the scan settles. See `documents.ts`.
+     */
+    documents: documentsDomain(http),
+    /** Tenant settings such as the embed origin allow-list (`tenants:settings`). */
+    tenants: tenantsDomain(http),
+    /** Tenant lists (blocklists / allowlists) and their entries. Lists are keyed, not versioned. */
+    lists: {
+      list: () => list(List, "/lists"),
+      get: (key) => http.parsed(List, `/lists/${encodeSegment(key)}`),
+      /** Creates the list or updates its metadata; entries are untouched. */
+      upsert: (key, body) => http.parsed(List, `/lists/${encodeSegment(key)}`, { method: "PUT", body }),
+      remove: async (key) => {
+        await http.request(`/lists/${encodeSegment(key)}`, { method: "DELETE" });
+      },
+      entries: (key, query = {}) => list(ListEntry, `/lists/${encodeSegment(key)}/entries`, query),
+      addEntries: (key, body) => http.parsed(ListImportResult, `/lists/${encodeSegment(key)}/entries`, {
+        method: "POST",
+        body
+      }),
+      removeEntries: (key, body) => http.parsed(RemovedCount, `/lists/${encodeSegment(key)}/entries`, {
+        method: "DELETE",
+        body
+      }),
+      /** Uploads a CSV (one value per line, optional `value,reason,expires_at` header). */
+      importCsv: (key, csv) => http.parsed(ListImportResult, `/lists/${encodeSegment(key)}/import`, {
+        method: "POST",
+        raw: { content: csv, contentType: "text/csv" }
+      })
+    }
+  };
+}
+
+// src/runtime-config.ts
+import { z as z8 } from "zod";
+var RuntimeConfig = z8.object({
+  apiUrl: z8.string(),
+  zitadelIssuer: z8.string(),
+  zitadelProjectId: z8.string(),
+  zitadelClientId: z8.string(),
+  zitadelOrgDomain: z8.string(),
+  collectionFlowUrl: z8.string()
+}).partial();
+var RUNTIME_CONFIG_PATH = "/config.json";
+async function loadRuntimeConfig(fetchImpl = fetch) {
+  try {
+    const init = { cache: "no-store", headers: { accept: "application/json" } };
+    const response = await fetchImpl(RUNTIME_CONFIG_PATH, init);
+    if (!response.ok) return {};
+    const parsed = RuntimeConfig.safeParse(await response.json());
+    return parsed.success ? parsed.data : {};
+  } catch {
+    return {};
+  }
+}
+function present(value) {
+  return value !== void 0 && value !== "";
+}
+function resolveConfig(runtime, env, defaults) {
+  const resolved = { ...defaults };
+  for (const key of Object.keys(defaults)) {
+    const fromRuntime = runtime[key];
+    const fromEnv = env[key];
+    if (present(fromRuntime)) resolved[key] = fromRuntime;
+    else if (present(fromEnv)) resolved[key] = fromEnv;
+  }
+  return resolved;
+}
+export {
+  ActorType,
+  AddListEntriesInput,
+  AggregationPolicy,
+  ApiError,
+  ApprovalCommentInput,
+  ApprovalDecision,
+  ApprovalOutcome,
+  AssignCaseInput,
+  AuditEvent2 as AuditEvent,
+  AuditExportFormat,
+  AuditFilter,
+  Backtest2 as Backtest,
+  BacktestProgress,
+  BacktestSample,
+  BacktestSampleFailure,
+  BacktestStatus,
+  BacktestSummary,
+  Case2 as Case,
+  CaseDetail,
+  CaseFilter,
+  CaseNote2 as CaseNote,
+  CaseNoteInput,
+  CasePriority,
+  CaseQueue2 as CaseQueue,
+  CaseQueueCount,
+  CaseSlaState,
+  CaseSort,
+  CaseStatus,
+  CaseView2 as CaseView,
+  CloseCaseInput,
+  Condition,
+  ConditionOp,
+  CreateDocumentInput,
+  CreatedSubmission,
+  DEFINITION_PATHS2 as DEFINITION_PATHS,
+  DOCUMENT_CONTENT_TYPES2 as DOCUMENT_CONTENT_TYPES,
+  DOCUMENT_MAX_BYTES2 as DOCUMENT_MAX_BYTES,
+  DOCUMENT_OPEN_STATUSES2 as DOCUMENT_OPEN_STATUSES,
+  DecideCaseResult,
+  DefinitionApproval2 as DefinitionApproval,
+  DefinitionDiff2 as DefinitionDiff,
+  DefinitionIssue,
+  DefinitionKind,
+  DefinitionVersionSummary2 as DefinitionVersionSummary,
+  DiffChange,
+  DiffOp,
+  DirectoryUser2 as DirectoryUser,
+  Document2 as Document,
+  DocumentContentType,
+  DocumentDownload2 as DocumentDownload,
+  DocumentPollTimeoutError,
+  DocumentScan,
+  DocumentStatus,
+  DocumentUploadTicket2 as DocumentUploadTicket,
+  DryRunResult,
+  Event2 as Event,
+  EventKey,
+  FORBIDDEN_CODES,
+  FieldTypeDescription2 as FieldTypeDescription,
+  FileFieldValue,
+  FormUiHints,
+  HealthStatus,
+  IngestEventsInput,
+  IngestEventsResult2 as IngestEventsResult,
+  IssueSeverity,
+  List2 as List,
+  ListEntry2 as ListEntry,
+  ListImportResult2 as ListImportResult,
+  ListKind,
+  Me,
+  MePrincipal,
+  NewEvent,
+  NewListEntry,
+  PluginSummary,
+  RUNTIME_CONFIG_PATH,
+  ReadyStatus,
+  RemoveListEntriesInput,
+  RemovedCount,
+  RuleSetBody,
+  RuleSetDefinition2 as RuleSetDefinition,
+  RuleSetRule,
+  RuleSetUseCase,
+  RuleTypeDescription,
+  RuleUiHints,
+  RuntimeConfig,
+  ScoreBand,
+  ScoreClamp,
+  SortOrder,
+  StartBacktestInput,
+  StepTypeDescription2 as StepTypeDescription,
+  Subject3 as Subject,
+  SubjectKind,
+  SubjectListQuery,
+  SubjectStatus,
+  SubmissionDetail,
+  SubmissionEmbed,
+  SubmissionStatus,
+  TenantSettings2 as TenantSettings,
+  TimelineEntry2 as TimelineEntry,
+  TimelineKind,
+  TimelineQuery,
+  UploadError,
+  UpsertCaseQueueInput,
+  UpsertListInput,
+  UpsertRuleSetInput,
+  ValidationReport2 as ValidationReport,
+  WebOrigin,
+  auditFilterParams,
+  bandFor,
+  caseListParams,
+  caseSlaState,
+  checkFileBeforeUpload,
+  createApiClient,
+  isApiError,
+  isApiErrorBody,
+  isForbidden,
+  isTenantNotProvisioned,
+  isTerminalDocumentStatus,
+  isUnauthenticated,
+  loadRuntimeConfig,
+  normalizeListValue,
+  pollDocument,
+  resolveConfig,
+  uploadToStorage,
+  verifyExport
+};
+//# sourceMappingURL=index.js.map