@alfe.ai/gateway 0.9.11 → 0.9.12

package/dist/health.js

@@ -287,190 +287,6 @@ function pluginConnectionId() {
 	return createId(ID_PREFIXES.pluginConnection);
 }
 //#endregion
-//#region ../../packages-internal/api-client/dist/client.js
-/**
-* @alfe/api-client — Typed HTTP client for Alfe services.
-*
-* Platform-agnostic: works in React Native and browser environments.
-* Uses standard fetch() API — no Node.js dependencies.
-*/
-var AlfeApiClient = class {
-	apiBaseUrl;
-	getToken;
-	onAuthFailure;
-	constructor(options) {
-		this.apiBaseUrl = options.apiBaseUrl.replace(/\/+$/, "");
-		this.getToken = options.getToken;
-		this.onAuthFailure = options.onAuthFailure;
-	}
-	/**
-	* Shared fetch logic — handles auth, 401, and network errors.
-	*
-	* `skipAuth` callers (public endpoints like OAuth device-code) opt out of
-	* the auth-header injection AND the synthetic 401 short-circuit. Without
-	* this opt-out, a CLI calling /auth/device-code (no token yet by design)
-	* would never reach the network — the `getToken: () => null` path would
-	* synthesize a 401 and fire onAuthFailure, breaking the entire flow.
-	*/
-	async _fetchResponse(path, options, skipAuth = false) {
-		try {
-			const url = `${this.apiBaseUrl}${path}`;
-			const headers = new Headers(options?.headers);
-			if (typeof options?.body === "string" && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
-			headers.set("x-correlation-id", correlationId());
-			if (!skipAuth) {
-				const token = await this.getToken();
-				if (!token) {
-					this.onAuthFailure?.();
-					return {
-						ok: false,
-						result: {
-							ok: false,
-							error: "No auth token available",
-							status: 401
-						}
-					};
-				}
-				headers.set("Authorization", `Bearer ${token}`);
-			}
-			const res = await fetch(url, {
-				...options,
-				headers
-			});
-			if (res.status === 401 && !skipAuth) {
-				this.onAuthFailure?.();
-				return {
-					ok: false,
-					result: {
-						ok: false,
-						error: "Session expired",
-						status: 401
-					}
-				};
-			}
-			if (!res.ok) {
-				const text = res.status === 204 ? "" : await res.text();
-				let body;
-				if (text) try {
-					body = JSON.parse(text);
-				} catch {
-					body = text;
-				}
-				const errBody = body;
-				return {
-					ok: false,
-					result: {
-						ok: false,
-						error: (typeof errBody === "object" ? errBody.message : void 0) ?? (typeof body === "string" ? body : `API error: ${String(res.status)}`),
-						status: res.status
-					}
-				};
-			}
-			return {
-				ok: true,
-				res
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				result: {
-					ok: false,
-					error: err instanceof Error ? err.message : "Network error"
-				}
-			};
-		}
-	}
-	async _fetch(path, options, skipAuth = false) {
-		const response = await this._fetchResponse(path, options, skipAuth);
-		if (!response.ok) return response;
-		const text = response.res.status === 204 ? "" : await response.res.text();
-		let body;
-		if (text) try {
-			body = JSON.parse(text);
-		} catch {
-			body = text;
-		}
-		return {
-			ok: true,
-			res: response.res,
-			body
-		};
-	}
-	/**
-	* Make an authenticated request to an Alfe API endpoint.
-	* Unwraps the @auriclabs/api-core `{ data, timestamp, requestId }` envelope.
-	*/
-	async request(path, options) {
-		const result = await this._fetch(path, options);
-		if (!result.ok) return result.result;
-		if (result.body === void 0) return {
-			ok: true,
-			data: void 0
-		};
-		return {
-			ok: true,
-			data: result.body.data
-		};
-	}
-	/**
-	* Make a request to a PUBLIC endpoint that does not require authentication.
-	* Skips both the Authorization header injection AND the onAuthFailure
-	* callback. Use for endpoints like /auth/device-code that the CLI hits
-	* before it has a token.
-	*/
-	async publicRequest(path, options) {
-		const result = await this._fetch(path, options, true);
-		if (!result.ok) return result.result;
-		if (result.body === void 0) return {
-			ok: true,
-			data: void 0
-		};
-		return {
-			ok: true,
-			data: result.body.data
-		};
-	}
-	/**
-	* Make an authenticated request that returns the body directly (no envelope unwrap).
-	* Use for APIs that don't use the @auriclabs/api-core response format (e.g. gateway).
-	*/
-	async rawRequest(path, options) {
-		const result = await this._fetch(path, options);
-		if (!result.ok) return result.result;
-		return {
-			ok: true,
-			data: result.body
-		};
-	}
-	/**
-	* Make an authenticated request without attempting text/JSON decoding.
-	* Use for downloads such as a Teams app ZIP where UTF-8 conversion would
-	* corrupt the payload.
-	*/
-	async binaryRequest(path, options) {
-		const result = await this._fetchResponse(path, options);
-		if (!result.ok) return result.result;
-		try {
-			return {
-				ok: true,
-				data: {
-					body: await result.res.arrayBuffer(),
-					contentType: result.res.headers.get("Content-Type") ?? void 0,
-					contentDisposition: result.res.headers.get("Content-Disposition") ?? void 0
-				}
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				error: err instanceof Error ? err.message : "Failed to read binary response"
-			};
-		}
-	}
-	getApiBaseUrl() {
-		return this.apiBaseUrl;
-	}
-};
-//#endregion
 //#region ../../packages-internal/types/dist/lib/enum-values.js
 /**
 * Converts a const enum object into a non-empty readonly tuple.
@@ -4193,7 +4009,8 @@ enumValues({
 	ClaudeMax: "claude-max",
 	OpenAICodexMax: "openai-codex-max",
 	OpenAICodexSubscription: "openai-codex-subscription",
-	GeminiMax: "gemini-max"
+	GeminiMax: "gemini-max",
+	AlfeAws: "alfe-aws"
 });
 enumValues({
 	Month: "month",
@@ -4347,6 +4164,7 @@ const PERMISSION_CATALOG = {
 	org_file: ["read", "write"],
 	org_knowledge: ["read", "write"],
 	model_policy: ["read", "manage"],
+	data_boundary: ["read", "manage"],
 	secret: [
 		"create",
 		"read",
@@ -4379,7 +4197,8 @@ const PERMISSION_CATALOG = {
 	discounts: ["manage"],
 	stats: ["read"],
 	mobile: ["read", "manage"],
-	impersonation: ["manage"]
+	impersonation: ["manage"],
+	partner: ["manage"]
 };
 /**
 * Subjects a tenant may grant via a custom role.
@@ -4400,6 +4219,7 @@ const TENANT_ALLOWED_SUBJECTS = [
 	"team",
 	"project",
 	"model_policy",
+	"data_boundary",
 	"role_management",
 	"billing",
 	"identity",
@@ -4562,6 +4382,26 @@ enumValues({
 	Demo: "demo",
 	Live: "live"
 });
+function createClerkReverificationResponse(afterMinutes) {
+	if (!Number.isInteger(afterMinutes) || afterMinutes < 0) throw new TypeError("afterMinutes must be a non-negative integer");
+	return { clerk_error: {
+		type: "forbidden",
+		reason: "reverification-error",
+		metadata: { reverification: {
+			level: "second_factor",
+			afterMinutes
+		} }
+	} };
+}
+/** Strictly identify the only authorization hint the API client may expose. */
+function isClerkReverificationResponse(value) {
+	if (!value || typeof value !== "object") return false;
+	const clerkError = value.clerk_error;
+	if (!clerkError || typeof clerkError !== "object") return false;
+	const error = clerkError;
+	const reverification = error.metadata?.reverification;
+	return error.type === "forbidden" && error.reason === "reverification-error" && reverification?.level === "second_factor" && Number.isInteger(reverification.afterMinutes) && reverification.afterMinutes >= 0;
+}
 //#endregion
 //#region ../../packages-internal/types/dist/models.js
 const AnthropicModel = {
@@ -4689,6 +4529,35 @@ _enum(QWEN_MODELS);
 string().trim().min(1);
 AnthropicModel.Opus5, AnthropicModel.Opus48, AnthropicModel.Opus47, AnthropicModel.Opus46, AnthropicModel.Sonnet5, AnthropicModel.Sonnet46, AnthropicModel.Haiku45, OpenAIModel.GPT4o, OpenAIModel.GPT4oMini, OpenAIModel.O3, OpenAIModel.GPT41, OpenAIModel.GPT41Mini, OpenAIModel.GPT41Nano, OpenAIModel.GPT54, OpenAIModel.GPT54Mini, OpenAIModel.GPT54Nano, OpenAIModel.GPT54Pro, OpenAIModel.GPT55, OpenAIModel.GPT55Pro, OpenAIModel.GPT56Sol, OpenAIModel.GPT56Terra, OpenAIModel.GPT56Luna, OpenAIModel.O3Mini, OpenAIModel.O4Mini, OpenAIModel.TextEmbedding3Small, OpenAIModel.TextEmbedding3Large, DeepSeekModel.Chat, DeepSeekModel.Reasoner, DeepSeekModel.V4Flash, DeepSeekModel.V4Pro, GoogleModel.Gemini35Flash, GoogleModel.Gemini31Pro, GoogleModel.Gemini31FlashLite, GoogleModel.Gemini25Pro, GoogleModel.Gemini25Flash, GoogleModel.Gemini25FlashLite, GoogleModel.Gemini20Flash, MiniMaxModel.M3, MiniMaxModel.M27, MiniMaxModel.M27HighSpeed, MiniMaxModel.M25, MiniMaxModel.M21, MiniMaxModel.M2, MistralModel.Large, MistralModel.Medium, MistralModel.Small, MistralModel.Codestral, MistralModel.Ministral8b, MistralModel.Ministral3b, MistralModel.MagistralMedium, MistralModel.MagistralSmall, MistralModel.DevstralMedium, XAIModel.Grok45, XAIModel.Grok43, XAIModel.Grok4, XAIModel.Grok41Fast, ZhipuModel.GLM52, ZhipuModel.GLM51, ZhipuModel.GLM46, ZhipuModel.GLM45, ZhipuModel.GLM45Air, MoonshotModel.K3, MoonshotModel.K26, MoonshotModel.K27Code, MoonshotModel.K27CodeHighSpeed, QwenModel.Qwen37Max, QwenModel.Qwen37Plus, QwenModel.Qwen36Flash, QwenModel.Qwen35Flash;
 AnthropicModel.Opus5, AnthropicModel.Opus48, AnthropicModel.Opus47, AnthropicModel.Opus46, AnthropicModel.Sonnet5, AnthropicModel.Sonnet46, AnthropicModel.Haiku45, OpenAIModel.GPT4o, OpenAIModel.GPT4oMini, OpenAIModel.O3, OpenAIModel.GPT41, OpenAIModel.GPT41Mini, OpenAIModel.GPT41Nano, OpenAIModel.GPT54, OpenAIModel.GPT54Mini, OpenAIModel.GPT54Nano, OpenAIModel.GPT54Pro, OpenAIModel.GPT55, OpenAIModel.GPT55Pro, OpenAIModel.GPT56Sol, OpenAIModel.GPT56Terra, OpenAIModel.GPT56Luna, OpenAIModel.O3Mini, OpenAIModel.O4Mini, OpenAIModel.TextEmbedding3Small, OpenAIModel.TextEmbedding3Large, DeepSeekModel.Chat, DeepSeekModel.Reasoner, DeepSeekModel.V4Flash, DeepSeekModel.V4Pro, GoogleModel.Gemini35Flash, GoogleModel.Gemini31Pro, GoogleModel.Gemini31FlashLite, GoogleModel.Gemini25Pro, GoogleModel.Gemini25Flash, GoogleModel.Gemini25FlashLite, GoogleModel.Gemini20Flash, MiniMaxModel.M3, MiniMaxModel.M27, MiniMaxModel.M27HighSpeed, MiniMaxModel.M25, MiniMaxModel.M21, MiniMaxModel.M2, MistralModel.Large, MistralModel.Medium, MistralModel.Small, MistralModel.Codestral, MistralModel.Ministral8b, MistralModel.Ministral3b, MistralModel.MagistralMedium, MistralModel.MagistralSmall, MistralModel.DevstralMedium, XAIModel.Grok45, XAIModel.Grok43, XAIModel.Grok4, XAIModel.Grok41Fast, ZhipuModel.GLM52, ZhipuModel.GLM51, ZhipuModel.GLM46, ZhipuModel.GLM45, ZhipuModel.GLM45Air, MoonshotModel.K3, MoonshotModel.K26, MoonshotModel.K27Code, MoonshotModel.K27CodeHighSpeed, QwenModel.Qwen37Max, QwenModel.Qwen37Plus, QwenModel.Qwen36Flash, QwenModel.Qwen35Flash;
+enumValues({
+	Standard: "standard",
+	AwsPrivate: "aws_private"
+});
+enumValues({ ApSoutheast2: "ap-southeast-2" });
+enumValues({
+	Standard: "standard",
+	Requested: "requested",
+	Provisioning: "provisioning",
+	Ready: "ready",
+	CuttingOver: "cutting_over",
+	Active: "active",
+	Failing: "failing",
+	Decommissioning: "decommissioning"
+});
+enumValues({
+	RegionalShared: "regional_shared",
+	Dedicated: "dedicated"
+});
+enumValues({
+	Inference: "inference",
+	AuthProjection: "auth_projection",
+	ChatGateway: "chat_gateway",
+	AgentCompute: "agent_compute",
+	Attachments: "attachments",
+	Memory: "memory",
+	CapabilityPolicy: "capability_policy",
+	Observability: "observability"
+});
 enumValues({
 	PendingChallenge: "pending_challenge",
 	Creating: "creating",
@@ -4777,6 +4646,8 @@ const NotificationType = {
 	BrowserTakeoverRequested: "browser_takeover_requested",
 	InviteCreated: "onboarding.invite.created",
 	OrgClaimed: "onboarding.org.claimed",
+	ElevatedSupportRequested: "partner.elevated_support.requested",
+	ElevatedSupportStarted: "partner.elevated_support.started",
 	TeamMemberAdded: "team.member.added",
 	ProjectMemberAdded: "project.member.added",
 	IntegrationInstalled: "integration.installed",
@@ -4791,7 +4662,213 @@ const RecipientStrategy = {
 	TenantAdmins: "tenant_admins",
 	SpecificUser: "specific_user"
 };
-NotificationType.PaymentSucceeded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.PaymentFailed, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationChannel.Sms, NotificationType.TopUpCompleted, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AutoRechargeCompleted, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.AutoRechargeFailed, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationChannel.Sms, NotificationType.SubscriptionCreated, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.SubscriptionCancelled, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.StartupGrantEnded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.GrantEnded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.EnterpriseGrantEnded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.SubscriptionPastDue, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationChannel.Sms, NotificationType.BalanceThresholdWarning, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.PlatformTierPriceIncrease, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.AgentCreated, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AgentProvisionFailed, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AgentBillingSuspended, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AgentDisconnectedExtended, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Push, NotificationType.BrowserTakeoverRequested, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.InviteCreated, NotificationCategory.System, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.OrgClaimed, NotificationCategory.System, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.TeamMemberAdded, NotificationCategory.Team, RecipientStrategy.SpecificUser, NotificationChannel.Email, NotificationChannel.Push, NotificationType.ProjectMemberAdded, NotificationCategory.Team, RecipientStrategy.SpecificUser, NotificationChannel.Email, NotificationChannel.Push, NotificationType.IntegrationInstalled, NotificationCategory.Integrations, RecipientStrategy.TenantAdmins, NotificationChannel.Push, NotificationType.IntegrationRemoved, NotificationCategory.Integrations, RecipientStrategy.TenantAdmins, NotificationChannel.Push;
+NotificationType.PaymentSucceeded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.PaymentFailed, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationChannel.Sms, NotificationType.TopUpCompleted, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AutoRechargeCompleted, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.AutoRechargeFailed, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationChannel.Sms, NotificationType.SubscriptionCreated, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.SubscriptionCancelled, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.StartupGrantEnded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.GrantEnded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.EnterpriseGrantEnded, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.SubscriptionPastDue, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationChannel.Sms, NotificationType.BalanceThresholdWarning, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.PlatformTierPriceIncrease, NotificationCategory.Billing, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.AgentCreated, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AgentProvisionFailed, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AgentBillingSuspended, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.AgentDisconnectedExtended, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Push, NotificationType.BrowserTakeoverRequested, NotificationCategory.Agents, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.InviteCreated, NotificationCategory.System, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationType.OrgClaimed, NotificationCategory.System, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.ElevatedSupportRequested, NotificationCategory.System, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.ElevatedSupportStarted, NotificationCategory.System, RecipientStrategy.TenantAdmins, NotificationChannel.Email, NotificationChannel.Push, NotificationType.TeamMemberAdded, NotificationCategory.Team, RecipientStrategy.SpecificUser, NotificationChannel.Email, NotificationChannel.Push, NotificationType.ProjectMemberAdded, NotificationCategory.Team, RecipientStrategy.SpecificUser, NotificationChannel.Email, NotificationChannel.Push, NotificationType.IntegrationInstalled, NotificationCategory.Integrations, RecipientStrategy.TenantAdmins, NotificationChannel.Push, NotificationType.IntegrationRemoved, NotificationCategory.Integrations, RecipientStrategy.TenantAdmins, NotificationChannel.Push;
+//#endregion
+//#region ../../packages-internal/api-client/dist/client.js
+/**
+* @alfe/api-client — Typed HTTP client for Alfe services.
+*
+* Platform-agnostic: works in React Native and browser environments.
+* Uses standard fetch() API — no Node.js dependencies.
+*/
+var AlfeApiClient = class {
+	apiBaseUrl;
+	getToken;
+	onAuthFailure;
+	constructor(options) {
+		this.apiBaseUrl = options.apiBaseUrl.replace(/\/+$/, "");
+		this.getToken = options.getToken;
+		this.onAuthFailure = options.onAuthFailure;
+	}
+	/**
+	* Shared fetch logic — handles auth, 401, and network errors.
+	*
+	* `skipAuth` callers (public endpoints like OAuth device-code) opt out of
+	* the auth-header injection AND the synthetic 401 short-circuit. Without
+	* this opt-out, a CLI calling /auth/device-code (no token yet by design)
+	* would never reach the network — the `getToken: () => null` path would
+	* synthesize a 401 and fire onAuthFailure, breaking the entire flow.
+	*/
+	async _fetchResponse(path, options, skipAuth = false) {
+		try {
+			const url = `${this.apiBaseUrl}${path}`;
+			const headers = new Headers(options?.headers);
+			if (typeof options?.body === "string" && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
+			headers.set("x-correlation-id", correlationId());
+			if (!skipAuth) {
+				const token = await this.getToken();
+				if (!token) {
+					this.onAuthFailure?.();
+					return {
+						ok: false,
+						result: {
+							ok: false,
+							error: "No auth token available",
+							status: 401
+						}
+					};
+				}
+				headers.set("Authorization", `Bearer ${token}`);
+			}
+			const res = await fetch(url, {
+				...options,
+				headers
+			});
+			if (res.status === 401 && !skipAuth) {
+				this.onAuthFailure?.();
+				return {
+					ok: false,
+					result: {
+						ok: false,
+						error: "Session expired",
+						status: 401
+					}
+				};
+			}
+			if (!res.ok) {
+				const text = res.status === 204 ? "" : await res.text();
+				let body;
+				if (text) try {
+					body = JSON.parse(text);
+				} catch {
+					body = text;
+				}
+				const errBody = body;
+				const errorMessage = typeof errBody === "object" ? errBody.message : void 0;
+				return {
+					ok: false,
+					body,
+					result: {
+						ok: false,
+						error: errorMessage ?? (typeof body === "string" ? body : `API error: ${String(res.status)}`),
+						status: res.status
+					}
+				};
+			}
+			return {
+				ok: true,
+				res
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				result: {
+					ok: false,
+					error: err instanceof Error ? err.message : "Network error"
+				}
+			};
+		}
+	}
+	async _fetch(path, options, skipAuth = false) {
+		const response = await this._fetchResponse(path, options, skipAuth);
+		if (!response.ok) return response;
+		const text = response.res.status === 204 ? "" : await response.res.text();
+		let body;
+		if (text) try {
+			body = JSON.parse(text);
+		} catch {
+			body = text;
+		}
+		return {
+			ok: true,
+			res: response.res,
+			body
+		};
+	}
+	/**
+	* Make an authenticated request to an Alfe API endpoint.
+	* Unwraps the @auriclabs/api-core `{ data, timestamp, requestId }` envelope.
+	*/
+	async request(path, options) {
+		const result = await this._fetch(path, options);
+		if (!result.ok) return result.result;
+		if (result.body === void 0) return {
+			ok: true,
+			data: void 0
+		};
+		return {
+			ok: true,
+			data: result.body.data
+		};
+	}
+	/**
+	* Make an authenticated request whose 403 response may ask Clerk to
+	* reverify the current session. Unlike `request`, this preserves only the
+	* strictly validated Clerk hint; all ordinary failures retain `ApiResult`.
+	*/
+	async reverifiableRequest(path, options) {
+		const result = await this._fetch(path, options);
+		if (!result.ok) {
+			if (isClerkReverificationResponse(result.body)) return createClerkReverificationResponse(result.body.clerk_error.metadata.reverification.afterMinutes);
+			return result.result;
+		}
+		if (result.body === void 0) return {
+			ok: true,
+			data: void 0
+		};
+		return {
+			ok: true,
+			data: result.body.data
+		};
+	}
+	/**
+	* Make a request to a PUBLIC endpoint that does not require authentication.
+	* Skips both the Authorization header injection AND the onAuthFailure
+	* callback. Use for endpoints like /auth/device-code that the CLI hits
+	* before it has a token.
+	*/
+	async publicRequest(path, options) {
+		const result = await this._fetch(path, options, true);
+		if (!result.ok) return result.result;
+		if (result.body === void 0) return {
+			ok: true,
+			data: void 0
+		};
+		return {
+			ok: true,
+			data: result.body.data
+		};
+	}
+	/**
+	* Make an authenticated request that returns the body directly (no envelope unwrap).
+	* Use for APIs that don't use the @auriclabs/api-core response format (e.g. gateway).
+	*/
+	async rawRequest(path, options) {
+		const result = await this._fetch(path, options);
+		if (!result.ok) return result.result;
+		return {
+			ok: true,
+			data: result.body
+		};
+	}
+	/**
+	* Make an authenticated request without attempting text/JSON decoding.
+	* Use for downloads such as a Teams app ZIP where UTF-8 conversion would
+	* corrupt the payload.
+	*/
+	async binaryRequest(path, options) {
+		const result = await this._fetchResponse(path, options);
+		if (!result.ok) return result.result;
+		try {
+			return {
+				ok: true,
+				data: {
+					body: await result.res.arrayBuffer(),
+					contentType: result.res.headers.get("Content-Type") ?? void 0,
+					contentDisposition: result.res.headers.get("Content-Disposition") ?? void 0
+				}
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: err instanceof Error ? err.message : "Failed to read binary response"
+			};
+		}
+	}
+	getApiBaseUrl() {
+		return this.apiBaseUrl;
+	}
+};
 //#endregion
 //#region ../../packages-internal/api-client/dist/services/auth.js
 var AuthService = class {
@@ -4818,6 +4895,24 @@ var AuthService = class {
 	deleteToken(tokenId) {
 		return this.client.request(`${this.prefix}/tokens/${encodeURIComponent(tokenId)}`, { method: "DELETE" });
 	}
+	mintPartnerDelegation(input) {
+		return this.client.request(`${this.prefix}/partner-delegations`, {
+			method: "POST",
+			body: JSON.stringify(input)
+		});
+	}
+	mintPartnerElevatedDelegation(input) {
+		return this.client.request(`${this.prefix}/partner-delegations/elevated`, {
+			method: "POST",
+			body: JSON.stringify(input)
+		});
+	}
+	refreshPartnerDelegation(delegationId) {
+		return this.client.request(`${this.prefix}/partner-delegations/${encodeURIComponent(delegationId)}/refresh`, { method: "POST" });
+	}
+	revokePartnerDelegation(delegationId) {
+		return this.client.request(`${this.prefix}/partner-delegations/${encodeURIComponent(delegationId)}`, { method: "DELETE" });
+	}
 	/**
 	* Start a device-code flow. Called by the CLI when the user runs
 	* `alfe login` and picks the browser path. The returned `device_code`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/gateway",
-  "version": "0.9.11",
+  "version": "0.9.12",
   "description": "Alfe local gateway daemon — persistent control plane for agent integrations",
   "type": "module",
   "bin": {
@@ -23,7 +23,7 @@
     "pino-roll": "^1.2.0",
     "smol-toml": ">=1.6.1",
     "ws": "^8.18.0",
-    "@alfe.ai/agent-api-client": "^0.16.1",
+    "@alfe.ai/agent-api-client": "^0.17.0",
     "@alfe.ai/ai-proxy-local": "^0.0.16",
     "@alfe.ai/config": "^0.4.1",
     "@alfe.ai/integration-manifest": "^0.3.6",