@allstak/wizard 0.1.3

package/CHANGELOG.md

@@ -0,0 +1,90 @@
+# Changelog
+
+All notable changes to `@allstak/wizard` will be documented here. The format
+follows [Keep a Changelog](https://keepachangelog.com/) and this project
+adheres to [Semantic Versioning](https://semver.org/).
+
+## [Unreleased] — 0.1.3
+
+### Added
+- Privacy-safe telemetry (`src/telemetry/*`) — disabled by default until an
+  HTTP provider is wired in. `--no-telemetry` / `--telemetry-debug` flags +
+  `ALLSTAK_WIZARD_TELEMETRY=0` env opt-out. Provider abstraction allows
+  swapping between `noopTelemetry` and `httpTelemetry({ endpoint })`. Test
+  asserts the payload contains EXACTLY the documented fields.
+- Centralised error catalog (`src/util/error-codes.ts`) with 22 canonical
+  codes. Every `WizardError` carries a stable `code` (public contract) and
+  optional `subcode` (internal grep). Coupled refactor of every throw site
+  to align with the catalog. JSON output now includes the structured error
+  via `WizardError.toPublicJSON()`.
+- `allstak.config.*` schema versioning: `schemaVersion` field +
+  `runConfigMigrations()` runner + `allstak config validate` /
+  `allstak config migrate` commands. Migration list is empty in v0.1.3
+  (current schema is v1) but the runner is plumbed and tested.
+- 11 public-beta docs under `docs/beta/`: quickstart, react, next, node,
+  doctor, restore, config, ci, privacy, known-limitations,
+  troubleshooting.
+- Canonical error catalog doc at `docs/errors.md`.
+
+### Changed
+- CLI top-level error handler routes through `toWizardError()` and emits a
+  structured JSON envelope under `--json` even when a command throws before
+  the reporter finalises.
+- `CredentialError` now extends `WizardError` (canonical code
+  `E_PERMISSION_DENIED`); old `CredentialError.code` becomes `subcode`.
+- `TransactionAbortedError.cause` renamed to `originalCause` to avoid
+  shadowing `Error.cause`.
+
+### Internal
+- Telemetry runtime threads through every command via `withTelemetry()`
+  wrapper in `cli.ts`. Provider failures NEVER abort the wizard.
+- Anonymous install id stored at `~/.config/allstak/install-id`; rotates
+  on file deletion.
+
+## [0.1.2] — 2026-05-07
+
+### Added
+- Real `allstak login` / `logout` / `whoami` against the AllStak email-OTP backend
+  (`/api/v1/auth/request-otp` → `/api/v1/auth/verify-otp`), with TOTP second-factor
+  support and JWT refresh-token rotation via `/api/v1/auth/refresh`.
+- Cross-platform credential storage: macOS Keychain (via `security`), Linux
+  Secret Service (via `secret-tool`), and an AES-256-GCM encrypted-file fallback
+  with machine-bound key derivation. `ALLSTAK_CREDENTIAL_STORE` env var to force
+  a specific store for testing.
+- `allstak.config.{ts,mts,mjs,js,cjs,json}` discovery via `defineConfig()` with
+  full schema validation and unknown-key suggestion. Precedence:
+  CLI > env > config > defaults. Self-hosted endpoints (`apiHost`/`ingestHost`/
+  `dashboardHost`) configurable from the file.
+- `allstak orgs list` and `allstak projects list/create` against
+  `/api/v1/organizations` and `/api/v1/projects`. `--with-api-key` mints a
+  project key after creation.
+- `allstak restore` (`list` / `show` / `apply` / `diff`) operating on
+  `.allstak-wizard/backups/`. Per-file restore, dry-run, transactional rollback.
+- `allstak doctor` rewritten with deterministic stages: `auth` → `reachability`
+  → `config` → `integration` → `event-ingest` → `release-linkage` → `source-maps`.
+  `--live-probe` sends a real test event via `POST /ingest/v1/errors` and polls
+  `GET /api/v1/errors` for ingestion. Each stage returns
+  `pass`/`warn`/`fail`/`skip` with an exact actionable fix.
+- semantic-release config + GitHub Actions matrix CI for React+Vite, Next
+  (app + pages router), and Node fixtures across Node 18/20/22.
+
+### Changed
+- `buildContext` is now async and returns `{ ctx, resolvedConfig, configSource }`
+  so commands can surface the active config source in `--json` output.
+
+### Internal
+- `src/api/` typed HTTP client with auth modes (`bearer` / `apiKey` / `none`),
+  request timeouts, and backend-error code preservation.
+- `src/credentials/` multi-backend store with platform auto-detection.
+- `src/snapshot/restore.ts` exposes `restoreSnapshot` / `restoreFiles` /
+  `diffSnapshot` for programmatic recovery.
+
+## [0.1.1] — 2026-05-07
+
+Architecture hardening release. See report
+`docs/reports/2026-05-07-allstak-wizard-v0.1.1-architecture-hardening.md`.
+
+## [0.1.0] — 2026-05-07
+
+Initial scaffold. See report
+`docs/reports/2026-05-07-allstak-wizard-v0.1-implementation.md`.

package/README.md

@@ -0,0 +1,79 @@
+# @allstak/wizard
+
+> v0.1 — Unified installation and configuration wizard for AllStak SDKs.
+
+A Sentry-Wizard-style CLI that installs and configures AllStak SDKs in your project with one command. Designed to be **honest by default**: only integrations validated end-to-end against real fixture projects ship with the `VALIDATED` tag; everything else is `SCAFFOLD` and refuses to apply patches without `--experimental`.
+
+## Status
+
+| Integration   | Tag         | Notes |
+|---------------|-------------|-------|
+| `react`       | VALIDATED   | Vite + plain React, AST-tested |
+| `next`        | VALIDATED   | Next 13+ app & pages router |
+| `js`          | VALIDATED   | Vanilla Node entry-point patching |
+| `expo`        | SCAFFOLD    | Config-plugin path scaffolded; native build verification deferred to v0.2 |
+| `react-native` | UNSUPPORTED | Bare RN intentionally refused — Podfile/Gradle patching not validated |
+| `nestjs` / `fastify` / `otel` / `python` / `go` / `java` / `php` / `ruby` / `dotnet` / `flutter` | SCAFFOLD | Env-var writing only; framework wiring deferred to v0.2 |
+
+Run `allstak-wizard list` to see this matrix at runtime.
+
+## Install
+
+In v0.1 the package is not published. To run from source:
+
+```bash
+cd /path/to/sdks/allstak-wizard
+npm install
+npx tsx src/cli.ts --help
+```
+
+## Usage
+
+```bash
+# Auto-detect framework, interactive
+allstak-wizard
+
+# Explicit, non-interactive
+allstak-wizard -i react --api-key $ALLSTAK_API_KEY -y
+
+# Self-hosted
+allstak-wizard -i next --host https://api.acme.allstak.com --api-key $KEY -y
+
+# Dry run (prints diff, writes nothing)
+allstak-wizard -i react --dry-run -y
+
+# Other commands
+allstak-wizard list
+allstak-wizard doctor [-i react]
+allstak-wizard repair -i react
+allstak-wizard uninstall -i react -y
+```
+
+## Authentication (v0.1)
+
+Browser/device-flow login is **not** implemented in v0.1. Provide a key via `--api-key` or `ALLSTAK_API_KEY`. `allstak-wizard login` exits with a clear hint.
+
+## Architecture
+
+- **Registry** — every integration is an `Integration` object with `detect`, `plan`, `install`, `patch`, `validate`, `uninstall`, `repair`, `doctor` methods. New integrations register themselves; the CLI is integration-agnostic.
+- **Transaction** — every file mutation goes through a `Transaction` that snapshots before writing, validates syntax after writing, and rolls back the entire batch on any failure.
+- **Markers** — every injected region is wrapped with `>>> allstak-wizard:v1` markers. Re-runs replace the existing block (idempotent). `uninstall` removes the block cleanly.
+- **AST patching** — JS/TS files use `magicast` (recast under the hood) to add imports without disturbing user code; non-AST changes (provider wrap hints, Vite plugin hints) live in marker blocks.
+- **Dry-run** — every command supports `--dry-run`; the transaction layer captures the diff but skips disk writes.
+
+## Self-hosted support
+
+The wizard never assumes `api.allstak.sa`; pass `--host`, `--ingest-host`, and `--dashboard-host` to point at any AllStak deployment. Note: the Java SDK currently hardcodes its host — that's a known SDK-side bug, not a wizard bug. See the v0.1 implementation report for details.
+
+## Testing
+
+```bash
+npm run test              # 46 tests across markers, transaction, patchers, detect, integrations
+npm run type-check
+```
+
+Tests use temp-dir fixtures (no network, no SDK install required) and validate idempotency, rollback, dry-run, and uninstall round-trips for all VALIDATED integrations.
+
+## v0.2 roadmap
+
+See `docs/reports/allstak-unified-sdk-wizard-v0.1-implementation.md` (in the platform monorepo) for the full plan.

package/dist/api/auth-client.d.ts

@@ -0,0 +1,22 @@
+import type { TokenPair, MeResponse } from './types.js';
+/**
+ * Auth API client — wraps `/api/v1/auth/*` endpoints from the AllStak backend.
+ *
+ * Backend reference (verified 2026-05-07):
+ *   POST /api/v1/auth/request-otp   → 200 { status: "sent" } (enumeration-safe)
+ *   POST /api/v1/auth/verify-otp    → 200 TokenPair (or { requires2fa: true } partial)
+ *   POST /api/v1/auth/verify-2fa-login → 200 TokenPair (full)
+ *   POST /api/v1/auth/refresh       → 200 TokenPair (rotated)
+ *   POST /api/v1/auth/logout        → 204 (revokes current session)
+ *   GET  /api/v1/auth/me            → 200 MeResponse
+ *   GET  /api/v1/auth/check-2fa     → 200 { required: boolean }
+ */
+export declare function requestOtp(host: string, email: string): Promise<{
+    status: string;
+}>;
+export declare function verifyOtp(host: string, email: string, code: string): Promise<TokenPair>;
+export declare function verify2faLogin(host: string, partialToken: string, totpCode: string): Promise<TokenPair>;
+export declare function refreshTokens(host: string, refreshToken: string): Promise<TokenPair>;
+export declare function logout(host: string, accessToken: string): Promise<void>;
+export declare function whoami(host: string, accessToken: string): Promise<MeResponse>;
+//# sourceMappingURL=auth-client.d.ts.map

package/dist/api/auth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-client.d.ts","sourceRoot":"","sources":["../../src/api/auth-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExD;;;;;;;;;;;GAWG;AAEH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAQzF;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAQ7F;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAQ7G;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAQ1F;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM7E;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAOnF"}

package/dist/api/auth-client.js

@@ -0,0 +1,65 @@
+import { apiRequest } from './http.js';
+/**
+ * Auth API client — wraps `/api/v1/auth/*` endpoints from the AllStak backend.
+ *
+ * Backend reference (verified 2026-05-07):
+ *   POST /api/v1/auth/request-otp   → 200 { status: "sent" } (enumeration-safe)
+ *   POST /api/v1/auth/verify-otp    → 200 TokenPair (or { requires2fa: true } partial)
+ *   POST /api/v1/auth/verify-2fa-login → 200 TokenPair (full)
+ *   POST /api/v1/auth/refresh       → 200 TokenPair (rotated)
+ *   POST /api/v1/auth/logout        → 204 (revokes current session)
+ *   GET  /api/v1/auth/me            → 200 MeResponse
+ *   GET  /api/v1/auth/check-2fa     → 200 { required: boolean }
+ */
+export async function requestOtp(host, email) {
+    const res = await apiRequest(host, {
+        method: 'POST',
+        path: '/api/v1/auth/request-otp',
+        body: { email },
+        auth: { kind: 'none' },
+    });
+    return res.data;
+}
+export async function verifyOtp(host, email, code) {
+    const res = await apiRequest(host, {
+        method: 'POST',
+        path: '/api/v1/auth/verify-otp',
+        body: { email, code },
+        auth: { kind: 'none' },
+    });
+    return res.data;
+}
+export async function verify2faLogin(host, partialToken, totpCode) {
+    const res = await apiRequest(host, {
+        method: 'POST',
+        path: '/api/v1/auth/verify-2fa-login',
+        body: { code: totpCode },
+        auth: { kind: 'bearer', token: partialToken },
+    });
+    return res.data;
+}
+export async function refreshTokens(host, refreshToken) {
+    const res = await apiRequest(host, {
+        method: 'POST',
+        path: '/api/v1/auth/refresh',
+        body: { refreshToken },
+        auth: { kind: 'none' }, // refresh endpoint accepts the token in body
+    });
+    return res.data;
+}
+export async function logout(host, accessToken) {
+    await apiRequest(host, {
+        method: 'POST',
+        path: '/api/v1/auth/logout',
+        auth: { kind: 'bearer', token: accessToken },
+    });
+}
+export async function whoami(host, accessToken) {
+    const res = await apiRequest(host, {
+        method: 'GET',
+        path: '/api/v1/auth/me',
+        auth: { kind: 'bearer', token: accessToken },
+    });
+    return res.data;
+}
+//# sourceMappingURL=auth-client.js.map

package/dist/api/auth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-client.js","sourceRoot":"","sources":["../../src/api/auth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGvC;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAqB,IAAI,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE,EAAE,KAAK,EAAE;QACf,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KACvB,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa,EAAE,IAAY;IACvE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAY,IAAI,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;QACrB,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KACvB,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,YAAoB,EAAE,QAAgB;IACvF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAY,IAAI,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,+BAA+B;QACrC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE;KAC9C,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,YAAoB;IACpE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAY,IAAI,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,sBAAsB;QAC5B,IAAI,EAAE,EAAE,YAAY,EAAE;QACtB,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,6CAA6C;KACtE,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,WAAmB;IAC5D,MAAM,UAAU,CAAU,IAAI,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,WAAmB;IAC5D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAa,IAAI,EAAE;QAC7C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;KAC7C,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC"}

package/dist/api/auth.d.ts

@@ -0,0 +1,39 @@
+import type { Credentials } from '../credentials/types.js';
+/**
+ * Auth resolution helpers.
+ *
+ * Two modes the wizard supports:
+ *
+ *   1. CI / one-shot: caller provides a project API key via --api-key or
+ *      `ALLSTAK_API_KEY`. Used for `allstak-wizard -i react --api-key ...`.
+ *
+ *   2. Interactive: user has run `allstak login` first; the wizard reads the
+ *      JWT from the credential store and auto-refreshes it when expired.
+ *      Used for `allstak orgs list`, `allstak doctor`, etc.
+ *
+ * The two modes are NOT interchangeable: `--api-key` is a project-scoped
+ * ingestion credential and cannot list orgs; the JWT is a user credential and
+ * cannot send events. The control-plane vs. data-plane split mirrors what the
+ * backend exposes (`/api/v1/*` vs `/ingest/v1/*`).
+ */
+export interface AuthResolveOptions {
+    apiKey?: string;
+    envFallback?: boolean;
+}
+export declare function resolveApiKey(opts: AuthResolveOptions): string;
+/**
+ * Read user credentials from the platform credential store. Auto-refreshes
+ * the access token if it expires within the next 60s (the access TTL is 15
+ * minutes; we refresh proactively).
+ *
+ * Returns null when the user has not run `allstak login`. Throws when
+ * credentials exist but cannot be refreshed (caller should ask the user to
+ * re-authenticate).
+ */
+export declare function loadUserCredentials(host: string): Promise<Credentials | null>;
+/**
+ * Convenience wrapper that throws when the user is not logged in. Used by
+ * commands that absolutely require a user JWT (orgs/projects).
+ */
+export declare function requireUserCredentials(host: string): Promise<Credentials>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/api/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAgB9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA6BnF;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAc/E"}

package/dist/api/auth.js

@@ -0,0 +1,69 @@
+import { WizardError } from '../util/errors.js';
+import { getCredentialStore } from '../credentials/index.js';
+import { refreshTokens } from './auth-client.js';
+export function resolveApiKey(opts) {
+    if (opts.apiKey && opts.apiKey.trim().length > 0)
+        return opts.apiKey.trim();
+    if (opts.envFallback !== false) {
+        const fromEnv = process.env.ALLSTAK_API_KEY;
+        if (fromEnv && fromEnv.trim().length > 0)
+            return fromEnv.trim();
+    }
+    throw new WizardError('E_AUTH_REQUIRED', 'No AllStak project API key provided.', {
+        subcode: 'E_MISSING_KEY',
+        hint: 'Pass --api-key or set ALLSTAK_API_KEY in your environment. ' +
+            'Or run `allstak login` to authenticate as a user and `allstak projects create` to mint a key.',
+    });
+}
+/**
+ * Read user credentials from the platform credential store. Auto-refreshes
+ * the access token if it expires within the next 60s (the access TTL is 15
+ * minutes; we refresh proactively).
+ *
+ * Returns null when the user has not run `allstak login`. Throws when
+ * credentials exist but cannot be refreshed (caller should ask the user to
+ * re-authenticate).
+ */
+export async function loadUserCredentials(host) {
+    const store = await getCredentialStore();
+    const creds = await store.load(host);
+    if (!creds)
+        return null;
+    const now = Date.now();
+    const remainingMs = creds.accessExpiresAt - now;
+    if (remainingMs > 60_000)
+        return creds;
+    // Attempt refresh. If it fails (e.g. refresh token revoked), surface a clean
+    // error so the CLI can prompt for re-login.
+    try {
+        const tp = await refreshTokens(host, creds.refreshToken);
+        const refreshed = {
+            ...creds,
+            accessToken: tp.accessToken,
+            refreshToken: tp.refreshToken,
+            accessExpiresAt: now + tp.expiresInSeconds * 1000,
+            storedAt: now,
+        };
+        await store.save(refreshed);
+        return refreshed;
+    }
+    catch (err) {
+        throw new WizardError('E_AUTH_EXPIRED', `Stored credentials for ${host} are no longer valid (${err instanceof Error ? err.message : String(err)}).`, { subcode: 'E_AUTH_REFRESH_FAILED', context: { host }, cause: err });
+    }
+}
+/**
+ * Convenience wrapper that throws when the user is not logged in. Used by
+ * commands that absolutely require a user JWT (orgs/projects).
+ */
+export async function requireUserCredentials(host) {
+    const creds = await loadUserCredentials(host);
+    if (!creds) {
+        throw new WizardError('E_AUTH_REQUIRED', `Not logged in to ${host}.`, {
+            subcode: 'E_NOT_LOGGED_IN',
+            hint: 'Run `allstak login` first, or pass --api-key for ingestion-only commands.',
+            context: { host },
+        });
+    }
+    return creds;
+}
+//# sourceMappingURL=auth.js.map

package/dist/api/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA0BjD,MAAM,UAAU,aAAa,CAAC,IAAwB;IACpD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5E,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC5C,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,WAAW,CACnB,iBAAiB,EACjB,sCAAsC,EACtC;QACE,OAAO,EAAE,eAAe;QACxB,IAAI,EACF,6DAA6D;YAC7D,+FAA+F;KAClG,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,KAAK,CAAC,eAAe,GAAG,GAAG,CAAC;IAChD,IAAI,WAAW,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC;IAEvC,6EAA6E;IAC7E,4CAA4C;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,SAAS,GAAgB;YAC7B,GAAG,KAAK;YACR,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,YAAY,EAAE,EAAE,CAAC,YAAY;YAC7B,eAAe,EAAE,GAAG,GAAG,EAAE,CAAC,gBAAgB,GAAG,IAAI;YACjD,QAAQ,EAAE,GAAG;SACd,CAAC;QACF,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CACnB,gBAAgB,EAChB,0BAA0B,IAAI,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAC3G,EAAE,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY;IACvD,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,WAAW,CACnB,iBAAiB,EACjB,oBAAoB,IAAI,GAAG,EAC3B;YACE,OAAO,EAAE,iBAAiB;YAC1B,IAAI,EAAE,2EAA2E;YACjF,OAAO,EAAE,EAAE,IAAI,EAAE;SAClB,CACF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/api/client.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Minimal HTTP client used by `doctor` for connectivity probes and (eventually)
+ * by `login` once a real device-flow endpoint exists.
+ *
+ * Intentionally tiny: no retry, no auth wiring beyond a Bearer header. Doctor
+ * uses it to probe `${ingestHost}/health` and `${dashboardHost}/api/health`;
+ * any non-2xx is reported as a degraded check, not a hard failure.
+ */
+export interface ProbeResult {
+    ok: boolean;
+    status: number | null;
+    detail: string;
+}
+export declare function probe(url: string, headers?: Record<string, string>): Promise<ProbeResult>;
+//# sourceMappingURL=client.d.ts.map

package/dist/api/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAgBnG"}

package/dist/api/client.js

@@ -0,0 +1,19 @@
+export async function probe(url, headers = {}) {
+    try {
+        const res = await fetch(url, {
+            method: 'GET',
+            headers,
+            signal: AbortSignal.timeout(5000),
+        });
+        return {
+            ok: res.ok,
+            status: res.status,
+            detail: res.ok ? `HTTP ${res.status}` : `HTTP ${res.status} ${res.statusText}`,
+        };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { ok: false, status: null, detail: msg };
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/api/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,UAAkC,EAAE;IAC3E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE;SAC/E,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/api/http.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Minimal typed HTTP client for the AllStak control-plane API.
+ *
+ * Design rules:
+ *   - Pure function-based (no class state), one fetch per call.
+ *   - Auth modes are explicit per request: { kind: 'bearer'|'apiKey'|'none' }.
+ *   - Errors normalised into WizardError with backend `error.code` preserved.
+ *   - Times out at 15s by default; AbortSignal forwarded for cancellation.
+ *   - Never logs request bodies (might contain refresh tokens / API keys).
+ *
+ * The wizard intentionally does NOT use a fancy HTTP client — fetch is built-in
+ * since Node 18 and the surface we need is tiny (POST/GET, JSON in/out).
+ */
+export type AuthMode = {
+    kind: 'none';
+} | {
+    kind: 'bearer';
+    token: string;
+} | {
+    kind: 'apiKey';
+    key: string;
+};
+export interface RequestInit {
+    method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+    path: string;
+    /** Treated as JSON. */
+    body?: unknown;
+    query?: Record<string, string | number | boolean | undefined>;
+    auth: AuthMode;
+    /** Override default timeout (ms). */
+    timeoutMs?: number;
+    /** Forward an external abort signal (e.g. Ctrl+C). */
+    signal?: AbortSignal;
+    /** Override Content-Type — used by source-map upload (still JSON in body but custom MIME). */
+    contentType?: string;
+}
+export interface ApiResponse<T> {
+    status: number;
+    data: T;
+    /** True for 2xx. */
+    ok: boolean;
+}
+export declare function apiRequest<T>(host: string, init: RequestInit): Promise<ApiResponse<T>>;
+//# sourceMappingURL=http.d.ts.map

package/dist/api/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/api/http.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC9D,IAAI,EAAE,QAAQ,CAAC;IACf,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,8FAA8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,CAAC,CAAC;IACR,oBAAoB;IACpB,EAAE,EAAE,OAAO,CAAC;CACb;AAID,wBAAsB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAsE5F"}

package/dist/api/http.js

@@ -0,0 +1,130 @@
+import { WizardError } from '../util/errors.js';
+const DEFAULT_TIMEOUT = 15_000;
+export async function apiRequest(host, init) {
+    const url = buildUrl(host, init.path, init.query);
+    const headers = {
+        Accept: 'application/json',
+        'Content-Type': init.contentType ?? 'application/json',
+        'User-Agent': 'allstak-wizard',
+    };
+    if (init.auth.kind === 'bearer') {
+        headers.Authorization = `Bearer ${init.auth.token}`;
+    }
+    else if (init.auth.kind === 'apiKey') {
+        headers['X-AllStak-Key'] = init.auth.key;
+    }
+    const controller = new AbortController();
+    const externalSignal = init.signal;
+    const timeout = setTimeout(() => controller.abort(new Error('timeout')), init.timeoutMs ?? DEFAULT_TIMEOUT);
+    if (externalSignal) {
+        if (externalSignal.aborted)
+            controller.abort(externalSignal.reason);
+        else
+            externalSignal.addEventListener('abort', () => controller.abort(externalSignal.reason));
+    }
+    let res;
+    try {
+        res = await fetch(url, {
+            method: init.method,
+            headers,
+            body: init.body !== undefined ? JSON.stringify(init.body) : undefined,
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        clearTimeout(timeout);
+        if (err instanceof Error && /timeout/i.test(err.message)) {
+            throw new WizardError('E_NETWORK_FAILED', `Request to ${redactUrl(url)} timed out after ${(init.timeoutMs ?? DEFAULT_TIMEOUT) / 1000}s`, { subcode: 'E_HTTP_TIMEOUT', context: { method: init.method, path: init.path } });
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new WizardError('E_NETWORK_FAILED', `Network error contacting ${redactUrl(url)}: ${msg}`, { subcode: 'E_HTTP_NETWORK', cause: err, context: { method: init.method, path: init.path } });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+    let parsed = null;
+    const text = await res.text();
+    if (text.length > 0) {
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            // Some endpoints return text/plain on errors; preserve as a string.
+            parsed = text;
+        }
+    }
+    if (res.ok) {
+        return { status: res.status, data: parsed, ok: true };
+    }
+    // Normalise backend error envelope.
+    const body = parsed;
+    const backendCode = body?.error?.code ?? `HTTP_${res.status}`;
+    const message = body?.error?.message ?? res.statusText ?? 'Unknown error';
+    const canonical = canonicalCodeFor(res.status, backendCode);
+    throw new WizardError(canonical, `[${res.status}] ${redactUrl(url)} — ${message}`, {
+        subcode: backendCode,
+        hint: hintFor(backendCode, res.status),
+        context: { status: res.status, method: init.method, path: init.path },
+    });
+}
+function canonicalCodeFor(status, backendCode) {
+    if (status === 401)
+        return 'E_AUTH_EXPIRED';
+    if (status === 403)
+        return 'E_PERMISSION_DENIED';
+    if (status === 404) {
+        if (/PROJECT|ORG/i.test(backendCode))
+            return 'E_PROJECT_NOT_FOUND';
+        return 'E_BACKEND_CONTRACT_MISSING';
+    }
+    if (status === 409 || status === 422)
+        return 'E_CONFIG_INVALID';
+    if (backendCode === 'INVALID_API_KEY')
+        return 'E_AUTH_FAILED';
+    if (backendCode === 'INVALID_OTP' || backendCode === 'OTP_RATE_LIMITED')
+        return 'E_AUTH_FAILED';
+    if (status >= 500)
+        return 'E_NETWORK_FAILED';
+    return 'E_NETWORK_FAILED';
+}
+function buildUrl(host, path, query) {
+    const base = host.endsWith('/') ? host.slice(0, -1) : host;
+    const p = path.startsWith('/') ? path : `/${path}`;
+    if (!query)
+        return `${base}${p}`;
+    const params = new URLSearchParams();
+    for (const [k, v] of Object.entries(query)) {
+        if (v === undefined || v === null)
+            continue;
+        params.append(k, String(v));
+    }
+    const qs = params.toString();
+    return qs ? `${base}${p}?${qs}` : `${base}${p}`;
+}
+function redactUrl(url) {
+    // Strip any token/api_key query — defensive even though we don't put secrets there.
+    return url.replace(/(token|key|api_key)=[^&]+/gi, '$1=***');
+}
+function hintFor(code, status) {
+    switch (code) {
+        case 'INVALID_API_KEY':
+            return 'Confirm the API key is for this project; rotate via the dashboard if it was leaked.';
+        case 'INVALID_OTP':
+            return 'OTP codes expire in ~10 minutes. Request a new one with `allstak login`.';
+        case 'OTP_RATE_LIMITED':
+            return 'Too many OTP requests for this email — wait a minute and retry.';
+        case 'TOKEN_EXPIRED':
+            return 'Your session has expired. Run `allstak login` again.';
+        default:
+            if (status === 401)
+                return 'Authentication failed. Run `allstak login` to refresh credentials.';
+            if (status === 403)
+                return 'You don\'t have access to this resource.';
+            if (status === 404)
+                return 'Resource not found — check org/project slugs.';
+            if (status >= 500)
+                return 'AllStak backend is currently degraded. Retry in a moment.';
+            return undefined;
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/api/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/api/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA4ChD,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,IAAiB;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;QAC1B,cAAc,EAAE,IAAI,CAAC,WAAW,IAAI,kBAAkB;QACtD,YAAY,EAAE,gBAAgB;KAC/B,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC3C,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IAC5G,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,cAAc,CAAC,OAAO;YAAE,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;;YAC/D,cAAc,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,GAAG,YAAY,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,WAAW,CACnB,kBAAkB,EAClB,cAAc,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,GAAG,IAAI,GAAG,EAC7F,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,WAAW,CACnB,kBAAkB,EAClB,4BAA4B,SAAS,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EACpD,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAC7F,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC7D,CAAC;IACD,oCAAoC;IACpC,MAAM,IAAI,GAAG,MAAsC,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,UAAU,IAAI,eAAe,CAAC;IAC1E,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,GAAG,CAAC,MAAM,OAAO,EAAE,EAAE;QACjF,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;KACtE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,WAAmB;IAC3D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,gBAAgB,CAAC;IAC5C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,qBAAqB,CAAC;IACjD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,qBAAqB,CAAC;QACnE,OAAO,4BAA4B,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,kBAAkB,CAAC;IAChE,IAAI,WAAW,KAAK,iBAAiB;QAAE,OAAO,eAAe,CAAC;IAC9D,IAAI,WAAW,KAAK,aAAa,IAAI,WAAW,KAAK,kBAAkB;QAAE,OAAO,eAAe,CAAC;IAChG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,kBAAkB,CAAC;IAC7C,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,KAA+B;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,oFAAoF;IACpF,OAAO,GAAG,CAAC,OAAO,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc;IAC3C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB;YACpB,OAAO,qFAAqF,CAAC;QAC/F,KAAK,aAAa;YAChB,OAAO,0EAA0E,CAAC;QACpF,KAAK,kBAAkB;YACrB,OAAO,iEAAiE,CAAC;QAC3E,KAAK,eAAe;YAClB,OAAO,sDAAsD,CAAC;QAChE;YACE,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,oEAAoE,CAAC;YAChG,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,0CAA0C,CAAC;YACtE,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,+CAA+C,CAAC;YAC3E,IAAI,MAAM,IAAI,GAAG;gBAAE,OAAO,2DAA2D,CAAC;YACtF,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/api/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Programmatic surface for the API layer. Each verb is an isolated function so
+ * downstream callers can mock individual endpoints without re-exporting our
+ * fetch wrapper.
+ */
+export { apiRequest, type AuthMode, type ApiResponse } from './http.js';
+export { requestOtp, verifyOtp, verify2faLogin, refreshTokens, logout as logoutSession, whoami, } from './auth-client.js';
+export { listOrgs, createOrg, getOrg } from './orgs-client.js';
+export { listProjects, createProject, getProject, createApiKey, listApiKeys, } from './projects-client.js';
+export { setupDoctor, sendTestEvent, pollForProbeEvent, } from './setup-doctor-client.js';
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EACL,UAAU,EACV,SAAS,EACT,cAAc,EACd,aAAa,EACb,MAAM,IAAI,aAAa,EACvB,MAAM,GACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,EACV,YAAY,EACZ,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,WAAW,EACX,aAAa,EACb,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,cAAc,YAAY,CAAC"}