@astralbeam/sdk 0.10.1 → 0.12.0

package/README.md

@@ -1,6 +1,6 @@
 # @astralbeam/sdk
 
-Embed an agent chat sidebar in your web app, or build your own UI with the headless core. The widget isolates its styles in a shadow root.
+Embed an agent chat sidebar or read-only tenant directories in your web app, or build your own chat UI with the headless core. The widgets isolate their styles in shadow roots.
 
 ```sh
 npm install @astralbeam/sdk
@@ -25,6 +25,16 @@ const handle = mountAstralBeamChat(document.getElementById("sidebar"), {})
 // Update with handle.update({ colorScheme: "dark" }), then clean up with handle.unmount().
 ```
 
+Without npm or a bundler, import the same entry from jsDelivr in a module script. Pin an exact version and the full `/dist/client.js` path, because the loader imports its lazy chunks relative to itself. See [Script tag](https://app.astralbeam.ai/docs/sdk/script-tag).
+
+```html
+<script type="module">
+  import { mountAstralBeamChat } from "https://cdn.jsdelivr.net/npm/@astralbeam/sdk@0.12.0/dist/client.js"
+
+  mountAstralBeamChat(document.getElementById("sidebar"), {})
+</script>
+```
+
 - The widget fills its container, so give it a parent with a definite height (`min-h-0` in a flex column).
 - Chat uses the hosted cloud by default. Tokens come from your application. For self-hosting, set `apiUrl` to your deployment’s `/api` base.
 - `@astralbeam/sdk/client` ships no React. The chat loads as a lazy chunk with its own bundled copy.
@@ -41,48 +51,57 @@ import { createAstralBeamToken } from "@astralbeam/sdk/server"
 const apiKey = process.env.ASTRALBEAM_API_KEY // key_<organizationId>_<id>_abo_<secret>
 
 export async function POST(request: Request) {
-  if (!apiKey) return Response.json({ error: "Not configured" }, { status: 503 })
+  const headers = { "Cache-Control": "no-store" }
+  if (!apiKey) return Response.json({ error: "Not configured" }, { status: 503, headers })
   const session = await getApplicationSession(request)
-  if (!session) return Response.json({ error: "Unauthenticated" }, { status: 401 })
-  const token = await createAstralBeamToken({
-    apiKey,
-    user: {
-      id: session.user.id,
-      name: session.user.name,
-      metadata: { email: session.user.email },
-    },
-    tenant: {
-      id: session.tenant.id,
-      name: session.tenant.name,
-      metadata: { plan: session.tenant.plan },
-    },
-  })
-  return Response.json({ token }, { headers: { "cache-control": "no-store" } })
+  if (!session) return Response.json({ error: "Unauthenticated" }, { status: 401, headers })
+  try {
+    const token = await createAstralBeamToken({
+      apiKey,
+      user: {
+        id: session.user.id,
+        name: session.user.name,
+        metadata: { email: session.user.email },
+      },
+      tenant: {
+        id: session.tenant.id,
+        name: session.tenant.name,
+        metadata: { plan: session.tenant.plan },
+      },
+    })
+    return Response.json({ token }, { headers })
+  } catch {
+    return Response.json({ error: "Token could not be issued" }, { status: 500, headers })
+  }
 }
 ```
 
 - Authenticate once and derive stable `user.id` and `tenant.id` values from that trusted session.
 - Keep API keys server-only. Tokens are signed, not encrypted, so their claims must contain no secrets.
 - Return `Cache-Control: no-store` and fail closed when configuration or authentication is missing.
+- Directory access additionally requires signed `user.admin: true`, derived from trusted tenant permissions, and persisted records. Follow [Tenant directories](https://app.astralbeam.ai/docs/sdk/listings).
 - For employee-facing Tenant management, use `createAstralBeamOrganizationToken`. The [API client guide](https://app.astralbeam.ai/docs/sdk/api) covers database-backed roles and browser integration.
 
+Existing token props and the default chat endpoint keep working. After acquiring a token, components call `POST /api/v1/me` and renew before expiry. See [authentication and refresh behavior](https://app.astralbeam.ai/docs/sdk/authentication).
+
 ## Options
 
 Every option is also a prop on `<AstralBeamChat>`. `handle.update(options)` applies any subset in place, and no option is fixed at mount. Details in [Configuration](https://app.astralbeam.ai/docs/sdk/configuration).
 
-| Option                               | Default                            | Meaning                                                              |
-| ------------------------------------ | ---------------------------------- | -------------------------------------------------------------------- |
-| `agentId`                            | organization's default             | `agent_<orgId>_<id>`, copied from the dashboard                      |
-| `apiUrl`                             | `https://app.astralbeam.ai/api`    | Base URL of the AstralBeam API. The widget calls `/v1/chat` there    |
-| `fetchAstralBeamToken`               | `{ url: "/api/astralbeam/token" }` | Chat auth token endpoint as `{ url, ...RequestInit }`, or a minter   |
-| `title`, `showHeader`                | `"AstralBeam"`, `true`             | Header text, and whether the header and reset button show            |
-| `emptyTitle`, `emptyDescription`     | generic copy                       | Headline and subtitle of the empty transcript                        |
-| `colorScheme`, `theme`               | `"system"`, built-in palette       | Light/dark/system, and shadcn token overrides                        |
-| `attachments`                        | `true`                             | `false` hides the feature, or pass limits                            |
-| `tools`, `widgets`                   | none                               | What the agent can do and draw in your app                           |
-| `sandboxPanel`                       | `false`                            | Collected sandbox panel: files with downloads, command log           |
-| `header`, `empty`, `composerActions` | widget's own chrome                | Host-rendered replacements (React props. `slots` on the handle)      |
-| `debug`                              | `false`                            | Log SDK actions in the browser, with server logs in development only |
+| Option | Default | Meaning |
+| --- | --- | --- |
+| `agentId` | organization's default | `agent_<orgId>_<id>`, copied from the dashboard |
+| `apiUrl` | `https://app.astralbeam.ai/api` | Base URL of the AstralBeam API. The widget calls `/v1/chat` there |
+| `fetchAstralBeamToken` | `{ url: "/api/astralbeam/token" }` | Chat auth token endpoint as `{ url, ...RequestInit }`, or a minter |
+| `title`, `showHeader` | `"AstralBeam"`, `true` | Header text, and whether the header and reset button show |
+| `emptyTitle`, `emptyDescription` | generic copy | Headline and subtitle of the empty transcript |
+| `colorScheme`, `theme` | `"system"`, built-in palette | Light/dark/system, and shadcn token overrides |
+| `customCss` | None | Trusted CSS inside the widget's Shadow DOM |
+| `attachments` | `true` | `false` hides the feature, or pass limits |
+| `tools`, `widgets` | none | What the agent can do and draw in your app |
+| `sandboxPanel` | `false` | Collected sandbox panel: files with downloads, command log |
+| `header`, `empty`, `composerActions` | widget's own chrome | Host-rendered replacements (React props. `slots` on the handle) |
+| `debug` | `false` | Log SDK actions in the browser, with server logs in development only |
 
 A `ref` on `<AstralBeamChat>` (and the vanilla handle) exposes `reset()` and `stop()` for hosts that draw their own controls.
 
@@ -113,29 +132,33 @@ widgets: {
 
 ## Documentation
 
-| Guide                                                                     | Covers                                                  |
-| ------------------------------------------------------------------------- | ------------------------------------------------------- |
-| [API client](https://app.astralbeam.ai/docs/sdk/api)                      | Typed resource and chat requests with API keys or JWTs. |
-| [Getting started](https://app.astralbeam.ai/docs/sdk/getting-started)     | install, mount, layout requirements.                    |
-| [Authentication](https://app.astralbeam.ai/docs/sdk/authentication)       | the token endpoint and its security rules.              |
-| [Configuration](https://app.astralbeam.ai/docs/sdk/configuration)         | every option, and what `update` can change.             |
-| [Theming](https://app.astralbeam.ai/docs/sdk/theming)                     | color schemes, CSS tokens, the shadow-root boundary.    |
-| [Tools and widgets](https://app.astralbeam.ai/docs/sdk/tools-and-widgets) | schemas, live state, rendering into the transcript.     |
-| [Attachments](https://app.astralbeam.ai/docs/sdk/attachments)             | file kinds, limits, what the endpoint enforces.         |
-| [Limits](https://app.astralbeam.ai/docs/sdk/limits)                       | request, attachment, and sandbox limits.                |
-| [Sandbox](https://app.astralbeam.ai/docs/sdk/sandbox)                     | steps, the opt-in panel, downloads, inline images.      |
-| [Headless](https://app.astralbeam.ai/docs/sdk/headless)                   | own the whole chat UI on the same session.              |
-| [Security model](https://app.astralbeam.ai/docs/sdk/security)             | who grants, who enforces, what the client can change.   |
+| Guide | Covers |
+| --- | --- |
+| [API client](https://app.astralbeam.ai/docs/sdk/api) | Typed resource and chat requests with API keys or JWTs. |
+| [Getting started](https://app.astralbeam.ai/docs/sdk/getting-started) | install, mount, layout requirements. |
+| [Script tag](https://app.astralbeam.ai/docs/sdk/script-tag) | loading from jsDelivr without a bundler, and Ruby on Rails. |
+| [Authentication](https://app.astralbeam.ai/docs/sdk/authentication) | the token endpoint, its security rules, and minting in other languages. |
+| [Tenant directories](https://app.astralbeam.ai/docs/sdk/listings) | provisioning, tenant-user and Tenant listings, lifecycle, and options. |
+| [Configuration](https://app.astralbeam.ai/docs/sdk/configuration) | every option, and what `update` can change. |
+| [Theming](https://app.astralbeam.ai/docs/sdk/theming) | color schemes, CSS tokens, the shadow-root boundary. |
+| [Tools and widgets](https://app.astralbeam.ai/docs/sdk/tools-and-widgets) | schemas, live state, rendering into the transcript. |
+| [Attachments](https://app.astralbeam.ai/docs/sdk/attachments) | file kinds, limits, what the endpoint enforces. |
+| [Limits](https://app.astralbeam.ai/docs/sdk/limits) | request, attachment, and sandbox limits. |
+| [Sandbox](https://app.astralbeam.ai/docs/sdk/sandbox) | steps, the opt-in panel, downloads, inline images. |
+| [Headless](https://app.astralbeam.ai/docs/sdk/headless) | own the whole chat UI on the same session. |
+| [Security model](https://app.astralbeam.ai/docs/sdk/security) | who grants, who enforces, what the client can change. |
 
 ## Entry points
 
+Read-only Tenant and TenantUser widgets are available from `/client` and `/react`. See [Tenant directories](https://app.astralbeam.ai/docs/sdk/listings) for setup and embedding examples.
+
 There is no root export. Conversation history is not built yet.
 
 | Entry point              | Contents                                     | Peer dependency      |
 | ------------------------ | -------------------------------------------- | -------------------- |
-| `@astralbeam/sdk/client` | `mountAstralBeamChat`, the vanilla loader    | none                 |
+| `@astralbeam/sdk/client` | Chat and Tenant directory mounts             | none                 |
 | `@astralbeam/sdk/core`   | `createAstralBeamChat`, the headless session | none                 |
-| `@astralbeam/sdk/react`  | `<AstralBeamChat>`, `useAstralBeamChat`      | `react`, `react-dom` |
+| `@astralbeam/sdk/react`  | Chat hooks and isolated UI wrappers          | `react`, `react-dom` |
 | `@astralbeam/sdk/server` | Tenant and organization token minters        | none                 |
 | `@astralbeam/sdk/api`    | Resource and chat HTTP helpers               | none                 |
 
@@ -143,7 +166,9 @@ Types resolve under every TypeScript module resolution mode, including classic `
 
 ## Example
 
-[`examples/todos`](../examples/todos) embeds the sidebar in a minimal TanStack Start app: a demo token route, host tools over live React state, and a `todoCard` widget. It uses no Tailwind or shadcn/ui of its own, to show the shadow-root boundary.
+[`examples/todos`](../examples/todos) embeds the sidebar and a tenant-scoped user listing in a minimal TanStack Start app. Both use the same demo token route. The app also demonstrates host tools over live React state and a `todoCard` widget, with no Tailwind or shadcn/ui of its own.
+
+[`examples/todos-rails`](../examples/todos-rails) is the same app in Ruby on Rails 8. It loads the SDK from jsDelivr through an import map, mounts it from a plain ES module, mints tokens with the `jwt` gem, and gives the agent tools over the app's JSON API.
 
 ## License
 

package/dist/{api-CaNIR6Af.js → api-DiwSihrG.js}

@@ -29,7 +29,8 @@ async function apiResponse(path, options) {
 	if (astralBeamToken) headers.set("authorization", `Bearer ${astralBeamToken}`);
 	const response = await fetchClient(resolveApiUrl(path, apiUrl), {
 		...init,
-		headers
+		headers,
+		...apiKey ? { redirect: "error" } : {}
 	});
 	if (response.ok) return response;
 	const value = await response.json().catch((error) => {
@@ -230,6 +231,19 @@ const updateTenantUser = (tenantId, id, updateTenantUserInput, options) => {
 		body: JSON.stringify(updateTenantUserInput)
 	});
 };
+const getGetOrganizationUrl = () => {
+	return `/api/v1/organization`;
+};
+/**
+* Return the id, name, and slug of the Organization that owns the credential. Accepts an organization API key or organization-management JWT, including a viewer's. Tenant JWTs are forbidden.
+* @summary Get the current Organization
+*/
+const getOrganization = (options) => {
+	return astralBeamApiFetch(getGetOrganizationUrl(), {
+		...options,
+		method: "GET"
+	});
+};
 const getRunChatUrl = () => {
 	return `/api/v1/chat`;
 };
@@ -292,5 +306,18 @@ const getChatFile = (params, options) => {
 		method: "GET"
 	});
 };
+const getGetCurrentUserUrl = () => {
+	return `/api/v1/me`;
+};
+/**
+* Use a tenant JWT to upsert its own Tenant and TenantUser atomically, without requiring admin authority. Supplied names and metadata replace stored values, omitted profile fields and admin are preserved, and an explicit admin claim updates stored admin. An organization JWT returns existing user membership and the current database role without provisioning identities. API keys and cookies are not accepted. Limited to 100 requests per five minutes per identity.
+* @summary Get the current user
+*/
+const getCurrentUser = (options) => {
+	return astralBeamJwtFetch(getGetCurrentUserUrl(), {
+		...options,
+		method: "POST"
+	});
+};
 //#endregion
-export { updateTenantUser as C, DEFAULT_CHAT_AUTH_TOKEN_URL as D, resolveApiUrl as E, DEFAULT_COLOR_SCHEME as O, updateTenant as S, isAstralBeamApiError as T, getUpdateTenantUrl as _, getChatFile as a, listUsersForTenant as b, getGetChatConfigUrl as c, getGetTenantUserUrl as d, getListTenantsUrl as f, getTenantUser as g, getTenant as h, getChatConfig as i, getGetChatFileUrl as l, getRunChatUrl as m, createTenant as n, getCreateTenantUrl as o, getListUsersForTenantUrl as p, createTenantUser as r, getCreateTenantUserUrl as s, ListUsersForTenantFilterAdmin as t, getGetTenantUrl as u, getUpdateTenantUserUrl as v, astralBeamChatFetch as w, runChat as x, listTenants as y };
+export { resolveApiUrl as A, listTenants as C, updateTenantUser as D, updateTenant as E, DEFAULT_COLOR_SCHEME as M, astralBeamChatFetch as O, getUpdateTenantUserUrl as S, runChat as T, getOrganization as _, getChatFile as a, getTenantUser as b, getCurrentUser as c, getGetCurrentUserUrl as d, getGetOrganizationUrl as f, getListUsersForTenantUrl as g, getListTenantsUrl as h, getChatConfig as i, DEFAULT_CHAT_AUTH_TOKEN_URL as j, isAstralBeamApiError as k, getGetChatConfigUrl as l, getGetTenantUserUrl as m, createTenant as n, getCreateTenantUrl as o, getGetTenantUrl as p, createTenantUser as r, getCreateTenantUserUrl as s, ListUsersForTenantFilterAdmin as t, getGetChatFileUrl as u, getRunChatUrl as v, listUsersForTenant as w, getUpdateTenantUrl as x, getTenant as y };

package/dist/api-ImuMGEar.d.ts

@@ -0,0 +1,370 @@
+//#region src/api/api.d.ts
+interface ApiRequestOptions extends RequestInit {
+  apiUrl?: string | undefined;
+  fetchClient?: typeof globalThis.fetch;
+}
+type ApiKeyOptions = ApiRequestOptions & {
+  apiKey: string;
+  astralBeamToken?: never;
+};
+type JwtOptions = ApiRequestOptions & {
+  astralBeamToken: string;
+  apiKey?: never;
+};
+type ApiOptions = ApiKeyOptions | JwtOptions;
+type FileOptions = ApiRequestOptions & {
+  apiKey?: never;
+  astralBeamToken?: never;
+};
+interface AstralBeamApiError$1 extends Error {
+  name: "AstralBeamApiError";
+  status: number;
+  headers: Headers;
+  body?: AstralBeamApiError;
+}
+declare function isAstralBeamApiError(error: unknown): error is AstralBeamApiError$1;
+declare function astralBeamApiFetch<T>(path: string, options: ApiOptions): Promise<T>;
+declare function astralBeamJwtFetch<T>(path: string, options: JwtOptions): Promise<T>;
+declare function astralBeamChatFetch<_T>(path: string, options: JwtOptions): Promise<Response>;
+declare function astralBeamFileFetch<_T>(path: string, options?: FileOptions): Promise<Response>;
+//#endregion
+//#region src/api/generated/api.d.ts
+/**
+ * Customer-defined JSON object; keys are preserved.
+ */
+type TenantRecordEncodedMetadata = {
+  [key: string]: unknown;
+};
+/**
+ * Persisted Tenant; id is internal, external_id is the customer's exact identity.
+ */
+interface TenantRecordEncoded {
+  id: string;
+  external_id: string;
+  name: string | null;
+  /** Customer-defined JSON object; keys are preserved. */
+  metadata: TenantRecordEncodedMetadata;
+  created_at: string;
+  updated_at: string;
+}
+/**
+ * Live keyset page. Pass either non-null continuation value as the same-named request parameter.
+ */
+interface TenantPage {
+  items: TenantRecordEncoded[];
+  /** Pass as page_after to fetch the next page; null means no next page. */
+  page_after: string | null;
+  /** Pass as page_before to fetch the previous page; null means no previous page. */
+  page_before: string | null;
+}
+type AstralBeamApiErrorIssuesItem = {
+  path: string;
+  message: string;
+};
+interface AstralBeamApiError {
+  type: string;
+  title: string;
+  status: number;
+  detail: string;
+  issues?: AstralBeamApiErrorIssuesItem[];
+}
+/**
+ * Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object.
+ */
+type CreateTenantInputMetadata = {
+  [key: string]: unknown;
+};
+interface CreateTenantInput {
+  /**
+   * Your stable external identity. Exact and case-sensitive; whitespace is preserved. Immutable after creation.
+   * @minLength 1
+   * @maxLength 255
+   */
+  external_id: string;
+  /** Defaults to null on creation. Send null to clear the name. */
+  name?: string | null;
+  /** Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object. */
+  metadata?: CreateTenantInputMetadata;
+}
+/**
+ * Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object.
+ */
+type UpdateTenantInputMetadata = {
+  [key: string]: unknown;
+};
+interface UpdateTenantInput {
+  /** Defaults to null on creation. Send null to clear the name. */
+  name?: string | null;
+  /** Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object. */
+  metadata?: UpdateTenantInputMetadata;
+}
+/**
+ * Customer-defined JSON object; keys are preserved.
+ */
+type TenantUserRecordEncodedMetadata = {
+  [key: string]: unknown;
+};
+/**
+ * Persisted TenantUser. Stored admin does not grant or revoke signed JWT authority.
+ */
+interface TenantUserRecordEncoded {
+  id: string;
+  external_id: string;
+  name: string | null;
+  /** Customer-defined JSON object; keys are preserved. */
+  metadata: TenantUserRecordEncodedMetadata;
+  created_at: string;
+  updated_at: string;
+  tenant_id: string;
+  admin: boolean;
+}
+/**
+ * Live keyset page in ascending ID order within one Tenant. Pass either non-null continuation value as the same-named request parameter.
+ */
+interface TenantUserPage {
+  items: TenantUserRecordEncoded[];
+  /** Pass as page_after to fetch the next page; null means no next page. */
+  page_after: string | null;
+  /** Pass as page_before to fetch the previous page; null means no previous page. */
+  page_before: string | null;
+}
+/**
+ * Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object.
+ */
+type CreateTenantUserInputMetadata = {
+  [key: string]: unknown;
+};
+interface CreateTenantUserInput {
+  /**
+   * Your stable external identity. Exact and case-sensitive; whitespace is preserved. Immutable after creation.
+   * @minLength 1
+   * @maxLength 255
+   */
+  external_id: string;
+  /** Defaults to null on creation. Send null to clear the name. */
+  name?: string | null;
+  /** Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object. */
+  metadata?: CreateTenantUserInputMetadata;
+  /** Defaults to false on creation. Stored admin does not change signed JWT authority. */
+  admin?: boolean;
+}
+/**
+ * Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object.
+ */
+type UpdateTenantUserInputMetadata = {
+  [key: string]: unknown;
+};
+interface UpdateTenantUserInput {
+  /** Defaults to null on creation. Send null to clear the name. */
+  name?: string | null;
+  /** Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object. */
+  metadata?: UpdateTenantUserInputMetadata;
+  /** Defaults to false on creation. Stored admin does not change signed JWT authority. */
+  admin?: boolean;
+}
+interface Organization {
+  id: string;
+  name: string;
+  /** Editable dashboard URL segment. Use id, not slug, as the stable identity. */
+  slug: string;
+}
+type ChatRunInputForwardedProps = {
+  [key: string]: unknown;
+};
+/**
+ * Legacy mirror of forwardedProps sent by TanStack AI clients.
+ */
+type ChatRunInputData = {
+  [key: string]: unknown;
+};
+/**
+ * AG-UI RunAgentInput, validated by TanStack AI. Messages, tools, context, and resume entries follow AG-UI. forwardedProps accepts agentId and development-only debug. systemPrompt is rejected. Maximum request size: 32 MiB.
+ */
+interface ChatRunInput {
+  threadId: string;
+  runId: string;
+  messages: unknown[];
+  tools: unknown[];
+  context: unknown[];
+  forwardedProps?: ChatRunInputForwardedProps;
+  /** Legacy mirror of forwardedProps sent by TanStack AI clients. */
+  data?: ChatRunInputData;
+  state?: unknown;
+  parentRunId?: string;
+  resume?: unknown[];
+}
+type ChatConfigurationCapabilities = {
+  attachments: boolean;
+};
+interface ChatConfiguration {
+  capabilities: ChatConfigurationCapabilities;
+}
+type CurrentUser = {
+  scope: "tenant";
+  organization: {
+    id: string;
+  };
+  tenant: TenantRecordEncoded;
+  user: TenantUserRecordEncoded;
+} | {
+  scope: "organization";
+  organization: {
+    id: string;
+  };
+  user: {
+    id: string;
+    name: string;
+    email: string;
+    role: string;
+  };
+};
+type ListTenantsParams = {
+  /**
+   * Case-insensitive literal substring of name or external_id. Trimmed, blank means no search.
+   * @maxLength 255
+   * @pattern ^[^\u0000]*$
+   */
+  q?: string;
+  /**
+   * Exact, case-sensitive external ID; whitespace is preserved. Returns zero or one item.
+   * @minLength 1
+   * @maxLength 255
+   */
+  "filter[external_id]"?: string;
+  /**
+   * Positive integer, default 20. Values above 100 are accepted and capped. page_after and page_before are mutually exclusive.
+   * @minimum 1
+   */
+  page_size?: number;
+  /**
+   * @minLength 1
+   * @maxLength 2048
+   */
+  page_after?: string;
+  /**
+   * @minLength 1
+   * @maxLength 2048
+   */
+  page_before?: string;
+};
+type ListUsersForTenantParams = {
+  /**
+   * Case-insensitive literal substring of name or external_id. Trimmed, blank means no search.
+   * @maxLength 255
+   * @pattern ^[^\u0000]*$
+   */
+  q?: string;
+  /**
+   * Exact, case-sensitive external ID; whitespace is preserved. Returns zero or one item.
+   * @minLength 1
+   * @maxLength 255
+   */
+  "filter[external_id]"?: string;
+  /**
+   * Positive integer, default 20. Values above 100 are accepted and capped. page_after and page_before are mutually exclusive.
+   * @minimum 1
+   */
+  page_size?: number;
+  /**
+   * @minLength 1
+   * @maxLength 2048
+   */
+  page_after?: string;
+  /**
+   * @minLength 1
+   * @maxLength 2048
+   */
+  page_before?: string;
+  "filter[admin]"?: ListUsersForTenantFilterAdmin;
+};
+type ListUsersForTenantFilterAdmin = (typeof ListUsersForTenantFilterAdmin)[keyof typeof ListUsersForTenantFilterAdmin];
+declare const ListUsersForTenantFilterAdmin: {
+  readonly true: "true";
+  readonly false: "false";
+};
+type GetChatConfigParams = {
+  agentId?: string;
+};
+type GetChatFileParams = {
+  ticket: string;
+};
+declare const getListTenantsUrl: (params: ListTenantsParams) => string;
+/**
+ * List Tenants in internal ID order. q searches name or external ID as a case-insensitive literal substring. filter[external_id] adds an exact match. Organization keys and organization-management JWTs see their organization; admin tenant JWTs see only their signed Tenant. Keep filters unchanged when reusing cursors. Live listing, not a snapshot.
+ * @summary List Tenants
+ */
+declare const listTenants: (params: ListTenantsParams, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantPage>;
+declare const getCreateTenantUrl: () => string;
+/**
+ * Create a Tenant with an exact customer-provided external_id. Requires an organization API key or organization-management JWT with a current owner/developer role. An external_id already used in this organization returns 409; creation never upserts.
+ * @summary Create a Tenant
+ */
+declare const createTenant: (createTenantInput: CreateTenantInput, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantRecordEncoded>;
+declare const getGetTenantUrl: (id: string) => string;
+/**
+ * Get a Tenant by internal UUID, not external_id.
+ * @summary Get a Tenant
+ */
+declare const getTenant: (id: string, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantRecordEncoded>;
+declare const getUpdateTenantUrl: (id: string) => string;
+/**
+ * Update supplied name/metadata fields only. Requires an organization API key or organization-management JWT with a current owner/developer role. name:null clears the name; metadata replaces the object. Last-write-wins; no upsert.
+ * @summary Update a Tenant
+ */
+declare const updateTenant: (id: string, updateTenantInput: UpdateTenantInput, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantRecordEncoded>;
+declare const getListUsersForTenantUrl: (tenantId: string, params: ListUsersForTenantParams) => string;
+/**
+ * List users of one Tenant in internal ID order. q searches name or external ID as a case-insensitive literal substring. Exact filter[external_id] and filter[admin] combine with AND. No matching user returns an empty page; missing and out-of-scope Tenants return 404. Cursors cannot be reused for another Tenant or filter. Live listing, not a snapshot.
+ * @summary List TenantUsers
+ */
+declare const listUsersForTenant: (tenantId: string, params: ListUsersForTenantParams, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantUserPage>;
+declare const getCreateTenantUserUrl: (tenantId: string) => string;
+/**
+ * Create a TenantUser under the internal tenant_id path identifier, with a customer-provided tenant-local external_id. An external_id already used in this Tenant returns 409; the same external_id in another Tenant is allowed. Stored admin does not change signed JWT authority.
+ * @summary Create a TenantUser
+ */
+declare const createTenantUser: (tenantId: string, createTenantUserInput: CreateTenantUserInput, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantUserRecordEncoded>;
+declare const getGetTenantUserUrl: (tenantId: string, id: string) => string;
+/**
+ * Get a TenantUser by the internal tenant_id and id pair within the authorized scope. No identity upsert.
+ * @summary Get a TenantUser
+ */
+declare const getTenantUser: (tenantId: string, id: string, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantUserRecordEncoded>;
+declare const getUpdateTenantUserUrl: (tenantId: string, id: string) => string;
+/**
+ * Update supplied name/metadata/admin fields only. Stored admin does not grant or revoke JWT authority. name:null clears the name; metadata replaces the object.
+ * @summary Update a TenantUser
+ */
+declare const updateTenantUser: (tenantId: string, id: string, updateTenantUserInput: UpdateTenantUserInput, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantUserRecordEncoded>;
+declare const getGetOrganizationUrl: () => string;
+/**
+ * Return the id, name, and slug of the Organization that owns the credential. Accepts an organization API key or organization-management JWT, including a viewer's. Tenant JWTs are forbidden.
+ * @summary Get the current Organization
+ */
+declare const getOrganization: (options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<Organization>;
+declare const getRunChatUrl: () => string;
+/**
+ * Stream an AG-UI agent run using a tenant user JWT. No admin claim required. HTTP failures before streaming use AstralBeamApiError. Once streaming starts, failures use RUN_ERROR events. Tool results continue in a subsequent request. Disconnecting cancels the run. Limited to 20 requests per minute per organization, tenant, and user.
+ * @summary Run chat
+ */
+declare const runChat: (chatRunInput: ChatRunInput, options: Parameters<typeof astralBeamChatFetch>[1]) => Promise<Response>;
+declare const getGetChatConfigUrl: (params: GetChatConfigParams) => string;
+/**
+ * Read the selected agent's attachment grant using a tenant user JWT. Omit agentId to use the organization's default agent. Client settings may narrow this grant, never widen it.
+ * @summary Get chat capabilities
+ */
+declare const getChatConfig: (params: GetChatConfigParams, options: Parameters<typeof astralBeamJwtFetch>[1]) => Promise<ChatConfiguration>;
+declare const getGetChatFileUrl: (params: GetChatFileParams) => string;
+/**
+ * Use the signed ticket returned when chat publishes an artifact. No bearer token is required. Returns the original bytes with a content-sniffed Content-Type and Content-Disposition filename. Invalid or expired tickets, a missing sandbox, and rejected artifact checks return 404. Provider or file-read failures return 500.
+ * @summary Download a chat artifact
+ */
+declare const getChatFile: (params: GetChatFileParams, options?: Parameters<typeof astralBeamFileFetch>[1]) => Promise<Response>;
+declare const getGetCurrentUserUrl: () => string;
+/**
+ * Use a tenant JWT to upsert its own Tenant and TenantUser atomically, without requiring admin authority. Supplied names and metadata replace stored values, omitted profile fields and admin are preserved, and an explicit admin claim updates stored admin. An organization JWT returns existing user membership and the current database role without provisioning identities. API keys and cookies are not accepted. Limited to 100 requests per five minutes per identity.
+ * @summary Get the current user
+ */
+declare const getCurrentUser: (options: Parameters<typeof astralBeamJwtFetch>[1]) => Promise<CurrentUser>;
+//#endregion
+export { updateTenant as $, createTenantUser as A, getGetTenantUrl as B, TenantUserRecordEncoded as C, UpdateTenantUserInput as D, UpdateTenantInputMetadata as E, getCurrentUser as F, getRunChatUrl as G, getListTenantsUrl as H, getGetChatConfigUrl as I, getUpdateTenantUrl as J, getTenant as K, getGetChatFileUrl as L, getChatFile as M, getCreateTenantUrl as N, UpdateTenantUserInputMetadata as O, getCreateTenantUserUrl as P, runChat as Q, getGetCurrentUserUrl as R, TenantUserPage as S, UpdateTenantInput as T, getListUsersForTenantUrl as U, getGetTenantUserUrl as V, getOrganization as W, listTenants as X, getUpdateTenantUserUrl as Y, listUsersForTenant as Z, ListUsersForTenantParams as _, ChatRunInput as a, FileOptions as at, TenantRecordEncoded as b, CreateTenantInput as c, CreateTenantUserInputMetadata as d, updateTenantUser as et, CurrentUser as f, ListUsersForTenantFilterAdmin as g, ListTenantsParams as h, ChatConfigurationCapabilities as i, AstralBeamApiError$1 as it, getChatConfig as j, createTenant as k, CreateTenantInputMetadata as l, GetChatFileParams as m, AstralBeamApiErrorIssuesItem as n, ApiOptions as nt, ChatRunInputData as o, JwtOptions as ot, GetChatConfigParams as p, getTenantUser as q, ChatConfiguration as r, ApiRequestOptions as rt, ChatRunInputForwardedProps as s, isAstralBeamApiError as st, AstralBeamApiError as t, ApiKeyOptions as tt, CreateTenantUserInput as u, Organization as v, TenantUserRecordEncodedMetadata as w, TenantRecordEncodedMetadata as x, TenantPage as y, getGetOrganizationUrl as z };