@astralbeam/sdk 0.7.0 → 0.10.1

package/README.md

@@ -1,6 +1,6 @@
 # @astralbeam/sdk
 
-A drop-in agent chat sidebar for your web app, from [AstralBeam](https://astralbeam.ai), with a headless core underneath when you want to own the UI. The widget renders in a shadow root so its styles never mix with yours, and it streams from an AstralBeam chat endpoint.
+Embed an agent chat sidebar in your web app, or build your own UI with the headless core. The widget isolates its styles in a shadow root.
 
 ```sh
 npm install @astralbeam/sdk
@@ -22,29 +22,29 @@ export function Sidebar() {
 import { mountAstralBeamChat } from "@astralbeam/sdk/client"
 
 const handle = mountAstralBeamChat(document.getElementById("sidebar"), {})
-// handle.update({ colorScheme: "dark" }) — handle.unmount()
+// Update with handle.update({ colorScheme: "dark" }), then clean up with handle.unmount().
 ```
 
 - The widget fills its container, so give it a parent with a definite height (`min-h-0` in a flex column).
-- Two origins by design: chat streams to the hosted cloud by default, while the token comes from your own app's endpoint. Self-hosted deployments set `apiUrl` to their own origin.
-- `@astralbeam/sdk/client` ships no React; the chat loads as a lazy chunk with its own bundled copy.
-- No runtime dependencies; `react` and `react-dom` are optional peers used only by `@astralbeam/sdk/react`.
+- Chat uses the hosted cloud by default. Tokens come from your application. For self-hosting, set `apiUrl` to your deployment’s `/api` base.
+- `@astralbeam/sdk/client` ships no React. The chat loads as a lazy chunk with its own bundled copy.
+- No runtime dependencies. `react` and `react-dom` are optional peers used only by `@astralbeam/sdk/react`.
 - Mount it above your router if the transcript should survive page navigation.
 
 ## Authentication
 
-The widget will not chat until your app mints it a short-lived chat auth token; it never sees your API key. That token is the credential your server signs for AstralBeam, never your app's own session cookie or access token. See [Authentication](https://app.astralbeam.ai/docs/sdk/authentication).
+Your server must authenticate the host session and mint a chat token before the widget can chat. Keep the API key server-only. See [Authentication](https://app.astralbeam.ai/docs/sdk/authentication).
 
 ```ts
-import { createChatAuthToken } from "@astralbeam/sdk/server"
+import { createAstralBeamToken } from "@astralbeam/sdk/server"
 
-const apiKey = process.env.ASTRALBEAM_API_KEY // key_<organization>_<key>_abo_<secret>
+const apiKey = process.env.ASTRALBEAM_API_KEY // key_<organizationId>_<id>_abo_<secret>
 
 export async function POST(request: Request) {
   if (!apiKey) return Response.json({ error: "Not configured" }, { status: 503 })
   const session = await getApplicationSession(request)
   if (!session) return Response.json({ error: "Unauthenticated" }, { status: 401 })
-  const token = await createChatAuthToken({
+  const token = await createAstralBeamToken({
     apiKey,
     user: {
       id: session.user.id,
@@ -61,36 +61,28 @@ export async function POST(request: Request) {
 }
 ```
 
-- Add one endpoint, `/api/astralbeam/token` by default, that authenticates your own session first.
-- Your handler owns the response: answer `cache-control: no-store`, and fail closed with a 401 or 503.
-- Authenticate once, then derive `user` and `tenant` separately from that same application session.
-- Derive `user` and `tenant` from trusted server-side state, never from anything the browser sent.
-- Provide stable tenant-local `user.id` and stable `tenant.id` values; names are optional, and set `user.admin` only from trusted state.
-- Put custom tenant and tenant-user fields in their respective `metadata` JSON objects; never include secrets.
-- SDK fields use camelCase; AstralBeam-owned JWT claims use snake_case, while `metadata` keys are preserved verbatim.
-- Tokens use the API key's organization slug as issuer and the platform audience `astralbeam`; AstralBeam does not require or interpret `sub`.
-- Tokens are signed, not encrypted: never put a secret in them.
-- Lifetimes are 60–600 seconds; the SDK renews in memory before expiry.
-- `fetchChatAuthToken` says where the chat auth token comes from: `{ url, ...init }`, which the widget calls as `fetch(url, init)` with a standard `RequestInit`, or a function returning `{ token }` (or a promise of it, or `undefined` when it cannot mint one).
-- It defaults to `{ url: "/api/astralbeam/token" }`, posted with the page's cookies, and runs again on every renewal, so a rotating credential stays current.
+- Authenticate once and derive stable `user.id` and `tenant.id` values from that trusted session.
+- Keep API keys server-only. Tokens are signed, not encrypted, so their claims must contain no secrets.
+- Return `Cache-Control: no-store` and fail closed when configuration or authentication is missing.
+- For employee-facing Tenant management, use `createAstralBeamOrganizationToken`. The [API client guide](https://app.astralbeam.ai/docs/sdk/api) covers database-backed roles and browser integration.
 
 ## Options
 
-Every option is also a prop on `<AstralBeamChat>`; `handle.update(options)` applies any subset in place, and no option is fixed at mount. Details in [Configuration](https://app.astralbeam.ai/docs/sdk/configuration).
-
-| Option                               | Default                            | Meaning                                                            |
-| ------------------------------------ | ---------------------------------- | ------------------------------------------------------------------ |
-| `agentId`                            | organization's default             | `agent_<uuid>`, copied from the dashboard                          |
-| `apiUrl`                             | `https://app.astralbeam.ai/api`    | Base URL of the AstralBeam API; the widget calls `/chat` there     |
-| `fetchChatAuthToken`                 | `{ url: "/api/astralbeam/token" }` | Chat auth token endpoint as `{ url, ...RequestInit }`, or a minter |
-| `title`, `showHeader`                | `"AstralBeam"`, `true`             | Header text, and whether the header and reset button show          |
-| `emptyTitle`, `emptyDescription`     | generic copy                       | Headline and subtitle of the empty transcript                      |
-| `colorScheme`, `theme`               | `"system"`, built-in palette       | Light/dark/system, and shadcn token overrides                      |
-| `attachments`                        | `true`                             | `false` hides the feature, or pass limits                          |
-| `tools`, `widgets`                   | none                               | What the agent can do and draw in your app                         |
-| `sandboxPanel`                       | `false`                            | Collected sandbox panel: files with downloads, command log         |
-| `header`, `empty`, `composerActions` | widget's own chrome                | Host-rendered replacements (React props; `slots` on the handle)    |
-| `debug`                              | `false`                            | Log every SDK action in the browser and on the server              |
+Every option is also a prop on `<AstralBeamChat>`. `handle.update(options)` applies any subset in place, and no option is fixed at mount. Details in [Configuration](https://app.astralbeam.ai/docs/sdk/configuration).
+
+| Option                               | Default                            | Meaning                                                              |
+| ------------------------------------ | ---------------------------------- | -------------------------------------------------------------------- |
+| `agentId`                            | organization's default             | `agent_<orgId>_<id>`, copied from the dashboard                      |
+| `apiUrl`                             | `https://app.astralbeam.ai/api`    | Base URL of the AstralBeam API. The widget calls `/v1/chat` there    |
+| `fetchAstralBeamToken`               | `{ url: "/api/astralbeam/token" }` | Chat auth token endpoint as `{ url, ...RequestInit }`, or a minter   |
+| `title`, `showHeader`                | `"AstralBeam"`, `true`             | Header text, and whether the header and reset button show            |
+| `emptyTitle`, `emptyDescription`     | generic copy                       | Headline and subtitle of the empty transcript                        |
+| `colorScheme`, `theme`               | `"system"`, built-in palette       | Light/dark/system, and shadcn token overrides                        |
+| `attachments`                        | `true`                             | `false` hides the feature, or pass limits                            |
+| `tools`, `widgets`                   | none                               | What the agent can do and draw in your app                           |
+| `sandboxPanel`                       | `false`                            | Collected sandbox panel: files with downloads, command log           |
+| `header`, `empty`, `composerActions` | widget's own chrome                | Host-rendered replacements (React props. `slots` on the handle)      |
+| `debug`                              | `false`                            | Log SDK actions in the browser, with server logs in development only |
 
 A `ref` on `<AstralBeamChat>` (and the vanilla handle) exposes `reset()` and `stop()` for hosts that draw their own controls.
 
@@ -117,24 +109,23 @@ widgets: {
 ```
 
 - Schemas are plain JSON Schema, or any [Standard Schema](https://standardschema.dev) validator (Zod, Valibot, ArkType).
-- Only a Standard Schema validates input in the browser; with plain JSON Schema, treat input as untrusted.
-- `defineTool` and `defineWidget` type `execute`/`render` input from a Standard Schema's output.
-- In React, `render` returns JSX in your own tree, so state, context, and handlers keep working.
-- New tools and widgets reach the agent on its next run.
+- Only a Standard Schema validates input in the browser. With plain JSON Schema, treat input as untrusted.
 
 ## Documentation
 
-Each guide is short and self-contained.
-
-- [Getting started](https://app.astralbeam.ai/docs/sdk/getting-started) — install, mount, layout requirements.
-- [Authentication](https://app.astralbeam.ai/docs/sdk/authentication) — the token endpoint and its security rules.
-- [Configuration](https://app.astralbeam.ai/docs/sdk/configuration) — every option, and what `update` can change.
-- [Theming](https://app.astralbeam.ai/docs/sdk/theming) — color schemes, CSS tokens, the shadow-root boundary.
-- [Tools and widgets](https://app.astralbeam.ai/docs/sdk/tools-and-widgets) — schemas, live state, rendering into the transcript.
-- [Attachments](https://app.astralbeam.ai/docs/sdk/attachments) — file kinds, limits, what the endpoint enforces.
-- [Sandbox](https://app.astralbeam.ai/docs/sdk/sandbox) — steps, the opt-in panel, downloads, inline images.
-- [Headless](https://app.astralbeam.ai/docs/sdk/headless) — own the whole chat UI on the same session.
-- [Security model](https://app.astralbeam.ai/docs/sdk/security) — who grants, who enforces, what the client can change.
+| Guide                                                                     | Covers                                                  |
+| ------------------------------------------------------------------------- | ------------------------------------------------------- |
+| [API client](https://app.astralbeam.ai/docs/sdk/api)                      | Typed resource and chat requests with API keys or JWTs. |
+| [Getting started](https://app.astralbeam.ai/docs/sdk/getting-started)     | install, mount, layout requirements.                    |
+| [Authentication](https://app.astralbeam.ai/docs/sdk/authentication)       | the token endpoint and its security rules.              |
+| [Configuration](https://app.astralbeam.ai/docs/sdk/configuration)         | every option, and what `update` can change.             |
+| [Theming](https://app.astralbeam.ai/docs/sdk/theming)                     | color schemes, CSS tokens, the shadow-root boundary.    |
+| [Tools and widgets](https://app.astralbeam.ai/docs/sdk/tools-and-widgets) | schemas, live state, rendering into the transcript.     |
+| [Attachments](https://app.astralbeam.ai/docs/sdk/attachments)             | file kinds, limits, what the endpoint enforces.         |
+| [Limits](https://app.astralbeam.ai/docs/sdk/limits)                       | request, attachment, and sandbox limits.                |
+| [Sandbox](https://app.astralbeam.ai/docs/sdk/sandbox)                     | steps, the opt-in panel, downloads, inline images.      |
+| [Headless](https://app.astralbeam.ai/docs/sdk/headless)                   | own the whole chat UI on the same session.              |
+| [Security model](https://app.astralbeam.ai/docs/sdk/security)             | who grants, who enforces, what the client can change.   |
 
 ## Entry points
 
@@ -145,9 +136,10 @@ There is no root export. Conversation history is not built yet.
 | `@astralbeam/sdk/client` | `mountAstralBeamChat`, the vanilla loader    | none                 |
 | `@astralbeam/sdk/core`   | `createAstralBeamChat`, the headless session | none                 |
 | `@astralbeam/sdk/react`  | `<AstralBeamChat>`, `useAstralBeamChat`      | `react`, `react-dom` |
-| `@astralbeam/sdk/server` | `createChatAuthToken`, the token minter      | none                 |
+| `@astralbeam/sdk/server` | Tenant and organization token minters        | none                 |
+| `@astralbeam/sdk/api`    | Resource and chat HTTP helpers               | none                 |
 
-Types resolve under every TypeScript module resolution mode, including the classic `"moduleResolution": "node"` that Ionic, Capacitor, and Create React App templates still ship. TypeScript 5.0 or later is required, because the declarations use `const` type parameters; on TypeScript 4.x the `.d.ts` files fail to parse.
+Types resolve under every TypeScript module resolution mode, including classic `"moduleResolution": "node"`. Requires TypeScript 5.0 or later because declarations use `const` type parameters, which fail to parse on TypeScript 4.x.
 
 ## Example
 

package/dist/api-CaNIR6Af.js

@@ -0,0 +1,296 @@
+//#region src/lib/constants.ts
+/** Base URL of the AstralBeam API when the mount options give none; versioned routes hang off it. */
+const DEFAULT_API_URL = "https://app.astralbeam.ai/api";
+/** Host endpoint that mints chat JWTs when the mount options give none. */
+const DEFAULT_CHAT_AUTH_TOKEN_URL = "/api/astralbeam/token";
+/** Color scheme used when the mount options and the React prop give none. */
+const DEFAULT_COLOR_SCHEME = "system";
+//#endregion
+//#region src/api/api.ts
+function isAstralBeamApiError(error) {
+	return error instanceof Error && error.name === "AstralBeamApiError" && "status" in error && typeof error.status === "number";
+}
+function resolveApiUrl(path, apiUrl = DEFAULT_API_URL) {
+	return `${apiUrl.replace(/\/+$/, "")}${path.replace(/^\/api(?=\/)/, "")}`;
+}
+function isApiErrorBody(value, status) {
+	if (!value || typeof value !== "object") return false;
+	const body = value;
+	return body.status === status && typeof body.type === "string" && typeof body.title === "string" && typeof body.detail === "string" && (body.issues === void 0 || Array.isArray(body.issues) && body.issues.every((issue) => issue && typeof issue.path === "string" && typeof issue.message === "string"));
+}
+async function apiResponse(path, options) {
+	const { apiUrl, apiKey, astralBeamToken, fetchClient = globalThis.fetch, ...init } = options;
+	const headers = new Headers();
+	const entries = init.headers instanceof Headers ? init.headers.entries() : Array.isArray(init.headers) ? init.headers : Object.entries(init.headers ?? {});
+	for (const [name, value] of entries) headers.set(name, value);
+	headers.delete("authorization");
+	headers.delete("x-api-key");
+	if (apiKey) headers.set("x-api-key", apiKey);
+	if (astralBeamToken) headers.set("authorization", `Bearer ${astralBeamToken}`);
+	const response = await fetchClient(resolveApiUrl(path, apiUrl), {
+		...init,
+		headers
+	});
+	if (response.ok) return response;
+	const value = await response.json().catch((error) => {
+		if (!(error instanceof SyntaxError)) throw error;
+	});
+	const body = isApiErrorBody(value, response.status) ? value : void 0;
+	throw Object.assign(new Error(body?.detail ?? `AstralBeam API returned HTTP ${response.status}`), {
+		name: "AstralBeamApiError",
+		status: response.status,
+		headers: response.headers,
+		body
+	});
+}
+async function astralBeamApiFetch(path, options) {
+	return await (await apiResponse(path, options)).json();
+}
+function astralBeamJwtFetch(path, options) {
+	return astralBeamApiFetch(path, options);
+}
+function astralBeamChatFetch(path, options) {
+	return apiResponse(path, options);
+}
+function astralBeamFileFetch(path, options = {}) {
+	return apiResponse(path, options);
+}
+//#endregion
+//#region src/api/generated/api.ts
+/**
+* Generated by Orval. Do not edit by hand.
+*/
+const ListUsersForTenantFilterAdmin = {
+	true: "true",
+	false: "false"
+};
+const getListTenantsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : String(value));
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `/api/v1/tenants?${stringifiedParams}` : `/api/v1/tenants`;
+};
+/**
+* List Tenants in internal ID order. q searches name or external ID as a case-insensitive literal substring. filter[external_id] adds an exact match. Organization keys and organization-management JWTs see their organization; admin tenant JWTs see only their signed Tenant. Keep filters unchanged when reusing cursors. Live listing, not a snapshot.
+* @summary List Tenants
+*/
+const listTenants = (params, options) => {
+	return astralBeamApiFetch(getListTenantsUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getCreateTenantUrl = () => {
+	return `/api/v1/tenants`;
+};
+/**
+* Create a Tenant with an exact customer-provided external_id. Requires an organization API key or organization-management JWT with a current owner/developer role. An external_id already used in this organization returns 409; creation never upserts.
+* @summary Create a Tenant
+*/
+const createTenant = (createTenantInput, options) => {
+	const getHeaders = (h) => {
+		if (!h) return {};
+		if (h instanceof Headers) return Object.fromEntries(h.entries());
+		if (Symbol.iterator in h) return Object.fromEntries(Array.from(h, (entry) => Array.from(entry)));
+		const headers = {};
+		for (const [name, value] of Object.entries(h)) if (value !== void 0) headers[name] = value;
+		return headers;
+	};
+	return astralBeamApiFetch(getCreateTenantUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...getHeaders(options?.headers)
+		},
+		body: JSON.stringify(createTenantInput)
+	});
+};
+const getGetTenantUrl = (id) => {
+	return `/api/v1/tenants/${encodeURIComponent(String(id))}`;
+};
+/**
+* Get a Tenant by internal UUID, not external_id.
+* @summary Get a Tenant
+*/
+const getTenant = (id, options) => {
+	return astralBeamApiFetch(getGetTenantUrl(id), {
+		...options,
+		method: "GET"
+	});
+};
+const getUpdateTenantUrl = (id) => {
+	return `/api/v1/tenants/${encodeURIComponent(String(id))}`;
+};
+/**
+* Update supplied name/metadata fields only. Requires an organization API key or organization-management JWT with a current owner/developer role. name:null clears the name; metadata replaces the object. Last-write-wins; no upsert.
+* @summary Update a Tenant
+*/
+const updateTenant = (id, updateTenantInput, options) => {
+	const getHeaders = (h) => {
+		if (!h) return {};
+		if (h instanceof Headers) return Object.fromEntries(h.entries());
+		if (Symbol.iterator in h) return Object.fromEntries(Array.from(h, (entry) => Array.from(entry)));
+		const headers = {};
+		for (const [name, value] of Object.entries(h)) if (value !== void 0) headers[name] = value;
+		return headers;
+	};
+	return astralBeamApiFetch(getUpdateTenantUrl(id), {
+		...options,
+		method: "PATCH",
+		headers: {
+			"Content-Type": "application/json",
+			...getHeaders(options?.headers)
+		},
+		body: JSON.stringify(updateTenantInput)
+	});
+};
+const getListUsersForTenantUrl = (tenantId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : String(value));
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `/api/v1/tenants/${encodeURIComponent(String(tenantId))}/tenant_users?${stringifiedParams}` : `/api/v1/tenants/${encodeURIComponent(String(tenantId))}/tenant_users`;
+};
+/**
+* List users of one Tenant in internal ID order. q searches name or external ID as a case-insensitive literal substring. Exact filter[external_id] and filter[admin] combine with AND. No matching user returns an empty page; missing and out-of-scope Tenants return 404. Cursors cannot be reused for another Tenant or filter. Live listing, not a snapshot.
+* @summary List TenantUsers
+*/
+const listUsersForTenant = (tenantId, params, options) => {
+	return astralBeamApiFetch(getListUsersForTenantUrl(tenantId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getCreateTenantUserUrl = (tenantId) => {
+	return `/api/v1/tenants/${encodeURIComponent(String(tenantId))}/tenant_users`;
+};
+/**
+* Create a TenantUser under the internal tenant_id path identifier, with a customer-provided tenant-local external_id. An external_id already used in this Tenant returns 409; the same external_id in another Tenant is allowed. Stored admin does not change signed JWT authority.
+* @summary Create a TenantUser
+*/
+const createTenantUser = (tenantId, createTenantUserInput, options) => {
+	const getHeaders = (h) => {
+		if (!h) return {};
+		if (h instanceof Headers) return Object.fromEntries(h.entries());
+		if (Symbol.iterator in h) return Object.fromEntries(Array.from(h, (entry) => Array.from(entry)));
+		const headers = {};
+		for (const [name, value] of Object.entries(h)) if (value !== void 0) headers[name] = value;
+		return headers;
+	};
+	return astralBeamApiFetch(getCreateTenantUserUrl(tenantId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...getHeaders(options?.headers)
+		},
+		body: JSON.stringify(createTenantUserInput)
+	});
+};
+const getGetTenantUserUrl = (tenantId, id) => {
+	return `/api/v1/tenants/${encodeURIComponent(String(tenantId))}/tenant_users/${encodeURIComponent(String(id))}`;
+};
+/**
+* Get a TenantUser by the internal tenant_id and id pair within the authorized scope. No identity upsert.
+* @summary Get a TenantUser
+*/
+const getTenantUser = (tenantId, id, options) => {
+	return astralBeamApiFetch(getGetTenantUserUrl(tenantId, id), {
+		...options,
+		method: "GET"
+	});
+};
+const getUpdateTenantUserUrl = (tenantId, id) => {
+	return `/api/v1/tenants/${encodeURIComponent(String(tenantId))}/tenant_users/${encodeURIComponent(String(id))}`;
+};
+/**
+* Update supplied name/metadata/admin fields only. Stored admin does not grant or revoke JWT authority. name:null clears the name; metadata replaces the object.
+* @summary Update a TenantUser
+*/
+const updateTenantUser = (tenantId, id, updateTenantUserInput, options) => {
+	const getHeaders = (h) => {
+		if (!h) return {};
+		if (h instanceof Headers) return Object.fromEntries(h.entries());
+		if (Symbol.iterator in h) return Object.fromEntries(Array.from(h, (entry) => Array.from(entry)));
+		const headers = {};
+		for (const [name, value] of Object.entries(h)) if (value !== void 0) headers[name] = value;
+		return headers;
+	};
+	return astralBeamApiFetch(getUpdateTenantUserUrl(tenantId, id), {
+		...options,
+		method: "PATCH",
+		headers: {
+			"Content-Type": "application/json",
+			...getHeaders(options?.headers)
+		},
+		body: JSON.stringify(updateTenantUserInput)
+	});
+};
+const getRunChatUrl = () => {
+	return `/api/v1/chat`;
+};
+/**
+* Stream an AG-UI agent run using a tenant user JWT. No admin claim required. HTTP failures before streaming use AstralBeamApiError. Once streaming starts, failures use RUN_ERROR events. Tool results continue in a subsequent request. Disconnecting cancels the run. Limited to 20 requests per minute per organization, tenant, and user.
+* @summary Run chat
+*/
+const runChat = (chatRunInput, options) => {
+	const getHeaders = (h) => {
+		if (!h) return {};
+		if (h instanceof Headers) return Object.fromEntries(h.entries());
+		if (Symbol.iterator in h) return Object.fromEntries(Array.from(h, (entry) => Array.from(entry)));
+		const headers = {};
+		for (const [name, value] of Object.entries(h)) if (value !== void 0) headers[name] = value;
+		return headers;
+	};
+	return astralBeamChatFetch(getRunChatUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...getHeaders(options?.headers)
+		},
+		body: JSON.stringify(chatRunInput)
+	});
+};
+const getGetChatConfigUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : String(value));
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `/api/v1/chat/config?${stringifiedParams}` : `/api/v1/chat/config`;
+};
+/**
+* Read the selected agent's attachment grant using a tenant user JWT. Omit agentId to use the organization's default agent. Client settings may narrow this grant, never widen it.
+* @summary Get chat capabilities
+*/
+const getChatConfig = (params, options) => {
+	return astralBeamJwtFetch(getGetChatConfigUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetChatFileUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : String(value));
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `/api/v1/chat/files?${stringifiedParams}` : `/api/v1/chat/files`;
+};
+/**
+* Use the signed ticket returned when chat publishes an artifact. No bearer token is required. Returns the original bytes with a content-sniffed Content-Type and Content-Disposition filename. Invalid or expired tickets, a missing sandbox, and rejected artifact checks return 404. Provider or file-read failures return 500.
+* @summary Download a chat artifact
+*/
+const getChatFile = (params, options) => {
+	return astralBeamFileFetch(getGetChatFileUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+//#endregion
+export { updateTenantUser as C, DEFAULT_CHAT_AUTH_TOKEN_URL as D, resolveApiUrl as E, DEFAULT_COLOR_SCHEME as O, updateTenant as S, isAstralBeamApiError as T, getUpdateTenantUrl as _, getChatFile as a, listUsersForTenant as b, getGetChatConfigUrl as c, getGetTenantUserUrl as d, getListTenantsUrl as f, getTenantUser as g, getTenant as h, getChatConfig as i, getGetChatFileUrl as l, getRunChatUrl as m, createTenant as n, getCreateTenantUrl as o, getListUsersForTenantUrl as p, createTenantUser as r, getCreateTenantUserUrl as s, ListUsersForTenantFilterAdmin as t, getGetTenantUrl as u, getUpdateTenantUserUrl as v, astralBeamChatFetch as w, runChat as x, listTenants as y };