@astralbeam/sdk 0.9.0 → 0.11.0

package/README.md

@@ -1,6 +1,6 @@
 # @astralbeam/sdk
 
-A drop-in agent chat sidebar for your web app, from [AstralBeam](https://astralbeam.ai), with a headless core underneath when you want to own the UI. The widget renders in a shadow root so its styles never mix with yours, and it streams from an AstralBeam chat endpoint.
+Embed an agent chat sidebar or read-only tenant directories in your web app, or build your own chat UI with the headless core. The widgets isolate their styles in shadow roots.
 
 ```sh
 npm install @astralbeam/sdk
@@ -22,75 +22,76 @@ export function Sidebar() {
 import { mountAstralBeamChat } from "@astralbeam/sdk/client"
 
 const handle = mountAstralBeamChat(document.getElementById("sidebar"), {})
-// handle.update({ colorScheme: "dark" }) — handle.unmount()
+// Update with handle.update({ colorScheme: "dark" }), then clean up with handle.unmount().
 ```
 
 - The widget fills its container, so give it a parent with a definite height (`min-h-0` in a flex column).
-- Two origins by design: chat streams to the hosted cloud by default, while the token comes from your own app's endpoint. Self-hosted deployments set `apiUrl` to their own origin.
-- `@astralbeam/sdk/client` ships no React; the chat loads as a lazy chunk with its own bundled copy.
-- No runtime dependencies; `react` and `react-dom` are optional peers used only by `@astralbeam/sdk/react`.
+- Chat uses the hosted cloud by default. Tokens come from your application. For self-hosting, set `apiUrl` to your deployment’s `/api` base.
+- `@astralbeam/sdk/client` ships no React. The chat loads as a lazy chunk with its own bundled copy.
+- No runtime dependencies. `react` and `react-dom` are optional peers used only by `@astralbeam/sdk/react`.
 - Mount it above your router if the transcript should survive page navigation.
 
 ## Authentication
 
-The widget will not chat until your app mints it a short-lived chat auth token; it never sees your API key. That token is the credential your server signs for AstralBeam, never your app's own session cookie or access token. See [Authentication](https://app.astralbeam.ai/docs/sdk/authentication).
+Your server must authenticate the host session and mint a chat token before the widget can chat. Keep the API key server-only. See [Authentication](https://app.astralbeam.ai/docs/sdk/authentication).
 
 ```ts
 import { createAstralBeamToken } from "@astralbeam/sdk/server"
 
-const apiKey = process.env.ASTRALBEAM_API_KEY // key_<organization>_<key>_abo_<secret>
+const apiKey = process.env.ASTRALBEAM_API_KEY // key_<organizationId>_<id>_abo_<secret>
 
 export async function POST(request: Request) {
-  if (!apiKey) return Response.json({ error: "Not configured" }, { status: 503 })
+  const headers = { "Cache-Control": "no-store" }
+  if (!apiKey) return Response.json({ error: "Not configured" }, { status: 503, headers })
   const session = await getApplicationSession(request)
-  if (!session) return Response.json({ error: "Unauthenticated" }, { status: 401 })
-  const token = await createAstralBeamToken({
-    apiKey,
-    user: {
-      id: session.user.id,
-      name: session.user.name,
-      metadata: { email: session.user.email },
-    },
-    tenant: {
-      id: session.tenant.id,
-      name: session.tenant.name,
-      metadata: { plan: session.tenant.plan },
-    },
-  })
-  return Response.json({ token }, { headers: { "cache-control": "no-store" } })
+  if (!session) return Response.json({ error: "Unauthenticated" }, { status: 401, headers })
+  try {
+    const token = await createAstralBeamToken({
+      apiKey,
+      user: {
+        id: session.user.id,
+        name: session.user.name,
+        metadata: { email: session.user.email },
+      },
+      tenant: {
+        id: session.tenant.id,
+        name: session.tenant.name,
+        metadata: { plan: session.tenant.plan },
+      },
+    })
+    return Response.json({ token }, { headers })
+  } catch {
+    return Response.json({ error: "Token could not be issued" }, { status: 500, headers })
+  }
 }
 ```
 
-- Add one endpoint, `/api/astralbeam/token` by default, that authenticates your own session first.
-- Your handler owns the response: answer `cache-control: no-store`, and fail closed with a 401 or 503.
-- Authenticate once, then derive `user` and `tenant` separately from that same application session.
-- Derive `user` and `tenant` from trusted server-side state, never from anything the browser sent.
-- Provide stable tenant-local `user.id` and stable `tenant.id` values; names are optional, and set `user.admin` only from trusted state.
-- Put custom tenant and tenant-user fields in their respective `metadata` JSON objects; never include secrets.
-- SDK fields use camelCase; AstralBeam-owned JWT claims use snake_case, while `metadata` keys are preserved verbatim.
-- Tokens use the API key's organization slug as issuer and the platform audience `astralbeam`; AstralBeam does not require or interpret `sub`.
-- Tokens are signed, not encrypted: never put a secret in them.
-- Lifetimes are 60–600 seconds; the SDK renews in memory before expiry.
-- `fetchAstralBeamToken` says where the chat auth token comes from: `{ url, ...init }`, which the widget calls as `fetch(url, init)` with a standard `RequestInit`, or a function returning `{ token }` (or a promise of it, or `undefined` when it cannot mint one).
-- It defaults to `{ url: "/api/astralbeam/token" }`, posted with the page's cookies, and runs again on every renewal, so a rotating credential stays current.
+- Authenticate once and derive stable `user.id` and `tenant.id` values from that trusted session.
+- Keep API keys server-only. Tokens are signed, not encrypted, so their claims must contain no secrets.
+- Return `Cache-Control: no-store` and fail closed when configuration or authentication is missing.
+- Directory access additionally requires signed `user.admin: true`, derived from trusted tenant permissions, and persisted records. Follow [Tenant directories](https://app.astralbeam.ai/docs/sdk/listings).
+- For employee-facing Tenant management, use `createAstralBeamOrganizationToken`. The [API client guide](https://app.astralbeam.ai/docs/sdk/api) covers database-backed roles and browser integration.
+
+Existing token props and the default chat endpoint keep working. After acquiring a token, components call `POST /api/v1/me` and renew before expiry. See [authentication and refresh behavior](https://app.astralbeam.ai/docs/sdk/authentication).
 
 ## Options
 
-Every option is also a prop on `<AstralBeamChat>`; `handle.update(options)` applies any subset in place, and no option is fixed at mount. Details in [Configuration](https://app.astralbeam.ai/docs/sdk/configuration).
-
-| Option                               | Default                            | Meaning                                                            |
-| ------------------------------------ | ---------------------------------- | ------------------------------------------------------------------ |
-| `agentId`                            | organization's default             | `agent_<uuid>`, copied from the dashboard                          |
-| `apiUrl`                             | `https://app.astralbeam.ai/api`    | Base URL of the AstralBeam API; the widget calls `/v1/chat` there  |
-| `fetchAstralBeamToken`               | `{ url: "/api/astralbeam/token" }` | Chat auth token endpoint as `{ url, ...RequestInit }`, or a minter |
-| `title`, `showHeader`                | `"AstralBeam"`, `true`             | Header text, and whether the header and reset button show          |
-| `emptyTitle`, `emptyDescription`     | generic copy                       | Headline and subtitle of the empty transcript                      |
-| `colorScheme`, `theme`               | `"system"`, built-in palette       | Light/dark/system, and shadcn token overrides                      |
-| `attachments`                        | `true`                             | `false` hides the feature, or pass limits                          |
-| `tools`, `widgets`                   | none                               | What the agent can do and draw in your app                         |
-| `sandboxPanel`                       | `false`                            | Collected sandbox panel: files with downloads, command log         |
-| `header`, `empty`, `composerActions` | widget's own chrome                | Host-rendered replacements (React props; `slots` on the handle)    |
-| `debug`                              | `false`                            | Log every SDK action in the browser and on the server              |
+Every option is also a prop on `<AstralBeamChat>`. `handle.update(options)` applies any subset in place, and no option is fixed at mount. Details in [Configuration](https://app.astralbeam.ai/docs/sdk/configuration).
+
+| Option | Default | Meaning |
+| --- | --- | --- |
+| `agentId` | organization's default | `agent_<orgId>_<id>`, copied from the dashboard |
+| `apiUrl` | `https://app.astralbeam.ai/api` | Base URL of the AstralBeam API. The widget calls `/v1/chat` there |
+| `fetchAstralBeamToken` | `{ url: "/api/astralbeam/token" }` | Chat auth token endpoint as `{ url, ...RequestInit }`, or a minter |
+| `title`, `showHeader` | `"AstralBeam"`, `true` | Header text, and whether the header and reset button show |
+| `emptyTitle`, `emptyDescription` | generic copy | Headline and subtitle of the empty transcript |
+| `colorScheme`, `theme` | `"system"`, built-in palette | Light/dark/system, and shadcn token overrides |
+| `customCss` | None | Trusted CSS inside the widget's Shadow DOM |
+| `attachments` | `true` | `false` hides the feature, or pass limits |
+| `tools`, `widgets` | none | What the agent can do and draw in your app |
+| `sandboxPanel` | `false` | Collected sandbox panel: files with downloads, command log |
+| `header`, `empty`, `composerActions` | widget's own chrome | Host-rendered replacements (React props. `slots` on the handle) |
+| `debug` | `false` | Log SDK actions in the browser, with server logs in development only |
 
 A `ref` on `<AstralBeamChat>` (and the vanilla handle) exposes `reset()` and `stop()` for hosts that draw their own controls.
 
@@ -117,41 +118,44 @@ widgets: {
 ```
 
 - Schemas are plain JSON Schema, or any [Standard Schema](https://standardschema.dev) validator (Zod, Valibot, ArkType).
-- Only a Standard Schema validates input in the browser; with plain JSON Schema, treat input as untrusted.
-- `defineTool` and `defineWidget` type `execute`/`render` input from a Standard Schema's output.
-- In React, `render` returns JSX in your own tree, so state, context, and handlers keep working.
-- New tools and widgets reach the agent on its next run.
+- Only a Standard Schema validates input in the browser. With plain JSON Schema, treat input as untrusted.
 
 ## Documentation
 
-Each guide is short and self-contained.
-
-- [Getting started](https://app.astralbeam.ai/docs/sdk/getting-started) — install, mount, layout requirements.
-- [Authentication](https://app.astralbeam.ai/docs/sdk/authentication) — the token endpoint and its security rules.
-- [Configuration](https://app.astralbeam.ai/docs/sdk/configuration) — every option, and what `update` can change.
-- [Theming](https://app.astralbeam.ai/docs/sdk/theming) — color schemes, CSS tokens, the shadow-root boundary.
-- [Tools and widgets](https://app.astralbeam.ai/docs/sdk/tools-and-widgets) — schemas, live state, rendering into the transcript.
-- [Attachments](https://app.astralbeam.ai/docs/sdk/attachments) — file kinds, limits, what the endpoint enforces.
-- [Sandbox](https://app.astralbeam.ai/docs/sdk/sandbox) — steps, the opt-in panel, downloads, inline images.
-- [Headless](https://app.astralbeam.ai/docs/sdk/headless) — own the whole chat UI on the same session.
-- [Security model](https://app.astralbeam.ai/docs/sdk/security) — who grants, who enforces, what the client can change.
+| Guide | Covers |
+| --- | --- |
+| [API client](https://app.astralbeam.ai/docs/sdk/api) | Typed resource and chat requests with API keys or JWTs. |
+| [Getting started](https://app.astralbeam.ai/docs/sdk/getting-started) | install, mount, layout requirements. |
+| [Authentication](https://app.astralbeam.ai/docs/sdk/authentication) | the token endpoint and its security rules. |
+| [Tenant directories](https://app.astralbeam.ai/docs/sdk/listings) | provisioning, tenant-user and Tenant listings, lifecycle, and options. |
+| [Configuration](https://app.astralbeam.ai/docs/sdk/configuration) | every option, and what `update` can change. |
+| [Theming](https://app.astralbeam.ai/docs/sdk/theming) | color schemes, CSS tokens, the shadow-root boundary. |
+| [Tools and widgets](https://app.astralbeam.ai/docs/sdk/tools-and-widgets) | schemas, live state, rendering into the transcript. |
+| [Attachments](https://app.astralbeam.ai/docs/sdk/attachments) | file kinds, limits, what the endpoint enforces. |
+| [Limits](https://app.astralbeam.ai/docs/sdk/limits) | request, attachment, and sandbox limits. |
+| [Sandbox](https://app.astralbeam.ai/docs/sdk/sandbox) | steps, the opt-in panel, downloads, inline images. |
+| [Headless](https://app.astralbeam.ai/docs/sdk/headless) | own the whole chat UI on the same session. |
+| [Security model](https://app.astralbeam.ai/docs/sdk/security) | who grants, who enforces, what the client can change. |
 
 ## Entry points
 
+Read-only Tenant and TenantUser widgets are available from `/client` and `/react`. See [Tenant directories](https://app.astralbeam.ai/docs/sdk/listings) for setup and embedding examples.
+
 There is no root export. Conversation history is not built yet.
 
 | Entry point              | Contents                                     | Peer dependency      |
 | ------------------------ | -------------------------------------------- | -------------------- |
-| `@astralbeam/sdk/client` | `mountAstralBeamChat`, the vanilla loader    | none                 |
+| `@astralbeam/sdk/client` | Chat and Tenant directory mounts             | none                 |
 | `@astralbeam/sdk/core`   | `createAstralBeamChat`, the headless session | none                 |
-| `@astralbeam/sdk/react`  | `<AstralBeamChat>`, `useAstralBeamChat`      | `react`, `react-dom` |
-| `@astralbeam/sdk/server` | `createAstralBeamToken`, the token minter    | none                 |
+| `@astralbeam/sdk/react`  | Chat hooks and isolated UI wrappers          | `react`, `react-dom` |
+| `@astralbeam/sdk/server` | Tenant and organization token minters        | none                 |
+| `@astralbeam/sdk/api`    | Resource and chat HTTP helpers               | none                 |
 
-Types resolve under every TypeScript module resolution mode, including the classic `"moduleResolution": "node"` that Ionic, Capacitor, and Create React App templates still ship. TypeScript 5.0 or later is required, because the declarations use `const` type parameters; on TypeScript 4.x the `.d.ts` files fail to parse.
+Types resolve under every TypeScript module resolution mode, including classic `"moduleResolution": "node"`. Requires TypeScript 5.0 or later because declarations use `const` type parameters, which fail to parse on TypeScript 4.x.
 
 ## Example
 
-[`examples/todos`](../examples/todos) embeds the sidebar in a minimal TanStack Start app: a demo token route, host tools over live React state, and a `todoCard` widget. It uses no Tailwind or shadcn/ui of its own, to show the shadow-root boundary.
+[`examples/todos`](../examples/todos) embeds the sidebar and a tenant-scoped user listing in a minimal TanStack Start app. Both use the same demo token route. The app also demonstrates host tools over live React state and a `todoCard` widget, with no Tailwind or shadcn/ui of its own.
 
 ## License
 

package/dist/api-CWgQSDaI.d.ts

@@ -0,0 +1,358 @@
+//#region src/api/api.d.ts
+interface ApiRequestOptions extends RequestInit {
+  apiUrl?: string | undefined;
+  fetchClient?: typeof globalThis.fetch;
+}
+type ApiKeyOptions = ApiRequestOptions & {
+  apiKey: string;
+  astralBeamToken?: never;
+};
+type JwtOptions = ApiRequestOptions & {
+  astralBeamToken: string;
+  apiKey?: never;
+};
+type ApiOptions = ApiKeyOptions | JwtOptions;
+type FileOptions = ApiRequestOptions & {
+  apiKey?: never;
+  astralBeamToken?: never;
+};
+interface AstralBeamApiError$1 extends Error {
+  name: "AstralBeamApiError";
+  status: number;
+  headers: Headers;
+  body?: AstralBeamApiError;
+}
+declare function isAstralBeamApiError(error: unknown): error is AstralBeamApiError$1;
+declare function astralBeamApiFetch<T>(path: string, options: ApiOptions): Promise<T>;
+declare function astralBeamJwtFetch<T>(path: string, options: JwtOptions): Promise<T>;
+declare function astralBeamChatFetch<_T>(path: string, options: JwtOptions): Promise<Response>;
+declare function astralBeamFileFetch<_T>(path: string, options?: FileOptions): Promise<Response>;
+//#endregion
+//#region src/api/generated/api.d.ts
+/**
+ * Customer-defined JSON object; keys are preserved.
+ */
+type TenantRecordEncodedMetadata = {
+  [key: string]: unknown;
+};
+/**
+ * Persisted Tenant; id is internal, external_id is the customer's exact identity.
+ */
+interface TenantRecordEncoded {
+  id: string;
+  external_id: string;
+  name: string | null;
+  /** Customer-defined JSON object; keys are preserved. */
+  metadata: TenantRecordEncodedMetadata;
+  created_at: string;
+  updated_at: string;
+}
+/**
+ * Live keyset page. Pass either non-null continuation value as the same-named request parameter.
+ */
+interface TenantPage {
+  items: TenantRecordEncoded[];
+  /** Pass as page_after to fetch the next page; null means no next page. */
+  page_after: string | null;
+  /** Pass as page_before to fetch the previous page; null means no previous page. */
+  page_before: string | null;
+}
+type AstralBeamApiErrorIssuesItem = {
+  path: string;
+  message: string;
+};
+interface AstralBeamApiError {
+  type: string;
+  title: string;
+  status: number;
+  detail: string;
+  issues?: AstralBeamApiErrorIssuesItem[];
+}
+/**
+ * Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object.
+ */
+type CreateTenantInputMetadata = {
+  [key: string]: unknown;
+};
+interface CreateTenantInput {
+  /**
+   * Your stable external identity. Exact and case-sensitive; whitespace is preserved. Immutable after creation.
+   * @minLength 1
+   * @maxLength 255
+   */
+  external_id: string;
+  /** Defaults to null on creation. Send null to clear the name. */
+  name?: string | null;
+  /** Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object. */
+  metadata?: CreateTenantInputMetadata;
+}
+/**
+ * Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object.
+ */
+type UpdateTenantInputMetadata = {
+  [key: string]: unknown;
+};
+interface UpdateTenantInput {
+  /** Defaults to null on creation. Send null to clear the name. */
+  name?: string | null;
+  /** Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object. */
+  metadata?: UpdateTenantInputMetadata;
+}
+/**
+ * Customer-defined JSON object; keys are preserved.
+ */
+type TenantUserRecordEncodedMetadata = {
+  [key: string]: unknown;
+};
+/**
+ * Persisted TenantUser. Stored admin does not grant or revoke signed JWT authority.
+ */
+interface TenantUserRecordEncoded {
+  id: string;
+  external_id: string;
+  name: string | null;
+  /** Customer-defined JSON object; keys are preserved. */
+  metadata: TenantUserRecordEncodedMetadata;
+  created_at: string;
+  updated_at: string;
+  tenant_id: string;
+  admin: boolean;
+}
+/**
+ * Live keyset page in ascending ID order within one Tenant. Pass either non-null continuation value as the same-named request parameter.
+ */
+interface TenantUserPage {
+  items: TenantUserRecordEncoded[];
+  /** Pass as page_after to fetch the next page; null means no next page. */
+  page_after: string | null;
+  /** Pass as page_before to fetch the previous page; null means no previous page. */
+  page_before: string | null;
+}
+/**
+ * Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object.
+ */
+type CreateTenantUserInputMetadata = {
+  [key: string]: unknown;
+};
+interface CreateTenantUserInput {
+  /**
+   * Your stable external identity. Exact and case-sensitive; whitespace is preserved. Immutable after creation.
+   * @minLength 1
+   * @maxLength 255
+   */
+  external_id: string;
+  /** Defaults to null on creation. Send null to clear the name. */
+  name?: string | null;
+  /** Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object. */
+  metadata?: CreateTenantUserInputMetadata;
+  /** Defaults to false on creation. Stored admin does not change signed JWT authority. */
+  admin?: boolean;
+}
+/**
+ * Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object.
+ */
+type UpdateTenantUserInputMetadata = {
+  [key: string]: unknown;
+};
+interface UpdateTenantUserInput {
+  /** Defaults to null on creation. Send null to clear the name. */
+  name?: string | null;
+  /** Customer-defined JSON object; keys are preserved. Defaults to {} on creation. Updates replace the entire object. */
+  metadata?: UpdateTenantUserInputMetadata;
+  /** Defaults to false on creation. Stored admin does not change signed JWT authority. */
+  admin?: boolean;
+}
+type ChatRunInputForwardedProps = {
+  [key: string]: unknown;
+};
+/**
+ * Legacy mirror of forwardedProps sent by TanStack AI clients.
+ */
+type ChatRunInputData = {
+  [key: string]: unknown;
+};
+/**
+ * AG-UI RunAgentInput, validated by TanStack AI. Messages, tools, context, and resume entries follow AG-UI. forwardedProps accepts agentId and development-only debug. systemPrompt is rejected. Maximum request size: 32 MiB.
+ */
+interface ChatRunInput {
+  threadId: string;
+  runId: string;
+  messages: unknown[];
+  tools: unknown[];
+  context: unknown[];
+  forwardedProps?: ChatRunInputForwardedProps;
+  /** Legacy mirror of forwardedProps sent by TanStack AI clients. */
+  data?: ChatRunInputData;
+  state?: unknown;
+  parentRunId?: string;
+  resume?: unknown[];
+}
+type ChatConfigurationCapabilities = {
+  attachments: boolean;
+};
+interface ChatConfiguration {
+  capabilities: ChatConfigurationCapabilities;
+}
+type CurrentUser = {
+  scope: "tenant";
+  organization: {
+    id: string;
+  };
+  tenant: TenantRecordEncoded;
+  user: TenantUserRecordEncoded;
+} | {
+  scope: "organization";
+  organization: {
+    id: string;
+  };
+  user: {
+    id: string;
+    name: string;
+    email: string;
+    role: string;
+  };
+};
+type ListTenantsParams = {
+  /**
+   * Case-insensitive literal substring of name or external_id. Trimmed, blank means no search.
+   * @maxLength 255
+   * @pattern ^[^\u0000]*$
+   */
+  q?: string;
+  /**
+   * Exact, case-sensitive external ID; whitespace is preserved. Returns zero or one item.
+   * @minLength 1
+   * @maxLength 255
+   */
+  "filter[external_id]"?: string;
+  /**
+   * Positive integer, default 20. Values above 100 are accepted and capped. page_after and page_before are mutually exclusive.
+   * @minimum 1
+   */
+  page_size?: number;
+  /**
+   * @minLength 1
+   * @maxLength 2048
+   */
+  page_after?: string;
+  /**
+   * @minLength 1
+   * @maxLength 2048
+   */
+  page_before?: string;
+};
+type ListUsersForTenantParams = {
+  /**
+   * Case-insensitive literal substring of name or external_id. Trimmed, blank means no search.
+   * @maxLength 255
+   * @pattern ^[^\u0000]*$
+   */
+  q?: string;
+  /**
+   * Exact, case-sensitive external ID; whitespace is preserved. Returns zero or one item.
+   * @minLength 1
+   * @maxLength 255
+   */
+  "filter[external_id]"?: string;
+  /**
+   * Positive integer, default 20. Values above 100 are accepted and capped. page_after and page_before are mutually exclusive.
+   * @minimum 1
+   */
+  page_size?: number;
+  /**
+   * @minLength 1
+   * @maxLength 2048
+   */
+  page_after?: string;
+  /**
+   * @minLength 1
+   * @maxLength 2048
+   */
+  page_before?: string;
+  "filter[admin]"?: ListUsersForTenantFilterAdmin;
+};
+type ListUsersForTenantFilterAdmin = (typeof ListUsersForTenantFilterAdmin)[keyof typeof ListUsersForTenantFilterAdmin];
+declare const ListUsersForTenantFilterAdmin: {
+  readonly true: "true";
+  readonly false: "false";
+};
+type GetChatConfigParams = {
+  agentId?: string;
+};
+type GetChatFileParams = {
+  ticket: string;
+};
+declare const getListTenantsUrl: (params: ListTenantsParams) => string;
+/**
+ * List Tenants in internal ID order. q searches name or external ID as a case-insensitive literal substring. filter[external_id] adds an exact match. Organization keys and organization-management JWTs see their organization; admin tenant JWTs see only their signed Tenant. Keep filters unchanged when reusing cursors. Live listing, not a snapshot.
+ * @summary List Tenants
+ */
+declare const listTenants: (params: ListTenantsParams, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantPage>;
+declare const getCreateTenantUrl: () => string;
+/**
+ * Create a Tenant with an exact customer-provided external_id. Requires an organization API key or organization-management JWT with a current owner/developer role. An external_id already used in this organization returns 409; creation never upserts.
+ * @summary Create a Tenant
+ */
+declare const createTenant: (createTenantInput: CreateTenantInput, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantRecordEncoded>;
+declare const getGetTenantUrl: (id: string) => string;
+/**
+ * Get a Tenant by internal UUID, not external_id.
+ * @summary Get a Tenant
+ */
+declare const getTenant: (id: string, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantRecordEncoded>;
+declare const getUpdateTenantUrl: (id: string) => string;
+/**
+ * Update supplied name/metadata fields only. Requires an organization API key or organization-management JWT with a current owner/developer role. name:null clears the name; metadata replaces the object. Last-write-wins; no upsert.
+ * @summary Update a Tenant
+ */
+declare const updateTenant: (id: string, updateTenantInput: UpdateTenantInput, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantRecordEncoded>;
+declare const getListUsersForTenantUrl: (tenantId: string, params: ListUsersForTenantParams) => string;
+/**
+ * List users of one Tenant in internal ID order. q searches name or external ID as a case-insensitive literal substring. Exact filter[external_id] and filter[admin] combine with AND. No matching user returns an empty page; missing and out-of-scope Tenants return 404. Cursors cannot be reused for another Tenant or filter. Live listing, not a snapshot.
+ * @summary List TenantUsers
+ */
+declare const listUsersForTenant: (tenantId: string, params: ListUsersForTenantParams, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantUserPage>;
+declare const getCreateTenantUserUrl: (tenantId: string) => string;
+/**
+ * Create a TenantUser under the internal tenant_id path identifier, with a customer-provided tenant-local external_id. An external_id already used in this Tenant returns 409; the same external_id in another Tenant is allowed. Stored admin does not change signed JWT authority.
+ * @summary Create a TenantUser
+ */
+declare const createTenantUser: (tenantId: string, createTenantUserInput: CreateTenantUserInput, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantUserRecordEncoded>;
+declare const getGetTenantUserUrl: (tenantId: string, id: string) => string;
+/**
+ * Get a TenantUser by the internal tenant_id and id pair within the authorized scope. No identity upsert.
+ * @summary Get a TenantUser
+ */
+declare const getTenantUser: (tenantId: string, id: string, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantUserRecordEncoded>;
+declare const getUpdateTenantUserUrl: (tenantId: string, id: string) => string;
+/**
+ * Update supplied name/metadata/admin fields only. Stored admin does not grant or revoke JWT authority. name:null clears the name; metadata replaces the object.
+ * @summary Update a TenantUser
+ */
+declare const updateTenantUser: (tenantId: string, id: string, updateTenantUserInput: UpdateTenantUserInput, options: Parameters<typeof astralBeamApiFetch>[1]) => Promise<TenantUserRecordEncoded>;
+declare const getRunChatUrl: () => string;
+/**
+ * Stream an AG-UI agent run using a tenant user JWT. No admin claim required. HTTP failures before streaming use AstralBeamApiError. Once streaming starts, failures use RUN_ERROR events. Tool results continue in a subsequent request. Disconnecting cancels the run. Limited to 20 requests per minute per organization, tenant, and user.
+ * @summary Run chat
+ */
+declare const runChat: (chatRunInput: ChatRunInput, options: Parameters<typeof astralBeamChatFetch>[1]) => Promise<Response>;
+declare const getGetChatConfigUrl: (params: GetChatConfigParams) => string;
+/**
+ * Read the selected agent's attachment grant using a tenant user JWT. Omit agentId to use the organization's default agent. Client settings may narrow this grant, never widen it.
+ * @summary Get chat capabilities
+ */
+declare const getChatConfig: (params: GetChatConfigParams, options: Parameters<typeof astralBeamJwtFetch>[1]) => Promise<ChatConfiguration>;
+declare const getGetChatFileUrl: (params: GetChatFileParams) => string;
+/**
+ * Use the signed ticket returned when chat publishes an artifact. No bearer token is required. Returns the original bytes with a content-sniffed Content-Type and Content-Disposition filename. Invalid or expired tickets, a missing sandbox, and rejected artifact checks return 404. Provider or file-read failures return 500.
+ * @summary Download a chat artifact
+ */
+declare const getChatFile: (params: GetChatFileParams, options?: Parameters<typeof astralBeamFileFetch>[1]) => Promise<Response>;
+declare const getGetCurrentUserUrl: () => string;
+/**
+ * Use a tenant JWT to upsert its own Tenant and TenantUser atomically, without requiring admin authority. Supplied names and metadata replace stored values, omitted profile fields and admin are preserved, and an explicit admin claim updates stored admin. An organization JWT returns existing user membership and the current database role without provisioning identities. API keys and cookies are not accepted. Limited to 100 requests per five minutes per identity.
+ * @summary Get the current user
+ */
+declare const getCurrentUser: (options: Parameters<typeof astralBeamJwtFetch>[1]) => Promise<CurrentUser>;
+//#endregion
+export { ApiOptions as $, getChatConfig as A, getListTenantsUrl as B, TenantUserRecordEncodedMetadata as C, UpdateTenantUserInputMetadata as D, UpdateTenantUserInput as E, getGetChatConfigUrl as F, getUpdateTenantUrl as G, getRunChatUrl as H, getGetChatFileUrl as I, listUsersForTenant as J, getUpdateTenantUserUrl as K, getGetCurrentUserUrl as L, getCreateTenantUrl as M, getCreateTenantUserUrl as N, createTenant as O, getCurrentUser as P, ApiKeyOptions as Q, getGetTenantUrl as R, TenantUserRecordEncoded as S, UpdateTenantInputMetadata as T, getTenant as U, getListUsersForTenantUrl as V, getTenantUser as W, updateTenant as X, runChat as Y, updateTenantUser as Z, ListUsersForTenantParams as _, ChatRunInput as a, TenantRecordEncodedMetadata as b, CreateTenantInput as c, CreateTenantUserInputMetadata as d, ApiRequestOptions as et, CurrentUser as f, ListUsersForTenantFilterAdmin as g, ListTenantsParams as h, ChatConfigurationCapabilities as i, isAstralBeamApiError as it, getChatFile as j, createTenantUser as k, CreateTenantInputMetadata as l, GetChatFileParams as m, AstralBeamApiErrorIssuesItem as n, FileOptions as nt, ChatRunInputData as o, GetChatConfigParams as p, listTenants as q, ChatConfiguration as r, JwtOptions as rt, ChatRunInputForwardedProps as s, AstralBeamApiError as t, AstralBeamApiError$1 as tt, CreateTenantUserInput as u, TenantPage as v, UpdateTenantInput as w, TenantUserPage as x, TenantRecordEncoded as y, getGetTenantUserUrl as z };