@aui.io/aui-client 3.1.1 → 3.2.0

package/dist/cjs/api/types/index.js

@@ -14,6 +14,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./Agent.js"), exports);
+__exportStar(require("./AgentCreateResponse.js"), exports);
+__exportStar(require("./AgentListFilters.js"), exports);
+__exportStar(require("./AgentUpdateResponse.js"), exports);
+__exportStar(require("./AgentVariables.js"), exports);
 __exportStar(require("./AgentVersion.js"), exports);
 __exportStar(require("./AgentVersionArchiveResponse.js"), exports);
 __exportStar(require("./AgentVersionCreateResponse.js"), exports);
@@ -22,6 +27,7 @@ __exportStar(require("./AgentVersionPublishResponse.js"), exports);
 __exportStar(require("./AgentVersionPullResponse.js"), exports);
 __exportStar(require("./AgentVersionPushResponse.js"), exports);
 __exportStar(require("./AgentVersionUpdateResponse.js"), exports);
+__exportStar(require("./AgentVersionWelcomeMessageResponse.js"), exports);
 __exportStar(require("./ErrorBody.js"), exports);
 __exportStar(require("./ErrorDetail.js"), exports);
 __exportStar(require("./ErrorEnvelope.js"), exports);
@@ -29,16 +35,7 @@ __exportStar(require("./ErrorResponse.js"), exports);
 __exportStar(require("./ErrorStreamEvent.js"), exports);
 __exportStar(require("./EventEnvelope.js"), exports);
 __exportStar(require("./EventEnvelopeBase.js"), exports);
-__exportStar(require("./ExternalAgent.js"), exports);
-__exportStar(require("./ExternalAgentCreateResponse.js"), exports);
-__exportStar(require("./ExternalAgentListFilters.js"), exports);
-__exportStar(require("./ExternalAgentUpdateResponse.js"), exports);
-__exportStar(require("./ExternalPageAgentVersion.js"), exports);
-__exportStar(require("./ExternalPageExternalAgent.js"), exports);
-__exportStar(require("./ExternalPageLinks.js"), exports);
-__exportStar(require("./ExternalPageMeta.js"), exports);
-__exportStar(require("./ExternalPageProject.js"), exports);
-__exportStar(require("./ExternalPageThreadListItem.js"), exports);
+__exportStar(require("./GenerateFollowupSuggestionsResponse.js"), exports);
 __exportStar(require("./HttpValidationError.js"), exports);
 __exportStar(require("./InitiateThreadResponse.js"), exports);
 __exportStar(require("./Message.js"), exports);
@@ -46,6 +43,12 @@ __exportStar(require("./MessageCard.js"), exports);
 __exportStar(require("./MessageEnvelope.js"), exports);
 __exportStar(require("./MessageParty.js"), exports);
 __exportStar(require("./MessageStreamEvent.js"), exports);
+__exportStar(require("./PageAgent.js"), exports);
+__exportStar(require("./PageAgentVersion.js"), exports);
+__exportStar(require("./PageLinks.js"), exports);
+__exportStar(require("./PageMeta.js"), exports);
+__exportStar(require("./PageProject.js"), exports);
+__exportStar(require("./PageThreadListItem.js"), exports);
 __exportStar(require("./Project.js"), exports);
 __exportStar(require("./ResumeRequest.js"), exports);
 __exportStar(require("./SendMessageRequest.js"), exports);

package/dist/cjs/core/auth/AuthProvider.d.ts

@@ -0,0 +1,4 @@
+import type { AuthRequest } from "./AuthRequest.js";
+export interface AuthProvider {
+    getAuthRequest(): Promise<AuthRequest>;
+}

package/dist/cjs/core/auth/AuthProvider.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/core/auth/AuthRequest.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Request parameters for authentication requests.
+ */
+export interface AuthRequest {
+    /**
+     * The headers to be included in the request.
+     */
+    headers: Record<string, string>;
+}

package/dist/cjs/core/auth/AuthRequest.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/core/auth/BasicAuth.d.ts

@@ -0,0 +1,8 @@
+export interface BasicAuth {
+    username: string;
+    password: string;
+}
+export declare const BasicAuth: {
+    toAuthorizationHeader: (basicAuth: BasicAuth | undefined) => string | undefined;
+    fromAuthorizationHeader: (header: string) => BasicAuth;
+};

package/dist/cjs/core/auth/BasicAuth.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BasicAuth = void 0;
+const base64_js_1 = require("../base64.js");
+const BASIC_AUTH_HEADER_PREFIX = /^Basic /i;
+exports.BasicAuth = {
+    toAuthorizationHeader: (basicAuth) => {
+        if (basicAuth == null) {
+            return undefined;
+        }
+        const token = (0, base64_js_1.base64Encode)(`${basicAuth.username}:${basicAuth.password}`);
+        return `Basic ${token}`;
+    },
+    fromAuthorizationHeader: (header) => {
+        const credentials = header.replace(BASIC_AUTH_HEADER_PREFIX, "");
+        const decoded = (0, base64_js_1.base64Decode)(credentials);
+        const [username, ...passwordParts] = decoded.split(":");
+        const password = passwordParts.length > 0 ? passwordParts.join(":") : undefined;
+        if (username == null || password == null) {
+            throw new Error("Invalid basic auth");
+        }
+        return {
+            username,
+            password,
+        };
+    },
+};

package/dist/cjs/core/auth/BearerToken.d.ts

@@ -0,0 +1,5 @@
+export type BearerToken = string;
+export declare const BearerToken: {
+    toAuthorizationHeader: (token: BearerToken | undefined) => string | undefined;
+    fromAuthorizationHeader: (header: string) => BearerToken;
+};

package/dist/cjs/core/auth/BearerToken.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BearerToken = void 0;
+const BEARER_AUTH_HEADER_PREFIX = /^Bearer /i;
+exports.BearerToken = {
+    toAuthorizationHeader: (token) => {
+        if (token == null) {
+            return undefined;
+        }
+        return `Bearer ${token}`;
+    },
+    fromAuthorizationHeader: (header) => {
+        return header.replace(BEARER_AUTH_HEADER_PREFIX, "").trim();
+    },
+};

package/dist/cjs/core/auth/index.d.ts

@@ -0,0 +1,4 @@
+export type { AuthProvider } from "./AuthProvider.js";
+export type { AuthRequest } from "./AuthRequest.js";
+export { BasicAuth } from "./BasicAuth.js";
+export { BearerToken } from "./BearerToken.js";

package/dist/cjs/core/auth/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BearerToken = exports.BasicAuth = void 0;
+var BasicAuth_js_1 = require("./BasicAuth.js");
+Object.defineProperty(exports, "BasicAuth", { enumerable: true, get: function () { return BasicAuth_js_1.BasicAuth; } });
+var BearerToken_js_1 = require("./BearerToken.js");
+Object.defineProperty(exports, "BearerToken", { enumerable: true, get: function () { return BearerToken_js_1.BearerToken; } });

package/dist/cjs/core/base64.d.ts

@@ -0,0 +1,2 @@
+export declare function base64Encode(input: string): string;
+export declare function base64Decode(input: string): string;

package/dist/cjs/core/base64.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.base64Encode = base64Encode;
+exports.base64Decode = base64Decode;
+function base64ToBytes(base64) {
+    const binString = atob(base64);
+    return Uint8Array.from(binString, (m) => m.codePointAt(0));
+}
+function bytesToBase64(bytes) {
+    const binString = String.fromCodePoint(...bytes);
+    return btoa(binString);
+}
+function base64Encode(input) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(input, "utf8").toString("base64");
+    }
+    const bytes = new TextEncoder().encode(input);
+    return bytesToBase64(bytes);
+}
+function base64Decode(input) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(input, "base64").toString("utf8");
+    }
+    const bytes = base64ToBytes(input);
+    return new TextDecoder().decode(bytes);
+}

package/dist/cjs/core/index.d.ts

@@ -1,3 +1,5 @@
+export * from "./auth/index.js";
+export * from "./base64.js";
 export * from "./fetcher/index.js";
 export * as logging from "./logging/index.js";
 export * from "./runtime/index.js";

package/dist/cjs/core/index.js

@@ -37,6 +37,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.url = exports.logging = void 0;
+__exportStar(require("./auth/index.js"), exports);
+__exportStar(require("./base64.js"), exports);
 __exportStar(require("./fetcher/index.js"), exports);
 exports.logging = __importStar(require("./logging/index.js"));
 __exportStar(require("./runtime/index.js"), exports);

package/dist/cjs/environments.d.ts

@@ -4,8 +4,8 @@ export interface ApolloEnvironmentUrls {
 }
 export declare const ApolloEnvironment: {
     readonly Gcp: {
-        readonly base: "https://api-v3.aui.io/apollo-api-v2";
-        readonly production: "wss://api-v3.aui.io/apollo-api-v2";
+        readonly base: "https://api-v3.aui.io/apollo-api";
+        readonly production: "wss://api-v3.aui.io/apollo-api";
     };
 };
 export type ApolloEnvironment = typeof ApolloEnvironment.Gcp;

package/dist/cjs/environments.js

@@ -4,7 +4,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApolloEnvironment = void 0;
 exports.ApolloEnvironment = {
     Gcp: {
-        base: "https://api-v3.aui.io/apollo-api-v2",
-        production: "wss://api-v3.aui.io/apollo-api-v2",
+        base: "https://api-v3.aui.io/apollo-api",
+        production: "wss://api-v3.aui.io/apollo-api",
     },
 };

package/dist/cjs/index.d.ts

@@ -1,6 +1,6 @@
 export * as Apollo from "./api/index.js";
 export type { BaseClientOptions, BaseRequestOptions } from "./BaseClient.js";
-export { ApolloClient } from "./ApolloClientWrapper.js";
+export { ApolloMessagingClient, ApolloManagementClient } from "./ApolloClientWrapper.js";
 export { ApolloEnvironment, type ApolloEnvironmentUrls } from "./environments.js";
 export { ApolloError, ApolloTimeoutError } from "./errors/index.js";
 export * from "./exports.js";

package/dist/cjs/index.js

@@ -36,10 +36,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ApolloTimeoutError = exports.ApolloError = exports.ApolloEnvironment = exports.ApolloClient = exports.Apollo = void 0;
+exports.ApolloTimeoutError = exports.ApolloError = exports.ApolloEnvironment = exports.ApolloManagementClient = exports.ApolloMessagingClient = exports.Apollo = void 0;
 exports.Apollo = __importStar(require("./api/index.js"));
 var ApolloClientWrapper_js_1 = require("./ApolloClientWrapper.js");
-Object.defineProperty(exports, "ApolloClient", { enumerable: true, get: function () { return ApolloClientWrapper_js_1.ApolloClient; } });
+Object.defineProperty(exports, "ApolloMessagingClient", { enumerable: true, get: function () { return ApolloClientWrapper_js_1.ApolloMessagingClient; } });
+Object.defineProperty(exports, "ApolloManagementClient", { enumerable: true, get: function () { return ApolloClientWrapper_js_1.ApolloManagementClient; } });
 var environments_js_1 = require("./environments.js");
 Object.defineProperty(exports, "ApolloEnvironment", { enumerable: true, get: function () { return environments_js_1.ApolloEnvironment; } });
 var index_js_1 = require("./errors/index.js");

package/dist/cjs/version.d.ts

@@ -1 +1 @@
-export declare const SDK_VERSION = "3.1.1";
+export declare const SDK_VERSION = "3.2.0";

package/dist/cjs/version.js

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SDK_VERSION = void 0;
-exports.SDK_VERSION = "3.1.1";
+exports.SDK_VERSION = "3.2.0";

package/dist/esm/ApolloClientWrapper.d.mts

@@ -2,30 +2,41 @@ import { ApolloClient as _GeneratedClient } from "./Client.mjs";
 import type { ApolloEnvironmentUrls } from "./environments.mjs";
 import { SessionSocket } from "./api/resources/session/client/Socket.mjs";
 import type { Session } from "./api/resources/session/client/Client.mjs";
+import type { Messaging } from "./api/resources/messaging/client/Client.mjs";
+import type { Channels } from "./api/resources/channels/client/Client.mjs";
+import type { Projects } from "./api/resources/projects/client/Client.mjs";
+import type { Agents } from "./api/resources/agents/client/Client.mjs";
+import type { AgentVersions } from "./api/resources/agentVersions/client/Client.mjs";
+import type { Threads } from "./api/resources/threads/client/Client.mjs";
 /** Publishable-key family, inferred from the key prefix. */
 export type PublishableKeyType = "agent" | "org" | "unknown";
-export declare namespace ApolloClient {
+type AuthHeaders = Record<string, string | (() => Promise<string>) | null>;
+declare class BaseApolloClient {
+    protected readonly _client: _GeneratedClient;
+    protected readonly _env: ApolloEnvironmentUrls;
+    constructor(env: ApolloEnvironmentUrls, authHeaders: AuthHeaders);
+}
+export declare namespace ApolloMessagingClient {
     interface Options {
-        /** Deployment environment. Defaults to ApolloEnvironment.Gcp. */
-        environment?: ApolloEnvironmentUrls;
-        /** Publishable key (pk_network_ or pk_org_); exchanged for a bearer token. */
-        publishableKey?: string;
-        /** Organization API key; used directly as the bearer token. */
-        organizationApiKey?: string;
+        /** Publishable key (pk_network_ / pk_org_). */
+        publishableKey: string;
+        /** Internal: override the API host. Defaults to production. */
+        baseUrl?: string;
     }
     interface ConnectArgs extends Session.ConnectArgs {
     }
 }
 /**
- * ApolloClient adds authentication on top of the generated client: it takes a
- * publishable key (or organization API key) and handles the token exchange/refresh
- * transparently. Every generated resource (agents, threads, messaging, …) is
- * inherited unchanged.
+ * Publishable-key client for end-user / widget messaging (browser-safe).
+ * Exposes the `messaging` audience only.
  */
-export declare class ApolloClient extends _GeneratedClient {
-    private readonly _tokenAuth;
-    private readonly _env;
-    constructor(options?: ApolloClient.Options);
+export declare class ApolloMessagingClient extends BaseApolloClient {
+    private readonly _pkAuth;
+    constructor(options: ApolloMessagingClient.Options);
+    /** Send / stream messages and read thread & interaction traces. */
+    get messaging(): Messaging;
+    /** Initiate channel-scoped threads (e.g. SMS). */
+    get channels(): Channels;
     /** Publishable-key family (agent / org / unknown). */
     get keyType(): PublishableKeyType;
     /** Agent resolved from an agent-scoped key. Populated after the first exchange. */
@@ -38,12 +49,30 @@ export declare class ApolloClient extends _GeneratedClient {
         organizationId?: string;
         keyType: PublishableKeyType;
     }>;
-    /**
-     * Open a messaging WebSocket session. The bearer token is resolved and sent as
-     * Authorization on the upgrade, and the required `aui-websocket` subprotocol is
-     * negotiated. Built here (rather than via the generated session resource) so the
-     * generated code stays vanilla — Fern emits protocols: [] and forwards only
-     * per-call headers, neither of which the v2 server accepts.
-     */
-    connect(args?: ApolloClient.ConnectArgs): Promise<SessionSocket>;
+    /** Open a messaging WebSocket session. */
+    connect(args?: ApolloMessagingClient.ConnectArgs): Promise<SessionSocket>;
+}
+export declare namespace ApolloManagementClient {
+    interface Options {
+        /** Organization API key. Server-side only. */
+        organizationApiKey: string;
+        /** Internal: override the API host. Defaults to production. */
+        baseUrl?: string;
+    }
+}
+/**
+ * Organization-API-key client for backend services and CI (server-side only).
+ * Exposes the `management` audience only.
+ */
+export declare class ApolloManagementClient extends BaseApolloClient {
+    constructor(options: ApolloManagementClient.Options);
+    /** Projects: listing, retrieval, and usage. */
+    get projects(): Projects;
+    /** Agents: listing, retrieval, and usage. */
+    get agents(): Agents;
+    /** Agent versions. */
+    get agentVersions(): AgentVersions;
+    /** Threads: listing, retrieval, updates, and traces. */
+    get threads(): Threads;
 }
+export {};

package/dist/esm/ApolloClientWrapper.mjs

@@ -12,19 +12,12 @@ import { ApolloClient as _GeneratedClient } from "./Client.mjs";
 import { ApolloEnvironment } from "./environments.mjs";
 import * as core from "./core/index.mjs";
 import { SessionSocket } from "./api/resources/session/client/Socket.mjs";
-// A publishable key is exchanged (POST /management/v1/auth/token) for a short-lived
-// bearer token; every request then sends Authorization: Bearer <token>.
 const TOKEN_EXCHANGE_PATH = "/management/v1/auth/token";
-// Re-exchange this many ms before the token expires.
 const REFRESH_SKEW_MS = 60000;
-// Messaging WebSocket channel path (relative to the environment's WS base).
 const SESSION_WS_PATH = "/messaging/v1/session";
-// The v2 messaging server negotiates this subprotocol on the WS upgrade; the
-// connection is rejected without it. Fern emits protocols: [], so we set it here.
 const WS_SUBPROTOCOL = "aui-websocket";
-// Fern injects SDK-telemetry headers (X-Fern-*) on every request. The API doesn't need
-// them, and in the browser each custom header triggers a CORS preflight that fails unless
-// the gateway allow-lists it. Passing null strips them (mergeHeaders deletes null values).
+const ORG_API_KEY_HEADER = "x-organization-api-key";
+// Strip Fern's telemetry headers (null deletes them); they trip browser CORS preflight.
 const STRIPPED_SDK_HEADERS = {
     "X-Fern-Language": null,
     "X-Fern-SDK-Name": null,
@@ -32,18 +25,13 @@ const STRIPPED_SDK_HEADERS = {
     "X-Fern-Runtime": null,
     "X-Fern-Runtime-Version": null,
 };
-// Publishable-key exchange + token caching. Kept as a standalone object so the header
-// suppliers can close over it — a subclass may not touch `this` before super() runs.
-class Auth {
-    constructor(baseUrl, publishableKey, organizationApiKey) {
+// Publishable-key exchange + token cache.
+class PkAuth {
+    constructor(baseUrl, publishableKey) {
         this.pk = publishableKey;
         this.keyType = detectKeyType(publishableKey);
-        this._staticToken = organizationApiKey;
         this._baseUrl = baseUrl;
     }
-    get hasCredential() {
-        return Boolean(this.pk || this._staticToken);
-    }
     get agentId() {
         var _a;
         return (_a = this._cache) === null || _a === void 0 ? void 0 : _a.agentId;
@@ -55,18 +43,13 @@ class Auth {
     getContext() {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b;
-            if (this.pk)
-                yield this.getToken();
+            yield this.getToken();
             return { agentId: (_a = this._cache) === null || _a === void 0 ? void 0 : _a.agentId, organizationId: (_b = this._cache) === null || _b === void 0 ? void 0 : _b.organizationId, keyType: this.keyType };
         });
     }
     getToken() {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b;
-            if (this._staticToken)
-                return this._staticToken;
-            if (!this.pk)
-                return "";
             if (((_a = this._cache) === null || _a === void 0 ? void 0 : _a.token) && Date.now() < this._cache.expiresAt - REFRESH_SKEW_MS) {
                 return this._cache.token;
             }
@@ -105,63 +88,74 @@ class Auth {
         });
     }
 }
-/**
- * ApolloClient adds authentication on top of the generated client: it takes a
- * publishable key (or organization API key) and handles the token exchange/refresh
- * transparently. Every generated resource (agents, threads, messaging, …) is
- * inherited unchanged.
- */
-export class ApolloClient extends _GeneratedClient {
-    constructor(options = {}) {
-        var _a;
-        const env = (_a = options.environment) !== null && _a !== void 0 ? _a : ApolloEnvironment.Gcp;
-        const auth = new Auth(env.base, options.publishableKey, options.organizationApiKey);
-        super({
+// Shared base: wraps the generated client, strips telemetry headers, defaults the
+// environment, and lets each client expose only its own audience's resources. Not exported.
+class BaseApolloClient {
+    constructor(env, authHeaders) {
+        // `organizationApiKey` is typed as required by Fern but we authenticate via
+        // headers, so cast to the generated options shape.
+        this._client = new _GeneratedClient({
             environment: env,
-            headers: Object.assign(Object.assign({}, STRIPPED_SDK_HEADERS), (auth.hasCredential ? { Authorization: () => __awaiter(this, void 0, void 0, function* () { return `Bearer ${yield auth.getToken()}`; }) } : {})),
+            headers: Object.assign(Object.assign({}, STRIPPED_SDK_HEADERS), authHeaders),
         });
-        this._tokenAuth = auth;
         this._env = env;
     }
+}
+/**
+ * Publishable-key client for end-user / widget messaging (browser-safe).
+ * Exposes the `messaging` audience only.
+ */
+export class ApolloMessagingClient extends BaseApolloClient {
+    constructor(options) {
+        if (!(options === null || options === void 0 ? void 0 : options.publishableKey)) {
+            throw new Error("ApolloMessagingClient requires a publishableKey.");
+        }
+        const env = resolveEnv(options.baseUrl);
+        const auth = new PkAuth(env.base, options.publishableKey);
+        super(env, { Authorization: () => __awaiter(this, void 0, void 0, function* () { return `Bearer ${yield auth.getToken()}`; }) });
+        this._pkAuth = auth;
+    }
+    /** Send / stream messages and read thread & interaction traces. */
+    get messaging() {
+        return this._client.messaging;
+    }
+    /** Initiate channel-scoped threads (e.g. SMS). */
+    get channels() {
+        return this._client.channels;
+    }
     /** Publishable-key family (agent / org / unknown). */
     get keyType() {
-        return this._tokenAuth.keyType;
+        return this._pkAuth.keyType;
     }
     /** Agent resolved from an agent-scoped key. Populated after the first exchange. */
     get agentId() {
-        return this._tokenAuth.agentId;
+        return this._pkAuth.agentId;
     }
     /** Organization the key belongs to. Populated after the first exchange. */
     get organizationId() {
-        return this._tokenAuth.organizationId;
+        return this._pkAuth.organizationId;
     }
     /** Force a token exchange (if needed) and return the resolved scope. */
     getContext() {
-        return this._tokenAuth.getContext();
-    }
-    /**
-     * Open a messaging WebSocket session. The bearer token is resolved and sent as
-     * Authorization on the upgrade, and the required `aui-websocket` subprotocol is
-     * negotiated. Built here (rather than via the generated session resource) so the
-     * generated code stays vanilla — Fern emits protocols: [] and forwards only
-     * per-call headers, neither of which the v2 server accepts.
-     */
+        return this._pkAuth.getContext();
+    }
+    /** Open a messaging WebSocket session. */
     connect() {
         return __awaiter(this, arguments, void 0, function* (args = {}) {
             var _a, _b;
-            const token = yield this._tokenAuth.getToken();
+            const token = yield this._pkAuth.getToken();
             const headers = Object.assign(Object.assign({}, (token ? { Authorization: `Bearer ${token}` } : {})), args.headers);
             const socket = new core.ReconnectingWebSocket({
                 url: core.url.join(this._env.production, SESSION_WS_PATH),
-                protocols: [WS_SUBPROTOCOL],
+                // Token as the first subprotocol is how the gateway reads auth (browsers can't
+                // set upgrade headers); `aui-websocket` must follow.
+                protocols: token ? [token, WS_SUBPROTOCOL] : [WS_SUBPROTOCOL],
                 queryParameters: {},
                 headers,
                 options: {
                     debug: (_a = args.debug) !== null && _a !== void 0 ? _a : false,
                     maxRetries: (_b = args.reconnectAttempts) !== null && _b !== void 0 ? _b : 30,
-                    // On Node 22+ the global (undici) WebSocket drops custom headers on the
-                    // upgrade, so the bearer token never arrives. Force the `ws` library on
-                    // Node; browsers fall back to the native global WebSocket.
+                    // Node's global WebSocket drops upgrade headers; force the `ws` library there.
                     WebSocket: core.RUNTIME.type === "node" ? NodeWebSocket : undefined,
                 },
             });
@@ -169,6 +163,42 @@ export class ApolloClient extends _GeneratedClient {
         });
     }
 }
+/**
+ * Organization-API-key client for backend services and CI (server-side only).
+ * Exposes the `management` audience only.
+ */
+export class ApolloManagementClient extends BaseApolloClient {
+    constructor(options) {
+        if (!(options === null || options === void 0 ? void 0 : options.organizationApiKey)) {
+            throw new Error("ApolloManagementClient requires an organizationApiKey.");
+        }
+        const env = resolveEnv(options.baseUrl);
+        super(env, { [ORG_API_KEY_HEADER]: options.organizationApiKey });
+    }
+    /** Projects: listing, retrieval, and usage. */
+    get projects() {
+        return this._client.projects;
+    }
+    /** Agents: listing, retrieval, and usage. */
+    get agents() {
+        return this._client.agents;
+    }
+    /** Agent versions. */
+    get agentVersions() {
+        return this._client.agentVersions;
+    }
+    /** Threads: listing, retrieval, updates, and traces. */
+    get threads() {
+        return this._client.threads;
+    }
+}
+// Build the REST + WS URLs from an optional host override, deriving ws(s):// from http(s)://.
+function resolveEnv(baseUrl) {
+    if (!baseUrl)
+        return ApolloEnvironment.Gcp;
+    const base = baseUrl.replace(/\/+$/, "");
+    return { base, production: base.replace(/^http/i, "ws") };
+}
 function detectKeyType(publishableKey) {
     if (!publishableKey)
         return "unknown";

package/dist/esm/BaseClient.d.mts

@@ -4,6 +4,9 @@ export interface BaseClientOptions {
     environment?: core.Supplier<environments.ApolloEnvironment | environments.ApolloEnvironmentUrls>;
     /** Specify a custom URL to connect the client to. */
     baseUrl?: core.Supplier<string>;
+    token?: core.Supplier<core.BearerToken | undefined>;
+    /** Override the x-organization-api-key header */
+    organizationApiKey: core.Supplier<string>;
     /** Additional headers to include in requests. */
     headers?: Record<string, string | core.Supplier<string | null | undefined> | null | undefined>;
     /** The default maximum time to wait for a response in seconds. */
@@ -22,6 +25,8 @@ export interface BaseRequestOptions {
     maxRetries?: number;
     /** A hook to abort the request. */
     abortSignal?: AbortSignal;
+    /** Override the x-organization-api-key header */
+    organizationApiKey?: string;
     /** Additional query string parameters to include in the request. */
     queryParams?: Record<string, unknown>;
     /** Additional headers to include in the request. */

package/dist/esm/Client.d.mts

@@ -24,7 +24,7 @@ export declare class ApolloClient {
     protected _channels: Channels | undefined;
     protected _auth: Auth | undefined;
     protected _session: Session | undefined;
-    constructor(_options?: ApolloClient.Options);
+    constructor(_options: ApolloClient.Options);
     get agents(): Agents;
     get agentVersions(): AgentVersions;
     get projects(): Projects;
@@ -34,6 +34,8 @@ export declare class ApolloClient {
     get auth(): Auth;
     get session(): Session;
     /**
+     * Liveness probe. Returns ``{"status": "ok"}`` when the service is up.
+     *
      * @param {ApolloClient.RequestOptions} requestOptions - Request-specific configuration.
      *
      * @example
@@ -41,4 +43,5 @@ export declare class ApolloClient {
      */
     health(requestOptions?: ApolloClient.RequestOptions): core.HttpResponsePromise<Record<string, unknown>>;
     private __health;
+    protected _getAuthorizationHeader(): Promise<string | undefined>;
 }