@avallon-labs/sdk 0.0.1

package/dist/generated/models/postV1AuthSignUp400Data.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generated by orval v8.1.0 🍺
+ * Do not edit manually.
+ * Avallon API
+ * OpenAPI spec version: 1.0.0
+ */
+import type { PostV1AuthSignUp400DataErrorsItem } from "./postV1AuthSignUp400DataErrorsItem";
+export type PostV1AuthSignUp400Data = {
+    errors: PostV1AuthSignUp400DataErrorsItem[];
+};

package/dist/generated/models/postV1AuthSignUp400Data.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/models/postV1AuthSignUp400DataErrorsItem.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.1.0 🍺
+ * Do not edit manually.
+ * Avallon API
+ * OpenAPI spec version: 1.0.0
+ */
+export type PostV1AuthSignUp400DataErrorsItem = {
+    /** Path to the invalid field */
+    field: string;
+    /** Error description */
+    message: string;
+};

package/dist/generated/models/postV1AuthSignUp400DataErrorsItem.js

@@ -0,0 +1,7 @@
+/**
+ * Generated by orval v8.1.0 🍺
+ * Do not edit manually.
+ * Avallon API
+ * OpenAPI spec version: 1.0.0
+ */
+export {};

package/dist/generated/models/postV1AuthSignUp401.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.1.0 🍺
+ * Do not edit manually.
+ * Avallon API
+ * OpenAPI spec version: 1.0.0
+ */
+import type { PostV1AuthSignUp401Data } from "./postV1AuthSignUp401Data";
+export type PostV1AuthSignUp401 = {
+    data: PostV1AuthSignUp401Data;
+    /** Human-readable error message */
+    message: string;
+};

package/dist/generated/models/postV1AuthSignUp401.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/models/postV1AuthSignUp401Data.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by orval v8.1.0 🍺
+ * Do not edit manually.
+ * Avallon API
+ * OpenAPI spec version: 1.0.0
+ */
+export type PostV1AuthSignUp401Data = {
+    [key: string]: unknown;
+};

package/dist/generated/models/postV1AuthSignUp401Data.js

@@ -0,0 +1,7 @@
+/**
+ * Generated by orval v8.1.0 🍺
+ * Do not edit manually.
+ * Avallon API
+ * OpenAPI spec version: 1.0.0
+ */
+export {};

package/dist/generated/models/postV1AuthSignUp500.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.1.0 🍺
+ * Do not edit manually.
+ * Avallon API
+ * OpenAPI spec version: 1.0.0
+ */
+import type { PostV1AuthSignUp500Data } from "./postV1AuthSignUp500Data";
+export type PostV1AuthSignUp500 = {
+    data: PostV1AuthSignUp500Data;
+    /** Human-readable error message */
+    message: string;
+};

package/dist/generated/models/postV1AuthSignUp500.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/models/postV1AuthSignUp500Data.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by orval v8.1.0 🍺
+ * Do not edit manually.
+ * Avallon API
+ * OpenAPI spec version: 1.0.0
+ */
+export type PostV1AuthSignUp500Data = {
+    [key: string]: unknown;
+};

package/dist/generated/models/postV1AuthSignUp500Data.js

@@ -0,0 +1,7 @@
+/**
+ * Generated by orval v8.1.0 🍺
+ * Do not edit manually.
+ * Avallon API
+ * OpenAPI spec version: 1.0.0
+ */
+export {};

package/dist/generated/models/postV1AuthSignUpBody.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.1.0 🍺
+ * Do not edit manually.
+ * Avallon API
+ * OpenAPI spec version: 1.0.0
+ */
+export type PostV1AuthSignUpBody = {
+    /** @pattern ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$ */
+    email: string;
+    password: string;
+};

package/dist/generated/models/postV1AuthSignUpBody.js

@@ -0,0 +1,7 @@
+/**
+ * Generated by orval v8.1.0 🍺
+ * Do not edit manually.
+ * Avallon API
+ * OpenAPI spec version: 1.0.0
+ */
+export {};

package/dist/src/auth.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Auth Utilities
+ *
+ * PKCE helpers for OAuth flow. This is legitimately custom code -
+ * browser-side crypto can't be generated from OpenAPI.
+ */
+export type { GetV1AuthOauthUrlParams } from "../generated/models";
+/** OAuth providers - matches backend enum */
+export type OAuthProvider = "google" | "microsoft";
+export type AuthTokens = {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: string;
+};
+/** Generate a cryptographically random code verifier */
+export declare function generateCodeVerifier(length?: number): string;
+/** Generate code challenge from verifier (S256) */
+export declare function generateCodeChallenge(verifier: string): Promise<string>;
+export type OAuthFlowParams = {
+    provider: OAuthProvider;
+    redirectUri: string;
+};
+export type OAuthFlowResult = {
+    /** URL to redirect user to for OAuth */
+    url: string;
+    /** Stored verifier (needed to complete flow) */
+    verifier: string;
+};
+/**
+ * Start OAuth flow.
+ *
+ * 1. Generates PKCE verifier + challenge
+ * 2. Calls backend to get OAuth redirect URL
+ * 3. Stores verifier in sessionStorage (needed for token exchange)
+ * 4. Returns URL for redirect
+ *
+ * @example
+ * ```ts
+ * const { url } = await startOAuthFlow({
+ *   provider: "google",
+ *   redirectUri: "https://app.example.com/auth/callback"
+ * });
+ * window.location.href = url;
+ * ```
+ */
+export declare function startOAuthFlow(params: OAuthFlowParams): Promise<OAuthFlowResult>;
+/** Get stored verifier (after OAuth redirect) */
+export declare function getStoredVerifier(): string | null;
+/** Clear stored verifier */
+export declare function clearStoredVerifier(): void;

package/dist/src/auth.js

@@ -0,0 +1,122 @@
+/**
+ * Auth Utilities
+ *
+ * PKCE helpers for OAuth flow. This is legitimately custom code -
+ * browser-side crypto can't be generated from OpenAPI.
+ */
+import { getV1AuthOauthUrl } from "../generated/endpoints/default/default";
+// --------------------------------------------------------------------------
+// PKCE Utilities
+// --------------------------------------------------------------------------
+/** Generate a cryptographically random code verifier */
+export function generateCodeVerifier(length = 64) {
+    const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+    const randomValues = crypto.getRandomValues(new Uint8Array(length));
+    return Array.from(randomValues)
+        .map((v) => charset[v % charset.length])
+        .join("");
+}
+/** Generate code challenge from verifier (S256) */
+export async function generateCodeChallenge(verifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const digest = await crypto.subtle.digest("SHA-256", data);
+    return base64UrlEncode(digest);
+}
+function base64UrlEncode(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+// --------------------------------------------------------------------------
+// Storage helpers (safe for private browsing / quota issues)
+// --------------------------------------------------------------------------
+const OAUTH_VERIFIER_KEY = "avallon_oauth_verifier";
+function safeSessionStorageSet(key, value) {
+    try {
+        if (typeof sessionStorage !== "undefined") {
+            sessionStorage.setItem(key, value);
+            return true;
+        }
+    }
+    catch {
+        // Quota exceeded or private browsing - fall through
+    }
+    return false;
+}
+function safeSessionStorageGet(key) {
+    try {
+        if (typeof sessionStorage !== "undefined") {
+            return sessionStorage.getItem(key);
+        }
+    }
+    catch {
+        // Private browsing or other issue
+    }
+    return null;
+}
+function safeSessionStorageRemove(key) {
+    try {
+        if (typeof sessionStorage !== "undefined") {
+            sessionStorage.removeItem(key);
+        }
+    }
+    catch {
+        // Ignore
+    }
+}
+/**
+ * Start OAuth flow.
+ *
+ * 1. Generates PKCE verifier + challenge
+ * 2. Calls backend to get OAuth redirect URL
+ * 3. Stores verifier in sessionStorage (needed for token exchange)
+ * 4. Returns URL for redirect
+ *
+ * @example
+ * ```ts
+ * const { url } = await startOAuthFlow({
+ *   provider: "google",
+ *   redirectUri: "https://app.example.com/auth/callback"
+ * });
+ * window.location.href = url;
+ * ```
+ */
+export async function startOAuthFlow(params) {
+    const verifier = generateCodeVerifier();
+    const challenge = await generateCodeChallenge(verifier);
+    // Get OAuth URL from backend FIRST (before storing anything)
+    const response = await getV1AuthOauthUrl({
+        provider: params.provider,
+        redirect_uri: params.redirectUri,
+        code_challenge: challenge,
+        code_challenge_method: "s256",
+    });
+    // Type narrowing - fetcher throws on errors, so this is always success
+    if (response.status !== 200) {
+        throw new Error("Failed to get OAuth URL");
+    }
+    // Only store verifier AFTER successful API call
+    const stored = safeSessionStorageSet(OAUTH_VERIFIER_KEY, verifier);
+    if (!stored) {
+        console.warn("Could not store OAuth verifier - token exchange may fail after redirect");
+    }
+    return {
+        url: response.data.data.url,
+        verifier,
+    };
+}
+/** Get stored verifier (after OAuth redirect) */
+export function getStoredVerifier() {
+    return safeSessionStorageGet(OAUTH_VERIFIER_KEY);
+}
+/** Clear stored verifier */
+export function clearStoredVerifier() {
+    safeSessionStorageRemove(OAUTH_VERIFIER_KEY);
+}

package/dist/src/fetcher.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Custom fetch wrapper for Orval-generated client.
+ * Handles auth (API key or Bearer token) and base URL configuration.
+ * Throws AvallonError on non-2xx responses for clean SWR error handling.
+ */
+export type AvallonConfig = {
+    baseUrl?: string;
+    apiKey?: string;
+    getAccessToken?: () => string | null;
+};
+/** Configure the SDK at runtime */
+export declare function configure(newConfig: Partial<AvallonConfig>): void;
+/** Get current config */
+export declare function getConfig(): AvallonConfig;
+/** Custom fetch - throws AvallonError on non-2xx */
+export declare function customFetch<T>(url: string, options: RequestInit): Promise<T>;
+/** Typed error class for API errors */
+export declare class AvallonError extends Error {
+    readonly status: number;
+    readonly body: {
+        data?: unknown;
+        message?: string;
+    };
+    constructor(status: number, body: {
+        data?: unknown;
+        message?: string;
+    });
+    /** Validation errors (400) have field-level details */
+    get errors(): Array<{
+        field: string;
+        message: string;
+    }> | undefined;
+    isValidationError(): boolean;
+    isUnauthorized(): boolean;
+    isNotFound(): boolean;
+}

package/dist/src/fetcher.js

@@ -0,0 +1,97 @@
+/**
+ * Custom fetch wrapper for Orval-generated client.
+ * Handles auth (API key or Bearer token) and base URL configuration.
+ * Throws AvallonError on non-2xx responses for clean SWR error handling.
+ */
+// --------------------------------------------------------------------------
+// Configuration
+// --------------------------------------------------------------------------
+let config = {
+    baseUrl: "https://api.avallon.ai",
+};
+/** Configure the SDK at runtime */
+export function configure(newConfig) {
+    config = { ...config, ...newConfig };
+}
+/** Get current config */
+export function getConfig() {
+    return { ...config };
+}
+// --------------------------------------------------------------------------
+// Fetch wrapper
+// --------------------------------------------------------------------------
+/** Custom fetch - throws AvallonError on non-2xx */
+export async function customFetch(url, options) {
+    const fullUrl = url.startsWith("http") ? url : `${config.baseUrl}${url}`;
+    const headers = new Headers(options.headers);
+    // Only set Content-Type for requests with JSON body
+    // (allows file uploads to set their own Content-Type)
+    if (options.body && typeof options.body === "string") {
+        headers.set("Content-Type", "application/json");
+    }
+    // Add auth header
+    const accessToken = config.getAccessToken?.();
+    if (accessToken) {
+        headers.set("Authorization", `Bearer ${accessToken}`);
+    }
+    else if (config.apiKey) {
+        headers.set("x-api-key", config.apiKey);
+    }
+    const response = await fetch(fullUrl, {
+        ...options,
+        headers,
+    });
+    // Parse response based on content type
+    const contentType = response.headers.get("Content-Type") ?? "";
+    let body;
+    if (response.status === 204) {
+        // No content
+        body = {};
+    }
+    else if (contentType.includes("application/json")) {
+        body = await response.json().catch(() => ({}));
+    }
+    else {
+        // Non-JSON response (shouldn't happen with our API, but handle gracefully)
+        const text = await response.text().catch(() => "");
+        body = { message: text };
+    }
+    // Throw on non-2xx - SWR will catch this as `error`
+    if (!response.ok) {
+        throw new AvallonError(response.status, body);
+    }
+    // Return success response in expected shape
+    return {
+        data: body,
+        status: response.status,
+        headers: response.headers,
+    };
+}
+// --------------------------------------------------------------------------
+// Error class
+// --------------------------------------------------------------------------
+/** Typed error class for API errors */
+export class AvallonError extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(body?.message ?? `API error ${status}`);
+        this.status = status;
+        this.body = body;
+        this.name = "AvallonError";
+    }
+    /** Validation errors (400) have field-level details */
+    get errors() {
+        const data = this.body?.data;
+        return data?.errors;
+    }
+    isValidationError() {
+        return this.status === 400;
+    }
+    isUnauthorized() {
+        return this.status === 401;
+    }
+    isNotFound() {
+        return this.status === 404;
+    }
+}

package/dist/src/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @avallon/sdk
+ *
+ * TypeScript SDK for the Avallon API.
+ */
+export { configure, getConfig, AvallonError, type AvallonConfig, } from "./fetcher";
+export { generateCodeVerifier, generateCodeChallenge, startOAuthFlow, getStoredVerifier, clearStoredVerifier, type OAuthProvider, type OAuthFlowParams, type OAuthFlowResult, type AuthTokens, } from "./auth";
+export * from "../generated/endpoints";
+export * from "../generated/models";

package/dist/src/index.js

@@ -0,0 +1,20 @@
+/**
+ * @avallon/sdk
+ *
+ * TypeScript SDK for the Avallon API.
+ */
+// ============================================================================
+// HANDWRITTEN - Custom code that can't be generated from OpenAPI
+// ============================================================================
+// Runtime configuration (base URL, auth)
+export { configure, getConfig, AvallonError, } from "./fetcher";
+// OAuth PKCE utilities (browser crypto)
+export { generateCodeVerifier, generateCodeChallenge, startOAuthFlow, getStoredVerifier, clearStoredVerifier, } from "./auth";
+// ============================================================================
+// GENERATED - Auto-generated from OpenAPI spec (do not edit)
+// Run `npm run generate` to regenerate
+// ============================================================================
+// API endpoints (SWR hooks + fetch functions)
+export * from "../generated/endpoints";
+// Request/response types
+export * from "../generated/models";