@barndoor-ai/sdk 1.2.0 → 2.0.0-dev.g37b8897

package/dist/lib/auth.d.ts

@@ -0,0 +1,95 @@
+import * as oidc from 'openid-client';
+/**
+ * Supplies a bearer token, and is asked for one on every request.
+ *
+ * This is the shape the generated client's `accessToken` hook already has, so a
+ * provider can refresh transparently and callers never hold a token that has
+ * since expired. Handing the SDK a token string instead would make the caller
+ * responsible for noticing expiry mid-session.
+ */
+export type TokenProvider = () => Promise<string>;
+/** A token obtained elsewhere: a Barndoor API key, or one from your own flow. */
+export declare function staticToken(token: string): TokenProvider;
+export interface ClientCredentialsOptions {
+    clientId: string;
+    clientSecret: string;
+    /** Defaults to the issuer the spec declares (`x-issuer` on the OAuth2 scheme). */
+    issuer?: string;
+    /** Space-delimited. Defaults to what every published operation requires. */
+    scope?: string;
+    /**
+     * Replaces the fetch used to reach the authorization server.
+     *
+     * The same seam `createFetch` offers: it exists for a proxy, a custom agent
+     * or instrumentation, and it is what lets the token lifecycle be tested
+     * against a stub instead of a live IdP.
+     */
+    fetch?: oidc.CustomFetch;
+}
+/**
+ * Machine-to-machine credentials.
+ *
+ * Discovery and the token request are both deferred to the first call rather
+ * than run at construction: building a client should not make network calls,
+ * and a service that never issues a request should not need the IdP to be
+ * reachable.
+ */
+export declare function clientCredentials(options: ClientCredentialsOptions): TokenProvider;
+/**
+ * Exchange a refresh token, keeping the newest one.
+ *
+ * Refresh tokens are frequently single-use: an authorization server may return
+ * a new one with each exchange and invalidate the old. Holding on to the
+ * original would work exactly once.
+ */
+export declare function refreshToken(initialRefreshToken: string, options: {
+    clientId: string;
+    clientSecret?: string;
+    issuer?: string;
+}): TokenProvider;
+export interface AuthorizationCodeOptions {
+    clientId: string;
+    /** Where the authorization server sends the user back. Must be registered on the client. */
+    redirectUri: string;
+    /** Confidential clients only. Omit for a public client, which relies on PKCE. */
+    clientSecret?: string;
+    issuer?: string;
+    scope?: string;
+}
+/** What {@link startAuthorizationCode} hands back, to be kept until the user returns. */
+export interface AuthorizationCodeRequest {
+    /** Send the user here. */
+    authorizationUrl: string;
+    /** Both must survive until the exchange, and neither may be reused. */
+    codeVerifier: string;
+    state: string;
+}
+/**
+ * Begin an authorization code flow with PKCE.
+ *
+ * There is no callback listener here on purpose. Catching the redirect is one
+ * way to obtain the code and it only works where a local port can be bound —
+ * not over SSH, not in a container, not in a browser. A browser app already has
+ * the redirect as its own page URL, and a script can ask the user to paste the
+ * URL they landed on. Both then call {@link completeAuthorizationCode}.
+ */
+export declare function startAuthorizationCode(options: AuthorizationCodeOptions): Promise<AuthorizationCodeRequest>;
+/**
+ * Finish the flow and get a provider.
+ *
+ * `callbackUrl` is the full URL the user arrived at, query string included —
+ * `window.location.href` in a browser, or whatever the user pasted.
+ *
+ * Returns a {@link TokenProvider} rather than a bare token so the session
+ * refreshes itself: the access token is short-lived, and a caller handed a
+ * string would have to notice expiry and re-run the whole interactive flow.
+ */
+export declare function completeAuthorizationCode(options: AuthorizationCodeOptions & {
+    callbackUrl: string;
+    codeVerifier: string;
+    state: string;
+}): Promise<{
+    accessToken: string;
+    refreshToken?: string;
+    getToken: TokenProvider;
+}>;

package/dist/lib/auth.js

@@ -0,0 +1,215 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.staticToken = staticToken;
+exports.clientCredentials = clientCredentials;
+exports.refreshToken = refreshToken;
+exports.startAuthorizationCode = startAuthorizationCode;
+exports.completeAuthorizationCode = completeAuthorizationCode;
+const oidc = __importStar(require("openid-client"));
+const runtime_js_1 = require("../runtime.js");
+/** A token obtained elsewhere: a Barndoor API key, or one from your own flow. */
+function staticToken(token) {
+    return async () => token;
+}
+/**
+ * Refresh a little before the server says the token dies, so a token that is
+ * valid when checked is still valid when it arrives.
+ */
+const EXPIRY_SKEW_SECONDS = 60;
+/**
+ * Discovery, with an optional replacement fetch carried onto the resulting
+ * configuration so later grants use it too — otherwise only the metadata
+ * request would be redirected and the token request would go elsewhere.
+ */
+async function discoverWith(issuer, clientId, clientSecret, customFetch) {
+    const config = await oidc.discovery(new URL(issuer), clientId, clientSecret, undefined, customFetch ? { [oidc.customFetch]: customFetch } : undefined);
+    if (customFetch) {
+        config[oidc.customFetch] = customFetch;
+    }
+    return config;
+}
+/**
+ * How long a token is good for, from a response that may not say.
+ *
+ * `expires_in` is optional in OAuth 2.0. Treating an absent value as "already
+ * expired" would request a token per API call, so it is treated as unknown and
+ * the token is used until a 401 forces a new one. `!= null`, not truthiness:
+ * `expires_in: 0` means already expired and is falsy.
+ */
+function expiryFrom(expiresIn) {
+    return expiresIn != null ? Date.now() + (expiresIn - EXPIRY_SKEW_SECONDS) * 1000 : Number.POSITIVE_INFINITY;
+}
+/**
+ * Machine-to-machine credentials.
+ *
+ * Discovery and the token request are both deferred to the first call rather
+ * than run at construction: building a client should not make network calls,
+ * and a service that never issues a request should not need the IdP to be
+ * reachable.
+ */
+function clientCredentials(options) {
+    const { clientId, clientSecret, issuer = runtime_js_1.OAUTH_ISSUER, scope = 'openid profile email', fetch: customFetch, } = options;
+    let configuration;
+    let cached;
+    let inFlight;
+    const discover = () => {
+        // Memoised, not re-discovered per token: the metadata is stable and
+        // discovery is a second network round trip on every refresh otherwise.
+        //
+        // Cleared on REJECTION, because `??=` caches the promise itself: a single
+        // transient failure — an IdP restarting mid-deploy is enough — would
+        // otherwise be replayed to every later call forever, and only a process
+        // restart would recover. Success is kept.
+        configuration ??= discoverWith(issuer, clientId, clientSecret, customFetch).catch(error => {
+            configuration = undefined;
+            throw error;
+        });
+        return configuration;
+    };
+    const fetchToken = async () => {
+        const config = await discover();
+        const response = await oidc.clientCredentialsGrant(config, { scope });
+        // `expires_in` is optional in OAuth 2.0. Treating an absent value as
+        // "already expired" would request a token per API call, so it is instead
+        // treated as unknown and the token is used until a 401 forces a new one.
+        cached = {
+            token: response.access_token,
+            expiresAt: expiryFrom(response.expires_in),
+        };
+        return cached.token;
+    };
+    return async function getToken() {
+        if (cached && Date.now() < cached.expiresAt) {
+            return cached.token;
+        }
+        // Concurrent requests arriving on an expired token must produce ONE token
+        // request, not one each — every generated operation calls this hook, so a
+        // burst of parallel calls would otherwise stampede the IdP.
+        inFlight ??= fetchToken().finally(() => {
+            inFlight = undefined;
+        });
+        return inFlight;
+    };
+}
+/**
+ * Exchange a refresh token, keeping the newest one.
+ *
+ * Refresh tokens are frequently single-use: an authorization server may return
+ * a new one with each exchange and invalidate the old. Holding on to the
+ * original would work exactly once.
+ */
+function refreshToken(initialRefreshToken, options) {
+    const { clientId, clientSecret, issuer = runtime_js_1.OAUTH_ISSUER } = options;
+    let configuration;
+    let current = initialRefreshToken;
+    let cached;
+    let inFlight;
+    const exchange = async () => {
+        // Cleared on rejection for the same reason as in clientCredentials above.
+        configuration ??= oidc.discovery(new URL(issuer), clientId, clientSecret).catch(error => {
+            configuration = undefined;
+            throw error;
+        });
+        const response = await oidc.refreshTokenGrant(await configuration, current);
+        if (response.refresh_token) {
+            current = response.refresh_token;
+        }
+        cached = {
+            token: response.access_token,
+            expiresAt: expiryFrom(response.expires_in),
+        };
+        return cached.token;
+    };
+    return async function getToken() {
+        if (cached && Date.now() < cached.expiresAt) {
+            return cached.token;
+        }
+        inFlight ??= exchange().finally(() => {
+            inFlight = undefined;
+        });
+        return inFlight;
+    };
+}
+/**
+ * Begin an authorization code flow with PKCE.
+ *
+ * There is no callback listener here on purpose. Catching the redirect is one
+ * way to obtain the code and it only works where a local port can be bound —
+ * not over SSH, not in a container, not in a browser. A browser app already has
+ * the redirect as its own page URL, and a script can ask the user to paste the
+ * URL they landed on. Both then call {@link completeAuthorizationCode}.
+ */
+async function startAuthorizationCode(options) {
+    const { clientId, clientSecret, redirectUri, issuer = runtime_js_1.OAUTH_ISSUER, scope = 'openid profile email' } = options;
+    const config = await oidc.discovery(new URL(issuer), clientId, clientSecret);
+    const codeVerifier = oidc.randomPKCECodeVerifier();
+    const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
+    const state = oidc.randomState();
+    const url = oidc.buildAuthorizationUrl(config, {
+        redirect_uri: redirectUri,
+        scope,
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256',
+        state,
+    });
+    return { authorizationUrl: url.href, codeVerifier, state };
+}
+/**
+ * Finish the flow and get a provider.
+ *
+ * `callbackUrl` is the full URL the user arrived at, query string included —
+ * `window.location.href` in a browser, or whatever the user pasted.
+ *
+ * Returns a {@link TokenProvider} rather than a bare token so the session
+ * refreshes itself: the access token is short-lived, and a caller handed a
+ * string would have to notice expiry and re-run the whole interactive flow.
+ */
+async function completeAuthorizationCode(options) {
+    const { clientId, clientSecret, issuer = runtime_js_1.OAUTH_ISSUER, callbackUrl, codeVerifier, state } = options;
+    const config = await oidc.discovery(new URL(issuer), clientId, clientSecret);
+    const tokens = await oidc.authorizationCodeGrant(config, new URL(callbackUrl), {
+        pkceCodeVerifier: codeVerifier,
+        // Checked, not skipped: without it a forged callback URL can inject an
+        // attacker's code and bind the session to their account.
+        expectedState: state,
+    });
+    // Without a refresh token there is nothing to renew with, so the access token
+    // is served until it expires and the caller must start the flow again.
+    const getToken = tokens.refresh_token
+        ? refreshToken(tokens.refresh_token, { clientId, clientSecret, issuer })
+        : staticToken(tokens.access_token);
+    return { accessToken: tokens.access_token, refreshToken: tokens.refresh_token, getToken };
+}

package/dist/lib/cli.d.ts

@@ -0,0 +1,44 @@
+import { type AuthorizationCodeOptions, type TokenProvider } from './auth.js';
+/**
+ * Interactive login for command-line tools.
+ *
+ * NODE ONLY. This module binds a local port and launches a browser, neither of
+ * which exists in a browser runtime, so it is published under the `/cli`
+ * subpath rather than the package root — importing the root must not drag
+ * `node:http` into a bundle.
+ *
+ * Everything here is orchestration. The flow itself is
+ * {@link startAuthorizationCode} and {@link completeAuthorizationCode}, which
+ * work without any of this; the listener only saves the user from copying a URL
+ * out of the address bar.
+ */
+export interface InteractiveLoginOptions extends Omit<AuthorizationCodeOptions, 'redirectUri'> {
+    /**
+     * Must match a redirect URI registered on the OAuth client, which is an exact
+     * comparison at the authorization server — a port it does not know about is
+     * rejected before the user sees a login page. Matches the port the
+     * hand-written SDK used.
+     */
+    port?: number;
+    /** Give up if the user never finishes. */
+    timeoutMs?: number;
+    /** Set false to skip launching a browser, leaving the user to open the URL. */
+    openBrowser?: boolean;
+    /**
+     * Where the sign-in URL goes. Defaults to stdout.
+     *
+     * A library should not write to the console with no way to intercept it:
+     * a caller rendering a TUI, logging structurally, or driving this from a test
+     * needs the URL as a value rather than as output.
+     */
+    onUrl?: (url: string) => void;
+}
+/**
+ * Log a user in and return a self-refreshing {@link TokenProvider}.
+ *
+ * Opens a browser, catches the redirect on a local port, and exchanges the
+ * code. The OAuth client is the caller's: its id, and a redirect URI of
+ * `http://localhost:<port>/callback`, must be registered with the
+ * authorization server first.
+ */
+export declare function loginInteractive(options: InteractiveLoginOptions): Promise<TokenProvider>;

package/dist/lib/cli.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loginInteractive = loginInteractive;
+const node_child_process_1 = require("node:child_process");
+const node_http_1 = require("node:http");
+const auth_js_1 = require("./auth.js");
+/** Best-effort browser launch. Failure is not fatal — the URL is printed too. */
+function openInBrowser(url) {
+    const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+    try {
+        (0, node_child_process_1.spawn)(command, [url], { detached: true, stdio: 'ignore', shell: process.platform === 'win32' })
+            .on('error', () => undefined)
+            .unref();
+    }
+    catch {
+        // Headless, sandboxed, or no handler registered. The printed URL still works.
+    }
+}
+/**
+ * Wait for the authorization server to redirect the user back.
+ *
+ * Resolves with the full callback URL — query string included — which is what
+ * the exchange needs in order to check `state` and read the code.
+ */
+function awaitCallback(port, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const server = (0, node_http_1.createServer)((req, res) => {
+            const url = new URL(req.url ?? '/', `http://localhost:${port}`);
+            // The browser asks for /favicon.ico alongside the real callback; answering
+            // that one as if it were the redirect would resolve with no code at all.
+            if (!url.searchParams.has('code') && !url.searchParams.has('error')) {
+                res.writeHead(404).end();
+                return;
+            }
+            const failed = url.searchParams.get('error');
+            res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' }).end(`<!doctype html><meta charset="utf-8"><title>Barndoor</title>
+         <body style="font:16px system-ui;padding:3rem;text-align:center">
+         <p>${failed ? `Sign-in failed: ${failed}` : 'Signed in. You can close this window.'}</p>`);
+            // Close after responding, so the browser is not left waiting on a socket
+            // that never finishes.
+            server.close();
+            if (failed) {
+                reject(new Error(`Authorization failed: ${failed}${url.searchParams.get('error_description') ? ` — ${url.searchParams.get('error_description')}` : ''}`));
+            }
+            else {
+                resolve(url.href);
+            }
+        });
+        const timer = setTimeout(() => {
+            server.close();
+            reject(new Error(`Timed out after ${timeoutMs}ms waiting for the browser to come back`));
+        }, timeoutMs);
+        timer.unref?.();
+        server.once('close', () => clearTimeout(timer));
+        server.on('error', error => {
+            clearTimeout(timer);
+            reject(new Error(`Could not listen on port ${port} (${error.code}). ` +
+                'Free the port, pass a different one that is also registered on the OAuth client, or ' +
+                'use startAuthorizationCode/completeAuthorizationCode directly.'));
+        });
+        // Loopback only. Binding every interface would expose the authorization code
+        // to anything else on the network for the life of the login.
+        server.listen(port, '127.0.0.1');
+    });
+}
+/**
+ * Log a user in and return a self-refreshing {@link TokenProvider}.
+ *
+ * Opens a browser, catches the redirect on a local port, and exchanges the
+ * code. The OAuth client is the caller's: its id, and a redirect URI of
+ * `http://localhost:<port>/callback`, must be registered with the
+ * authorization server first.
+ */
+async function loginInteractive(options) {
+    const { port = 52765, timeoutMs = 300_000, openBrowser = true, onUrl = url => console.log(`\nOpen this to sign in:\n\n${url}\n`), ...auth } = options;
+    const redirectUri = `http://localhost:${port}/callback`;
+    const request = await (0, auth_js_1.startAuthorizationCode)({ ...auth, redirectUri });
+    // Listen BEFORE sending the user anywhere: a fast redirect against a server
+    // that is not up yet is a connection refused the user sees instead of a login.
+    const callback = awaitCallback(port, timeoutMs);
+    if (openBrowser)
+        openInBrowser(request.authorizationUrl);
+    onUrl(request.authorizationUrl);
+    const { getToken } = await (0, auth_js_1.completeAuthorizationCode)({
+        ...auth,
+        redirectUri,
+        callbackUrl: await callback,
+        codeVerifier: request.codeVerifier,
+        state: request.state,
+    });
+    return getToken;
+}

package/dist/lib/client.d.ts

@@ -0,0 +1,51 @@
+import { Configuration, type Middleware, DlpApi, IdentityApi, LlmGatewayApi, NotificationApi, PolicyApi, RegistryApi, SystemManagementApi } from '../index.js';
+import { type ClientCredentialsOptions, type TokenProvider } from './auth.js';
+import { type Environment } from './config.js';
+import { type RetryOptions } from './http.js';
+export interface ClientOptions {
+    /**
+     * How to authenticate. One of:
+     *
+     * - a token string — a Barndoor API key, or one you obtained yourself
+     * - machine-to-machine credentials, exchanged and refreshed for you
+     * - your own {@link TokenProvider}, asked for a token on every request
+     */
+    auth: string | ClientCredentialsOptions | TokenProvider;
+    /** Defaults to production, which the generated client already points at. */
+    env?: Environment;
+    /** Retry and timeout behaviour. `false` disables retrying. */
+    retry?: RetryOptions | false;
+    /**
+     * Run around every request: `pre`, `post` and `onError`.
+     *
+     * This is the extension point for logging, tracing and metrics — the SDK
+     * itself logs nothing, so a caller who wants visibility into requests adds it
+     * here rather than configuring a logger we would have to define.
+     */
+    middleware?: Middleware[];
+    /** Sent on every request. */
+    headers?: Record<string, string>;
+}
+export interface BarndoorClient {
+    registry: RegistryApi;
+    policy: PolicyApi;
+    identity: IdentityApi;
+    notification: NotificationApi;
+    dlp: DlpApi;
+    llmGateway: LlmGatewayApi;
+    systemManagement: SystemManagementApi;
+    /** The underlying configuration, for constructing an API class this does not expose. */
+    configuration: Configuration;
+}
+/**
+ * Assemble a client.
+ *
+ * Synchronous on purpose: nothing here touches the network. OIDC discovery and
+ * the first token exchange are deferred to the first request, so constructing a
+ * client cannot fail because an IdP is briefly unreachable.
+ *
+ * Retries are on unless switched off. Wiring `fetchApi` by hand is easy to
+ * forget, and forgetting it fails invisibly — the client simply becomes less
+ * resilient, with nothing to notice until a deploy produces a burst of 503s.
+ */
+export declare function createClient(options: ClientOptions): BarndoorClient;

package/dist/lib/client.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createClient = createClient;
+const index_js_1 = require("../index.js");
+const auth_js_1 = require("./auth.js");
+const http_js_1 = require("./http.js");
+function resolveAuth(auth, env) {
+    if (typeof auth === 'function')
+        return auth;
+    if (typeof auth === 'string')
+        return (0, auth_js_1.staticToken)(auth);
+    // Credentials inherit the environment's issuer, so pointing at dev cannot
+    // leave the API on dev while the token comes from production.
+    return (0, auth_js_1.clientCredentials)(env ? { issuer: env.issuer, ...auth } : auth);
+}
+/**
+ * Assemble a client.
+ *
+ * Synchronous on purpose: nothing here touches the network. OIDC discovery and
+ * the first token exchange are deferred to the first request, so constructing a
+ * client cannot fail because an IdP is briefly unreachable.
+ *
+ * Retries are on unless switched off. Wiring `fetchApi` by hand is easy to
+ * forget, and forgetting it fails invisibly — the client simply becomes less
+ * resilient, with nothing to notice until a deploy produces a burst of 503s.
+ */
+function createClient(options) {
+    const { auth, env, retry, middleware, headers } = options;
+    const configuration = new index_js_1.Configuration({
+        // Omitted for production: the generated BASE_PATH already is production,
+        // taken from the spec's `servers` block.
+        ...(env?.baseUrl ? { basePath: env.baseUrl } : {}),
+        accessToken: resolveAuth(auth, env),
+        ...(retry === false ? {} : { fetchApi: (0, http_js_1.createFetch)(retry) }),
+        ...(middleware ? { middleware } : {}),
+        ...(headers ? { headers } : {}),
+    });
+    return {
+        registry: new index_js_1.RegistryApi(configuration),
+        policy: new index_js_1.PolicyApi(configuration),
+        identity: new index_js_1.IdentityApi(configuration),
+        notification: new index_js_1.NotificationApi(configuration),
+        dlp: new index_js_1.DlpApi(configuration),
+        llmGateway: new index_js_1.LlmGatewayApi(configuration),
+        systemManagement: new index_js_1.SystemManagementApi(configuration),
+        configuration,
+    };
+}

package/dist/lib/config.d.ts

@@ -0,0 +1,14 @@
+export interface Environment {
+    /** OIDC issuer, for discovery. */
+    issuer: string;
+    /** API base URL, passed to the generated `Configuration` as `basePath`. */
+    baseUrl: string;
+}
+export declare const DEV: Environment;
+/**
+ * Local Tilt. The host carries an `mcp.` prefix rather than `platform.`, which
+ * is why the spec's `servers` variable is the whole host and not a domain
+ * suffix — see charts/barndoor/values.yaml.
+ */
+export declare const LOCAL: Environment;
+export declare function environmentFromEnv(source?: Record<string, string | undefined>): Environment | undefined;

package/dist/lib/config.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOCAL = exports.DEV = void 0;
+exports.environmentFromEnv = environmentFromEnv;
+/**
+ * Non-production overrides.
+ *
+ * Production needs nothing here: the generated client already carries the
+ * production base URL (from the spec's `servers` block, baked into `BASE_PATH`)
+ * and the production OAuth endpoints (from the `OAuth2` security scheme, emitted
+ * as `OAUTH_ISSUER` / `OAUTH_TOKEN_URL` / `OAUTH_AUTHORIZATION_URL`). Both come
+ * from docs/api/public-openapi.yaml, so neither is restated here.
+ *
+ * Only the other environments need declaring, because one spec cannot describe
+ * several deployments.
+ */
+const runtime_js_1 = require("../runtime.js");
+exports.DEV = {
+    issuer: 'https://auth.barndoordev.com/realms/barndoor',
+    baseUrl: 'https://platform.barndoordev.com',
+};
+/**
+ * Local Tilt. The host carries an `mcp.` prefix rather than `platform.`, which
+ * is why the spec's `servers` variable is the whole host and not a domain
+ * suffix — see charts/barndoor/values.yaml.
+ */
+exports.LOCAL = {
+    issuer: 'https://auth.barndoorlocal.com/realms/barndoor',
+    baseUrl: 'https://mcp.barndoorlocal.com',
+};
+/**
+ * Read an environment from process environment variables.
+ *
+ * Opt-in on purpose. The SDK never reads `process.env` by itself: it is not
+ * available in a browser, and a library that quietly re-points itself at another
+ * cluster because of a variable set for some unrelated reason is a bad
+ * surprise. Callers who want the behaviour ask for it:
+ *
+ *     createClient({ auth, env: environmentFromEnv() })
+ *
+ * `BARNDOOR_ENV` selects a known environment (`dev` or `local`; anything else,
+ * including unset, means production). `BARNDOOR_API_URL` overrides the base URL
+ * independently, for a deployment this SDK does not know about.
+ *
+ * Returns `undefined` for production, which is what `createClient` wants when
+ * it should fall back to the generated defaults.
+ */
+/**
+ * `process.env`, or an empty object off-Node.
+ *
+ * Reached through `globalThis` rather than the `process` global so the package
+ * needs no `@types/node`, which a browser consumer should not have to install.
+ */
+function processEnv() {
+    return globalThis.process?.env ?? {};
+}
+function environmentFromEnv(source = processEnv()) {
+    const named = source['BARNDOOR_ENV']?.trim().toLowerCase();
+    const base = named === 'dev' ? exports.DEV : named === 'local' ? exports.LOCAL : undefined;
+    const url = source['BARNDOOR_API_URL']?.trim();
+    if (!url)
+        return base;
+    // A bare URL override still needs an issuer, and production's is the only one
+    // the SDK knows without being told.
+    return { issuer: base?.issuer ?? runtime_js_1.OAUTH_ISSUER, baseUrl: url };
+}

package/dist/lib/http.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The fetch the generated client runs every request through.
+ *
+ * `Configuration.fetchApi` is the single choke point — runtime.ts calls
+ * `(this.configuration.fetchApi || fetch)(...)` once, beneath the middleware
+ * chain, so retries belong here rather than in a `Middleware`: a `post` hook
+ * would see each attempt, and an `onError` hook cannot retry a response that
+ * arrived successfully with a 503.
+ */
+/** Matches the generated `FetchAPI` type without importing from generated code. */
+type FetchAPI = (url: string, init?: RequestInit) => Promise<Response>;
+export interface RetryOptions {
+    /** Attempts after the first. 0 disables retrying. */
+    retries?: number;
+    /** Per-attempt timeout in milliseconds. */
+    timeoutMs?: number;
+    /** Base for exponential backoff in milliseconds. */
+    backoffMs?: number;
+    /** Underlying fetch, for tests or a non-global implementation. */
+    fetch?: FetchAPI;
+}
+export declare function createFetch(options?: RetryOptions): FetchAPI;
+export {};