@buildbase/sdk 0.0.48 → 0.0.50

package/dist/index.d.ts

@@ -1112,6 +1112,8 @@ declare abstract class BaseApi {
     protected url(path: string): string;
     /** Merge auth + custom + per-request headers. */
     private buildHeaders;
+    /** Fire the onError callback exactly once per error, regardless of call path. */
+    private reportError;
     /** Execute fetch with timeout, retries, debug logging, and error callback. */
     private executeFetch;
     /** Internal: execute fetch against a resolved URL with timeout, retries, debug logging, and error callback. */
@@ -1858,8 +1860,14 @@ declare function validateRedirectUrl(url: string | null | undefined): string | n
 /**
  * Safely redirect to a URL after validating it.
  * Falls back to fallbackUrl if the target URL is invalid.
+ *
+ * Browser-only: navigation requires `window.location`. On non-browser runtimes
+ * (Node, edge, Deno, Bun) there is nothing to navigate, so this is a no-op that
+ * returns `false`. Returns `true` when a navigation was initiated. Server code
+ * that needs the resolved target should call {@link validateRedirectUrl} and
+ * issue the redirect with its own framework (e.g. `Response.redirect`).
  */
-declare function safeRedirect(url: string | null | undefined, fallbackUrl?: string): void;
+declare function safeRedirect(url: string | null | undefined, fallbackUrl?: string): boolean;
 
 /**
  * Auth intent preservation — saves and restores the URL the user was on
@@ -2209,7 +2217,10 @@ interface BetaFormResponse {
  * Verify that a webhook request came from BuildBase.
  *
  * Uses HMAC-SHA256 signature verification with timing-safe comparison
- * to prevent timing attacks. Node.js only (uses `crypto` module).
+ * to prevent timing attacks. Runtime-agnostic: the HMAC is a dependency-free
+ * pure-JS implementation (shared with the OAuth app-bridge), so it behaves
+ * identically under CJS, ESM, bundlers, edge runtimes, Deno, Bun, and browsers —
+ * no Node `crypto`/`require`/`Buffer`.
  *
  * @example
  * ```ts
@@ -2285,6 +2296,460 @@ declare function parseWebhookEvent(options: {
     data: Record<string, any>;
 } | null;
 
+/**
+ * Agent-readiness discovery toolkit (server-side, framework-agnostic).
+ *
+ * Makes a consuming app "agent ready" (see https://isitagentready.com) by
+ * serving the standard machine-readable discovery documents an AI agent looks
+ * for — with the BuildBase server as the source of truth.
+ *
+ * The heavy lifting already lives on the platform: an org admin configures
+ * agent readiness once (protected resources, scopes, llms.txt) and the server
+ * publishes the OAuth2 authorization-server metadata (RFC 8414) and the
+ * per-resource protected-resource metadata (RFC 9728). This module lets an app
+ * re-serve those documents from its own origin — where agents actually look —
+ * plus generate the static discovery documents (Agent Card, Agent Skills,
+ * security.txt) from local config. The result: an org admin adds full agent
+ * support to their app in a couple of lines, and never hand-writes a
+ * `.well-known` route.
+ *
+ * Zero React and no framework types — every function returns plain data. The
+ * only runtime dependency is `fetch`; SHA-256 (for Agent Skills digests) is a
+ * dependency-free pure-JS implementation, so there is no Web Crypto / Node
+ * `crypto` requirement and output is identical on every runtime (browser, edge,
+ * Node 18+). Wire the returned documents into your router yourself (Next.js,
+ * Hono, Express, …).
+ *
+ * @example Next.js App Router — the entire integration:
+ * ```ts
+ * // lib/agent-ready.ts
+ * import type { AgentReadyConfig } from "@buildbase/sdk";
+ * export const agentConfig: AgentReadyConfig = {
+ *   serverUrl: process.env.BUILDBASE_URL!,
+ *   orgId: process.env.BUILDBASE_ORG_ID!,
+ *   siteUrl: "https://imejis.io",
+ *   site: { name: "Imejis", description: "Generate images from templates via API." },
+ * };
+ *
+ * // app/.well-known/[...path]/route.ts
+ * import { resolveWellKnown } from "@buildbase/sdk";
+ * import { agentConfig } from "@/lib/agent-ready";
+ * export async function GET(req: Request) {
+ *   const doc = await resolveWellKnown(new URL(req.url).pathname, agentConfig);
+ *   if (!doc) return new Response('{"error":"not_found"}', { status: 404 });
+ *   return new Response(doc.body, {
+ *     status: doc.status,
+ *     headers: { "Content-Type": doc.contentType, "Cache-Control": doc.cacheControl },
+ *   });
+ * }
+ *
+ * // app/llms.txt/route.ts
+ * import { buildLlmsTxt, fetchAgentReadiness } from "@buildbase/sdk";
+ * import { agentConfig } from "@/lib/agent-ready";
+ * export async function GET() {
+ *   const doc = buildLlmsTxt(agentConfig, await fetchAgentReadiness(agentConfig));
+ *   if (!doc) return new Response("Not found", { status: 404 });
+ *   return new Response(doc.body, { headers: { "Content-Type": doc.contentType } });
+ * }
+ * ```
+ */
+/**
+ * The agent-readiness bundle the BuildBase server publishes for an org at
+ * `GET /api/v1/public/:orgId/agent-readiness`. This is the single source of
+ * truth an org admin edits; everything org-specific below is derived from it.
+ */
+interface AgentReadinessBundle {
+    /** False when the org has not enabled agent readiness — everything else absent. */
+    enabled: boolean;
+    /** Pointer to the org's RFC 8414 authorization-server metadata. */
+    authorizationServer?: {
+        issuer: string;
+        metadataUrl: string;
+    };
+    /**
+     * RFC 9728 protected-resource metadata objects, ready to serve. Each `metadata`
+     * is a complete document; `resource` is the canonical resource URI it describes.
+     */
+    protectedResources?: Array<{
+        resource: string;
+        metadata: Record<string, unknown>;
+    }>;
+    /** Org-authored llms.txt content, or null when unset. */
+    llmsTxt?: string | null;
+}
+/** An Agent Skill (Agent Skills Discovery RFC v0.2.0) published by this app. */
+interface AgentSkill {
+    /** Stable slug, e.g. `imejis-api`. */
+    name: string;
+    /** One-line human/agent-readable summary. */
+    description: string;
+    /** Full markdown content of the SKILL.md served for this skill. */
+    content: string;
+    /**
+     * Path the SKILL.md is served from. Defaults to
+     * `/.well-known/agent-skills/<name>/SKILL.md`.
+     */
+    path?: string;
+    /** Skill artifact kind. Defaults to `skill-md`. */
+    type?: 'skill-md' | 'archive';
+}
+/** One API described in an API Catalog (RFC 9727 / RFC 9264 linkset). */
+interface ApiCatalogApi {
+    /** Anchor URL identifying the API, e.g. `https://api.imejis.io`. */
+    anchor: string;
+    /** OpenAPI / machine-readable description URL (link rel `service-desc`). */
+    serviceDesc?: string;
+    /** Human documentation URL (link rel `service-doc`). */
+    serviceDoc?: string;
+    /** Health / status endpoint URL (link rel `status`). */
+    status?: string;
+    /** Optional human title for the API. */
+    title?: string;
+}
+/** MCP Server Card (SEP-1649 / SEP-2127), advertising a live MCP server. */
+interface McpServerCard {
+    /** Server name. */
+    name: string;
+    /** Server version. */
+    version: string;
+    /** MCP transport endpoint URL the agent connects to. */
+    endpoint: string;
+    /** Transport type. Defaults to `"streamable-http"`. */
+    transport?: string;
+    /** Capabilities object, e.g. `{ tools: {}, resources: {} }`. */
+    capabilities?: Record<string, unknown>;
+    /** Optional human description. */
+    description?: string;
+    /** Documentation URL. */
+    documentationUrl?: string;
+}
+/** Configuration for the agent-readiness discovery layer. */
+interface AgentReadyConfig {
+    /** BuildBase server base URL, e.g. `https://api.buildbase.app` (no trailing slash needed). */
+    serverUrl: string;
+    /** The org id (24-hex) whose agent-readiness config to serve. */
+    orgId: string;
+    /**
+     * This app's public origin, e.g. `https://imejis.io`. Used to build absolute
+     * URLs in the Agent Card and to match RFC 9728 resource paths.
+     */
+    siteUrl: string;
+    /** Static metadata for the Agent Card (`/.well-known/agent.json`). */
+    site: {
+        name: string;
+        description?: string;
+        /** Absolute URL to human/agent documentation. */
+        documentationUrl?: string;
+        /** Support/contact email surfaced on the Agent Card. */
+        contactEmail?: string;
+        /** Provider block; defaults to `{ name: site.name, url: siteUrl }`. */
+        provider?: {
+            name: string;
+            url: string;
+        };
+    };
+    /** Agent Skills to publish. Omit to skip the Agent Skills documents. */
+    skills?: AgentSkill[];
+    /** security.txt fields (RFC 9116). Omit to skip serving security.txt. */
+    security?: {
+        /** Contact URI(s) — email (`mailto:`) or URL. */
+        contact: string | string[];
+        /** ISO-8601 expiry; strongly recommended by RFC 9116. */
+        expires?: string;
+        /** Security policy URL. */
+        policy?: string;
+    };
+    /**
+     * API Catalog entries (RFC 9727), served at `/.well-known/api-catalog` as
+     * `application/linkset+json`. Omit to skip.
+     */
+    apiCatalog?: ApiCatalogApi[];
+    /**
+     * MCP Server Card (SEP-1649), served at `/.well-known/mcp/server-card.json`.
+     * Only set this when you actually run an MCP server — the card advertises a
+     * live transport endpoint. Omit to skip.
+     */
+    mcpServerCard?: McpServerCard;
+    /**
+     * Raw `/auth.md` content (agent registration/auth instructions). If omitted,
+     * `buildAuthMd` generates one from the OAuth metadata + site config.
+     */
+    authMd?: string;
+    /** TTL (seconds) for cached platform fetches. Default 300 (5 min). */
+    cacheTtlSeconds?: number;
+    /** Injectable fetch, mainly for testing. Defaults to the global `fetch`. */
+    fetch?: typeof fetch;
+}
+/** A rendered discovery document ready to become an HTTP response. */
+interface DiscoveryDocument {
+    status: number;
+    contentType: string;
+    body: string;
+    cacheControl: string;
+}
+/**
+ * SHA-256 of `content` as `sha256:<hex>`, via the shared pure-JS hash (no Web
+ * Crypto / Node `crypto`), so output is identical on every runtime.
+ */
+declare function sha256Digest(content: string): string;
+/**
+ * Fetch (and cache) an org's agent-readiness bundle from the BuildBase server.
+ *
+ * Fail-soft: any network/HTTP/parse error resolves to `{ enabled: false }` so a
+ * discovery route never 500s and never leaks the platform being down — agents
+ * simply see the app as not (yet) agent-ready.
+ */
+declare function fetchAgentReadiness(config: AgentReadyConfig): Promise<AgentReadinessBundle>;
+/** Clear the in-memory agent-readiness cache (mainly for tests). */
+declare function clearAgentReadinessCache(): void;
+/**
+ * The Agent Card served at `/.well-known/agent.json`. A stable, machine-readable
+ * entry point advertising who this app is and where agents can discover more.
+ */
+declare function buildAgentCard(config: AgentReadyConfig, bundle: AgentReadinessBundle): DiscoveryDocument;
+/**
+ * Resolve the RFC 9728 protected-resource metadata for a request path, or null
+ * if no configured resource maps to it.
+ */
+declare function buildProtectedResourceMetadata(requestPath: string, config: AgentReadyConfig, bundle: AgentReadinessBundle): DiscoveryDocument | null;
+/** Agent Skills discovery index (Agent Skills Discovery RFC v0.2.0). */
+declare function buildAgentSkillsIndex(config: AgentReadyConfig): DiscoveryDocument | null;
+/** Serve a single skill's SKILL.md by request path, or null if none matches. */
+declare function buildSkillMd(requestPath: string, config: AgentReadyConfig): DiscoveryDocument | null;
+/** security.txt (RFC 9116), or null when not configured. */
+declare function buildSecurityTxt(config: AgentReadyConfig): DiscoveryDocument | null;
+/** The org-authored llms.txt, or null when the org hasn't set one. */
+declare function buildLlmsTxt(config: AgentReadyConfig, bundle: AgentReadinessBundle): DiscoveryDocument | null;
+/**
+ * API Catalog (RFC 9727) as a `linkset+json` document for
+ * `/.well-known/api-catalog`. Returns null when no APIs are configured.
+ */
+declare function buildApiCatalog(config: AgentReadyConfig): DiscoveryDocument | null;
+/**
+ * MCP Server Card (SEP-1649) for `/.well-known/mcp/server-card.json`. Returns
+ * null when no card is configured (i.e. no MCP server is running).
+ */
+declare function buildMcpServerCard(config: AgentReadyConfig): DiscoveryDocument | null;
+/**
+ * The `/auth.md` document (agent registration + authentication instructions).
+ * Uses `config.authMd` verbatim when provided; otherwise generates one from the
+ * OAuth authorization-server metadata + site config. Returns null only when
+ * there is nothing to describe (no authorizationServer and no override).
+ */
+declare function buildAuthMd(config: AgentReadyConfig, bundle: AgentReadinessBundle): DiscoveryDocument | null;
+/**
+ * Resolve any `.well-known` request path to its discovery document, or null if
+ * this app serves nothing there (caller should 404).
+ *
+ * Handles: agent.json, oauth-protected-resource (+ per-resource paths),
+ * oauth-authorization-server (pointer), agent-skills index + SKILL.md,
+ * security.txt, api-catalog (RFC 9727), and the MCP server card.
+ *
+ * Root-level docs are served via their own builders (they aren't under
+ * `.well-known`): `buildLlmsTxt` for `/llms.txt` and `buildAuthMd` for `/auth.md`.
+ */
+declare function resolveWellKnown(requestPath: string, config: AgentReadyConfig): Promise<DiscoveryDocument | null>;
+/** A WebMCP tool definition exposed to in-page agents via `navigator.modelContext`. */
+interface WebMcpTool {
+    name: string;
+    description: string;
+    /** JSON Schema for the tool's input. */
+    inputSchema: Record<string, unknown>;
+    /** Called when an agent invokes the tool. */
+    execute: (input: any) => unknown | Promise<unknown>;
+}
+/**
+ * Register WebMCP tools with the browser so in-page AI agents can invoke your
+ * site's actions (WebMCP `navigator.modelContext.provideContext`). Client-side
+ * only — a no-op returning `false` when the API is unavailable, so it's safe to
+ * call unconditionally in a browser effect.
+ */
+declare function provideWebMcpTools(tools: WebMcpTool[]): boolean;
+
+/**
+ * OAuth2 app-bridge toolkit (server-side).
+ *
+ * BuildBase runs the OAuth2 authorization flow (login, consent, code, PKCE,
+ * refresh rotation) but it never mints the access token itself — on the token
+ * grant it calls the org's own backend to mint the token the agent will carry.
+ * Concretely, the platform makes signed webhook-style calls to two endpoints an
+ * OAuth2 client registers:
+ *
+ *   • applicationTokenUrl   — mint an access token for a user (required)
+ *   • applicationRevokeUrl  — invalidate a user's token on revocation (optional)
+ *
+ * Both requests carry an `Authorization: Bearer <JWT>` where the JWT is HS256,
+ * signed with the client's secret (so possession of the secret authenticates
+ * the platform). This module verifies those requests and shapes the responses,
+ * so an implementor writes only the part that is theirs: minting/invalidating a
+ * token in their own format.
+ *
+ * HMAC verification uses the SDK's dependency-free pure-JS HMAC-SHA256 (no Web
+ * Crypto, no Node `crypto`, no `require`), so it behaves identically whether the
+ * bundle is loaded as ESM or CJS, under a bundler or on bare Node.
+ *
+ * @example applicationTokenUrl handler (Next.js Pages Router):
+ * ```ts
+ * import { handleAppTokenRequest } from "@buildbase/sdk";
+ * export default async function handler(req, res) {
+ *   const { status, body } = await handleAppTokenRequest({
+ *     authorization: req.headers.authorization,
+ *     clientSecret: process.env.BUILDBASE_CLIENT_SECRET!,
+ *     mintToken: (user) => ({
+ *       token: signMyAccessToken(user, { aud: user.resource }), // your token, your format
+ *       expiresIn: 3600,
+ *     }),
+ *   });
+ *   res.status(status).json(body);
+ * }
+ * ```
+ */
+/** Thrown when an incoming platform request fails verification. */
+declare class AppBridgeError extends Error {
+    /** Machine-readable reason, e.g. `invalid_signature`, `token_expired`. */
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * The user + grant context BuildBase sends to `applicationTokenUrl`. The app
+ * mints a token for this user; `resource` is the RFC 8707 audience(s) the token
+ * should be bound to (stamp them as `aud`), and `scope` is what the user granted.
+ * Unknown claims are preserved for forward-compatibility.
+ */
+interface AppTokenRequestClaims {
+    /** The user's id in the org. */
+    id: string;
+    email: string;
+    name?: string;
+    role?: string;
+    emailVerified?: boolean;
+    image?: string;
+    blocked?: boolean;
+    blockedReason?: string;
+    blockedAt?: string;
+    /** Which grant triggered this mint. */
+    grantType?: 'authorization_code' | 'refresh_token';
+    /** Scopes granted at authorization time. */
+    scope?: string[];
+    /** RFC 8707 resource indicator(s) — bind the minted token's `aud` to these. */
+    resource?: string[];
+    /** The OAuth2 client's display title. */
+    clientTitle?: string;
+    [claim: string]: unknown;
+}
+/** The payload BuildBase sends to `applicationRevokeUrl`. */
+interface AppRevokeRequestClaims {
+    userId: string;
+    clientId: string;
+    reason: string;
+    [claim: string]: unknown;
+}
+/**
+ * Verify a BuildBase-issued HS256 JWT (signed with the client secret) and return
+ * its payload. Checks the signature (timing-safe), the algorithm, and `exp`/`nbf`.
+ * Throws {@link AppBridgeError} on any failure.
+ */
+declare function verifyClientJwt(token: string, clientSecret: string, clockToleranceSec?: number): Record<string, any>;
+/** Extract the token from an `Authorization: Bearer <token>` header. */
+declare function extractBearerToken(authorization: string | null | undefined): string | null;
+interface VerifyOptions {
+    /** The `Authorization` header value from the incoming request. */
+    authorization: string | null | undefined;
+    /** Your OAuth2 client's secret (the signing key). */
+    clientSecret: string;
+    /** Allowed clock skew in seconds for exp/nbf. Default 60. */
+    clockToleranceSec?: number;
+}
+/** Verify an `applicationTokenUrl` request and return the user + grant context. */
+declare function verifyAppTokenRequest(options: VerifyOptions): AppTokenRequestClaims;
+/** Verify an `applicationRevokeUrl` request and return the revocation context. */
+declare function verifyAppRevokeRequest(options: VerifyOptions): AppRevokeRequestClaims;
+/** What your `mintToken` returns: an access token and, ideally, its lifetime. */
+interface AppTokenResult {
+    /** The access token your app minted (its own format). */
+    token: string;
+    /** Token lifetime in seconds; the platform surfaces it as `expires_in`. */
+    expiresIn?: number;
+    /** Optional human-readable message. */
+    message?: string;
+}
+/**
+ * The exact body shape the platform expects from `applicationTokenUrl`
+ * (`{ success, token, message }`, plus optional `expiresIn`; no other keys).
+ */
+interface AppTokenResponseBody {
+    success: boolean;
+    token: string;
+    message: string;
+    expiresIn?: number;
+}
+/** Build a success body for `applicationTokenUrl`. */
+declare function appTokenSuccess(result: AppTokenResult): AppTokenResponseBody;
+/** Build a failure body for `applicationTokenUrl`. */
+declare function appTokenFailure(message: string): AppTokenResponseBody;
+/** The `{ status, body }` a framework-agnostic handler returns. */
+interface HandlerResult<T> {
+    status: number;
+    body: T;
+}
+/**
+ * Verify an `applicationTokenUrl` request, mint via your callback, and return
+ * the exact response the platform expects. Returns 401 with a failure body when
+ * verification fails; errors thrown by `mintToken` propagate to you.
+ *
+ * @example
+ * ```ts
+ * const { status, body } = await handleAppTokenRequest({
+ *   authorization: req.headers.authorization,
+ *   clientSecret: process.env.BUILDBASE_CLIENT_SECRET!,
+ *   mintToken: (user) => ({ token: signMyJwt(user, { aud: user.resource }), expiresIn: 3600 }),
+ * });
+ * res.status(status).json(body);
+ * ```
+ */
+declare function handleAppTokenRequest(options: {
+    authorization: string | null | undefined;
+    clientSecret: string;
+    mintToken: (claims: AppTokenRequestClaims) => AppTokenResult | Promise<AppTokenResult>;
+    clockToleranceSec?: number;
+}): Promise<HandlerResult<AppTokenResponseBody>>;
+/**
+ * Verify an `applicationRevokeUrl` request and run your invalidation callback.
+ * Returns 401 on verification failure; errors thrown by `onRevoke` propagate.
+ */
+declare function handleAppRevokeRequest(options: {
+    authorization: string | null | undefined;
+    clientSecret: string;
+    onRevoke: (claims: AppRevokeRequestClaims) => void | Promise<void>;
+    clockToleranceSec?: number;
+}): Promise<HandlerResult<{
+    success: boolean;
+    message?: string;
+}>>;
+/**
+ * Build the 401 an agent should receive when it calls your protected API without
+ * a valid token. The `WWW-Authenticate: Bearer resource_metadata=...` header
+ * points the agent at your `/.well-known/oauth-protected-resource` document,
+ * bootstrapping the OAuth discovery flow (RFC 9728 §5.1, RFC 6750 §3).
+ *
+ * @example
+ * ```ts
+ * if (!isValid(token)) {
+ *   const c = bearerChallenge({ resourceMetadataUrl: "https://imejis.io/.well-known/oauth-protected-resource" });
+ *   res.writeHead(c.status, c.headers).end(c.body);
+ * }
+ * ```
+ */
+declare function bearerChallenge(options: {
+    resourceMetadataUrl: string;
+    error?: 'invalid_token' | 'insufficient_scope' | string;
+    errorDescription?: string;
+}): {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+};
+
 interface BuildBaseConfig {
     /** Base URL of the BuildBase API server */
     serverUrl: string;
@@ -2569,5 +3034,5 @@ interface BuildBaseResult extends ScopedActions {
 }
 declare function BuildBase(config: BuildBaseConfig): BuildBaseResult;
 
-export { ApiVersion, AuthApi, AuthStatus, BBAction, BBScreen, BBStatus, BB_PARAM, BaseApi, BetaForm, BillingIntervals, BuildBase, CURRENCY_DISPLAY, CURRENCY_FLAG, CreditBucketSource, CreditBucketStatus, CreditTransactionType, DEFAULT_ROLE_PERMISSIONS, DunningState, EventEmitter, InvoiceStatuses, PLAN_CURRENCY_CODES, PLAN_CURRENCY_OPTIONS, PUSH_SERVICE_WORKER_SCRIPT, Permission, PushApi, SDKEvent, SettingsApi, SubscriptionItemType, SubscriptionStatus, UserApi, WorkspaceApi, calculateBillableSeats, calculateSeatOverageCents, calculateTotalSubscriptionCents, cleanBBParams, clearAuthIntent, consumeAuthIntent, createBBUrl, createCheckoutRedirectUrls, createCreditPurchaseRedirectUrls, BuildBase as default, eventEmitter, formatCents, formatOverageRate, formatOverageRateWithLabel, formatQuotaIncludedOverage, formatQuotaWithPrice, getAvailableCurrenciesFromPlans, getBasePriceCents, getBillingIntervalAndCurrencyFromPriceId, getCurrencyFlag, getCurrencySymbol, getDisplayCurrency, getPerSeatPriceCents, getPricingVariant, getQuotaDisplayValue, getQuotaDisplayWithVariant, getQuotaOverageCents, getQuotaUnitLabelFromName, getSeatPricing, getStripePriceIdForInterval, hasPermission, invalidateCreditBalance, invalidateQuotaUsage, invalidateSubscription, parseWebhookEvent, readBBParams, resolveMaxUsers, resolvePermissions, safeRedirect, saveAuthIntent, validateInvite, validateRedirectUrl, verifyWebhookSignature };
-export type { BBActionType, BBScreenType, BBStatusType, BetaFormData, BetaFormResponse, BillingInterval, BuildBaseConfig, BuildBaseResult, BuildBaseSession, CheckoutResult, CreditActions, CreditBucketSourceType, CreditBucketStatusType, CreditTransactionTypeValue, DunningStateType, EventData, EventType, FeatureActions, FormatQuotaWithPriceOptions, GetCheckoutStripeParams, IAllQuotaUsageResponse, IBaseApiConfig, IBasePricing, IBetaConfig, ICheckoutSessionRequest, ICheckoutSessionResponse, ICheckoutStripeOptions, IConsumeCreditsRequest, IConsumeCreditsResponse, ICreditBalance, ICreditBucket, ICreditBucketsQuery, ICreditBucketsResponse, ICreditPackage, ICreditPackagePricingVariant, ICreditPurchaseRequest, ICreditPurchaseResponse, ICreditTransaction, ICreditTransactionsQuery, ICreditTransactionsResponse, IEventCallbacks, IExpiringCreditsResponse, IInvoice, IInvoiceListResponse, IInvoiceResponse, IOsConfig, IOsState, IPlan, IPlanGroup, IPlanGroupInfo, IPlanGroupLatestVersion, IPlanGroupResponse, IPlanGroupVersion, IPlanGroupVersionWithPlans, IPlanGroupVersionsResponse, IPlanVersion, IPlanVersionSummary, IPlanVersionWithPlan, IPricingVariant, IPublicCreditPackage, IPublicCreditPackagesResponse, IPublicPlanItem, IPublicPlanItemCategory, IPublicPlanVersion, IPublicPlansResponse, IQuotaByInterval, IQuotaIntervalValue, IQuotaOveragePriceIdsByInterval, IQuotaOveragesByInterval, IQuotaUsageStatus, IQuotaUsageStatusResponse, IRecordUsageRequest, IRecordUsageResponse, IStripePricesByInterval, ISubscription, ISubscriptionItem, ISubscriptionResponse, ISubscriptionUpdateRequest, ISubscriptionUpdateResponse, IUsageLogEntry, IUsageLogsQuery, IUsageLogsResponse, InviteBlockReason, InviteValidation, InvoiceActions, InvoiceStatus, InvoiceStatusType, MaxUsersConfig, NotificationData, NotificationEvent, NotificationResult, OnWorkspaceChangeParams, PermissionActions, PermissionContext, PermissionKey, PlanActions, PlanVersionWithPricingVariants, QuotaDisplayValue, QuotaDisplayWithOverage, RolePermissionMap, ScopedActions, SettingsActions, SubscriptionActions, SubscriptionItemTypeValue, SubscriptionStatusType, UsageActions, UserActions, UserCreatedEventData, UserUpdatedEventData, WorkspaceActions, WorkspaceChangedEventData, WorkspaceCreatedEventData, WorkspaceDeletedEventData, WorkspaceUpdatedEventData, WorkspaceUserAddedEventData, WorkspaceUserRemovedEventData, WorkspaceUserRoleChangedEventData };
+export { ApiVersion, AppBridgeError, AuthApi, AuthStatus, BBAction, BBScreen, BBStatus, BB_PARAM, BaseApi, BetaForm, BillingIntervals, BuildBase, CURRENCY_DISPLAY, CURRENCY_FLAG, CreditBucketSource, CreditBucketStatus, CreditTransactionType, DEFAULT_ROLE_PERMISSIONS, DunningState, EventEmitter, InvoiceStatuses, PLAN_CURRENCY_CODES, PLAN_CURRENCY_OPTIONS, PUSH_SERVICE_WORKER_SCRIPT, Permission, PushApi, SDKEvent, SettingsApi, SubscriptionItemType, SubscriptionStatus, UserApi, WorkspaceApi, appTokenFailure, appTokenSuccess, bearerChallenge, buildAgentCard, buildAgentSkillsIndex, buildApiCatalog, buildAuthMd, buildLlmsTxt, buildMcpServerCard, buildProtectedResourceMetadata, buildSecurityTxt, buildSkillMd, calculateBillableSeats, calculateSeatOverageCents, calculateTotalSubscriptionCents, cleanBBParams, clearAgentReadinessCache, clearAuthIntent, consumeAuthIntent, createBBUrl, createCheckoutRedirectUrls, createCreditPurchaseRedirectUrls, BuildBase as default, eventEmitter, extractBearerToken, fetchAgentReadiness, formatCents, formatOverageRate, formatOverageRateWithLabel, formatQuotaIncludedOverage, formatQuotaWithPrice, getAvailableCurrenciesFromPlans, getBasePriceCents, getBillingIntervalAndCurrencyFromPriceId, getCurrencyFlag, getCurrencySymbol, getDisplayCurrency, getPerSeatPriceCents, getPricingVariant, getQuotaDisplayValue, getQuotaDisplayWithVariant, getQuotaOverageCents, getQuotaUnitLabelFromName, getSeatPricing, getStripePriceIdForInterval, handleAppRevokeRequest, handleAppTokenRequest, hasPermission, invalidateCreditBalance, invalidateQuotaUsage, invalidateSubscription, parseWebhookEvent, provideWebMcpTools, readBBParams, resolveMaxUsers, resolvePermissions, resolveWellKnown, safeRedirect, saveAuthIntent, sha256Digest, validateInvite, validateRedirectUrl, verifyAppRevokeRequest, verifyAppTokenRequest, verifyClientJwt, verifyWebhookSignature };
+export type { AgentReadinessBundle, AgentReadyConfig, AgentSkill, ApiCatalogApi, AppRevokeRequestClaims, AppTokenRequestClaims, AppTokenResponseBody, AppTokenResult, BBActionType, BBScreenType, BBStatusType, BetaFormData, BetaFormResponse, BillingInterval, BuildBaseConfig, BuildBaseResult, BuildBaseSession, CheckoutResult, CreditActions, CreditBucketSourceType, CreditBucketStatusType, CreditTransactionTypeValue, DiscoveryDocument, DunningStateType, EventData, EventType, FeatureActions, FormatQuotaWithPriceOptions, GetCheckoutStripeParams, HandlerResult, IAllQuotaUsageResponse, IBaseApiConfig, IBasePricing, IBetaConfig, ICheckoutSessionRequest, ICheckoutSessionResponse, ICheckoutStripeOptions, IConsumeCreditsRequest, IConsumeCreditsResponse, ICreditBalance, ICreditBucket, ICreditBucketsQuery, ICreditBucketsResponse, ICreditPackage, ICreditPackagePricingVariant, ICreditPurchaseRequest, ICreditPurchaseResponse, ICreditTransaction, ICreditTransactionsQuery, ICreditTransactionsResponse, IEventCallbacks, IExpiringCreditsResponse, IInvoice, IInvoiceListResponse, IInvoiceResponse, IOsConfig, IOsState, IPlan, IPlanGroup, IPlanGroupInfo, IPlanGroupLatestVersion, IPlanGroupResponse, IPlanGroupVersion, IPlanGroupVersionWithPlans, IPlanGroupVersionsResponse, IPlanVersion, IPlanVersionSummary, IPlanVersionWithPlan, IPricingVariant, IPublicCreditPackage, IPublicCreditPackagesResponse, IPublicPlanItem, IPublicPlanItemCategory, IPublicPlanVersion, IPublicPlansResponse, IQuotaByInterval, IQuotaIntervalValue, IQuotaOveragePriceIdsByInterval, IQuotaOveragesByInterval, IQuotaUsageStatus, IQuotaUsageStatusResponse, IRecordUsageRequest, IRecordUsageResponse, IStripePricesByInterval, ISubscription, ISubscriptionItem, ISubscriptionResponse, ISubscriptionUpdateRequest, ISubscriptionUpdateResponse, IUsageLogEntry, IUsageLogsQuery, IUsageLogsResponse, InviteBlockReason, InviteValidation, InvoiceActions, InvoiceStatus, InvoiceStatusType, MaxUsersConfig, McpServerCard, NotificationData, NotificationEvent, NotificationResult, OnWorkspaceChangeParams, PermissionActions, PermissionContext, PermissionKey, PlanActions, PlanVersionWithPricingVariants, QuotaDisplayValue, QuotaDisplayWithOverage, RolePermissionMap, ScopedActions, SettingsActions, SubscriptionActions, SubscriptionItemTypeValue, SubscriptionStatusType, UsageActions, UserActions, UserCreatedEventData, UserUpdatedEventData, WebMcpTool, WorkspaceActions, WorkspaceChangedEventData, WorkspaceCreatedEventData, WorkspaceDeletedEventData, WorkspaceUpdatedEventData, WorkspaceUserAddedEventData, WorkspaceUserRemovedEventData, WorkspaceUserRoleChangedEventData };