@collective-intelligence/external-apps-client-sdk 0.0.0-stage → 0.1.1

package/dist/index.js

@@ -0,0 +1,725 @@
+import { a as parseMountPath, c as isClientOperationId, i as createHttpOperationTransport, n as createResourceClient, o as parseOriginUrl, r as createEntityProtocol, s as clientOperationIds, t as createEntityHttpTransport } from "./resources-BYm1KWAZ.js";
+const base64Url = (bytes) => {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+};
+const createOauthRandomValue = (crypto = globalThis.crypto) => base64Url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
+const createPkcePair = async (crypto = globalThis.crypto) => {
+	const verifier = createOauthRandomValue(crypto);
+	const challengeBytes = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
+	return {
+		challenge: base64Url(challengeBytes),
+		method: "S256",
+		verifier
+	};
+};
+var FederatedAuthError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "FederatedAuthError";
+		this.code = code;
+	}
+};
+const transactionLifetimeMs = 6e5;
+const maxReturnTargetLength = 2048;
+const asUrl = (value, field) => {
+	try {
+		const url = new URL(value);
+		if (url.username !== "" || url.password !== "") throw new Error("credentials");
+		return url;
+	} catch {
+		throw new FederatedAuthError("configuration_error", `${field} must be an absolute URL without credentials`);
+	}
+};
+const tenantOrigin = (value) => {
+	const url = asUrl(value, "tenantUrl");
+	if (url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new FederatedAuthError("configuration_error", "tenantUrl must contain only the tenant origin");
+	return url.origin;
+};
+const normalizedReturnTarget = (value, applicationOrigin) => {
+	if (value.length > maxReturnTargetLength) throw new FederatedAuthError("invalid_return_target", "The return target is too long");
+	const target = new URL(value, applicationOrigin);
+	if (target.origin !== applicationOrigin) throw new FederatedAuthError("invalid_return_target", "The return target must share the callback origin");
+	return target.href;
+};
+const isRecord = (value) => value !== null && Object(value) === value && !Array.isArray(value);
+const parseTransaction = (serialized) => {
+	const value = JSON.parse(serialized);
+	if (!isRecord(value) || typeof value.expiresAt !== "number" || typeof value.returnTo !== "string" || typeof value.state !== "string" || typeof value.verifier !== "string") throw new FederatedAuthError("invalid_state", "Invalid login transaction");
+	return {
+		expiresAt: value.expiresAt,
+		returnTo: value.returnTo,
+		state: value.state,
+		verifier: value.verifier
+	};
+};
+const parseToken = (value, now) => {
+	const accessToken = value.access_token;
+	const expiresIn = value.expires_in;
+	if (typeof accessToken !== "string" || accessToken.length === 0 || typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0 || value.token_type !== "Bearer") throw new FederatedAuthError("token_exchange_failed", "The authorization server returned an invalid token");
+	return {
+		accessToken,
+		expiresAt: now + expiresIn * 1e3
+	};
+};
+const createFederatedAuth = (options) => {
+	const tenantUrl = tenantOrigin(options.tenantUrl);
+	const redirectUri = asUrl(options.redirectUri, "redirectUri");
+	const crypto = options.crypto ?? globalThis.crypto;
+	const fetch = options.fetch ?? globalThis.fetch;
+	const now = options.now ?? Date.now;
+	const storage = options.sessionStorage ?? globalThis.sessionStorage;
+	const navigate = options.navigate ?? ((url) => {
+		const { location } = globalThis;
+		if (!location || !("assign" in location) || typeof location.assign !== "function") throw new FederatedAuthError("configuration_error", "Provide navigate when browser navigation is unavailable");
+		location.assign(url);
+	});
+	const storageKey = `ci:federated-auth:${redirectUri.origin}:${options.clientId}`;
+	const listeners = /* @__PURE__ */ new Set();
+	let state = { status: "anonymous" };
+	let token;
+	let completion;
+	let rememberedReturnTo;
+	if (options.clientId.length === 0 || options.scopes.length === 0) throw new FederatedAuthError("configuration_error", "clientId and at least one scope are required");
+	if (crypto === void 0 || storage === void 0 || fetch === void 0) throw new FederatedAuthError("configuration_error", "Browser crypto, fetch, and sessionStorage are required");
+	const transition = (next) => {
+		state = next;
+		for (const listener of listeners) listener(next);
+	};
+	const fail = (error) => {
+		token = void 0;
+		transition({
+			error,
+			status: "error"
+		});
+		throw error;
+	};
+	const beginLogin = async ({ returnTo }) => {
+		const normalizedReturnTo = normalizedReturnTarget(returnTo, redirectUri.origin);
+		rememberedReturnTo = normalizedReturnTo;
+		const pkce = await createPkcePair(crypto);
+		const transaction = {
+			expiresAt: now() + transactionLifetimeMs,
+			returnTo: normalizedReturnTo,
+			state: createOauthRandomValue(crypto),
+			verifier: pkce.verifier
+		};
+		storage.setItem(storageKey, JSON.stringify(transaction));
+		const authorizationUrl = new URL("/oauth/authorize", tenantUrl);
+		authorizationUrl.searchParams.set("client_id", options.clientId);
+		authorizationUrl.searchParams.set("redirect_uri", redirectUri.href);
+		authorizationUrl.searchParams.set("response_type", "code");
+		authorizationUrl.searchParams.set("scope", options.scopes.join(" "));
+		authorizationUrl.searchParams.set("state", transaction.state);
+		authorizationUrl.searchParams.set("code_challenge", pkce.challenge);
+		authorizationUrl.searchParams.set("code_challenge_method", pkce.method);
+		token = void 0;
+		completion = void 0;
+		transition({ status: "redirecting" });
+		navigate(authorizationUrl.href);
+		return authorizationUrl.href;
+	};
+	const complete = async (callbackUrl) => {
+		let callback;
+		try {
+			callback = asUrl(callbackUrl, "callbackUrl");
+		} catch {
+			storage.removeItem(storageKey);
+			return fail(new FederatedAuthError("invalid_callback", "The callback URL is invalid"));
+		}
+		if (callback.origin !== redirectUri.origin || callback.pathname !== redirectUri.pathname) {
+			storage.removeItem(storageKey);
+			return fail(new FederatedAuthError("invalid_callback", "The callback URL does not match redirectUri"));
+		}
+		const serialized = storage.getItem(storageKey);
+		storage.removeItem(storageKey);
+		if (serialized === null) return fail(new FederatedAuthError("invalid_state", "No login transaction exists"));
+		let transaction;
+		try {
+			transaction = parseTransaction(serialized);
+		} catch (error) {
+			return fail(error instanceof FederatedAuthError ? error : new FederatedAuthError("invalid_state", "Invalid login transaction"));
+		}
+		if (transaction.expiresAt <= now()) return fail(new FederatedAuthError("transaction_expired", "The login transaction expired"));
+		if (callback.searchParams.get("state") !== transaction.state) return fail(new FederatedAuthError("invalid_state", "OAuth state mismatch"));
+		const authorizationError = callback.searchParams.get("error");
+		const code = callback.searchParams.get("code");
+		if (authorizationError !== null || code === null || code.length === 0) return fail(new FederatedAuthError("authorization_failed", authorizationError ?? "The callback did not include a code"));
+		const body = new URLSearchParams({
+			client_id: options.clientId,
+			code,
+			code_verifier: transaction.verifier,
+			grant_type: "authorization_code",
+			redirect_uri: redirectUri.href
+		});
+		const response = await fetch(new URL("/oauth/token", tenantUrl), {
+			body,
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			method: "POST"
+		});
+		if (!response.ok) return fail(new FederatedAuthError("token_exchange_failed", "The authorization code exchange failed"));
+		try {
+			const tokenResponse = await response.json();
+			if (!(tokenResponse instanceof Object)) throw new FederatedAuthError("token_exchange_failed", "The authorization server returned an invalid token");
+			const payload = {
+				access_token: Object.entries(tokenResponse).find(([key]) => key === "access_token")?.[1],
+				expires_in: Object.entries(tokenResponse).find(([key]) => key === "expires_in")?.[1],
+				token_type: Object.entries(tokenResponse).find(([key]) => key === "token_type")?.[1]
+			};
+			token = parseToken(payload, now());
+		} catch (error) {
+			return fail(error instanceof FederatedAuthError ? error : new FederatedAuthError("token_exchange_failed", "The authorization server returned an invalid token"));
+		}
+		transition({
+			expiresAt: token.expiresAt,
+			status: "authenticated"
+		});
+		rememberedReturnTo = transaction.returnTo;
+		return { returnTo: transaction.returnTo };
+	};
+	const reauthorize = async (input) => {
+		const returnTo = input?.returnTo ?? rememberedReturnTo;
+		if (returnTo === void 0) throw new FederatedAuthError("reauthorization_required", "A same-origin return target is required to restart CI login");
+		return await beginLogin({ returnTo });
+	};
+	return {
+		beginLogin,
+		completeLogin: async (callbackUrl) => {
+			if (completion !== void 0) return await completion;
+			const current = complete(callbackUrl);
+			completion = current;
+			const retire = async () => {
+				try {
+					await current;
+				} catch {} finally {
+					if (completion === current) completion = void 0;
+				}
+			};
+			retire();
+			return await current;
+		},
+		getAccessToken: async () => {
+			if (token !== void 0 && token.expiresAt <= now()) {
+				token = void 0;
+				transition({ status: "expired" });
+				await reauthorize();
+				throw new FederatedAuthError("reauthorization_required", "A new CI login is required");
+			}
+			if (token === void 0) throw new FederatedAuthError("reauthorization_required", "A new CI login is required");
+			return token.accessToken;
+		},
+		getState: () => state,
+		logout: async () => {
+			const accessToken = token?.accessToken;
+			token = void 0;
+			completion = void 0;
+			rememberedReturnTo = void 0;
+			storage.removeItem(storageKey);
+			transition({ status: "anonymous" });
+			if (accessToken !== void 0) try {
+				await fetch(new URL("/oauth/logout", tenantUrl), {
+					headers: { authorization: `Bearer ${accessToken}` },
+					method: "POST"
+				});
+			} catch {}
+		},
+		reauthorize,
+		subscribe: (listener) => {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		}
+	};
+};
+const parseExpiresAt = (value) => {
+	if (typeof value === "string") {
+		const parsed = Date.parse(value);
+		return Number.isFinite(parsed) ? parsed : null;
+	}
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	return null;
+};
+const asRecord$2 = (value) => {
+	if (typeof value !== "object" || value === null) return null;
+	return value;
+};
+const readString$1 = (record, key) => {
+	const candidate = record[key];
+	return typeof candidate === "string" ? candidate : null;
+};
+const parseIdentity = (value) => {
+	const payload = asRecord$2(value);
+	if (payload === null) return null;
+	const nested = asRecord$2(payload.identity) ?? payload;
+	const id = readString$1(nested, "id");
+	const organizationId = readString$1(nested, "organizationId") ?? readString$1(payload, "organizationId");
+	if (id === null || organizationId === null) return null;
+	return {
+		email: readString$1(nested, "email"),
+		id,
+		name: readString$1(nested, "name"),
+		organizationId
+	};
+};
+/** Browser session client for a sealed-cookie BFF. The access token never leaves the server. */
+const createServerSessionAuth = (options) => {
+	const { basePath } = options;
+	if (!/^\/[\w/-]+$/u.test(basePath) || basePath.endsWith("/")) throw new FederatedAuthError("configuration_error", "basePath must be an absolute path without a trailing slash");
+	const fetch = options.fetch ?? globalThis.fetch;
+	const origin = options.origin ?? "";
+	const now = options.now ?? Date.now;
+	const navigate = options.navigate ?? ((url) => {
+		const { location } = globalThis;
+		if (!location || !("assign" in location) || typeof location.assign !== "function") throw new FederatedAuthError("configuration_error", "Provide navigate when browser navigation is unavailable");
+		location.assign(url);
+	});
+	const listeners = /* @__PURE__ */ new Set();
+	let state = { status: "anonymous" };
+	let rememberedReturnTo;
+	let completion;
+	const transition = (next) => {
+		state = next;
+		for (const listener of listeners) listener(next);
+	};
+	const refresh = async () => {
+		const response = await fetch(`${origin}${basePath}/session`, {
+			credentials: "same-origin",
+			headers: { accept: "application/json" }
+		});
+		if (response.status === 401) {
+			transition({ status: "anonymous" });
+			return state;
+		}
+		if (!response.ok) {
+			const error = new FederatedAuthError("authorization_failed", "The application session could not be read");
+			transition({
+				error,
+				status: "error"
+			});
+			return state;
+		}
+		const payload = await response.json();
+		const record = asRecord$2(payload);
+		const expiresAt = record === null ? null : parseExpiresAt(record.expiresAt);
+		const identity = parseIdentity(payload);
+		if (expiresAt === null || identity === null) {
+			const error = new FederatedAuthError("authorization_failed", "The application session is invalid");
+			transition({
+				error,
+				status: "error"
+			});
+			return state;
+		}
+		if (expiresAt <= now()) {
+			transition({ status: "expired" });
+			return state;
+		}
+		transition({
+			expiresAt,
+			identity,
+			status: "authenticated"
+		});
+		return state;
+	};
+	const beginLogin = ({ returnTo }) => {
+		rememberedReturnTo = returnTo;
+		const url = `${origin}${basePath}/login?returnTo=${encodeURIComponent(returnTo)}`;
+		transition({ status: "redirecting" });
+		navigate(url);
+		return Promise.resolve(url);
+	};
+	const complete = async () => {
+		await refresh();
+		if (state.status === "error") throw state.error;
+		return { returnTo: rememberedReturnTo ?? "/" };
+	};
+	const reauthorize = async (input) => {
+		const returnTo = input?.returnTo ?? rememberedReturnTo;
+		if (returnTo === void 0) throw new FederatedAuthError("reauthorization_required", "A same-origin return target is required to restart CI login");
+		return await beginLogin({ returnTo });
+	};
+	return {
+		beginLogin,
+		completeLogin: async () => {
+			if (completion !== void 0) return await completion;
+			const current = complete();
+			completion = current;
+			const retire = async () => {
+				try {
+					await current;
+				} catch {} finally {
+					if (completion === current) completion = void 0;
+				}
+			};
+			retire();
+			return await current;
+		},
+		getAccessToken: () => Promise.reject(new FederatedAuthError("reauthorization_required", "The CI access token stays on the application server")),
+		getState: () => state,
+		logout: async () => {
+			rememberedReturnTo = void 0;
+			completion = void 0;
+			try {
+				await fetch(`${origin}${basePath}/logout`, {
+					credentials: "same-origin",
+					method: "POST"
+				});
+			} catch {}
+			transition({ status: "anonymous" });
+		},
+		reauthorize,
+		subscribe: (listener) => {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		}
+	};
+};
+/**
+* Ten minutes: a skill run's five-minute AI deadline plus queueing and
+* delivery slack. Long runs return a `runId` immediately; follow is how
+* callers wait for their outcome.
+*/
+const DEFAULT_FOLLOW_RUN_DEADLINE_MS = 6e5;
+const DEFAULT_IDLE_MS = 50;
+const MAX_BACKOFF_IDLE_MS = 1e3;
+const terminalEventKinds = /* @__PURE__ */ new Set([
+	"cancelled",
+	"completed",
+	"failed"
+]);
+const terminalSnapshotStatuses = /* @__PURE__ */ new Set([
+	"cancelled",
+	"failed",
+	"succeeded"
+]);
+const asRecord$1 = (value) => {
+	if (typeof value !== "object" || value === null) return null;
+	return value;
+};
+const readString = (record, key) => {
+	const candidate = record[key];
+	return typeof candidate === "string" ? candidate : null;
+};
+const snapshotStatus = (value) => {
+	const record = asRecord$1(value);
+	if (record === null) return null;
+	const nested = asRecord$1(record.result);
+	return readString(record, "status") ?? (nested === null ? null : readString(nested, "status"));
+};
+const eventKind = (event) => {
+	const record = asRecord$1(event);
+	return record === null ? null : readString(record, "kind");
+};
+const idle = async (ms, sleep, signal) => {
+	if (ms <= 0 || signal?.aborted === true) return;
+	if (sleep !== void 0) {
+		await sleep(ms);
+		return;
+	}
+	const cleanup = new AbortController();
+	try {
+		await new Promise((resolve) => {
+			const timeout = setTimeout(resolve, ms);
+			signal?.addEventListener("abort", () => {
+				clearTimeout(timeout);
+				resolve();
+			}, {
+				once: true,
+				signal: cleanup.signal
+			});
+		});
+	} finally {
+		cleanup.abort();
+	}
+};
+const isTerminalEvent = (event) => {
+	const kind = eventKind(event);
+	return kind !== null && terminalEventKinds.has(kind);
+};
+/**
+* Reads the pages after `page` of a run that has already finished and
+* returns the last non-empty one. Stops at the first terminal event.
+*/
+const readRemainingPages = async (runs, options, page) => {
+	let last = page;
+	while (last.nextCursor !== null && !last.events.some(isTerminalEvent)) {
+		options.signal?.throwIfAborted();
+		const next = await runs.stream({
+			afterCursor: last.nextCursor,
+			runId: options.runId
+		});
+		if (!next.ok) throw new Error(next.error.message);
+		if (next.value.events.length === 0) return last;
+		last = next.value;
+	}
+	return last;
+};
+/**
+* Follows dedicated run events until a terminal event or snapshot status.
+* Resolves with the last event page read.
+*/
+const followRun = async (runs, options) => {
+	const deadlineMs = options.deadlineMs ?? 6e5;
+	const idleMs = options.idleMs ?? DEFAULT_IDLE_MS;
+	const maxIdleMs = Math.max(idleMs, MAX_BACKOFF_IDLE_MS);
+	const now = options.now ?? Date.now;
+	const deadline = now() + deadlineMs;
+	let afterCursor;
+	let emptyPolls = 0;
+	while (now() < deadline) {
+		options.signal?.throwIfAborted();
+		const snapshot = await runs.get({ runId: options.runId });
+		if (!snapshot.ok) throw new Error(snapshot.error.message);
+		const page = await runs.stream(afterCursor === void 0 ? { runId: options.runId } : {
+			afterCursor,
+			runId: options.runId
+		});
+		if (!page.ok) throw new Error(page.error.message);
+		if (page.value.events.some(isTerminalEvent)) return page.value;
+		const status = snapshotStatus(snapshot.value);
+		if (status !== null && terminalSnapshotStatuses.has(status)) return await readRemainingPages(runs, options, page.value);
+		if (page.value.nextCursor !== null) afterCursor = page.value.nextCursor;
+		emptyPolls = page.value.events.length === 0 ? emptyPolls + 1 : 0;
+		await idle(Math.min(idleMs * 2 ** emptyPolls, maxIdleMs), options.sleep, options.signal);
+	}
+	throw new Error("Run did not finish");
+};
+const clientSdkProtocolVersion = "v1";
+const executionOptions = (organizationId, options) => options?.signal === void 0 ? { organizationId } : {
+	organizationId,
+	signal: options.signal
+};
+const scopedOperation = (transport, organizationId, operationId) => async (input, options) => await transport.execute(operationId, input, executionOptions(organizationId, options));
+const rootOperation = (transport, operationId) => async (input, options) => {
+	const { organizationId, ...wireInput } = input;
+	return await transport.execute(operationId, wireInput, executionOptions(organizationId, options));
+};
+const domains = (transport, organizationId) => {
+	const operation = (operationId) => organizationId === void 0 ? rootOperation(transport, operationId) : scopedOperation(transport, organizationId, operationId);
+	return {
+		agents: {
+			invoke: operation("agents_invoke"),
+			list: operation("agents_list")
+		},
+		attachments: {
+			downloadUrl: operation("attachments_download_url"),
+			upload: operation("attachments_upload")
+		},
+		context: { get: operation("context_get") },
+		knowledge: {
+			autocomplete: operation("knowledge_autocomplete"),
+			createEntity: operation("knowledge_create_entity"),
+			createRelation: operation("knowledge_create_relation"),
+			deleteEntity: operation("knowledge_delete_entity"),
+			deleteRelation: operation("knowledge_delete_relation"),
+			facets: operation("knowledge_facets"),
+			getEntity: operation("knowledge_get_entity"),
+			getEntitySchemaSnapshot: operation("knowledge_get_entity_schema_snapshot"),
+			getSchemaQueryContext: operation("knowledge_get_schema_query_context"),
+			query: operation("knowledge_query"),
+			searchEntities: operation("knowledge_search_entities"),
+			traverse: operation("knowledge_traverse"),
+			updateEntity: operation("knowledge_update_entity"),
+			updateRelation: operation("knowledge_update_relation"),
+			upsertEntity: operation("knowledge_upsert_entity")
+		},
+		runs: {
+			cancel: operation("runs_cancel"),
+			follow: (async (options) => {
+				const orgId = organizationId ?? options.organizationId;
+				if (orgId === void 0 || orgId.length === 0) throw new TypeError("organizationId is required");
+				return await followRun({
+					get: (input) => transport.execute("runs_get", input, executionOptions(orgId, options)),
+					stream: (input) => transport.execute("runs_stream", input, executionOptions(orgId, options))
+				}, options);
+			}),
+			get: operation("runs_get"),
+			stream: operation("runs_stream")
+		},
+		skills: {
+			invoke: operation("skills_invoke"),
+			list: operation("skills_list")
+		},
+		workflows: {
+			invoke: operation("workflows_invoke"),
+			list: operation("workflows_list")
+		}
+	};
+};
+const createClient = (options) => {
+	const publicDomains = domains(options.transport);
+	const forOrganization = (organizationId) => {
+		if (organizationId.length === 0) throw new TypeError("organizationId is required");
+		return {
+			...domains(options.transport, organizationId),
+			organizationId
+		};
+	};
+	return {
+		...publicDomains,
+		context: {
+			...publicDomains.context,
+			forOrganization
+		},
+		execute: options.transport.execute,
+		forOrganization,
+		protocolVersion: "v1"
+	};
+};
+const createProxyTransport = (options) => {
+	const serverUrl = parseOriginUrl(options.serverUrl, "serverUrl");
+	const path = parseMountPath(options.path);
+	const { authentication } = options;
+	return createHttpOperationTransport({
+		...authentication.mode === "federated" ? { authorization: authentication.auth.getAccessToken } : { credentials: authentication.credentials ?? "same-origin" },
+		basePath: path,
+		fetch: options.fetch ?? globalThis.fetch,
+		origin: serverUrl
+	});
+};
+const mapAuthState = (state) => {
+	switch (state.status) {
+		case "authenticated":
+			if (state.identity === void 0) return {
+				message: "The application session is invalid",
+				status: "unavailable"
+			};
+			return {
+				expiresAt: new Date(state.expiresAt).toISOString(),
+				identity: state.identity,
+				status: "authenticated"
+			};
+		case "expired": return { status: "expired" };
+		case "error": return {
+			message: state.error.message,
+			status: "unavailable"
+		};
+		default: return { status: "anonymous" };
+	}
+};
+/** Browser runtime for a sealed-cookie BFF: session identity, proxy client, and run follow. */
+const createDelegatedApplicationRuntime = (options) => {
+	const fetch = options.fetch ?? globalThis.fetch;
+	const authBasePath = options.authBasePath ?? "/api/auth";
+	const proxyPath = options.proxyPath ?? "/api";
+	const sessionAuth = createServerSessionAuth({
+		basePath: authBasePath,
+		fetch,
+		...options.navigate && { navigate: options.navigate },
+		origin: options.origin
+	});
+	const client = createClient({ transport: createProxyTransport({
+		authentication: {
+			credentials: "same-origin",
+			mode: "server_delegated"
+		},
+		fetch,
+		path: proxyPath,
+		serverUrl: options.origin
+	}) });
+	let state = { status: "checking" };
+	let generation = 0;
+	const listeners = /* @__PURE__ */ new Set();
+	const publish = (next) => {
+		state = next;
+		for (const notify of listeners) notify();
+	};
+	const subscribe = (notify) => {
+		listeners.add(notify);
+		return () => {
+			listeners.delete(notify);
+		};
+	};
+	const refresh = async () => {
+		generation += 1;
+		const current = generation;
+		publish({ status: "checking" });
+		try {
+			await sessionAuth.completeLogin(`${options.origin}${authBasePath}/callback`);
+			if (current !== generation) return;
+			publish(mapAuthState(sessionAuth.getState()));
+		} catch (error) {
+			if (current === generation) publish({
+				message: error instanceof Error ? error.message : "CI session verification is unavailable",
+				status: "unavailable"
+			});
+		}
+	};
+	const login = async (returnTo) => {
+		generation += 1;
+		publish({ status: "anonymous" });
+		await sessionAuth.beginLogin({ returnTo });
+	};
+	const initialize = async (url) => {
+		await refresh();
+		if (state.status === "authenticated") return;
+		if (state.status === "anonymous" || state.status === "expired") await login(url);
+	};
+	const logout = async () => {
+		generation += 1;
+		await sessionAuth.logout();
+		publish({ status: "anonymous" });
+	};
+	const followRun = async (runId) => {
+		if (state.status !== "authenticated") throw new Error("A CI session is required to follow a run");
+		return await client.forOrganization(state.identity.organizationId).runs.follow({ runId });
+	};
+	const auth = sessionAuth;
+	return {
+		applicationId: options.applicationId,
+		auth,
+		client,
+		followRun,
+		getSnapshot: () => state,
+		initialize,
+		login,
+		logout,
+		refresh,
+		sessionAuth,
+		subscribe
+	};
+};
+const asRecord = (value) => {
+	if (typeof value !== "object" || value === null) return null;
+	return value;
+};
+const readRunId = (value) => {
+	const payload = asRecord(value);
+	const runId = payload === null ? null : payload.runId;
+	return typeof runId === "string" ? runId : null;
+};
+/** Posts a Fixed workflow BFF route and returns the admitted run id. */
+const createFixedWorkflowClient = (options) => {
+	const fetch = options.fetch ?? globalThis.fetch;
+	return { invoke: async (input) => {
+		const response = await fetch(options.url(input), {
+			body: JSON.stringify(options.body === void 0 ? input : options.body(input)),
+			credentials: "same-origin",
+			headers: {
+				"content-type": "application/json",
+				"x-idempotency-key": crypto.randomUUID()
+			},
+			method: "POST"
+		});
+		const payload = await response.json();
+		const runId = readRunId(payload);
+		if (!response.ok || runId === null) throw new Error("Fixed workflow did not return a run id");
+		return { runId };
+	} };
+};
+const nextStreamCursor = (page) => page.nextCursor;
+const createDirectTransport = (options) => {
+	const tenantUrl = parseOriginUrl(options.tenantUrl, "tenantUrl");
+	return createHttpOperationTransport({
+		authorization: options.auth.getAccessToken,
+		basePath: "/application/v1",
+		fetch: options.fetch ?? globalThis.fetch,
+		origin: tenantUrl
+	});
+};
+export { DEFAULT_FOLLOW_RUN_DEADLINE_MS, FederatedAuthError, clientOperationIds, clientSdkProtocolVersion, createClient, createDelegatedApplicationRuntime, createDirectTransport, createEntityHttpTransport, createEntityProtocol, createFederatedAuth, createFixedWorkflowClient, createProxyTransport, createResourceClient, createServerSessionAuth, followRun, isClientOperationId, nextStreamCursor };