@craftedxp/sdk-node 0.3.0 → 0.4.0

package/dist/index.d.mts

@@ -86,15 +86,12 @@ interface Agent {
     recording?: AgentRecording;
     structuredDataSchema?: Record<string, unknown>;
     /**
-     * Free-form persona tags the consumer catalog filters on. Lowercased on
+     * End-user authorisation gate. Lists every user tag that's allowed to
+     * call this agent. Match rule is intersection: the call-token's
+     * `userTags` must contain at least one string from this list. Empty /
+     * unset means anyone with a valid `sk_` can mint a token. Lowercased on
      * save (regex `[a-zA-Z0-9_-]+`).
      */
-    tags?: string[];
-    /**
-     * End-user authorisation gate. When non-empty, the call-token mint must
-     * include `userTags` that intersect this list (else 403). Empty / unset
-     * means anyone with a valid `sk_` can mint a token for this agent.
-     */
     allowedUserTags?: string[];
     createdAt: number;
     updatedAt: number;
@@ -113,7 +110,6 @@ interface AgentCreateInput {
     knowledgeBaseId?: string;
     recording?: AgentRecording;
     structuredDataSchema?: Record<string, unknown>;
-    tags?: string[];
     allowedUserTags?: string[];
 }
 type AgentUpdateInput = Partial<AgentCreateInput>;
@@ -127,7 +123,6 @@ type AgentUpdateInput = Partial<AgentCreateInput>;
 interface CatalogAgent {
     agentId: string;
     name: string;
-    tags: string[];
     voice: {
         provider: string;
         voiceId?: string;
@@ -139,11 +134,6 @@ interface CatalogListInput {
      * server returns 403 otherwise.
      */
     orgId: string;
-    /**
-     * OR-filter on persona tags. Empty / undefined returns all agents in
-     * the org.
-     */
-    tags?: string[];
     /**
      * End-user entitlement tags. When supplied, the catalog hides agents
      * whose `allowedUserTags` doesn't intersect with these. Omit to get the
@@ -457,11 +447,12 @@ declare const createOrgsResource: (http: HttpClient) => {
      * no system prompt, tools, or KB info. Use `client.agents.get(agentId)`
      * with the same `sk_` if you need the full admin shape.
      *
-     * Filters:
-     *   - `tags`: OR-match on persona tags. Empty = all.
-     *   - `userTags`: tier gate. Hides agents whose `allowedUserTags` is
-     *     non-empty and doesn't intersect. Omit to skip the gate filter
-     *     (admin / dashboard usage).
+     * `userTags`: end-user entitlement tags. When supplied, hides agents
+     * whose `allowedUserTags` is non-empty and doesn't intersect with the
+     * supplied list. Omit to get the unfiltered admin view.
+     *
+     * Persona / category filtering is intentionally not a server param —
+     * filter the returned list client-side over `name`s if you need it.
      *
      * Throws `403 forbidden` if `orgId` doesn't match the key's org.
      */

package/dist/index.d.ts

@@ -86,15 +86,12 @@ interface Agent {
     recording?: AgentRecording;
     structuredDataSchema?: Record<string, unknown>;
     /**
-     * Free-form persona tags the consumer catalog filters on. Lowercased on
+     * End-user authorisation gate. Lists every user tag that's allowed to
+     * call this agent. Match rule is intersection: the call-token's
+     * `userTags` must contain at least one string from this list. Empty /
+     * unset means anyone with a valid `sk_` can mint a token. Lowercased on
      * save (regex `[a-zA-Z0-9_-]+`).
      */
-    tags?: string[];
-    /**
-     * End-user authorisation gate. When non-empty, the call-token mint must
-     * include `userTags` that intersect this list (else 403). Empty / unset
-     * means anyone with a valid `sk_` can mint a token for this agent.
-     */
     allowedUserTags?: string[];
     createdAt: number;
     updatedAt: number;
@@ -113,7 +110,6 @@ interface AgentCreateInput {
     knowledgeBaseId?: string;
     recording?: AgentRecording;
     structuredDataSchema?: Record<string, unknown>;
-    tags?: string[];
     allowedUserTags?: string[];
 }
 type AgentUpdateInput = Partial<AgentCreateInput>;
@@ -127,7 +123,6 @@ type AgentUpdateInput = Partial<AgentCreateInput>;
 interface CatalogAgent {
     agentId: string;
     name: string;
-    tags: string[];
     voice: {
         provider: string;
         voiceId?: string;
@@ -139,11 +134,6 @@ interface CatalogListInput {
      * server returns 403 otherwise.
      */
     orgId: string;
-    /**
-     * OR-filter on persona tags. Empty / undefined returns all agents in
-     * the org.
-     */
-    tags?: string[];
     /**
      * End-user entitlement tags. When supplied, the catalog hides agents
      * whose `allowedUserTags` doesn't intersect with these. Omit to get the
@@ -457,11 +447,12 @@ declare const createOrgsResource: (http: HttpClient) => {
      * no system prompt, tools, or KB info. Use `client.agents.get(agentId)`
      * with the same `sk_` if you need the full admin shape.
      *
-     * Filters:
-     *   - `tags`: OR-match on persona tags. Empty = all.
-     *   - `userTags`: tier gate. Hides agents whose `allowedUserTags` is
-     *     non-empty and doesn't intersect. Omit to skip the gate filter
-     *     (admin / dashboard usage).
+     * `userTags`: end-user entitlement tags. When supplied, hides agents
+     * whose `allowedUserTags` is non-empty and doesn't intersect with the
+     * supplied list. Omit to get the unfiltered admin view.
+     *
+     * Persona / category filtering is intentionally not a server param —
+     * filter the returned list client-side over `name`s if you need it.
      *
      * Throws `403 forbidden` if `orgId` doesn't match the key's org.
      */

package/dist/index.js

@@ -432,17 +432,17 @@ var createOrgsResource = (http) => ({
    * no system prompt, tools, or KB info. Use `client.agents.get(agentId)`
    * with the same `sk_` if you need the full admin shape.
    *
-   * Filters:
-   *   - `tags`: OR-match on persona tags. Empty = all.
-   *   - `userTags`: tier gate. Hides agents whose `allowedUserTags` is
-   *     non-empty and doesn't intersect. Omit to skip the gate filter
-   *     (admin / dashboard usage).
+   * `userTags`: end-user entitlement tags. When supplied, hides agents
+   * whose `allowedUserTags` is non-empty and doesn't intersect with the
+   * supplied list. Omit to get the unfiltered admin view.
+   *
+   * Persona / category filtering is intentionally not a server param —
+   * filter the returned list client-side over `name`s if you need it.
    *
    * Throws `403 forbidden` if `orgId` doesn't match the key's org.
    */
   listAgents: async (input) => {
     const query = {};
-    if (input.tags && input.tags.length > 0) query.tags = input.tags.join(",");
     if (input.userTags && input.userTags.length > 0) query.userTags = input.userTags.join(",");
     const res = await http.request({
       method: "GET",

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/http.ts","../src/resources/me.ts","../src/resources/agentWebhooks.ts","../src/resources/agents.ts","../src/resources/calls.ts","../src/resources/knowledgeBases.ts","../src/resources/credits.ts","../src/resources/callTokens.ts","../src/resources/webhooks.ts","../src/resources/orgs.ts","../src/PlatformClient.ts","../src/verify.ts"],"sourcesContent":["// Public API of @craftedxp/sdk-node.\n\nexport { PlatformClient } from './PlatformClient'\nexport type { PlatformClientOptions } from './PlatformClient'\n\n// Error class for `instanceof` checks in consumer code.\nexport { PlatformError } from './errors'\nexport type { ApiErrorCode } from './errors'\n\n// Webhook signature verification helper — standalone so frameworks\n// (Express, Koa, Next.js route handlers) can use it without instantiating\n// a PlatformClient.\nexport { verifyWebhookSignature } from './verify'\n\n// Re-export DTO types. Consumers often type their own storage models\n// against these — re-exporting avoids `import type` gymnastics.\nexport type * from './types'\n\n// Advanced: expose the resource types for consumers subclassing / wrapping\n// the client. 99% of users don't need these.\nexport type { MeResource } from './resources/me'\nexport type { AgentsResource } from './resources/agents'\nexport type { AgentWebhooksResource } from './resources/agentWebhooks'\nexport type { CallsResource } from './resources/calls'\nexport type { KnowledgeBasesResource } from './resources/knowledgeBases'\nexport type { CreditsResource } from './resources/credits'\nexport type { CallTokensResource } from './resources/callTokens'\nexport type { WebhooksResource } from './resources/webhooks'\nexport type { OrgsResource } from './resources/orgs'\n","// Typed error class mirroring the server's ErrorV1 shape:\n//   { error: { code, message, field?, docs_url? } }\n//\n// Consumers do `err instanceof PlatformError` to branch on code without\n// parsing string messages. `status` carries the HTTP code for the 1% of\n// cases where the code field isn't enough (e.g. rate-limit → retry-after\n// header correlation).\n\nexport type ApiErrorCode =\n  | 'unauthorized'\n  | 'forbidden'\n  | 'not_found'\n  | 'bad_request'\n  | 'conflict'\n  | 'rate_limited'\n  | 'payment_required'\n  | 'internal_error'\n  | 'unknown'\n\nexport class PlatformError extends Error {\n  readonly code: ApiErrorCode\n  readonly status: number\n  readonly field?: string\n  readonly docsUrl?: string\n  // The raw response body for debugging. Intentionally optional — we clear\n  // it on `error.toJSON()` so logging libraries don't dump the whole\n  // server response into production logs.\n  readonly body?: unknown\n\n  constructor(params: {\n    code: ApiErrorCode\n    message: string\n    status: number\n    field?: string\n    docsUrl?: string\n    body?: unknown\n  }) {\n    super(params.message)\n    this.name = 'PlatformError'\n    this.code = params.code\n    this.status = params.status\n    this.field = params.field\n    this.docsUrl = params.docsUrl\n    this.body = params.body\n    // Preserve the stack trace — Node's Error doesn't capture it\n    // automatically when subclassing in some older runtimes.\n    if (\n      typeof (Error as typeof Error & { captureStackTrace?: unknown }).captureStackTrace ===\n      'function'\n    ) {\n      ;(\n        Error as typeof Error & { captureStackTrace: (target: unknown, ctor: unknown) => void }\n      ).captureStackTrace(this, PlatformError)\n    }\n  }\n\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      field: this.field,\n      docsUrl: this.docsUrl,\n    }\n  }\n}\n","import { PlatformError, type ApiErrorCode } from './errors'\n\n// Low-level HTTP wrapper around `fetch` (native in Node 18+). Every resource\n// method routes through here for consistent auth + error handling + retries.\n//\n// v1 scope: JSON-in / JSON-out + multipart for file uploads. No streaming —\n// call WebSockets go through @craftedxp/voice-rn (the React Native client)\n// or a web equivalent, not this server-side SDK.\n\nexport interface HttpClientOptions {\n  apiKey: string\n  baseUrl: string\n  // Default 30s. File uploads can override per-request.\n  timeoutMs?: number\n  // 429 + 5xx retries. Defaults to 3 attempts (original + 2 retries) with\n  // exponential backoff (250ms, 1s). Set to 0 to disable.\n  maxRetries?: number\n  // Optional — lets consumers swap in a test/mock fetch (or a custom one\n  // with instrumentation). Defaults to the global.\n  fetch?: typeof fetch\n  // Optional — a callback that fires per-request with the final status and\n  // duration. Handy for dropping traces into the consumer's observability\n  // stack without wrapping each call.\n  onRequest?: (info: {\n    method: string\n    url: string\n    status: number\n    durationMs: number\n    attempt: number\n  }) => void\n}\n\nexport interface HttpRequest {\n  method: 'GET' | 'POST' | 'PATCH' | 'DELETE'\n  path: string // starts with `/`, e.g. `/v1/agents/123`\n  query?: Record<string, string | number | boolean | undefined>\n  body?: unknown // JSON-serialised — for multipart use `formData`\n  formData?: FormData\n  timeoutMs?: number\n  // Exposed for edge cases where a resource wants to tack on extra\n  // headers (we don't have any today but leave the hook).\n  headers?: Record<string, string>\n}\n\nconst DEFAULT_TIMEOUT_MS = 30_000\nconst DEFAULT_MAX_RETRIES = 2 // total attempts = 3\n\nconst buildUrl = (baseUrl: string, path: string, query?: HttpRequest['query']): string => {\n  const u = new URL(path, baseUrl)\n  if (query) {\n    for (const [k, v] of Object.entries(query)) {\n      if (v === undefined) continue\n      u.searchParams.set(k, String(v))\n    }\n  }\n  return u.toString()\n}\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\nconst isRetryable = (status: number): boolean => status === 429 || (status >= 500 && status < 600)\n\n// Parse whatever the server returned into a PlatformError. Falls back to\n// synthesising a sensible error for non-JSON responses.\nconst errorFromResponse = async (res: Response): Promise<PlatformError> => {\n  const bodyText = await res.text().catch(() => '')\n  let parsed: unknown = undefined\n  try {\n    parsed = bodyText ? JSON.parse(bodyText) : undefined\n  } catch {\n    // non-JSON response (e.g. an HTML error page from a proxy). Fall\n    // through with parsed = undefined.\n  }\n  const errObj = (\n    parsed as { error?: { code?: string; message?: string; field?: string; docs_url?: string } }\n  )?.error\n  return new PlatformError({\n    code: (errObj?.code as ApiErrorCode) ?? 'unknown',\n    message: errObj?.message ?? res.statusText ?? `HTTP ${res.status}`,\n    status: res.status,\n    field: errObj?.field,\n    docsUrl: errObj?.docs_url,\n    body: parsed ?? bodyText,\n  })\n}\n\nexport const createHttpClient = (opts: HttpClientOptions) => {\n  const fetchImpl = opts.fetch ?? globalThis.fetch\n  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS\n  const maxRetries = opts.maxRetries ?? DEFAULT_MAX_RETRIES\n\n  if (!fetchImpl) {\n    throw new Error('No global fetch available. @craftedxp/sdk-node requires Node >= 18.')\n  }\n\n  const request = async <T>(req: HttpRequest): Promise<T> => {\n    const url = buildUrl(opts.baseUrl, req.path, req.query)\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${opts.apiKey}`,\n      Accept: 'application/json',\n      ...(req.headers ?? {}),\n    }\n\n    // Body shaping: prefer formData when provided; otherwise JSON.\n    // `FormData` sets its own Content-Type with boundary — don't preempt it.\n    // Typed as `string | FormData | undefined` (a subset of the global\n    // BodyInit) so we don't need DOM lib types in this server-side SDK.\n    let body: string | FormData | undefined\n    if (req.formData) {\n      body = req.formData\n    } else if (req.body !== undefined) {\n      headers['Content-Type'] = 'application/json'\n      body = JSON.stringify(req.body)\n    }\n\n    const reqTimeout = req.timeoutMs ?? timeoutMs\n    let lastErr: unknown\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      const controller = new AbortController()\n      const timer = setTimeout(() => controller.abort(), reqTimeout)\n      const started = Date.now()\n      try {\n        const res = await fetchImpl(url, {\n          method: req.method,\n          headers,\n          body,\n          signal: controller.signal,\n        })\n        const durationMs = Date.now() - started\n        opts.onRequest?.({\n          method: req.method,\n          url,\n          status: res.status,\n          durationMs,\n          attempt: attempt + 1,\n        })\n\n        if (res.ok) {\n          // 204 No Content — some endpoints (DELETE webhooks) return nothing.\n          if (res.status === 204) return undefined as T\n          const ct = res.headers.get('content-type') ?? ''\n          if (ct.includes('application/json')) {\n            return (await res.json()) as T\n          }\n          // Non-JSON 2xx — rare. Return raw text cast as T.\n          return (await res.text()) as unknown as T\n        }\n\n        // Retryable error: back off + retry up to maxRetries.\n        if (isRetryable(res.status) && attempt < maxRetries) {\n          const retryAfter = res.headers.get('Retry-After')\n          const backoff = retryAfter ? Number(retryAfter) * 1000 : 250 * Math.pow(2, attempt)\n          await sleep(backoff)\n          continue\n        }\n\n        throw await errorFromResponse(res)\n      } catch (err) {\n        if (err instanceof PlatformError) throw err\n        // AbortError / network / DNS failures — retry up to maxRetries.\n        if (attempt < maxRetries) {\n          lastErr = err\n          await sleep(250 * Math.pow(2, attempt))\n          continue\n        }\n        const msg = err instanceof Error ? err.message : 'network error'\n        throw new PlatformError({\n          code: 'unknown',\n          message: `Network error: ${msg}`,\n          status: 0,\n        })\n      } finally {\n        clearTimeout(timer)\n      }\n    }\n\n    // Should be unreachable — the loop either returns, throws, or continues.\n    throw lastErr instanceof Error ? lastErr : new Error('request exhausted retries')\n  }\n\n  return { request }\n}\n\nexport type HttpClient = ReturnType<typeof createHttpClient>\n","import type { HttpClient } from '../http'\nimport type { MeResponse } from '../types'\n\nexport const createMeResource = (http: HttpClient) => ({\n  // Smoke test — confirms the API key is valid and returns the org + balance.\n  // Most consumers use this as a ping on startup.\n  get: async (): Promise<MeResponse> => http.request<MeResponse>({ method: 'GET', path: '/v1/me' }),\n})\n\nexport type MeResource = ReturnType<typeof createMeResource>\n","import type { HttpClient } from '../http'\nimport type {\n  WebhookConfig,\n  WebhookCreateInput,\n  WebhookDelivery,\n  WebhookUpdateInput,\n} from '../types'\n\n// Per-agent webhook resource, scoped at factory time to a specific agentId.\n// All endpoints mirror /v1/agents/:agentId/webhooks[/:id].\n\nexport const createAgentWebhooksResource = (http: HttpClient, agentId: string) => ({\n  // Returns the webhook + its signing secret. The secret is only present in\n  // this response — persist immediately, subsequent GETs omit it. Use the\n  // secret to verify `X-Platform-Signature-256` (sha256=hex HMAC over body).\n  create: async (input: WebhookCreateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks`,\n      body: input,\n    }),\n\n  list: async (): Promise<WebhookConfig[]> => {\n    const res = await http.request<{ data: WebhookConfig[] }>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks`,\n    })\n    return res.data\n  },\n\n  get: async (webhookId: string): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  update: async (webhookId: string, patch: WebhookUpdateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'PATCH',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n      body: patch,\n    }),\n\n  delete: async (webhookId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  // Fires a synthetic call.started against this webhook and returns the\n  // full delivery record (including attempt status codes) once the retry\n  // sequence has finished. Useful during setup to verify receiver wiring.\n  test: async (webhookId: string): Promise<WebhookDelivery> =>\n    http.request<WebhookDelivery>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}/test`,\n    }),\n})\n\nexport type AgentWebhooksResource = ReturnType<typeof createAgentWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { Agent, AgentCreateInput, AgentUpdateInput } from '../types'\nimport { createAgentWebhooksResource, type AgentWebhooksResource } from './agentWebhooks'\n\n// The server returns Agent with `apiKey` stripped and `hasApiKey: boolean`\n// on the model. We type the happy path but keep our input type permissive\n// so consumers can POST a plaintext `apiKey` that the server encrypts +\n// swaps for `apiKeySecret` on persistence.\n\nexport const createAgentsResource = (http: HttpClient) => {\n  const agents = {\n    create: async (input: AgentCreateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'POST', path: '/v1/agents', body: input }),\n\n    list: async (): Promise<Agent[]> => {\n      const res = await http.request<{ data: Agent[] }>({ method: 'GET', path: '/v1/agents' })\n      return res.data\n    },\n\n    // Async iterator for \"give me every agent\" — v1 server returns the full\n    // list in one page, so this is just a thin convenience. When the server\n    // picks up cursor pagination, this is the method that papers over that\n    // migration without consumer changes.\n    listAll: async function* (): AsyncIterable<Agent> {\n      const page = await agents.list()\n      for (const a of page) yield a\n    },\n\n    get: async (agentId: string): Promise<Agent> =>\n      http.request<Agent>({ method: 'GET', path: `/v1/agents/${agentId}` }),\n\n    update: async (agentId: string, patch: AgentUpdateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'PATCH', path: `/v1/agents/${agentId}`, body: patch }),\n\n    delete: async (agentId: string): Promise<void> =>\n      http.request<void>({ method: 'DELETE', path: `/v1/agents/${agentId}` }),\n\n    // Nested resource. Per-agent webhook CRUD lives at\n    // /v1/agents/:agentId/webhooks/* — we expose it as a factory keyed on\n    // agentId so consumers can bind once and reuse:\n    //\n    //   const hooks = client.agents.webhooks(myAgentId)\n    //   await hooks.create({ url, events })\n    //   await hooks.list()\n    webhooks: (agentId: string): AgentWebhooksResource =>\n      createAgentWebhooksResource(http, agentId),\n  }\n  return agents\n}\n\nexport type AgentsResource = ReturnType<typeof createAgentsResource>\n","import type { HttpClient } from '../http'\nimport type {\n  CallListFilters,\n  CallRecord,\n  CallRecordingUrlResponse,\n  CallSummary,\n  TranscriptTurn,\n} from '../types'\n\nexport const createCallsResource = (http: HttpClient) => {\n  const calls = {\n    list: async (filters: CallListFilters = {}): Promise<CallSummary[]> => {\n      const res = await http.request<{ data: CallSummary[] }>({\n        method: 'GET',\n        path: '/v1/calls',\n        query: filters as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination helper. v1 server caps at limit (max 200) in a single\n    // page — consumers who ask for \"every call since X\" get that page, the\n    // iterator ends. This is the shape we'd extend with cursor support\n    // without breaking callers.\n    listAll: async function* (filters: CallListFilters = {}): AsyncIterable<CallSummary> {\n      const page = await calls.list(filters)\n      for (const c of page) yield c\n    },\n\n    get: async (callId: string): Promise<CallRecord> =>\n      http.request<CallRecord>({ method: 'GET', path: `/v1/calls/${callId}` }),\n\n    transcript: async (callId: string): Promise<{ callId: string; transcript: TranscriptTurn[] }> =>\n      http.request<{ callId: string; transcript: TranscriptTurn[] }>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/transcript`,\n      }),\n\n    // Returns a V4 signed URL (1-hour TTL). `ready: false` + `artifact:\n    // 'caller-raw'` means the async mix job hasn't finished — the URL still\n    // points at a playable file (raw caller PCM).\n    recording: async (callId: string): Promise<CallRecordingUrlResponse> =>\n      http.request<CallRecordingUrlResponse>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/recording`,\n      }),\n\n    // Outbound dialling (POST /v1/calls) + in-call control are Phase 1.4.4 /\n    // 1.4.5 respectively — blocked on telephony. Surface clear \"not built\n    // yet\" errors here if consumers guess those method names, so they don't\n    // silently hit a non-existent endpoint and wonder why it 404s.\n  }\n  return calls\n}\n\nexport type CallsResource = ReturnType<typeof createCallsResource>\n","import fs from 'node:fs'\nimport path from 'node:path'\nimport type { HttpClient } from '../http'\nimport type { KnowledgeBase, KnowledgeBaseFile } from '../types'\n\nexport const createKnowledgeBasesResource = (http: HttpClient) => ({\n  create: async (name: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({\n      method: 'POST',\n      path: '/v1/knowledge-bases',\n      body: { name },\n    }),\n\n  list: async (): Promise<KnowledgeBase[]> => {\n    const res = await http.request<{ data: KnowledgeBase[] }>({\n      method: 'GET',\n      path: '/v1/knowledge-bases',\n    })\n    return res.data\n  },\n\n  get: async (kbId: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({ method: 'GET', path: `/v1/knowledge-bases/${kbId}` }),\n\n  delete: async (kbId: string): Promise<void> =>\n    http.request<void>({ method: 'DELETE', path: `/v1/knowledge-bases/${kbId}` }),\n\n  // File upload — accepts either a local file path OR raw bytes + filename.\n  // The server ingests synchronously today (Phase 3.1.4 Cloud Tasks is a\n  // followup), so the returned file has status='ready' in most cases.\n  uploadFile: async (\n    kbId: string,\n    source:\n      | { path: string; filename?: string; mimeType?: string }\n      | { data: Buffer | Uint8Array; filename: string; mimeType?: string },\n  ): Promise<KnowledgeBaseFile> => {\n    const form = new FormData()\n    let blob: Blob\n    let filename: string\n    let mime: string\n\n    if ('path' in source) {\n      const buf = await fs.promises.readFile(source.path)\n      filename = source.filename ?? path.basename(source.path)\n      mime = source.mimeType ?? 'application/octet-stream'\n      blob = new Blob([new Uint8Array(buf)], { type: mime })\n    } else {\n      filename = source.filename\n      mime = source.mimeType ?? 'application/octet-stream'\n      const bytes = source.data instanceof Buffer ? new Uint8Array(source.data) : source.data\n      blob = new Blob([bytes], { type: mime })\n    }\n    form.append('file', blob, filename)\n\n    // File uploads can take a while (OCR, chunking, embedding) — give them\n    // room before timing out. 5 min cap matches the server's own\n    // processing budget.\n    return http.request<KnowledgeBaseFile>({\n      method: 'POST',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n      formData: form,\n      timeoutMs: 5 * 60 * 1000,\n    })\n  },\n\n  listFiles: async (kbId: string): Promise<KnowledgeBaseFile[]> => {\n    const res = await http.request<{ data: KnowledgeBaseFile[] }>({\n      method: 'GET',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n    })\n    return res.data\n  },\n\n  deleteFile: async (kbId: string, fileId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/knowledge-bases/${kbId}/files/${fileId}`,\n    }),\n})\n\nexport type KnowledgeBasesResource = ReturnType<typeof createKnowledgeBasesResource>\n","import type { HttpClient } from '../http'\nimport type { LedgerEntry } from '../types'\n\nexport const createCreditsResource = (http: HttpClient) => {\n  const credits = {\n    getBalance: async (): Promise<{ orgId: string; balanceCents: number }> =>\n      http.request<{ orgId: string; balanceCents: number }>({\n        method: 'GET',\n        path: '/v1/credits/balance',\n      }),\n\n    // Returns ledger entries newest-first. `limit` is capped at 500 server-side.\n    getLedger: async (opts: { limit?: number } = {}): Promise<LedgerEntry[]> => {\n      const res = await http.request<{ data: LedgerEntry[] }>({\n        method: 'GET',\n        path: '/v1/credits/ledger',\n        query: opts as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination scaffold — v1 server returns a single page up to\n    // limit=500. When cursor pagination lands this is where it gets wired.\n    getLedgerAll: async function* (opts: { limit?: number } = {}): AsyncIterable<LedgerEntry> {\n      const page = await credits.getLedger(opts)\n      for (const e of page) yield e\n    },\n  }\n  return credits\n}\n\nexport type CreditsResource = ReturnType<typeof createCreditsResource>\n","import type { HttpClient } from '../http'\nimport type { CallTokenMintInput, CallTokenMintResult, CallTokenSummary } from '../types'\n\n// Short-lived, agent-scoped `ct_` tokens. Mint one per user session on your\n// backend, hand the raw value to the browser; let this SDK handle lifecycle\n// (revoke on sign-out, list active tokens for an admin panel).\n\nexport const createCallTokensResource = (http: HttpClient) => ({\n  // Returns the RAW token value once. Don't log it; pass it straight to the\n  // browser + discard server-side. `tokenId` is the stable public handle\n  // used for revocation later.\n  mint: async (input: CallTokenMintInput): Promise<CallTokenMintResult> =>\n    http.request<CallTokenMintResult>({\n      method: 'POST',\n      path: '/v1/call-tokens',\n      body: input,\n    }),\n\n  // Live tokens only by default. Pass includeRevoked/includeExpired when\n  // debugging \"why did my token stop working\".\n  list: async (\n    opts: { includeRevoked?: boolean; includeExpired?: boolean; limit?: number } = {},\n  ): Promise<CallTokenSummary[]> => {\n    const query: Record<string, string | number | undefined> = {}\n    if (opts.includeRevoked) query.includeRevoked = '1'\n    if (opts.includeExpired) query.includeExpired = '1'\n    if (opts.limit !== undefined) query.limit = opts.limit\n    const res = await http.request<{ data: CallTokenSummary[] }>({\n      method: 'GET',\n      path: '/v1/call-tokens',\n      query,\n    })\n    return res.data\n  },\n\n  // Idempotent — re-revoking a revoked token returns `alreadyRevoked: true`.\n  revoke: async (\n    tokenId: string,\n  ): Promise<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }> =>\n    http.request<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }>({\n      method: 'DELETE',\n      path: `/v1/call-tokens/${tokenId}`,\n    }),\n})\n\nexport type CallTokensResource = ReturnType<typeof createCallTokensResource>\n","import type { HttpClient } from '../http'\nimport type { WebhookDelivery } from '../types'\n\n// Org-wide webhook delivery log. Per-agent CRUD lives on\n// `client.agents.webhooks(agentId)` — this namespace is just the\n// read-only deliveries surface that spans all agents.\n\nexport const createWebhooksResource = (http: HttpClient) => ({\n  deliveries: async (\n    filters: {\n      agentId?: string\n      webhookId?: string\n      callId?: string\n      limit?: number\n    } = {},\n  ): Promise<WebhookDelivery[]> => {\n    const res = await http.request<{ data: WebhookDelivery[] }>({\n      method: 'GET',\n      path: '/v1/webhooks/deliveries',\n      query: filters as Record<string, string | number | undefined>,\n    })\n    return res.data\n  },\n})\n\nexport type WebhooksResource = ReturnType<typeof createWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { CatalogAgent, CatalogListInput } from '../types'\n\n// Org-scoped consumer endpoints. Today this is just the agent catalog —\n// the trimmed shape your mobile app picks an agent from. Lives at\n// `/v1/orgs/:orgId/agents` rather than reusing the admin `/v1/agents/*`\n// tree on purpose: the catalog response intentionally excludes the\n// operator-only fields (system prompt, tools, KB IDs) so a leaked\n// consumer-backend `sk_` can't lift the operator config out of it.\n//\n// Pattern from your backend:\n//\n//   const client = new PlatformClient({ apiKey: process.env.SK })\n//   const free = await client.orgs.listAgents({\n//     orgId: process.env.ORG_ID!,\n//     userTags: ['free'],         // hide premium agents from free users\n//   })\n//   res.json(free)\n//\n// Or with persona filtering:\n//\n//   const secretaries = await client.orgs.listAgents({\n//     orgId: process.env.ORG_ID!,\n//     tags: ['secretary'],\n//     userTags: ['paying'],\n//   })\n\nexport const createOrgsResource = (http: HttpClient) => ({\n  /**\n   * Fetch the agent catalog for an org. Returns the consumer-trimmed shape;\n   * no system prompt, tools, or KB info. Use `client.agents.get(agentId)`\n   * with the same `sk_` if you need the full admin shape.\n   *\n   * Filters:\n   *   - `tags`: OR-match on persona tags. Empty = all.\n   *   - `userTags`: tier gate. Hides agents whose `allowedUserTags` is\n   *     non-empty and doesn't intersect. Omit to skip the gate filter\n   *     (admin / dashboard usage).\n   *\n   * Throws `403 forbidden` if `orgId` doesn't match the key's org.\n   */\n  listAgents: async (input: CatalogListInput): Promise<CatalogAgent[]> => {\n    const query: Record<string, string | undefined> = {}\n    if (input.tags && input.tags.length > 0) query.tags = input.tags.join(',')\n    if (input.userTags && input.userTags.length > 0) query.userTags = input.userTags.join(',')\n    const res = await http.request<{ data: CatalogAgent[] }>({\n      method: 'GET',\n      path: `/v1/orgs/${input.orgId}/agents`,\n      query,\n    })\n    return res.data\n  },\n})\n\nexport type OrgsResource = ReturnType<typeof createOrgsResource>\n","import { createHttpClient, type HttpClientOptions } from './http'\nimport { createMeResource, type MeResource } from './resources/me'\nimport { createAgentsResource, type AgentsResource } from './resources/agents'\nimport { createCallsResource, type CallsResource } from './resources/calls'\nimport {\n  createKnowledgeBasesResource,\n  type KnowledgeBasesResource,\n} from './resources/knowledgeBases'\nimport { createCreditsResource, type CreditsResource } from './resources/credits'\nimport { createCallTokensResource, type CallTokensResource } from './resources/callTokens'\nimport { createWebhooksResource, type WebhooksResource } from './resources/webhooks'\nimport { createOrgsResource, type OrgsResource } from './resources/orgs'\n\nexport interface PlatformClientOptions {\n  // Full-org API key minted from the dashboard or bootstrap CLI. Start with\n  // `sk_`. Never ship to a browser — use `client.callTokens.mint(...)` to\n  // generate a narrow `ct_` token for client-side use instead.\n  apiKey: string\n  // Defaults to the hosted platform. Point at `http://localhost:8080` for\n  // local dev or at a self-hosted deployment.\n  baseUrl?: string\n  // Passthrough tuning for the HTTP layer.\n  timeoutMs?: number\n  maxRetries?: number\n  fetch?: HttpClientOptions['fetch']\n  onRequest?: HttpClientOptions['onRequest']\n}\n\n// Single entry point. All resources are lazy-constructed in the constructor\n// so their refs don't incur any per-call allocation. Shape mirrors Stripe /\n// Twilio / Vapi's `resource.method()` convention for familiarity.\nexport class PlatformClient {\n  readonly me: MeResource\n  readonly agents: AgentsResource\n  readonly calls: CallsResource\n  readonly knowledgeBases: KnowledgeBasesResource\n  readonly credits: CreditsResource\n  readonly callTokens: CallTokensResource\n  readonly webhooks: WebhooksResource\n  readonly orgs: OrgsResource\n\n  constructor(options: PlatformClientOptions) {\n    if (!options.apiKey) {\n      throw new Error('PlatformClient: `apiKey` is required')\n    }\n    const http = createHttpClient({\n      apiKey: options.apiKey,\n      baseUrl: options.baseUrl ?? 'https://api.example.com',\n      timeoutMs: options.timeoutMs,\n      maxRetries: options.maxRetries,\n      fetch: options.fetch,\n      onRequest: options.onRequest,\n    })\n\n    this.me = createMeResource(http)\n    this.agents = createAgentsResource(http)\n    this.calls = createCallsResource(http)\n    this.knowledgeBases = createKnowledgeBasesResource(http)\n    this.credits = createCreditsResource(http)\n    this.callTokens = createCallTokensResource(http)\n    this.webhooks = createWebhooksResource(http)\n    this.orgs = createOrgsResource(http)\n  }\n}\n","import crypto from 'node:crypto'\n\n// Helper for consumers receiving webhooks: verify the `X-Platform-Signature-256`\n// header against the raw body + secret. Plain function (not tied to\n// PlatformClient) so Express/Koa/Next.js middleware can use it without\n// instantiating a client.\n//\n//   import { verifyWebhookSignature } from '@craftedxp/sdk-node'\n//   app.post('/webhooks/voice-agent', express.raw({ type: 'application/json' }), (req, res) => {\n//     const sig = req.header('X-Platform-Signature-256') ?? ''\n//     if (!verifyWebhookSignature(req.body, sig, process.env.VOICE_AGENT_WEBHOOK_SECRET!)) {\n//       return res.status(401).send('invalid signature')\n//     }\n//     const event = JSON.parse(req.body.toString('utf8'))\n//     // ...handle event\n//   })\n//\n// The signature is `sha256=<hex HMAC-SHA256 of rawBody with secret>`.\n// Timing-safe compare to avoid microtiming side channels.\n\nexport const verifyWebhookSignature = (\n  rawBody: Buffer | string,\n  signatureHeader: string,\n  secret: string,\n): boolean => {\n  if (!signatureHeader || !secret) return false\n  const [algo, provided] = signatureHeader.split('=')\n  if (algo !== 'sha256' || !provided) return false\n\n  const expected = crypto\n    .createHmac('sha256', secret)\n    .update(typeof rawBody === 'string' ? rawBody : rawBody)\n    .digest('hex')\n\n  // Buffers must match in length for timingSafeEqual.\n  const a = Buffer.from(expected, 'hex')\n  const b = Buffer.from(provided, 'hex')\n  if (a.length !== b.length) return false\n  return crypto.timingSafeEqual(a, b)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBO,IAAM,gBAAN,MAAM,uBAAsB,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EAET,YAAY,QAOT;AACD,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,OAAO,OAAO;AAGnB,QACE,OAAQ,MAAyD,sBACjE,YACA;AACA;AAAC,MACC,MACA,kBAAkB,MAAM,cAAa;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,SAAkC;AAChC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AACF;;;ACtBA,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AAE5B,IAAM,WAAW,CAAC,SAAiBA,OAAc,UAAyC;AACxF,QAAM,IAAI,IAAI,IAAIA,OAAM,OAAO;AAC/B,MAAI,OAAO;AACT,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,MAAM,OAAW;AACrB,QAAE,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO,EAAE,SAAS;AACpB;AAEA,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAExE,IAAM,cAAc,CAAC,WAA4B,WAAW,OAAQ,UAAU,OAAO,SAAS;AAI9F,IAAM,oBAAoB,OAAO,QAA0C;AACzE,QAAM,WAAW,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAChD,MAAI,SAAkB;AACtB,MAAI;AACF,aAAS,WAAW,KAAK,MAAM,QAAQ,IAAI;AAAA,EAC7C,QAAQ;AAAA,EAGR;AACA,QAAM,SACJ,QACC;AACH,SAAO,IAAI,cAAc;AAAA,IACvB,MAAO,QAAQ,QAAyB;AAAA,IACxC,SAAS,QAAQ,WAAW,IAAI,cAAc,QAAQ,IAAI,MAAM;AAAA,IAChE,QAAQ,IAAI;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,MAAM,UAAU;AAAA,EAClB,CAAC;AACH;AAEO,IAAM,mBAAmB,CAAC,SAA4B;AAC3D,QAAM,YAAY,KAAK,SAAS,WAAW;AAC3C,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,aAAa,KAAK,cAAc;AAEtC,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAEA,QAAM,UAAU,OAAU,QAAiC;AACzD,UAAM,MAAM,SAAS,KAAK,SAAS,IAAI,MAAM,IAAI,KAAK;AACtD,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,QAAQ;AAAA,MACR,GAAI,IAAI,WAAW,CAAC;AAAA,IACtB;AAMA,QAAI;AACJ,QAAI,IAAI,UAAU;AAChB,aAAO,IAAI;AAAA,IACb,WAAW,IAAI,SAAS,QAAW;AACjC,cAAQ,cAAc,IAAI;AAC1B,aAAO,KAAK,UAAU,IAAI,IAAI;AAAA,IAChC;AAEA,UAAM,aAAa,IAAI,aAAa;AACpC,QAAI;AAEJ,aAAS,UAAU,GAAG,WAAW,YAAY,WAAW;AACtD,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,YAAM,UAAU,KAAK,IAAI;AACzB,UAAI;AACF,cAAM,MAAM,MAAM,UAAU,KAAK;AAAA,UAC/B,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA;AAAA,UACA,QAAQ,WAAW;AAAA,QACrB,CAAC;AACD,cAAM,aAAa,KAAK,IAAI,IAAI;AAChC,aAAK,YAAY;AAAA,UACf,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,SAAS,UAAU;AAAA,QACrB,CAAC;AAED,YAAI,IAAI,IAAI;AAEV,cAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,gBAAM,KAAK,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC9C,cAAI,GAAG,SAAS,kBAAkB,GAAG;AACnC,mBAAQ,MAAM,IAAI,KAAK;AAAA,UACzB;AAEA,iBAAQ,MAAM,IAAI,KAAK;AAAA,QACzB;AAGA,YAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,gBAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,gBAAM,UAAU,aAAa,OAAO,UAAU,IAAI,MAAO,MAAM,KAAK,IAAI,GAAG,OAAO;AAClF,gBAAM,MAAM,OAAO;AACnB;AAAA,QACF;AAEA,cAAM,MAAM,kBAAkB,GAAG;AAAA,MACnC,SAAS,KAAK;AACZ,YAAI,eAAe,cAAe,OAAM;AAExC,YAAI,UAAU,YAAY;AACxB,oBAAU;AACV,gBAAM,MAAM,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;AACtC;AAAA,QACF;AACA,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU;AACjD,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,kBAAkB,GAAG;AAAA,UAC9B,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAGA,UAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,2BAA2B;AAAA,EAClF;AAEA,SAAO,EAAE,QAAQ;AACnB;;;ACnLO,IAAM,mBAAmB,CAAC,UAAsB;AAAA;AAAA;AAAA,EAGrD,KAAK,YAAiC,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,SAAS,CAAC;AAClG;;;ACIO,IAAM,8BAA8B,CAAC,MAAkB,aAAqB;AAAA;AAAA;AAAA;AAAA,EAIjF,QAAQ,OAAO,UACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO;AAAA,IAC3B,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM,cAAc,OAAO;AAAA,IAC7B,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,cACV,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA,EAEH,QAAQ,OAAO,WAAmB,UAChC,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,IACjD,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,QAAQ,OAAO,cACb,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,MAAM,OAAO,cACX,KAAK,QAAyB;AAAA,IAC5B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AACL;;;AChDO,IAAM,uBAAuB,CAAC,SAAqB;AACxD,QAAM,SAAS;AAAA,IACb,QAAQ,OAAO,UACb,KAAK,QAAe,EAAE,QAAQ,QAAQ,MAAM,cAAc,MAAM,MAAM,CAAC;AAAA,IAEzE,MAAM,YAA8B;AAClC,YAAM,MAAM,MAAM,KAAK,QAA2B,EAAE,QAAQ,OAAO,MAAM,aAAa,CAAC;AACvF,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,mBAAyC;AAChD,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,YACV,KAAK,QAAe,EAAE,QAAQ,OAAO,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA,IAEtE,QAAQ,OAAO,SAAiB,UAC9B,KAAK,QAAe,EAAE,QAAQ,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,MAAM,CAAC;AAAA,IAErF,QAAQ,OAAO,YACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASxE,UAAU,CAAC,YACT,4BAA4B,MAAM,OAAO;AAAA,EAC7C;AACA,SAAO;AACT;;;ACvCO,IAAM,sBAAsB,CAAC,SAAqB;AACvD,QAAM,QAAQ;AAAA,IACZ,MAAM,OAAO,UAA2B,CAAC,MAA8B;AACrE,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,iBAAiB,UAA2B,CAAC,GAA+B;AACnF,YAAM,OAAO,MAAM,MAAM,KAAK,OAAO;AACrC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,WACV,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,aAAa,MAAM,GAAG,CAAC;AAAA,IAEzE,YAAY,OAAO,WACjB,KAAK,QAA0D;AAAA,MAC7D,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,IAKH,WAAW,OAAO,WAChB,KAAK,QAAkC;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAML;AACA,SAAO;AACT;;;ACrDA,qBAAe;AACf,uBAAiB;AAIV,IAAM,+BAA+B,CAAC,UAAsB;AAAA,EACjE,QAAQ,OAAO,SACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM,EAAE,KAAK;AAAA,EACf,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,SACV,KAAK,QAAuB,EAAE,QAAQ,OAAO,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA,EAEpF,QAAQ,OAAO,SACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,EAK9E,YAAY,OACV,MACA,WAG+B;AAC/B,UAAM,OAAO,IAAI,SAAS;AAC1B,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,UAAU,QAAQ;AACpB,YAAM,MAAM,MAAM,eAAAC,QAAG,SAAS,SAAS,OAAO,IAAI;AAClD,iBAAW,OAAO,YAAY,iBAAAC,QAAK,SAAS,OAAO,IAAI;AACvD,aAAO,OAAO,YAAY;AAC1B,aAAO,IAAI,KAAK,CAAC,IAAI,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACvD,OAAO;AACL,iBAAW,OAAO;AAClB,aAAO,OAAO,YAAY;AAC1B,YAAM,QAAQ,OAAO,gBAAgB,SAAS,IAAI,WAAW,OAAO,IAAI,IAAI,OAAO;AACnF,aAAO,IAAI,KAAK,CAAC,KAAK,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACzC;AACA,SAAK,OAAO,QAAQ,MAAM,QAAQ;AAKlC,WAAO,KAAK,QAA2B;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,WAAW,IAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,OAAO,SAA+C;AAC/D,UAAM,MAAM,MAAM,KAAK,QAAuC;AAAA,MAC5D,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,IACnC,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,YAAY,OAAO,MAAc,WAC/B,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,uBAAuB,IAAI,UAAU,MAAM;AAAA,EACnD,CAAC;AACL;;;AC3EO,IAAM,wBAAwB,CAAC,SAAqB;AACzD,QAAM,UAAU;AAAA,IACd,YAAY,YACV,KAAK,QAAiD;AAAA,MACpD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA;AAAA,IAGH,WAAW,OAAO,OAA2B,CAAC,MAA8B;AAC1E,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA,IAIA,cAAc,iBAAiB,OAA2B,CAAC,GAA+B;AACxF,YAAM,OAAO,MAAM,QAAQ,UAAU,IAAI;AACzC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,EACF;AACA,SAAO;AACT;;;ACtBO,IAAM,2BAA2B,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA,EAI7D,MAAM,OAAO,UACX,KAAK,QAA6B;AAAA,IAChC,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAAA;AAAA;AAAA,EAIH,MAAM,OACJ,OAA+E,CAAC,MAChD;AAChC,UAAM,QAAqD,CAAC;AAC5D,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,UAAM,MAAM,MAAM,KAAK,QAAsC;AAAA,MAC3D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA;AAAA,EAGA,QAAQ,OACN,YAEA,KAAK,QAAyE;AAAA,IAC5E,QAAQ;AAAA,IACR,MAAM,mBAAmB,OAAO;AAAA,EAClC,CAAC;AACL;;;ACpCO,IAAM,yBAAyB,CAAC,UAAsB;AAAA,EAC3D,YAAY,OACV,UAKI,CAAC,MAC0B;AAC/B,UAAM,MAAM,MAAM,KAAK,QAAqC;AAAA,MAC1D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACIO,IAAM,qBAAqB,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcvD,YAAY,OAAO,UAAqD;AACtE,UAAM,QAA4C,CAAC;AACnD,QAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,EAAG,OAAM,OAAO,MAAM,KAAK,KAAK,GAAG;AACzE,QAAI,MAAM,YAAY,MAAM,SAAS,SAAS,EAAG,OAAM,WAAW,MAAM,SAAS,KAAK,GAAG;AACzF,UAAM,MAAM,MAAM,KAAK,QAAkC;AAAA,MACvD,QAAQ;AAAA,MACR,MAAM,YAAY,MAAM,KAAK;AAAA,MAC7B;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACrBO,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAgC;AAC1C,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,UAAM,OAAO,iBAAiB;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ,WAAW;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,MACpB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,IACrB,CAAC;AAED,SAAK,KAAK,iBAAiB,IAAI;AAC/B,SAAK,SAAS,qBAAqB,IAAI;AACvC,SAAK,QAAQ,oBAAoB,IAAI;AACrC,SAAK,iBAAiB,6BAA6B,IAAI;AACvD,SAAK,UAAU,sBAAsB,IAAI;AACzC,SAAK,aAAa,yBAAyB,IAAI;AAC/C,SAAK,WAAW,uBAAuB,IAAI;AAC3C,SAAK,OAAO,mBAAmB,IAAI;AAAA,EACrC;AACF;;;AC/DA,yBAAmB;AAoBZ,IAAM,yBAAyB,CACpC,SACA,iBACA,WACY;AACZ,MAAI,CAAC,mBAAmB,CAAC,OAAQ,QAAO;AACxC,QAAM,CAAC,MAAM,QAAQ,IAAI,gBAAgB,MAAM,GAAG;AAClD,MAAI,SAAS,YAAY,CAAC,SAAU,QAAO;AAE3C,QAAM,WAAW,mBAAAC,QACd,WAAW,UAAU,MAAM,EAC3B,OAAO,OAAO,YAAY,WAAW,UAAU,OAAO,EACtD,OAAO,KAAK;AAGf,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,mBAAAA,QAAO,gBAAgB,GAAG,CAAC;AACpC;","names":["path","fs","path","crypto"]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/http.ts","../src/resources/me.ts","../src/resources/agentWebhooks.ts","../src/resources/agents.ts","../src/resources/calls.ts","../src/resources/knowledgeBases.ts","../src/resources/credits.ts","../src/resources/callTokens.ts","../src/resources/webhooks.ts","../src/resources/orgs.ts","../src/PlatformClient.ts","../src/verify.ts"],"sourcesContent":["// Public API of @craftedxp/sdk-node.\n\nexport { PlatformClient } from './PlatformClient'\nexport type { PlatformClientOptions } from './PlatformClient'\n\n// Error class for `instanceof` checks in consumer code.\nexport { PlatformError } from './errors'\nexport type { ApiErrorCode } from './errors'\n\n// Webhook signature verification helper — standalone so frameworks\n// (Express, Koa, Next.js route handlers) can use it without instantiating\n// a PlatformClient.\nexport { verifyWebhookSignature } from './verify'\n\n// Re-export DTO types. Consumers often type their own storage models\n// against these — re-exporting avoids `import type` gymnastics.\nexport type * from './types'\n\n// Advanced: expose the resource types for consumers subclassing / wrapping\n// the client. 99% of users don't need these.\nexport type { MeResource } from './resources/me'\nexport type { AgentsResource } from './resources/agents'\nexport type { AgentWebhooksResource } from './resources/agentWebhooks'\nexport type { CallsResource } from './resources/calls'\nexport type { KnowledgeBasesResource } from './resources/knowledgeBases'\nexport type { CreditsResource } from './resources/credits'\nexport type { CallTokensResource } from './resources/callTokens'\nexport type { WebhooksResource } from './resources/webhooks'\nexport type { OrgsResource } from './resources/orgs'\n","// Typed error class mirroring the server's ErrorV1 shape:\n//   { error: { code, message, field?, docs_url? } }\n//\n// Consumers do `err instanceof PlatformError` to branch on code without\n// parsing string messages. `status` carries the HTTP code for the 1% of\n// cases where the code field isn't enough (e.g. rate-limit → retry-after\n// header correlation).\n\nexport type ApiErrorCode =\n  | 'unauthorized'\n  | 'forbidden'\n  | 'not_found'\n  | 'bad_request'\n  | 'conflict'\n  | 'rate_limited'\n  | 'payment_required'\n  | 'internal_error'\n  | 'unknown'\n\nexport class PlatformError extends Error {\n  readonly code: ApiErrorCode\n  readonly status: number\n  readonly field?: string\n  readonly docsUrl?: string\n  // The raw response body for debugging. Intentionally optional — we clear\n  // it on `error.toJSON()` so logging libraries don't dump the whole\n  // server response into production logs.\n  readonly body?: unknown\n\n  constructor(params: {\n    code: ApiErrorCode\n    message: string\n    status: number\n    field?: string\n    docsUrl?: string\n    body?: unknown\n  }) {\n    super(params.message)\n    this.name = 'PlatformError'\n    this.code = params.code\n    this.status = params.status\n    this.field = params.field\n    this.docsUrl = params.docsUrl\n    this.body = params.body\n    // Preserve the stack trace — Node's Error doesn't capture it\n    // automatically when subclassing in some older runtimes.\n    if (\n      typeof (Error as typeof Error & { captureStackTrace?: unknown }).captureStackTrace ===\n      'function'\n    ) {\n      ;(\n        Error as typeof Error & { captureStackTrace: (target: unknown, ctor: unknown) => void }\n      ).captureStackTrace(this, PlatformError)\n    }\n  }\n\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      field: this.field,\n      docsUrl: this.docsUrl,\n    }\n  }\n}\n","import { PlatformError, type ApiErrorCode } from './errors'\n\n// Low-level HTTP wrapper around `fetch` (native in Node 18+). Every resource\n// method routes through here for consistent auth + error handling + retries.\n//\n// v1 scope: JSON-in / JSON-out + multipart for file uploads. No streaming —\n// call WebSockets go through @craftedxp/voice-rn (the React Native client)\n// or a web equivalent, not this server-side SDK.\n\nexport interface HttpClientOptions {\n  apiKey: string\n  baseUrl: string\n  // Default 30s. File uploads can override per-request.\n  timeoutMs?: number\n  // 429 + 5xx retries. Defaults to 3 attempts (original + 2 retries) with\n  // exponential backoff (250ms, 1s). Set to 0 to disable.\n  maxRetries?: number\n  // Optional — lets consumers swap in a test/mock fetch (or a custom one\n  // with instrumentation). Defaults to the global.\n  fetch?: typeof fetch\n  // Optional — a callback that fires per-request with the final status and\n  // duration. Handy for dropping traces into the consumer's observability\n  // stack without wrapping each call.\n  onRequest?: (info: {\n    method: string\n    url: string\n    status: number\n    durationMs: number\n    attempt: number\n  }) => void\n}\n\nexport interface HttpRequest {\n  method: 'GET' | 'POST' | 'PATCH' | 'DELETE'\n  path: string // starts with `/`, e.g. `/v1/agents/123`\n  query?: Record<string, string | number | boolean | undefined>\n  body?: unknown // JSON-serialised — for multipart use `formData`\n  formData?: FormData\n  timeoutMs?: number\n  // Exposed for edge cases where a resource wants to tack on extra\n  // headers (we don't have any today but leave the hook).\n  headers?: Record<string, string>\n}\n\nconst DEFAULT_TIMEOUT_MS = 30_000\nconst DEFAULT_MAX_RETRIES = 2 // total attempts = 3\n\nconst buildUrl = (baseUrl: string, path: string, query?: HttpRequest['query']): string => {\n  const u = new URL(path, baseUrl)\n  if (query) {\n    for (const [k, v] of Object.entries(query)) {\n      if (v === undefined) continue\n      u.searchParams.set(k, String(v))\n    }\n  }\n  return u.toString()\n}\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\nconst isRetryable = (status: number): boolean => status === 429 || (status >= 500 && status < 600)\n\n// Parse whatever the server returned into a PlatformError. Falls back to\n// synthesising a sensible error for non-JSON responses.\nconst errorFromResponse = async (res: Response): Promise<PlatformError> => {\n  const bodyText = await res.text().catch(() => '')\n  let parsed: unknown = undefined\n  try {\n    parsed = bodyText ? JSON.parse(bodyText) : undefined\n  } catch {\n    // non-JSON response (e.g. an HTML error page from a proxy). Fall\n    // through with parsed = undefined.\n  }\n  const errObj = (\n    parsed as { error?: { code?: string; message?: string; field?: string; docs_url?: string } }\n  )?.error\n  return new PlatformError({\n    code: (errObj?.code as ApiErrorCode) ?? 'unknown',\n    message: errObj?.message ?? res.statusText ?? `HTTP ${res.status}`,\n    status: res.status,\n    field: errObj?.field,\n    docsUrl: errObj?.docs_url,\n    body: parsed ?? bodyText,\n  })\n}\n\nexport const createHttpClient = (opts: HttpClientOptions) => {\n  const fetchImpl = opts.fetch ?? globalThis.fetch\n  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS\n  const maxRetries = opts.maxRetries ?? DEFAULT_MAX_RETRIES\n\n  if (!fetchImpl) {\n    throw new Error('No global fetch available. @craftedxp/sdk-node requires Node >= 18.')\n  }\n\n  const request = async <T>(req: HttpRequest): Promise<T> => {\n    const url = buildUrl(opts.baseUrl, req.path, req.query)\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${opts.apiKey}`,\n      Accept: 'application/json',\n      ...(req.headers ?? {}),\n    }\n\n    // Body shaping: prefer formData when provided; otherwise JSON.\n    // `FormData` sets its own Content-Type with boundary — don't preempt it.\n    // Typed as `string | FormData | undefined` (a subset of the global\n    // BodyInit) so we don't need DOM lib types in this server-side SDK.\n    let body: string | FormData | undefined\n    if (req.formData) {\n      body = req.formData\n    } else if (req.body !== undefined) {\n      headers['Content-Type'] = 'application/json'\n      body = JSON.stringify(req.body)\n    }\n\n    const reqTimeout = req.timeoutMs ?? timeoutMs\n    let lastErr: unknown\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      const controller = new AbortController()\n      const timer = setTimeout(() => controller.abort(), reqTimeout)\n      const started = Date.now()\n      try {\n        const res = await fetchImpl(url, {\n          method: req.method,\n          headers,\n          body,\n          signal: controller.signal,\n        })\n        const durationMs = Date.now() - started\n        opts.onRequest?.({\n          method: req.method,\n          url,\n          status: res.status,\n          durationMs,\n          attempt: attempt + 1,\n        })\n\n        if (res.ok) {\n          // 204 No Content — some endpoints (DELETE webhooks) return nothing.\n          if (res.status === 204) return undefined as T\n          const ct = res.headers.get('content-type') ?? ''\n          if (ct.includes('application/json')) {\n            return (await res.json()) as T\n          }\n          // Non-JSON 2xx — rare. Return raw text cast as T.\n          return (await res.text()) as unknown as T\n        }\n\n        // Retryable error: back off + retry up to maxRetries.\n        if (isRetryable(res.status) && attempt < maxRetries) {\n          const retryAfter = res.headers.get('Retry-After')\n          const backoff = retryAfter ? Number(retryAfter) * 1000 : 250 * Math.pow(2, attempt)\n          await sleep(backoff)\n          continue\n        }\n\n        throw await errorFromResponse(res)\n      } catch (err) {\n        if (err instanceof PlatformError) throw err\n        // AbortError / network / DNS failures — retry up to maxRetries.\n        if (attempt < maxRetries) {\n          lastErr = err\n          await sleep(250 * Math.pow(2, attempt))\n          continue\n        }\n        const msg = err instanceof Error ? err.message : 'network error'\n        throw new PlatformError({\n          code: 'unknown',\n          message: `Network error: ${msg}`,\n          status: 0,\n        })\n      } finally {\n        clearTimeout(timer)\n      }\n    }\n\n    // Should be unreachable — the loop either returns, throws, or continues.\n    throw lastErr instanceof Error ? lastErr : new Error('request exhausted retries')\n  }\n\n  return { request }\n}\n\nexport type HttpClient = ReturnType<typeof createHttpClient>\n","import type { HttpClient } from '../http'\nimport type { MeResponse } from '../types'\n\nexport const createMeResource = (http: HttpClient) => ({\n  // Smoke test — confirms the API key is valid and returns the org + balance.\n  // Most consumers use this as a ping on startup.\n  get: async (): Promise<MeResponse> => http.request<MeResponse>({ method: 'GET', path: '/v1/me' }),\n})\n\nexport type MeResource = ReturnType<typeof createMeResource>\n","import type { HttpClient } from '../http'\nimport type {\n  WebhookConfig,\n  WebhookCreateInput,\n  WebhookDelivery,\n  WebhookUpdateInput,\n} from '../types'\n\n// Per-agent webhook resource, scoped at factory time to a specific agentId.\n// All endpoints mirror /v1/agents/:agentId/webhooks[/:id].\n\nexport const createAgentWebhooksResource = (http: HttpClient, agentId: string) => ({\n  // Returns the webhook + its signing secret. The secret is only present in\n  // this response — persist immediately, subsequent GETs omit it. Use the\n  // secret to verify `X-Platform-Signature-256` (sha256=hex HMAC over body).\n  create: async (input: WebhookCreateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks`,\n      body: input,\n    }),\n\n  list: async (): Promise<WebhookConfig[]> => {\n    const res = await http.request<{ data: WebhookConfig[] }>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks`,\n    })\n    return res.data\n  },\n\n  get: async (webhookId: string): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  update: async (webhookId: string, patch: WebhookUpdateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'PATCH',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n      body: patch,\n    }),\n\n  delete: async (webhookId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  // Fires a synthetic call.started against this webhook and returns the\n  // full delivery record (including attempt status codes) once the retry\n  // sequence has finished. Useful during setup to verify receiver wiring.\n  test: async (webhookId: string): Promise<WebhookDelivery> =>\n    http.request<WebhookDelivery>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}/test`,\n    }),\n})\n\nexport type AgentWebhooksResource = ReturnType<typeof createAgentWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { Agent, AgentCreateInput, AgentUpdateInput } from '../types'\nimport { createAgentWebhooksResource, type AgentWebhooksResource } from './agentWebhooks'\n\n// The server returns Agent with `apiKey` stripped and `hasApiKey: boolean`\n// on the model. We type the happy path but keep our input type permissive\n// so consumers can POST a plaintext `apiKey` that the server encrypts +\n// swaps for `apiKeySecret` on persistence.\n\nexport const createAgentsResource = (http: HttpClient) => {\n  const agents = {\n    create: async (input: AgentCreateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'POST', path: '/v1/agents', body: input }),\n\n    list: async (): Promise<Agent[]> => {\n      const res = await http.request<{ data: Agent[] }>({ method: 'GET', path: '/v1/agents' })\n      return res.data\n    },\n\n    // Async iterator for \"give me every agent\" — v1 server returns the full\n    // list in one page, so this is just a thin convenience. When the server\n    // picks up cursor pagination, this is the method that papers over that\n    // migration without consumer changes.\n    listAll: async function* (): AsyncIterable<Agent> {\n      const page = await agents.list()\n      for (const a of page) yield a\n    },\n\n    get: async (agentId: string): Promise<Agent> =>\n      http.request<Agent>({ method: 'GET', path: `/v1/agents/${agentId}` }),\n\n    update: async (agentId: string, patch: AgentUpdateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'PATCH', path: `/v1/agents/${agentId}`, body: patch }),\n\n    delete: async (agentId: string): Promise<void> =>\n      http.request<void>({ method: 'DELETE', path: `/v1/agents/${agentId}` }),\n\n    // Nested resource. Per-agent webhook CRUD lives at\n    // /v1/agents/:agentId/webhooks/* — we expose it as a factory keyed on\n    // agentId so consumers can bind once and reuse:\n    //\n    //   const hooks = client.agents.webhooks(myAgentId)\n    //   await hooks.create({ url, events })\n    //   await hooks.list()\n    webhooks: (agentId: string): AgentWebhooksResource =>\n      createAgentWebhooksResource(http, agentId),\n  }\n  return agents\n}\n\nexport type AgentsResource = ReturnType<typeof createAgentsResource>\n","import type { HttpClient } from '../http'\nimport type {\n  CallListFilters,\n  CallRecord,\n  CallRecordingUrlResponse,\n  CallSummary,\n  TranscriptTurn,\n} from '../types'\n\nexport const createCallsResource = (http: HttpClient) => {\n  const calls = {\n    list: async (filters: CallListFilters = {}): Promise<CallSummary[]> => {\n      const res = await http.request<{ data: CallSummary[] }>({\n        method: 'GET',\n        path: '/v1/calls',\n        query: filters as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination helper. v1 server caps at limit (max 200) in a single\n    // page — consumers who ask for \"every call since X\" get that page, the\n    // iterator ends. This is the shape we'd extend with cursor support\n    // without breaking callers.\n    listAll: async function* (filters: CallListFilters = {}): AsyncIterable<CallSummary> {\n      const page = await calls.list(filters)\n      for (const c of page) yield c\n    },\n\n    get: async (callId: string): Promise<CallRecord> =>\n      http.request<CallRecord>({ method: 'GET', path: `/v1/calls/${callId}` }),\n\n    transcript: async (callId: string): Promise<{ callId: string; transcript: TranscriptTurn[] }> =>\n      http.request<{ callId: string; transcript: TranscriptTurn[] }>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/transcript`,\n      }),\n\n    // Returns a V4 signed URL (1-hour TTL). `ready: false` + `artifact:\n    // 'caller-raw'` means the async mix job hasn't finished — the URL still\n    // points at a playable file (raw caller PCM).\n    recording: async (callId: string): Promise<CallRecordingUrlResponse> =>\n      http.request<CallRecordingUrlResponse>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/recording`,\n      }),\n\n    // Outbound dialling (POST /v1/calls) + in-call control are Phase 1.4.4 /\n    // 1.4.5 respectively — blocked on telephony. Surface clear \"not built\n    // yet\" errors here if consumers guess those method names, so they don't\n    // silently hit a non-existent endpoint and wonder why it 404s.\n  }\n  return calls\n}\n\nexport type CallsResource = ReturnType<typeof createCallsResource>\n","import fs from 'node:fs'\nimport path from 'node:path'\nimport type { HttpClient } from '../http'\nimport type { KnowledgeBase, KnowledgeBaseFile } from '../types'\n\nexport const createKnowledgeBasesResource = (http: HttpClient) => ({\n  create: async (name: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({\n      method: 'POST',\n      path: '/v1/knowledge-bases',\n      body: { name },\n    }),\n\n  list: async (): Promise<KnowledgeBase[]> => {\n    const res = await http.request<{ data: KnowledgeBase[] }>({\n      method: 'GET',\n      path: '/v1/knowledge-bases',\n    })\n    return res.data\n  },\n\n  get: async (kbId: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({ method: 'GET', path: `/v1/knowledge-bases/${kbId}` }),\n\n  delete: async (kbId: string): Promise<void> =>\n    http.request<void>({ method: 'DELETE', path: `/v1/knowledge-bases/${kbId}` }),\n\n  // File upload — accepts either a local file path OR raw bytes + filename.\n  // The server ingests synchronously today (Phase 3.1.4 Cloud Tasks is a\n  // followup), so the returned file has status='ready' in most cases.\n  uploadFile: async (\n    kbId: string,\n    source:\n      | { path: string; filename?: string; mimeType?: string }\n      | { data: Buffer | Uint8Array; filename: string; mimeType?: string },\n  ): Promise<KnowledgeBaseFile> => {\n    const form = new FormData()\n    let blob: Blob\n    let filename: string\n    let mime: string\n\n    if ('path' in source) {\n      const buf = await fs.promises.readFile(source.path)\n      filename = source.filename ?? path.basename(source.path)\n      mime = source.mimeType ?? 'application/octet-stream'\n      blob = new Blob([new Uint8Array(buf)], { type: mime })\n    } else {\n      filename = source.filename\n      mime = source.mimeType ?? 'application/octet-stream'\n      const bytes = source.data instanceof Buffer ? new Uint8Array(source.data) : source.data\n      blob = new Blob([bytes], { type: mime })\n    }\n    form.append('file', blob, filename)\n\n    // File uploads can take a while (OCR, chunking, embedding) — give them\n    // room before timing out. 5 min cap matches the server's own\n    // processing budget.\n    return http.request<KnowledgeBaseFile>({\n      method: 'POST',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n      formData: form,\n      timeoutMs: 5 * 60 * 1000,\n    })\n  },\n\n  listFiles: async (kbId: string): Promise<KnowledgeBaseFile[]> => {\n    const res = await http.request<{ data: KnowledgeBaseFile[] }>({\n      method: 'GET',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n    })\n    return res.data\n  },\n\n  deleteFile: async (kbId: string, fileId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/knowledge-bases/${kbId}/files/${fileId}`,\n    }),\n})\n\nexport type KnowledgeBasesResource = ReturnType<typeof createKnowledgeBasesResource>\n","import type { HttpClient } from '../http'\nimport type { LedgerEntry } from '../types'\n\nexport const createCreditsResource = (http: HttpClient) => {\n  const credits = {\n    getBalance: async (): Promise<{ orgId: string; balanceCents: number }> =>\n      http.request<{ orgId: string; balanceCents: number }>({\n        method: 'GET',\n        path: '/v1/credits/balance',\n      }),\n\n    // Returns ledger entries newest-first. `limit` is capped at 500 server-side.\n    getLedger: async (opts: { limit?: number } = {}): Promise<LedgerEntry[]> => {\n      const res = await http.request<{ data: LedgerEntry[] }>({\n        method: 'GET',\n        path: '/v1/credits/ledger',\n        query: opts as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination scaffold — v1 server returns a single page up to\n    // limit=500. When cursor pagination lands this is where it gets wired.\n    getLedgerAll: async function* (opts: { limit?: number } = {}): AsyncIterable<LedgerEntry> {\n      const page = await credits.getLedger(opts)\n      for (const e of page) yield e\n    },\n  }\n  return credits\n}\n\nexport type CreditsResource = ReturnType<typeof createCreditsResource>\n","import type { HttpClient } from '../http'\nimport type { CallTokenMintInput, CallTokenMintResult, CallTokenSummary } from '../types'\n\n// Short-lived, agent-scoped `ct_` tokens. Mint one per user session on your\n// backend, hand the raw value to the browser; let this SDK handle lifecycle\n// (revoke on sign-out, list active tokens for an admin panel).\n\nexport const createCallTokensResource = (http: HttpClient) => ({\n  // Returns the RAW token value once. Don't log it; pass it straight to the\n  // browser + discard server-side. `tokenId` is the stable public handle\n  // used for revocation later.\n  mint: async (input: CallTokenMintInput): Promise<CallTokenMintResult> =>\n    http.request<CallTokenMintResult>({\n      method: 'POST',\n      path: '/v1/call-tokens',\n      body: input,\n    }),\n\n  // Live tokens only by default. Pass includeRevoked/includeExpired when\n  // debugging \"why did my token stop working\".\n  list: async (\n    opts: { includeRevoked?: boolean; includeExpired?: boolean; limit?: number } = {},\n  ): Promise<CallTokenSummary[]> => {\n    const query: Record<string, string | number | undefined> = {}\n    if (opts.includeRevoked) query.includeRevoked = '1'\n    if (opts.includeExpired) query.includeExpired = '1'\n    if (opts.limit !== undefined) query.limit = opts.limit\n    const res = await http.request<{ data: CallTokenSummary[] }>({\n      method: 'GET',\n      path: '/v1/call-tokens',\n      query,\n    })\n    return res.data\n  },\n\n  // Idempotent — re-revoking a revoked token returns `alreadyRevoked: true`.\n  revoke: async (\n    tokenId: string,\n  ): Promise<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }> =>\n    http.request<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }>({\n      method: 'DELETE',\n      path: `/v1/call-tokens/${tokenId}`,\n    }),\n})\n\nexport type CallTokensResource = ReturnType<typeof createCallTokensResource>\n","import type { HttpClient } from '../http'\nimport type { WebhookDelivery } from '../types'\n\n// Org-wide webhook delivery log. Per-agent CRUD lives on\n// `client.agents.webhooks(agentId)` — this namespace is just the\n// read-only deliveries surface that spans all agents.\n\nexport const createWebhooksResource = (http: HttpClient) => ({\n  deliveries: async (\n    filters: {\n      agentId?: string\n      webhookId?: string\n      callId?: string\n      limit?: number\n    } = {},\n  ): Promise<WebhookDelivery[]> => {\n    const res = await http.request<{ data: WebhookDelivery[] }>({\n      method: 'GET',\n      path: '/v1/webhooks/deliveries',\n      query: filters as Record<string, string | number | undefined>,\n    })\n    return res.data\n  },\n})\n\nexport type WebhooksResource = ReturnType<typeof createWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { CatalogAgent, CatalogListInput } from '../types'\n\n// Org-scoped consumer endpoints. Today this is just the agent catalog —\n// the trimmed shape your mobile app picks an agent from. Lives at\n// `/v1/orgs/:orgId/agents` rather than reusing the admin `/v1/agents/*`\n// tree on purpose: the catalog response intentionally excludes the\n// operator-only fields (system prompt, tools, KB IDs) so a leaked\n// consumer-backend `sk_` can't lift the operator config out of it.\n//\n// Pattern from your backend:\n//\n//   const client = new PlatformClient({ apiKey: process.env.SK })\n//   const visible = await client.orgs.listAgents({\n//     orgId: process.env.ORG_ID!,\n//     userTags: ['tier1'],   // omit to get the unfiltered admin view\n//   })\n//   res.json(visible)\n\nexport const createOrgsResource = (http: HttpClient) => ({\n  /**\n   * Fetch the agent catalog for an org. Returns the consumer-trimmed shape;\n   * no system prompt, tools, or KB info. Use `client.agents.get(agentId)`\n   * with the same `sk_` if you need the full admin shape.\n   *\n   * `userTags`: end-user entitlement tags. When supplied, hides agents\n   * whose `allowedUserTags` is non-empty and doesn't intersect with the\n   * supplied list. Omit to get the unfiltered admin view.\n   *\n   * Persona / category filtering is intentionally not a server param —\n   * filter the returned list client-side over `name`s if you need it.\n   *\n   * Throws `403 forbidden` if `orgId` doesn't match the key's org.\n   */\n  listAgents: async (input: CatalogListInput): Promise<CatalogAgent[]> => {\n    const query: Record<string, string | undefined> = {}\n    if (input.userTags && input.userTags.length > 0) query.userTags = input.userTags.join(',')\n    const res = await http.request<{ data: CatalogAgent[] }>({\n      method: 'GET',\n      path: `/v1/orgs/${input.orgId}/agents`,\n      query,\n    })\n    return res.data\n  },\n})\n\nexport type OrgsResource = ReturnType<typeof createOrgsResource>\n","import { createHttpClient, type HttpClientOptions } from './http'\nimport { createMeResource, type MeResource } from './resources/me'\nimport { createAgentsResource, type AgentsResource } from './resources/agents'\nimport { createCallsResource, type CallsResource } from './resources/calls'\nimport {\n  createKnowledgeBasesResource,\n  type KnowledgeBasesResource,\n} from './resources/knowledgeBases'\nimport { createCreditsResource, type CreditsResource } from './resources/credits'\nimport { createCallTokensResource, type CallTokensResource } from './resources/callTokens'\nimport { createWebhooksResource, type WebhooksResource } from './resources/webhooks'\nimport { createOrgsResource, type OrgsResource } from './resources/orgs'\n\nexport interface PlatformClientOptions {\n  // Full-org API key minted from the dashboard or bootstrap CLI. Start with\n  // `sk_`. Never ship to a browser — use `client.callTokens.mint(...)` to\n  // generate a narrow `ct_` token for client-side use instead.\n  apiKey: string\n  // Defaults to the hosted platform. Point at `http://localhost:8080` for\n  // local dev or at a self-hosted deployment.\n  baseUrl?: string\n  // Passthrough tuning for the HTTP layer.\n  timeoutMs?: number\n  maxRetries?: number\n  fetch?: HttpClientOptions['fetch']\n  onRequest?: HttpClientOptions['onRequest']\n}\n\n// Single entry point. All resources are lazy-constructed in the constructor\n// so their refs don't incur any per-call allocation. Shape mirrors Stripe /\n// Twilio / Vapi's `resource.method()` convention for familiarity.\nexport class PlatformClient {\n  readonly me: MeResource\n  readonly agents: AgentsResource\n  readonly calls: CallsResource\n  readonly knowledgeBases: KnowledgeBasesResource\n  readonly credits: CreditsResource\n  readonly callTokens: CallTokensResource\n  readonly webhooks: WebhooksResource\n  readonly orgs: OrgsResource\n\n  constructor(options: PlatformClientOptions) {\n    if (!options.apiKey) {\n      throw new Error('PlatformClient: `apiKey` is required')\n    }\n    const http = createHttpClient({\n      apiKey: options.apiKey,\n      baseUrl: options.baseUrl ?? 'https://api.example.com',\n      timeoutMs: options.timeoutMs,\n      maxRetries: options.maxRetries,\n      fetch: options.fetch,\n      onRequest: options.onRequest,\n    })\n\n    this.me = createMeResource(http)\n    this.agents = createAgentsResource(http)\n    this.calls = createCallsResource(http)\n    this.knowledgeBases = createKnowledgeBasesResource(http)\n    this.credits = createCreditsResource(http)\n    this.callTokens = createCallTokensResource(http)\n    this.webhooks = createWebhooksResource(http)\n    this.orgs = createOrgsResource(http)\n  }\n}\n","import crypto from 'node:crypto'\n\n// Helper for consumers receiving webhooks: verify the `X-Platform-Signature-256`\n// header against the raw body + secret. Plain function (not tied to\n// PlatformClient) so Express/Koa/Next.js middleware can use it without\n// instantiating a client.\n//\n//   import { verifyWebhookSignature } from '@craftedxp/sdk-node'\n//   app.post('/webhooks/voice-agent', express.raw({ type: 'application/json' }), (req, res) => {\n//     const sig = req.header('X-Platform-Signature-256') ?? ''\n//     if (!verifyWebhookSignature(req.body, sig, process.env.VOICE_AGENT_WEBHOOK_SECRET!)) {\n//       return res.status(401).send('invalid signature')\n//     }\n//     const event = JSON.parse(req.body.toString('utf8'))\n//     // ...handle event\n//   })\n//\n// The signature is `sha256=<hex HMAC-SHA256 of rawBody with secret>`.\n// Timing-safe compare to avoid microtiming side channels.\n\nexport const verifyWebhookSignature = (\n  rawBody: Buffer | string,\n  signatureHeader: string,\n  secret: string,\n): boolean => {\n  if (!signatureHeader || !secret) return false\n  const [algo, provided] = signatureHeader.split('=')\n  if (algo !== 'sha256' || !provided) return false\n\n  const expected = crypto\n    .createHmac('sha256', secret)\n    .update(typeof rawBody === 'string' ? rawBody : rawBody)\n    .digest('hex')\n\n  // Buffers must match in length for timingSafeEqual.\n  const a = Buffer.from(expected, 'hex')\n  const b = Buffer.from(provided, 'hex')\n  if (a.length !== b.length) return false\n  return crypto.timingSafeEqual(a, b)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBO,IAAM,gBAAN,MAAM,uBAAsB,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EAET,YAAY,QAOT;AACD,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,OAAO,OAAO;AAGnB,QACE,OAAQ,MAAyD,sBACjE,YACA;AACA;AAAC,MACC,MACA,kBAAkB,MAAM,cAAa;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,SAAkC;AAChC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AACF;;;ACtBA,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AAE5B,IAAM,WAAW,CAAC,SAAiBA,OAAc,UAAyC;AACxF,QAAM,IAAI,IAAI,IAAIA,OAAM,OAAO;AAC/B,MAAI,OAAO;AACT,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,MAAM,OAAW;AACrB,QAAE,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO,EAAE,SAAS;AACpB;AAEA,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAExE,IAAM,cAAc,CAAC,WAA4B,WAAW,OAAQ,UAAU,OAAO,SAAS;AAI9F,IAAM,oBAAoB,OAAO,QAA0C;AACzE,QAAM,WAAW,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAChD,MAAI,SAAkB;AACtB,MAAI;AACF,aAAS,WAAW,KAAK,MAAM,QAAQ,IAAI;AAAA,EAC7C,QAAQ;AAAA,EAGR;AACA,QAAM,SACJ,QACC;AACH,SAAO,IAAI,cAAc;AAAA,IACvB,MAAO,QAAQ,QAAyB;AAAA,IACxC,SAAS,QAAQ,WAAW,IAAI,cAAc,QAAQ,IAAI,MAAM;AAAA,IAChE,QAAQ,IAAI;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,MAAM,UAAU;AAAA,EAClB,CAAC;AACH;AAEO,IAAM,mBAAmB,CAAC,SAA4B;AAC3D,QAAM,YAAY,KAAK,SAAS,WAAW;AAC3C,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,aAAa,KAAK,cAAc;AAEtC,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAEA,QAAM,UAAU,OAAU,QAAiC;AACzD,UAAM,MAAM,SAAS,KAAK,SAAS,IAAI,MAAM,IAAI,KAAK;AACtD,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,QAAQ;AAAA,MACR,GAAI,IAAI,WAAW,CAAC;AAAA,IACtB;AAMA,QAAI;AACJ,QAAI,IAAI,UAAU;AAChB,aAAO,IAAI;AAAA,IACb,WAAW,IAAI,SAAS,QAAW;AACjC,cAAQ,cAAc,IAAI;AAC1B,aAAO,KAAK,UAAU,IAAI,IAAI;AAAA,IAChC;AAEA,UAAM,aAAa,IAAI,aAAa;AACpC,QAAI;AAEJ,aAAS,UAAU,GAAG,WAAW,YAAY,WAAW;AACtD,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,YAAM,UAAU,KAAK,IAAI;AACzB,UAAI;AACF,cAAM,MAAM,MAAM,UAAU,KAAK;AAAA,UAC/B,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA;AAAA,UACA,QAAQ,WAAW;AAAA,QACrB,CAAC;AACD,cAAM,aAAa,KAAK,IAAI,IAAI;AAChC,aAAK,YAAY;AAAA,UACf,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,SAAS,UAAU;AAAA,QACrB,CAAC;AAED,YAAI,IAAI,IAAI;AAEV,cAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,gBAAM,KAAK,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC9C,cAAI,GAAG,SAAS,kBAAkB,GAAG;AACnC,mBAAQ,MAAM,IAAI,KAAK;AAAA,UACzB;AAEA,iBAAQ,MAAM,IAAI,KAAK;AAAA,QACzB;AAGA,YAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,gBAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,gBAAM,UAAU,aAAa,OAAO,UAAU,IAAI,MAAO,MAAM,KAAK,IAAI,GAAG,OAAO;AAClF,gBAAM,MAAM,OAAO;AACnB;AAAA,QACF;AAEA,cAAM,MAAM,kBAAkB,GAAG;AAAA,MACnC,SAAS,KAAK;AACZ,YAAI,eAAe,cAAe,OAAM;AAExC,YAAI,UAAU,YAAY;AACxB,oBAAU;AACV,gBAAM,MAAM,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;AACtC;AAAA,QACF;AACA,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU;AACjD,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,kBAAkB,GAAG;AAAA,UAC9B,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAGA,UAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,2BAA2B;AAAA,EAClF;AAEA,SAAO,EAAE,QAAQ;AACnB;;;ACnLO,IAAM,mBAAmB,CAAC,UAAsB;AAAA;AAAA;AAAA,EAGrD,KAAK,YAAiC,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,SAAS,CAAC;AAClG;;;ACIO,IAAM,8BAA8B,CAAC,MAAkB,aAAqB;AAAA;AAAA;AAAA;AAAA,EAIjF,QAAQ,OAAO,UACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO;AAAA,IAC3B,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM,cAAc,OAAO;AAAA,IAC7B,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,cACV,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA,EAEH,QAAQ,OAAO,WAAmB,UAChC,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,IACjD,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,QAAQ,OAAO,cACb,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,MAAM,OAAO,cACX,KAAK,QAAyB;AAAA,IAC5B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AACL;;;AChDO,IAAM,uBAAuB,CAAC,SAAqB;AACxD,QAAM,SAAS;AAAA,IACb,QAAQ,OAAO,UACb,KAAK,QAAe,EAAE,QAAQ,QAAQ,MAAM,cAAc,MAAM,MAAM,CAAC;AAAA,IAEzE,MAAM,YAA8B;AAClC,YAAM,MAAM,MAAM,KAAK,QAA2B,EAAE,QAAQ,OAAO,MAAM,aAAa,CAAC;AACvF,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,mBAAyC;AAChD,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,YACV,KAAK,QAAe,EAAE,QAAQ,OAAO,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA,IAEtE,QAAQ,OAAO,SAAiB,UAC9B,KAAK,QAAe,EAAE,QAAQ,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,MAAM,CAAC;AAAA,IAErF,QAAQ,OAAO,YACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASxE,UAAU,CAAC,YACT,4BAA4B,MAAM,OAAO;AAAA,EAC7C;AACA,SAAO;AACT;;;ACvCO,IAAM,sBAAsB,CAAC,SAAqB;AACvD,QAAM,QAAQ;AAAA,IACZ,MAAM,OAAO,UAA2B,CAAC,MAA8B;AACrE,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,iBAAiB,UAA2B,CAAC,GAA+B;AACnF,YAAM,OAAO,MAAM,MAAM,KAAK,OAAO;AACrC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,WACV,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,aAAa,MAAM,GAAG,CAAC;AAAA,IAEzE,YAAY,OAAO,WACjB,KAAK,QAA0D;AAAA,MAC7D,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,IAKH,WAAW,OAAO,WAChB,KAAK,QAAkC;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAML;AACA,SAAO;AACT;;;ACrDA,qBAAe;AACf,uBAAiB;AAIV,IAAM,+BAA+B,CAAC,UAAsB;AAAA,EACjE,QAAQ,OAAO,SACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM,EAAE,KAAK;AAAA,EACf,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,SACV,KAAK,QAAuB,EAAE,QAAQ,OAAO,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA,EAEpF,QAAQ,OAAO,SACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,EAK9E,YAAY,OACV,MACA,WAG+B;AAC/B,UAAM,OAAO,IAAI,SAAS;AAC1B,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,UAAU,QAAQ;AACpB,YAAM,MAAM,MAAM,eAAAC,QAAG,SAAS,SAAS,OAAO,IAAI;AAClD,iBAAW,OAAO,YAAY,iBAAAC,QAAK,SAAS,OAAO,IAAI;AACvD,aAAO,OAAO,YAAY;AAC1B,aAAO,IAAI,KAAK,CAAC,IAAI,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACvD,OAAO;AACL,iBAAW,OAAO;AAClB,aAAO,OAAO,YAAY;AAC1B,YAAM,QAAQ,OAAO,gBAAgB,SAAS,IAAI,WAAW,OAAO,IAAI,IAAI,OAAO;AACnF,aAAO,IAAI,KAAK,CAAC,KAAK,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACzC;AACA,SAAK,OAAO,QAAQ,MAAM,QAAQ;AAKlC,WAAO,KAAK,QAA2B;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,WAAW,IAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,OAAO,SAA+C;AAC/D,UAAM,MAAM,MAAM,KAAK,QAAuC;AAAA,MAC5D,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,IACnC,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,YAAY,OAAO,MAAc,WAC/B,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,uBAAuB,IAAI,UAAU,MAAM;AAAA,EACnD,CAAC;AACL;;;AC3EO,IAAM,wBAAwB,CAAC,SAAqB;AACzD,QAAM,UAAU;AAAA,IACd,YAAY,YACV,KAAK,QAAiD;AAAA,MACpD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA;AAAA,IAGH,WAAW,OAAO,OAA2B,CAAC,MAA8B;AAC1E,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA,IAIA,cAAc,iBAAiB,OAA2B,CAAC,GAA+B;AACxF,YAAM,OAAO,MAAM,QAAQ,UAAU,IAAI;AACzC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,EACF;AACA,SAAO;AACT;;;ACtBO,IAAM,2BAA2B,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA,EAI7D,MAAM,OAAO,UACX,KAAK,QAA6B;AAAA,IAChC,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAAA;AAAA;AAAA,EAIH,MAAM,OACJ,OAA+E,CAAC,MAChD;AAChC,UAAM,QAAqD,CAAC;AAC5D,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,UAAM,MAAM,MAAM,KAAK,QAAsC;AAAA,MAC3D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA;AAAA,EAGA,QAAQ,OACN,YAEA,KAAK,QAAyE;AAAA,IAC5E,QAAQ;AAAA,IACR,MAAM,mBAAmB,OAAO;AAAA,EAClC,CAAC;AACL;;;ACpCO,IAAM,yBAAyB,CAAC,UAAsB;AAAA,EAC3D,YAAY,OACV,UAKI,CAAC,MAC0B;AAC/B,UAAM,MAAM,MAAM,KAAK,QAAqC;AAAA,MAC1D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACJO,IAAM,qBAAqB,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAevD,YAAY,OAAO,UAAqD;AACtE,UAAM,QAA4C,CAAC;AACnD,QAAI,MAAM,YAAY,MAAM,SAAS,SAAS,EAAG,OAAM,WAAW,MAAM,SAAS,KAAK,GAAG;AACzF,UAAM,MAAM,MAAM,KAAK,QAAkC;AAAA,MACvD,QAAQ;AAAA,MACR,MAAM,YAAY,MAAM,KAAK;AAAA,MAC7B;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACbO,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAgC;AAC1C,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,UAAM,OAAO,iBAAiB;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ,WAAW;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,MACpB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,IACrB,CAAC;AAED,SAAK,KAAK,iBAAiB,IAAI;AAC/B,SAAK,SAAS,qBAAqB,IAAI;AACvC,SAAK,QAAQ,oBAAoB,IAAI;AACrC,SAAK,iBAAiB,6BAA6B,IAAI;AACvD,SAAK,UAAU,sBAAsB,IAAI;AACzC,SAAK,aAAa,yBAAyB,IAAI;AAC/C,SAAK,WAAW,uBAAuB,IAAI;AAC3C,SAAK,OAAO,mBAAmB,IAAI;AAAA,EACrC;AACF;;;AC/DA,yBAAmB;AAoBZ,IAAM,yBAAyB,CACpC,SACA,iBACA,WACY;AACZ,MAAI,CAAC,mBAAmB,CAAC,OAAQ,QAAO;AACxC,QAAM,CAAC,MAAM,QAAQ,IAAI,gBAAgB,MAAM,GAAG;AAClD,MAAI,SAAS,YAAY,CAAC,SAAU,QAAO;AAE3C,QAAM,WAAW,mBAAAC,QACd,WAAW,UAAU,MAAM,EAC3B,OAAO,OAAO,YAAY,WAAW,UAAU,OAAO,EACtD,OAAO,KAAK;AAGf,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,mBAAAA,QAAO,gBAAgB,GAAG,CAAC;AACpC;","names":["path","fs","path","crypto"]}

package/dist/index.mjs

@@ -394,17 +394,17 @@ var createOrgsResource = (http) => ({
    * no system prompt, tools, or KB info. Use `client.agents.get(agentId)`
    * with the same `sk_` if you need the full admin shape.
    *
-   * Filters:
-   *   - `tags`: OR-match on persona tags. Empty = all.
-   *   - `userTags`: tier gate. Hides agents whose `allowedUserTags` is
-   *     non-empty and doesn't intersect. Omit to skip the gate filter
-   *     (admin / dashboard usage).
+   * `userTags`: end-user entitlement tags. When supplied, hides agents
+   * whose `allowedUserTags` is non-empty and doesn't intersect with the
+   * supplied list. Omit to get the unfiltered admin view.
+   *
+   * Persona / category filtering is intentionally not a server param —
+   * filter the returned list client-side over `name`s if you need it.
    *
    * Throws `403 forbidden` if `orgId` doesn't match the key's org.
    */
   listAgents: async (input) => {
     const query = {};
-    if (input.tags && input.tags.length > 0) query.tags = input.tags.join(",");
     if (input.userTags && input.userTags.length > 0) query.userTags = input.userTags.join(",");
     const res = await http.request({
       method: "GET",

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/http.ts","../src/resources/me.ts","../src/resources/agentWebhooks.ts","../src/resources/agents.ts","../src/resources/calls.ts","../src/resources/knowledgeBases.ts","../src/resources/credits.ts","../src/resources/callTokens.ts","../src/resources/webhooks.ts","../src/resources/orgs.ts","../src/PlatformClient.ts","../src/verify.ts"],"sourcesContent":["// Typed error class mirroring the server's ErrorV1 shape:\n//   { error: { code, message, field?, docs_url? } }\n//\n// Consumers do `err instanceof PlatformError` to branch on code without\n// parsing string messages. `status` carries the HTTP code for the 1% of\n// cases where the code field isn't enough (e.g. rate-limit → retry-after\n// header correlation).\n\nexport type ApiErrorCode =\n  | 'unauthorized'\n  | 'forbidden'\n  | 'not_found'\n  | 'bad_request'\n  | 'conflict'\n  | 'rate_limited'\n  | 'payment_required'\n  | 'internal_error'\n  | 'unknown'\n\nexport class PlatformError extends Error {\n  readonly code: ApiErrorCode\n  readonly status: number\n  readonly field?: string\n  readonly docsUrl?: string\n  // The raw response body for debugging. Intentionally optional — we clear\n  // it on `error.toJSON()` so logging libraries don't dump the whole\n  // server response into production logs.\n  readonly body?: unknown\n\n  constructor(params: {\n    code: ApiErrorCode\n    message: string\n    status: number\n    field?: string\n    docsUrl?: string\n    body?: unknown\n  }) {\n    super(params.message)\n    this.name = 'PlatformError'\n    this.code = params.code\n    this.status = params.status\n    this.field = params.field\n    this.docsUrl = params.docsUrl\n    this.body = params.body\n    // Preserve the stack trace — Node's Error doesn't capture it\n    // automatically when subclassing in some older runtimes.\n    if (\n      typeof (Error as typeof Error & { captureStackTrace?: unknown }).captureStackTrace ===\n      'function'\n    ) {\n      ;(\n        Error as typeof Error & { captureStackTrace: (target: unknown, ctor: unknown) => void }\n      ).captureStackTrace(this, PlatformError)\n    }\n  }\n\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      field: this.field,\n      docsUrl: this.docsUrl,\n    }\n  }\n}\n","import { PlatformError, type ApiErrorCode } from './errors'\n\n// Low-level HTTP wrapper around `fetch` (native in Node 18+). Every resource\n// method routes through here for consistent auth + error handling + retries.\n//\n// v1 scope: JSON-in / JSON-out + multipart for file uploads. No streaming —\n// call WebSockets go through @craftedxp/voice-rn (the React Native client)\n// or a web equivalent, not this server-side SDK.\n\nexport interface HttpClientOptions {\n  apiKey: string\n  baseUrl: string\n  // Default 30s. File uploads can override per-request.\n  timeoutMs?: number\n  // 429 + 5xx retries. Defaults to 3 attempts (original + 2 retries) with\n  // exponential backoff (250ms, 1s). Set to 0 to disable.\n  maxRetries?: number\n  // Optional — lets consumers swap in a test/mock fetch (or a custom one\n  // with instrumentation). Defaults to the global.\n  fetch?: typeof fetch\n  // Optional — a callback that fires per-request with the final status and\n  // duration. Handy for dropping traces into the consumer's observability\n  // stack without wrapping each call.\n  onRequest?: (info: {\n    method: string\n    url: string\n    status: number\n    durationMs: number\n    attempt: number\n  }) => void\n}\n\nexport interface HttpRequest {\n  method: 'GET' | 'POST' | 'PATCH' | 'DELETE'\n  path: string // starts with `/`, e.g. `/v1/agents/123`\n  query?: Record<string, string | number | boolean | undefined>\n  body?: unknown // JSON-serialised — for multipart use `formData`\n  formData?: FormData\n  timeoutMs?: number\n  // Exposed for edge cases where a resource wants to tack on extra\n  // headers (we don't have any today but leave the hook).\n  headers?: Record<string, string>\n}\n\nconst DEFAULT_TIMEOUT_MS = 30_000\nconst DEFAULT_MAX_RETRIES = 2 // total attempts = 3\n\nconst buildUrl = (baseUrl: string, path: string, query?: HttpRequest['query']): string => {\n  const u = new URL(path, baseUrl)\n  if (query) {\n    for (const [k, v] of Object.entries(query)) {\n      if (v === undefined) continue\n      u.searchParams.set(k, String(v))\n    }\n  }\n  return u.toString()\n}\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\nconst isRetryable = (status: number): boolean => status === 429 || (status >= 500 && status < 600)\n\n// Parse whatever the server returned into a PlatformError. Falls back to\n// synthesising a sensible error for non-JSON responses.\nconst errorFromResponse = async (res: Response): Promise<PlatformError> => {\n  const bodyText = await res.text().catch(() => '')\n  let parsed: unknown = undefined\n  try {\n    parsed = bodyText ? JSON.parse(bodyText) : undefined\n  } catch {\n    // non-JSON response (e.g. an HTML error page from a proxy). Fall\n    // through with parsed = undefined.\n  }\n  const errObj = (\n    parsed as { error?: { code?: string; message?: string; field?: string; docs_url?: string } }\n  )?.error\n  return new PlatformError({\n    code: (errObj?.code as ApiErrorCode) ?? 'unknown',\n    message: errObj?.message ?? res.statusText ?? `HTTP ${res.status}`,\n    status: res.status,\n    field: errObj?.field,\n    docsUrl: errObj?.docs_url,\n    body: parsed ?? bodyText,\n  })\n}\n\nexport const createHttpClient = (opts: HttpClientOptions) => {\n  const fetchImpl = opts.fetch ?? globalThis.fetch\n  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS\n  const maxRetries = opts.maxRetries ?? DEFAULT_MAX_RETRIES\n\n  if (!fetchImpl) {\n    throw new Error('No global fetch available. @craftedxp/sdk-node requires Node >= 18.')\n  }\n\n  const request = async <T>(req: HttpRequest): Promise<T> => {\n    const url = buildUrl(opts.baseUrl, req.path, req.query)\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${opts.apiKey}`,\n      Accept: 'application/json',\n      ...(req.headers ?? {}),\n    }\n\n    // Body shaping: prefer formData when provided; otherwise JSON.\n    // `FormData` sets its own Content-Type with boundary — don't preempt it.\n    // Typed as `string | FormData | undefined` (a subset of the global\n    // BodyInit) so we don't need DOM lib types in this server-side SDK.\n    let body: string | FormData | undefined\n    if (req.formData) {\n      body = req.formData\n    } else if (req.body !== undefined) {\n      headers['Content-Type'] = 'application/json'\n      body = JSON.stringify(req.body)\n    }\n\n    const reqTimeout = req.timeoutMs ?? timeoutMs\n    let lastErr: unknown\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      const controller = new AbortController()\n      const timer = setTimeout(() => controller.abort(), reqTimeout)\n      const started = Date.now()\n      try {\n        const res = await fetchImpl(url, {\n          method: req.method,\n          headers,\n          body,\n          signal: controller.signal,\n        })\n        const durationMs = Date.now() - started\n        opts.onRequest?.({\n          method: req.method,\n          url,\n          status: res.status,\n          durationMs,\n          attempt: attempt + 1,\n        })\n\n        if (res.ok) {\n          // 204 No Content — some endpoints (DELETE webhooks) return nothing.\n          if (res.status === 204) return undefined as T\n          const ct = res.headers.get('content-type') ?? ''\n          if (ct.includes('application/json')) {\n            return (await res.json()) as T\n          }\n          // Non-JSON 2xx — rare. Return raw text cast as T.\n          return (await res.text()) as unknown as T\n        }\n\n        // Retryable error: back off + retry up to maxRetries.\n        if (isRetryable(res.status) && attempt < maxRetries) {\n          const retryAfter = res.headers.get('Retry-After')\n          const backoff = retryAfter ? Number(retryAfter) * 1000 : 250 * Math.pow(2, attempt)\n          await sleep(backoff)\n          continue\n        }\n\n        throw await errorFromResponse(res)\n      } catch (err) {\n        if (err instanceof PlatformError) throw err\n        // AbortError / network / DNS failures — retry up to maxRetries.\n        if (attempt < maxRetries) {\n          lastErr = err\n          await sleep(250 * Math.pow(2, attempt))\n          continue\n        }\n        const msg = err instanceof Error ? err.message : 'network error'\n        throw new PlatformError({\n          code: 'unknown',\n          message: `Network error: ${msg}`,\n          status: 0,\n        })\n      } finally {\n        clearTimeout(timer)\n      }\n    }\n\n    // Should be unreachable — the loop either returns, throws, or continues.\n    throw lastErr instanceof Error ? lastErr : new Error('request exhausted retries')\n  }\n\n  return { request }\n}\n\nexport type HttpClient = ReturnType<typeof createHttpClient>\n","import type { HttpClient } from '../http'\nimport type { MeResponse } from '../types'\n\nexport const createMeResource = (http: HttpClient) => ({\n  // Smoke test — confirms the API key is valid and returns the org + balance.\n  // Most consumers use this as a ping on startup.\n  get: async (): Promise<MeResponse> => http.request<MeResponse>({ method: 'GET', path: '/v1/me' }),\n})\n\nexport type MeResource = ReturnType<typeof createMeResource>\n","import type { HttpClient } from '../http'\nimport type {\n  WebhookConfig,\n  WebhookCreateInput,\n  WebhookDelivery,\n  WebhookUpdateInput,\n} from '../types'\n\n// Per-agent webhook resource, scoped at factory time to a specific agentId.\n// All endpoints mirror /v1/agents/:agentId/webhooks[/:id].\n\nexport const createAgentWebhooksResource = (http: HttpClient, agentId: string) => ({\n  // Returns the webhook + its signing secret. The secret is only present in\n  // this response — persist immediately, subsequent GETs omit it. Use the\n  // secret to verify `X-Platform-Signature-256` (sha256=hex HMAC over body).\n  create: async (input: WebhookCreateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks`,\n      body: input,\n    }),\n\n  list: async (): Promise<WebhookConfig[]> => {\n    const res = await http.request<{ data: WebhookConfig[] }>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks`,\n    })\n    return res.data\n  },\n\n  get: async (webhookId: string): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  update: async (webhookId: string, patch: WebhookUpdateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'PATCH',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n      body: patch,\n    }),\n\n  delete: async (webhookId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  // Fires a synthetic call.started against this webhook and returns the\n  // full delivery record (including attempt status codes) once the retry\n  // sequence has finished. Useful during setup to verify receiver wiring.\n  test: async (webhookId: string): Promise<WebhookDelivery> =>\n    http.request<WebhookDelivery>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}/test`,\n    }),\n})\n\nexport type AgentWebhooksResource = ReturnType<typeof createAgentWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { Agent, AgentCreateInput, AgentUpdateInput } from '../types'\nimport { createAgentWebhooksResource, type AgentWebhooksResource } from './agentWebhooks'\n\n// The server returns Agent with `apiKey` stripped and `hasApiKey: boolean`\n// on the model. We type the happy path but keep our input type permissive\n// so consumers can POST a plaintext `apiKey` that the server encrypts +\n// swaps for `apiKeySecret` on persistence.\n\nexport const createAgentsResource = (http: HttpClient) => {\n  const agents = {\n    create: async (input: AgentCreateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'POST', path: '/v1/agents', body: input }),\n\n    list: async (): Promise<Agent[]> => {\n      const res = await http.request<{ data: Agent[] }>({ method: 'GET', path: '/v1/agents' })\n      return res.data\n    },\n\n    // Async iterator for \"give me every agent\" — v1 server returns the full\n    // list in one page, so this is just a thin convenience. When the server\n    // picks up cursor pagination, this is the method that papers over that\n    // migration without consumer changes.\n    listAll: async function* (): AsyncIterable<Agent> {\n      const page = await agents.list()\n      for (const a of page) yield a\n    },\n\n    get: async (agentId: string): Promise<Agent> =>\n      http.request<Agent>({ method: 'GET', path: `/v1/agents/${agentId}` }),\n\n    update: async (agentId: string, patch: AgentUpdateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'PATCH', path: `/v1/agents/${agentId}`, body: patch }),\n\n    delete: async (agentId: string): Promise<void> =>\n      http.request<void>({ method: 'DELETE', path: `/v1/agents/${agentId}` }),\n\n    // Nested resource. Per-agent webhook CRUD lives at\n    // /v1/agents/:agentId/webhooks/* — we expose it as a factory keyed on\n    // agentId so consumers can bind once and reuse:\n    //\n    //   const hooks = client.agents.webhooks(myAgentId)\n    //   await hooks.create({ url, events })\n    //   await hooks.list()\n    webhooks: (agentId: string): AgentWebhooksResource =>\n      createAgentWebhooksResource(http, agentId),\n  }\n  return agents\n}\n\nexport type AgentsResource = ReturnType<typeof createAgentsResource>\n","import type { HttpClient } from '../http'\nimport type {\n  CallListFilters,\n  CallRecord,\n  CallRecordingUrlResponse,\n  CallSummary,\n  TranscriptTurn,\n} from '../types'\n\nexport const createCallsResource = (http: HttpClient) => {\n  const calls = {\n    list: async (filters: CallListFilters = {}): Promise<CallSummary[]> => {\n      const res = await http.request<{ data: CallSummary[] }>({\n        method: 'GET',\n        path: '/v1/calls',\n        query: filters as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination helper. v1 server caps at limit (max 200) in a single\n    // page — consumers who ask for \"every call since X\" get that page, the\n    // iterator ends. This is the shape we'd extend with cursor support\n    // without breaking callers.\n    listAll: async function* (filters: CallListFilters = {}): AsyncIterable<CallSummary> {\n      const page = await calls.list(filters)\n      for (const c of page) yield c\n    },\n\n    get: async (callId: string): Promise<CallRecord> =>\n      http.request<CallRecord>({ method: 'GET', path: `/v1/calls/${callId}` }),\n\n    transcript: async (callId: string): Promise<{ callId: string; transcript: TranscriptTurn[] }> =>\n      http.request<{ callId: string; transcript: TranscriptTurn[] }>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/transcript`,\n      }),\n\n    // Returns a V4 signed URL (1-hour TTL). `ready: false` + `artifact:\n    // 'caller-raw'` means the async mix job hasn't finished — the URL still\n    // points at a playable file (raw caller PCM).\n    recording: async (callId: string): Promise<CallRecordingUrlResponse> =>\n      http.request<CallRecordingUrlResponse>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/recording`,\n      }),\n\n    // Outbound dialling (POST /v1/calls) + in-call control are Phase 1.4.4 /\n    // 1.4.5 respectively — blocked on telephony. Surface clear \"not built\n    // yet\" errors here if consumers guess those method names, so they don't\n    // silently hit a non-existent endpoint and wonder why it 404s.\n  }\n  return calls\n}\n\nexport type CallsResource = ReturnType<typeof createCallsResource>\n","import fs from 'node:fs'\nimport path from 'node:path'\nimport type { HttpClient } from '../http'\nimport type { KnowledgeBase, KnowledgeBaseFile } from '../types'\n\nexport const createKnowledgeBasesResource = (http: HttpClient) => ({\n  create: async (name: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({\n      method: 'POST',\n      path: '/v1/knowledge-bases',\n      body: { name },\n    }),\n\n  list: async (): Promise<KnowledgeBase[]> => {\n    const res = await http.request<{ data: KnowledgeBase[] }>({\n      method: 'GET',\n      path: '/v1/knowledge-bases',\n    })\n    return res.data\n  },\n\n  get: async (kbId: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({ method: 'GET', path: `/v1/knowledge-bases/${kbId}` }),\n\n  delete: async (kbId: string): Promise<void> =>\n    http.request<void>({ method: 'DELETE', path: `/v1/knowledge-bases/${kbId}` }),\n\n  // File upload — accepts either a local file path OR raw bytes + filename.\n  // The server ingests synchronously today (Phase 3.1.4 Cloud Tasks is a\n  // followup), so the returned file has status='ready' in most cases.\n  uploadFile: async (\n    kbId: string,\n    source:\n      | { path: string; filename?: string; mimeType?: string }\n      | { data: Buffer | Uint8Array; filename: string; mimeType?: string },\n  ): Promise<KnowledgeBaseFile> => {\n    const form = new FormData()\n    let blob: Blob\n    let filename: string\n    let mime: string\n\n    if ('path' in source) {\n      const buf = await fs.promises.readFile(source.path)\n      filename = source.filename ?? path.basename(source.path)\n      mime = source.mimeType ?? 'application/octet-stream'\n      blob = new Blob([new Uint8Array(buf)], { type: mime })\n    } else {\n      filename = source.filename\n      mime = source.mimeType ?? 'application/octet-stream'\n      const bytes = source.data instanceof Buffer ? new Uint8Array(source.data) : source.data\n      blob = new Blob([bytes], { type: mime })\n    }\n    form.append('file', blob, filename)\n\n    // File uploads can take a while (OCR, chunking, embedding) — give them\n    // room before timing out. 5 min cap matches the server's own\n    // processing budget.\n    return http.request<KnowledgeBaseFile>({\n      method: 'POST',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n      formData: form,\n      timeoutMs: 5 * 60 * 1000,\n    })\n  },\n\n  listFiles: async (kbId: string): Promise<KnowledgeBaseFile[]> => {\n    const res = await http.request<{ data: KnowledgeBaseFile[] }>({\n      method: 'GET',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n    })\n    return res.data\n  },\n\n  deleteFile: async (kbId: string, fileId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/knowledge-bases/${kbId}/files/${fileId}`,\n    }),\n})\n\nexport type KnowledgeBasesResource = ReturnType<typeof createKnowledgeBasesResource>\n","import type { HttpClient } from '../http'\nimport type { LedgerEntry } from '../types'\n\nexport const createCreditsResource = (http: HttpClient) => {\n  const credits = {\n    getBalance: async (): Promise<{ orgId: string; balanceCents: number }> =>\n      http.request<{ orgId: string; balanceCents: number }>({\n        method: 'GET',\n        path: '/v1/credits/balance',\n      }),\n\n    // Returns ledger entries newest-first. `limit` is capped at 500 server-side.\n    getLedger: async (opts: { limit?: number } = {}): Promise<LedgerEntry[]> => {\n      const res = await http.request<{ data: LedgerEntry[] }>({\n        method: 'GET',\n        path: '/v1/credits/ledger',\n        query: opts as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination scaffold — v1 server returns a single page up to\n    // limit=500. When cursor pagination lands this is where it gets wired.\n    getLedgerAll: async function* (opts: { limit?: number } = {}): AsyncIterable<LedgerEntry> {\n      const page = await credits.getLedger(opts)\n      for (const e of page) yield e\n    },\n  }\n  return credits\n}\n\nexport type CreditsResource = ReturnType<typeof createCreditsResource>\n","import type { HttpClient } from '../http'\nimport type { CallTokenMintInput, CallTokenMintResult, CallTokenSummary } from '../types'\n\n// Short-lived, agent-scoped `ct_` tokens. Mint one per user session on your\n// backend, hand the raw value to the browser; let this SDK handle lifecycle\n// (revoke on sign-out, list active tokens for an admin panel).\n\nexport const createCallTokensResource = (http: HttpClient) => ({\n  // Returns the RAW token value once. Don't log it; pass it straight to the\n  // browser + discard server-side. `tokenId` is the stable public handle\n  // used for revocation later.\n  mint: async (input: CallTokenMintInput): Promise<CallTokenMintResult> =>\n    http.request<CallTokenMintResult>({\n      method: 'POST',\n      path: '/v1/call-tokens',\n      body: input,\n    }),\n\n  // Live tokens only by default. Pass includeRevoked/includeExpired when\n  // debugging \"why did my token stop working\".\n  list: async (\n    opts: { includeRevoked?: boolean; includeExpired?: boolean; limit?: number } = {},\n  ): Promise<CallTokenSummary[]> => {\n    const query: Record<string, string | number | undefined> = {}\n    if (opts.includeRevoked) query.includeRevoked = '1'\n    if (opts.includeExpired) query.includeExpired = '1'\n    if (opts.limit !== undefined) query.limit = opts.limit\n    const res = await http.request<{ data: CallTokenSummary[] }>({\n      method: 'GET',\n      path: '/v1/call-tokens',\n      query,\n    })\n    return res.data\n  },\n\n  // Idempotent — re-revoking a revoked token returns `alreadyRevoked: true`.\n  revoke: async (\n    tokenId: string,\n  ): Promise<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }> =>\n    http.request<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }>({\n      method: 'DELETE',\n      path: `/v1/call-tokens/${tokenId}`,\n    }),\n})\n\nexport type CallTokensResource = ReturnType<typeof createCallTokensResource>\n","import type { HttpClient } from '../http'\nimport type { WebhookDelivery } from '../types'\n\n// Org-wide webhook delivery log. Per-agent CRUD lives on\n// `client.agents.webhooks(agentId)` — this namespace is just the\n// read-only deliveries surface that spans all agents.\n\nexport const createWebhooksResource = (http: HttpClient) => ({\n  deliveries: async (\n    filters: {\n      agentId?: string\n      webhookId?: string\n      callId?: string\n      limit?: number\n    } = {},\n  ): Promise<WebhookDelivery[]> => {\n    const res = await http.request<{ data: WebhookDelivery[] }>({\n      method: 'GET',\n      path: '/v1/webhooks/deliveries',\n      query: filters as Record<string, string | number | undefined>,\n    })\n    return res.data\n  },\n})\n\nexport type WebhooksResource = ReturnType<typeof createWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { CatalogAgent, CatalogListInput } from '../types'\n\n// Org-scoped consumer endpoints. Today this is just the agent catalog —\n// the trimmed shape your mobile app picks an agent from. Lives at\n// `/v1/orgs/:orgId/agents` rather than reusing the admin `/v1/agents/*`\n// tree on purpose: the catalog response intentionally excludes the\n// operator-only fields (system prompt, tools, KB IDs) so a leaked\n// consumer-backend `sk_` can't lift the operator config out of it.\n//\n// Pattern from your backend:\n//\n//   const client = new PlatformClient({ apiKey: process.env.SK })\n//   const free = await client.orgs.listAgents({\n//     orgId: process.env.ORG_ID!,\n//     userTags: ['free'],         // hide premium agents from free users\n//   })\n//   res.json(free)\n//\n// Or with persona filtering:\n//\n//   const secretaries = await client.orgs.listAgents({\n//     orgId: process.env.ORG_ID!,\n//     tags: ['secretary'],\n//     userTags: ['paying'],\n//   })\n\nexport const createOrgsResource = (http: HttpClient) => ({\n  /**\n   * Fetch the agent catalog for an org. Returns the consumer-trimmed shape;\n   * no system prompt, tools, or KB info. Use `client.agents.get(agentId)`\n   * with the same `sk_` if you need the full admin shape.\n   *\n   * Filters:\n   *   - `tags`: OR-match on persona tags. Empty = all.\n   *   - `userTags`: tier gate. Hides agents whose `allowedUserTags` is\n   *     non-empty and doesn't intersect. Omit to skip the gate filter\n   *     (admin / dashboard usage).\n   *\n   * Throws `403 forbidden` if `orgId` doesn't match the key's org.\n   */\n  listAgents: async (input: CatalogListInput): Promise<CatalogAgent[]> => {\n    const query: Record<string, string | undefined> = {}\n    if (input.tags && input.tags.length > 0) query.tags = input.tags.join(',')\n    if (input.userTags && input.userTags.length > 0) query.userTags = input.userTags.join(',')\n    const res = await http.request<{ data: CatalogAgent[] }>({\n      method: 'GET',\n      path: `/v1/orgs/${input.orgId}/agents`,\n      query,\n    })\n    return res.data\n  },\n})\n\nexport type OrgsResource = ReturnType<typeof createOrgsResource>\n","import { createHttpClient, type HttpClientOptions } from './http'\nimport { createMeResource, type MeResource } from './resources/me'\nimport { createAgentsResource, type AgentsResource } from './resources/agents'\nimport { createCallsResource, type CallsResource } from './resources/calls'\nimport {\n  createKnowledgeBasesResource,\n  type KnowledgeBasesResource,\n} from './resources/knowledgeBases'\nimport { createCreditsResource, type CreditsResource } from './resources/credits'\nimport { createCallTokensResource, type CallTokensResource } from './resources/callTokens'\nimport { createWebhooksResource, type WebhooksResource } from './resources/webhooks'\nimport { createOrgsResource, type OrgsResource } from './resources/orgs'\n\nexport interface PlatformClientOptions {\n  // Full-org API key minted from the dashboard or bootstrap CLI. Start with\n  // `sk_`. Never ship to a browser — use `client.callTokens.mint(...)` to\n  // generate a narrow `ct_` token for client-side use instead.\n  apiKey: string\n  // Defaults to the hosted platform. Point at `http://localhost:8080` for\n  // local dev or at a self-hosted deployment.\n  baseUrl?: string\n  // Passthrough tuning for the HTTP layer.\n  timeoutMs?: number\n  maxRetries?: number\n  fetch?: HttpClientOptions['fetch']\n  onRequest?: HttpClientOptions['onRequest']\n}\n\n// Single entry point. All resources are lazy-constructed in the constructor\n// so their refs don't incur any per-call allocation. Shape mirrors Stripe /\n// Twilio / Vapi's `resource.method()` convention for familiarity.\nexport class PlatformClient {\n  readonly me: MeResource\n  readonly agents: AgentsResource\n  readonly calls: CallsResource\n  readonly knowledgeBases: KnowledgeBasesResource\n  readonly credits: CreditsResource\n  readonly callTokens: CallTokensResource\n  readonly webhooks: WebhooksResource\n  readonly orgs: OrgsResource\n\n  constructor(options: PlatformClientOptions) {\n    if (!options.apiKey) {\n      throw new Error('PlatformClient: `apiKey` is required')\n    }\n    const http = createHttpClient({\n      apiKey: options.apiKey,\n      baseUrl: options.baseUrl ?? 'https://api.example.com',\n      timeoutMs: options.timeoutMs,\n      maxRetries: options.maxRetries,\n      fetch: options.fetch,\n      onRequest: options.onRequest,\n    })\n\n    this.me = createMeResource(http)\n    this.agents = createAgentsResource(http)\n    this.calls = createCallsResource(http)\n    this.knowledgeBases = createKnowledgeBasesResource(http)\n    this.credits = createCreditsResource(http)\n    this.callTokens = createCallTokensResource(http)\n    this.webhooks = createWebhooksResource(http)\n    this.orgs = createOrgsResource(http)\n  }\n}\n","import crypto from 'node:crypto'\n\n// Helper for consumers receiving webhooks: verify the `X-Platform-Signature-256`\n// header against the raw body + secret. Plain function (not tied to\n// PlatformClient) so Express/Koa/Next.js middleware can use it without\n// instantiating a client.\n//\n//   import { verifyWebhookSignature } from '@craftedxp/sdk-node'\n//   app.post('/webhooks/voice-agent', express.raw({ type: 'application/json' }), (req, res) => {\n//     const sig = req.header('X-Platform-Signature-256') ?? ''\n//     if (!verifyWebhookSignature(req.body, sig, process.env.VOICE_AGENT_WEBHOOK_SECRET!)) {\n//       return res.status(401).send('invalid signature')\n//     }\n//     const event = JSON.parse(req.body.toString('utf8'))\n//     // ...handle event\n//   })\n//\n// The signature is `sha256=<hex HMAC-SHA256 of rawBody with secret>`.\n// Timing-safe compare to avoid microtiming side channels.\n\nexport const verifyWebhookSignature = (\n  rawBody: Buffer | string,\n  signatureHeader: string,\n  secret: string,\n): boolean => {\n  if (!signatureHeader || !secret) return false\n  const [algo, provided] = signatureHeader.split('=')\n  if (algo !== 'sha256' || !provided) return false\n\n  const expected = crypto\n    .createHmac('sha256', secret)\n    .update(typeof rawBody === 'string' ? rawBody : rawBody)\n    .digest('hex')\n\n  // Buffers must match in length for timingSafeEqual.\n  const a = Buffer.from(expected, 'hex')\n  const b = Buffer.from(provided, 'hex')\n  if (a.length !== b.length) return false\n  return crypto.timingSafeEqual(a, b)\n}\n"],"mappings":";AAmBO,IAAM,gBAAN,MAAM,uBAAsB,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EAET,YAAY,QAOT;AACD,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,OAAO,OAAO;AAGnB,QACE,OAAQ,MAAyD,sBACjE,YACA;AACA;AAAC,MACC,MACA,kBAAkB,MAAM,cAAa;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,SAAkC;AAChC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AACF;;;ACtBA,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AAE5B,IAAM,WAAW,CAAC,SAAiBA,OAAc,UAAyC;AACxF,QAAM,IAAI,IAAI,IAAIA,OAAM,OAAO;AAC/B,MAAI,OAAO;AACT,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,MAAM,OAAW;AACrB,QAAE,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO,EAAE,SAAS;AACpB;AAEA,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAExE,IAAM,cAAc,CAAC,WAA4B,WAAW,OAAQ,UAAU,OAAO,SAAS;AAI9F,IAAM,oBAAoB,OAAO,QAA0C;AACzE,QAAM,WAAW,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAChD,MAAI,SAAkB;AACtB,MAAI;AACF,aAAS,WAAW,KAAK,MAAM,QAAQ,IAAI;AAAA,EAC7C,QAAQ;AAAA,EAGR;AACA,QAAM,SACJ,QACC;AACH,SAAO,IAAI,cAAc;AAAA,IACvB,MAAO,QAAQ,QAAyB;AAAA,IACxC,SAAS,QAAQ,WAAW,IAAI,cAAc,QAAQ,IAAI,MAAM;AAAA,IAChE,QAAQ,IAAI;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,MAAM,UAAU;AAAA,EAClB,CAAC;AACH;AAEO,IAAM,mBAAmB,CAAC,SAA4B;AAC3D,QAAM,YAAY,KAAK,SAAS,WAAW;AAC3C,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,aAAa,KAAK,cAAc;AAEtC,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAEA,QAAM,UAAU,OAAU,QAAiC;AACzD,UAAM,MAAM,SAAS,KAAK,SAAS,IAAI,MAAM,IAAI,KAAK;AACtD,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,QAAQ;AAAA,MACR,GAAI,IAAI,WAAW,CAAC;AAAA,IACtB;AAMA,QAAI;AACJ,QAAI,IAAI,UAAU;AAChB,aAAO,IAAI;AAAA,IACb,WAAW,IAAI,SAAS,QAAW;AACjC,cAAQ,cAAc,IAAI;AAC1B,aAAO,KAAK,UAAU,IAAI,IAAI;AAAA,IAChC;AAEA,UAAM,aAAa,IAAI,aAAa;AACpC,QAAI;AAEJ,aAAS,UAAU,GAAG,WAAW,YAAY,WAAW;AACtD,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,YAAM,UAAU,KAAK,IAAI;AACzB,UAAI;AACF,cAAM,MAAM,MAAM,UAAU,KAAK;AAAA,UAC/B,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA;AAAA,UACA,QAAQ,WAAW;AAAA,QACrB,CAAC;AACD,cAAM,aAAa,KAAK,IAAI,IAAI;AAChC,aAAK,YAAY;AAAA,UACf,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,SAAS,UAAU;AAAA,QACrB,CAAC;AAED,YAAI,IAAI,IAAI;AAEV,cAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,gBAAM,KAAK,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC9C,cAAI,GAAG,SAAS,kBAAkB,GAAG;AACnC,mBAAQ,MAAM,IAAI,KAAK;AAAA,UACzB;AAEA,iBAAQ,MAAM,IAAI,KAAK;AAAA,QACzB;AAGA,YAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,gBAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,gBAAM,UAAU,aAAa,OAAO,UAAU,IAAI,MAAO,MAAM,KAAK,IAAI,GAAG,OAAO;AAClF,gBAAM,MAAM,OAAO;AACnB;AAAA,QACF;AAEA,cAAM,MAAM,kBAAkB,GAAG;AAAA,MACnC,SAAS,KAAK;AACZ,YAAI,eAAe,cAAe,OAAM;AAExC,YAAI,UAAU,YAAY;AACxB,oBAAU;AACV,gBAAM,MAAM,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;AACtC;AAAA,QACF;AACA,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU;AACjD,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,kBAAkB,GAAG;AAAA,UAC9B,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAGA,UAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,2BAA2B;AAAA,EAClF;AAEA,SAAO,EAAE,QAAQ;AACnB;;;ACnLO,IAAM,mBAAmB,CAAC,UAAsB;AAAA;AAAA;AAAA,EAGrD,KAAK,YAAiC,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,SAAS,CAAC;AAClG;;;ACIO,IAAM,8BAA8B,CAAC,MAAkB,aAAqB;AAAA;AAAA;AAAA;AAAA,EAIjF,QAAQ,OAAO,UACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO;AAAA,IAC3B,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM,cAAc,OAAO;AAAA,IAC7B,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,cACV,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA,EAEH,QAAQ,OAAO,WAAmB,UAChC,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,IACjD,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,QAAQ,OAAO,cACb,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,MAAM,OAAO,cACX,KAAK,QAAyB;AAAA,IAC5B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AACL;;;AChDO,IAAM,uBAAuB,CAAC,SAAqB;AACxD,QAAM,SAAS;AAAA,IACb,QAAQ,OAAO,UACb,KAAK,QAAe,EAAE,QAAQ,QAAQ,MAAM,cAAc,MAAM,MAAM,CAAC;AAAA,IAEzE,MAAM,YAA8B;AAClC,YAAM,MAAM,MAAM,KAAK,QAA2B,EAAE,QAAQ,OAAO,MAAM,aAAa,CAAC;AACvF,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,mBAAyC;AAChD,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,YACV,KAAK,QAAe,EAAE,QAAQ,OAAO,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA,IAEtE,QAAQ,OAAO,SAAiB,UAC9B,KAAK,QAAe,EAAE,QAAQ,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,MAAM,CAAC;AAAA,IAErF,QAAQ,OAAO,YACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASxE,UAAU,CAAC,YACT,4BAA4B,MAAM,OAAO;AAAA,EAC7C;AACA,SAAO;AACT;;;ACvCO,IAAM,sBAAsB,CAAC,SAAqB;AACvD,QAAM,QAAQ;AAAA,IACZ,MAAM,OAAO,UAA2B,CAAC,MAA8B;AACrE,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,iBAAiB,UAA2B,CAAC,GAA+B;AACnF,YAAM,OAAO,MAAM,MAAM,KAAK,OAAO;AACrC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,WACV,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,aAAa,MAAM,GAAG,CAAC;AAAA,IAEzE,YAAY,OAAO,WACjB,KAAK,QAA0D;AAAA,MAC7D,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,IAKH,WAAW,OAAO,WAChB,KAAK,QAAkC;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAML;AACA,SAAO;AACT;;;ACrDA,OAAO,QAAQ;AACf,OAAO,UAAU;AAIV,IAAM,+BAA+B,CAAC,UAAsB;AAAA,EACjE,QAAQ,OAAO,SACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM,EAAE,KAAK;AAAA,EACf,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,SACV,KAAK,QAAuB,EAAE,QAAQ,OAAO,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA,EAEpF,QAAQ,OAAO,SACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,EAK9E,YAAY,OACV,MACA,WAG+B;AAC/B,UAAM,OAAO,IAAI,SAAS;AAC1B,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,UAAU,QAAQ;AACpB,YAAM,MAAM,MAAM,GAAG,SAAS,SAAS,OAAO,IAAI;AAClD,iBAAW,OAAO,YAAY,KAAK,SAAS,OAAO,IAAI;AACvD,aAAO,OAAO,YAAY;AAC1B,aAAO,IAAI,KAAK,CAAC,IAAI,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACvD,OAAO;AACL,iBAAW,OAAO;AAClB,aAAO,OAAO,YAAY;AAC1B,YAAM,QAAQ,OAAO,gBAAgB,SAAS,IAAI,WAAW,OAAO,IAAI,IAAI,OAAO;AACnF,aAAO,IAAI,KAAK,CAAC,KAAK,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACzC;AACA,SAAK,OAAO,QAAQ,MAAM,QAAQ;AAKlC,WAAO,KAAK,QAA2B;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,WAAW,IAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,OAAO,SAA+C;AAC/D,UAAM,MAAM,MAAM,KAAK,QAAuC;AAAA,MAC5D,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,IACnC,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,YAAY,OAAO,MAAc,WAC/B,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,uBAAuB,IAAI,UAAU,MAAM;AAAA,EACnD,CAAC;AACL;;;AC3EO,IAAM,wBAAwB,CAAC,SAAqB;AACzD,QAAM,UAAU;AAAA,IACd,YAAY,YACV,KAAK,QAAiD;AAAA,MACpD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA;AAAA,IAGH,WAAW,OAAO,OAA2B,CAAC,MAA8B;AAC1E,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA,IAIA,cAAc,iBAAiB,OAA2B,CAAC,GAA+B;AACxF,YAAM,OAAO,MAAM,QAAQ,UAAU,IAAI;AACzC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,EACF;AACA,SAAO;AACT;;;ACtBO,IAAM,2BAA2B,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA,EAI7D,MAAM,OAAO,UACX,KAAK,QAA6B;AAAA,IAChC,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAAA;AAAA;AAAA,EAIH,MAAM,OACJ,OAA+E,CAAC,MAChD;AAChC,UAAM,QAAqD,CAAC;AAC5D,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,UAAM,MAAM,MAAM,KAAK,QAAsC;AAAA,MAC3D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA;AAAA,EAGA,QAAQ,OACN,YAEA,KAAK,QAAyE;AAAA,IAC5E,QAAQ;AAAA,IACR,MAAM,mBAAmB,OAAO;AAAA,EAClC,CAAC;AACL;;;ACpCO,IAAM,yBAAyB,CAAC,UAAsB;AAAA,EAC3D,YAAY,OACV,UAKI,CAAC,MAC0B;AAC/B,UAAM,MAAM,MAAM,KAAK,QAAqC;AAAA,MAC1D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACIO,IAAM,qBAAqB,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcvD,YAAY,OAAO,UAAqD;AACtE,UAAM,QAA4C,CAAC;AACnD,QAAI,MAAM,QAAQ,MAAM,KAAK,SAAS,EAAG,OAAM,OAAO,MAAM,KAAK,KAAK,GAAG;AACzE,QAAI,MAAM,YAAY,MAAM,SAAS,SAAS,EAAG,OAAM,WAAW,MAAM,SAAS,KAAK,GAAG;AACzF,UAAM,MAAM,MAAM,KAAK,QAAkC;AAAA,MACvD,QAAQ;AAAA,MACR,MAAM,YAAY,MAAM,KAAK;AAAA,MAC7B;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACrBO,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAgC;AAC1C,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,UAAM,OAAO,iBAAiB;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ,WAAW;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,MACpB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,IACrB,CAAC;AAED,SAAK,KAAK,iBAAiB,IAAI;AAC/B,SAAK,SAAS,qBAAqB,IAAI;AACvC,SAAK,QAAQ,oBAAoB,IAAI;AACrC,SAAK,iBAAiB,6BAA6B,IAAI;AACvD,SAAK,UAAU,sBAAsB,IAAI;AACzC,SAAK,aAAa,yBAAyB,IAAI;AAC/C,SAAK,WAAW,uBAAuB,IAAI;AAC3C,SAAK,OAAO,mBAAmB,IAAI;AAAA,EACrC;AACF;;;AC/DA,OAAO,YAAY;AAoBZ,IAAM,yBAAyB,CACpC,SACA,iBACA,WACY;AACZ,MAAI,CAAC,mBAAmB,CAAC,OAAQ,QAAO;AACxC,QAAM,CAAC,MAAM,QAAQ,IAAI,gBAAgB,MAAM,GAAG;AAClD,MAAI,SAAS,YAAY,CAAC,SAAU,QAAO;AAE3C,QAAM,WAAW,OACd,WAAW,UAAU,MAAM,EAC3B,OAAO,OAAO,YAAY,WAAW,UAAU,OAAO,EACtD,OAAO,KAAK;AAGf,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,OAAO,gBAAgB,GAAG,CAAC;AACpC;","names":["path"]}
+{"version":3,"sources":["../src/errors.ts","../src/http.ts","../src/resources/me.ts","../src/resources/agentWebhooks.ts","../src/resources/agents.ts","../src/resources/calls.ts","../src/resources/knowledgeBases.ts","../src/resources/credits.ts","../src/resources/callTokens.ts","../src/resources/webhooks.ts","../src/resources/orgs.ts","../src/PlatformClient.ts","../src/verify.ts"],"sourcesContent":["// Typed error class mirroring the server's ErrorV1 shape:\n//   { error: { code, message, field?, docs_url? } }\n//\n// Consumers do `err instanceof PlatformError` to branch on code without\n// parsing string messages. `status` carries the HTTP code for the 1% of\n// cases where the code field isn't enough (e.g. rate-limit → retry-after\n// header correlation).\n\nexport type ApiErrorCode =\n  | 'unauthorized'\n  | 'forbidden'\n  | 'not_found'\n  | 'bad_request'\n  | 'conflict'\n  | 'rate_limited'\n  | 'payment_required'\n  | 'internal_error'\n  | 'unknown'\n\nexport class PlatformError extends Error {\n  readonly code: ApiErrorCode\n  readonly status: number\n  readonly field?: string\n  readonly docsUrl?: string\n  // The raw response body for debugging. Intentionally optional — we clear\n  // it on `error.toJSON()` so logging libraries don't dump the whole\n  // server response into production logs.\n  readonly body?: unknown\n\n  constructor(params: {\n    code: ApiErrorCode\n    message: string\n    status: number\n    field?: string\n    docsUrl?: string\n    body?: unknown\n  }) {\n    super(params.message)\n    this.name = 'PlatformError'\n    this.code = params.code\n    this.status = params.status\n    this.field = params.field\n    this.docsUrl = params.docsUrl\n    this.body = params.body\n    // Preserve the stack trace — Node's Error doesn't capture it\n    // automatically when subclassing in some older runtimes.\n    if (\n      typeof (Error as typeof Error & { captureStackTrace?: unknown }).captureStackTrace ===\n      'function'\n    ) {\n      ;(\n        Error as typeof Error & { captureStackTrace: (target: unknown, ctor: unknown) => void }\n      ).captureStackTrace(this, PlatformError)\n    }\n  }\n\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      field: this.field,\n      docsUrl: this.docsUrl,\n    }\n  }\n}\n","import { PlatformError, type ApiErrorCode } from './errors'\n\n// Low-level HTTP wrapper around `fetch` (native in Node 18+). Every resource\n// method routes through here for consistent auth + error handling + retries.\n//\n// v1 scope: JSON-in / JSON-out + multipart for file uploads. No streaming —\n// call WebSockets go through @craftedxp/voice-rn (the React Native client)\n// or a web equivalent, not this server-side SDK.\n\nexport interface HttpClientOptions {\n  apiKey: string\n  baseUrl: string\n  // Default 30s. File uploads can override per-request.\n  timeoutMs?: number\n  // 429 + 5xx retries. Defaults to 3 attempts (original + 2 retries) with\n  // exponential backoff (250ms, 1s). Set to 0 to disable.\n  maxRetries?: number\n  // Optional — lets consumers swap in a test/mock fetch (or a custom one\n  // with instrumentation). Defaults to the global.\n  fetch?: typeof fetch\n  // Optional — a callback that fires per-request with the final status and\n  // duration. Handy for dropping traces into the consumer's observability\n  // stack without wrapping each call.\n  onRequest?: (info: {\n    method: string\n    url: string\n    status: number\n    durationMs: number\n    attempt: number\n  }) => void\n}\n\nexport interface HttpRequest {\n  method: 'GET' | 'POST' | 'PATCH' | 'DELETE'\n  path: string // starts with `/`, e.g. `/v1/agents/123`\n  query?: Record<string, string | number | boolean | undefined>\n  body?: unknown // JSON-serialised — for multipart use `formData`\n  formData?: FormData\n  timeoutMs?: number\n  // Exposed for edge cases where a resource wants to tack on extra\n  // headers (we don't have any today but leave the hook).\n  headers?: Record<string, string>\n}\n\nconst DEFAULT_TIMEOUT_MS = 30_000\nconst DEFAULT_MAX_RETRIES = 2 // total attempts = 3\n\nconst buildUrl = (baseUrl: string, path: string, query?: HttpRequest['query']): string => {\n  const u = new URL(path, baseUrl)\n  if (query) {\n    for (const [k, v] of Object.entries(query)) {\n      if (v === undefined) continue\n      u.searchParams.set(k, String(v))\n    }\n  }\n  return u.toString()\n}\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\nconst isRetryable = (status: number): boolean => status === 429 || (status >= 500 && status < 600)\n\n// Parse whatever the server returned into a PlatformError. Falls back to\n// synthesising a sensible error for non-JSON responses.\nconst errorFromResponse = async (res: Response): Promise<PlatformError> => {\n  const bodyText = await res.text().catch(() => '')\n  let parsed: unknown = undefined\n  try {\n    parsed = bodyText ? JSON.parse(bodyText) : undefined\n  } catch {\n    // non-JSON response (e.g. an HTML error page from a proxy). Fall\n    // through with parsed = undefined.\n  }\n  const errObj = (\n    parsed as { error?: { code?: string; message?: string; field?: string; docs_url?: string } }\n  )?.error\n  return new PlatformError({\n    code: (errObj?.code as ApiErrorCode) ?? 'unknown',\n    message: errObj?.message ?? res.statusText ?? `HTTP ${res.status}`,\n    status: res.status,\n    field: errObj?.field,\n    docsUrl: errObj?.docs_url,\n    body: parsed ?? bodyText,\n  })\n}\n\nexport const createHttpClient = (opts: HttpClientOptions) => {\n  const fetchImpl = opts.fetch ?? globalThis.fetch\n  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS\n  const maxRetries = opts.maxRetries ?? DEFAULT_MAX_RETRIES\n\n  if (!fetchImpl) {\n    throw new Error('No global fetch available. @craftedxp/sdk-node requires Node >= 18.')\n  }\n\n  const request = async <T>(req: HttpRequest): Promise<T> => {\n    const url = buildUrl(opts.baseUrl, req.path, req.query)\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${opts.apiKey}`,\n      Accept: 'application/json',\n      ...(req.headers ?? {}),\n    }\n\n    // Body shaping: prefer formData when provided; otherwise JSON.\n    // `FormData` sets its own Content-Type with boundary — don't preempt it.\n    // Typed as `string | FormData | undefined` (a subset of the global\n    // BodyInit) so we don't need DOM lib types in this server-side SDK.\n    let body: string | FormData | undefined\n    if (req.formData) {\n      body = req.formData\n    } else if (req.body !== undefined) {\n      headers['Content-Type'] = 'application/json'\n      body = JSON.stringify(req.body)\n    }\n\n    const reqTimeout = req.timeoutMs ?? timeoutMs\n    let lastErr: unknown\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      const controller = new AbortController()\n      const timer = setTimeout(() => controller.abort(), reqTimeout)\n      const started = Date.now()\n      try {\n        const res = await fetchImpl(url, {\n          method: req.method,\n          headers,\n          body,\n          signal: controller.signal,\n        })\n        const durationMs = Date.now() - started\n        opts.onRequest?.({\n          method: req.method,\n          url,\n          status: res.status,\n          durationMs,\n          attempt: attempt + 1,\n        })\n\n        if (res.ok) {\n          // 204 No Content — some endpoints (DELETE webhooks) return nothing.\n          if (res.status === 204) return undefined as T\n          const ct = res.headers.get('content-type') ?? ''\n          if (ct.includes('application/json')) {\n            return (await res.json()) as T\n          }\n          // Non-JSON 2xx — rare. Return raw text cast as T.\n          return (await res.text()) as unknown as T\n        }\n\n        // Retryable error: back off + retry up to maxRetries.\n        if (isRetryable(res.status) && attempt < maxRetries) {\n          const retryAfter = res.headers.get('Retry-After')\n          const backoff = retryAfter ? Number(retryAfter) * 1000 : 250 * Math.pow(2, attempt)\n          await sleep(backoff)\n          continue\n        }\n\n        throw await errorFromResponse(res)\n      } catch (err) {\n        if (err instanceof PlatformError) throw err\n        // AbortError / network / DNS failures — retry up to maxRetries.\n        if (attempt < maxRetries) {\n          lastErr = err\n          await sleep(250 * Math.pow(2, attempt))\n          continue\n        }\n        const msg = err instanceof Error ? err.message : 'network error'\n        throw new PlatformError({\n          code: 'unknown',\n          message: `Network error: ${msg}`,\n          status: 0,\n        })\n      } finally {\n        clearTimeout(timer)\n      }\n    }\n\n    // Should be unreachable — the loop either returns, throws, or continues.\n    throw lastErr instanceof Error ? lastErr : new Error('request exhausted retries')\n  }\n\n  return { request }\n}\n\nexport type HttpClient = ReturnType<typeof createHttpClient>\n","import type { HttpClient } from '../http'\nimport type { MeResponse } from '../types'\n\nexport const createMeResource = (http: HttpClient) => ({\n  // Smoke test — confirms the API key is valid and returns the org + balance.\n  // Most consumers use this as a ping on startup.\n  get: async (): Promise<MeResponse> => http.request<MeResponse>({ method: 'GET', path: '/v1/me' }),\n})\n\nexport type MeResource = ReturnType<typeof createMeResource>\n","import type { HttpClient } from '../http'\nimport type {\n  WebhookConfig,\n  WebhookCreateInput,\n  WebhookDelivery,\n  WebhookUpdateInput,\n} from '../types'\n\n// Per-agent webhook resource, scoped at factory time to a specific agentId.\n// All endpoints mirror /v1/agents/:agentId/webhooks[/:id].\n\nexport const createAgentWebhooksResource = (http: HttpClient, agentId: string) => ({\n  // Returns the webhook + its signing secret. The secret is only present in\n  // this response — persist immediately, subsequent GETs omit it. Use the\n  // secret to verify `X-Platform-Signature-256` (sha256=hex HMAC over body).\n  create: async (input: WebhookCreateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks`,\n      body: input,\n    }),\n\n  list: async (): Promise<WebhookConfig[]> => {\n    const res = await http.request<{ data: WebhookConfig[] }>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks`,\n    })\n    return res.data\n  },\n\n  get: async (webhookId: string): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  update: async (webhookId: string, patch: WebhookUpdateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'PATCH',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n      body: patch,\n    }),\n\n  delete: async (webhookId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  // Fires a synthetic call.started against this webhook and returns the\n  // full delivery record (including attempt status codes) once the retry\n  // sequence has finished. Useful during setup to verify receiver wiring.\n  test: async (webhookId: string): Promise<WebhookDelivery> =>\n    http.request<WebhookDelivery>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}/test`,\n    }),\n})\n\nexport type AgentWebhooksResource = ReturnType<typeof createAgentWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { Agent, AgentCreateInput, AgentUpdateInput } from '../types'\nimport { createAgentWebhooksResource, type AgentWebhooksResource } from './agentWebhooks'\n\n// The server returns Agent with `apiKey` stripped and `hasApiKey: boolean`\n// on the model. We type the happy path but keep our input type permissive\n// so consumers can POST a plaintext `apiKey` that the server encrypts +\n// swaps for `apiKeySecret` on persistence.\n\nexport const createAgentsResource = (http: HttpClient) => {\n  const agents = {\n    create: async (input: AgentCreateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'POST', path: '/v1/agents', body: input }),\n\n    list: async (): Promise<Agent[]> => {\n      const res = await http.request<{ data: Agent[] }>({ method: 'GET', path: '/v1/agents' })\n      return res.data\n    },\n\n    // Async iterator for \"give me every agent\" — v1 server returns the full\n    // list in one page, so this is just a thin convenience. When the server\n    // picks up cursor pagination, this is the method that papers over that\n    // migration without consumer changes.\n    listAll: async function* (): AsyncIterable<Agent> {\n      const page = await agents.list()\n      for (const a of page) yield a\n    },\n\n    get: async (agentId: string): Promise<Agent> =>\n      http.request<Agent>({ method: 'GET', path: `/v1/agents/${agentId}` }),\n\n    update: async (agentId: string, patch: AgentUpdateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'PATCH', path: `/v1/agents/${agentId}`, body: patch }),\n\n    delete: async (agentId: string): Promise<void> =>\n      http.request<void>({ method: 'DELETE', path: `/v1/agents/${agentId}` }),\n\n    // Nested resource. Per-agent webhook CRUD lives at\n    // /v1/agents/:agentId/webhooks/* — we expose it as a factory keyed on\n    // agentId so consumers can bind once and reuse:\n    //\n    //   const hooks = client.agents.webhooks(myAgentId)\n    //   await hooks.create({ url, events })\n    //   await hooks.list()\n    webhooks: (agentId: string): AgentWebhooksResource =>\n      createAgentWebhooksResource(http, agentId),\n  }\n  return agents\n}\n\nexport type AgentsResource = ReturnType<typeof createAgentsResource>\n","import type { HttpClient } from '../http'\nimport type {\n  CallListFilters,\n  CallRecord,\n  CallRecordingUrlResponse,\n  CallSummary,\n  TranscriptTurn,\n} from '../types'\n\nexport const createCallsResource = (http: HttpClient) => {\n  const calls = {\n    list: async (filters: CallListFilters = {}): Promise<CallSummary[]> => {\n      const res = await http.request<{ data: CallSummary[] }>({\n        method: 'GET',\n        path: '/v1/calls',\n        query: filters as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination helper. v1 server caps at limit (max 200) in a single\n    // page — consumers who ask for \"every call since X\" get that page, the\n    // iterator ends. This is the shape we'd extend with cursor support\n    // without breaking callers.\n    listAll: async function* (filters: CallListFilters = {}): AsyncIterable<CallSummary> {\n      const page = await calls.list(filters)\n      for (const c of page) yield c\n    },\n\n    get: async (callId: string): Promise<CallRecord> =>\n      http.request<CallRecord>({ method: 'GET', path: `/v1/calls/${callId}` }),\n\n    transcript: async (callId: string): Promise<{ callId: string; transcript: TranscriptTurn[] }> =>\n      http.request<{ callId: string; transcript: TranscriptTurn[] }>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/transcript`,\n      }),\n\n    // Returns a V4 signed URL (1-hour TTL). `ready: false` + `artifact:\n    // 'caller-raw'` means the async mix job hasn't finished — the URL still\n    // points at a playable file (raw caller PCM).\n    recording: async (callId: string): Promise<CallRecordingUrlResponse> =>\n      http.request<CallRecordingUrlResponse>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/recording`,\n      }),\n\n    // Outbound dialling (POST /v1/calls) + in-call control are Phase 1.4.4 /\n    // 1.4.5 respectively — blocked on telephony. Surface clear \"not built\n    // yet\" errors here if consumers guess those method names, so they don't\n    // silently hit a non-existent endpoint and wonder why it 404s.\n  }\n  return calls\n}\n\nexport type CallsResource = ReturnType<typeof createCallsResource>\n","import fs from 'node:fs'\nimport path from 'node:path'\nimport type { HttpClient } from '../http'\nimport type { KnowledgeBase, KnowledgeBaseFile } from '../types'\n\nexport const createKnowledgeBasesResource = (http: HttpClient) => ({\n  create: async (name: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({\n      method: 'POST',\n      path: '/v1/knowledge-bases',\n      body: { name },\n    }),\n\n  list: async (): Promise<KnowledgeBase[]> => {\n    const res = await http.request<{ data: KnowledgeBase[] }>({\n      method: 'GET',\n      path: '/v1/knowledge-bases',\n    })\n    return res.data\n  },\n\n  get: async (kbId: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({ method: 'GET', path: `/v1/knowledge-bases/${kbId}` }),\n\n  delete: async (kbId: string): Promise<void> =>\n    http.request<void>({ method: 'DELETE', path: `/v1/knowledge-bases/${kbId}` }),\n\n  // File upload — accepts either a local file path OR raw bytes + filename.\n  // The server ingests synchronously today (Phase 3.1.4 Cloud Tasks is a\n  // followup), so the returned file has status='ready' in most cases.\n  uploadFile: async (\n    kbId: string,\n    source:\n      | { path: string; filename?: string; mimeType?: string }\n      | { data: Buffer | Uint8Array; filename: string; mimeType?: string },\n  ): Promise<KnowledgeBaseFile> => {\n    const form = new FormData()\n    let blob: Blob\n    let filename: string\n    let mime: string\n\n    if ('path' in source) {\n      const buf = await fs.promises.readFile(source.path)\n      filename = source.filename ?? path.basename(source.path)\n      mime = source.mimeType ?? 'application/octet-stream'\n      blob = new Blob([new Uint8Array(buf)], { type: mime })\n    } else {\n      filename = source.filename\n      mime = source.mimeType ?? 'application/octet-stream'\n      const bytes = source.data instanceof Buffer ? new Uint8Array(source.data) : source.data\n      blob = new Blob([bytes], { type: mime })\n    }\n    form.append('file', blob, filename)\n\n    // File uploads can take a while (OCR, chunking, embedding) — give them\n    // room before timing out. 5 min cap matches the server's own\n    // processing budget.\n    return http.request<KnowledgeBaseFile>({\n      method: 'POST',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n      formData: form,\n      timeoutMs: 5 * 60 * 1000,\n    })\n  },\n\n  listFiles: async (kbId: string): Promise<KnowledgeBaseFile[]> => {\n    const res = await http.request<{ data: KnowledgeBaseFile[] }>({\n      method: 'GET',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n    })\n    return res.data\n  },\n\n  deleteFile: async (kbId: string, fileId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/knowledge-bases/${kbId}/files/${fileId}`,\n    }),\n})\n\nexport type KnowledgeBasesResource = ReturnType<typeof createKnowledgeBasesResource>\n","import type { HttpClient } from '../http'\nimport type { LedgerEntry } from '../types'\n\nexport const createCreditsResource = (http: HttpClient) => {\n  const credits = {\n    getBalance: async (): Promise<{ orgId: string; balanceCents: number }> =>\n      http.request<{ orgId: string; balanceCents: number }>({\n        method: 'GET',\n        path: '/v1/credits/balance',\n      }),\n\n    // Returns ledger entries newest-first. `limit` is capped at 500 server-side.\n    getLedger: async (opts: { limit?: number } = {}): Promise<LedgerEntry[]> => {\n      const res = await http.request<{ data: LedgerEntry[] }>({\n        method: 'GET',\n        path: '/v1/credits/ledger',\n        query: opts as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination scaffold — v1 server returns a single page up to\n    // limit=500. When cursor pagination lands this is where it gets wired.\n    getLedgerAll: async function* (opts: { limit?: number } = {}): AsyncIterable<LedgerEntry> {\n      const page = await credits.getLedger(opts)\n      for (const e of page) yield e\n    },\n  }\n  return credits\n}\n\nexport type CreditsResource = ReturnType<typeof createCreditsResource>\n","import type { HttpClient } from '../http'\nimport type { CallTokenMintInput, CallTokenMintResult, CallTokenSummary } from '../types'\n\n// Short-lived, agent-scoped `ct_` tokens. Mint one per user session on your\n// backend, hand the raw value to the browser; let this SDK handle lifecycle\n// (revoke on sign-out, list active tokens for an admin panel).\n\nexport const createCallTokensResource = (http: HttpClient) => ({\n  // Returns the RAW token value once. Don't log it; pass it straight to the\n  // browser + discard server-side. `tokenId` is the stable public handle\n  // used for revocation later.\n  mint: async (input: CallTokenMintInput): Promise<CallTokenMintResult> =>\n    http.request<CallTokenMintResult>({\n      method: 'POST',\n      path: '/v1/call-tokens',\n      body: input,\n    }),\n\n  // Live tokens only by default. Pass includeRevoked/includeExpired when\n  // debugging \"why did my token stop working\".\n  list: async (\n    opts: { includeRevoked?: boolean; includeExpired?: boolean; limit?: number } = {},\n  ): Promise<CallTokenSummary[]> => {\n    const query: Record<string, string | number | undefined> = {}\n    if (opts.includeRevoked) query.includeRevoked = '1'\n    if (opts.includeExpired) query.includeExpired = '1'\n    if (opts.limit !== undefined) query.limit = opts.limit\n    const res = await http.request<{ data: CallTokenSummary[] }>({\n      method: 'GET',\n      path: '/v1/call-tokens',\n      query,\n    })\n    return res.data\n  },\n\n  // Idempotent — re-revoking a revoked token returns `alreadyRevoked: true`.\n  revoke: async (\n    tokenId: string,\n  ): Promise<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }> =>\n    http.request<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }>({\n      method: 'DELETE',\n      path: `/v1/call-tokens/${tokenId}`,\n    }),\n})\n\nexport type CallTokensResource = ReturnType<typeof createCallTokensResource>\n","import type { HttpClient } from '../http'\nimport type { WebhookDelivery } from '../types'\n\n// Org-wide webhook delivery log. Per-agent CRUD lives on\n// `client.agents.webhooks(agentId)` — this namespace is just the\n// read-only deliveries surface that spans all agents.\n\nexport const createWebhooksResource = (http: HttpClient) => ({\n  deliveries: async (\n    filters: {\n      agentId?: string\n      webhookId?: string\n      callId?: string\n      limit?: number\n    } = {},\n  ): Promise<WebhookDelivery[]> => {\n    const res = await http.request<{ data: WebhookDelivery[] }>({\n      method: 'GET',\n      path: '/v1/webhooks/deliveries',\n      query: filters as Record<string, string | number | undefined>,\n    })\n    return res.data\n  },\n})\n\nexport type WebhooksResource = ReturnType<typeof createWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { CatalogAgent, CatalogListInput } from '../types'\n\n// Org-scoped consumer endpoints. Today this is just the agent catalog —\n// the trimmed shape your mobile app picks an agent from. Lives at\n// `/v1/orgs/:orgId/agents` rather than reusing the admin `/v1/agents/*`\n// tree on purpose: the catalog response intentionally excludes the\n// operator-only fields (system prompt, tools, KB IDs) so a leaked\n// consumer-backend `sk_` can't lift the operator config out of it.\n//\n// Pattern from your backend:\n//\n//   const client = new PlatformClient({ apiKey: process.env.SK })\n//   const visible = await client.orgs.listAgents({\n//     orgId: process.env.ORG_ID!,\n//     userTags: ['tier1'],   // omit to get the unfiltered admin view\n//   })\n//   res.json(visible)\n\nexport const createOrgsResource = (http: HttpClient) => ({\n  /**\n   * Fetch the agent catalog for an org. Returns the consumer-trimmed shape;\n   * no system prompt, tools, or KB info. Use `client.agents.get(agentId)`\n   * with the same `sk_` if you need the full admin shape.\n   *\n   * `userTags`: end-user entitlement tags. When supplied, hides agents\n   * whose `allowedUserTags` is non-empty and doesn't intersect with the\n   * supplied list. Omit to get the unfiltered admin view.\n   *\n   * Persona / category filtering is intentionally not a server param —\n   * filter the returned list client-side over `name`s if you need it.\n   *\n   * Throws `403 forbidden` if `orgId` doesn't match the key's org.\n   */\n  listAgents: async (input: CatalogListInput): Promise<CatalogAgent[]> => {\n    const query: Record<string, string | undefined> = {}\n    if (input.userTags && input.userTags.length > 0) query.userTags = input.userTags.join(',')\n    const res = await http.request<{ data: CatalogAgent[] }>({\n      method: 'GET',\n      path: `/v1/orgs/${input.orgId}/agents`,\n      query,\n    })\n    return res.data\n  },\n})\n\nexport type OrgsResource = ReturnType<typeof createOrgsResource>\n","import { createHttpClient, type HttpClientOptions } from './http'\nimport { createMeResource, type MeResource } from './resources/me'\nimport { createAgentsResource, type AgentsResource } from './resources/agents'\nimport { createCallsResource, type CallsResource } from './resources/calls'\nimport {\n  createKnowledgeBasesResource,\n  type KnowledgeBasesResource,\n} from './resources/knowledgeBases'\nimport { createCreditsResource, type CreditsResource } from './resources/credits'\nimport { createCallTokensResource, type CallTokensResource } from './resources/callTokens'\nimport { createWebhooksResource, type WebhooksResource } from './resources/webhooks'\nimport { createOrgsResource, type OrgsResource } from './resources/orgs'\n\nexport interface PlatformClientOptions {\n  // Full-org API key minted from the dashboard or bootstrap CLI. Start with\n  // `sk_`. Never ship to a browser — use `client.callTokens.mint(...)` to\n  // generate a narrow `ct_` token for client-side use instead.\n  apiKey: string\n  // Defaults to the hosted platform. Point at `http://localhost:8080` for\n  // local dev or at a self-hosted deployment.\n  baseUrl?: string\n  // Passthrough tuning for the HTTP layer.\n  timeoutMs?: number\n  maxRetries?: number\n  fetch?: HttpClientOptions['fetch']\n  onRequest?: HttpClientOptions['onRequest']\n}\n\n// Single entry point. All resources are lazy-constructed in the constructor\n// so their refs don't incur any per-call allocation. Shape mirrors Stripe /\n// Twilio / Vapi's `resource.method()` convention for familiarity.\nexport class PlatformClient {\n  readonly me: MeResource\n  readonly agents: AgentsResource\n  readonly calls: CallsResource\n  readonly knowledgeBases: KnowledgeBasesResource\n  readonly credits: CreditsResource\n  readonly callTokens: CallTokensResource\n  readonly webhooks: WebhooksResource\n  readonly orgs: OrgsResource\n\n  constructor(options: PlatformClientOptions) {\n    if (!options.apiKey) {\n      throw new Error('PlatformClient: `apiKey` is required')\n    }\n    const http = createHttpClient({\n      apiKey: options.apiKey,\n      baseUrl: options.baseUrl ?? 'https://api.example.com',\n      timeoutMs: options.timeoutMs,\n      maxRetries: options.maxRetries,\n      fetch: options.fetch,\n      onRequest: options.onRequest,\n    })\n\n    this.me = createMeResource(http)\n    this.agents = createAgentsResource(http)\n    this.calls = createCallsResource(http)\n    this.knowledgeBases = createKnowledgeBasesResource(http)\n    this.credits = createCreditsResource(http)\n    this.callTokens = createCallTokensResource(http)\n    this.webhooks = createWebhooksResource(http)\n    this.orgs = createOrgsResource(http)\n  }\n}\n","import crypto from 'node:crypto'\n\n// Helper for consumers receiving webhooks: verify the `X-Platform-Signature-256`\n// header against the raw body + secret. Plain function (not tied to\n// PlatformClient) so Express/Koa/Next.js middleware can use it without\n// instantiating a client.\n//\n//   import { verifyWebhookSignature } from '@craftedxp/sdk-node'\n//   app.post('/webhooks/voice-agent', express.raw({ type: 'application/json' }), (req, res) => {\n//     const sig = req.header('X-Platform-Signature-256') ?? ''\n//     if (!verifyWebhookSignature(req.body, sig, process.env.VOICE_AGENT_WEBHOOK_SECRET!)) {\n//       return res.status(401).send('invalid signature')\n//     }\n//     const event = JSON.parse(req.body.toString('utf8'))\n//     // ...handle event\n//   })\n//\n// The signature is `sha256=<hex HMAC-SHA256 of rawBody with secret>`.\n// Timing-safe compare to avoid microtiming side channels.\n\nexport const verifyWebhookSignature = (\n  rawBody: Buffer | string,\n  signatureHeader: string,\n  secret: string,\n): boolean => {\n  if (!signatureHeader || !secret) return false\n  const [algo, provided] = signatureHeader.split('=')\n  if (algo !== 'sha256' || !provided) return false\n\n  const expected = crypto\n    .createHmac('sha256', secret)\n    .update(typeof rawBody === 'string' ? rawBody : rawBody)\n    .digest('hex')\n\n  // Buffers must match in length for timingSafeEqual.\n  const a = Buffer.from(expected, 'hex')\n  const b = Buffer.from(provided, 'hex')\n  if (a.length !== b.length) return false\n  return crypto.timingSafeEqual(a, b)\n}\n"],"mappings":";AAmBO,IAAM,gBAAN,MAAM,uBAAsB,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EAET,YAAY,QAOT;AACD,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,OAAO,OAAO;AAGnB,QACE,OAAQ,MAAyD,sBACjE,YACA;AACA;AAAC,MACC,MACA,kBAAkB,MAAM,cAAa;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,SAAkC;AAChC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AACF;;;ACtBA,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AAE5B,IAAM,WAAW,CAAC,SAAiBA,OAAc,UAAyC;AACxF,QAAM,IAAI,IAAI,IAAIA,OAAM,OAAO;AAC/B,MAAI,OAAO;AACT,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,MAAM,OAAW;AACrB,QAAE,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO,EAAE,SAAS;AACpB;AAEA,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAExE,IAAM,cAAc,CAAC,WAA4B,WAAW,OAAQ,UAAU,OAAO,SAAS;AAI9F,IAAM,oBAAoB,OAAO,QAA0C;AACzE,QAAM,WAAW,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAChD,MAAI,SAAkB;AACtB,MAAI;AACF,aAAS,WAAW,KAAK,MAAM,QAAQ,IAAI;AAAA,EAC7C,QAAQ;AAAA,EAGR;AACA,QAAM,SACJ,QACC;AACH,SAAO,IAAI,cAAc;AAAA,IACvB,MAAO,QAAQ,QAAyB;AAAA,IACxC,SAAS,QAAQ,WAAW,IAAI,cAAc,QAAQ,IAAI,MAAM;AAAA,IAChE,QAAQ,IAAI;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,MAAM,UAAU;AAAA,EAClB,CAAC;AACH;AAEO,IAAM,mBAAmB,CAAC,SAA4B;AAC3D,QAAM,YAAY,KAAK,SAAS,WAAW;AAC3C,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,aAAa,KAAK,cAAc;AAEtC,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAEA,QAAM,UAAU,OAAU,QAAiC;AACzD,UAAM,MAAM,SAAS,KAAK,SAAS,IAAI,MAAM,IAAI,KAAK;AACtD,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,QAAQ;AAAA,MACR,GAAI,IAAI,WAAW,CAAC;AAAA,IACtB;AAMA,QAAI;AACJ,QAAI,IAAI,UAAU;AAChB,aAAO,IAAI;AAAA,IACb,WAAW,IAAI,SAAS,QAAW;AACjC,cAAQ,cAAc,IAAI;AAC1B,aAAO,KAAK,UAAU,IAAI,IAAI;AAAA,IAChC;AAEA,UAAM,aAAa,IAAI,aAAa;AACpC,QAAI;AAEJ,aAAS,UAAU,GAAG,WAAW,YAAY,WAAW;AACtD,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,YAAM,UAAU,KAAK,IAAI;AACzB,UAAI;AACF,cAAM,MAAM,MAAM,UAAU,KAAK;AAAA,UAC/B,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA;AAAA,UACA,QAAQ,WAAW;AAAA,QACrB,CAAC;AACD,cAAM,aAAa,KAAK,IAAI,IAAI;AAChC,aAAK,YAAY;AAAA,UACf,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,SAAS,UAAU;AAAA,QACrB,CAAC;AAED,YAAI,IAAI,IAAI;AAEV,cAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,gBAAM,KAAK,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC9C,cAAI,GAAG,SAAS,kBAAkB,GAAG;AACnC,mBAAQ,MAAM,IAAI,KAAK;AAAA,UACzB;AAEA,iBAAQ,MAAM,IAAI,KAAK;AAAA,QACzB;AAGA,YAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,gBAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,gBAAM,UAAU,aAAa,OAAO,UAAU,IAAI,MAAO,MAAM,KAAK,IAAI,GAAG,OAAO;AAClF,gBAAM,MAAM,OAAO;AACnB;AAAA,QACF;AAEA,cAAM,MAAM,kBAAkB,GAAG;AAAA,MACnC,SAAS,KAAK;AACZ,YAAI,eAAe,cAAe,OAAM;AAExC,YAAI,UAAU,YAAY;AACxB,oBAAU;AACV,gBAAM,MAAM,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;AACtC;AAAA,QACF;AACA,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU;AACjD,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,kBAAkB,GAAG;AAAA,UAC9B,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAGA,UAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,2BAA2B;AAAA,EAClF;AAEA,SAAO,EAAE,QAAQ;AACnB;;;ACnLO,IAAM,mBAAmB,CAAC,UAAsB;AAAA;AAAA;AAAA,EAGrD,KAAK,YAAiC,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,SAAS,CAAC;AAClG;;;ACIO,IAAM,8BAA8B,CAAC,MAAkB,aAAqB;AAAA;AAAA;AAAA;AAAA,EAIjF,QAAQ,OAAO,UACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO;AAAA,IAC3B,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM,cAAc,OAAO;AAAA,IAC7B,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,cACV,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA,EAEH,QAAQ,OAAO,WAAmB,UAChC,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,IACjD,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,QAAQ,OAAO,cACb,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,MAAM,OAAO,cACX,KAAK,QAAyB;AAAA,IAC5B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AACL;;;AChDO,IAAM,uBAAuB,CAAC,SAAqB;AACxD,QAAM,SAAS;AAAA,IACb,QAAQ,OAAO,UACb,KAAK,QAAe,EAAE,QAAQ,QAAQ,MAAM,cAAc,MAAM,MAAM,CAAC;AAAA,IAEzE,MAAM,YAA8B;AAClC,YAAM,MAAM,MAAM,KAAK,QAA2B,EAAE,QAAQ,OAAO,MAAM,aAAa,CAAC;AACvF,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,mBAAyC;AAChD,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,YACV,KAAK,QAAe,EAAE,QAAQ,OAAO,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA,IAEtE,QAAQ,OAAO,SAAiB,UAC9B,KAAK,QAAe,EAAE,QAAQ,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,MAAM,CAAC;AAAA,IAErF,QAAQ,OAAO,YACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASxE,UAAU,CAAC,YACT,4BAA4B,MAAM,OAAO;AAAA,EAC7C;AACA,SAAO;AACT;;;ACvCO,IAAM,sBAAsB,CAAC,SAAqB;AACvD,QAAM,QAAQ;AAAA,IACZ,MAAM,OAAO,UAA2B,CAAC,MAA8B;AACrE,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,iBAAiB,UAA2B,CAAC,GAA+B;AACnF,YAAM,OAAO,MAAM,MAAM,KAAK,OAAO;AACrC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,WACV,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,aAAa,MAAM,GAAG,CAAC;AAAA,IAEzE,YAAY,OAAO,WACjB,KAAK,QAA0D;AAAA,MAC7D,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,IAKH,WAAW,OAAO,WAChB,KAAK,QAAkC;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAML;AACA,SAAO;AACT;;;ACrDA,OAAO,QAAQ;AACf,OAAO,UAAU;AAIV,IAAM,+BAA+B,CAAC,UAAsB;AAAA,EACjE,QAAQ,OAAO,SACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM,EAAE,KAAK;AAAA,EACf,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,SACV,KAAK,QAAuB,EAAE,QAAQ,OAAO,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA,EAEpF,QAAQ,OAAO,SACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,EAK9E,YAAY,OACV,MACA,WAG+B;AAC/B,UAAM,OAAO,IAAI,SAAS;AAC1B,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,UAAU,QAAQ;AACpB,YAAM,MAAM,MAAM,GAAG,SAAS,SAAS,OAAO,IAAI;AAClD,iBAAW,OAAO,YAAY,KAAK,SAAS,OAAO,IAAI;AACvD,aAAO,OAAO,YAAY;AAC1B,aAAO,IAAI,KAAK,CAAC,IAAI,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACvD,OAAO;AACL,iBAAW,OAAO;AAClB,aAAO,OAAO,YAAY;AAC1B,YAAM,QAAQ,OAAO,gBAAgB,SAAS,IAAI,WAAW,OAAO,IAAI,IAAI,OAAO;AACnF,aAAO,IAAI,KAAK,CAAC,KAAK,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACzC;AACA,SAAK,OAAO,QAAQ,MAAM,QAAQ;AAKlC,WAAO,KAAK,QAA2B;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,WAAW,IAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,OAAO,SAA+C;AAC/D,UAAM,MAAM,MAAM,KAAK,QAAuC;AAAA,MAC5D,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,IACnC,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,YAAY,OAAO,MAAc,WAC/B,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,uBAAuB,IAAI,UAAU,MAAM;AAAA,EACnD,CAAC;AACL;;;AC3EO,IAAM,wBAAwB,CAAC,SAAqB;AACzD,QAAM,UAAU;AAAA,IACd,YAAY,YACV,KAAK,QAAiD;AAAA,MACpD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA;AAAA,IAGH,WAAW,OAAO,OAA2B,CAAC,MAA8B;AAC1E,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA,IAIA,cAAc,iBAAiB,OAA2B,CAAC,GAA+B;AACxF,YAAM,OAAO,MAAM,QAAQ,UAAU,IAAI;AACzC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,EACF;AACA,SAAO;AACT;;;ACtBO,IAAM,2BAA2B,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA,EAI7D,MAAM,OAAO,UACX,KAAK,QAA6B;AAAA,IAChC,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAAA;AAAA;AAAA,EAIH,MAAM,OACJ,OAA+E,CAAC,MAChD;AAChC,UAAM,QAAqD,CAAC;AAC5D,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,UAAM,MAAM,MAAM,KAAK,QAAsC;AAAA,MAC3D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA;AAAA,EAGA,QAAQ,OACN,YAEA,KAAK,QAAyE;AAAA,IAC5E,QAAQ;AAAA,IACR,MAAM,mBAAmB,OAAO;AAAA,EAClC,CAAC;AACL;;;ACpCO,IAAM,yBAAyB,CAAC,UAAsB;AAAA,EAC3D,YAAY,OACV,UAKI,CAAC,MAC0B;AAC/B,UAAM,MAAM,MAAM,KAAK,QAAqC;AAAA,MAC1D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACJO,IAAM,qBAAqB,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAevD,YAAY,OAAO,UAAqD;AACtE,UAAM,QAA4C,CAAC;AACnD,QAAI,MAAM,YAAY,MAAM,SAAS,SAAS,EAAG,OAAM,WAAW,MAAM,SAAS,KAAK,GAAG;AACzF,UAAM,MAAM,MAAM,KAAK,QAAkC;AAAA,MACvD,QAAQ;AAAA,MACR,MAAM,YAAY,MAAM,KAAK;AAAA,MAC7B;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACbO,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAgC;AAC1C,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,UAAM,OAAO,iBAAiB;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ,WAAW;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,MACpB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,IACrB,CAAC;AAED,SAAK,KAAK,iBAAiB,IAAI;AAC/B,SAAK,SAAS,qBAAqB,IAAI;AACvC,SAAK,QAAQ,oBAAoB,IAAI;AACrC,SAAK,iBAAiB,6BAA6B,IAAI;AACvD,SAAK,UAAU,sBAAsB,IAAI;AACzC,SAAK,aAAa,yBAAyB,IAAI;AAC/C,SAAK,WAAW,uBAAuB,IAAI;AAC3C,SAAK,OAAO,mBAAmB,IAAI;AAAA,EACrC;AACF;;;AC/DA,OAAO,YAAY;AAoBZ,IAAM,yBAAyB,CACpC,SACA,iBACA,WACY;AACZ,MAAI,CAAC,mBAAmB,CAAC,OAAQ,QAAO;AACxC,QAAM,CAAC,MAAM,QAAQ,IAAI,gBAAgB,MAAM,GAAG;AAClD,MAAI,SAAS,YAAY,CAAC,SAAU,QAAO;AAE3C,QAAM,WAAW,OACd,WAAW,UAAU,MAAM,EAC3B,OAAO,OAAO,YAAY,WAAW,UAAU,OAAO,EACtD,OAAO,KAAK;AAGf,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,OAAO,gBAAgB,GAAG,CAAC;AACpC;","names":["path"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@craftedxp/sdk-node",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Node.js / TypeScript SDK for the voice agent platform. Server-side API client — mint call tokens, manage agents, query calls, upload knowledge-base docs.",
   "author": "Crafted XP",
   "license": "MIT",