@craftedxp/sdk-node 0.8.0 → 0.10.1

package/README.md

@@ -24,16 +24,24 @@ const client = new PlatformClient({
   baseUrl: 'https://api.your-server.com', // or http://localhost:8080 for dev
 })
 
-// In your "/voice-token" route handler — called by the RN SDK's fetchToken:
+// In your "/voice-token" route handler — called by the client SDK's fetchToken:
 async function mintForCall({ agentId, userId, context, metadata }) {
-  const { token } = await client.callTokens.mint({
+  const result = await client.callTokens.mint({
     agentId,
     ttlSeconds: 600, // 10 min default; up to 3600 (60 min)
     contactId: userId, // optional → cross-call memory
     context, // optional arbitrary JSON, lowered into agent's system prompt
     metadata, // optional opaque keys round-tripped on call.ended webhook (≤1 KB)
   })
-  return { token } // hand to the RN SDK
+  // Forward `transport` + `webrtcGatewayBase` so the client SDK can
+  // dispatch WS vs WebRTC based on the agent's configuration. New agents
+  // default to `transport: 'webrtc'` (2026-05-16); WS stays as the
+  // back-compat fallback for legacy agents and older client builds.
+  return {
+    token: result.token,
+    transport: result.transport,
+    webrtcGatewayBase: result.webrtcGatewayBase,
+  }
 }
 ```
 
@@ -72,6 +80,57 @@ client.credits.getBalance()                                  // billing
 client.credits.getLedger({ limit, cursor })
 
 client.webhooks.deliveries({ agentId, callId, webhookId })   // org-wide delivery log
+
+client.rooms.create({ agentId, durationMin })                // multi-party video rooms
+client.rooms.list({ status, limit, cursor })
+client.rooms.get(roomId)
+client.rooms.transcript(roomId, { cursor, limit })
+client.rooms.end(roomId)
+```
+
+## Multi-party video rooms
+
+Provision a hosted room from your backend; share the single returned link;
+participants join with **video** in the browser via `@craftedxp/voice-js`
+(`joinRoom`). The room always includes a silent AI notetaker that transcribes
+per speaker — the human-to-human video call works regardless.
+
+```ts
+// Backend — the agent must be allowed to host rooms. Enable it from code
+// (since 0.10.1) instead of the dashboard:
+await client.agents.update(agentId, { canHostRooms: true, roomMode: 'notes-only' })
+// (you can also pass canHostRooms/roomMode to `agents.create`.)
+
+// Mint a room. Returns ONE shared joinToken + a joinUrl; the raw token is
+// returned once and never stored.
+const room = await client.rooms.create({ agentId, durationMin: 30 })
+// → { roomId, status: 'provisioning', joinToken, joinUrl, expiresAt }
+
+// Hand `roomId` + `joinToken` to the browser. There, with @craftedxp/voice-js:
+//   const session = await configureVoiceClient({ apiBase }).joinRoom({
+//     roomId, joinCode: joinToken, name,
+//   })
+//   await session.publishMic(); await session.publishCamera()
+//   session.on('track.subscribed', ({ kind, track }) => kind === 'video' && track.attach(el))
+
+// Read the transcript (cursor-paginated, oldest first) or end the room early:
+const page = await client.rooms.transcript(room.roomId, { limit: 100 })
+await client.rooms.end(room.roomId)
+```
+
+A complete, runnable consumer app (backend + browser video UI) lives in
+[`examples/video-call`](../../examples/video-call).
+
+### Transcribe-only agents
+
+Set `transcribeOnly: true` (on `agents.create` or `agents.update`, since 0.10.1)
+for an agent that **listens but never speaks** — no TTS/LLM, no greeting; user
+turns stream back as `transcript` data-messages over the existing call/WebRTC
+transport. Useful for note-taking / dictation surfaces that reuse the agent +
+call-mint plumbing but want the agent silent.
+
+```ts
+await client.agents.create({ name: 'Scribe', systemPrompt: 'n/a', transcribeOnly: true })
 ```
 
 ## Webhook signature verification

package/dist/index.d.mts

@@ -26,7 +26,7 @@ declare const createHttpClient: (opts: HttpClientOptions) => {
 };
 type HttpClient = ReturnType<typeof createHttpClient>;
 
-type TtsProvider = 'pockettts' | 'cartesia' | 'fish-audio' | 'gemini';
+type TtsProvider = 'pockettts' | 'cartesia' | 'fish-audio' | 'gemini' | 'kokoro' | 'hume' | 'omnivoice' | 'chatterbox' | 'tada';
 type SttProvider = 'deepgram';
 type LlmProvider = 'gemini' | 'openai' | 'anthropic';
 type EndpointingMode = 'smart' | 'simple';
@@ -34,6 +34,20 @@ interface AgentVoice {
     provider: TtsProvider;
     voiceId?: string;
     language?: string;
+    /**
+     * Secondary language for bilingual agents. When set, the agent supports
+     * mid-utterance code-switching via the `[lang=xx]...[/lang]` tag contract.
+     * Requires a multilingual-capable TTS provider (cartesia, kokoro,
+     * fish-audio, hume, omnivoice, gemini). See docs/sdks.md "Bilingual
+     * agents" section.
+     */
+    secondaryLanguage?: string;
+    /**
+     * Second-language voice ID for voice-pinned providers (kokoro). Stays
+     * unset for providers whose voices handle multiple languages natively
+     * (cartesia, hume, omnivoice).
+     */
+    secondaryVoiceId?: string;
     /**
      * Per-utterance variation, 0.0–1.0. Honoured by Fish Audio and
      * Chatterbox (passed through to each provider's synthesis API).
@@ -54,6 +68,13 @@ interface AgentTranscriber {
     provider: SttProvider;
     model: string;
     language?: string;
+    /**
+     * Secondary language for bilingual agents. When set, the STT provider
+     * auto-flips to multi-language mode (Deepgram `multi`, Whisper
+     * auto-detect). Other STT providers reject bilingual config at agent
+     * create time.
+     */
+    secondaryLanguage?: string;
 }
 interface AgentModel {
     provider: LlmProvider;
@@ -122,6 +143,19 @@ interface Agent {
      * cache-buster so browser/CDN caches refresh on replace.
      */
     avatarUrl?: string;
+    /**
+     * Transport the agent's live calls use. `'webrtc'` (the platform default
+     * for new agents) or `'ws'` (legacy). Forwarded on the mint result and
+     * needed by the agent-initiated push payload so the app dispatches to the
+     * right gateway.
+     */
+    transport?: 'ws' | 'webrtc';
+    /** Whether this agent may host multi-party video rooms. */
+    canHostRooms?: boolean;
+    /** Room operating mode (`'notes-only'` today). */
+    roomMode?: 'notes-only';
+    /** Transcribe-only mode — the agent listens but never speaks. */
+    transcribeOnly?: boolean;
     createdAt: number;
     updatedAt: number;
 }
@@ -140,6 +174,8 @@ interface AgentCreateInput {
     recording?: AgentRecording;
     structuredDataSchema?: Record<string, unknown>;
     allowedUserTags?: string[];
+    /** See Agent.transport. Defaults to the platform default when omitted. */
+    transport?: 'ws' | 'webrtc';
     /**
      * Server-managed. Don't set this directly via create/update — use
      * `agents.uploadAvatar(agentId, file)` instead. Sending it raw is
@@ -147,6 +183,25 @@ interface AgentCreateInput {
      * actually changes.
      */
     avatarUrl?: string;
+    /**
+     * Let this agent host multi-party video rooms. Off by default. Required
+     * (`true`) before `client.rooms.create({ agentId })` will accept the agent.
+     */
+    canHostRooms?: boolean;
+    /**
+     * Room operating mode. Today only `'notes-only'` exists — the agent listens
+     * and takes structured notes without speaking. A literal union so future
+     * modes can be added without breaking the wire.
+     */
+    roomMode?: 'notes-only';
+    /**
+     * Transcribe-only mode. When `true`, the agent listens but never speaks: no
+     * TTS/LLM, no greeting, idle nudges suppressed, user turns are not routed
+     * through the LLM — an STT-only loop that streams `transcript` data-messages
+     * back to the caller. `voice` stays required by the schema (defaults apply)
+     * but is never read at runtime.
+     */
+    transcribeOnly?: boolean;
 }
 type AgentUpdateInput = Partial<AgentCreateInput>;
 /**
@@ -323,6 +378,13 @@ interface CallTokenMintInput {
      * if you blindly accept client-asserted tier the gate is theatre.
      */
     userTags?: string[];
+    /**
+     * Mark this token as agent-initiated. When 'agent', the tenant's server
+     * is ringing the end-user (push → app connects) and the resulting
+     * CallRecord is tagged `direction: 'outbound'`. Omit / 'user' for the
+     * default user-initiated connect. See docs/sdks.md "Agent-initiated calls".
+     */
+    initiatedBy?: 'user' | 'agent';
 }
 interface CallTokenMintResult {
     tokenId: string;
@@ -330,6 +392,20 @@ interface CallTokenMintResult {
     agentId: string;
     expiresAt: number;
     allowedOrigins?: string[];
+    /**
+     * Transport the agent is configured for. Forward this to the client
+     * SDK's `fetchToken` (rich return form) so it can dispatch correctly
+     * without a second round-trip. Always present in the response;
+     * defaults to `'ws'` for legacy agent docs missing the field.
+     */
+    transport?: 'ws' | 'webrtc';
+    /**
+     * Signaling gateway base URL when `transport === 'webrtc'` AND the
+     * server has `WEBRTC_GATEWAY_BASE` configured. Forward alongside
+     * `transport` so the client SDK reaches the gateway directly instead
+     * of falling back to the Phase-1 routes on the API base (local dev).
+     */
+    webrtcGatewayBase?: string;
 }
 interface CallTokenSummary {
     tokenId: string;
@@ -386,6 +462,81 @@ interface MeResponse {
     plan: 'free' | 'paid';
     creditBalance: number;
 }
+type RoomStatus = 'provisioning' | 'active' | 'ended';
+type RoomEndReason = 'duration_reached' | 'empty' | 'manual' | 'expired';
+type GuestRole = 'host' | 'participant';
+type WorkerStatus = 'pending' | 'up' | 'down' | 'exited';
+interface CreateRoomInput {
+    agentId: string;
+    /** 1..240 — enforced by the server. */
+    durationMin: number;
+}
+interface CreateRoomResponse {
+    roomId: string;
+    status: 'provisioning';
+    expiresAt: string;
+    /** The shareable room-level secret — returned once, never persisted raw.
+     *  Anyone with this token + a display name joins as a fresh participant. */
+    joinToken: string;
+    /** `${APP_ORIGIN}/rooms/${roomId}/join?t=${joinToken}` — the single link to
+     *  share with everyone you want in the room. */
+    joinUrl: string;
+}
+interface RoomMetricsWire {
+    droppedUtterances: number;
+    deepgramReconnects: number;
+}
+interface RoomDoc {
+    roomId: string;
+    orgId: string;
+    agentId: string;
+    status: RoomStatus;
+    livekitSid: string | null;
+    durationMin: number;
+    /** sha256 of the shared room join token. The raw token is never persisted. */
+    joinTokenJti?: string;
+    createdByApiKeyId?: string;
+    createdAt?: string;
+    startedAt: string | null;
+    endedAt: string | null;
+    expiresAt: string;
+    endReason: RoomEndReason | null;
+    workerStatus?: WorkerStatus;
+    metrics?: RoomMetricsWire | null;
+}
+interface RoomListFilters {
+    status?: RoomStatus;
+    /** Server clamps to 100 max; default 20. */
+    limit?: number;
+    cursor?: string;
+}
+interface ListRoomsResponse {
+    rooms: RoomDoc[];
+    nextCursor: string | null;
+}
+interface RoomTranscriptOptions {
+    cursor?: string;
+    /** Server clamps to 1000 max; default 200. */
+    limit?: number;
+}
+interface UtteranceWire {
+    utteranceId: string;
+    participantId: string;
+    speakerName: string;
+    text: string;
+    startedAt: string;
+    endedAt: string;
+    sttConfidence: number;
+}
+interface ListUtterancesResponse {
+    utterances: UtteranceWire[];
+    nextCursor: string | null;
+}
+/** Returned by host-action endpoints (`/end` and friends) — 202 + eventId so
+ *  callers can correlate the async system-message broadcast that follows. */
+interface RoomEventAck {
+    eventId: string;
+}
 
 declare const createMeResource: (http: HttpClient) => {
     get: () => Promise<MeResponse>;
@@ -522,6 +673,15 @@ declare const createOrgsResource: (http: HttpClient) => {
 };
 type OrgsResource = ReturnType<typeof createOrgsResource>;
 
+declare const createRoomsResource: (http: HttpClient) => {
+    create: (input: CreateRoomInput) => Promise<CreateRoomResponse>;
+    list: (filters?: RoomListFilters) => Promise<ListRoomsResponse>;
+    get: (roomId: string) => Promise<RoomDoc>;
+    transcript: (roomId: string, opts?: RoomTranscriptOptions) => Promise<ListUtterancesResponse>;
+    end: (roomId: string) => Promise<RoomEventAck>;
+};
+type RoomsResource = ReturnType<typeof createRoomsResource>;
+
 interface PlatformClientOptions {
     apiKey: string;
     baseUrl?: string;
@@ -539,6 +699,7 @@ declare class PlatformClient {
     readonly callTokens: CallTokensResource;
     readonly webhooks: WebhooksResource;
     readonly orgs: OrgsResource;
+    readonly rooms: RoomsResource;
     constructor(options: PlatformClientOptions);
 }
 
@@ -562,4 +723,4 @@ declare class PlatformError extends Error {
 
 declare const verifyWebhookSignature: (rawBody: Buffer | string, signatureHeader: string, secret: string) => boolean;
 
-export { type Agent, type AgentCreateInput, type AgentEndpointing, type AgentHttpTool, type AgentModel, type AgentRecording, type AgentTool, type AgentTranscriber, type AgentUpdateInput, type AgentVoice, type AgentWebhooksResource, type AgentsResource, type ApiErrorCode, type CallListFilters, type CallRecord, type CallRecordingUrlResponse, type CallStatus, type CallSummary, type CallTokenMintInput, type CallTokenMintResult, type CallTokenSummary, type CallTokensResource, type CallsResource, type CatalogAgent, type CatalogListInput, type CostBreakdown, type CreditsResource, type EndReason, type EndpointingMode, type KnowledgeBase, type KnowledgeBaseFile, type KnowledgeBasesResource, type LedgerEntry, type LlmProvider, type MeResource, type MeResponse, type OrgsResource, PlatformClient, type PlatformClientOptions, PlatformError, type PlatformEventName, type RecordingMeta, type SttProvider, type TranscriptTurn, type TtsProvider, type WebhookConfig, type WebhookCreateInput, type WebhookDelivery, type WebhookUpdateInput, type WebhooksResource, verifyWebhookSignature };
+export { type Agent, type AgentCreateInput, type AgentEndpointing, type AgentHttpTool, type AgentModel, type AgentRecording, type AgentTool, type AgentTranscriber, type AgentUpdateInput, type AgentVoice, type AgentWebhooksResource, type AgentsResource, type ApiErrorCode, type CallListFilters, type CallRecord, type CallRecordingUrlResponse, type CallStatus, type CallSummary, type CallTokenMintInput, type CallTokenMintResult, type CallTokenSummary, type CallTokensResource, type CallsResource, type CatalogAgent, type CatalogListInput, type CostBreakdown, type CreateRoomInput, type CreateRoomResponse, type CreditsResource, type EndReason, type EndpointingMode, type GuestRole, type KnowledgeBase, type KnowledgeBaseFile, type KnowledgeBasesResource, type LedgerEntry, type ListRoomsResponse, type ListUtterancesResponse, type LlmProvider, type MeResource, type MeResponse, type OrgsResource, PlatformClient, type PlatformClientOptions, PlatformError, type PlatformEventName, type RecordingMeta, type RoomDoc, type RoomEndReason, type RoomEventAck, type RoomListFilters, type RoomMetricsWire, type RoomStatus, type RoomTranscriptOptions, type RoomsResource, type SttProvider, type TranscriptTurn, type TtsProvider, type UtteranceWire, type WebhookConfig, type WebhookCreateInput, type WebhookDelivery, type WebhookUpdateInput, type WebhooksResource, type WorkerStatus, verifyWebhookSignature };

package/dist/index.d.ts

@@ -26,7 +26,7 @@ declare const createHttpClient: (opts: HttpClientOptions) => {
 };
 type HttpClient = ReturnType<typeof createHttpClient>;
 
-type TtsProvider = 'pockettts' | 'cartesia' | 'fish-audio' | 'gemini';
+type TtsProvider = 'pockettts' | 'cartesia' | 'fish-audio' | 'gemini' | 'kokoro' | 'hume' | 'omnivoice' | 'chatterbox' | 'tada';
 type SttProvider = 'deepgram';
 type LlmProvider = 'gemini' | 'openai' | 'anthropic';
 type EndpointingMode = 'smart' | 'simple';
@@ -34,6 +34,20 @@ interface AgentVoice {
     provider: TtsProvider;
     voiceId?: string;
     language?: string;
+    /**
+     * Secondary language for bilingual agents. When set, the agent supports
+     * mid-utterance code-switching via the `[lang=xx]...[/lang]` tag contract.
+     * Requires a multilingual-capable TTS provider (cartesia, kokoro,
+     * fish-audio, hume, omnivoice, gemini). See docs/sdks.md "Bilingual
+     * agents" section.
+     */
+    secondaryLanguage?: string;
+    /**
+     * Second-language voice ID for voice-pinned providers (kokoro). Stays
+     * unset for providers whose voices handle multiple languages natively
+     * (cartesia, hume, omnivoice).
+     */
+    secondaryVoiceId?: string;
     /**
      * Per-utterance variation, 0.0–1.0. Honoured by Fish Audio and
      * Chatterbox (passed through to each provider's synthesis API).
@@ -54,6 +68,13 @@ interface AgentTranscriber {
     provider: SttProvider;
     model: string;
     language?: string;
+    /**
+     * Secondary language for bilingual agents. When set, the STT provider
+     * auto-flips to multi-language mode (Deepgram `multi`, Whisper
+     * auto-detect). Other STT providers reject bilingual config at agent
+     * create time.
+     */
+    secondaryLanguage?: string;
 }
 interface AgentModel {
     provider: LlmProvider;
@@ -122,6 +143,19 @@ interface Agent {
      * cache-buster so browser/CDN caches refresh on replace.
      */
     avatarUrl?: string;
+    /**
+     * Transport the agent's live calls use. `'webrtc'` (the platform default
+     * for new agents) or `'ws'` (legacy). Forwarded on the mint result and
+     * needed by the agent-initiated push payload so the app dispatches to the
+     * right gateway.
+     */
+    transport?: 'ws' | 'webrtc';
+    /** Whether this agent may host multi-party video rooms. */
+    canHostRooms?: boolean;
+    /** Room operating mode (`'notes-only'` today). */
+    roomMode?: 'notes-only';
+    /** Transcribe-only mode — the agent listens but never speaks. */
+    transcribeOnly?: boolean;
     createdAt: number;
     updatedAt: number;
 }
@@ -140,6 +174,8 @@ interface AgentCreateInput {
     recording?: AgentRecording;
     structuredDataSchema?: Record<string, unknown>;
     allowedUserTags?: string[];
+    /** See Agent.transport. Defaults to the platform default when omitted. */
+    transport?: 'ws' | 'webrtc';
     /**
      * Server-managed. Don't set this directly via create/update — use
      * `agents.uploadAvatar(agentId, file)` instead. Sending it raw is
@@ -147,6 +183,25 @@ interface AgentCreateInput {
      * actually changes.
      */
     avatarUrl?: string;
+    /**
+     * Let this agent host multi-party video rooms. Off by default. Required
+     * (`true`) before `client.rooms.create({ agentId })` will accept the agent.
+     */
+    canHostRooms?: boolean;
+    /**
+     * Room operating mode. Today only `'notes-only'` exists — the agent listens
+     * and takes structured notes without speaking. A literal union so future
+     * modes can be added without breaking the wire.
+     */
+    roomMode?: 'notes-only';
+    /**
+     * Transcribe-only mode. When `true`, the agent listens but never speaks: no
+     * TTS/LLM, no greeting, idle nudges suppressed, user turns are not routed
+     * through the LLM — an STT-only loop that streams `transcript` data-messages
+     * back to the caller. `voice` stays required by the schema (defaults apply)
+     * but is never read at runtime.
+     */
+    transcribeOnly?: boolean;
 }
 type AgentUpdateInput = Partial<AgentCreateInput>;
 /**
@@ -323,6 +378,13 @@ interface CallTokenMintInput {
      * if you blindly accept client-asserted tier the gate is theatre.
      */
     userTags?: string[];
+    /**
+     * Mark this token as agent-initiated. When 'agent', the tenant's server
+     * is ringing the end-user (push → app connects) and the resulting
+     * CallRecord is tagged `direction: 'outbound'`. Omit / 'user' for the
+     * default user-initiated connect. See docs/sdks.md "Agent-initiated calls".
+     */
+    initiatedBy?: 'user' | 'agent';
 }
 interface CallTokenMintResult {
     tokenId: string;
@@ -330,6 +392,20 @@ interface CallTokenMintResult {
     agentId: string;
     expiresAt: number;
     allowedOrigins?: string[];
+    /**
+     * Transport the agent is configured for. Forward this to the client
+     * SDK's `fetchToken` (rich return form) so it can dispatch correctly
+     * without a second round-trip. Always present in the response;
+     * defaults to `'ws'` for legacy agent docs missing the field.
+     */
+    transport?: 'ws' | 'webrtc';
+    /**
+     * Signaling gateway base URL when `transport === 'webrtc'` AND the
+     * server has `WEBRTC_GATEWAY_BASE` configured. Forward alongside
+     * `transport` so the client SDK reaches the gateway directly instead
+     * of falling back to the Phase-1 routes on the API base (local dev).
+     */
+    webrtcGatewayBase?: string;
 }
 interface CallTokenSummary {
     tokenId: string;
@@ -386,6 +462,81 @@ interface MeResponse {
     plan: 'free' | 'paid';
     creditBalance: number;
 }
+type RoomStatus = 'provisioning' | 'active' | 'ended';
+type RoomEndReason = 'duration_reached' | 'empty' | 'manual' | 'expired';
+type GuestRole = 'host' | 'participant';
+type WorkerStatus = 'pending' | 'up' | 'down' | 'exited';
+interface CreateRoomInput {
+    agentId: string;
+    /** 1..240 — enforced by the server. */
+    durationMin: number;
+}
+interface CreateRoomResponse {
+    roomId: string;
+    status: 'provisioning';
+    expiresAt: string;
+    /** The shareable room-level secret — returned once, never persisted raw.
+     *  Anyone with this token + a display name joins as a fresh participant. */
+    joinToken: string;
+    /** `${APP_ORIGIN}/rooms/${roomId}/join?t=${joinToken}` — the single link to
+     *  share with everyone you want in the room. */
+    joinUrl: string;
+}
+interface RoomMetricsWire {
+    droppedUtterances: number;
+    deepgramReconnects: number;
+}
+interface RoomDoc {
+    roomId: string;
+    orgId: string;
+    agentId: string;
+    status: RoomStatus;
+    livekitSid: string | null;
+    durationMin: number;
+    /** sha256 of the shared room join token. The raw token is never persisted. */
+    joinTokenJti?: string;
+    createdByApiKeyId?: string;
+    createdAt?: string;
+    startedAt: string | null;
+    endedAt: string | null;
+    expiresAt: string;
+    endReason: RoomEndReason | null;
+    workerStatus?: WorkerStatus;
+    metrics?: RoomMetricsWire | null;
+}
+interface RoomListFilters {
+    status?: RoomStatus;
+    /** Server clamps to 100 max; default 20. */
+    limit?: number;
+    cursor?: string;
+}
+interface ListRoomsResponse {
+    rooms: RoomDoc[];
+    nextCursor: string | null;
+}
+interface RoomTranscriptOptions {
+    cursor?: string;
+    /** Server clamps to 1000 max; default 200. */
+    limit?: number;
+}
+interface UtteranceWire {
+    utteranceId: string;
+    participantId: string;
+    speakerName: string;
+    text: string;
+    startedAt: string;
+    endedAt: string;
+    sttConfidence: number;
+}
+interface ListUtterancesResponse {
+    utterances: UtteranceWire[];
+    nextCursor: string | null;
+}
+/** Returned by host-action endpoints (`/end` and friends) — 202 + eventId so
+ *  callers can correlate the async system-message broadcast that follows. */
+interface RoomEventAck {
+    eventId: string;
+}
 
 declare const createMeResource: (http: HttpClient) => {
     get: () => Promise<MeResponse>;
@@ -522,6 +673,15 @@ declare const createOrgsResource: (http: HttpClient) => {
 };
 type OrgsResource = ReturnType<typeof createOrgsResource>;
 
+declare const createRoomsResource: (http: HttpClient) => {
+    create: (input: CreateRoomInput) => Promise<CreateRoomResponse>;
+    list: (filters?: RoomListFilters) => Promise<ListRoomsResponse>;
+    get: (roomId: string) => Promise<RoomDoc>;
+    transcript: (roomId: string, opts?: RoomTranscriptOptions) => Promise<ListUtterancesResponse>;
+    end: (roomId: string) => Promise<RoomEventAck>;
+};
+type RoomsResource = ReturnType<typeof createRoomsResource>;
+
 interface PlatformClientOptions {
     apiKey: string;
     baseUrl?: string;
@@ -539,6 +699,7 @@ declare class PlatformClient {
     readonly callTokens: CallTokensResource;
     readonly webhooks: WebhooksResource;
     readonly orgs: OrgsResource;
+    readonly rooms: RoomsResource;
     constructor(options: PlatformClientOptions);
 }
 
@@ -562,4 +723,4 @@ declare class PlatformError extends Error {
 
 declare const verifyWebhookSignature: (rawBody: Buffer | string, signatureHeader: string, secret: string) => boolean;
 
-export { type Agent, type AgentCreateInput, type AgentEndpointing, type AgentHttpTool, type AgentModel, type AgentRecording, type AgentTool, type AgentTranscriber, type AgentUpdateInput, type AgentVoice, type AgentWebhooksResource, type AgentsResource, type ApiErrorCode, type CallListFilters, type CallRecord, type CallRecordingUrlResponse, type CallStatus, type CallSummary, type CallTokenMintInput, type CallTokenMintResult, type CallTokenSummary, type CallTokensResource, type CallsResource, type CatalogAgent, type CatalogListInput, type CostBreakdown, type CreditsResource, type EndReason, type EndpointingMode, type KnowledgeBase, type KnowledgeBaseFile, type KnowledgeBasesResource, type LedgerEntry, type LlmProvider, type MeResource, type MeResponse, type OrgsResource, PlatformClient, type PlatformClientOptions, PlatformError, type PlatformEventName, type RecordingMeta, type SttProvider, type TranscriptTurn, type TtsProvider, type WebhookConfig, type WebhookCreateInput, type WebhookDelivery, type WebhookUpdateInput, type WebhooksResource, verifyWebhookSignature };
+export { type Agent, type AgentCreateInput, type AgentEndpointing, type AgentHttpTool, type AgentModel, type AgentRecording, type AgentTool, type AgentTranscriber, type AgentUpdateInput, type AgentVoice, type AgentWebhooksResource, type AgentsResource, type ApiErrorCode, type CallListFilters, type CallRecord, type CallRecordingUrlResponse, type CallStatus, type CallSummary, type CallTokenMintInput, type CallTokenMintResult, type CallTokenSummary, type CallTokensResource, type CallsResource, type CatalogAgent, type CatalogListInput, type CostBreakdown, type CreateRoomInput, type CreateRoomResponse, type CreditsResource, type EndReason, type EndpointingMode, type GuestRole, type KnowledgeBase, type KnowledgeBaseFile, type KnowledgeBasesResource, type LedgerEntry, type ListRoomsResponse, type ListUtterancesResponse, type LlmProvider, type MeResource, type MeResponse, type OrgsResource, PlatformClient, type PlatformClientOptions, PlatformError, type PlatformEventName, type RecordingMeta, type RoomDoc, type RoomEndReason, type RoomEventAck, type RoomListFilters, type RoomMetricsWire, type RoomStatus, type RoomTranscriptOptions, type RoomsResource, type SttProvider, type TranscriptTurn, type TtsProvider, type UtteranceWire, type WebhookConfig, type WebhookCreateInput, type WebhookDelivery, type WebhookUpdateInput, type WebhooksResource, type WorkerStatus, verifyWebhookSignature };

package/dist/index.js

@@ -482,6 +482,57 @@ var createOrgsResource = (http) => ({
   }
 });
 
+// src/resources/rooms.ts
+var createRoomsResource = (http) => ({
+  // Provision a new room. Server returns 201 with ONE shared room-level
+  // `joinToken` + `joinUrl`. Share the single link with everyone you want in
+  // the room — each visitor supplies their own display name at join time and
+  // becomes a fresh, distinct participant. The server persists only the
+  // token's sha256 hash; the raw token is returned here once and never stored.
+  create: async (input) => http.request({
+    method: "POST",
+    path: "/v1/rooms",
+    body: input
+  }),
+  // Listing — opaque cursor pagination (`nextCursor` returned by the server
+  // is whatever startAfter() needs, don't parse client-side).
+  list: async (filters = {}) => {
+    const query = {};
+    if (filters.status) query.status = filters.status;
+    if (filters.limit !== void 0) query.limit = filters.limit;
+    if (filters.cursor) query.cursor = filters.cursor;
+    return http.request({
+      method: "GET",
+      path: "/v1/rooms",
+      query
+    });
+  },
+  // Fetch a single room. 404s are surfaced as PlatformError('not_found').
+  get: async (roomId) => http.request({
+    method: "GET",
+    path: `/v1/rooms/${roomId}`
+  }),
+  // Transcript pages — utterances are ordered by `startedAt asc`. Cursor is
+  // an ISO timestamp (server enforces, don't construct yourself).
+  transcript: async (roomId, opts = {}) => {
+    const query = {};
+    if (opts.cursor) query.cursor = opts.cursor;
+    if (opts.limit !== void 0) query.limit = opts.limit;
+    return http.request({
+      method: "GET",
+      path: `/v1/rooms/${roomId}/transcript`,
+      query
+    });
+  },
+  // End a room — async on the server: returns 202 + eventId once the
+  // controlEvents entry is written. The room-worker observes the entry,
+  // broadcasts the system message, and tears down LiveKit shortly after.
+  end: async (roomId) => http.request({
+    method: "POST",
+    path: `/v1/rooms/${roomId}/end`
+  })
+});
+
 // src/PlatformClient.ts
 var PlatformClient = class {
   me;
@@ -492,6 +543,7 @@ var PlatformClient = class {
   callTokens;
   webhooks;
   orgs;
+  rooms;
   constructor(options) {
     if (!options.apiKey) {
       throw new Error("PlatformClient: `apiKey` is required");
@@ -512,6 +564,7 @@ var PlatformClient = class {
     this.callTokens = createCallTokensResource(http);
     this.webhooks = createWebhooksResource(http);
     this.orgs = createOrgsResource(http);
+    this.rooms = createRoomsResource(http);
   }
 };
 

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/http.ts","../src/resources/me.ts","../src/resources/agentWebhooks.ts","../src/resources/agents.ts","../src/resources/calls.ts","../src/resources/knowledgeBases.ts","../src/resources/credits.ts","../src/resources/callTokens.ts","../src/resources/webhooks.ts","../src/resources/orgs.ts","../src/PlatformClient.ts","../src/verify.ts"],"sourcesContent":["// Public API of @craftedxp/sdk-node.\n\nexport { PlatformClient } from './PlatformClient'\nexport type { PlatformClientOptions } from './PlatformClient'\n\n// Error class for `instanceof` checks in consumer code.\nexport { PlatformError } from './errors'\nexport type { ApiErrorCode } from './errors'\n\n// Webhook signature verification helper — standalone so frameworks\n// (Express, Koa, Next.js route handlers) can use it without instantiating\n// a PlatformClient.\nexport { verifyWebhookSignature } from './verify'\n\n// Re-export DTO types. Consumers often type their own storage models\n// against these — re-exporting avoids `import type` gymnastics.\nexport type * from './types'\n\n// Advanced: expose the resource types for consumers subclassing / wrapping\n// the client. 99% of users don't need these.\nexport type { MeResource } from './resources/me'\nexport type { AgentsResource } from './resources/agents'\nexport type { AgentWebhooksResource } from './resources/agentWebhooks'\nexport type { CallsResource } from './resources/calls'\nexport type { KnowledgeBasesResource } from './resources/knowledgeBases'\nexport type { CreditsResource } from './resources/credits'\nexport type { CallTokensResource } from './resources/callTokens'\nexport type { WebhooksResource } from './resources/webhooks'\nexport type { OrgsResource } from './resources/orgs'\n","// Typed error class mirroring the server's ErrorV1 shape:\n//   { error: { code, message, field?, docs_url? } }\n//\n// Consumers do `err instanceof PlatformError` to branch on code without\n// parsing string messages. `status` carries the HTTP code for the 1% of\n// cases where the code field isn't enough (e.g. rate-limit → retry-after\n// header correlation).\n\nexport type ApiErrorCode =\n  | 'unauthorized'\n  | 'forbidden'\n  | 'not_found'\n  | 'bad_request'\n  | 'conflict'\n  | 'rate_limited'\n  | 'payment_required'\n  | 'internal_error'\n  | 'unknown'\n\nexport class PlatformError extends Error {\n  readonly code: ApiErrorCode\n  readonly status: number\n  readonly field?: string\n  readonly docsUrl?: string\n  // The raw response body for debugging. Intentionally optional — we clear\n  // it on `error.toJSON()` so logging libraries don't dump the whole\n  // server response into production logs.\n  readonly body?: unknown\n\n  constructor(params: {\n    code: ApiErrorCode\n    message: string\n    status: number\n    field?: string\n    docsUrl?: string\n    body?: unknown\n  }) {\n    super(params.message)\n    this.name = 'PlatformError'\n    this.code = params.code\n    this.status = params.status\n    this.field = params.field\n    this.docsUrl = params.docsUrl\n    this.body = params.body\n    // Preserve the stack trace — Node's Error doesn't capture it\n    // automatically when subclassing in some older runtimes.\n    if (\n      typeof (Error as typeof Error & { captureStackTrace?: unknown }).captureStackTrace ===\n      'function'\n    ) {\n      ;(\n        Error as typeof Error & { captureStackTrace: (target: unknown, ctor: unknown) => void }\n      ).captureStackTrace(this, PlatformError)\n    }\n  }\n\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      field: this.field,\n      docsUrl: this.docsUrl,\n    }\n  }\n}\n","import { PlatformError, type ApiErrorCode } from './errors'\n\n// Low-level HTTP wrapper around `fetch` (native in Node 18+). Every resource\n// method routes through here for consistent auth + error handling + retries.\n//\n// v1 scope: JSON-in / JSON-out + multipart for file uploads. No streaming —\n// call WebSockets go through @craftedxp/voice-rn (the React Native client)\n// or a web equivalent, not this server-side SDK.\n\nexport interface HttpClientOptions {\n  apiKey: string\n  baseUrl: string\n  // Default 30s. File uploads can override per-request.\n  timeoutMs?: number\n  // 429 + 5xx retries. Defaults to 3 attempts (original + 2 retries) with\n  // exponential backoff (250ms, 1s). Set to 0 to disable.\n  maxRetries?: number\n  // Optional — lets consumers swap in a test/mock fetch (or a custom one\n  // with instrumentation). Defaults to the global.\n  fetch?: typeof fetch\n  // Optional — a callback that fires per-request with the final status and\n  // duration. Handy for dropping traces into the consumer's observability\n  // stack without wrapping each call.\n  onRequest?: (info: {\n    method: string\n    url: string\n    status: number\n    durationMs: number\n    attempt: number\n  }) => void\n}\n\nexport interface HttpRequest {\n  method: 'GET' | 'POST' | 'PATCH' | 'DELETE'\n  path: string // starts with `/`, e.g. `/v1/agents/123`\n  query?: Record<string, string | number | boolean | undefined>\n  body?: unknown // JSON-serialised — for multipart use `formData`\n  formData?: FormData\n  timeoutMs?: number\n  // Exposed for edge cases where a resource wants to tack on extra\n  // headers (we don't have any today but leave the hook).\n  headers?: Record<string, string>\n}\n\nconst DEFAULT_TIMEOUT_MS = 30_000\nconst DEFAULT_MAX_RETRIES = 2 // total attempts = 3\n\nconst buildUrl = (baseUrl: string, path: string, query?: HttpRequest['query']): string => {\n  const u = new URL(path, baseUrl)\n  if (query) {\n    for (const [k, v] of Object.entries(query)) {\n      if (v === undefined) continue\n      u.searchParams.set(k, String(v))\n    }\n  }\n  return u.toString()\n}\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\nconst isRetryable = (status: number): boolean => status === 429 || (status >= 500 && status < 600)\n\n// Parse whatever the server returned into a PlatformError. Falls back to\n// synthesising a sensible error for non-JSON responses.\nconst errorFromResponse = async (res: Response): Promise<PlatformError> => {\n  const bodyText = await res.text().catch(() => '')\n  let parsed: unknown = undefined\n  try {\n    parsed = bodyText ? JSON.parse(bodyText) : undefined\n  } catch {\n    // non-JSON response (e.g. an HTML error page from a proxy). Fall\n    // through with parsed = undefined.\n  }\n  const errObj = (\n    parsed as { error?: { code?: string; message?: string; field?: string; docs_url?: string } }\n  )?.error\n  return new PlatformError({\n    code: (errObj?.code as ApiErrorCode) ?? 'unknown',\n    message: errObj?.message ?? res.statusText ?? `HTTP ${res.status}`,\n    status: res.status,\n    field: errObj?.field,\n    docsUrl: errObj?.docs_url,\n    body: parsed ?? bodyText,\n  })\n}\n\nexport const createHttpClient = (opts: HttpClientOptions) => {\n  const fetchImpl = opts.fetch ?? globalThis.fetch\n  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS\n  const maxRetries = opts.maxRetries ?? DEFAULT_MAX_RETRIES\n\n  if (!fetchImpl) {\n    throw new Error('No global fetch available. @craftedxp/sdk-node requires Node >= 18.')\n  }\n\n  const request = async <T>(req: HttpRequest): Promise<T> => {\n    const url = buildUrl(opts.baseUrl, req.path, req.query)\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${opts.apiKey}`,\n      Accept: 'application/json',\n      ...(req.headers ?? {}),\n    }\n\n    // Body shaping: prefer formData when provided; otherwise JSON.\n    // `FormData` sets its own Content-Type with boundary — don't preempt it.\n    // Typed as `string | FormData | undefined` (a subset of the global\n    // BodyInit) so we don't need DOM lib types in this server-side SDK.\n    let body: string | FormData | undefined\n    if (req.formData) {\n      body = req.formData\n    } else if (req.body !== undefined) {\n      headers['Content-Type'] = 'application/json'\n      body = JSON.stringify(req.body)\n    }\n\n    const reqTimeout = req.timeoutMs ?? timeoutMs\n    let lastErr: unknown\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      const controller = new AbortController()\n      const timer = setTimeout(() => controller.abort(), reqTimeout)\n      const started = Date.now()\n      try {\n        const res = await fetchImpl(url, {\n          method: req.method,\n          headers,\n          body,\n          signal: controller.signal,\n        })\n        const durationMs = Date.now() - started\n        opts.onRequest?.({\n          method: req.method,\n          url,\n          status: res.status,\n          durationMs,\n          attempt: attempt + 1,\n        })\n\n        if (res.ok) {\n          // 204 No Content — some endpoints (DELETE webhooks) return nothing.\n          if (res.status === 204) return undefined as T\n          const ct = res.headers.get('content-type') ?? ''\n          if (ct.includes('application/json')) {\n            return (await res.json()) as T\n          }\n          // Non-JSON 2xx — rare. Return raw text cast as T.\n          return (await res.text()) as unknown as T\n        }\n\n        // Retryable error: back off + retry up to maxRetries.\n        if (isRetryable(res.status) && attempt < maxRetries) {\n          const retryAfter = res.headers.get('Retry-After')\n          const backoff = retryAfter ? Number(retryAfter) * 1000 : 250 * Math.pow(2, attempt)\n          await sleep(backoff)\n          continue\n        }\n\n        throw await errorFromResponse(res)\n      } catch (err) {\n        if (err instanceof PlatformError) throw err\n        // AbortError / network / DNS failures — retry up to maxRetries.\n        if (attempt < maxRetries) {\n          lastErr = err\n          await sleep(250 * Math.pow(2, attempt))\n          continue\n        }\n        const msg = err instanceof Error ? err.message : 'network error'\n        throw new PlatformError({\n          code: 'unknown',\n          message: `Network error: ${msg}`,\n          status: 0,\n        })\n      } finally {\n        clearTimeout(timer)\n      }\n    }\n\n    // Should be unreachable — the loop either returns, throws, or continues.\n    throw lastErr instanceof Error ? lastErr : new Error('request exhausted retries')\n  }\n\n  return { request }\n}\n\nexport type HttpClient = ReturnType<typeof createHttpClient>\n","import type { HttpClient } from '../http'\nimport type { MeResponse } from '../types'\n\nexport const createMeResource = (http: HttpClient) => ({\n  // Smoke test — confirms the API key is valid and returns the org + balance.\n  // Most consumers use this as a ping on startup.\n  get: async (): Promise<MeResponse> => http.request<MeResponse>({ method: 'GET', path: '/v1/me' }),\n})\n\nexport type MeResource = ReturnType<typeof createMeResource>\n","import type { HttpClient } from '../http'\nimport type {\n  WebhookConfig,\n  WebhookCreateInput,\n  WebhookDelivery,\n  WebhookUpdateInput,\n} from '../types'\n\n// Per-agent webhook resource, scoped at factory time to a specific agentId.\n// All endpoints mirror /v1/agents/:agentId/webhooks[/:id].\n\nexport const createAgentWebhooksResource = (http: HttpClient, agentId: string) => ({\n  // Returns the webhook + its signing secret. The secret is only present in\n  // this response — persist immediately, subsequent GETs omit it. Use the\n  // secret to verify `X-Platform-Signature-256` (sha256=hex HMAC over body).\n  create: async (input: WebhookCreateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks`,\n      body: input,\n    }),\n\n  list: async (): Promise<WebhookConfig[]> => {\n    const res = await http.request<{ data: WebhookConfig[] }>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks`,\n    })\n    return res.data\n  },\n\n  get: async (webhookId: string): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  update: async (webhookId: string, patch: WebhookUpdateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'PATCH',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n      body: patch,\n    }),\n\n  delete: async (webhookId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  // Fires a synthetic call.started against this webhook and returns the\n  // full delivery record (including attempt status codes) once the retry\n  // sequence has finished. Useful during setup to verify receiver wiring.\n  test: async (webhookId: string): Promise<WebhookDelivery> =>\n    http.request<WebhookDelivery>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}/test`,\n    }),\n})\n\nexport type AgentWebhooksResource = ReturnType<typeof createAgentWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { Agent, AgentCreateInput, AgentUpdateInput } from '../types'\nimport { createAgentWebhooksResource, type AgentWebhooksResource } from './agentWebhooks'\n\n// The server returns Agent with `apiKey` stripped and `hasApiKey: boolean`\n// on the model. We type the happy path but keep our input type permissive\n// so consumers can POST a plaintext `apiKey` that the server encrypts +\n// swaps for `apiKeySecret` on persistence.\n\nexport const createAgentsResource = (http: HttpClient) => {\n  const agents = {\n    create: async (input: AgentCreateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'POST', path: '/v1/agents', body: input }),\n\n    list: async (): Promise<Agent[]> => {\n      const res = await http.request<{ data: Agent[] }>({ method: 'GET', path: '/v1/agents' })\n      return res.data\n    },\n\n    // Async iterator for \"give me every agent\" — v1 server returns the full\n    // list in one page, so this is just a thin convenience. When the server\n    // picks up cursor pagination, this is the method that papers over that\n    // migration without consumer changes.\n    listAll: async function* (): AsyncIterable<Agent> {\n      const page = await agents.list()\n      for (const a of page) yield a\n    },\n\n    get: async (agentId: string): Promise<Agent> =>\n      http.request<Agent>({ method: 'GET', path: `/v1/agents/${agentId}` }),\n\n    update: async (agentId: string, patch: AgentUpdateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'PATCH', path: `/v1/agents/${agentId}`, body: patch }),\n\n    delete: async (agentId: string): Promise<void> =>\n      http.request<void>({ method: 'DELETE', path: `/v1/agents/${agentId}` }),\n\n    /**\n     * Upload an avatar image for the agent. Server re-encodes to a 512×512\n     * WebP and stores it in the public-read avatars bucket; the returned\n     * `Agent` has `avatarUrl` set to the canonical public URL with a\n     * `?v=` cache-buster.\n     *\n     * `file` accepts a Node Buffer / Uint8Array / Blob / typed-array.\n     * `filename` and `contentType` are optional but help the server log\n     * meaningful errors when something rejects.\n     */\n    uploadAvatar: async (\n      agentId: string,\n      file: Buffer | Uint8Array | Blob | ArrayBuffer,\n      opts: { filename?: string; contentType?: string } = {},\n    ): Promise<Agent> => {\n      const fd = new FormData()\n      const blob =\n        file instanceof Blob\n          ? file\n          : // eslint-disable-next-line @typescript-eslint/no-explicit-any\n            new Blob([file as any], { type: opts.contentType ?? 'application/octet-stream' })\n      fd.append('file', blob, opts.filename ?? 'avatar')\n      return http.request<Agent>({\n        method: 'POST',\n        path: `/v1/agents/${agentId}/avatar`,\n        formData: fd,\n      })\n    },\n\n    /**\n     * Remove the agent's avatar — both the GCS object and the `avatarUrl`\n     * field. Idempotent: calling on an agent without an avatar still\n     * returns the agent.\n     */\n    removeAvatar: async (agentId: string): Promise<Agent> =>\n      http.request<Agent>({ method: 'DELETE', path: `/v1/agents/${agentId}/avatar` }),\n\n    // Nested resource. Per-agent webhook CRUD lives at\n    // /v1/agents/:agentId/webhooks/* — we expose it as a factory keyed on\n    // agentId so consumers can bind once and reuse:\n    //\n    //   const hooks = client.agents.webhooks(myAgentId)\n    //   await hooks.create({ url, events })\n    //   await hooks.list()\n    webhooks: (agentId: string): AgentWebhooksResource =>\n      createAgentWebhooksResource(http, agentId),\n  }\n  return agents\n}\n\nexport type AgentsResource = ReturnType<typeof createAgentsResource>\n","import type { HttpClient } from '../http'\nimport type {\n  CallListFilters,\n  CallRecord,\n  CallRecordingUrlResponse,\n  CallSummary,\n  TranscriptTurn,\n} from '../types'\n\nexport const createCallsResource = (http: HttpClient) => {\n  const calls = {\n    list: async (filters: CallListFilters = {}): Promise<CallSummary[]> => {\n      const res = await http.request<{ data: CallSummary[] }>({\n        method: 'GET',\n        path: '/v1/calls',\n        query: filters as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination helper. v1 server caps at limit (max 200) in a single\n    // page — consumers who ask for \"every call since X\" get that page, the\n    // iterator ends. This is the shape we'd extend with cursor support\n    // without breaking callers.\n    listAll: async function* (filters: CallListFilters = {}): AsyncIterable<CallSummary> {\n      const page = await calls.list(filters)\n      for (const c of page) yield c\n    },\n\n    get: async (callId: string): Promise<CallRecord> =>\n      http.request<CallRecord>({ method: 'GET', path: `/v1/calls/${callId}` }),\n\n    transcript: async (callId: string): Promise<{ callId: string; transcript: TranscriptTurn[] }> =>\n      http.request<{ callId: string; transcript: TranscriptTurn[] }>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/transcript`,\n      }),\n\n    // Returns a V4 signed URL (1-hour TTL). `ready: false` + `artifact:\n    // 'caller-raw'` means the async mix job hasn't finished — the URL still\n    // points at a playable file (raw caller PCM).\n    recording: async (callId: string): Promise<CallRecordingUrlResponse> =>\n      http.request<CallRecordingUrlResponse>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/recording`,\n      }),\n\n    // Outbound dialling (POST /v1/calls) + in-call control are Phase 1.4.4 /\n    // 1.4.5 respectively — blocked on telephony. Surface clear \"not built\n    // yet\" errors here if consumers guess those method names, so they don't\n    // silently hit a non-existent endpoint and wonder why it 404s.\n  }\n  return calls\n}\n\nexport type CallsResource = ReturnType<typeof createCallsResource>\n","import fs from 'node:fs'\nimport path from 'node:path'\nimport type { HttpClient } from '../http'\nimport type { KnowledgeBase, KnowledgeBaseFile } from '../types'\n\nexport const createKnowledgeBasesResource = (http: HttpClient) => ({\n  create: async (name: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({\n      method: 'POST',\n      path: '/v1/knowledge-bases',\n      body: { name },\n    }),\n\n  list: async (): Promise<KnowledgeBase[]> => {\n    const res = await http.request<{ data: KnowledgeBase[] }>({\n      method: 'GET',\n      path: '/v1/knowledge-bases',\n    })\n    return res.data\n  },\n\n  get: async (kbId: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({ method: 'GET', path: `/v1/knowledge-bases/${kbId}` }),\n\n  delete: async (kbId: string): Promise<void> =>\n    http.request<void>({ method: 'DELETE', path: `/v1/knowledge-bases/${kbId}` }),\n\n  // File upload — accepts either a local file path OR raw bytes + filename.\n  // The server ingests synchronously today (Phase 3.1.4 Cloud Tasks is a\n  // followup), so the returned file has status='ready' in most cases.\n  uploadFile: async (\n    kbId: string,\n    source:\n      | { path: string; filename?: string; mimeType?: string }\n      | { data: Buffer | Uint8Array; filename: string; mimeType?: string },\n  ): Promise<KnowledgeBaseFile> => {\n    const form = new FormData()\n    let blob: Blob\n    let filename: string\n    let mime: string\n\n    if ('path' in source) {\n      const buf = await fs.promises.readFile(source.path)\n      filename = source.filename ?? path.basename(source.path)\n      mime = source.mimeType ?? 'application/octet-stream'\n      blob = new Blob([new Uint8Array(buf)], { type: mime })\n    } else {\n      filename = source.filename\n      mime = source.mimeType ?? 'application/octet-stream'\n      const bytes = source.data instanceof Buffer ? new Uint8Array(source.data) : source.data\n      blob = new Blob([bytes], { type: mime })\n    }\n    form.append('file', blob, filename)\n\n    // File uploads can take a while (OCR, chunking, embedding) — give them\n    // room before timing out. 5 min cap matches the server's own\n    // processing budget.\n    return http.request<KnowledgeBaseFile>({\n      method: 'POST',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n      formData: form,\n      timeoutMs: 5 * 60 * 1000,\n    })\n  },\n\n  listFiles: async (kbId: string): Promise<KnowledgeBaseFile[]> => {\n    const res = await http.request<{ data: KnowledgeBaseFile[] }>({\n      method: 'GET',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n    })\n    return res.data\n  },\n\n  deleteFile: async (kbId: string, fileId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/knowledge-bases/${kbId}/files/${fileId}`,\n    }),\n})\n\nexport type KnowledgeBasesResource = ReturnType<typeof createKnowledgeBasesResource>\n","import type { HttpClient } from '../http'\nimport type { LedgerEntry } from '../types'\n\nexport const createCreditsResource = (http: HttpClient) => {\n  const credits = {\n    getBalance: async (): Promise<{ orgId: string; balanceCents: number }> =>\n      http.request<{ orgId: string; balanceCents: number }>({\n        method: 'GET',\n        path: '/v1/credits/balance',\n      }),\n\n    // Returns ledger entries newest-first. `limit` is capped at 500 server-side.\n    getLedger: async (opts: { limit?: number } = {}): Promise<LedgerEntry[]> => {\n      const res = await http.request<{ data: LedgerEntry[] }>({\n        method: 'GET',\n        path: '/v1/credits/ledger',\n        query: opts as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination scaffold — v1 server returns a single page up to\n    // limit=500. When cursor pagination lands this is where it gets wired.\n    getLedgerAll: async function* (opts: { limit?: number } = {}): AsyncIterable<LedgerEntry> {\n      const page = await credits.getLedger(opts)\n      for (const e of page) yield e\n    },\n  }\n  return credits\n}\n\nexport type CreditsResource = ReturnType<typeof createCreditsResource>\n","import type { HttpClient } from '../http'\nimport type { CallTokenMintInput, CallTokenMintResult, CallTokenSummary } from '../types'\n\n// Short-lived, agent-scoped `ct_` tokens. Mint one per user session on your\n// backend, hand the raw value to the browser; let this SDK handle lifecycle\n// (revoke on sign-out, list active tokens for an admin panel).\n\nexport const createCallTokensResource = (http: HttpClient) => ({\n  // Returns the RAW token value once. Don't log it; pass it straight to the\n  // browser + discard server-side. `tokenId` is the stable public handle\n  // used for revocation later.\n  mint: async (input: CallTokenMintInput): Promise<CallTokenMintResult> =>\n    http.request<CallTokenMintResult>({\n      method: 'POST',\n      path: '/v1/call-tokens',\n      body: input,\n    }),\n\n  // Live tokens only by default. Pass includeRevoked/includeExpired when\n  // debugging \"why did my token stop working\".\n  list: async (\n    opts: { includeRevoked?: boolean; includeExpired?: boolean; limit?: number } = {},\n  ): Promise<CallTokenSummary[]> => {\n    const query: Record<string, string | number | undefined> = {}\n    if (opts.includeRevoked) query.includeRevoked = '1'\n    if (opts.includeExpired) query.includeExpired = '1'\n    if (opts.limit !== undefined) query.limit = opts.limit\n    const res = await http.request<{ data: CallTokenSummary[] }>({\n      method: 'GET',\n      path: '/v1/call-tokens',\n      query,\n    })\n    return res.data\n  },\n\n  // Idempotent — re-revoking a revoked token returns `alreadyRevoked: true`.\n  revoke: async (\n    tokenId: string,\n  ): Promise<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }> =>\n    http.request<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }>({\n      method: 'DELETE',\n      path: `/v1/call-tokens/${tokenId}`,\n    }),\n})\n\nexport type CallTokensResource = ReturnType<typeof createCallTokensResource>\n","import type { HttpClient } from '../http'\nimport type { WebhookDelivery } from '../types'\n\n// Org-wide webhook delivery log. Per-agent CRUD lives on\n// `client.agents.webhooks(agentId)` — this namespace is just the\n// read-only deliveries surface that spans all agents.\n\nexport const createWebhooksResource = (http: HttpClient) => ({\n  deliveries: async (\n    filters: {\n      agentId?: string\n      webhookId?: string\n      callId?: string\n      limit?: number\n    } = {},\n  ): Promise<WebhookDelivery[]> => {\n    const res = await http.request<{ data: WebhookDelivery[] }>({\n      method: 'GET',\n      path: '/v1/webhooks/deliveries',\n      query: filters as Record<string, string | number | undefined>,\n    })\n    return res.data\n  },\n})\n\nexport type WebhooksResource = ReturnType<typeof createWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { CatalogAgent, CatalogListInput } from '../types'\n\n// Org-scoped consumer endpoints. Today this is just the agent catalog —\n// the trimmed shape your mobile app picks an agent from. Lives at\n// `/v1/orgs/:orgId/agents` rather than reusing the admin `/v1/agents/*`\n// tree on purpose: the catalog response intentionally excludes the\n// operator-only fields (system prompt, tools, KB IDs) so a leaked\n// consumer-backend `sk_` can't lift the operator config out of it.\n//\n// Pattern from your backend:\n//\n//   const client = new PlatformClient({ apiKey: process.env.SK })\n//   const visible = await client.orgs.listAgents({\n//     orgId: process.env.ORG_ID!,\n//     userTags: ['tier1'],   // omit to get the unfiltered admin view\n//   })\n//   res.json(visible)\n\nexport const createOrgsResource = (http: HttpClient) => ({\n  /**\n   * Fetch the agent catalog for an org. Returns the consumer-trimmed shape;\n   * no system prompt, tools, or KB info. Use `client.agents.get(agentId)`\n   * with the same `sk_` if you need the full admin shape.\n   *\n   * `userTags`: end-user entitlement tags. When supplied, hides agents\n   * whose `allowedUserTags` is non-empty and doesn't intersect with the\n   * supplied list. Omit to get the unfiltered admin view.\n   *\n   * Persona / category filtering is intentionally not a server param —\n   * filter the returned list client-side over `name`s if you need it.\n   *\n   * Throws `403 forbidden` if `orgId` doesn't match the key's org.\n   */\n  listAgents: async (input: CatalogListInput): Promise<CatalogAgent[]> => {\n    const query: Record<string, string | undefined> = {}\n    if (input.userTags && input.userTags.length > 0) query.userTags = input.userTags.join(',')\n    const res = await http.request<{ data: CatalogAgent[] }>({\n      method: 'GET',\n      path: `/v1/orgs/${input.orgId}/agents`,\n      query,\n    })\n    return res.data\n  },\n})\n\nexport type OrgsResource = ReturnType<typeof createOrgsResource>\n","import { createHttpClient, type HttpClientOptions } from './http'\nimport { createMeResource, type MeResource } from './resources/me'\nimport { createAgentsResource, type AgentsResource } from './resources/agents'\nimport { createCallsResource, type CallsResource } from './resources/calls'\nimport {\n  createKnowledgeBasesResource,\n  type KnowledgeBasesResource,\n} from './resources/knowledgeBases'\nimport { createCreditsResource, type CreditsResource } from './resources/credits'\nimport { createCallTokensResource, type CallTokensResource } from './resources/callTokens'\nimport { createWebhooksResource, type WebhooksResource } from './resources/webhooks'\nimport { createOrgsResource, type OrgsResource } from './resources/orgs'\n\nexport interface PlatformClientOptions {\n  // Full-org API key minted from the dashboard or bootstrap CLI. Start with\n  // `sk_`. Never ship to a browser — use `client.callTokens.mint(...)` to\n  // generate a narrow `ct_` token for client-side use instead.\n  apiKey: string\n  // Defaults to the hosted platform. Point at `http://localhost:8080` for\n  // local dev or at a self-hosted deployment.\n  baseUrl?: string\n  // Passthrough tuning for the HTTP layer.\n  timeoutMs?: number\n  maxRetries?: number\n  fetch?: HttpClientOptions['fetch']\n  onRequest?: HttpClientOptions['onRequest']\n}\n\n// Single entry point. All resources are lazy-constructed in the constructor\n// so their refs don't incur any per-call allocation. Shape mirrors Stripe /\n// Twilio / Vapi's `resource.method()` convention for familiarity.\nexport class PlatformClient {\n  readonly me: MeResource\n  readonly agents: AgentsResource\n  readonly calls: CallsResource\n  readonly knowledgeBases: KnowledgeBasesResource\n  readonly credits: CreditsResource\n  readonly callTokens: CallTokensResource\n  readonly webhooks: WebhooksResource\n  readonly orgs: OrgsResource\n\n  constructor(options: PlatformClientOptions) {\n    if (!options.apiKey) {\n      throw new Error('PlatformClient: `apiKey` is required')\n    }\n    const http = createHttpClient({\n      apiKey: options.apiKey,\n      baseUrl: options.baseUrl ?? 'https://api.example.com',\n      timeoutMs: options.timeoutMs,\n      maxRetries: options.maxRetries,\n      fetch: options.fetch,\n      onRequest: options.onRequest,\n    })\n\n    this.me = createMeResource(http)\n    this.agents = createAgentsResource(http)\n    this.calls = createCallsResource(http)\n    this.knowledgeBases = createKnowledgeBasesResource(http)\n    this.credits = createCreditsResource(http)\n    this.callTokens = createCallTokensResource(http)\n    this.webhooks = createWebhooksResource(http)\n    this.orgs = createOrgsResource(http)\n  }\n}\n","import crypto from 'node:crypto'\n\n// Helper for consumers receiving webhooks: verify the `X-Platform-Signature-256`\n// header against the raw body + secret. Plain function (not tied to\n// PlatformClient) so Express/Koa/Next.js middleware can use it without\n// instantiating a client.\n//\n//   import { verifyWebhookSignature } from '@craftedxp/sdk-node'\n//   app.post('/webhooks/voice-agent', express.raw({ type: 'application/json' }), (req, res) => {\n//     const sig = req.header('X-Platform-Signature-256') ?? ''\n//     if (!verifyWebhookSignature(req.body, sig, process.env.VOICE_AGENT_WEBHOOK_SECRET!)) {\n//       return res.status(401).send('invalid signature')\n//     }\n//     const event = JSON.parse(req.body.toString('utf8'))\n//     // ...handle event\n//   })\n//\n// The signature is `sha256=<hex HMAC-SHA256 of rawBody with secret>`.\n// Timing-safe compare to avoid microtiming side channels.\n\nexport const verifyWebhookSignature = (\n  rawBody: Buffer | string,\n  signatureHeader: string,\n  secret: string,\n): boolean => {\n  if (!signatureHeader || !secret) return false\n  const [algo, provided] = signatureHeader.split('=')\n  if (algo !== 'sha256' || !provided) return false\n\n  const expected = crypto\n    .createHmac('sha256', secret)\n    .update(typeof rawBody === 'string' ? rawBody : rawBody)\n    .digest('hex')\n\n  // Buffers must match in length for timingSafeEqual.\n  const a = Buffer.from(expected, 'hex')\n  const b = Buffer.from(provided, 'hex')\n  if (a.length !== b.length) return false\n  return crypto.timingSafeEqual(a, b)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBO,IAAM,gBAAN,MAAM,uBAAsB,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EAET,YAAY,QAOT;AACD,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,OAAO,OAAO;AAGnB,QACE,OAAQ,MAAyD,sBACjE,YACA;AACA;AAAC,MACC,MACA,kBAAkB,MAAM,cAAa;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,SAAkC;AAChC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AACF;;;ACtBA,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AAE5B,IAAM,WAAW,CAAC,SAAiBA,OAAc,UAAyC;AACxF,QAAM,IAAI,IAAI,IAAIA,OAAM,OAAO;AAC/B,MAAI,OAAO;AACT,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,MAAM,OAAW;AACrB,QAAE,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO,EAAE,SAAS;AACpB;AAEA,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAExE,IAAM,cAAc,CAAC,WAA4B,WAAW,OAAQ,UAAU,OAAO,SAAS;AAI9F,IAAM,oBAAoB,OAAO,QAA0C;AACzE,QAAM,WAAW,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAChD,MAAI,SAAkB;AACtB,MAAI;AACF,aAAS,WAAW,KAAK,MAAM,QAAQ,IAAI;AAAA,EAC7C,QAAQ;AAAA,EAGR;AACA,QAAM,SACJ,QACC;AACH,SAAO,IAAI,cAAc;AAAA,IACvB,MAAO,QAAQ,QAAyB;AAAA,IACxC,SAAS,QAAQ,WAAW,IAAI,cAAc,QAAQ,IAAI,MAAM;AAAA,IAChE,QAAQ,IAAI;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,MAAM,UAAU;AAAA,EAClB,CAAC;AACH;AAEO,IAAM,mBAAmB,CAAC,SAA4B;AAC3D,QAAM,YAAY,KAAK,SAAS,WAAW;AAC3C,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,aAAa,KAAK,cAAc;AAEtC,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAEA,QAAM,UAAU,OAAU,QAAiC;AACzD,UAAM,MAAM,SAAS,KAAK,SAAS,IAAI,MAAM,IAAI,KAAK;AACtD,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,QAAQ;AAAA,MACR,GAAI,IAAI,WAAW,CAAC;AAAA,IACtB;AAMA,QAAI;AACJ,QAAI,IAAI,UAAU;AAChB,aAAO,IAAI;AAAA,IACb,WAAW,IAAI,SAAS,QAAW;AACjC,cAAQ,cAAc,IAAI;AAC1B,aAAO,KAAK,UAAU,IAAI,IAAI;AAAA,IAChC;AAEA,UAAM,aAAa,IAAI,aAAa;AACpC,QAAI;AAEJ,aAAS,UAAU,GAAG,WAAW,YAAY,WAAW;AACtD,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,YAAM,UAAU,KAAK,IAAI;AACzB,UAAI;AACF,cAAM,MAAM,MAAM,UAAU,KAAK;AAAA,UAC/B,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA;AAAA,UACA,QAAQ,WAAW;AAAA,QACrB,CAAC;AACD,cAAM,aAAa,KAAK,IAAI,IAAI;AAChC,aAAK,YAAY;AAAA,UACf,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,SAAS,UAAU;AAAA,QACrB,CAAC;AAED,YAAI,IAAI,IAAI;AAEV,cAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,gBAAM,KAAK,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC9C,cAAI,GAAG,SAAS,kBAAkB,GAAG;AACnC,mBAAQ,MAAM,IAAI,KAAK;AAAA,UACzB;AAEA,iBAAQ,MAAM,IAAI,KAAK;AAAA,QACzB;AAGA,YAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,gBAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,gBAAM,UAAU,aAAa,OAAO,UAAU,IAAI,MAAO,MAAM,KAAK,IAAI,GAAG,OAAO;AAClF,gBAAM,MAAM,OAAO;AACnB;AAAA,QACF;AAEA,cAAM,MAAM,kBAAkB,GAAG;AAAA,MACnC,SAAS,KAAK;AACZ,YAAI,eAAe,cAAe,OAAM;AAExC,YAAI,UAAU,YAAY;AACxB,oBAAU;AACV,gBAAM,MAAM,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;AACtC;AAAA,QACF;AACA,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU;AACjD,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,kBAAkB,GAAG;AAAA,UAC9B,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAGA,UAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,2BAA2B;AAAA,EAClF;AAEA,SAAO,EAAE,QAAQ;AACnB;;;ACnLO,IAAM,mBAAmB,CAAC,UAAsB;AAAA;AAAA;AAAA,EAGrD,KAAK,YAAiC,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,SAAS,CAAC;AAClG;;;ACIO,IAAM,8BAA8B,CAAC,MAAkB,aAAqB;AAAA;AAAA;AAAA;AAAA,EAIjF,QAAQ,OAAO,UACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO;AAAA,IAC3B,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM,cAAc,OAAO;AAAA,IAC7B,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,cACV,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA,EAEH,QAAQ,OAAO,WAAmB,UAChC,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,IACjD,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,QAAQ,OAAO,cACb,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,MAAM,OAAO,cACX,KAAK,QAAyB;AAAA,IAC5B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AACL;;;AChDO,IAAM,uBAAuB,CAAC,SAAqB;AACxD,QAAM,SAAS;AAAA,IACb,QAAQ,OAAO,UACb,KAAK,QAAe,EAAE,QAAQ,QAAQ,MAAM,cAAc,MAAM,MAAM,CAAC;AAAA,IAEzE,MAAM,YAA8B;AAClC,YAAM,MAAM,MAAM,KAAK,QAA2B,EAAE,QAAQ,OAAO,MAAM,aAAa,CAAC;AACvF,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,mBAAyC;AAChD,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,YACV,KAAK,QAAe,EAAE,QAAQ,OAAO,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA,IAEtE,QAAQ,OAAO,SAAiB,UAC9B,KAAK,QAAe,EAAE,QAAQ,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,MAAM,CAAC;AAAA,IAErF,QAAQ,OAAO,YACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYxE,cAAc,OACZ,SACA,MACA,OAAoD,CAAC,MAClC;AACnB,YAAM,KAAK,IAAI,SAAS;AACxB,YAAM,OACJ,gBAAgB,OACZ;AAAA;AAAA,QAEA,IAAI,KAAK,CAAC,IAAW,GAAG,EAAE,MAAM,KAAK,eAAe,2BAA2B,CAAC;AAAA;AACtF,SAAG,OAAO,QAAQ,MAAM,KAAK,YAAY,QAAQ;AACjD,aAAO,KAAK,QAAe;AAAA,QACzB,QAAQ;AAAA,QACR,MAAM,cAAc,OAAO;AAAA,QAC3B,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,cAAc,OAAO,YACnB,KAAK,QAAe,EAAE,QAAQ,UAAU,MAAM,cAAc,OAAO,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAShF,UAAU,CAAC,YACT,4BAA4B,MAAM,OAAO;AAAA,EAC7C;AACA,SAAO;AACT;;;AC5EO,IAAM,sBAAsB,CAAC,SAAqB;AACvD,QAAM,QAAQ;AAAA,IACZ,MAAM,OAAO,UAA2B,CAAC,MAA8B;AACrE,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,iBAAiB,UAA2B,CAAC,GAA+B;AACnF,YAAM,OAAO,MAAM,MAAM,KAAK,OAAO;AACrC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,WACV,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,aAAa,MAAM,GAAG,CAAC;AAAA,IAEzE,YAAY,OAAO,WACjB,KAAK,QAA0D;AAAA,MAC7D,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,IAKH,WAAW,OAAO,WAChB,KAAK,QAAkC;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAML;AACA,SAAO;AACT;;;ACrDA,qBAAe;AACf,uBAAiB;AAIV,IAAM,+BAA+B,CAAC,UAAsB;AAAA,EACjE,QAAQ,OAAO,SACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM,EAAE,KAAK;AAAA,EACf,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,SACV,KAAK,QAAuB,EAAE,QAAQ,OAAO,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA,EAEpF,QAAQ,OAAO,SACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,EAK9E,YAAY,OACV,MACA,WAG+B;AAC/B,UAAM,OAAO,IAAI,SAAS;AAC1B,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,UAAU,QAAQ;AACpB,YAAM,MAAM,MAAM,eAAAC,QAAG,SAAS,SAAS,OAAO,IAAI;AAClD,iBAAW,OAAO,YAAY,iBAAAC,QAAK,SAAS,OAAO,IAAI;AACvD,aAAO,OAAO,YAAY;AAC1B,aAAO,IAAI,KAAK,CAAC,IAAI,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACvD,OAAO;AACL,iBAAW,OAAO;AAClB,aAAO,OAAO,YAAY;AAC1B,YAAM,QAAQ,OAAO,gBAAgB,SAAS,IAAI,WAAW,OAAO,IAAI,IAAI,OAAO;AACnF,aAAO,IAAI,KAAK,CAAC,KAAK,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACzC;AACA,SAAK,OAAO,QAAQ,MAAM,QAAQ;AAKlC,WAAO,KAAK,QAA2B;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,WAAW,IAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,OAAO,SAA+C;AAC/D,UAAM,MAAM,MAAM,KAAK,QAAuC;AAAA,MAC5D,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,IACnC,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,YAAY,OAAO,MAAc,WAC/B,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,uBAAuB,IAAI,UAAU,MAAM;AAAA,EACnD,CAAC;AACL;;;AC3EO,IAAM,wBAAwB,CAAC,SAAqB;AACzD,QAAM,UAAU;AAAA,IACd,YAAY,YACV,KAAK,QAAiD;AAAA,MACpD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA;AAAA,IAGH,WAAW,OAAO,OAA2B,CAAC,MAA8B;AAC1E,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA,IAIA,cAAc,iBAAiB,OAA2B,CAAC,GAA+B;AACxF,YAAM,OAAO,MAAM,QAAQ,UAAU,IAAI;AACzC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,EACF;AACA,SAAO;AACT;;;ACtBO,IAAM,2BAA2B,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA,EAI7D,MAAM,OAAO,UACX,KAAK,QAA6B;AAAA,IAChC,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAAA;AAAA;AAAA,EAIH,MAAM,OACJ,OAA+E,CAAC,MAChD;AAChC,UAAM,QAAqD,CAAC;AAC5D,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,UAAM,MAAM,MAAM,KAAK,QAAsC;AAAA,MAC3D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA;AAAA,EAGA,QAAQ,OACN,YAEA,KAAK,QAAyE;AAAA,IAC5E,QAAQ;AAAA,IACR,MAAM,mBAAmB,OAAO;AAAA,EAClC,CAAC;AACL;;;ACpCO,IAAM,yBAAyB,CAAC,UAAsB;AAAA,EAC3D,YAAY,OACV,UAKI,CAAC,MAC0B;AAC/B,UAAM,MAAM,MAAM,KAAK,QAAqC;AAAA,MAC1D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACJO,IAAM,qBAAqB,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAevD,YAAY,OAAO,UAAqD;AACtE,UAAM,QAA4C,CAAC;AACnD,QAAI,MAAM,YAAY,MAAM,SAAS,SAAS,EAAG,OAAM,WAAW,MAAM,SAAS,KAAK,GAAG;AACzF,UAAM,MAAM,MAAM,KAAK,QAAkC;AAAA,MACvD,QAAQ;AAAA,MACR,MAAM,YAAY,MAAM,KAAK;AAAA,MAC7B;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACbO,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAgC;AAC1C,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,UAAM,OAAO,iBAAiB;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ,WAAW;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,MACpB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,IACrB,CAAC;AAED,SAAK,KAAK,iBAAiB,IAAI;AAC/B,SAAK,SAAS,qBAAqB,IAAI;AACvC,SAAK,QAAQ,oBAAoB,IAAI;AACrC,SAAK,iBAAiB,6BAA6B,IAAI;AACvD,SAAK,UAAU,sBAAsB,IAAI;AACzC,SAAK,aAAa,yBAAyB,IAAI;AAC/C,SAAK,WAAW,uBAAuB,IAAI;AAC3C,SAAK,OAAO,mBAAmB,IAAI;AAAA,EACrC;AACF;;;AC/DA,yBAAmB;AAoBZ,IAAM,yBAAyB,CACpC,SACA,iBACA,WACY;AACZ,MAAI,CAAC,mBAAmB,CAAC,OAAQ,QAAO;AACxC,QAAM,CAAC,MAAM,QAAQ,IAAI,gBAAgB,MAAM,GAAG;AAClD,MAAI,SAAS,YAAY,CAAC,SAAU,QAAO;AAE3C,QAAM,WAAW,mBAAAC,QACd,WAAW,UAAU,MAAM,EAC3B,OAAO,OAAO,YAAY,WAAW,UAAU,OAAO,EACtD,OAAO,KAAK;AAGf,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,mBAAAA,QAAO,gBAAgB,GAAG,CAAC;AACpC;","names":["path","fs","path","crypto"]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/http.ts","../src/resources/me.ts","../src/resources/agentWebhooks.ts","../src/resources/agents.ts","../src/resources/calls.ts","../src/resources/knowledgeBases.ts","../src/resources/credits.ts","../src/resources/callTokens.ts","../src/resources/webhooks.ts","../src/resources/orgs.ts","../src/resources/rooms.ts","../src/PlatformClient.ts","../src/verify.ts"],"sourcesContent":["// Public API of @craftedxp/sdk-node.\n\nexport { PlatformClient } from './PlatformClient'\nexport type { PlatformClientOptions } from './PlatformClient'\n\n// Error class for `instanceof` checks in consumer code.\nexport { PlatformError } from './errors'\nexport type { ApiErrorCode } from './errors'\n\n// Webhook signature verification helper — standalone so frameworks\n// (Express, Koa, Next.js route handlers) can use it without instantiating\n// a PlatformClient.\nexport { verifyWebhookSignature } from './verify'\n\n// Re-export DTO types. Consumers often type their own storage models\n// against these — re-exporting avoids `import type` gymnastics.\nexport type * from './types'\n\n// Advanced: expose the resource types for consumers subclassing / wrapping\n// the client. 99% of users don't need these.\nexport type { MeResource } from './resources/me'\nexport type { AgentsResource } from './resources/agents'\nexport type { AgentWebhooksResource } from './resources/agentWebhooks'\nexport type { CallsResource } from './resources/calls'\nexport type { KnowledgeBasesResource } from './resources/knowledgeBases'\nexport type { CreditsResource } from './resources/credits'\nexport type { CallTokensResource } from './resources/callTokens'\nexport type { WebhooksResource } from './resources/webhooks'\nexport type { OrgsResource } from './resources/orgs'\nexport type { RoomsResource } from './resources/rooms'\n","// Typed error class mirroring the server's ErrorV1 shape:\n//   { error: { code, message, field?, docs_url? } }\n//\n// Consumers do `err instanceof PlatformError` to branch on code without\n// parsing string messages. `status` carries the HTTP code for the 1% of\n// cases where the code field isn't enough (e.g. rate-limit → retry-after\n// header correlation).\n\nexport type ApiErrorCode =\n  | 'unauthorized'\n  | 'forbidden'\n  | 'not_found'\n  | 'bad_request'\n  | 'conflict'\n  | 'rate_limited'\n  | 'payment_required'\n  | 'internal_error'\n  | 'unknown'\n\nexport class PlatformError extends Error {\n  readonly code: ApiErrorCode\n  readonly status: number\n  readonly field?: string\n  readonly docsUrl?: string\n  // The raw response body for debugging. Intentionally optional — we clear\n  // it on `error.toJSON()` so logging libraries don't dump the whole\n  // server response into production logs.\n  readonly body?: unknown\n\n  constructor(params: {\n    code: ApiErrorCode\n    message: string\n    status: number\n    field?: string\n    docsUrl?: string\n    body?: unknown\n  }) {\n    super(params.message)\n    this.name = 'PlatformError'\n    this.code = params.code\n    this.status = params.status\n    this.field = params.field\n    this.docsUrl = params.docsUrl\n    this.body = params.body\n    // Preserve the stack trace — Node's Error doesn't capture it\n    // automatically when subclassing in some older runtimes.\n    if (\n      typeof (Error as typeof Error & { captureStackTrace?: unknown }).captureStackTrace ===\n      'function'\n    ) {\n      ;(\n        Error as typeof Error & { captureStackTrace: (target: unknown, ctor: unknown) => void }\n      ).captureStackTrace(this, PlatformError)\n    }\n  }\n\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      field: this.field,\n      docsUrl: this.docsUrl,\n    }\n  }\n}\n","import { PlatformError, type ApiErrorCode } from './errors'\n\n// Low-level HTTP wrapper around `fetch` (native in Node 18+). Every resource\n// method routes through here for consistent auth + error handling + retries.\n//\n// v1 scope: JSON-in / JSON-out + multipart for file uploads. No streaming —\n// call WebSockets go through @craftedxp/voice-rn (the React Native client)\n// or a web equivalent, not this server-side SDK.\n\nexport interface HttpClientOptions {\n  apiKey: string\n  baseUrl: string\n  // Default 30s. File uploads can override per-request.\n  timeoutMs?: number\n  // 429 + 5xx retries. Defaults to 3 attempts (original + 2 retries) with\n  // exponential backoff (250ms, 1s). Set to 0 to disable.\n  maxRetries?: number\n  // Optional — lets consumers swap in a test/mock fetch (or a custom one\n  // with instrumentation). Defaults to the global.\n  fetch?: typeof fetch\n  // Optional — a callback that fires per-request with the final status and\n  // duration. Handy for dropping traces into the consumer's observability\n  // stack without wrapping each call.\n  onRequest?: (info: {\n    method: string\n    url: string\n    status: number\n    durationMs: number\n    attempt: number\n  }) => void\n}\n\nexport interface HttpRequest {\n  method: 'GET' | 'POST' | 'PATCH' | 'DELETE'\n  path: string // starts with `/`, e.g. `/v1/agents/123`\n  query?: Record<string, string | number | boolean | undefined>\n  body?: unknown // JSON-serialised — for multipart use `formData`\n  formData?: FormData\n  timeoutMs?: number\n  // Exposed for edge cases where a resource wants to tack on extra\n  // headers (we don't have any today but leave the hook).\n  headers?: Record<string, string>\n}\n\nconst DEFAULT_TIMEOUT_MS = 30_000\nconst DEFAULT_MAX_RETRIES = 2 // total attempts = 3\n\nconst buildUrl = (baseUrl: string, path: string, query?: HttpRequest['query']): string => {\n  const u = new URL(path, baseUrl)\n  if (query) {\n    for (const [k, v] of Object.entries(query)) {\n      if (v === undefined) continue\n      u.searchParams.set(k, String(v))\n    }\n  }\n  return u.toString()\n}\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\nconst isRetryable = (status: number): boolean => status === 429 || (status >= 500 && status < 600)\n\n// Parse whatever the server returned into a PlatformError. Falls back to\n// synthesising a sensible error for non-JSON responses.\nconst errorFromResponse = async (res: Response): Promise<PlatformError> => {\n  const bodyText = await res.text().catch(() => '')\n  let parsed: unknown = undefined\n  try {\n    parsed = bodyText ? JSON.parse(bodyText) : undefined\n  } catch {\n    // non-JSON response (e.g. an HTML error page from a proxy). Fall\n    // through with parsed = undefined.\n  }\n  const errObj = (\n    parsed as { error?: { code?: string; message?: string; field?: string; docs_url?: string } }\n  )?.error\n  return new PlatformError({\n    code: (errObj?.code as ApiErrorCode) ?? 'unknown',\n    message: errObj?.message ?? res.statusText ?? `HTTP ${res.status}`,\n    status: res.status,\n    field: errObj?.field,\n    docsUrl: errObj?.docs_url,\n    body: parsed ?? bodyText,\n  })\n}\n\nexport const createHttpClient = (opts: HttpClientOptions) => {\n  const fetchImpl = opts.fetch ?? globalThis.fetch\n  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS\n  const maxRetries = opts.maxRetries ?? DEFAULT_MAX_RETRIES\n\n  if (!fetchImpl) {\n    throw new Error('No global fetch available. @craftedxp/sdk-node requires Node >= 18.')\n  }\n\n  const request = async <T>(req: HttpRequest): Promise<T> => {\n    const url = buildUrl(opts.baseUrl, req.path, req.query)\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${opts.apiKey}`,\n      Accept: 'application/json',\n      ...(req.headers ?? {}),\n    }\n\n    // Body shaping: prefer formData when provided; otherwise JSON.\n    // `FormData` sets its own Content-Type with boundary — don't preempt it.\n    // Typed as `string | FormData | undefined` (a subset of the global\n    // BodyInit) so we don't need DOM lib types in this server-side SDK.\n    let body: string | FormData | undefined\n    if (req.formData) {\n      body = req.formData\n    } else if (req.body !== undefined) {\n      headers['Content-Type'] = 'application/json'\n      body = JSON.stringify(req.body)\n    }\n\n    const reqTimeout = req.timeoutMs ?? timeoutMs\n    let lastErr: unknown\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      const controller = new AbortController()\n      const timer = setTimeout(() => controller.abort(), reqTimeout)\n      const started = Date.now()\n      try {\n        const res = await fetchImpl(url, {\n          method: req.method,\n          headers,\n          body,\n          signal: controller.signal,\n        })\n        const durationMs = Date.now() - started\n        opts.onRequest?.({\n          method: req.method,\n          url,\n          status: res.status,\n          durationMs,\n          attempt: attempt + 1,\n        })\n\n        if (res.ok) {\n          // 204 No Content — some endpoints (DELETE webhooks) return nothing.\n          if (res.status === 204) return undefined as T\n          const ct = res.headers.get('content-type') ?? ''\n          if (ct.includes('application/json')) {\n            return (await res.json()) as T\n          }\n          // Non-JSON 2xx — rare. Return raw text cast as T.\n          return (await res.text()) as unknown as T\n        }\n\n        // Retryable error: back off + retry up to maxRetries.\n        if (isRetryable(res.status) && attempt < maxRetries) {\n          const retryAfter = res.headers.get('Retry-After')\n          const backoff = retryAfter ? Number(retryAfter) * 1000 : 250 * Math.pow(2, attempt)\n          await sleep(backoff)\n          continue\n        }\n\n        throw await errorFromResponse(res)\n      } catch (err) {\n        if (err instanceof PlatformError) throw err\n        // AbortError / network / DNS failures — retry up to maxRetries.\n        if (attempt < maxRetries) {\n          lastErr = err\n          await sleep(250 * Math.pow(2, attempt))\n          continue\n        }\n        const msg = err instanceof Error ? err.message : 'network error'\n        throw new PlatformError({\n          code: 'unknown',\n          message: `Network error: ${msg}`,\n          status: 0,\n        })\n      } finally {\n        clearTimeout(timer)\n      }\n    }\n\n    // Should be unreachable — the loop either returns, throws, or continues.\n    throw lastErr instanceof Error ? lastErr : new Error('request exhausted retries')\n  }\n\n  return { request }\n}\n\nexport type HttpClient = ReturnType<typeof createHttpClient>\n","import type { HttpClient } from '../http'\nimport type { MeResponse } from '../types'\n\nexport const createMeResource = (http: HttpClient) => ({\n  // Smoke test — confirms the API key is valid and returns the org + balance.\n  // Most consumers use this as a ping on startup.\n  get: async (): Promise<MeResponse> => http.request<MeResponse>({ method: 'GET', path: '/v1/me' }),\n})\n\nexport type MeResource = ReturnType<typeof createMeResource>\n","import type { HttpClient } from '../http'\nimport type {\n  WebhookConfig,\n  WebhookCreateInput,\n  WebhookDelivery,\n  WebhookUpdateInput,\n} from '../types'\n\n// Per-agent webhook resource, scoped at factory time to a specific agentId.\n// All endpoints mirror /v1/agents/:agentId/webhooks[/:id].\n\nexport const createAgentWebhooksResource = (http: HttpClient, agentId: string) => ({\n  // Returns the webhook + its signing secret. The secret is only present in\n  // this response — persist immediately, subsequent GETs omit it. Use the\n  // secret to verify `X-Platform-Signature-256` (sha256=hex HMAC over body).\n  create: async (input: WebhookCreateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks`,\n      body: input,\n    }),\n\n  list: async (): Promise<WebhookConfig[]> => {\n    const res = await http.request<{ data: WebhookConfig[] }>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks`,\n    })\n    return res.data\n  },\n\n  get: async (webhookId: string): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  update: async (webhookId: string, patch: WebhookUpdateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'PATCH',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n      body: patch,\n    }),\n\n  delete: async (webhookId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  // Fires a synthetic call.started against this webhook and returns the\n  // full delivery record (including attempt status codes) once the retry\n  // sequence has finished. Useful during setup to verify receiver wiring.\n  test: async (webhookId: string): Promise<WebhookDelivery> =>\n    http.request<WebhookDelivery>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}/test`,\n    }),\n})\n\nexport type AgentWebhooksResource = ReturnType<typeof createAgentWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { Agent, AgentCreateInput, AgentUpdateInput } from '../types'\nimport { createAgentWebhooksResource, type AgentWebhooksResource } from './agentWebhooks'\n\n// The server returns Agent with `apiKey` stripped and `hasApiKey: boolean`\n// on the model. We type the happy path but keep our input type permissive\n// so consumers can POST a plaintext `apiKey` that the server encrypts +\n// swaps for `apiKeySecret` on persistence.\n\nexport const createAgentsResource = (http: HttpClient) => {\n  const agents = {\n    create: async (input: AgentCreateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'POST', path: '/v1/agents', body: input }),\n\n    list: async (): Promise<Agent[]> => {\n      const res = await http.request<{ data: Agent[] }>({ method: 'GET', path: '/v1/agents' })\n      return res.data\n    },\n\n    // Async iterator for \"give me every agent\" — v1 server returns the full\n    // list in one page, so this is just a thin convenience. When the server\n    // picks up cursor pagination, this is the method that papers over that\n    // migration without consumer changes.\n    listAll: async function* (): AsyncIterable<Agent> {\n      const page = await agents.list()\n      for (const a of page) yield a\n    },\n\n    get: async (agentId: string): Promise<Agent> =>\n      http.request<Agent>({ method: 'GET', path: `/v1/agents/${agentId}` }),\n\n    update: async (agentId: string, patch: AgentUpdateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'PATCH', path: `/v1/agents/${agentId}`, body: patch }),\n\n    delete: async (agentId: string): Promise<void> =>\n      http.request<void>({ method: 'DELETE', path: `/v1/agents/${agentId}` }),\n\n    /**\n     * Upload an avatar image for the agent. Server re-encodes to a 512×512\n     * WebP and stores it in the public-read avatars bucket; the returned\n     * `Agent` has `avatarUrl` set to the canonical public URL with a\n     * `?v=` cache-buster.\n     *\n     * `file` accepts a Node Buffer / Uint8Array / Blob / typed-array.\n     * `filename` and `contentType` are optional but help the server log\n     * meaningful errors when something rejects.\n     */\n    uploadAvatar: async (\n      agentId: string,\n      file: Buffer | Uint8Array | Blob | ArrayBuffer,\n      opts: { filename?: string; contentType?: string } = {},\n    ): Promise<Agent> => {\n      const fd = new FormData()\n      const blob =\n        file instanceof Blob\n          ? file\n          : // eslint-disable-next-line @typescript-eslint/no-explicit-any\n            new Blob([file as any], { type: opts.contentType ?? 'application/octet-stream' })\n      fd.append('file', blob, opts.filename ?? 'avatar')\n      return http.request<Agent>({\n        method: 'POST',\n        path: `/v1/agents/${agentId}/avatar`,\n        formData: fd,\n      })\n    },\n\n    /**\n     * Remove the agent's avatar — both the GCS object and the `avatarUrl`\n     * field. Idempotent: calling on an agent without an avatar still\n     * returns the agent.\n     */\n    removeAvatar: async (agentId: string): Promise<Agent> =>\n      http.request<Agent>({ method: 'DELETE', path: `/v1/agents/${agentId}/avatar` }),\n\n    // Nested resource. Per-agent webhook CRUD lives at\n    // /v1/agents/:agentId/webhooks/* — we expose it as a factory keyed on\n    // agentId so consumers can bind once and reuse:\n    //\n    //   const hooks = client.agents.webhooks(myAgentId)\n    //   await hooks.create({ url, events })\n    //   await hooks.list()\n    webhooks: (agentId: string): AgentWebhooksResource =>\n      createAgentWebhooksResource(http, agentId),\n  }\n  return agents\n}\n\nexport type AgentsResource = ReturnType<typeof createAgentsResource>\n","import type { HttpClient } from '../http'\nimport type {\n  CallListFilters,\n  CallRecord,\n  CallRecordingUrlResponse,\n  CallSummary,\n  TranscriptTurn,\n} from '../types'\n\nexport const createCallsResource = (http: HttpClient) => {\n  const calls = {\n    list: async (filters: CallListFilters = {}): Promise<CallSummary[]> => {\n      const res = await http.request<{ data: CallSummary[] }>({\n        method: 'GET',\n        path: '/v1/calls',\n        query: filters as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination helper. v1 server caps at limit (max 200) in a single\n    // page — consumers who ask for \"every call since X\" get that page, the\n    // iterator ends. This is the shape we'd extend with cursor support\n    // without breaking callers.\n    listAll: async function* (filters: CallListFilters = {}): AsyncIterable<CallSummary> {\n      const page = await calls.list(filters)\n      for (const c of page) yield c\n    },\n\n    get: async (callId: string): Promise<CallRecord> =>\n      http.request<CallRecord>({ method: 'GET', path: `/v1/calls/${callId}` }),\n\n    transcript: async (callId: string): Promise<{ callId: string; transcript: TranscriptTurn[] }> =>\n      http.request<{ callId: string; transcript: TranscriptTurn[] }>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/transcript`,\n      }),\n\n    // Returns a V4 signed URL (1-hour TTL). `ready: false` + `artifact:\n    // 'caller-raw'` means the async mix job hasn't finished — the URL still\n    // points at a playable file (raw caller PCM).\n    recording: async (callId: string): Promise<CallRecordingUrlResponse> =>\n      http.request<CallRecordingUrlResponse>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/recording`,\n      }),\n\n    // Outbound dialling (POST /v1/calls) + in-call control are Phase 1.4.4 /\n    // 1.4.5 respectively — blocked on telephony. Surface clear \"not built\n    // yet\" errors here if consumers guess those method names, so they don't\n    // silently hit a non-existent endpoint and wonder why it 404s.\n  }\n  return calls\n}\n\nexport type CallsResource = ReturnType<typeof createCallsResource>\n","import fs from 'node:fs'\nimport path from 'node:path'\nimport type { HttpClient } from '../http'\nimport type { KnowledgeBase, KnowledgeBaseFile } from '../types'\n\nexport const createKnowledgeBasesResource = (http: HttpClient) => ({\n  create: async (name: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({\n      method: 'POST',\n      path: '/v1/knowledge-bases',\n      body: { name },\n    }),\n\n  list: async (): Promise<KnowledgeBase[]> => {\n    const res = await http.request<{ data: KnowledgeBase[] }>({\n      method: 'GET',\n      path: '/v1/knowledge-bases',\n    })\n    return res.data\n  },\n\n  get: async (kbId: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({ method: 'GET', path: `/v1/knowledge-bases/${kbId}` }),\n\n  delete: async (kbId: string): Promise<void> =>\n    http.request<void>({ method: 'DELETE', path: `/v1/knowledge-bases/${kbId}` }),\n\n  // File upload — accepts either a local file path OR raw bytes + filename.\n  // The server ingests synchronously today (Phase 3.1.4 Cloud Tasks is a\n  // followup), so the returned file has status='ready' in most cases.\n  uploadFile: async (\n    kbId: string,\n    source:\n      | { path: string; filename?: string; mimeType?: string }\n      | { data: Buffer | Uint8Array; filename: string; mimeType?: string },\n  ): Promise<KnowledgeBaseFile> => {\n    const form = new FormData()\n    let blob: Blob\n    let filename: string\n    let mime: string\n\n    if ('path' in source) {\n      const buf = await fs.promises.readFile(source.path)\n      filename = source.filename ?? path.basename(source.path)\n      mime = source.mimeType ?? 'application/octet-stream'\n      blob = new Blob([new Uint8Array(buf)], { type: mime })\n    } else {\n      filename = source.filename\n      mime = source.mimeType ?? 'application/octet-stream'\n      const bytes = source.data instanceof Buffer ? new Uint8Array(source.data) : source.data\n      blob = new Blob([bytes], { type: mime })\n    }\n    form.append('file', blob, filename)\n\n    // File uploads can take a while (OCR, chunking, embedding) — give them\n    // room before timing out. 5 min cap matches the server's own\n    // processing budget.\n    return http.request<KnowledgeBaseFile>({\n      method: 'POST',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n      formData: form,\n      timeoutMs: 5 * 60 * 1000,\n    })\n  },\n\n  listFiles: async (kbId: string): Promise<KnowledgeBaseFile[]> => {\n    const res = await http.request<{ data: KnowledgeBaseFile[] }>({\n      method: 'GET',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n    })\n    return res.data\n  },\n\n  deleteFile: async (kbId: string, fileId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/knowledge-bases/${kbId}/files/${fileId}`,\n    }),\n})\n\nexport type KnowledgeBasesResource = ReturnType<typeof createKnowledgeBasesResource>\n","import type { HttpClient } from '../http'\nimport type { LedgerEntry } from '../types'\n\nexport const createCreditsResource = (http: HttpClient) => {\n  const credits = {\n    getBalance: async (): Promise<{ orgId: string; balanceCents: number }> =>\n      http.request<{ orgId: string; balanceCents: number }>({\n        method: 'GET',\n        path: '/v1/credits/balance',\n      }),\n\n    // Returns ledger entries newest-first. `limit` is capped at 500 server-side.\n    getLedger: async (opts: { limit?: number } = {}): Promise<LedgerEntry[]> => {\n      const res = await http.request<{ data: LedgerEntry[] }>({\n        method: 'GET',\n        path: '/v1/credits/ledger',\n        query: opts as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination scaffold — v1 server returns a single page up to\n    // limit=500. When cursor pagination lands this is where it gets wired.\n    getLedgerAll: async function* (opts: { limit?: number } = {}): AsyncIterable<LedgerEntry> {\n      const page = await credits.getLedger(opts)\n      for (const e of page) yield e\n    },\n  }\n  return credits\n}\n\nexport type CreditsResource = ReturnType<typeof createCreditsResource>\n","import type { HttpClient } from '../http'\nimport type { CallTokenMintInput, CallTokenMintResult, CallTokenSummary } from '../types'\n\n// Short-lived, agent-scoped `ct_` tokens. Mint one per user session on your\n// backend, hand the raw value to the browser; let this SDK handle lifecycle\n// (revoke on sign-out, list active tokens for an admin panel).\n\nexport const createCallTokensResource = (http: HttpClient) => ({\n  // Returns the RAW token value once. Don't log it; pass it straight to the\n  // browser + discard server-side. `tokenId` is the stable public handle\n  // used for revocation later.\n  mint: async (input: CallTokenMintInput): Promise<CallTokenMintResult> =>\n    http.request<CallTokenMintResult>({\n      method: 'POST',\n      path: '/v1/call-tokens',\n      body: input,\n    }),\n\n  // Live tokens only by default. Pass includeRevoked/includeExpired when\n  // debugging \"why did my token stop working\".\n  list: async (\n    opts: { includeRevoked?: boolean; includeExpired?: boolean; limit?: number } = {},\n  ): Promise<CallTokenSummary[]> => {\n    const query: Record<string, string | number | undefined> = {}\n    if (opts.includeRevoked) query.includeRevoked = '1'\n    if (opts.includeExpired) query.includeExpired = '1'\n    if (opts.limit !== undefined) query.limit = opts.limit\n    const res = await http.request<{ data: CallTokenSummary[] }>({\n      method: 'GET',\n      path: '/v1/call-tokens',\n      query,\n    })\n    return res.data\n  },\n\n  // Idempotent — re-revoking a revoked token returns `alreadyRevoked: true`.\n  revoke: async (\n    tokenId: string,\n  ): Promise<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }> =>\n    http.request<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }>({\n      method: 'DELETE',\n      path: `/v1/call-tokens/${tokenId}`,\n    }),\n})\n\nexport type CallTokensResource = ReturnType<typeof createCallTokensResource>\n","import type { HttpClient } from '../http'\nimport type { WebhookDelivery } from '../types'\n\n// Org-wide webhook delivery log. Per-agent CRUD lives on\n// `client.agents.webhooks(agentId)` — this namespace is just the\n// read-only deliveries surface that spans all agents.\n\nexport const createWebhooksResource = (http: HttpClient) => ({\n  deliveries: async (\n    filters: {\n      agentId?: string\n      webhookId?: string\n      callId?: string\n      limit?: number\n    } = {},\n  ): Promise<WebhookDelivery[]> => {\n    const res = await http.request<{ data: WebhookDelivery[] }>({\n      method: 'GET',\n      path: '/v1/webhooks/deliveries',\n      query: filters as Record<string, string | number | undefined>,\n    })\n    return res.data\n  },\n})\n\nexport type WebhooksResource = ReturnType<typeof createWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { CatalogAgent, CatalogListInput } from '../types'\n\n// Org-scoped consumer endpoints. Today this is just the agent catalog —\n// the trimmed shape your mobile app picks an agent from. Lives at\n// `/v1/orgs/:orgId/agents` rather than reusing the admin `/v1/agents/*`\n// tree on purpose: the catalog response intentionally excludes the\n// operator-only fields (system prompt, tools, KB IDs) so a leaked\n// consumer-backend `sk_` can't lift the operator config out of it.\n//\n// Pattern from your backend:\n//\n//   const client = new PlatformClient({ apiKey: process.env.SK })\n//   const visible = await client.orgs.listAgents({\n//     orgId: process.env.ORG_ID!,\n//     userTags: ['tier1'],   // omit to get the unfiltered admin view\n//   })\n//   res.json(visible)\n\nexport const createOrgsResource = (http: HttpClient) => ({\n  /**\n   * Fetch the agent catalog for an org. Returns the consumer-trimmed shape;\n   * no system prompt, tools, or KB info. Use `client.agents.get(agentId)`\n   * with the same `sk_` if you need the full admin shape.\n   *\n   * `userTags`: end-user entitlement tags. When supplied, hides agents\n   * whose `allowedUserTags` is non-empty and doesn't intersect with the\n   * supplied list. Omit to get the unfiltered admin view.\n   *\n   * Persona / category filtering is intentionally not a server param —\n   * filter the returned list client-side over `name`s if you need it.\n   *\n   * Throws `403 forbidden` if `orgId` doesn't match the key's org.\n   */\n  listAgents: async (input: CatalogListInput): Promise<CatalogAgent[]> => {\n    const query: Record<string, string | undefined> = {}\n    if (input.userTags && input.userTags.length > 0) query.userTags = input.userTags.join(',')\n    const res = await http.request<{ data: CatalogAgent[] }>({\n      method: 'GET',\n      path: `/v1/orgs/${input.orgId}/agents`,\n      query,\n    })\n    return res.data\n  },\n})\n\nexport type OrgsResource = ReturnType<typeof createOrgsResource>\n","import type { HttpClient } from '../http'\nimport type {\n  CreateRoomInput,\n  CreateRoomResponse,\n  ListRoomsResponse,\n  ListUtterancesResponse,\n  RoomDoc,\n  RoomEventAck,\n  RoomListFilters,\n  RoomTranscriptOptions,\n} from '../types'\n\n// REST wrappers for /v1/rooms — the multi-party video room surface (see\n// docs/superpowers/specs/2026-05-18-multiparty-rooms-design.md). Lets\n// server-side code mint rooms, fetch state, list transcript pages, and end\n// rooms programmatically.\n//\n// Auth model: same Bearer `sk_` flow as every other resource — the server\n// derives `orgId` from the API key, so the SDK never sets a tenant header.\n//\n// Host actions beyond `end` (promote/demote/kick) and observer-token mint\n// live in the server but aren't surfaced here yet — they're operator-side\n// flows that the dashboard hits directly. Re-add here if a programmatic\n// use-case shows up (CI tests, integration harnesses).\n\nexport const createRoomsResource = (http: HttpClient) => ({\n  // Provision a new room. Server returns 201 with ONE shared room-level\n  // `joinToken` + `joinUrl`. Share the single link with everyone you want in\n  // the room — each visitor supplies their own display name at join time and\n  // becomes a fresh, distinct participant. The server persists only the\n  // token's sha256 hash; the raw token is returned here once and never stored.\n  create: async (input: CreateRoomInput): Promise<CreateRoomResponse> =>\n    http.request<CreateRoomResponse>({\n      method: 'POST',\n      path: '/v1/rooms',\n      body: input,\n    }),\n\n  // Listing — opaque cursor pagination (`nextCursor` returned by the server\n  // is whatever startAfter() needs, don't parse client-side).\n  list: async (filters: RoomListFilters = {}): Promise<ListRoomsResponse> => {\n    const query: Record<string, string | number | undefined> = {}\n    if (filters.status) query.status = filters.status\n    if (filters.limit !== undefined) query.limit = filters.limit\n    if (filters.cursor) query.cursor = filters.cursor\n    return http.request<ListRoomsResponse>({\n      method: 'GET',\n      path: '/v1/rooms',\n      query,\n    })\n  },\n\n  // Fetch a single room. 404s are surfaced as PlatformError('not_found').\n  get: async (roomId: string): Promise<RoomDoc> =>\n    http.request<RoomDoc>({\n      method: 'GET',\n      path: `/v1/rooms/${roomId}`,\n    }),\n\n  // Transcript pages — utterances are ordered by `startedAt asc`. Cursor is\n  // an ISO timestamp (server enforces, don't construct yourself).\n  transcript: async (\n    roomId: string,\n    opts: RoomTranscriptOptions = {},\n  ): Promise<ListUtterancesResponse> => {\n    const query: Record<string, string | number | undefined> = {}\n    if (opts.cursor) query.cursor = opts.cursor\n    if (opts.limit !== undefined) query.limit = opts.limit\n    return http.request<ListUtterancesResponse>({\n      method: 'GET',\n      path: `/v1/rooms/${roomId}/transcript`,\n      query,\n    })\n  },\n\n  // End a room — async on the server: returns 202 + eventId once the\n  // controlEvents entry is written. The room-worker observes the entry,\n  // broadcasts the system message, and tears down LiveKit shortly after.\n  end: async (roomId: string): Promise<RoomEventAck> =>\n    http.request<RoomEventAck>({\n      method: 'POST',\n      path: `/v1/rooms/${roomId}/end`,\n    }),\n})\n\nexport type RoomsResource = ReturnType<typeof createRoomsResource>\n","import { createHttpClient, type HttpClientOptions } from './http'\nimport { createMeResource, type MeResource } from './resources/me'\nimport { createAgentsResource, type AgentsResource } from './resources/agents'\nimport { createCallsResource, type CallsResource } from './resources/calls'\nimport {\n  createKnowledgeBasesResource,\n  type KnowledgeBasesResource,\n} from './resources/knowledgeBases'\nimport { createCreditsResource, type CreditsResource } from './resources/credits'\nimport { createCallTokensResource, type CallTokensResource } from './resources/callTokens'\nimport { createWebhooksResource, type WebhooksResource } from './resources/webhooks'\nimport { createOrgsResource, type OrgsResource } from './resources/orgs'\nimport { createRoomsResource, type RoomsResource } from './resources/rooms'\n\nexport interface PlatformClientOptions {\n  // Full-org API key minted from the dashboard or bootstrap CLI. Start with\n  // `sk_`. Never ship to a browser — use `client.callTokens.mint(...)` to\n  // generate a narrow `ct_` token for client-side use instead.\n  apiKey: string\n  // Defaults to the hosted platform. Point at `http://localhost:8080` for\n  // local dev or at a self-hosted deployment.\n  baseUrl?: string\n  // Passthrough tuning for the HTTP layer.\n  timeoutMs?: number\n  maxRetries?: number\n  fetch?: HttpClientOptions['fetch']\n  onRequest?: HttpClientOptions['onRequest']\n}\n\n// Single entry point. All resources are lazy-constructed in the constructor\n// so their refs don't incur any per-call allocation. Shape mirrors Stripe /\n// Twilio / Vapi's `resource.method()` convention for familiarity.\nexport class PlatformClient {\n  readonly me: MeResource\n  readonly agents: AgentsResource\n  readonly calls: CallsResource\n  readonly knowledgeBases: KnowledgeBasesResource\n  readonly credits: CreditsResource\n  readonly callTokens: CallTokensResource\n  readonly webhooks: WebhooksResource\n  readonly orgs: OrgsResource\n  readonly rooms: RoomsResource\n\n  constructor(options: PlatformClientOptions) {\n    if (!options.apiKey) {\n      throw new Error('PlatformClient: `apiKey` is required')\n    }\n    const http = createHttpClient({\n      apiKey: options.apiKey,\n      baseUrl: options.baseUrl ?? 'https://api.example.com',\n      timeoutMs: options.timeoutMs,\n      maxRetries: options.maxRetries,\n      fetch: options.fetch,\n      onRequest: options.onRequest,\n    })\n\n    this.me = createMeResource(http)\n    this.agents = createAgentsResource(http)\n    this.calls = createCallsResource(http)\n    this.knowledgeBases = createKnowledgeBasesResource(http)\n    this.credits = createCreditsResource(http)\n    this.callTokens = createCallTokensResource(http)\n    this.webhooks = createWebhooksResource(http)\n    this.orgs = createOrgsResource(http)\n    this.rooms = createRoomsResource(http)\n  }\n}\n","import crypto from 'node:crypto'\n\n// Helper for consumers receiving webhooks: verify the `X-Platform-Signature-256`\n// header against the raw body + secret. Plain function (not tied to\n// PlatformClient) so Express/Koa/Next.js middleware can use it without\n// instantiating a client.\n//\n//   import { verifyWebhookSignature } from '@craftedxp/sdk-node'\n//   app.post('/webhooks/voice-agent', express.raw({ type: 'application/json' }), (req, res) => {\n//     const sig = req.header('X-Platform-Signature-256') ?? ''\n//     if (!verifyWebhookSignature(req.body, sig, process.env.VOICE_AGENT_WEBHOOK_SECRET!)) {\n//       return res.status(401).send('invalid signature')\n//     }\n//     const event = JSON.parse(req.body.toString('utf8'))\n//     // ...handle event\n//   })\n//\n// The signature is `sha256=<hex HMAC-SHA256 of rawBody with secret>`.\n// Timing-safe compare to avoid microtiming side channels.\n\nexport const verifyWebhookSignature = (\n  rawBody: Buffer | string,\n  signatureHeader: string,\n  secret: string,\n): boolean => {\n  if (!signatureHeader || !secret) return false\n  const [algo, provided] = signatureHeader.split('=')\n  if (algo !== 'sha256' || !provided) return false\n\n  const expected = crypto\n    .createHmac('sha256', secret)\n    .update(typeof rawBody === 'string' ? rawBody : rawBody)\n    .digest('hex')\n\n  // Buffers must match in length for timingSafeEqual.\n  const a = Buffer.from(expected, 'hex')\n  const b = Buffer.from(provided, 'hex')\n  if (a.length !== b.length) return false\n  return crypto.timingSafeEqual(a, b)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBO,IAAM,gBAAN,MAAM,uBAAsB,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EAET,YAAY,QAOT;AACD,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,OAAO,OAAO;AAGnB,QACE,OAAQ,MAAyD,sBACjE,YACA;AACA;AAAC,MACC,MACA,kBAAkB,MAAM,cAAa;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,SAAkC;AAChC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AACF;;;ACtBA,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AAE5B,IAAM,WAAW,CAAC,SAAiBA,OAAc,UAAyC;AACxF,QAAM,IAAI,IAAI,IAAIA,OAAM,OAAO;AAC/B,MAAI,OAAO;AACT,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,MAAM,OAAW;AACrB,QAAE,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO,EAAE,SAAS;AACpB;AAEA,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAExE,IAAM,cAAc,CAAC,WAA4B,WAAW,OAAQ,UAAU,OAAO,SAAS;AAI9F,IAAM,oBAAoB,OAAO,QAA0C;AACzE,QAAM,WAAW,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAChD,MAAI,SAAkB;AACtB,MAAI;AACF,aAAS,WAAW,KAAK,MAAM,QAAQ,IAAI;AAAA,EAC7C,QAAQ;AAAA,EAGR;AACA,QAAM,SACJ,QACC;AACH,SAAO,IAAI,cAAc;AAAA,IACvB,MAAO,QAAQ,QAAyB;AAAA,IACxC,SAAS,QAAQ,WAAW,IAAI,cAAc,QAAQ,IAAI,MAAM;AAAA,IAChE,QAAQ,IAAI;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,MAAM,UAAU;AAAA,EAClB,CAAC;AACH;AAEO,IAAM,mBAAmB,CAAC,SAA4B;AAC3D,QAAM,YAAY,KAAK,SAAS,WAAW;AAC3C,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,aAAa,KAAK,cAAc;AAEtC,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAEA,QAAM,UAAU,OAAU,QAAiC;AACzD,UAAM,MAAM,SAAS,KAAK,SAAS,IAAI,MAAM,IAAI,KAAK;AACtD,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,QAAQ;AAAA,MACR,GAAI,IAAI,WAAW,CAAC;AAAA,IACtB;AAMA,QAAI;AACJ,QAAI,IAAI,UAAU;AAChB,aAAO,IAAI;AAAA,IACb,WAAW,IAAI,SAAS,QAAW;AACjC,cAAQ,cAAc,IAAI;AAC1B,aAAO,KAAK,UAAU,IAAI,IAAI;AAAA,IAChC;AAEA,UAAM,aAAa,IAAI,aAAa;AACpC,QAAI;AAEJ,aAAS,UAAU,GAAG,WAAW,YAAY,WAAW;AACtD,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,YAAM,UAAU,KAAK,IAAI;AACzB,UAAI;AACF,cAAM,MAAM,MAAM,UAAU,KAAK;AAAA,UAC/B,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA;AAAA,UACA,QAAQ,WAAW;AAAA,QACrB,CAAC;AACD,cAAM,aAAa,KAAK,IAAI,IAAI;AAChC,aAAK,YAAY;AAAA,UACf,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,SAAS,UAAU;AAAA,QACrB,CAAC;AAED,YAAI,IAAI,IAAI;AAEV,cAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,gBAAM,KAAK,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC9C,cAAI,GAAG,SAAS,kBAAkB,GAAG;AACnC,mBAAQ,MAAM,IAAI,KAAK;AAAA,UACzB;AAEA,iBAAQ,MAAM,IAAI,KAAK;AAAA,QACzB;AAGA,YAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,gBAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,gBAAM,UAAU,aAAa,OAAO,UAAU,IAAI,MAAO,MAAM,KAAK,IAAI,GAAG,OAAO;AAClF,gBAAM,MAAM,OAAO;AACnB;AAAA,QACF;AAEA,cAAM,MAAM,kBAAkB,GAAG;AAAA,MACnC,SAAS,KAAK;AACZ,YAAI,eAAe,cAAe,OAAM;AAExC,YAAI,UAAU,YAAY;AACxB,oBAAU;AACV,gBAAM,MAAM,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;AACtC;AAAA,QACF;AACA,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU;AACjD,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,kBAAkB,GAAG;AAAA,UAC9B,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAGA,UAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,2BAA2B;AAAA,EAClF;AAEA,SAAO,EAAE,QAAQ;AACnB;;;ACnLO,IAAM,mBAAmB,CAAC,UAAsB;AAAA;AAAA;AAAA,EAGrD,KAAK,YAAiC,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,SAAS,CAAC;AAClG;;;ACIO,IAAM,8BAA8B,CAAC,MAAkB,aAAqB;AAAA;AAAA;AAAA;AAAA,EAIjF,QAAQ,OAAO,UACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO;AAAA,IAC3B,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM,cAAc,OAAO;AAAA,IAC7B,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,cACV,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA,EAEH,QAAQ,OAAO,WAAmB,UAChC,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,IACjD,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,QAAQ,OAAO,cACb,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,MAAM,OAAO,cACX,KAAK,QAAyB;AAAA,IAC5B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AACL;;;AChDO,IAAM,uBAAuB,CAAC,SAAqB;AACxD,QAAM,SAAS;AAAA,IACb,QAAQ,OAAO,UACb,KAAK,QAAe,EAAE,QAAQ,QAAQ,MAAM,cAAc,MAAM,MAAM,CAAC;AAAA,IAEzE,MAAM,YAA8B;AAClC,YAAM,MAAM,MAAM,KAAK,QAA2B,EAAE,QAAQ,OAAO,MAAM,aAAa,CAAC;AACvF,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,mBAAyC;AAChD,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,YACV,KAAK,QAAe,EAAE,QAAQ,OAAO,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA,IAEtE,QAAQ,OAAO,SAAiB,UAC9B,KAAK,QAAe,EAAE,QAAQ,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,MAAM,CAAC;AAAA,IAErF,QAAQ,OAAO,YACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYxE,cAAc,OACZ,SACA,MACA,OAAoD,CAAC,MAClC;AACnB,YAAM,KAAK,IAAI,SAAS;AACxB,YAAM,OACJ,gBAAgB,OACZ;AAAA;AAAA,QAEA,IAAI,KAAK,CAAC,IAAW,GAAG,EAAE,MAAM,KAAK,eAAe,2BAA2B,CAAC;AAAA;AACtF,SAAG,OAAO,QAAQ,MAAM,KAAK,YAAY,QAAQ;AACjD,aAAO,KAAK,QAAe;AAAA,QACzB,QAAQ;AAAA,QACR,MAAM,cAAc,OAAO;AAAA,QAC3B,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,cAAc,OAAO,YACnB,KAAK,QAAe,EAAE,QAAQ,UAAU,MAAM,cAAc,OAAO,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAShF,UAAU,CAAC,YACT,4BAA4B,MAAM,OAAO;AAAA,EAC7C;AACA,SAAO;AACT;;;AC5EO,IAAM,sBAAsB,CAAC,SAAqB;AACvD,QAAM,QAAQ;AAAA,IACZ,MAAM,OAAO,UAA2B,CAAC,MAA8B;AACrE,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,iBAAiB,UAA2B,CAAC,GAA+B;AACnF,YAAM,OAAO,MAAM,MAAM,KAAK,OAAO;AACrC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,WACV,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,aAAa,MAAM,GAAG,CAAC;AAAA,IAEzE,YAAY,OAAO,WACjB,KAAK,QAA0D;AAAA,MAC7D,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,IAKH,WAAW,OAAO,WAChB,KAAK,QAAkC;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAML;AACA,SAAO;AACT;;;ACrDA,qBAAe;AACf,uBAAiB;AAIV,IAAM,+BAA+B,CAAC,UAAsB;AAAA,EACjE,QAAQ,OAAO,SACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM,EAAE,KAAK;AAAA,EACf,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,SACV,KAAK,QAAuB,EAAE,QAAQ,OAAO,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA,EAEpF,QAAQ,OAAO,SACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,EAK9E,YAAY,OACV,MACA,WAG+B;AAC/B,UAAM,OAAO,IAAI,SAAS;AAC1B,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,UAAU,QAAQ;AACpB,YAAM,MAAM,MAAM,eAAAC,QAAG,SAAS,SAAS,OAAO,IAAI;AAClD,iBAAW,OAAO,YAAY,iBAAAC,QAAK,SAAS,OAAO,IAAI;AACvD,aAAO,OAAO,YAAY;AAC1B,aAAO,IAAI,KAAK,CAAC,IAAI,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACvD,OAAO;AACL,iBAAW,OAAO;AAClB,aAAO,OAAO,YAAY;AAC1B,YAAM,QAAQ,OAAO,gBAAgB,SAAS,IAAI,WAAW,OAAO,IAAI,IAAI,OAAO;AACnF,aAAO,IAAI,KAAK,CAAC,KAAK,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACzC;AACA,SAAK,OAAO,QAAQ,MAAM,QAAQ;AAKlC,WAAO,KAAK,QAA2B;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,WAAW,IAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,OAAO,SAA+C;AAC/D,UAAM,MAAM,MAAM,KAAK,QAAuC;AAAA,MAC5D,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,IACnC,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,YAAY,OAAO,MAAc,WAC/B,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,uBAAuB,IAAI,UAAU,MAAM;AAAA,EACnD,CAAC;AACL;;;AC3EO,IAAM,wBAAwB,CAAC,SAAqB;AACzD,QAAM,UAAU;AAAA,IACd,YAAY,YACV,KAAK,QAAiD;AAAA,MACpD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA;AAAA,IAGH,WAAW,OAAO,OAA2B,CAAC,MAA8B;AAC1E,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA,IAIA,cAAc,iBAAiB,OAA2B,CAAC,GAA+B;AACxF,YAAM,OAAO,MAAM,QAAQ,UAAU,IAAI;AACzC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,EACF;AACA,SAAO;AACT;;;ACtBO,IAAM,2BAA2B,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA,EAI7D,MAAM,OAAO,UACX,KAAK,QAA6B;AAAA,IAChC,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAAA;AAAA;AAAA,EAIH,MAAM,OACJ,OAA+E,CAAC,MAChD;AAChC,UAAM,QAAqD,CAAC;AAC5D,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,UAAM,MAAM,MAAM,KAAK,QAAsC;AAAA,MAC3D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA;AAAA,EAGA,QAAQ,OACN,YAEA,KAAK,QAAyE;AAAA,IAC5E,QAAQ;AAAA,IACR,MAAM,mBAAmB,OAAO;AAAA,EAClC,CAAC;AACL;;;ACpCO,IAAM,yBAAyB,CAAC,UAAsB;AAAA,EAC3D,YAAY,OACV,UAKI,CAAC,MAC0B;AAC/B,UAAM,MAAM,MAAM,KAAK,QAAqC;AAAA,MAC1D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACJO,IAAM,qBAAqB,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAevD,YAAY,OAAO,UAAqD;AACtE,UAAM,QAA4C,CAAC;AACnD,QAAI,MAAM,YAAY,MAAM,SAAS,SAAS,EAAG,OAAM,WAAW,MAAM,SAAS,KAAK,GAAG;AACzF,UAAM,MAAM,MAAM,KAAK,QAAkC;AAAA,MACvD,QAAQ;AAAA,MACR,MAAM,YAAY,MAAM,KAAK;AAAA,MAC7B;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACnBO,IAAM,sBAAsB,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMxD,QAAQ,OAAO,UACb,KAAK,QAA4B;AAAA,IAC/B,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAAA;AAAA;AAAA,EAIH,MAAM,OAAO,UAA2B,CAAC,MAAkC;AACzE,UAAM,QAAqD,CAAC;AAC5D,QAAI,QAAQ,OAAQ,OAAM,SAAS,QAAQ;AAC3C,QAAI,QAAQ,UAAU,OAAW,OAAM,QAAQ,QAAQ;AACvD,QAAI,QAAQ,OAAQ,OAAM,SAAS,QAAQ;AAC3C,WAAO,KAAK,QAA2B;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,KAAK,OAAO,WACV,KAAK,QAAiB;AAAA,IACpB,QAAQ;AAAA,IACR,MAAM,aAAa,MAAM;AAAA,EAC3B,CAAC;AAAA;AAAA;AAAA,EAIH,YAAY,OACV,QACA,OAA8B,CAAC,MACK;AACpC,UAAM,QAAqD,CAAC;AAC5D,QAAI,KAAK,OAAQ,OAAM,SAAS,KAAK;AACrC,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,WAAO,KAAK,QAAgC;AAAA,MAC1C,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,MACzB;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,KAAK,OAAO,WACV,KAAK,QAAsB;AAAA,IACzB,QAAQ;AAAA,IACR,MAAM,aAAa,MAAM;AAAA,EAC3B,CAAC;AACL;;;ACnDO,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAgC;AAC1C,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,UAAM,OAAO,iBAAiB;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ,WAAW;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,MACpB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,IACrB,CAAC;AAED,SAAK,KAAK,iBAAiB,IAAI;AAC/B,SAAK,SAAS,qBAAqB,IAAI;AACvC,SAAK,QAAQ,oBAAoB,IAAI;AACrC,SAAK,iBAAiB,6BAA6B,IAAI;AACvD,SAAK,UAAU,sBAAsB,IAAI;AACzC,SAAK,aAAa,yBAAyB,IAAI;AAC/C,SAAK,WAAW,uBAAuB,IAAI;AAC3C,SAAK,OAAO,mBAAmB,IAAI;AACnC,SAAK,QAAQ,oBAAoB,IAAI;AAAA,EACvC;AACF;;;AClEA,yBAAmB;AAoBZ,IAAM,yBAAyB,CACpC,SACA,iBACA,WACY;AACZ,MAAI,CAAC,mBAAmB,CAAC,OAAQ,QAAO;AACxC,QAAM,CAAC,MAAM,QAAQ,IAAI,gBAAgB,MAAM,GAAG;AAClD,MAAI,SAAS,YAAY,CAAC,SAAU,QAAO;AAE3C,QAAM,WAAW,mBAAAC,QACd,WAAW,UAAU,MAAM,EAC3B,OAAO,OAAO,YAAY,WAAW,UAAU,OAAO,EACtD,OAAO,KAAK;AAGf,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,mBAAAA,QAAO,gBAAgB,GAAG,CAAC;AACpC;","names":["path","fs","path","crypto"]}

package/dist/index.mjs

@@ -444,6 +444,57 @@ var createOrgsResource = (http) => ({
   }
 });
 
+// src/resources/rooms.ts
+var createRoomsResource = (http) => ({
+  // Provision a new room. Server returns 201 with ONE shared room-level
+  // `joinToken` + `joinUrl`. Share the single link with everyone you want in
+  // the room — each visitor supplies their own display name at join time and
+  // becomes a fresh, distinct participant. The server persists only the
+  // token's sha256 hash; the raw token is returned here once and never stored.
+  create: async (input) => http.request({
+    method: "POST",
+    path: "/v1/rooms",
+    body: input
+  }),
+  // Listing — opaque cursor pagination (`nextCursor` returned by the server
+  // is whatever startAfter() needs, don't parse client-side).
+  list: async (filters = {}) => {
+    const query = {};
+    if (filters.status) query.status = filters.status;
+    if (filters.limit !== void 0) query.limit = filters.limit;
+    if (filters.cursor) query.cursor = filters.cursor;
+    return http.request({
+      method: "GET",
+      path: "/v1/rooms",
+      query
+    });
+  },
+  // Fetch a single room. 404s are surfaced as PlatformError('not_found').
+  get: async (roomId) => http.request({
+    method: "GET",
+    path: `/v1/rooms/${roomId}`
+  }),
+  // Transcript pages — utterances are ordered by `startedAt asc`. Cursor is
+  // an ISO timestamp (server enforces, don't construct yourself).
+  transcript: async (roomId, opts = {}) => {
+    const query = {};
+    if (opts.cursor) query.cursor = opts.cursor;
+    if (opts.limit !== void 0) query.limit = opts.limit;
+    return http.request({
+      method: "GET",
+      path: `/v1/rooms/${roomId}/transcript`,
+      query
+    });
+  },
+  // End a room — async on the server: returns 202 + eventId once the
+  // controlEvents entry is written. The room-worker observes the entry,
+  // broadcasts the system message, and tears down LiveKit shortly after.
+  end: async (roomId) => http.request({
+    method: "POST",
+    path: `/v1/rooms/${roomId}/end`
+  })
+});
+
 // src/PlatformClient.ts
 var PlatformClient = class {
   me;
@@ -454,6 +505,7 @@ var PlatformClient = class {
   callTokens;
   webhooks;
   orgs;
+  rooms;
   constructor(options) {
     if (!options.apiKey) {
       throw new Error("PlatformClient: `apiKey` is required");
@@ -474,6 +526,7 @@ var PlatformClient = class {
     this.callTokens = createCallTokensResource(http);
     this.webhooks = createWebhooksResource(http);
     this.orgs = createOrgsResource(http);
+    this.rooms = createRoomsResource(http);
   }
 };
 

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/http.ts","../src/resources/me.ts","../src/resources/agentWebhooks.ts","../src/resources/agents.ts","../src/resources/calls.ts","../src/resources/knowledgeBases.ts","../src/resources/credits.ts","../src/resources/callTokens.ts","../src/resources/webhooks.ts","../src/resources/orgs.ts","../src/PlatformClient.ts","../src/verify.ts"],"sourcesContent":["// Typed error class mirroring the server's ErrorV1 shape:\n//   { error: { code, message, field?, docs_url? } }\n//\n// Consumers do `err instanceof PlatformError` to branch on code without\n// parsing string messages. `status` carries the HTTP code for the 1% of\n// cases where the code field isn't enough (e.g. rate-limit → retry-after\n// header correlation).\n\nexport type ApiErrorCode =\n  | 'unauthorized'\n  | 'forbidden'\n  | 'not_found'\n  | 'bad_request'\n  | 'conflict'\n  | 'rate_limited'\n  | 'payment_required'\n  | 'internal_error'\n  | 'unknown'\n\nexport class PlatformError extends Error {\n  readonly code: ApiErrorCode\n  readonly status: number\n  readonly field?: string\n  readonly docsUrl?: string\n  // The raw response body for debugging. Intentionally optional — we clear\n  // it on `error.toJSON()` so logging libraries don't dump the whole\n  // server response into production logs.\n  readonly body?: unknown\n\n  constructor(params: {\n    code: ApiErrorCode\n    message: string\n    status: number\n    field?: string\n    docsUrl?: string\n    body?: unknown\n  }) {\n    super(params.message)\n    this.name = 'PlatformError'\n    this.code = params.code\n    this.status = params.status\n    this.field = params.field\n    this.docsUrl = params.docsUrl\n    this.body = params.body\n    // Preserve the stack trace — Node's Error doesn't capture it\n    // automatically when subclassing in some older runtimes.\n    if (\n      typeof (Error as typeof Error & { captureStackTrace?: unknown }).captureStackTrace ===\n      'function'\n    ) {\n      ;(\n        Error as typeof Error & { captureStackTrace: (target: unknown, ctor: unknown) => void }\n      ).captureStackTrace(this, PlatformError)\n    }\n  }\n\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      field: this.field,\n      docsUrl: this.docsUrl,\n    }\n  }\n}\n","import { PlatformError, type ApiErrorCode } from './errors'\n\n// Low-level HTTP wrapper around `fetch` (native in Node 18+). Every resource\n// method routes through here for consistent auth + error handling + retries.\n//\n// v1 scope: JSON-in / JSON-out + multipart for file uploads. No streaming —\n// call WebSockets go through @craftedxp/voice-rn (the React Native client)\n// or a web equivalent, not this server-side SDK.\n\nexport interface HttpClientOptions {\n  apiKey: string\n  baseUrl: string\n  // Default 30s. File uploads can override per-request.\n  timeoutMs?: number\n  // 429 + 5xx retries. Defaults to 3 attempts (original + 2 retries) with\n  // exponential backoff (250ms, 1s). Set to 0 to disable.\n  maxRetries?: number\n  // Optional — lets consumers swap in a test/mock fetch (or a custom one\n  // with instrumentation). Defaults to the global.\n  fetch?: typeof fetch\n  // Optional — a callback that fires per-request with the final status and\n  // duration. Handy for dropping traces into the consumer's observability\n  // stack without wrapping each call.\n  onRequest?: (info: {\n    method: string\n    url: string\n    status: number\n    durationMs: number\n    attempt: number\n  }) => void\n}\n\nexport interface HttpRequest {\n  method: 'GET' | 'POST' | 'PATCH' | 'DELETE'\n  path: string // starts with `/`, e.g. `/v1/agents/123`\n  query?: Record<string, string | number | boolean | undefined>\n  body?: unknown // JSON-serialised — for multipart use `formData`\n  formData?: FormData\n  timeoutMs?: number\n  // Exposed for edge cases where a resource wants to tack on extra\n  // headers (we don't have any today but leave the hook).\n  headers?: Record<string, string>\n}\n\nconst DEFAULT_TIMEOUT_MS = 30_000\nconst DEFAULT_MAX_RETRIES = 2 // total attempts = 3\n\nconst buildUrl = (baseUrl: string, path: string, query?: HttpRequest['query']): string => {\n  const u = new URL(path, baseUrl)\n  if (query) {\n    for (const [k, v] of Object.entries(query)) {\n      if (v === undefined) continue\n      u.searchParams.set(k, String(v))\n    }\n  }\n  return u.toString()\n}\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\nconst isRetryable = (status: number): boolean => status === 429 || (status >= 500 && status < 600)\n\n// Parse whatever the server returned into a PlatformError. Falls back to\n// synthesising a sensible error for non-JSON responses.\nconst errorFromResponse = async (res: Response): Promise<PlatformError> => {\n  const bodyText = await res.text().catch(() => '')\n  let parsed: unknown = undefined\n  try {\n    parsed = bodyText ? JSON.parse(bodyText) : undefined\n  } catch {\n    // non-JSON response (e.g. an HTML error page from a proxy). Fall\n    // through with parsed = undefined.\n  }\n  const errObj = (\n    parsed as { error?: { code?: string; message?: string; field?: string; docs_url?: string } }\n  )?.error\n  return new PlatformError({\n    code: (errObj?.code as ApiErrorCode) ?? 'unknown',\n    message: errObj?.message ?? res.statusText ?? `HTTP ${res.status}`,\n    status: res.status,\n    field: errObj?.field,\n    docsUrl: errObj?.docs_url,\n    body: parsed ?? bodyText,\n  })\n}\n\nexport const createHttpClient = (opts: HttpClientOptions) => {\n  const fetchImpl = opts.fetch ?? globalThis.fetch\n  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS\n  const maxRetries = opts.maxRetries ?? DEFAULT_MAX_RETRIES\n\n  if (!fetchImpl) {\n    throw new Error('No global fetch available. @craftedxp/sdk-node requires Node >= 18.')\n  }\n\n  const request = async <T>(req: HttpRequest): Promise<T> => {\n    const url = buildUrl(opts.baseUrl, req.path, req.query)\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${opts.apiKey}`,\n      Accept: 'application/json',\n      ...(req.headers ?? {}),\n    }\n\n    // Body shaping: prefer formData when provided; otherwise JSON.\n    // `FormData` sets its own Content-Type with boundary — don't preempt it.\n    // Typed as `string | FormData | undefined` (a subset of the global\n    // BodyInit) so we don't need DOM lib types in this server-side SDK.\n    let body: string | FormData | undefined\n    if (req.formData) {\n      body = req.formData\n    } else if (req.body !== undefined) {\n      headers['Content-Type'] = 'application/json'\n      body = JSON.stringify(req.body)\n    }\n\n    const reqTimeout = req.timeoutMs ?? timeoutMs\n    let lastErr: unknown\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      const controller = new AbortController()\n      const timer = setTimeout(() => controller.abort(), reqTimeout)\n      const started = Date.now()\n      try {\n        const res = await fetchImpl(url, {\n          method: req.method,\n          headers,\n          body,\n          signal: controller.signal,\n        })\n        const durationMs = Date.now() - started\n        opts.onRequest?.({\n          method: req.method,\n          url,\n          status: res.status,\n          durationMs,\n          attempt: attempt + 1,\n        })\n\n        if (res.ok) {\n          // 204 No Content — some endpoints (DELETE webhooks) return nothing.\n          if (res.status === 204) return undefined as T\n          const ct = res.headers.get('content-type') ?? ''\n          if (ct.includes('application/json')) {\n            return (await res.json()) as T\n          }\n          // Non-JSON 2xx — rare. Return raw text cast as T.\n          return (await res.text()) as unknown as T\n        }\n\n        // Retryable error: back off + retry up to maxRetries.\n        if (isRetryable(res.status) && attempt < maxRetries) {\n          const retryAfter = res.headers.get('Retry-After')\n          const backoff = retryAfter ? Number(retryAfter) * 1000 : 250 * Math.pow(2, attempt)\n          await sleep(backoff)\n          continue\n        }\n\n        throw await errorFromResponse(res)\n      } catch (err) {\n        if (err instanceof PlatformError) throw err\n        // AbortError / network / DNS failures — retry up to maxRetries.\n        if (attempt < maxRetries) {\n          lastErr = err\n          await sleep(250 * Math.pow(2, attempt))\n          continue\n        }\n        const msg = err instanceof Error ? err.message : 'network error'\n        throw new PlatformError({\n          code: 'unknown',\n          message: `Network error: ${msg}`,\n          status: 0,\n        })\n      } finally {\n        clearTimeout(timer)\n      }\n    }\n\n    // Should be unreachable — the loop either returns, throws, or continues.\n    throw lastErr instanceof Error ? lastErr : new Error('request exhausted retries')\n  }\n\n  return { request }\n}\n\nexport type HttpClient = ReturnType<typeof createHttpClient>\n","import type { HttpClient } from '../http'\nimport type { MeResponse } from '../types'\n\nexport const createMeResource = (http: HttpClient) => ({\n  // Smoke test — confirms the API key is valid and returns the org + balance.\n  // Most consumers use this as a ping on startup.\n  get: async (): Promise<MeResponse> => http.request<MeResponse>({ method: 'GET', path: '/v1/me' }),\n})\n\nexport type MeResource = ReturnType<typeof createMeResource>\n","import type { HttpClient } from '../http'\nimport type {\n  WebhookConfig,\n  WebhookCreateInput,\n  WebhookDelivery,\n  WebhookUpdateInput,\n} from '../types'\n\n// Per-agent webhook resource, scoped at factory time to a specific agentId.\n// All endpoints mirror /v1/agents/:agentId/webhooks[/:id].\n\nexport const createAgentWebhooksResource = (http: HttpClient, agentId: string) => ({\n  // Returns the webhook + its signing secret. The secret is only present in\n  // this response — persist immediately, subsequent GETs omit it. Use the\n  // secret to verify `X-Platform-Signature-256` (sha256=hex HMAC over body).\n  create: async (input: WebhookCreateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks`,\n      body: input,\n    }),\n\n  list: async (): Promise<WebhookConfig[]> => {\n    const res = await http.request<{ data: WebhookConfig[] }>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks`,\n    })\n    return res.data\n  },\n\n  get: async (webhookId: string): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  update: async (webhookId: string, patch: WebhookUpdateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'PATCH',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n      body: patch,\n    }),\n\n  delete: async (webhookId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  // Fires a synthetic call.started against this webhook and returns the\n  // full delivery record (including attempt status codes) once the retry\n  // sequence has finished. Useful during setup to verify receiver wiring.\n  test: async (webhookId: string): Promise<WebhookDelivery> =>\n    http.request<WebhookDelivery>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}/test`,\n    }),\n})\n\nexport type AgentWebhooksResource = ReturnType<typeof createAgentWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { Agent, AgentCreateInput, AgentUpdateInput } from '../types'\nimport { createAgentWebhooksResource, type AgentWebhooksResource } from './agentWebhooks'\n\n// The server returns Agent with `apiKey` stripped and `hasApiKey: boolean`\n// on the model. We type the happy path but keep our input type permissive\n// so consumers can POST a plaintext `apiKey` that the server encrypts +\n// swaps for `apiKeySecret` on persistence.\n\nexport const createAgentsResource = (http: HttpClient) => {\n  const agents = {\n    create: async (input: AgentCreateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'POST', path: '/v1/agents', body: input }),\n\n    list: async (): Promise<Agent[]> => {\n      const res = await http.request<{ data: Agent[] }>({ method: 'GET', path: '/v1/agents' })\n      return res.data\n    },\n\n    // Async iterator for \"give me every agent\" — v1 server returns the full\n    // list in one page, so this is just a thin convenience. When the server\n    // picks up cursor pagination, this is the method that papers over that\n    // migration without consumer changes.\n    listAll: async function* (): AsyncIterable<Agent> {\n      const page = await agents.list()\n      for (const a of page) yield a\n    },\n\n    get: async (agentId: string): Promise<Agent> =>\n      http.request<Agent>({ method: 'GET', path: `/v1/agents/${agentId}` }),\n\n    update: async (agentId: string, patch: AgentUpdateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'PATCH', path: `/v1/agents/${agentId}`, body: patch }),\n\n    delete: async (agentId: string): Promise<void> =>\n      http.request<void>({ method: 'DELETE', path: `/v1/agents/${agentId}` }),\n\n    /**\n     * Upload an avatar image for the agent. Server re-encodes to a 512×512\n     * WebP and stores it in the public-read avatars bucket; the returned\n     * `Agent` has `avatarUrl` set to the canonical public URL with a\n     * `?v=` cache-buster.\n     *\n     * `file` accepts a Node Buffer / Uint8Array / Blob / typed-array.\n     * `filename` and `contentType` are optional but help the server log\n     * meaningful errors when something rejects.\n     */\n    uploadAvatar: async (\n      agentId: string,\n      file: Buffer | Uint8Array | Blob | ArrayBuffer,\n      opts: { filename?: string; contentType?: string } = {},\n    ): Promise<Agent> => {\n      const fd = new FormData()\n      const blob =\n        file instanceof Blob\n          ? file\n          : // eslint-disable-next-line @typescript-eslint/no-explicit-any\n            new Blob([file as any], { type: opts.contentType ?? 'application/octet-stream' })\n      fd.append('file', blob, opts.filename ?? 'avatar')\n      return http.request<Agent>({\n        method: 'POST',\n        path: `/v1/agents/${agentId}/avatar`,\n        formData: fd,\n      })\n    },\n\n    /**\n     * Remove the agent's avatar — both the GCS object and the `avatarUrl`\n     * field. Idempotent: calling on an agent without an avatar still\n     * returns the agent.\n     */\n    removeAvatar: async (agentId: string): Promise<Agent> =>\n      http.request<Agent>({ method: 'DELETE', path: `/v1/agents/${agentId}/avatar` }),\n\n    // Nested resource. Per-agent webhook CRUD lives at\n    // /v1/agents/:agentId/webhooks/* — we expose it as a factory keyed on\n    // agentId so consumers can bind once and reuse:\n    //\n    //   const hooks = client.agents.webhooks(myAgentId)\n    //   await hooks.create({ url, events })\n    //   await hooks.list()\n    webhooks: (agentId: string): AgentWebhooksResource =>\n      createAgentWebhooksResource(http, agentId),\n  }\n  return agents\n}\n\nexport type AgentsResource = ReturnType<typeof createAgentsResource>\n","import type { HttpClient } from '../http'\nimport type {\n  CallListFilters,\n  CallRecord,\n  CallRecordingUrlResponse,\n  CallSummary,\n  TranscriptTurn,\n} from '../types'\n\nexport const createCallsResource = (http: HttpClient) => {\n  const calls = {\n    list: async (filters: CallListFilters = {}): Promise<CallSummary[]> => {\n      const res = await http.request<{ data: CallSummary[] }>({\n        method: 'GET',\n        path: '/v1/calls',\n        query: filters as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination helper. v1 server caps at limit (max 200) in a single\n    // page — consumers who ask for \"every call since X\" get that page, the\n    // iterator ends. This is the shape we'd extend with cursor support\n    // without breaking callers.\n    listAll: async function* (filters: CallListFilters = {}): AsyncIterable<CallSummary> {\n      const page = await calls.list(filters)\n      for (const c of page) yield c\n    },\n\n    get: async (callId: string): Promise<CallRecord> =>\n      http.request<CallRecord>({ method: 'GET', path: `/v1/calls/${callId}` }),\n\n    transcript: async (callId: string): Promise<{ callId: string; transcript: TranscriptTurn[] }> =>\n      http.request<{ callId: string; transcript: TranscriptTurn[] }>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/transcript`,\n      }),\n\n    // Returns a V4 signed URL (1-hour TTL). `ready: false` + `artifact:\n    // 'caller-raw'` means the async mix job hasn't finished — the URL still\n    // points at a playable file (raw caller PCM).\n    recording: async (callId: string): Promise<CallRecordingUrlResponse> =>\n      http.request<CallRecordingUrlResponse>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/recording`,\n      }),\n\n    // Outbound dialling (POST /v1/calls) + in-call control are Phase 1.4.4 /\n    // 1.4.5 respectively — blocked on telephony. Surface clear \"not built\n    // yet\" errors here if consumers guess those method names, so they don't\n    // silently hit a non-existent endpoint and wonder why it 404s.\n  }\n  return calls\n}\n\nexport type CallsResource = ReturnType<typeof createCallsResource>\n","import fs from 'node:fs'\nimport path from 'node:path'\nimport type { HttpClient } from '../http'\nimport type { KnowledgeBase, KnowledgeBaseFile } from '../types'\n\nexport const createKnowledgeBasesResource = (http: HttpClient) => ({\n  create: async (name: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({\n      method: 'POST',\n      path: '/v1/knowledge-bases',\n      body: { name },\n    }),\n\n  list: async (): Promise<KnowledgeBase[]> => {\n    const res = await http.request<{ data: KnowledgeBase[] }>({\n      method: 'GET',\n      path: '/v1/knowledge-bases',\n    })\n    return res.data\n  },\n\n  get: async (kbId: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({ method: 'GET', path: `/v1/knowledge-bases/${kbId}` }),\n\n  delete: async (kbId: string): Promise<void> =>\n    http.request<void>({ method: 'DELETE', path: `/v1/knowledge-bases/${kbId}` }),\n\n  // File upload — accepts either a local file path OR raw bytes + filename.\n  // The server ingests synchronously today (Phase 3.1.4 Cloud Tasks is a\n  // followup), so the returned file has status='ready' in most cases.\n  uploadFile: async (\n    kbId: string,\n    source:\n      | { path: string; filename?: string; mimeType?: string }\n      | { data: Buffer | Uint8Array; filename: string; mimeType?: string },\n  ): Promise<KnowledgeBaseFile> => {\n    const form = new FormData()\n    let blob: Blob\n    let filename: string\n    let mime: string\n\n    if ('path' in source) {\n      const buf = await fs.promises.readFile(source.path)\n      filename = source.filename ?? path.basename(source.path)\n      mime = source.mimeType ?? 'application/octet-stream'\n      blob = new Blob([new Uint8Array(buf)], { type: mime })\n    } else {\n      filename = source.filename\n      mime = source.mimeType ?? 'application/octet-stream'\n      const bytes = source.data instanceof Buffer ? new Uint8Array(source.data) : source.data\n      blob = new Blob([bytes], { type: mime })\n    }\n    form.append('file', blob, filename)\n\n    // File uploads can take a while (OCR, chunking, embedding) — give them\n    // room before timing out. 5 min cap matches the server's own\n    // processing budget.\n    return http.request<KnowledgeBaseFile>({\n      method: 'POST',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n      formData: form,\n      timeoutMs: 5 * 60 * 1000,\n    })\n  },\n\n  listFiles: async (kbId: string): Promise<KnowledgeBaseFile[]> => {\n    const res = await http.request<{ data: KnowledgeBaseFile[] }>({\n      method: 'GET',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n    })\n    return res.data\n  },\n\n  deleteFile: async (kbId: string, fileId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/knowledge-bases/${kbId}/files/${fileId}`,\n    }),\n})\n\nexport type KnowledgeBasesResource = ReturnType<typeof createKnowledgeBasesResource>\n","import type { HttpClient } from '../http'\nimport type { LedgerEntry } from '../types'\n\nexport const createCreditsResource = (http: HttpClient) => {\n  const credits = {\n    getBalance: async (): Promise<{ orgId: string; balanceCents: number }> =>\n      http.request<{ orgId: string; balanceCents: number }>({\n        method: 'GET',\n        path: '/v1/credits/balance',\n      }),\n\n    // Returns ledger entries newest-first. `limit` is capped at 500 server-side.\n    getLedger: async (opts: { limit?: number } = {}): Promise<LedgerEntry[]> => {\n      const res = await http.request<{ data: LedgerEntry[] }>({\n        method: 'GET',\n        path: '/v1/credits/ledger',\n        query: opts as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination scaffold — v1 server returns a single page up to\n    // limit=500. When cursor pagination lands this is where it gets wired.\n    getLedgerAll: async function* (opts: { limit?: number } = {}): AsyncIterable<LedgerEntry> {\n      const page = await credits.getLedger(opts)\n      for (const e of page) yield e\n    },\n  }\n  return credits\n}\n\nexport type CreditsResource = ReturnType<typeof createCreditsResource>\n","import type { HttpClient } from '../http'\nimport type { CallTokenMintInput, CallTokenMintResult, CallTokenSummary } from '../types'\n\n// Short-lived, agent-scoped `ct_` tokens. Mint one per user session on your\n// backend, hand the raw value to the browser; let this SDK handle lifecycle\n// (revoke on sign-out, list active tokens for an admin panel).\n\nexport const createCallTokensResource = (http: HttpClient) => ({\n  // Returns the RAW token value once. Don't log it; pass it straight to the\n  // browser + discard server-side. `tokenId` is the stable public handle\n  // used for revocation later.\n  mint: async (input: CallTokenMintInput): Promise<CallTokenMintResult> =>\n    http.request<CallTokenMintResult>({\n      method: 'POST',\n      path: '/v1/call-tokens',\n      body: input,\n    }),\n\n  // Live tokens only by default. Pass includeRevoked/includeExpired when\n  // debugging \"why did my token stop working\".\n  list: async (\n    opts: { includeRevoked?: boolean; includeExpired?: boolean; limit?: number } = {},\n  ): Promise<CallTokenSummary[]> => {\n    const query: Record<string, string | number | undefined> = {}\n    if (opts.includeRevoked) query.includeRevoked = '1'\n    if (opts.includeExpired) query.includeExpired = '1'\n    if (opts.limit !== undefined) query.limit = opts.limit\n    const res = await http.request<{ data: CallTokenSummary[] }>({\n      method: 'GET',\n      path: '/v1/call-tokens',\n      query,\n    })\n    return res.data\n  },\n\n  // Idempotent — re-revoking a revoked token returns `alreadyRevoked: true`.\n  revoke: async (\n    tokenId: string,\n  ): Promise<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }> =>\n    http.request<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }>({\n      method: 'DELETE',\n      path: `/v1/call-tokens/${tokenId}`,\n    }),\n})\n\nexport type CallTokensResource = ReturnType<typeof createCallTokensResource>\n","import type { HttpClient } from '../http'\nimport type { WebhookDelivery } from '../types'\n\n// Org-wide webhook delivery log. Per-agent CRUD lives on\n// `client.agents.webhooks(agentId)` — this namespace is just the\n// read-only deliveries surface that spans all agents.\n\nexport const createWebhooksResource = (http: HttpClient) => ({\n  deliveries: async (\n    filters: {\n      agentId?: string\n      webhookId?: string\n      callId?: string\n      limit?: number\n    } = {},\n  ): Promise<WebhookDelivery[]> => {\n    const res = await http.request<{ data: WebhookDelivery[] }>({\n      method: 'GET',\n      path: '/v1/webhooks/deliveries',\n      query: filters as Record<string, string | number | undefined>,\n    })\n    return res.data\n  },\n})\n\nexport type WebhooksResource = ReturnType<typeof createWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { CatalogAgent, CatalogListInput } from '../types'\n\n// Org-scoped consumer endpoints. Today this is just the agent catalog —\n// the trimmed shape your mobile app picks an agent from. Lives at\n// `/v1/orgs/:orgId/agents` rather than reusing the admin `/v1/agents/*`\n// tree on purpose: the catalog response intentionally excludes the\n// operator-only fields (system prompt, tools, KB IDs) so a leaked\n// consumer-backend `sk_` can't lift the operator config out of it.\n//\n// Pattern from your backend:\n//\n//   const client = new PlatformClient({ apiKey: process.env.SK })\n//   const visible = await client.orgs.listAgents({\n//     orgId: process.env.ORG_ID!,\n//     userTags: ['tier1'],   // omit to get the unfiltered admin view\n//   })\n//   res.json(visible)\n\nexport const createOrgsResource = (http: HttpClient) => ({\n  /**\n   * Fetch the agent catalog for an org. Returns the consumer-trimmed shape;\n   * no system prompt, tools, or KB info. Use `client.agents.get(agentId)`\n   * with the same `sk_` if you need the full admin shape.\n   *\n   * `userTags`: end-user entitlement tags. When supplied, hides agents\n   * whose `allowedUserTags` is non-empty and doesn't intersect with the\n   * supplied list. Omit to get the unfiltered admin view.\n   *\n   * Persona / category filtering is intentionally not a server param —\n   * filter the returned list client-side over `name`s if you need it.\n   *\n   * Throws `403 forbidden` if `orgId` doesn't match the key's org.\n   */\n  listAgents: async (input: CatalogListInput): Promise<CatalogAgent[]> => {\n    const query: Record<string, string | undefined> = {}\n    if (input.userTags && input.userTags.length > 0) query.userTags = input.userTags.join(',')\n    const res = await http.request<{ data: CatalogAgent[] }>({\n      method: 'GET',\n      path: `/v1/orgs/${input.orgId}/agents`,\n      query,\n    })\n    return res.data\n  },\n})\n\nexport type OrgsResource = ReturnType<typeof createOrgsResource>\n","import { createHttpClient, type HttpClientOptions } from './http'\nimport { createMeResource, type MeResource } from './resources/me'\nimport { createAgentsResource, type AgentsResource } from './resources/agents'\nimport { createCallsResource, type CallsResource } from './resources/calls'\nimport {\n  createKnowledgeBasesResource,\n  type KnowledgeBasesResource,\n} from './resources/knowledgeBases'\nimport { createCreditsResource, type CreditsResource } from './resources/credits'\nimport { createCallTokensResource, type CallTokensResource } from './resources/callTokens'\nimport { createWebhooksResource, type WebhooksResource } from './resources/webhooks'\nimport { createOrgsResource, type OrgsResource } from './resources/orgs'\n\nexport interface PlatformClientOptions {\n  // Full-org API key minted from the dashboard or bootstrap CLI. Start with\n  // `sk_`. Never ship to a browser — use `client.callTokens.mint(...)` to\n  // generate a narrow `ct_` token for client-side use instead.\n  apiKey: string\n  // Defaults to the hosted platform. Point at `http://localhost:8080` for\n  // local dev or at a self-hosted deployment.\n  baseUrl?: string\n  // Passthrough tuning for the HTTP layer.\n  timeoutMs?: number\n  maxRetries?: number\n  fetch?: HttpClientOptions['fetch']\n  onRequest?: HttpClientOptions['onRequest']\n}\n\n// Single entry point. All resources are lazy-constructed in the constructor\n// so their refs don't incur any per-call allocation. Shape mirrors Stripe /\n// Twilio / Vapi's `resource.method()` convention for familiarity.\nexport class PlatformClient {\n  readonly me: MeResource\n  readonly agents: AgentsResource\n  readonly calls: CallsResource\n  readonly knowledgeBases: KnowledgeBasesResource\n  readonly credits: CreditsResource\n  readonly callTokens: CallTokensResource\n  readonly webhooks: WebhooksResource\n  readonly orgs: OrgsResource\n\n  constructor(options: PlatformClientOptions) {\n    if (!options.apiKey) {\n      throw new Error('PlatformClient: `apiKey` is required')\n    }\n    const http = createHttpClient({\n      apiKey: options.apiKey,\n      baseUrl: options.baseUrl ?? 'https://api.example.com',\n      timeoutMs: options.timeoutMs,\n      maxRetries: options.maxRetries,\n      fetch: options.fetch,\n      onRequest: options.onRequest,\n    })\n\n    this.me = createMeResource(http)\n    this.agents = createAgentsResource(http)\n    this.calls = createCallsResource(http)\n    this.knowledgeBases = createKnowledgeBasesResource(http)\n    this.credits = createCreditsResource(http)\n    this.callTokens = createCallTokensResource(http)\n    this.webhooks = createWebhooksResource(http)\n    this.orgs = createOrgsResource(http)\n  }\n}\n","import crypto from 'node:crypto'\n\n// Helper for consumers receiving webhooks: verify the `X-Platform-Signature-256`\n// header against the raw body + secret. Plain function (not tied to\n// PlatformClient) so Express/Koa/Next.js middleware can use it without\n// instantiating a client.\n//\n//   import { verifyWebhookSignature } from '@craftedxp/sdk-node'\n//   app.post('/webhooks/voice-agent', express.raw({ type: 'application/json' }), (req, res) => {\n//     const sig = req.header('X-Platform-Signature-256') ?? ''\n//     if (!verifyWebhookSignature(req.body, sig, process.env.VOICE_AGENT_WEBHOOK_SECRET!)) {\n//       return res.status(401).send('invalid signature')\n//     }\n//     const event = JSON.parse(req.body.toString('utf8'))\n//     // ...handle event\n//   })\n//\n// The signature is `sha256=<hex HMAC-SHA256 of rawBody with secret>`.\n// Timing-safe compare to avoid microtiming side channels.\n\nexport const verifyWebhookSignature = (\n  rawBody: Buffer | string,\n  signatureHeader: string,\n  secret: string,\n): boolean => {\n  if (!signatureHeader || !secret) return false\n  const [algo, provided] = signatureHeader.split('=')\n  if (algo !== 'sha256' || !provided) return false\n\n  const expected = crypto\n    .createHmac('sha256', secret)\n    .update(typeof rawBody === 'string' ? rawBody : rawBody)\n    .digest('hex')\n\n  // Buffers must match in length for timingSafeEqual.\n  const a = Buffer.from(expected, 'hex')\n  const b = Buffer.from(provided, 'hex')\n  if (a.length !== b.length) return false\n  return crypto.timingSafeEqual(a, b)\n}\n"],"mappings":";AAmBO,IAAM,gBAAN,MAAM,uBAAsB,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EAET,YAAY,QAOT;AACD,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,OAAO,OAAO;AAGnB,QACE,OAAQ,MAAyD,sBACjE,YACA;AACA;AAAC,MACC,MACA,kBAAkB,MAAM,cAAa;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,SAAkC;AAChC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AACF;;;ACtBA,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AAE5B,IAAM,WAAW,CAAC,SAAiBA,OAAc,UAAyC;AACxF,QAAM,IAAI,IAAI,IAAIA,OAAM,OAAO;AAC/B,MAAI,OAAO;AACT,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,MAAM,OAAW;AACrB,QAAE,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO,EAAE,SAAS;AACpB;AAEA,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAExE,IAAM,cAAc,CAAC,WAA4B,WAAW,OAAQ,UAAU,OAAO,SAAS;AAI9F,IAAM,oBAAoB,OAAO,QAA0C;AACzE,QAAM,WAAW,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAChD,MAAI,SAAkB;AACtB,MAAI;AACF,aAAS,WAAW,KAAK,MAAM,QAAQ,IAAI;AAAA,EAC7C,QAAQ;AAAA,EAGR;AACA,QAAM,SACJ,QACC;AACH,SAAO,IAAI,cAAc;AAAA,IACvB,MAAO,QAAQ,QAAyB;AAAA,IACxC,SAAS,QAAQ,WAAW,IAAI,cAAc,QAAQ,IAAI,MAAM;AAAA,IAChE,QAAQ,IAAI;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,MAAM,UAAU;AAAA,EAClB,CAAC;AACH;AAEO,IAAM,mBAAmB,CAAC,SAA4B;AAC3D,QAAM,YAAY,KAAK,SAAS,WAAW;AAC3C,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,aAAa,KAAK,cAAc;AAEtC,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAEA,QAAM,UAAU,OAAU,QAAiC;AACzD,UAAM,MAAM,SAAS,KAAK,SAAS,IAAI,MAAM,IAAI,KAAK;AACtD,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,QAAQ;AAAA,MACR,GAAI,IAAI,WAAW,CAAC;AAAA,IACtB;AAMA,QAAI;AACJ,QAAI,IAAI,UAAU;AAChB,aAAO,IAAI;AAAA,IACb,WAAW,IAAI,SAAS,QAAW;AACjC,cAAQ,cAAc,IAAI;AAC1B,aAAO,KAAK,UAAU,IAAI,IAAI;AAAA,IAChC;AAEA,UAAM,aAAa,IAAI,aAAa;AACpC,QAAI;AAEJ,aAAS,UAAU,GAAG,WAAW,YAAY,WAAW;AACtD,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,YAAM,UAAU,KAAK,IAAI;AACzB,UAAI;AACF,cAAM,MAAM,MAAM,UAAU,KAAK;AAAA,UAC/B,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA;AAAA,UACA,QAAQ,WAAW;AAAA,QACrB,CAAC;AACD,cAAM,aAAa,KAAK,IAAI,IAAI;AAChC,aAAK,YAAY;AAAA,UACf,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,SAAS,UAAU;AAAA,QACrB,CAAC;AAED,YAAI,IAAI,IAAI;AAEV,cAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,gBAAM,KAAK,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC9C,cAAI,GAAG,SAAS,kBAAkB,GAAG;AACnC,mBAAQ,MAAM,IAAI,KAAK;AAAA,UACzB;AAEA,iBAAQ,MAAM,IAAI,KAAK;AAAA,QACzB;AAGA,YAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,gBAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,gBAAM,UAAU,aAAa,OAAO,UAAU,IAAI,MAAO,MAAM,KAAK,IAAI,GAAG,OAAO;AAClF,gBAAM,MAAM,OAAO;AACnB;AAAA,QACF;AAEA,cAAM,MAAM,kBAAkB,GAAG;AAAA,MACnC,SAAS,KAAK;AACZ,YAAI,eAAe,cAAe,OAAM;AAExC,YAAI,UAAU,YAAY;AACxB,oBAAU;AACV,gBAAM,MAAM,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;AACtC;AAAA,QACF;AACA,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU;AACjD,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,kBAAkB,GAAG;AAAA,UAC9B,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAGA,UAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,2BAA2B;AAAA,EAClF;AAEA,SAAO,EAAE,QAAQ;AACnB;;;ACnLO,IAAM,mBAAmB,CAAC,UAAsB;AAAA;AAAA;AAAA,EAGrD,KAAK,YAAiC,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,SAAS,CAAC;AAClG;;;ACIO,IAAM,8BAA8B,CAAC,MAAkB,aAAqB;AAAA;AAAA;AAAA;AAAA,EAIjF,QAAQ,OAAO,UACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO;AAAA,IAC3B,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM,cAAc,OAAO;AAAA,IAC7B,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,cACV,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA,EAEH,QAAQ,OAAO,WAAmB,UAChC,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,IACjD,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,QAAQ,OAAO,cACb,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,MAAM,OAAO,cACX,KAAK,QAAyB;AAAA,IAC5B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AACL;;;AChDO,IAAM,uBAAuB,CAAC,SAAqB;AACxD,QAAM,SAAS;AAAA,IACb,QAAQ,OAAO,UACb,KAAK,QAAe,EAAE,QAAQ,QAAQ,MAAM,cAAc,MAAM,MAAM,CAAC;AAAA,IAEzE,MAAM,YAA8B;AAClC,YAAM,MAAM,MAAM,KAAK,QAA2B,EAAE,QAAQ,OAAO,MAAM,aAAa,CAAC;AACvF,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,mBAAyC;AAChD,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,YACV,KAAK,QAAe,EAAE,QAAQ,OAAO,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA,IAEtE,QAAQ,OAAO,SAAiB,UAC9B,KAAK,QAAe,EAAE,QAAQ,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,MAAM,CAAC;AAAA,IAErF,QAAQ,OAAO,YACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYxE,cAAc,OACZ,SACA,MACA,OAAoD,CAAC,MAClC;AACnB,YAAM,KAAK,IAAI,SAAS;AACxB,YAAM,OACJ,gBAAgB,OACZ;AAAA;AAAA,QAEA,IAAI,KAAK,CAAC,IAAW,GAAG,EAAE,MAAM,KAAK,eAAe,2BAA2B,CAAC;AAAA;AACtF,SAAG,OAAO,QAAQ,MAAM,KAAK,YAAY,QAAQ;AACjD,aAAO,KAAK,QAAe;AAAA,QACzB,QAAQ;AAAA,QACR,MAAM,cAAc,OAAO;AAAA,QAC3B,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,cAAc,OAAO,YACnB,KAAK,QAAe,EAAE,QAAQ,UAAU,MAAM,cAAc,OAAO,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAShF,UAAU,CAAC,YACT,4BAA4B,MAAM,OAAO;AAAA,EAC7C;AACA,SAAO;AACT;;;AC5EO,IAAM,sBAAsB,CAAC,SAAqB;AACvD,QAAM,QAAQ;AAAA,IACZ,MAAM,OAAO,UAA2B,CAAC,MAA8B;AACrE,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,iBAAiB,UAA2B,CAAC,GAA+B;AACnF,YAAM,OAAO,MAAM,MAAM,KAAK,OAAO;AACrC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,WACV,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,aAAa,MAAM,GAAG,CAAC;AAAA,IAEzE,YAAY,OAAO,WACjB,KAAK,QAA0D;AAAA,MAC7D,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,IAKH,WAAW,OAAO,WAChB,KAAK,QAAkC;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAML;AACA,SAAO;AACT;;;ACrDA,OAAO,QAAQ;AACf,OAAO,UAAU;AAIV,IAAM,+BAA+B,CAAC,UAAsB;AAAA,EACjE,QAAQ,OAAO,SACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM,EAAE,KAAK;AAAA,EACf,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,SACV,KAAK,QAAuB,EAAE,QAAQ,OAAO,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA,EAEpF,QAAQ,OAAO,SACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,EAK9E,YAAY,OACV,MACA,WAG+B;AAC/B,UAAM,OAAO,IAAI,SAAS;AAC1B,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,UAAU,QAAQ;AACpB,YAAM,MAAM,MAAM,GAAG,SAAS,SAAS,OAAO,IAAI;AAClD,iBAAW,OAAO,YAAY,KAAK,SAAS,OAAO,IAAI;AACvD,aAAO,OAAO,YAAY;AAC1B,aAAO,IAAI,KAAK,CAAC,IAAI,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACvD,OAAO;AACL,iBAAW,OAAO;AAClB,aAAO,OAAO,YAAY;AAC1B,YAAM,QAAQ,OAAO,gBAAgB,SAAS,IAAI,WAAW,OAAO,IAAI,IAAI,OAAO;AACnF,aAAO,IAAI,KAAK,CAAC,KAAK,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACzC;AACA,SAAK,OAAO,QAAQ,MAAM,QAAQ;AAKlC,WAAO,KAAK,QAA2B;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,WAAW,IAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,OAAO,SAA+C;AAC/D,UAAM,MAAM,MAAM,KAAK,QAAuC;AAAA,MAC5D,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,IACnC,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,YAAY,OAAO,MAAc,WAC/B,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,uBAAuB,IAAI,UAAU,MAAM;AAAA,EACnD,CAAC;AACL;;;AC3EO,IAAM,wBAAwB,CAAC,SAAqB;AACzD,QAAM,UAAU;AAAA,IACd,YAAY,YACV,KAAK,QAAiD;AAAA,MACpD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA;AAAA,IAGH,WAAW,OAAO,OAA2B,CAAC,MAA8B;AAC1E,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA,IAIA,cAAc,iBAAiB,OAA2B,CAAC,GAA+B;AACxF,YAAM,OAAO,MAAM,QAAQ,UAAU,IAAI;AACzC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,EACF;AACA,SAAO;AACT;;;ACtBO,IAAM,2BAA2B,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA,EAI7D,MAAM,OAAO,UACX,KAAK,QAA6B;AAAA,IAChC,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAAA;AAAA;AAAA,EAIH,MAAM,OACJ,OAA+E,CAAC,MAChD;AAChC,UAAM,QAAqD,CAAC;AAC5D,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,UAAM,MAAM,MAAM,KAAK,QAAsC;AAAA,MAC3D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA;AAAA,EAGA,QAAQ,OACN,YAEA,KAAK,QAAyE;AAAA,IAC5E,QAAQ;AAAA,IACR,MAAM,mBAAmB,OAAO;AAAA,EAClC,CAAC;AACL;;;ACpCO,IAAM,yBAAyB,CAAC,UAAsB;AAAA,EAC3D,YAAY,OACV,UAKI,CAAC,MAC0B;AAC/B,UAAM,MAAM,MAAM,KAAK,QAAqC;AAAA,MAC1D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACJO,IAAM,qBAAqB,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAevD,YAAY,OAAO,UAAqD;AACtE,UAAM,QAA4C,CAAC;AACnD,QAAI,MAAM,YAAY,MAAM,SAAS,SAAS,EAAG,OAAM,WAAW,MAAM,SAAS,KAAK,GAAG;AACzF,UAAM,MAAM,MAAM,KAAK,QAAkC;AAAA,MACvD,QAAQ;AAAA,MACR,MAAM,YAAY,MAAM,KAAK;AAAA,MAC7B;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACbO,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAgC;AAC1C,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,UAAM,OAAO,iBAAiB;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ,WAAW;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,MACpB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,IACrB,CAAC;AAED,SAAK,KAAK,iBAAiB,IAAI;AAC/B,SAAK,SAAS,qBAAqB,IAAI;AACvC,SAAK,QAAQ,oBAAoB,IAAI;AACrC,SAAK,iBAAiB,6BAA6B,IAAI;AACvD,SAAK,UAAU,sBAAsB,IAAI;AACzC,SAAK,aAAa,yBAAyB,IAAI;AAC/C,SAAK,WAAW,uBAAuB,IAAI;AAC3C,SAAK,OAAO,mBAAmB,IAAI;AAAA,EACrC;AACF;;;AC/DA,OAAO,YAAY;AAoBZ,IAAM,yBAAyB,CACpC,SACA,iBACA,WACY;AACZ,MAAI,CAAC,mBAAmB,CAAC,OAAQ,QAAO;AACxC,QAAM,CAAC,MAAM,QAAQ,IAAI,gBAAgB,MAAM,GAAG;AAClD,MAAI,SAAS,YAAY,CAAC,SAAU,QAAO;AAE3C,QAAM,WAAW,OACd,WAAW,UAAU,MAAM,EAC3B,OAAO,OAAO,YAAY,WAAW,UAAU,OAAO,EACtD,OAAO,KAAK;AAGf,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,OAAO,gBAAgB,GAAG,CAAC;AACpC;","names":["path"]}
+{"version":3,"sources":["../src/errors.ts","../src/http.ts","../src/resources/me.ts","../src/resources/agentWebhooks.ts","../src/resources/agents.ts","../src/resources/calls.ts","../src/resources/knowledgeBases.ts","../src/resources/credits.ts","../src/resources/callTokens.ts","../src/resources/webhooks.ts","../src/resources/orgs.ts","../src/resources/rooms.ts","../src/PlatformClient.ts","../src/verify.ts"],"sourcesContent":["// Typed error class mirroring the server's ErrorV1 shape:\n//   { error: { code, message, field?, docs_url? } }\n//\n// Consumers do `err instanceof PlatformError` to branch on code without\n// parsing string messages. `status` carries the HTTP code for the 1% of\n// cases where the code field isn't enough (e.g. rate-limit → retry-after\n// header correlation).\n\nexport type ApiErrorCode =\n  | 'unauthorized'\n  | 'forbidden'\n  | 'not_found'\n  | 'bad_request'\n  | 'conflict'\n  | 'rate_limited'\n  | 'payment_required'\n  | 'internal_error'\n  | 'unknown'\n\nexport class PlatformError extends Error {\n  readonly code: ApiErrorCode\n  readonly status: number\n  readonly field?: string\n  readonly docsUrl?: string\n  // The raw response body for debugging. Intentionally optional — we clear\n  // it on `error.toJSON()` so logging libraries don't dump the whole\n  // server response into production logs.\n  readonly body?: unknown\n\n  constructor(params: {\n    code: ApiErrorCode\n    message: string\n    status: number\n    field?: string\n    docsUrl?: string\n    body?: unknown\n  }) {\n    super(params.message)\n    this.name = 'PlatformError'\n    this.code = params.code\n    this.status = params.status\n    this.field = params.field\n    this.docsUrl = params.docsUrl\n    this.body = params.body\n    // Preserve the stack trace — Node's Error doesn't capture it\n    // automatically when subclassing in some older runtimes.\n    if (\n      typeof (Error as typeof Error & { captureStackTrace?: unknown }).captureStackTrace ===\n      'function'\n    ) {\n      ;(\n        Error as typeof Error & { captureStackTrace: (target: unknown, ctor: unknown) => void }\n      ).captureStackTrace(this, PlatformError)\n    }\n  }\n\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      status: this.status,\n      field: this.field,\n      docsUrl: this.docsUrl,\n    }\n  }\n}\n","import { PlatformError, type ApiErrorCode } from './errors'\n\n// Low-level HTTP wrapper around `fetch` (native in Node 18+). Every resource\n// method routes through here for consistent auth + error handling + retries.\n//\n// v1 scope: JSON-in / JSON-out + multipart for file uploads. No streaming —\n// call WebSockets go through @craftedxp/voice-rn (the React Native client)\n// or a web equivalent, not this server-side SDK.\n\nexport interface HttpClientOptions {\n  apiKey: string\n  baseUrl: string\n  // Default 30s. File uploads can override per-request.\n  timeoutMs?: number\n  // 429 + 5xx retries. Defaults to 3 attempts (original + 2 retries) with\n  // exponential backoff (250ms, 1s). Set to 0 to disable.\n  maxRetries?: number\n  // Optional — lets consumers swap in a test/mock fetch (or a custom one\n  // with instrumentation). Defaults to the global.\n  fetch?: typeof fetch\n  // Optional — a callback that fires per-request with the final status and\n  // duration. Handy for dropping traces into the consumer's observability\n  // stack without wrapping each call.\n  onRequest?: (info: {\n    method: string\n    url: string\n    status: number\n    durationMs: number\n    attempt: number\n  }) => void\n}\n\nexport interface HttpRequest {\n  method: 'GET' | 'POST' | 'PATCH' | 'DELETE'\n  path: string // starts with `/`, e.g. `/v1/agents/123`\n  query?: Record<string, string | number | boolean | undefined>\n  body?: unknown // JSON-serialised — for multipart use `formData`\n  formData?: FormData\n  timeoutMs?: number\n  // Exposed for edge cases where a resource wants to tack on extra\n  // headers (we don't have any today but leave the hook).\n  headers?: Record<string, string>\n}\n\nconst DEFAULT_TIMEOUT_MS = 30_000\nconst DEFAULT_MAX_RETRIES = 2 // total attempts = 3\n\nconst buildUrl = (baseUrl: string, path: string, query?: HttpRequest['query']): string => {\n  const u = new URL(path, baseUrl)\n  if (query) {\n    for (const [k, v] of Object.entries(query)) {\n      if (v === undefined) continue\n      u.searchParams.set(k, String(v))\n    }\n  }\n  return u.toString()\n}\n\nconst sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms))\n\nconst isRetryable = (status: number): boolean => status === 429 || (status >= 500 && status < 600)\n\n// Parse whatever the server returned into a PlatformError. Falls back to\n// synthesising a sensible error for non-JSON responses.\nconst errorFromResponse = async (res: Response): Promise<PlatformError> => {\n  const bodyText = await res.text().catch(() => '')\n  let parsed: unknown = undefined\n  try {\n    parsed = bodyText ? JSON.parse(bodyText) : undefined\n  } catch {\n    // non-JSON response (e.g. an HTML error page from a proxy). Fall\n    // through with parsed = undefined.\n  }\n  const errObj = (\n    parsed as { error?: { code?: string; message?: string; field?: string; docs_url?: string } }\n  )?.error\n  return new PlatformError({\n    code: (errObj?.code as ApiErrorCode) ?? 'unknown',\n    message: errObj?.message ?? res.statusText ?? `HTTP ${res.status}`,\n    status: res.status,\n    field: errObj?.field,\n    docsUrl: errObj?.docs_url,\n    body: parsed ?? bodyText,\n  })\n}\n\nexport const createHttpClient = (opts: HttpClientOptions) => {\n  const fetchImpl = opts.fetch ?? globalThis.fetch\n  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS\n  const maxRetries = opts.maxRetries ?? DEFAULT_MAX_RETRIES\n\n  if (!fetchImpl) {\n    throw new Error('No global fetch available. @craftedxp/sdk-node requires Node >= 18.')\n  }\n\n  const request = async <T>(req: HttpRequest): Promise<T> => {\n    const url = buildUrl(opts.baseUrl, req.path, req.query)\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${opts.apiKey}`,\n      Accept: 'application/json',\n      ...(req.headers ?? {}),\n    }\n\n    // Body shaping: prefer formData when provided; otherwise JSON.\n    // `FormData` sets its own Content-Type with boundary — don't preempt it.\n    // Typed as `string | FormData | undefined` (a subset of the global\n    // BodyInit) so we don't need DOM lib types in this server-side SDK.\n    let body: string | FormData | undefined\n    if (req.formData) {\n      body = req.formData\n    } else if (req.body !== undefined) {\n      headers['Content-Type'] = 'application/json'\n      body = JSON.stringify(req.body)\n    }\n\n    const reqTimeout = req.timeoutMs ?? timeoutMs\n    let lastErr: unknown\n\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      const controller = new AbortController()\n      const timer = setTimeout(() => controller.abort(), reqTimeout)\n      const started = Date.now()\n      try {\n        const res = await fetchImpl(url, {\n          method: req.method,\n          headers,\n          body,\n          signal: controller.signal,\n        })\n        const durationMs = Date.now() - started\n        opts.onRequest?.({\n          method: req.method,\n          url,\n          status: res.status,\n          durationMs,\n          attempt: attempt + 1,\n        })\n\n        if (res.ok) {\n          // 204 No Content — some endpoints (DELETE webhooks) return nothing.\n          if (res.status === 204) return undefined as T\n          const ct = res.headers.get('content-type') ?? ''\n          if (ct.includes('application/json')) {\n            return (await res.json()) as T\n          }\n          // Non-JSON 2xx — rare. Return raw text cast as T.\n          return (await res.text()) as unknown as T\n        }\n\n        // Retryable error: back off + retry up to maxRetries.\n        if (isRetryable(res.status) && attempt < maxRetries) {\n          const retryAfter = res.headers.get('Retry-After')\n          const backoff = retryAfter ? Number(retryAfter) * 1000 : 250 * Math.pow(2, attempt)\n          await sleep(backoff)\n          continue\n        }\n\n        throw await errorFromResponse(res)\n      } catch (err) {\n        if (err instanceof PlatformError) throw err\n        // AbortError / network / DNS failures — retry up to maxRetries.\n        if (attempt < maxRetries) {\n          lastErr = err\n          await sleep(250 * Math.pow(2, attempt))\n          continue\n        }\n        const msg = err instanceof Error ? err.message : 'network error'\n        throw new PlatformError({\n          code: 'unknown',\n          message: `Network error: ${msg}`,\n          status: 0,\n        })\n      } finally {\n        clearTimeout(timer)\n      }\n    }\n\n    // Should be unreachable — the loop either returns, throws, or continues.\n    throw lastErr instanceof Error ? lastErr : new Error('request exhausted retries')\n  }\n\n  return { request }\n}\n\nexport type HttpClient = ReturnType<typeof createHttpClient>\n","import type { HttpClient } from '../http'\nimport type { MeResponse } from '../types'\n\nexport const createMeResource = (http: HttpClient) => ({\n  // Smoke test — confirms the API key is valid and returns the org + balance.\n  // Most consumers use this as a ping on startup.\n  get: async (): Promise<MeResponse> => http.request<MeResponse>({ method: 'GET', path: '/v1/me' }),\n})\n\nexport type MeResource = ReturnType<typeof createMeResource>\n","import type { HttpClient } from '../http'\nimport type {\n  WebhookConfig,\n  WebhookCreateInput,\n  WebhookDelivery,\n  WebhookUpdateInput,\n} from '../types'\n\n// Per-agent webhook resource, scoped at factory time to a specific agentId.\n// All endpoints mirror /v1/agents/:agentId/webhooks[/:id].\n\nexport const createAgentWebhooksResource = (http: HttpClient, agentId: string) => ({\n  // Returns the webhook + its signing secret. The secret is only present in\n  // this response — persist immediately, subsequent GETs omit it. Use the\n  // secret to verify `X-Platform-Signature-256` (sha256=hex HMAC over body).\n  create: async (input: WebhookCreateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks`,\n      body: input,\n    }),\n\n  list: async (): Promise<WebhookConfig[]> => {\n    const res = await http.request<{ data: WebhookConfig[] }>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks`,\n    })\n    return res.data\n  },\n\n  get: async (webhookId: string): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'GET',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  update: async (webhookId: string, patch: WebhookUpdateInput): Promise<WebhookConfig> =>\n    http.request<WebhookConfig>({\n      method: 'PATCH',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n      body: patch,\n    }),\n\n  delete: async (webhookId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}`,\n    }),\n\n  // Fires a synthetic call.started against this webhook and returns the\n  // full delivery record (including attempt status codes) once the retry\n  // sequence has finished. Useful during setup to verify receiver wiring.\n  test: async (webhookId: string): Promise<WebhookDelivery> =>\n    http.request<WebhookDelivery>({\n      method: 'POST',\n      path: `/v1/agents/${agentId}/webhooks/${webhookId}/test`,\n    }),\n})\n\nexport type AgentWebhooksResource = ReturnType<typeof createAgentWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { Agent, AgentCreateInput, AgentUpdateInput } from '../types'\nimport { createAgentWebhooksResource, type AgentWebhooksResource } from './agentWebhooks'\n\n// The server returns Agent with `apiKey` stripped and `hasApiKey: boolean`\n// on the model. We type the happy path but keep our input type permissive\n// so consumers can POST a plaintext `apiKey` that the server encrypts +\n// swaps for `apiKeySecret` on persistence.\n\nexport const createAgentsResource = (http: HttpClient) => {\n  const agents = {\n    create: async (input: AgentCreateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'POST', path: '/v1/agents', body: input }),\n\n    list: async (): Promise<Agent[]> => {\n      const res = await http.request<{ data: Agent[] }>({ method: 'GET', path: '/v1/agents' })\n      return res.data\n    },\n\n    // Async iterator for \"give me every agent\" — v1 server returns the full\n    // list in one page, so this is just a thin convenience. When the server\n    // picks up cursor pagination, this is the method that papers over that\n    // migration without consumer changes.\n    listAll: async function* (): AsyncIterable<Agent> {\n      const page = await agents.list()\n      for (const a of page) yield a\n    },\n\n    get: async (agentId: string): Promise<Agent> =>\n      http.request<Agent>({ method: 'GET', path: `/v1/agents/${agentId}` }),\n\n    update: async (agentId: string, patch: AgentUpdateInput): Promise<Agent> =>\n      http.request<Agent>({ method: 'PATCH', path: `/v1/agents/${agentId}`, body: patch }),\n\n    delete: async (agentId: string): Promise<void> =>\n      http.request<void>({ method: 'DELETE', path: `/v1/agents/${agentId}` }),\n\n    /**\n     * Upload an avatar image for the agent. Server re-encodes to a 512×512\n     * WebP and stores it in the public-read avatars bucket; the returned\n     * `Agent` has `avatarUrl` set to the canonical public URL with a\n     * `?v=` cache-buster.\n     *\n     * `file` accepts a Node Buffer / Uint8Array / Blob / typed-array.\n     * `filename` and `contentType` are optional but help the server log\n     * meaningful errors when something rejects.\n     */\n    uploadAvatar: async (\n      agentId: string,\n      file: Buffer | Uint8Array | Blob | ArrayBuffer,\n      opts: { filename?: string; contentType?: string } = {},\n    ): Promise<Agent> => {\n      const fd = new FormData()\n      const blob =\n        file instanceof Blob\n          ? file\n          : // eslint-disable-next-line @typescript-eslint/no-explicit-any\n            new Blob([file as any], { type: opts.contentType ?? 'application/octet-stream' })\n      fd.append('file', blob, opts.filename ?? 'avatar')\n      return http.request<Agent>({\n        method: 'POST',\n        path: `/v1/agents/${agentId}/avatar`,\n        formData: fd,\n      })\n    },\n\n    /**\n     * Remove the agent's avatar — both the GCS object and the `avatarUrl`\n     * field. Idempotent: calling on an agent without an avatar still\n     * returns the agent.\n     */\n    removeAvatar: async (agentId: string): Promise<Agent> =>\n      http.request<Agent>({ method: 'DELETE', path: `/v1/agents/${agentId}/avatar` }),\n\n    // Nested resource. Per-agent webhook CRUD lives at\n    // /v1/agents/:agentId/webhooks/* — we expose it as a factory keyed on\n    // agentId so consumers can bind once and reuse:\n    //\n    //   const hooks = client.agents.webhooks(myAgentId)\n    //   await hooks.create({ url, events })\n    //   await hooks.list()\n    webhooks: (agentId: string): AgentWebhooksResource =>\n      createAgentWebhooksResource(http, agentId),\n  }\n  return agents\n}\n\nexport type AgentsResource = ReturnType<typeof createAgentsResource>\n","import type { HttpClient } from '../http'\nimport type {\n  CallListFilters,\n  CallRecord,\n  CallRecordingUrlResponse,\n  CallSummary,\n  TranscriptTurn,\n} from '../types'\n\nexport const createCallsResource = (http: HttpClient) => {\n  const calls = {\n    list: async (filters: CallListFilters = {}): Promise<CallSummary[]> => {\n      const res = await http.request<{ data: CallSummary[] }>({\n        method: 'GET',\n        path: '/v1/calls',\n        query: filters as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination helper. v1 server caps at limit (max 200) in a single\n    // page — consumers who ask for \"every call since X\" get that page, the\n    // iterator ends. This is the shape we'd extend with cursor support\n    // without breaking callers.\n    listAll: async function* (filters: CallListFilters = {}): AsyncIterable<CallSummary> {\n      const page = await calls.list(filters)\n      for (const c of page) yield c\n    },\n\n    get: async (callId: string): Promise<CallRecord> =>\n      http.request<CallRecord>({ method: 'GET', path: `/v1/calls/${callId}` }),\n\n    transcript: async (callId: string): Promise<{ callId: string; transcript: TranscriptTurn[] }> =>\n      http.request<{ callId: string; transcript: TranscriptTurn[] }>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/transcript`,\n      }),\n\n    // Returns a V4 signed URL (1-hour TTL). `ready: false` + `artifact:\n    // 'caller-raw'` means the async mix job hasn't finished — the URL still\n    // points at a playable file (raw caller PCM).\n    recording: async (callId: string): Promise<CallRecordingUrlResponse> =>\n      http.request<CallRecordingUrlResponse>({\n        method: 'GET',\n        path: `/v1/calls/${callId}/recording`,\n      }),\n\n    // Outbound dialling (POST /v1/calls) + in-call control are Phase 1.4.4 /\n    // 1.4.5 respectively — blocked on telephony. Surface clear \"not built\n    // yet\" errors here if consumers guess those method names, so they don't\n    // silently hit a non-existent endpoint and wonder why it 404s.\n  }\n  return calls\n}\n\nexport type CallsResource = ReturnType<typeof createCallsResource>\n","import fs from 'node:fs'\nimport path from 'node:path'\nimport type { HttpClient } from '../http'\nimport type { KnowledgeBase, KnowledgeBaseFile } from '../types'\n\nexport const createKnowledgeBasesResource = (http: HttpClient) => ({\n  create: async (name: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({\n      method: 'POST',\n      path: '/v1/knowledge-bases',\n      body: { name },\n    }),\n\n  list: async (): Promise<KnowledgeBase[]> => {\n    const res = await http.request<{ data: KnowledgeBase[] }>({\n      method: 'GET',\n      path: '/v1/knowledge-bases',\n    })\n    return res.data\n  },\n\n  get: async (kbId: string): Promise<KnowledgeBase> =>\n    http.request<KnowledgeBase>({ method: 'GET', path: `/v1/knowledge-bases/${kbId}` }),\n\n  delete: async (kbId: string): Promise<void> =>\n    http.request<void>({ method: 'DELETE', path: `/v1/knowledge-bases/${kbId}` }),\n\n  // File upload — accepts either a local file path OR raw bytes + filename.\n  // The server ingests synchronously today (Phase 3.1.4 Cloud Tasks is a\n  // followup), so the returned file has status='ready' in most cases.\n  uploadFile: async (\n    kbId: string,\n    source:\n      | { path: string; filename?: string; mimeType?: string }\n      | { data: Buffer | Uint8Array; filename: string; mimeType?: string },\n  ): Promise<KnowledgeBaseFile> => {\n    const form = new FormData()\n    let blob: Blob\n    let filename: string\n    let mime: string\n\n    if ('path' in source) {\n      const buf = await fs.promises.readFile(source.path)\n      filename = source.filename ?? path.basename(source.path)\n      mime = source.mimeType ?? 'application/octet-stream'\n      blob = new Blob([new Uint8Array(buf)], { type: mime })\n    } else {\n      filename = source.filename\n      mime = source.mimeType ?? 'application/octet-stream'\n      const bytes = source.data instanceof Buffer ? new Uint8Array(source.data) : source.data\n      blob = new Blob([bytes], { type: mime })\n    }\n    form.append('file', blob, filename)\n\n    // File uploads can take a while (OCR, chunking, embedding) — give them\n    // room before timing out. 5 min cap matches the server's own\n    // processing budget.\n    return http.request<KnowledgeBaseFile>({\n      method: 'POST',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n      formData: form,\n      timeoutMs: 5 * 60 * 1000,\n    })\n  },\n\n  listFiles: async (kbId: string): Promise<KnowledgeBaseFile[]> => {\n    const res = await http.request<{ data: KnowledgeBaseFile[] }>({\n      method: 'GET',\n      path: `/v1/knowledge-bases/${kbId}/files`,\n    })\n    return res.data\n  },\n\n  deleteFile: async (kbId: string, fileId: string): Promise<void> =>\n    http.request<void>({\n      method: 'DELETE',\n      path: `/v1/knowledge-bases/${kbId}/files/${fileId}`,\n    }),\n})\n\nexport type KnowledgeBasesResource = ReturnType<typeof createKnowledgeBasesResource>\n","import type { HttpClient } from '../http'\nimport type { LedgerEntry } from '../types'\n\nexport const createCreditsResource = (http: HttpClient) => {\n  const credits = {\n    getBalance: async (): Promise<{ orgId: string; balanceCents: number }> =>\n      http.request<{ orgId: string; balanceCents: number }>({\n        method: 'GET',\n        path: '/v1/credits/balance',\n      }),\n\n    // Returns ledger entries newest-first. `limit` is capped at 500 server-side.\n    getLedger: async (opts: { limit?: number } = {}): Promise<LedgerEntry[]> => {\n      const res = await http.request<{ data: LedgerEntry[] }>({\n        method: 'GET',\n        path: '/v1/credits/ledger',\n        query: opts as Record<string, string | number | undefined>,\n      })\n      return res.data\n    },\n\n    // Auto-pagination scaffold — v1 server returns a single page up to\n    // limit=500. When cursor pagination lands this is where it gets wired.\n    getLedgerAll: async function* (opts: { limit?: number } = {}): AsyncIterable<LedgerEntry> {\n      const page = await credits.getLedger(opts)\n      for (const e of page) yield e\n    },\n  }\n  return credits\n}\n\nexport type CreditsResource = ReturnType<typeof createCreditsResource>\n","import type { HttpClient } from '../http'\nimport type { CallTokenMintInput, CallTokenMintResult, CallTokenSummary } from '../types'\n\n// Short-lived, agent-scoped `ct_` tokens. Mint one per user session on your\n// backend, hand the raw value to the browser; let this SDK handle lifecycle\n// (revoke on sign-out, list active tokens for an admin panel).\n\nexport const createCallTokensResource = (http: HttpClient) => ({\n  // Returns the RAW token value once. Don't log it; pass it straight to the\n  // browser + discard server-side. `tokenId` is the stable public handle\n  // used for revocation later.\n  mint: async (input: CallTokenMintInput): Promise<CallTokenMintResult> =>\n    http.request<CallTokenMintResult>({\n      method: 'POST',\n      path: '/v1/call-tokens',\n      body: input,\n    }),\n\n  // Live tokens only by default. Pass includeRevoked/includeExpired when\n  // debugging \"why did my token stop working\".\n  list: async (\n    opts: { includeRevoked?: boolean; includeExpired?: boolean; limit?: number } = {},\n  ): Promise<CallTokenSummary[]> => {\n    const query: Record<string, string | number | undefined> = {}\n    if (opts.includeRevoked) query.includeRevoked = '1'\n    if (opts.includeExpired) query.includeExpired = '1'\n    if (opts.limit !== undefined) query.limit = opts.limit\n    const res = await http.request<{ data: CallTokenSummary[] }>({\n      method: 'GET',\n      path: '/v1/call-tokens',\n      query,\n    })\n    return res.data\n  },\n\n  // Idempotent — re-revoking a revoked token returns `alreadyRevoked: true`.\n  revoke: async (\n    tokenId: string,\n  ): Promise<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }> =>\n    http.request<{ tokenId: string; revoked: boolean; alreadyRevoked?: boolean }>({\n      method: 'DELETE',\n      path: `/v1/call-tokens/${tokenId}`,\n    }),\n})\n\nexport type CallTokensResource = ReturnType<typeof createCallTokensResource>\n","import type { HttpClient } from '../http'\nimport type { WebhookDelivery } from '../types'\n\n// Org-wide webhook delivery log. Per-agent CRUD lives on\n// `client.agents.webhooks(agentId)` — this namespace is just the\n// read-only deliveries surface that spans all agents.\n\nexport const createWebhooksResource = (http: HttpClient) => ({\n  deliveries: async (\n    filters: {\n      agentId?: string\n      webhookId?: string\n      callId?: string\n      limit?: number\n    } = {},\n  ): Promise<WebhookDelivery[]> => {\n    const res = await http.request<{ data: WebhookDelivery[] }>({\n      method: 'GET',\n      path: '/v1/webhooks/deliveries',\n      query: filters as Record<string, string | number | undefined>,\n    })\n    return res.data\n  },\n})\n\nexport type WebhooksResource = ReturnType<typeof createWebhooksResource>\n","import type { HttpClient } from '../http'\nimport type { CatalogAgent, CatalogListInput } from '../types'\n\n// Org-scoped consumer endpoints. Today this is just the agent catalog —\n// the trimmed shape your mobile app picks an agent from. Lives at\n// `/v1/orgs/:orgId/agents` rather than reusing the admin `/v1/agents/*`\n// tree on purpose: the catalog response intentionally excludes the\n// operator-only fields (system prompt, tools, KB IDs) so a leaked\n// consumer-backend `sk_` can't lift the operator config out of it.\n//\n// Pattern from your backend:\n//\n//   const client = new PlatformClient({ apiKey: process.env.SK })\n//   const visible = await client.orgs.listAgents({\n//     orgId: process.env.ORG_ID!,\n//     userTags: ['tier1'],   // omit to get the unfiltered admin view\n//   })\n//   res.json(visible)\n\nexport const createOrgsResource = (http: HttpClient) => ({\n  /**\n   * Fetch the agent catalog for an org. Returns the consumer-trimmed shape;\n   * no system prompt, tools, or KB info. Use `client.agents.get(agentId)`\n   * with the same `sk_` if you need the full admin shape.\n   *\n   * `userTags`: end-user entitlement tags. When supplied, hides agents\n   * whose `allowedUserTags` is non-empty and doesn't intersect with the\n   * supplied list. Omit to get the unfiltered admin view.\n   *\n   * Persona / category filtering is intentionally not a server param —\n   * filter the returned list client-side over `name`s if you need it.\n   *\n   * Throws `403 forbidden` if `orgId` doesn't match the key's org.\n   */\n  listAgents: async (input: CatalogListInput): Promise<CatalogAgent[]> => {\n    const query: Record<string, string | undefined> = {}\n    if (input.userTags && input.userTags.length > 0) query.userTags = input.userTags.join(',')\n    const res = await http.request<{ data: CatalogAgent[] }>({\n      method: 'GET',\n      path: `/v1/orgs/${input.orgId}/agents`,\n      query,\n    })\n    return res.data\n  },\n})\n\nexport type OrgsResource = ReturnType<typeof createOrgsResource>\n","import type { HttpClient } from '../http'\nimport type {\n  CreateRoomInput,\n  CreateRoomResponse,\n  ListRoomsResponse,\n  ListUtterancesResponse,\n  RoomDoc,\n  RoomEventAck,\n  RoomListFilters,\n  RoomTranscriptOptions,\n} from '../types'\n\n// REST wrappers for /v1/rooms — the multi-party video room surface (see\n// docs/superpowers/specs/2026-05-18-multiparty-rooms-design.md). Lets\n// server-side code mint rooms, fetch state, list transcript pages, and end\n// rooms programmatically.\n//\n// Auth model: same Bearer `sk_` flow as every other resource — the server\n// derives `orgId` from the API key, so the SDK never sets a tenant header.\n//\n// Host actions beyond `end` (promote/demote/kick) and observer-token mint\n// live in the server but aren't surfaced here yet — they're operator-side\n// flows that the dashboard hits directly. Re-add here if a programmatic\n// use-case shows up (CI tests, integration harnesses).\n\nexport const createRoomsResource = (http: HttpClient) => ({\n  // Provision a new room. Server returns 201 with ONE shared room-level\n  // `joinToken` + `joinUrl`. Share the single link with everyone you want in\n  // the room — each visitor supplies their own display name at join time and\n  // becomes a fresh, distinct participant. The server persists only the\n  // token's sha256 hash; the raw token is returned here once and never stored.\n  create: async (input: CreateRoomInput): Promise<CreateRoomResponse> =>\n    http.request<CreateRoomResponse>({\n      method: 'POST',\n      path: '/v1/rooms',\n      body: input,\n    }),\n\n  // Listing — opaque cursor pagination (`nextCursor` returned by the server\n  // is whatever startAfter() needs, don't parse client-side).\n  list: async (filters: RoomListFilters = {}): Promise<ListRoomsResponse> => {\n    const query: Record<string, string | number | undefined> = {}\n    if (filters.status) query.status = filters.status\n    if (filters.limit !== undefined) query.limit = filters.limit\n    if (filters.cursor) query.cursor = filters.cursor\n    return http.request<ListRoomsResponse>({\n      method: 'GET',\n      path: '/v1/rooms',\n      query,\n    })\n  },\n\n  // Fetch a single room. 404s are surfaced as PlatformError('not_found').\n  get: async (roomId: string): Promise<RoomDoc> =>\n    http.request<RoomDoc>({\n      method: 'GET',\n      path: `/v1/rooms/${roomId}`,\n    }),\n\n  // Transcript pages — utterances are ordered by `startedAt asc`. Cursor is\n  // an ISO timestamp (server enforces, don't construct yourself).\n  transcript: async (\n    roomId: string,\n    opts: RoomTranscriptOptions = {},\n  ): Promise<ListUtterancesResponse> => {\n    const query: Record<string, string | number | undefined> = {}\n    if (opts.cursor) query.cursor = opts.cursor\n    if (opts.limit !== undefined) query.limit = opts.limit\n    return http.request<ListUtterancesResponse>({\n      method: 'GET',\n      path: `/v1/rooms/${roomId}/transcript`,\n      query,\n    })\n  },\n\n  // End a room — async on the server: returns 202 + eventId once the\n  // controlEvents entry is written. The room-worker observes the entry,\n  // broadcasts the system message, and tears down LiveKit shortly after.\n  end: async (roomId: string): Promise<RoomEventAck> =>\n    http.request<RoomEventAck>({\n      method: 'POST',\n      path: `/v1/rooms/${roomId}/end`,\n    }),\n})\n\nexport type RoomsResource = ReturnType<typeof createRoomsResource>\n","import { createHttpClient, type HttpClientOptions } from './http'\nimport { createMeResource, type MeResource } from './resources/me'\nimport { createAgentsResource, type AgentsResource } from './resources/agents'\nimport { createCallsResource, type CallsResource } from './resources/calls'\nimport {\n  createKnowledgeBasesResource,\n  type KnowledgeBasesResource,\n} from './resources/knowledgeBases'\nimport { createCreditsResource, type CreditsResource } from './resources/credits'\nimport { createCallTokensResource, type CallTokensResource } from './resources/callTokens'\nimport { createWebhooksResource, type WebhooksResource } from './resources/webhooks'\nimport { createOrgsResource, type OrgsResource } from './resources/orgs'\nimport { createRoomsResource, type RoomsResource } from './resources/rooms'\n\nexport interface PlatformClientOptions {\n  // Full-org API key minted from the dashboard or bootstrap CLI. Start with\n  // `sk_`. Never ship to a browser — use `client.callTokens.mint(...)` to\n  // generate a narrow `ct_` token for client-side use instead.\n  apiKey: string\n  // Defaults to the hosted platform. Point at `http://localhost:8080` for\n  // local dev or at a self-hosted deployment.\n  baseUrl?: string\n  // Passthrough tuning for the HTTP layer.\n  timeoutMs?: number\n  maxRetries?: number\n  fetch?: HttpClientOptions['fetch']\n  onRequest?: HttpClientOptions['onRequest']\n}\n\n// Single entry point. All resources are lazy-constructed in the constructor\n// so their refs don't incur any per-call allocation. Shape mirrors Stripe /\n// Twilio / Vapi's `resource.method()` convention for familiarity.\nexport class PlatformClient {\n  readonly me: MeResource\n  readonly agents: AgentsResource\n  readonly calls: CallsResource\n  readonly knowledgeBases: KnowledgeBasesResource\n  readonly credits: CreditsResource\n  readonly callTokens: CallTokensResource\n  readonly webhooks: WebhooksResource\n  readonly orgs: OrgsResource\n  readonly rooms: RoomsResource\n\n  constructor(options: PlatformClientOptions) {\n    if (!options.apiKey) {\n      throw new Error('PlatformClient: `apiKey` is required')\n    }\n    const http = createHttpClient({\n      apiKey: options.apiKey,\n      baseUrl: options.baseUrl ?? 'https://api.example.com',\n      timeoutMs: options.timeoutMs,\n      maxRetries: options.maxRetries,\n      fetch: options.fetch,\n      onRequest: options.onRequest,\n    })\n\n    this.me = createMeResource(http)\n    this.agents = createAgentsResource(http)\n    this.calls = createCallsResource(http)\n    this.knowledgeBases = createKnowledgeBasesResource(http)\n    this.credits = createCreditsResource(http)\n    this.callTokens = createCallTokensResource(http)\n    this.webhooks = createWebhooksResource(http)\n    this.orgs = createOrgsResource(http)\n    this.rooms = createRoomsResource(http)\n  }\n}\n","import crypto from 'node:crypto'\n\n// Helper for consumers receiving webhooks: verify the `X-Platform-Signature-256`\n// header against the raw body + secret. Plain function (not tied to\n// PlatformClient) so Express/Koa/Next.js middleware can use it without\n// instantiating a client.\n//\n//   import { verifyWebhookSignature } from '@craftedxp/sdk-node'\n//   app.post('/webhooks/voice-agent', express.raw({ type: 'application/json' }), (req, res) => {\n//     const sig = req.header('X-Platform-Signature-256') ?? ''\n//     if (!verifyWebhookSignature(req.body, sig, process.env.VOICE_AGENT_WEBHOOK_SECRET!)) {\n//       return res.status(401).send('invalid signature')\n//     }\n//     const event = JSON.parse(req.body.toString('utf8'))\n//     // ...handle event\n//   })\n//\n// The signature is `sha256=<hex HMAC-SHA256 of rawBody with secret>`.\n// Timing-safe compare to avoid microtiming side channels.\n\nexport const verifyWebhookSignature = (\n  rawBody: Buffer | string,\n  signatureHeader: string,\n  secret: string,\n): boolean => {\n  if (!signatureHeader || !secret) return false\n  const [algo, provided] = signatureHeader.split('=')\n  if (algo !== 'sha256' || !provided) return false\n\n  const expected = crypto\n    .createHmac('sha256', secret)\n    .update(typeof rawBody === 'string' ? rawBody : rawBody)\n    .digest('hex')\n\n  // Buffers must match in length for timingSafeEqual.\n  const a = Buffer.from(expected, 'hex')\n  const b = Buffer.from(provided, 'hex')\n  if (a.length !== b.length) return false\n  return crypto.timingSafeEqual(a, b)\n}\n"],"mappings":";AAmBO,IAAM,gBAAN,MAAM,uBAAsB,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EAET,YAAY,QAOT;AACD,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ,OAAO;AACpB,SAAK,UAAU,OAAO;AACtB,SAAK,OAAO,OAAO;AAGnB,QACE,OAAQ,MAAyD,sBACjE,YACA;AACA;AAAC,MACC,MACA,kBAAkB,MAAM,cAAa;AAAA,IACzC;AAAA,EACF;AAAA,EAEA,SAAkC;AAChC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AACF;;;ACtBA,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AAE5B,IAAM,WAAW,CAAC,SAAiBA,OAAc,UAAyC;AACxF,QAAM,IAAI,IAAI,IAAIA,OAAM,OAAO;AAC/B,MAAI,OAAO;AACT,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,MAAM,OAAW;AACrB,QAAE,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO,EAAE,SAAS;AACpB;AAEA,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAExE,IAAM,cAAc,CAAC,WAA4B,WAAW,OAAQ,UAAU,OAAO,SAAS;AAI9F,IAAM,oBAAoB,OAAO,QAA0C;AACzE,QAAM,WAAW,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAChD,MAAI,SAAkB;AACtB,MAAI;AACF,aAAS,WAAW,KAAK,MAAM,QAAQ,IAAI;AAAA,EAC7C,QAAQ;AAAA,EAGR;AACA,QAAM,SACJ,QACC;AACH,SAAO,IAAI,cAAc;AAAA,IACvB,MAAO,QAAQ,QAAyB;AAAA,IACxC,SAAS,QAAQ,WAAW,IAAI,cAAc,QAAQ,IAAI,MAAM;AAAA,IAChE,QAAQ,IAAI;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,MAAM,UAAU;AAAA,EAClB,CAAC;AACH;AAEO,IAAM,mBAAmB,CAAC,SAA4B;AAC3D,QAAM,YAAY,KAAK,SAAS,WAAW;AAC3C,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,aAAa,KAAK,cAAc;AAEtC,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAEA,QAAM,UAAU,OAAU,QAAiC;AACzD,UAAM,MAAM,SAAS,KAAK,SAAS,IAAI,MAAM,IAAI,KAAK;AACtD,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,QAAQ;AAAA,MACR,GAAI,IAAI,WAAW,CAAC;AAAA,IACtB;AAMA,QAAI;AACJ,QAAI,IAAI,UAAU;AAChB,aAAO,IAAI;AAAA,IACb,WAAW,IAAI,SAAS,QAAW;AACjC,cAAQ,cAAc,IAAI;AAC1B,aAAO,KAAK,UAAU,IAAI,IAAI;AAAA,IAChC;AAEA,UAAM,aAAa,IAAI,aAAa;AACpC,QAAI;AAEJ,aAAS,UAAU,GAAG,WAAW,YAAY,WAAW;AACtD,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,YAAM,UAAU,KAAK,IAAI;AACzB,UAAI;AACF,cAAM,MAAM,MAAM,UAAU,KAAK;AAAA,UAC/B,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA;AAAA,UACA,QAAQ,WAAW;AAAA,QACrB,CAAC;AACD,cAAM,aAAa,KAAK,IAAI,IAAI;AAChC,aAAK,YAAY;AAAA,UACf,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,QAAQ,IAAI;AAAA,UACZ;AAAA,UACA,SAAS,UAAU;AAAA,QACrB,CAAC;AAED,YAAI,IAAI,IAAI;AAEV,cAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,gBAAM,KAAK,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC9C,cAAI,GAAG,SAAS,kBAAkB,GAAG;AACnC,mBAAQ,MAAM,IAAI,KAAK;AAAA,UACzB;AAEA,iBAAQ,MAAM,IAAI,KAAK;AAAA,QACzB;AAGA,YAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,gBAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,gBAAM,UAAU,aAAa,OAAO,UAAU,IAAI,MAAO,MAAM,KAAK,IAAI,GAAG,OAAO;AAClF,gBAAM,MAAM,OAAO;AACnB;AAAA,QACF;AAEA,cAAM,MAAM,kBAAkB,GAAG;AAAA,MACnC,SAAS,KAAK;AACZ,YAAI,eAAe,cAAe,OAAM;AAExC,YAAI,UAAU,YAAY;AACxB,oBAAU;AACV,gBAAM,MAAM,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;AACtC;AAAA,QACF;AACA,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU;AACjD,cAAM,IAAI,cAAc;AAAA,UACtB,MAAM;AAAA,UACN,SAAS,kBAAkB,GAAG;AAAA,UAC9B,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAGA,UAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,2BAA2B;AAAA,EAClF;AAEA,SAAO,EAAE,QAAQ;AACnB;;;ACnLO,IAAM,mBAAmB,CAAC,UAAsB;AAAA;AAAA;AAAA,EAGrD,KAAK,YAAiC,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,SAAS,CAAC;AAClG;;;ACIO,IAAM,8BAA8B,CAAC,MAAkB,aAAqB;AAAA;AAAA;AAAA;AAAA,EAIjF,QAAQ,OAAO,UACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO;AAAA,IAC3B,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM,cAAc,OAAO;AAAA,IAC7B,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,cACV,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA,EAEH,QAAQ,OAAO,WAAmB,UAChC,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,IACjD,MAAM;AAAA,EACR,CAAC;AAAA,EAEH,QAAQ,OAAO,cACb,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,MAAM,OAAO,cACX,KAAK,QAAyB;AAAA,IAC5B,QAAQ;AAAA,IACR,MAAM,cAAc,OAAO,aAAa,SAAS;AAAA,EACnD,CAAC;AACL;;;AChDO,IAAM,uBAAuB,CAAC,SAAqB;AACxD,QAAM,SAAS;AAAA,IACb,QAAQ,OAAO,UACb,KAAK,QAAe,EAAE,QAAQ,QAAQ,MAAM,cAAc,MAAM,MAAM,CAAC;AAAA,IAEzE,MAAM,YAA8B;AAClC,YAAM,MAAM,MAAM,KAAK,QAA2B,EAAE,QAAQ,OAAO,MAAM,aAAa,CAAC;AACvF,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,mBAAyC;AAChD,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,YACV,KAAK,QAAe,EAAE,QAAQ,OAAO,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA,IAEtE,QAAQ,OAAO,SAAiB,UAC9B,KAAK,QAAe,EAAE,QAAQ,SAAS,MAAM,cAAc,OAAO,IAAI,MAAM,MAAM,CAAC;AAAA,IAErF,QAAQ,OAAO,YACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,cAAc,OAAO,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYxE,cAAc,OACZ,SACA,MACA,OAAoD,CAAC,MAClC;AACnB,YAAM,KAAK,IAAI,SAAS;AACxB,YAAM,OACJ,gBAAgB,OACZ;AAAA;AAAA,QAEA,IAAI,KAAK,CAAC,IAAW,GAAG,EAAE,MAAM,KAAK,eAAe,2BAA2B,CAAC;AAAA;AACtF,SAAG,OAAO,QAAQ,MAAM,KAAK,YAAY,QAAQ;AACjD,aAAO,KAAK,QAAe;AAAA,QACzB,QAAQ;AAAA,QACR,MAAM,cAAc,OAAO;AAAA,QAC3B,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,cAAc,OAAO,YACnB,KAAK,QAAe,EAAE,QAAQ,UAAU,MAAM,cAAc,OAAO,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAShF,UAAU,CAAC,YACT,4BAA4B,MAAM,OAAO;AAAA,EAC7C;AACA,SAAO;AACT;;;AC5EO,IAAM,sBAAsB,CAAC,SAAqB;AACvD,QAAM,QAAQ;AAAA,IACZ,MAAM,OAAO,UAA2B,CAAC,MAA8B;AACrE,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS,iBAAiB,UAA2B,CAAC,GAA+B;AACnF,YAAM,OAAO,MAAM,MAAM,KAAK,OAAO;AACrC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,IAEA,KAAK,OAAO,WACV,KAAK,QAAoB,EAAE,QAAQ,OAAO,MAAM,aAAa,MAAM,GAAG,CAAC;AAAA,IAEzE,YAAY,OAAO,WACjB,KAAK,QAA0D;AAAA,MAC7D,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,IAKH,WAAW,OAAO,WAChB,KAAK,QAAkC;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,IAC3B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAML;AACA,SAAO;AACT;;;ACrDA,OAAO,QAAQ;AACf,OAAO,UAAU;AAIV,IAAM,+BAA+B,CAAC,UAAsB;AAAA,EACjE,QAAQ,OAAO,SACb,KAAK,QAAuB;AAAA,IAC1B,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM,EAAE,KAAK;AAAA,EACf,CAAC;AAAA,EAEH,MAAM,YAAsC;AAC1C,UAAM,MAAM,MAAM,KAAK,QAAmC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,KAAK,OAAO,SACV,KAAK,QAAuB,EAAE,QAAQ,OAAO,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA,EAEpF,QAAQ,OAAO,SACb,KAAK,QAAc,EAAE,QAAQ,UAAU,MAAM,uBAAuB,IAAI,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,EAK9E,YAAY,OACV,MACA,WAG+B;AAC/B,UAAM,OAAO,IAAI,SAAS;AAC1B,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,UAAU,QAAQ;AACpB,YAAM,MAAM,MAAM,GAAG,SAAS,SAAS,OAAO,IAAI;AAClD,iBAAW,OAAO,YAAY,KAAK,SAAS,OAAO,IAAI;AACvD,aAAO,OAAO,YAAY;AAC1B,aAAO,IAAI,KAAK,CAAC,IAAI,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACvD,OAAO;AACL,iBAAW,OAAO;AAClB,aAAO,OAAO,YAAY;AAC1B,YAAM,QAAQ,OAAO,gBAAgB,SAAS,IAAI,WAAW,OAAO,IAAI,IAAI,OAAO;AACnF,aAAO,IAAI,KAAK,CAAC,KAAK,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACzC;AACA,SAAK,OAAO,QAAQ,MAAM,QAAQ;AAKlC,WAAO,KAAK,QAA2B;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,MACjC,UAAU;AAAA,MACV,WAAW,IAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,OAAO,SAA+C;AAC/D,UAAM,MAAM,MAAM,KAAK,QAAuC;AAAA,MAC5D,QAAQ;AAAA,MACR,MAAM,uBAAuB,IAAI;AAAA,IACnC,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA,EAEA,YAAY,OAAO,MAAc,WAC/B,KAAK,QAAc;AAAA,IACjB,QAAQ;AAAA,IACR,MAAM,uBAAuB,IAAI,UAAU,MAAM;AAAA,EACnD,CAAC;AACL;;;AC3EO,IAAM,wBAAwB,CAAC,SAAqB;AACzD,QAAM,UAAU;AAAA,IACd,YAAY,YACV,KAAK,QAAiD;AAAA,MACpD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA;AAAA,IAGH,WAAW,OAAO,OAA2B,CAAC,MAA8B;AAC1E,YAAM,MAAM,MAAM,KAAK,QAAiC;AAAA,QACtD,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA;AAAA;AAAA,IAIA,cAAc,iBAAiB,OAA2B,CAAC,GAA+B;AACxF,YAAM,OAAO,MAAM,QAAQ,UAAU,IAAI;AACzC,iBAAW,KAAK,KAAM,OAAM;AAAA,IAC9B;AAAA,EACF;AACA,SAAO;AACT;;;ACtBO,IAAM,2BAA2B,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA,EAI7D,MAAM,OAAO,UACX,KAAK,QAA6B;AAAA,IAChC,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAAA;AAAA;AAAA,EAIH,MAAM,OACJ,OAA+E,CAAC,MAChD;AAChC,UAAM,QAAqD,CAAC;AAC5D,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,eAAgB,OAAM,iBAAiB;AAChD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,UAAM,MAAM,MAAM,KAAK,QAAsC;AAAA,MAC3D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AAAA;AAAA,EAGA,QAAQ,OACN,YAEA,KAAK,QAAyE;AAAA,IAC5E,QAAQ;AAAA,IACR,MAAM,mBAAmB,OAAO;AAAA,EAClC,CAAC;AACL;;;ACpCO,IAAM,yBAAyB,CAAC,UAAsB;AAAA,EAC3D,YAAY,OACV,UAKI,CAAC,MAC0B;AAC/B,UAAM,MAAM,MAAM,KAAK,QAAqC;AAAA,MAC1D,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACJO,IAAM,qBAAqB,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAevD,YAAY,OAAO,UAAqD;AACtE,UAAM,QAA4C,CAAC;AACnD,QAAI,MAAM,YAAY,MAAM,SAAS,SAAS,EAAG,OAAM,WAAW,MAAM,SAAS,KAAK,GAAG;AACzF,UAAM,MAAM,MAAM,KAAK,QAAkC;AAAA,MACvD,QAAQ;AAAA,MACR,MAAM,YAAY,MAAM,KAAK;AAAA,MAC7B;AAAA,IACF,CAAC;AACD,WAAO,IAAI;AAAA,EACb;AACF;;;ACnBO,IAAM,sBAAsB,CAAC,UAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMxD,QAAQ,OAAO,UACb,KAAK,QAA4B;AAAA,IAC/B,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AAAA;AAAA;AAAA,EAIH,MAAM,OAAO,UAA2B,CAAC,MAAkC;AACzE,UAAM,QAAqD,CAAC;AAC5D,QAAI,QAAQ,OAAQ,OAAM,SAAS,QAAQ;AAC3C,QAAI,QAAQ,UAAU,OAAW,OAAM,QAAQ,QAAQ;AACvD,QAAI,QAAQ,OAAQ,OAAM,SAAS,QAAQ;AAC3C,WAAO,KAAK,QAA2B;AAAA,MACrC,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,KAAK,OAAO,WACV,KAAK,QAAiB;AAAA,IACpB,QAAQ;AAAA,IACR,MAAM,aAAa,MAAM;AAAA,EAC3B,CAAC;AAAA;AAAA;AAAA,EAIH,YAAY,OACV,QACA,OAA8B,CAAC,MACK;AACpC,UAAM,QAAqD,CAAC;AAC5D,QAAI,KAAK,OAAQ,OAAM,SAAS,KAAK;AACrC,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,WAAO,KAAK,QAAgC;AAAA,MAC1C,QAAQ;AAAA,MACR,MAAM,aAAa,MAAM;AAAA,MACzB;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,KAAK,OAAO,WACV,KAAK,QAAsB;AAAA,IACzB,QAAQ;AAAA,IACR,MAAM,aAAa,MAAM;AAAA,EAC3B,CAAC;AACL;;;ACnDO,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAAgC;AAC1C,QAAI,CAAC,QAAQ,QAAQ;AACnB,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,UAAM,OAAO,iBAAiB;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ,WAAW;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,MACpB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,IACrB,CAAC;AAED,SAAK,KAAK,iBAAiB,IAAI;AAC/B,SAAK,SAAS,qBAAqB,IAAI;AACvC,SAAK,QAAQ,oBAAoB,IAAI;AACrC,SAAK,iBAAiB,6BAA6B,IAAI;AACvD,SAAK,UAAU,sBAAsB,IAAI;AACzC,SAAK,aAAa,yBAAyB,IAAI;AAC/C,SAAK,WAAW,uBAAuB,IAAI;AAC3C,SAAK,OAAO,mBAAmB,IAAI;AACnC,SAAK,QAAQ,oBAAoB,IAAI;AAAA,EACvC;AACF;;;AClEA,OAAO,YAAY;AAoBZ,IAAM,yBAAyB,CACpC,SACA,iBACA,WACY;AACZ,MAAI,CAAC,mBAAmB,CAAC,OAAQ,QAAO;AACxC,QAAM,CAAC,MAAM,QAAQ,IAAI,gBAAgB,MAAM,GAAG;AAClD,MAAI,SAAS,YAAY,CAAC,SAAU,QAAO;AAE3C,QAAM,WAAW,OACd,WAAW,UAAU,MAAM,EAC3B,OAAO,OAAO,YAAY,WAAW,UAAU,OAAO,EACtD,OAAO,KAAK;AAGf,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,QAAM,IAAI,OAAO,KAAK,UAAU,KAAK;AACrC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,OAAO,gBAAgB,GAAG,CAAC;AACpC;","names":["path"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@craftedxp/sdk-node",
-  "version": "0.8.0",
+  "version": "0.10.1",
   "description": "Node.js / TypeScript SDK for the voice agent platform. Server-side API client — mint call tokens, manage agents, query calls, upload knowledge-base docs.",
   "author": "Crafted XP",
   "license": "MIT",
@@ -33,6 +33,7 @@
   },
   "devDependencies": {
     "tsup": "^8.3.5",
+    "tsx": "^4.19.0",
     "typescript": "^5.3.3",
     "@types/node": "^20.10.0"
   },
@@ -41,6 +42,7 @@
     "build": "npm run clean && tsup",
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit",
+    "test": "node --test --import tsx 'src/**/__tests__/*.test.ts'",
     "prepare": "npm run build"
   }
 }