@faable/deploy-sdk 2.1.0 → 2.2.0

package/dist/api/generated-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-client.d.ts","sourceRoot":"","sources":["../../src/api/generated-client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI7C,KAAK,MAAM,CAAC,CAAC,SAAS,MAAM,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,SAAS;IAC9D,WAAW,EAAE;QAAE,OAAO,EAAE;YAAE,kBAAkB,EAAE,MAAM,CAAC,CAAA;SAAE,CAAA;KAAE,CAAC;CAC3D,GACG,CAAC,GACD,KAAK,CAAC;AAsBV,KAAK,OAAO,CAAC,CAAC,SAAS,MAAM,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,SAAS;IAC/D,UAAU,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACjC,GACG,WAAW,CAAC,CAAC,CAAC,GACd,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE1B;;;;GAIG;AACH,8BAAsB,wBAAyB,SAAQ,SAAS;IAC9D;;;;OAIG;IACH,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC;;;;;;;IAI9C;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC;;;;;;;;iBAoU8wtC,0CAAsB;;;;gBAAulB,0CAAsB;;;;;;;;;;IAhUr7uC;;;;OAIG;IACH,SAAS,CAAC,EAAE,EAAE,MAAM;;;;;;;;iBA2Ts76C,0CAAsB;;;;gBAAulB,0CAAsB;;;;;;;;;;IAtT7k8C;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;;;;;;;;iBAiT0/xC,0CAAsB;;;;gBAAulB,0CAAsB;;;;;;;;;;IA5S3qzC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,EAAE,MAAM;;;;IAK/B;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM;;;;;;;;IAK7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,qBAAqB,CAAC;;;;;;;;iBAmR+/a,0CAAsB;;;;gBAA+d,0CAAsB;;;;;;;;;;IA9Q3kc;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;;;;;;;;;qBAyQmgb,0CAAsB;;;;oBAA+d,0CAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAvX5jc,CAAA;oBAA0B,CAAC;;;;;;;;;qBAuXshb,0CAAsB;;;;oBAA+d,0CAAsB;;;;;;;;;;;IArQ3kc;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC;IAKpD;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,EAAE,MAAM;;;;IAKjC;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM;;;;;;;;iBA4O4ib,0CAAsB;;;;gBAA+d,0CAAsB;;;;;;;;;;IAvO3kc;;;;OAIG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC;;;;;yBAkOijkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA7N5mkD;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM;;;;;;;;iBAwNkib,0CAAsB;;;;gBAA+d,0CAAsB;;;;;;;;;;IAnN3kc;;;;OAIG;IACH,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC;;;;;;;;iBA8Mm42C,0CAAsB;;;;gBAAulB,0CAAsB;;;;;;;;;;IAzMtj4C;;;;OAIG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,mBAAmB,CAAC;;;;;;;;;gBAoMqpyD,0CAAsB;;;;;;;IAhM7tyD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,EAAE,MAAM;;;;;;;;;gBA2L673D,0CAAsB;;;;;;;IAtL9+3D;;;;OAIG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM;;;;;;;;;gBAiLsj1D,0CAAsB;;;;;;;IA5Kpm1D;;;;OAIG;IACH,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;;;;;;;;;;oBAuKy5gB,0CAAsB;;;;;;;;;;;;;;;;;;;;;;;;kBAvX3+gB,CAAA;oBAA0B,CAAC;;;;;;;;;;oBAuX07gB,0CAAsB;;;;;;;;IAnK1/gB;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC;;;;;;;;;gBA8Jql+D,0CAAsB;;;;;;;IA1Jrp+D;;;;OAIG;IACH,YAAY,CAAC,EAAE,EAAE,MAAM;;;;;;;;;gBAqJukqE,0CAAsB;;;;;;;IAhJpnqE;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM;;;;;;;;;gBA2IwnnB,0CAAsB;;;;;;;IAtIrqnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,EAAE,MAAM;;;;;;;;;gBAiIi/hE,0CAAsB;;;;;;;IA5H3hiE;;;;OAIG;IACH,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;;;;;;;;;;oBAuH4knB,0CAAsB;;;;;;;;;;;;;;;;;;;;;;;;kBAvXtpnB,CAAA;oBAA0B,CAAC;;;;;;;;;;oBAuXqmnB,0CAAsB;;;;;;;;IAnHrqnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC;;;;;;;;;gBA8G+pmE,0CAAsB;;;;;;;IAzG3umE;;;;OAIG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC;;;;;;;;;;;IAI5C;;;;OAIG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;IAKxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;IAKrB;;;;OAIG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC;;;;;;;;;;;IAKxD;;;;OAIG;IACH,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;kBA1TtD,CAAA;oBAA0B,CAAC;;;;;;;;;;;;;IA8T1C;;;;OAIG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC;;;;;;;;;;;IAKxD;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,sBAAsB,CAAC;;;;;;;;;;;;;;;IAIvD;;;;OAIG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM;IAK/B;;;;OAIG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC;;iBAuBiptB,0CAAsB;;IAlB9utB;;;;OAIG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC;;;;;;;;;;;;;;;IAI5C;;;;OAIG;IACH,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAGb"}

package/dist/api/generated-client.js

@@ -0,0 +1,315 @@
+// AUTO-GENERATED by scripts/gen-client.mjs — do not edit by hand.
+// Regenerated from the OpenAPI spec on every build (npm run gentypes).
+// Source of truth: the deploy API's operationIds + security.
+import { FaableApi } from "@faable/sdk-base";
+import { requireId } from "../helpers.js";
+/**
+ * Auto-generated deploy-API methods, one per secured operation in the OpenAPI
+ * spec. `DeployApi` extends this and adds the constructor, custom-logic
+ * helpers, and deprecated aliases.
+ */
+export class GeneratedFaableDeployApi extends FaableApi {
+    /**
+     * `GET /app/checkname` — operationId: `app/checkname`
+     *
+     * Check if an app name is availiable
+     */
+    appCheckname(params) {
+        return this.fetcher.request({ method: "GET", url: `/app/checkname`, params });
+    }
+    /**
+     * `POST /app` — operationId: `app/create`
+     *
+     * Create App
+     */
+    appCreate(data) {
+        return this.fetcher.post(`/app`, data);
+    }
+    /**
+     * `DELETE /app/{id}` — operationId: `app/delete`
+     *
+     * Delete App
+     */
+    appDelete(id) {
+        requireId("id", id);
+        return this.fetcher.delete(`/app/${id}`);
+    }
+    /**
+     * `GET /app/{id}` — operationId: `app/get`
+     *
+     * Get App
+     */
+    appGet(id, params) {
+        requireId("id", id);
+        return this.fetcher.request({ method: "GET", url: `/app/${id}`, params });
+    }
+    /**
+     * `GET /app/{id}/deploy-workflow` — operationId: `app/get_deploy_workflow`
+     *
+     * Get deploy workflow status
+     */
+    appGetDeployWorkflow(id) {
+        requireId("id", id);
+        return this.fetcher.get(`/app/${id}/deploy-workflow`);
+    }
+    /**
+     * `GET /app/{app_id}/registry` — operationId: `app/get_registry`
+     *
+     * Get app registry
+     */
+    appGetRegistry(app_id) {
+        requireId("app_id", app_id);
+        return this.fetcher.get(`/app/${app_id}/registry`);
+    }
+    /**
+     * `POST /app/{id}/link-repository` — operationId: `app/link_repository`
+     *
+     * Link a GitHub repository to an app
+     */
+    appLinkRepository(id, data) {
+        requireId("id", id);
+        return this.fetcher.post(`/app/${id}/link-repository`, data);
+    }
+    /**
+     * `GET /app` — operationId: `app/list`
+     *
+     * List Apps
+     */
+    appList(params) {
+        return this.paginator({ url: `/app`, params });
+    }
+    /**
+     * `GET /app/{app_id}/logs` — operationId: `app/logs`
+     *
+     * Get app logs
+     */
+    appLogs(app_id, params) {
+        requireId("app_id", app_id);
+        return this.fetcher.request({ method: "GET", url: `/app/${app_id}/logs`, params });
+    }
+    /**
+     * `POST /app/{id}/deploy-workflow` — operationId: `app/setup_deploy_workflow`
+     *
+     * Set up deploy workflow
+     */
+    appSetupDeployWorkflow(id) {
+        requireId("id", id);
+        return this.fetcher.post(`/app/${id}/deploy-workflow`, {});
+    }
+    /**
+     * `GET /app/slug/{slug}` — operationId: `app/slug`
+     *
+     * Get App by unique slug
+     */
+    appSlug(slug) {
+        requireId("slug", slug);
+        return this.fetcher.get(`/app/slug/${slug}`);
+    }
+    /**
+     * `GET /app/{app_id}/traffic` — operationId: `app/traffic`
+     *
+     * Get App Traffic
+     */
+    appTraffic(app_id, params) {
+        requireId("app_id", app_id);
+        return this.fetcher.request({ method: "GET", url: `/app/${app_id}/traffic`, params });
+    }
+    /**
+     * `POST /app/{id}/unlink-repository` — operationId: `app/unlink_repository`
+     *
+     * Unlink the GitHub repository from an app
+     */
+    appUnlinkRepository(id) {
+        requireId("id", id);
+        return this.fetcher.post(`/app/${id}/unlink-repository`, {});
+    }
+    /**
+     * `POST /app/{id}` — operationId: `app/update`
+     *
+     * Update App
+     */
+    appUpdate(id, data) {
+        requireId("id", id);
+        return this.fetcher.post(`/app/${id}`, data);
+    }
+    /**
+     * `POST /deployment` — operationId: `deployment/create`
+     *
+     * Create Deployment
+     */
+    deploymentCreate(data) {
+        return this.fetcher.post(`/deployment`, data);
+    }
+    /**
+     * `DELETE /deployment/{id}` — operationId: `deployment/delete`
+     *
+     * Delete Deployment
+     */
+    deploymentDelete(id) {
+        requireId("id", id);
+        return this.fetcher.delete(`/deployment/${id}`);
+    }
+    /**
+     * `GET /deployment/{id}` — operationId: `deployment/get`
+     *
+     * Get Deployment
+     */
+    deploymentGet(id) {
+        requireId("id", id);
+        return this.fetcher.get(`/deployment/${id}`);
+    }
+    /**
+     * `GET /deployment` — operationId: `deployment/list`
+     *
+     * List Deployments
+     */
+    deploymentList(params) {
+        return this.paginator({ url: `/deployment`, params });
+    }
+    /**
+     * `POST /domain` — operationId: `domain/create`
+     *
+     * Create Domain
+     */
+    domainCreate(data) {
+        return this.fetcher.post(`/domain`, data);
+    }
+    /**
+     * `DELETE /domain/{id}` — operationId: `domain/delete`
+     *
+     * Delete Domain
+     */
+    domainDelete(id) {
+        requireId("id", id);
+        return this.fetcher.delete(`/domain/${id}`);
+    }
+    /**
+     * `GET /domain/fqdn/{fqdn}` — operationId: `domain/fqdn`
+     *
+     * Get domain by FQDN
+     */
+    domainFqdn(fqdn) {
+        requireId("fqdn", fqdn);
+        return this.fetcher.get(`/domain/fqdn/${fqdn}`);
+    }
+    /**
+     * `GET /domain/{id}` — operationId: `domain/get`
+     *
+     * Get Domain
+     */
+    domainGet(id) {
+        requireId("id", id);
+        return this.fetcher.get(`/domain/${id}`);
+    }
+    /**
+     * `GET /domain` — operationId: `domain/list`
+     *
+     * List Domains
+     */
+    domainList(params) {
+        return this.paginator({ url: `/domain`, params });
+    }
+    /**
+     * `POST /domain/{id}` — operationId: `domain/update`
+     *
+     * Update Domain
+     */
+    domainUpdate(id, data) {
+        requireId("id", id);
+        return this.fetcher.post(`/domain/${id}`, data);
+    }
+    /**
+     * `POST /project` — operationId: `project/create`
+     *
+     * Create Project
+     */
+    projectCreate(data) {
+        return this.fetcher.post(`/project`, data);
+    }
+    /**
+     * `DELETE /project/{id}` — operationId: `project/delete`
+     *
+     * Delete Project
+     */
+    projectDelete(id) {
+        requireId("id", id);
+        return this.fetcher.delete(`/project/${id}`);
+    }
+    /**
+     * `GET /project/{id}` — operationId: `project/get`
+     *
+     * Get Project
+     */
+    projectGet(id) {
+        requireId("id", id);
+        return this.fetcher.get(`/project/${id}`);
+    }
+    /**
+     * `POST /project/{id}/invite` — operationId: `project/invite`
+     *
+     * Invite collaborators to project
+     */
+    projectInvite(id, data) {
+        requireId("id", id);
+        return this.fetcher.post(`/project/${id}/invite`, data);
+    }
+    /**
+     * `GET /project` — operationId: `project/list`
+     *
+     * List Projects
+     */
+    projectList(params) {
+        return this.paginator({ url: `/project`, params });
+    }
+    /**
+     * `POST /project/{id}` — operationId: `project/update`
+     *
+     * Update Project
+     */
+    projectUpdate(id, data) {
+        requireId("id", id);
+        return this.fetcher.post(`/project/${id}`, data);
+    }
+    /**
+     * `POST /secret/createbatch` — operationId: `secrets/create_batch`
+     *
+     * Create secrets in batch
+     */
+    secretsCreateBatch(data) {
+        return this.fetcher.post(`/secret/createbatch`, data);
+    }
+    /**
+     * `DELETE /secret/{secret_id}` — operationId: `secrets/delete`
+     *
+     * Delete a secret
+     */
+    secretsDelete(secret_id) {
+        requireId("secret_id", secret_id);
+        return this.fetcher.delete(`/secret/${secret_id}`);
+    }
+    /**
+     * `GET /secret/{context_id}` — operationId: `secrets/list_app`
+     *
+     * List all secrets assigned to an App or Profile contexts
+     */
+    secretsListApp(context_id, params) {
+        requireId("context_id", context_id);
+        return this.fetcher.request({ method: "GET", url: `/secret/${context_id}`, params });
+    }
+    /**
+     * `POST /secret` — operationId: `secrets/upsert`
+     *
+     * Upsert a secret
+     */
+    secretsUpsert(data) {
+        return this.fetcher.post(`/secret`, data);
+    }
+    /**
+     * `GET /usage/summary` — operationId: `usage/summary`
+     *
+     * Get team usage summary for the current billing period
+     */
+    usageSummary() {
+        return this.fetcher.get(`/usage/summary`);
+    }
+}

package/dist/helpers.d.ts

@@ -0,0 +1,2 @@
+export declare const requireId: (name: string, value: unknown) => string;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,SAAS,SAAU,MAAM,SAAS,OAAO,KAAG,MASxD,CAAC"}

package/dist/helpers.js

@@ -0,0 +1,11 @@
+import { FaableApiError } from "@faable/sdk-base";
+// Guard required path params (ids) before interpolating them into a URL.
+// Without this, a `null`/`undefined` id silently builds e.g. `/app/null` and
+// the server rejects it with a confusing 400 — failing fast here gives the
+// caller a clear error. Used by the auto-generated client methods.
+export const requireId = (name, value) => {
+    if (typeof value !== "string" || value.trim() === "") {
+        throw new FaableApiError(`FaableApiError: ${name} is required and must be a non-empty string (received ${JSON.stringify(value)})`);
+    }
+    return value;
+};

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 export * from "./FaableDeployApi.js";
-export * from "./api/api-types.js";
+export * from "./api/generated-client.js";
+export * from "./api/custom-types.js";
 export * from "./api/types.js";
 export * from "@faable/sdk-base";
-import * as types from "./api/api-types.js";
+import * as types from "./api/custom-types.js";
 export { types };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAM/B,cAAc,kBAAkB,CAAC;AAMjC,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAG1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAM/B,cAAc,kBAAkB,CAAC;AAMjC,OAAO,KAAK,KAAK,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,CAAC"}

package/dist/index.js

@@ -1,5 +1,8 @@
 export * from "./FaableDeployApi.js";
-export * from "./api/api-types.js";
+export * from "./api/generated-client.js";
+// custom-types re-exports the auto-generated api-types plus the hand-maintained
+// extras (friendlier event names, the AppTraffic interface).
+export * from "./api/custom-types.js";
 export * from "./api/types.js";
 // Re-export the @faable/sdk-base public surface (auth strategies like
 // `authClientCredentials` / `authApikey`, `ApiParams`, `FaableApiError`, …) so
@@ -10,5 +13,5 @@ export * from "@faable/sdk-base";
 // as a namespace — `import { types } from "@faable/deploy-sdk"` then
 // `types.App` / `types.Deployment`. Kept alongside the flat re-exports above so
 // both import styles resolve. Dropping it silently broke `import { types }`.
-import * as types from "./api/api-types.js";
+import * as types from "./api/custom-types.js";
 export { types };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@faable/deploy-sdk",
   "description": "Codebase for SDK building",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -27,9 +27,11 @@
     "typescript": "^5.6.2"
   },
   "scripts": {
-    "generate-types": "openapi-typescript https://api.faable.com/docs/json -o src/api/types.ts",
+    "fetch-spec": "node scripts/fetch-spec.mjs",
+    "generate-types": "openapi-typescript ${DEPLOY_OPENAPI:-spec/openapi.json} -o src/api/types.ts",
+    "gentypes": "npm run fetch-spec && npm run generate-types && node scripts/gen-client.mjs",
     "clean": "rimraf dist",
-    "prebuild": "npm run clean && npm run generate-types",
+    "prebuild": "npm run clean && npm run gentypes",
     "build": "tsc",
     "test": "ava",
     "release": "semantic-release"

package/scripts/fetch-spec.mjs

@@ -0,0 +1,24 @@
+// Downloads the live OpenAPI spec to spec/openapi.json so that BOTH
+// openapi-typescript (types.ts) and gen-client.mjs (client + api-types) read the
+// exact same snapshot. Fetching the URL independently from each tool risks a
+// version skew if the API changes between calls.
+
+import { writeFileSync, mkdirSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ROOT = resolve(__dirname, "..");
+
+const URL =
+  process.env.DEPLOY_OPENAPI_URL || "https://api.faable.com/docs/json";
+const OUT = resolve(ROOT, "spec/openapi.json");
+
+const res = await fetch(URL);
+if (!res.ok) {
+  throw new Error(`fetch-spec: ${URL} returned ${res.status}`);
+}
+const spec = await res.json();
+mkdirSync(dirname(OUT), { recursive: true });
+writeFileSync(OUT, JSON.stringify(spec, null, 2));
+console.warn(`fetch-spec: ${URL} → ${OUT.replace(ROOT + "/", "")}`);

package/scripts/gen-client.mjs

@@ -0,0 +1,241 @@
+// Generates `src/api/generated-client.ts` + `src/api/api-types.ts` from the
+// OpenAPI spec. Ported from auth-sdk's generator (kept in sync by hand).
+//
+// Why: the SDK's typed methods (appGet, deploymentList, …) used to be
+// hand-written and always lagged the API. The TYPES are already generated by
+// openapi-typescript; this does the same for the METHODS, so the SDK covers the
+// whole deploy API for free and stays in sync on every build.
+//
+// Scope: every secured operation (all of them carry the same
+// apikey/faable_cli/faable_machine/faable_user scheme), MINUS internal
+// resources in EXCLUDE_RESOURCES and the unsecured github/webhook/oidc
+// endpoints. Reads the spec from a LOCAL file (downloaded by fetch-spec.mjs) so
+// types.ts and this client are generated from the exact same snapshot.
+//
+// Run via `npm run gentypes`. Output is committed and reviewed in diff like
+// `types.ts`. Do not edit the output by hand.
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ROOT = resolve(__dirname, "..");
+
+const SPEC = process.env.DEPLOY_OPENAPI || resolve(ROOT, "spec/openapi.json");
+const OUT = resolve(ROOT, "src/api/generated-client.ts");
+const OUT_TYPES = resolve(ROOT, "src/api/api-types.ts");
+
+const spec = JSON.parse(readFileSync(SPEC, "utf8"));
+
+// operationId (`resource/action`, possibly snake/kebab in the action) →
+// camelCase. `app/list`→appList, `app/get_deploy_workflow`→appGetDeployWorkflow,
+// `secrets/list_app`→secretsListApp.
+const toMethodName = (operationId) =>
+  operationId
+    .split(/[/_-]/)
+    .filter(Boolean)
+    .map((seg, i) =>
+      i === 0
+        ? seg[0].toLowerCase() + seg.slice(1)
+        : seg[0].toUpperCase() + seg.slice(1),
+    )
+    .join("");
+
+// `/app/{id}/traffic` → ["id"], in order of appearance.
+const pathParamNames = (path) =>
+  [...path.matchAll(/\{([^}]+)\}/g)].map((m) => m[1]);
+
+// `/app/{id}` → "/app/${id}" (template-literal body).
+const toUrlTemplate = (path) =>
+  path.replace(/\{([^}]+)\}/g, (_, name) => "${" + name + "}");
+
+// Include every operation that requires auth (all deploy ops share one scheme)
+// and isn't marked internal. Two exclusion layers:
+//   1. no `security`      → infra (github setup/webhook, oidc token exchange)
+//   2. `x-internal: true` → explicitly marked private in the API
+const isIncluded = (op) => {
+  if (!Array.isArray(op.security) || op.security.length === 0) return false;
+  return op["x-internal"] !== true;
+};
+
+const successSchema = (op) => {
+  const responses = op.responses || {};
+  const res = responses["200"] || responses["201"];
+  return res?.content?.["application/json"]?.schema;
+};
+
+// A paginated list response is `{ next, results }` (see buildPaginator in
+// sdk-base). Detected structurally so it tracks the server, not the op name.
+const isPaginated = (op) => {
+  const schema = successSchema(op);
+  const req = schema?.required;
+  return Array.isArray(req) && req.includes("next") && req.includes("results");
+};
+
+const escape = (s) => (s || "").replace(/\*\//g, "*\\/").replace(/\r?\n/g, " ");
+
+// Collect + sort operations by operationId for a stable, reviewable diff.
+const operations = [];
+for (const [path, methods] of Object.entries(spec.paths || {})) {
+  for (const [httpMethod, op] of Object.entries(methods)) {
+    if (!op || typeof op !== "object" || !op.operationId) continue;
+    if (!["get", "post", "delete"].includes(httpMethod)) continue;
+    if (!isIncluded(op)) continue;
+    operations.push({ path, httpMethod, op });
+  }
+}
+operations.sort((a, b) => a.op.operationId.localeCompare(b.op.operationId));
+
+const emitMethod = ({ path, httpMethod, op }) => {
+  const id = op.operationId;
+  const name = toMethodName(id);
+  const pathParams = pathParamNames(path);
+  const queryParams = (op.parameters || []).filter((p) => p.in === "query");
+  const hasBody = !!op.requestBody;
+  const paginated = isPaginated(op);
+  const url = "`" + toUrlTemplate(path) + "`";
+
+  const hasQuery = queryParams.length > 0;
+  const args = pathParams.map((p) => `${p}: string`);
+  if (hasBody) args.push(`data: OpBody<"${id}">`);
+
+  // fetcher.post takes a strict FetcherConfig (string-only params), so a POST
+  // carrying query params needs extra handling. None exist today; fail loud if
+  // that changes rather than silently dropping the query.
+  if (httpMethod === "post" && hasQuery) {
+    throw new Error(
+      `gen-client: POST with query params not supported yet (${id}). ` +
+        "Extend emitMethod to thread query params through fetcher.post's config.",
+    );
+  }
+
+  let body;
+  if (paginated) {
+    args.push(`params?: Omit<OpQuery<"${id}">, "cursor" | "next">`);
+    // The paginator's request params are untyped (`any`), so array/number/enum
+    // query values pass straight through.
+    body = `return this.paginator<OpItem<"${id}">>({ url: ${url}, params });`;
+  } else if (httpMethod === "post") {
+    // fetcher.post rejects a falsy body ("empty body"), so bodyless POSTs send
+    // an empty object.
+    const data = hasBody ? "data" : "{}";
+    body = `return this.fetcher.post<OpResult<"${id}">>(${url}, ${data});`;
+  } else if (hasQuery) {
+    // GET/DELETE with query params route through fetcher.request: its `params`
+    // is untyped, sidestepping FetcherConfig's string-only constraint, and the
+    // GET path still goes through the ETag cache.
+    args.push(`params?: OpQuery<"${id}">`);
+    const method = httpMethod.toUpperCase();
+    body = `return this.fetcher.request<OpResult<"${id}">>({ method: "${method}", url: ${url}, params });`;
+  } else if (httpMethod === "delete") {
+    body = `return this.fetcher.delete<OpResult<"${id}">>(${url});`;
+  } else {
+    body = `return this.fetcher.get<OpResult<"${id}">>(${url});`;
+  }
+
+  const guards = pathParams.map((p) => `    requireId("${p}", ${p});`);
+  const doc = op.summary || op.description;
+  const jsdoc = [
+    "  /**",
+    `   * \`${httpMethod.toUpperCase()} ${path}\` — operationId: \`${id}\``,
+    ...(doc ? [`   *`, `   * ${escape(doc)}`] : []),
+    "   */",
+  ].join("\n");
+
+  return [
+    jsdoc,
+    `  ${name}(${args.join(", ")}) {`,
+    ...guards,
+    `    ${body}`,
+    "  }",
+  ].join("\n");
+};
+
+const header = `// AUTO-GENERATED by scripts/gen-client.mjs — do not edit by hand.
+// Regenerated from the OpenAPI spec on every build (npm run gentypes).
+// Source of truth: the deploy API's operationIds + security.
+
+import type { operations } from "./types.js";
+import { FaableApi } from "@faable/sdk-base";
+import { requireId } from "../helpers.js";
+
+// JSON body of an operation's request (typed from the generated \`operations\`).
+type OpBody<K extends keyof operations> = operations[K] extends {
+  requestBody: { content: { "application/json": infer B } };
+}
+  ? B
+  : never;
+
+// JSON body of an operation's 2xx response.
+type Content2xx<R> = R extends {
+  200: { content: { "application/json": infer T } };
+}
+  ? T
+  : R extends { 201: { content: { "application/json": infer T } } }
+    ? T
+    : void;
+
+type OpResult<K extends keyof operations> = operations[K] extends {
+  responses: infer R;
+}
+  ? Content2xx<R>
+  : void;
+
+// Item type of a paginated (\`{ next, results }\`) list response.
+type OpItem<K extends keyof operations> =
+  OpResult<K> extends { results: (infer I)[] } ? I : never;
+
+// Query parameters of an operation.
+type OpQuery<K extends keyof operations> = operations[K] extends {
+  parameters: { query?: infer Q };
+}
+  ? NonNullable<Q>
+  : Record<string, never>;
+`;
+
+const classBody = operations.map(emitMethod).join("\n\n");
+
+const out = `${header}
+/**
+ * Auto-generated deploy-API methods, one per secured operation in the OpenAPI
+ * spec. \`DeployApi\` extends this and adds the constructor, custom-logic
+ * helpers, and deprecated aliases.
+ */
+export abstract class GeneratedFaableDeployApi extends FaableApi {
+${classBody}
+}
+`;
+
+writeFileSync(OUT, out);
+console.warn(
+  `gen-client: wrote ${operations.length} methods → ${OUT.replace(ROOT + "/", "")}`,
+);
+
+// Simple-named aliases for every component schema (App, Deployment, Secret, …),
+// so consumers import `App` instead of `components["schemas"]["App"]`. One alias
+// per schema, sorted for a stable diff. Hand-maintained extras (friendlier event
+// names, the AppTraffic interface) live in custom-types.ts, which re-exports
+// this file.
+const schemaNames = Object.keys(spec.components?.schemas || {})
+  .filter((name) => /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name))
+  .sort();
+
+const typeAliases = schemaNames
+  .map((name) => `export type ${name} = components["schemas"]["${name}"];`)
+  .join("\n");
+
+const typesOut = `// AUTO-GENERATED by scripts/gen-client.mjs — do not edit by hand.
+// Regenerated from the OpenAPI spec on every build (npm run gentypes).
+// One simple-named alias per schema in \`components["schemas"]\`.
+// Hand-maintained extras live in custom-types.ts.
+
+import type { components } from "./types.js";
+
+${typeAliases}
+`;
+
+writeFileSync(OUT_TYPES, typesOut);
+console.warn(
+  `gen-client: wrote ${schemaNames.length} type aliases → ${OUT_TYPES.replace(ROOT + "/", "")}`,
+);