@farthershore/farthershore-js 0.19.0 → 0.20.0

package/CHANGELOG.md

@@ -3,7 +3,26 @@
 All notable changes to `@farthershore/farthershore-js` are documented here.
 This project adheres to Semantic Versioning (pre-1.0: minors may break).
 
-## [0.19.0] - 2026-07-19
+## [0.20.0] - 2026-07-20
+
+Consumer-principal key model — audit fixes to the two-kind (PERSONAL / SERVICE)
+API-key surface:
+
+- `keys.create()` / `keys.rotate()` now return the subject binding + provenance
+  on the created key: `kind` (non-null, as `CreatedApiKey` already promised),
+  `memberId`, `serviceAccountId`, `serviceAccountName`, and `createdBy`. Core's
+  create/rotate responses previously omitted these, so `CreatedApiKey.kind` could
+  be `undefined` at a non-null type. No SDK type change — the platform response is
+  now honest with the existing contract.
+- `keys.list()` ("Your keys") is CALLER-SCOPED server-side: a member receives
+  only their OWN personal keys plus, for admins (`team:assign_product_role`),
+  the org's service keys. Another member's personal-key rows are no longer
+  returned. Revoking or rotating a key is authorized at member level — a
+  personal key's bound member may manage it; anyone else needs the admin
+  provisioning permission (this closes a gap where a non-admin could revoke a
+  colleague's key).
+- `<ApiKeysPanel>` personal ("Your keys") rows now offer a Rotate action
+  alongside Revoke (the bound member manages their own key).
 
 Breaking — aligned with the platform's Product → Business excision and the
 variables / gateway-API cleanup:
@@ -16,6 +35,16 @@ variables / gateway-API cleanup:
   variables are backend-only encrypted secrets injected at the edge, with no
   browser-exposure path.
 - `product` → `business` naming across bootstrap/config/branding types.
+- The public `createFartherShoreClient(config)` no longer accepts the
+  platform-infrastructure knobs `coreUrl`, `portalHost`, `businessId`,
+  `environmentId`, or `gatewayUrl`. They were never part of the builder-facing
+  `FartherShoreConfig` type, but a plain-JS or `as any` caller could previously
+  smuggle them through at runtime (TypeScript's excess-property check only
+  rejects object literals); the public factory now **strips them at runtime**, so
+  they are physically unreachable through this entry point. The edge supplies
+  them via `window.__FS_CONFIG__`; a platform harness that must target a non-prod
+  environment uses `createFartherShoreClientWithPlatformConfig` from
+  `@farthershore/farthershore-js/internal`.
 
 ## [0.18.2] - 2026-07-18
 

package/README.md

@@ -3,7 +3,7 @@
 The **Farther Shore Frontend SDK** — the browser + React integration layer for
 your product's subscriber portal.
 
-> **Status: `0.19.0`.** Pre-1.0 (`0.x`): a minor bump (e.g. `0.9.x` → `0.10.0`)
+> **Status: `0.20.0`.** Pre-1.0 (`0.x`): a minor bump (e.g. `0.9.x` → `0.10.0`)
 > may include breaking changes, so a caret range is unsafe — **pin this package
 > exactly** (`0.9.0`) or use a patch-only tilde (`~0.9.0`). Changes are recorded
 > in [`CHANGELOG.md`](./CHANGELOG.md).
@@ -104,16 +104,31 @@ import "./styles/components.css";
 </FartherShoreRoot>;
 ```
 
-**Escape hatch (dev/test only):** everywhere there's no injected
-`window.__FS_CONFIG__` — local dev, self-hosting, tests — pass config
-explicitly:
+The public `createFartherShoreClient(config)` accepts only builder-facing
+options (`getToken`, `organizationId`, `apiKey`, `fetch`, `retry`, the error
+hooks, `mock`):
 
 ```ts
 const fs = createFartherShoreClient({
+  getToken: () => myAuthProvider.getToken(), // see "BYO auth" below
+});
+```
+
+The platform-infrastructure knobs (`coreUrl`, `portalHost`, `businessId`,
+`environmentId`, `gatewayUrl`) are **not** accepted here — the edge injects them
+via `window.__FS_CONFIG__`, and the public factory strips them at runtime, so a
+builder cannot point the client at the wrong place. A platform harness that must
+target a non-prod environment (local dev without edge injection, self-hosting,
+tests) uses the internal factory instead:
+
+```ts
+import { createFartherShoreClientWithPlatformConfig } from "@farthershore/farthershore-js/internal";
+
+const fs = createFartherShoreClientWithPlatformConfig({
   coreUrl: "http://localhost:4000", // dev/self-host only; injected on-platform
   portalHost: "croncloud.example.com", // defaults to window.location.host
   businessId: "biz_123", // usually omitted — bootstrap() discovers it
-  getToken: () => myAuthProvider.getToken(), // see "BYO auth" below
+  getToken: () => myAuthProvider.getToken(),
 });
 ```
 

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import { type FartherShoreConfig, type ClientContext } from "./config.js";
+import { type FartherShoreConfig, type FartherShorePlatformConfig, type ClientContext } from "./config.js";
 import { type CoreRequest } from "./http.js";
 import { type FsFetchOptions } from "./fetch.js";
 import { type BusinessResource } from "./resources/business.js";
@@ -166,20 +166,24 @@ export interface FartherShoreClient {
     core<T>(req: CoreRequest): Promise<T>;
 }
 /**
- * Create a {@link FartherShoreClient}. Zero-config by default: on a
- * platform-served portal, no config is needed at all — the edge injects
- * `window.__FS_CONFIG__` with the environment's `coreUrl` (and Clerk
- * connection), `portalHost` defaults to `window.location.host`, and the
- * business is discovered at {@link FartherShoreClient.bootstrap}. Both reads
- * are LAZY (never at construction — only when something is actually resolved,
- * e.g. the first request), so `createFartherShoreClient()` never throws.
+ * Create a {@link FartherShoreClient}. Zero-config: on a platform-served portal
+ * no config is needed at all — the edge injects `window.__FS_CONFIG__` with the
+ * environment's Core URL (and Clerk connection), `portalHost` defaults to
+ * `window.location.host`, and the business is discovered at
+ * {@link FartherShoreClient.bootstrap}. Those reads are LAZY (never at
+ * construction — only when something is actually resolved, e.g. the first
+ * request), so `createFartherShoreClient()` never throws.
  *
- * The `overrides` parameter is a labeled dev/test escape hatch — explicit
- * config always wins over the injected channel, for local dev, self-hosted
- * setups, and tests (`{ coreUrl: "http://localhost:4000" }`). The returned
- * client owns all routing (Core vs Gateway), auth, and host/env scoping; app
- * code only expresses intent via its typed resources (`fs.usage`, `fs.keys`,
- * `fs.route`).
+ * The optional `config` carries only builder-facing options
+ * ({@link FartherShoreConfig}: `getToken`, `organizationId`, `mock`, `fetch`,
+ * `retry`, the error hooks). Platform-infrastructure knobs
+ * (coreUrl/portalHost/businessId/gatewayUrl/environmentId) are intentionally NOT
+ * accepted here — the platform supplies them at the edge. They are STRIPPED at
+ * runtime (not merely rejected by TypeScript, which only catches object
+ * literals), so a plain-JS or `as any` caller physically cannot set them through
+ * this entry point. A harness that must target a non-prod environment uses
+ * `createFartherShoreClientWithPlatformConfig` from
+ * `@farthershore/farthershore-js/internal`.
  *
  * @example
  * ```ts
@@ -187,11 +191,22 @@ export interface FartherShoreClient {
  * const { product } = await fs.bootstrap();
  * const keys = await fs.keys.list();
  * ```
+ */
+export declare function createFartherShoreClient(config?: FartherShoreConfig): FartherShoreClient;
+/**
+ * PLATFORM-INTERNAL client factory — identical to {@link createFartherShoreClient}
+ * but also accepts the platform-infrastructure knobs in
+ * {@link FartherShorePlatformConfig} (coreUrl/portalHost/businessId/gatewayUrl/
+ * environmentId). Explicit values here win over the edge-injected
+ * `window.__FS_CONFIG__`, which is what lets our own harnesses (this repo's
+ * tests + the dev-portal-template dev bridge) steer a client at a non-production
+ * environment.
  *
- * @example Dev/test escape hatch
- * ```ts
- * const fs = createFartherShoreClient({ coreUrl: "http://localhost:4000" });
- * ```
+ * Exposed ONLY through the `@farthershore/farthershore-js/internal` subpath —
+ * never re-exported from the package root — so it stays out of builder types,
+ * autocomplete, docs, and examples. If you are writing product/app code and
+ * reach for this, STOP: you want zero-config {@link createFartherShoreClient}
+ * and the edge-injected channel.
  */
-export declare function createFartherShoreClient(overrides?: FartherShoreConfig): FartherShoreClient;
+export declare function createFartherShoreClientWithPlatformConfig(config?: FartherShorePlatformConfig): FartherShoreClient;
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAGnB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAW,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA2BhF;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,IAAI,IAAI,IAAI,CAAC;IACb,0EAA0E;IAC1E,EAAE,IAAI,IAAI,CAAC;IACX,gFAAgF;IAChF,KAAK,IAAI,IAAI,CAAC;IACd,6BAA6B;IAC7B,OAAO,IAAI,IAAI,CAAC;IAChB,qDAAqD;IACrD,YAAY,IAAI,IAAI,CAAC;IACrB,uDAAuD;IACvD,aAAa,IAAI,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;6EAKyE;IACzE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;yCACqC;IACrC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,+DAA+D;IAC/D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACpC,8EAA8E;IAC9E,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5C;;gDAE4C;IAC5C,gBAAgB,CACd,QAAQ,EAAE,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,GAC9D,IAAI,CAAC;IACR;;;yDAGqD;IACrD,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACvD;;4EAEwE;IACxE,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC;;;;uBAImB;IACnB,iBAAiB,CACf,OAAO,EACH,CAAC,CAAC,GAAG,EAAE,OAAO,mBAAmB,EAAE,oBAAoB,KAAK,IAAI,CAAC,GACjE,IAAI,GACP,IAAI,CAAC;IACR;;;wFAGoF;IACpF,UAAU,IAAI,IAAI,CAAC;IAEnB;;;yDAGqD;IACrD,QAAQ,CAAC,SAAS,EAAE;QAClB,GAAG,IAAI,OAAO,mBAAmB,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAC5D,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;KAC7C,CAAC;IAEF;;;;wEAIoE;IACpE,QAAQ,CAAC,UAAU,EAAE;QACnB,GAAG,IAAI,OAAO,mBAAmB,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAC5D,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;KAC7C,CAAC;IAEF,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;sBAEkB;IAClB,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACvE,wEAAwE;IACxE,WAAW,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,iEAAiE;IACjE,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;;;oCAGgC;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;6DACyD;IACzD,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAE3D;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE7D;;;;;;;;OAQG;IACH,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,GAAE,kBAAuB,GACjC,kBAAkB,CAgJpB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,aAAa,EAInB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAW,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA2BhF;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,IAAI,IAAI,IAAI,CAAC;IACb,0EAA0E;IAC1E,EAAE,IAAI,IAAI,CAAC;IACX,gFAAgF;IAChF,KAAK,IAAI,IAAI,CAAC;IACd,6BAA6B;IAC7B,OAAO,IAAI,IAAI,CAAC;IAChB,qDAAqD;IACrD,YAAY,IAAI,IAAI,CAAC;IACrB,uDAAuD;IACvD,aAAa,IAAI,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;6EAKyE;IACzE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;yCACqC;IACrC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,+DAA+D;IAC/D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACpC,8EAA8E;IAC9E,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5C;;gDAE4C;IAC5C,gBAAgB,CACd,QAAQ,EAAE,CAAC,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,GAC9D,IAAI,CAAC;IACR;;;yDAGqD;IACrD,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACvD;;4EAEwE;IACxE,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC;;;;uBAImB;IACnB,iBAAiB,CACf,OAAO,EACH,CAAC,CAAC,GAAG,EAAE,OAAO,mBAAmB,EAAE,oBAAoB,KAAK,IAAI,CAAC,GACjE,IAAI,GACP,IAAI,CAAC;IACR;;;wFAGoF;IACpF,UAAU,IAAI,IAAI,CAAC;IAEnB;;;yDAGqD;IACrD,QAAQ,CAAC,SAAS,EAAE;QAClB,GAAG,IAAI,OAAO,mBAAmB,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAC5D,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;KAC7C,CAAC;IAEF;;;;wEAIoE;IACpE,QAAQ,CAAC,UAAU,EAAE;QACnB,GAAG,IAAI,OAAO,mBAAmB,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAC5D,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;KAC7C,CAAC;IAEF,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;sBAEkB;IAClB,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACvE,wEAAwE;IACxE,WAAW,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,iEAAiE;IACjE,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;;;oCAGgC;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;6DACyD;IACzD,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAE3D;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE7D;;;;;;;;OAQG;IACH,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,GAAE,kBAAuB,GAC9B,kBAAkB,CAQpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0CAA0C,CACxD,MAAM,GAAE,0BAA+B,GACtC,kBAAkB,CA+IpB"}

package/dist/client.js

@@ -1,8 +1,16 @@
-// The client factory. Frontend code creates one client (usually with just a
-// coreUrl), then expresses intent — `fs.usage.summary()`, `fs.keys.list()`,
-// `fs.route.get("/forecast")`. The client owns ALL routing: Core
-// vs Gateway, auth, host/env scoping.
-import { buildContext, isMockMode, } from "./config.js";
+// The client factory. Frontend code creates one client — on a platform-served
+// portal with ZERO config — then expresses intent: `fs.usage.summary()`,
+// `fs.keys.list()`, `fs.route.get("/forecast")`. The client owns ALL routing:
+// Core vs Gateway, auth, host/env scoping.
+//
+// `createFartherShoreClient` is the public builder entrypoint and accepts only
+// the builder-facing {@link FartherShoreConfig}. Platform-infrastructure knobs
+// (coreUrl/portalHost/businessId/gatewayUrl/environmentId) are NOT builder
+// config — they arrive via the edge-injected `window.__FS_CONFIG__` and
+// bootstrap discovery. Our own harnesses that must point a client at a non-prod
+// environment use `createFartherShoreClientWithPlatformConfig` via the
+// `@farthershore/farthershore-js/internal` subpath.
+import { buildContext, isMockMode, stripPlatformOverrides, } from "./config.js";
 import { resolveBootstrap } from "./bootstrap.js";
 import { bustReadCache, bustEntitlementCaches } from "./cache.js";
 import { coreFetch } from "./http.js";
@@ -36,20 +44,24 @@ function installMockTransport(ctx) {
     ctx.sessionToken = "fs_mock_session";
 }
 /**
- * Create a {@link FartherShoreClient}. Zero-config by default: on a
- * platform-served portal, no config is needed at all — the edge injects
- * `window.__FS_CONFIG__` with the environment's `coreUrl` (and Clerk
- * connection), `portalHost` defaults to `window.location.host`, and the
- * business is discovered at {@link FartherShoreClient.bootstrap}. Both reads
- * are LAZY (never at construction — only when something is actually resolved,
- * e.g. the first request), so `createFartherShoreClient()` never throws.
+ * Create a {@link FartherShoreClient}. Zero-config: on a platform-served portal
+ * no config is needed at all — the edge injects `window.__FS_CONFIG__` with the
+ * environment's Core URL (and Clerk connection), `portalHost` defaults to
+ * `window.location.host`, and the business is discovered at
+ * {@link FartherShoreClient.bootstrap}. Those reads are LAZY (never at
+ * construction — only when something is actually resolved, e.g. the first
+ * request), so `createFartherShoreClient()` never throws.
  *
- * The `overrides` parameter is a labeled dev/test escape hatch — explicit
- * config always wins over the injected channel, for local dev, self-hosted
- * setups, and tests (`{ coreUrl: "http://localhost:4000" }`). The returned
- * client owns all routing (Core vs Gateway), auth, and host/env scoping; app
- * code only expresses intent via its typed resources (`fs.usage`, `fs.keys`,
- * `fs.route`).
+ * The optional `config` carries only builder-facing options
+ * ({@link FartherShoreConfig}: `getToken`, `organizationId`, `mock`, `fetch`,
+ * `retry`, the error hooks). Platform-infrastructure knobs
+ * (coreUrl/portalHost/businessId/gatewayUrl/environmentId) are intentionally NOT
+ * accepted here — the platform supplies them at the edge. They are STRIPPED at
+ * runtime (not merely rejected by TypeScript, which only catches object
+ * literals), so a plain-JS or `as any` caller physically cannot set them through
+ * this entry point. A harness that must target a non-prod environment uses
+ * `createFartherShoreClientWithPlatformConfig` from
+ * `@farthershore/farthershore-js/internal`.
  *
  * @example
  * ```ts
@@ -57,14 +69,30 @@ function installMockTransport(ctx) {
  * const { product } = await fs.bootstrap();
  * const keys = await fs.keys.list();
  * ```
+ */
+export function createFartherShoreClient(config = {}) {
+    // Runtime strip: physically remove the platform-infrastructure keys so they
+    // can never reach buildContext through the public entry, regardless of how the
+    // caller typed (or didn't type) the object. The /internal factory below is the
+    // only path that honors them.
+    return createFartherShoreClientWithPlatformConfig(stripPlatformOverrides(config));
+}
+/**
+ * PLATFORM-INTERNAL client factory — identical to {@link createFartherShoreClient}
+ * but also accepts the platform-infrastructure knobs in
+ * {@link FartherShorePlatformConfig} (coreUrl/portalHost/businessId/gatewayUrl/
+ * environmentId). Explicit values here win over the edge-injected
+ * `window.__FS_CONFIG__`, which is what lets our own harnesses (this repo's
+ * tests + the dev-portal-template dev bridge) steer a client at a non-production
+ * environment.
  *
- * @example Dev/test escape hatch
- * ```ts
- * const fs = createFartherShoreClient({ coreUrl: "http://localhost:4000" });
- * ```
+ * Exposed ONLY through the `@farthershore/farthershore-js/internal` subpath —
+ * never re-exported from the package root — so it stays out of builder types,
+ * autocomplete, docs, and examples. If you are writing product/app code and
+ * reach for this, STOP: you want zero-config {@link createFartherShoreClient}
+ * and the edge-injected channel.
  */
-export function createFartherShoreClient(overrides = {}) {
-    const config = overrides;
+export function createFartherShoreClientWithPlatformConfig(config = {}) {
     // buildContext returns coreUrl/portalHost as LAZY getters — this call does
     // no window/location/__FS_CONFIG__ reads itself, so construction can never
     // throw for a missing coreUrl (only a later read of ctx.coreUrl can).

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,4EAA4E;AAC5E,iEAAiE;AACjE,sCAAsC;AAEtC,OAAO,EAGL,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,SAAS,EAAoB,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,OAAO,EAAuB,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GAEtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAqB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAsB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EACL,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAsB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EACL,oBAAoB,GAOrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,0BAA0B,GAG3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAsB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EACL,uBAAuB,GAExB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,SAAS,oBAAoB,CAAC,GAAkB;IAC9C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,SAAS,GAEF,IAAI,CAAC;IAChB,IAAI,gBAAgB,GAET,IAAI,CAAC;IAChB,GAAG,CAAC,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAChC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,gBAAgB,KAAK,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CACnB,CAAC;YACF,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACrC,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,GAAG,CAAC,YAAY,GAAG,iBAAiB,CAAC;AACvC,CAAC;AAuKD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAgC,EAAE;IAElC,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,GAAG,GAAkB,YAAY,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3B,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,oDAAoD;IACpD,wEAAwE;IACxE,6DAA6D;IAC7D,IAAI,MAAM,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;QAChD,IAAI,SAAS;YAAE,GAAG,CAAC,cAAc,GAAG,SAAS,CAAC;IAChD,CAAC;IAED,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,IAAI,QAAQ,GAA8B,IAAI,CAAC;IAC/C,SAAS,eAAe;QACtB,IAAI,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC;iBAC7B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,MAAM,GAAG,CAAC,CAAC;gBACX,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,CAAC,CAAC;YACX,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;gBACpB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,CAAC,CAAC;YACV,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAmB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACvD,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,0BAA0B,CAAC;QAC5D,GAAG;QACH,EAAE,EAAE,OAAO,CAAC,EAAE;KACf,CAAC,CAAC;IAEH,2EAA2E;IAC3E,wEAAwE;IACxE,2DAA2D;IAC3D,SAAS,IAAI,CAAC,IAA4B;QACxC,KAAK,eAAe,EAAE;aACnB,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,QAAQ,GAAoB;QAChC,IAAI,EAAE,GAAG,EAAE;YACT,KAAK,eAAe,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAClC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACzC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACtD,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;KACzD,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,GAAG;QACZ,SAAS,EAAE,eAAe;QAC1B,SAAS,CAAC,GAAG;YACX,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QACD,eAAe,CAAC,KAAK;YACnB,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC;YACzB,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAC/B,iEAAiE;YACjE,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,gBAAgB,CAAC,QAAQ;YACvB,GAAG,CAAC,aAAa,GAAG,QAAQ,CAAC;YAC7B,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAC/B,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,iBAAiB,CAAC,cAAc;YAC9B,GAAG,CAAC,cAAc,GAAG,cAAc,CAAC;YACpC,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAC/B,iDAAiD;YACjD,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,8DAA8D;YAC9D,wEAAwE;YACxE,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACxC,CAAC;QACD,iBAAiB;YACf,OAAO,GAAG,CAAC,cAAc,CAAC;QAC5B,CAAC;QACD,iBAAiB,CAAC,OAAO;YACvB,GAAG,CAAC,qBAAqB,GAAG,OAAO,IAAI,SAAS,CAAC;QACnD,CAAC;QACD,UAAU;YACR,0EAA0E;YAC1E,wEAAwE;YACxE,gEAAgE;YAChE,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,SAAS,EAAE;YACT,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa;YAC5B,SAAS,CAAC,QAAQ;gBAChB,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrC,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvD,CAAC;SACF;QACD,UAAU,EAAE;YACV,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa;YAC5B,SAAS,CAAC,QAAQ;gBAChB,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrC,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvD,CAAC;SACF;QACD,QAAQ,EAAE,sBAAsB,CAAC,eAAe,CAAC;QACjD,IAAI,EAAE,kBAAkB,CAAC,GAAG,CAAC;QAC7B,IAAI;QACJ,KAAK;QACL,OAAO;QACP,KAAK,EAAE,mBAAmB,CAAC,GAAG,EAAE,eAAe,CAAC;QAChD,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY;QACZ,QAAQ;QACR,QAAQ;QACR,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;QAC/B,SAAS,EAAE,CAAc,IAAY,EAAE,EAAE,CACvC,uBAAuB,CAAI,GAAG,EAAE,IAAI,CAAC;QACvC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;QAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;KACnC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAC9E,2CAA2C;AAC3C,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,wEAAwE;AACxE,gFAAgF;AAChF,uEAAuE;AACvE,oDAAoD;AAEpD,OAAO,EAIL,YAAY,EACZ,UAAU,EACV,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,SAAS,EAAoB,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,OAAO,EAAuB,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GAEtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAqB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAsB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EACL,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAsB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EACL,oBAAoB,GAOrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,0BAA0B,GAG3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAsB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EACL,uBAAuB,GAExB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,SAAS,oBAAoB,CAAC,GAAkB;IAC9C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,IAAI,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,SAAS,GAEF,IAAI,CAAC;IAChB,IAAI,gBAAgB,GAET,IAAI,CAAC;IAChB,GAAG,CAAC,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAChC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,gBAAgB,KAAK,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CACnB,CAAC;YACF,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACrC,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,GAAG,CAAC,YAAY,GAAG,iBAAiB,CAAC;AACvC,CAAC;AAuKD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAA6B,EAAE;IAE/B,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,8BAA8B;IAC9B,OAAO,0CAA0C,CAC/C,sBAAsB,CAAC,MAAM,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0CAA0C,CACxD,SAAqC,EAAE;IAEvC,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,GAAG,GAAkB,YAAY,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3B,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,oDAAoD;IACpD,wEAAwE;IACxE,6DAA6D;IAC7D,IAAI,MAAM,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;QAChD,IAAI,SAAS;YAAE,GAAG,CAAC,cAAc,GAAG,SAAS,CAAC;IAChD,CAAC;IAED,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,IAAI,QAAQ,GAA8B,IAAI,CAAC;IAC/C,SAAS,eAAe;QACtB,IAAI,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC;iBAC7B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,MAAM,GAAG,CAAC,CAAC;gBACX,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,CAAC,CAAC;YACX,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;gBACpB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,CAAC,CAAC;YACV,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAmB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACvD,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,0BAA0B,CAAC;QAC5D,GAAG;QACH,EAAE,EAAE,OAAO,CAAC,EAAE;KACf,CAAC,CAAC;IAEH,2EAA2E;IAC3E,wEAAwE;IACxE,2DAA2D;IAC3D,SAAS,IAAI,CAAC,IAA4B;QACxC,KAAK,eAAe,EAAE;aACnB,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,QAAQ,GAAoB;QAChC,IAAI,EAAE,GAAG,EAAE;YACT,KAAK,eAAe,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAClC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACzC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACtD,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;KACzD,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,GAAG;QACZ,SAAS,EAAE,eAAe;QAC1B,SAAS,CAAC,GAAG;YACX,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QACD,eAAe,CAAC,KAAK;YACnB,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC;YACzB,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAC/B,iEAAiE;YACjE,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,gBAAgB,CAAC,QAAQ;YACvB,GAAG,CAAC,aAAa,GAAG,QAAQ,CAAC;YAC7B,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAC/B,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,iBAAiB,CAAC,cAAc;YAC9B,GAAG,CAAC,cAAc,GAAG,cAAc,CAAC;YACpC,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAC/B,iDAAiD;YACjD,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,8DAA8D;YAC9D,wEAAwE;YACxE,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACxC,CAAC;QACD,iBAAiB;YACf,OAAO,GAAG,CAAC,cAAc,CAAC;QAC5B,CAAC;QACD,iBAAiB,CAAC,OAAO;YACvB,GAAG,CAAC,qBAAqB,GAAG,OAAO,IAAI,SAAS,CAAC;QACnD,CAAC;QACD,UAAU;YACR,0EAA0E;YAC1E,wEAAwE;YACxE,gEAAgE;YAChE,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,SAAS,EAAE;YACT,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa;YAC5B,SAAS,CAAC,QAAQ;gBAChB,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrC,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvD,CAAC;SACF;QACD,UAAU,EAAE;YACV,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa;YAC5B,SAAS,CAAC,QAAQ;gBAChB,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrC,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvD,CAAC;SACF;QACD,QAAQ,EAAE,sBAAsB,CAAC,eAAe,CAAC;QACjD,IAAI,EAAE,kBAAkB,CAAC,GAAG,CAAC;QAC7B,IAAI;QACJ,KAAK;QACL,OAAO;QACP,KAAK,EAAE,mBAAmB,CAAC,GAAG,EAAE,eAAe,CAAC;QAChD,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY;QACZ,QAAQ;QACR,QAAQ;QACR,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;QAC/B,SAAS,EAAE,CAAc,IAAY,EAAE,EAAE,CACvC,uBAAuB,CAAI,GAAG,EAAE,IAAI,CAAC;QACvC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;QAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;KACnC,CAAC;AACJ,CAAC"}

package/dist/components/_internal.d.ts

@@ -5,4 +5,14 @@ export declare function ArrowIcon(): import("react/jsx-runtime").JSX.Element;
 export declare function CheckIcon({ className }: {
     className?: string;
 }): import("react/jsx-runtime").JSX.Element;
+/** Kind glyph for a PERSONAL key — a person, because it acts as a human. Purely
+ *  decorative (`aria-hidden`); the identity is stated in adjacent text. */
+export declare function PersonalKeyIcon({ className }: {
+    className?: string;
+}): import("react/jsx-runtime").JSX.Element;
+/** Kind glyph for a SERVICE key — a stacked machine, because it is an org-owned
+ *  machine identity, never a person. Decorative (`aria-hidden`). */
+export declare function ServiceKeyIcon({ className }: {
+    className?: string;
+}): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=_internal.d.ts.map

package/dist/components/_internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_internal.d.ts","sourceRoot":"","sources":["../../src/components/_internal.tsx"],"names":[],"mappings":"AAIA;uEACuE;AACvE,wBAAgB,EAAE,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC,GAAG,MAAM,CAE7E;AAED,wBAAgB,SAAS,4CAgBxB;AAED,wBAAgB,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,2CAgB9D"}
+{"version":3,"file":"_internal.d.ts","sourceRoot":"","sources":["../../src/components/_internal.tsx"],"names":[],"mappings":"AAIA;uEACuE;AACvE,wBAAgB,EAAE,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC,GAAG,MAAM,CAE7E;AAED,wBAAgB,SAAS,4CAgBxB;AAED,wBAAgB,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,2CAgB9D;AAED;2EAC2E;AAC3E,wBAAgB,eAAe,CAAC,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,2CAcpE;AAED;oEACoE;AACpE,wBAAgB,cAAc,CAAC,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,2CAenE"}

package/dist/components/_internal.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Internal shared bits for the components package — NOT exported from the
 // package. Public components live one-per-file; this holds the tiny pieces
 // several of them share.
@@ -13,4 +13,14 @@ export function ArrowIcon() {
 export function CheckIcon({ className }) {
     return (_jsx("svg", { className: className, fill: "none", viewBox: "0 0 24 24", strokeWidth: 2.5, stroke: "currentColor", children: _jsx("path", { strokeLinecap: "round", strokeLinejoin: "round", d: "M4.5 12.75l6 6 9-13.5" }) }));
 }
+/** Kind glyph for a PERSONAL key — a person, because it acts as a human. Purely
+ *  decorative (`aria-hidden`); the identity is stated in adjacent text. */
+export function PersonalKeyIcon({ className }) {
+    return (_jsxs("svg", { className: className, "aria-hidden": "true", fill: "none", viewBox: "0 0 24 24", strokeWidth: 1.75, stroke: "currentColor", children: [_jsx("circle", { cx: "12", cy: "8", r: "3.25" }), _jsx("path", { strokeLinecap: "round", d: "M5.5 19a6.5 6.5 0 0 1 13 0" })] }));
+}
+/** Kind glyph for a SERVICE key — a stacked machine, because it is an org-owned
+ *  machine identity, never a person. Decorative (`aria-hidden`). */
+export function ServiceKeyIcon({ className }) {
+    return (_jsxs("svg", { className: className, "aria-hidden": "true", fill: "none", viewBox: "0 0 24 24", strokeWidth: 1.75, stroke: "currentColor", children: [_jsx("rect", { x: "3.75", y: "4.5", width: "16.5", height: "6", rx: "1.75" }), _jsx("rect", { x: "3.75", y: "13.5", width: "16.5", height: "6", rx: "1.75" }), _jsx("path", { strokeLinecap: "round", d: "M7 7.5h.01M7 16.5h.01" })] }));
+}
 //# sourceMappingURL=_internal.js.map

package/dist/components/_internal.js.map

@@ -1 +1 @@
-{"version":3,"file":"_internal.js","sourceRoot":"","sources":["../../src/components/_internal.tsx"],"names":[],"mappings":";AAAA,0EAA0E;AAC1E,2EAA2E;AAC3E,yBAAyB;AAEzB;uEACuE;AACvE,MAAM,UAAU,EAAE,CAAC,GAAG,KAA+C;IACnE,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,CACL,cACE,SAAS,EAAC,eAAe,EACzB,IAAI,EAAC,MAAM,EACX,OAAO,EAAC,WAAW,EACnB,WAAW,EAAE,GAAG,EAChB,MAAM,EAAC,cAAc,YAErB,eACE,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,EACtB,CAAC,EAAC,sCAAsC,GACxC,GACE,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAE,SAAS,EAA0B;IAC7D,OAAO,CACL,cACE,SAAS,EAAE,SAAS,EACpB,IAAI,EAAC,MAAM,EACX,OAAO,EAAC,WAAW,EACnB,WAAW,EAAE,GAAG,EAChB,MAAM,EAAC,cAAc,YAErB,eACE,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,EACtB,CAAC,EAAC,uBAAuB,GACzB,GACE,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"_internal.js","sourceRoot":"","sources":["../../src/components/_internal.tsx"],"names":[],"mappings":";AAAA,0EAA0E;AAC1E,2EAA2E;AAC3E,yBAAyB;AAEzB;uEACuE;AACvE,MAAM,UAAU,EAAE,CAAC,GAAG,KAA+C;IACnE,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,CACL,cACE,SAAS,EAAC,eAAe,EACzB,IAAI,EAAC,MAAM,EACX,OAAO,EAAC,WAAW,EACnB,WAAW,EAAE,GAAG,EAChB,MAAM,EAAC,cAAc,YAErB,eACE,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,EACtB,CAAC,EAAC,sCAAsC,GACxC,GACE,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAE,SAAS,EAA0B;IAC7D,OAAO,CACL,cACE,SAAS,EAAE,SAAS,EACpB,IAAI,EAAC,MAAM,EACX,OAAO,EAAC,WAAW,EACnB,WAAW,EAAE,GAAG,EAChB,MAAM,EAAC,cAAc,YAErB,eACE,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,EACtB,CAAC,EAAC,uBAAuB,GACzB,GACE,CACP,CAAC;AACJ,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,eAAe,CAAC,EAAE,SAAS,EAA0B;IACnE,OAAO,CACL,eACE,SAAS,EAAE,SAAS,iBACR,MAAM,EAClB,IAAI,EAAC,MAAM,EACX,OAAO,EAAC,WAAW,EACnB,WAAW,EAAE,IAAI,EACjB,MAAM,EAAC,cAAc,aAErB,iBAAQ,EAAE,EAAC,IAAI,EAAC,EAAE,EAAC,GAAG,EAAC,CAAC,EAAC,MAAM,GAAG,EAClC,eAAM,aAAa,EAAC,OAAO,EAAC,CAAC,EAAC,4BAA4B,GAAG,IACzD,CACP,CAAC;AACJ,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,cAAc,CAAC,EAAE,SAAS,EAA0B;IAClE,OAAO,CACL,eACE,SAAS,EAAE,SAAS,iBACR,MAAM,EAClB,IAAI,EAAC,MAAM,EACX,OAAO,EAAC,WAAW,EACnB,WAAW,EAAE,IAAI,EACjB,MAAM,EAAC,cAAc,aAErB,eAAM,CAAC,EAAC,MAAM,EAAC,CAAC,EAAC,KAAK,EAAC,KAAK,EAAC,MAAM,EAAC,MAAM,EAAC,GAAG,EAAC,EAAE,EAAC,MAAM,GAAG,EAC3D,eAAM,CAAC,EAAC,MAAM,EAAC,CAAC,EAAC,MAAM,EAAC,KAAK,EAAC,MAAM,EAAC,MAAM,EAAC,GAAG,EAAC,EAAE,EAAC,MAAM,GAAG,EAC5D,eAAM,aAAa,EAAC,OAAO,EAAC,CAAC,EAAC,uBAAuB,GAAG,IACpD,CACP,CAAC;AACJ,CAAC"}

package/dist/components/keys.d.ts

@@ -1,5 +1,5 @@
 export interface ApiKeysPanelProps {
-    /** Appended to the root card. */
+    /** Appended to the root element. */
     className?: string;
 }
 export declare function ApiKeysPanel({ className }?: ApiKeysPanelProps): import("react/jsx-runtime").JSX.Element;

package/dist/components/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/components/keys.tsx"],"names":[],"mappings":"AAuBA,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA8CD,wBAAgB,YAAY,CAAC,EAAE,SAAS,EAAE,GAAE,iBAAsB,2CAgJjE"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/components/keys.tsx"],"names":[],"mappings":"AAyDA,MAAM,WAAW,iBAAiB;IAChC,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA+ED,wBAAgB,YAAY,CAAC,EAAE,SAAS,EAAE,GAAE,iBAAsB,2CA4JjE"}