@gebsecure01/sdk 0.2.1

package/dist/index.js

@@ -0,0 +1,1218 @@
+// src/clock.ts
+function abortReason(signal) {
+  return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
+var systemClock = {
+  now: () => Date.now(),
+  sleep: (ms2, signal) => new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(abortReason(signal));
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(abortReason(signal));
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, Math.max(0, ms2));
+    signal?.addEventListener("abort", onAbort, { once: true });
+  })
+};
+
+// src/errors.ts
+var GebSecureError = class extends Error {
+  /** HTTP status, or 0 for client-side errors (network, timeouts, approval waits). */
+  status;
+  /** Machine-readable error code, e.g. `policy_denied`, `rate_limited`, `connection_error`. */
+  code;
+  /** Human-readable detail from the server (or the SDK). */
+  detail;
+  /** Server request id (`x-request-id`), when known. */
+  requestId;
+  /** W3C trace id of the request, when known. */
+  traceId;
+  /** Structured problem details (e.g. validation issues), when provided. */
+  details;
+  /** Problem type URI, when provided. */
+  type;
+  constructor(init) {
+    const detail = init.detail ?? init.code;
+    super(`${init.code}: ${detail}${init.requestId ? ` (request ${init.requestId})` : ""}`, init.cause !== void 0 ? { cause: init.cause } : void 0);
+    this.name = new.target.name;
+    this.status = init.status ?? 0;
+    this.code = init.code;
+    this.detail = detail;
+    this.requestId = init.requestId ?? null;
+    this.traceId = init.traceId ?? null;
+    this.details = init.details ?? null;
+    this.type = init.type ?? null;
+  }
+};
+var ApiError = class extends GebSecureError {
+};
+var AuthenticationError = class extends ApiError {
+};
+var PermissionDeniedError = class extends ApiError {
+};
+var PolicyDeniedError = class extends ApiError {
+};
+var ApprovalRequiredError = class extends ApiError {
+};
+var ValidationError = class extends ApiError {
+};
+var NotFoundError = class extends ApiError {
+};
+var ConflictError = class extends ApiError {
+};
+var UpstreamError = class extends ApiError {
+};
+var TimeoutError = class extends ApiError {
+};
+var UnavailableError = class extends ApiError {
+};
+var InternalError = class extends ApiError {
+};
+var RateLimitError = class extends ApiError {
+  /** Server-requested wait before retrying, in milliseconds (from `Retry-After`), if any. */
+  retryAfterMs;
+  constructor(init) {
+    super(init);
+    this.retryAfterMs = init.retryAfterMs ?? null;
+  }
+};
+var ConnectionError = class extends GebSecureError {
+  constructor(detail, cause) {
+    super({ code: "connection_error", detail, cause });
+  }
+};
+var ApprovalTimeoutError = class extends GebSecureError {
+  approvalId;
+  constructor(approvalId, timeoutMs) {
+    super({ code: "approval_timeout", detail: `Approval ${approvalId} still pending after ${timeoutMs} ms` });
+    this.approvalId = approvalId;
+  }
+};
+var ApprovalNotGrantedError = class extends GebSecureError {
+  approval;
+  constructor(approval) {
+    super({ code: "approval_not_granted", detail: `Approval ${approval.id} was ${approval.status}${approval.resolutionComment ? `: ${approval.resolutionComment}` : ""}` });
+    this.approval = approval;
+  }
+};
+var SimulationFailedError = class extends ApiError {
+  run;
+  constructor(run, meta = {}) {
+    const s = run.summary;
+    super({
+      status: 422,
+      code: "simulation_failed",
+      detail: `Simulation ${run.id ?? run.name ?? ""} ${run.status}: ${s?.failed ?? 0} failed, ${s?.errors ?? 0} errors`.replace("  ", " "),
+      requestId: meta.requestId ?? null,
+      traceId: meta.traceId ?? null
+    });
+    this.run = run;
+  }
+};
+var ConfigurationError = class extends GebSecureError {
+  constructor(detail) {
+    super({ code: "invalid_configuration", detail });
+  }
+};
+var STATUS_CODES = {
+  400: "bad_request",
+  401: "unauthenticated",
+  403: "forbidden",
+  404: "not_found",
+  409: "conflict",
+  412: "precondition_failed",
+  422: "validation_failed",
+  429: "rate_limited",
+  502: "upstream_error",
+  503: "unavailable",
+  504: "timeout"
+};
+var CODE_CLASSES = {
+  unauthenticated: AuthenticationError,
+  forbidden: PermissionDeniedError,
+  policy_denied: PolicyDeniedError,
+  approval_required: ApprovalRequiredError,
+  validation_failed: ValidationError,
+  bad_request: ValidationError,
+  not_found: NotFoundError,
+  conflict: ConflictError,
+  precondition_failed: ConflictError,
+  upstream_error: UpstreamError,
+  timeout: TimeoutError,
+  unavailable: UnavailableError,
+  internal: InternalError
+};
+function codeForStatus(status) {
+  return STATUS_CODES[status] ?? (status >= 500 ? "internal" : "bad_request");
+}
+function errorFromResponse(args) {
+  const p = args.body && typeof args.body === "object" ? args.body : {};
+  const str = (v) => typeof v === "string" && v ? v : void 0;
+  const typeUri = str(p.type);
+  const code = str(p.title) ?? (typeUri ? typeUri.split("/").pop() : void 0) ?? codeForStatus(args.status);
+  const init = {
+    status: args.status,
+    code,
+    detail: str(p.detail) ?? (args.text ? args.text.slice(0, 500) : `HTTP ${args.status}`),
+    requestId: str(p.requestId) ?? args.requestId,
+    traceId: str(p.traceId) ?? args.traceId,
+    details: p.details && typeof p.details === "object" ? p.details : null,
+    type: typeUri ?? null,
+    retryAfterMs: args.retryAfterMs
+  };
+  if (code === "rate_limited" || code === "quota_exceeded") return new RateLimitError(init);
+  const Cls = CODE_CLASSES[code] ?? (args.status >= 500 ? InternalError : ApiError);
+  return new Cls(init);
+}
+
+// src/auth.ts
+var StaticTokenProvider = class {
+  constructor(token) {
+    this.token = token;
+    if (!token) throw new ConfigurationError("Token must be a non-empty string");
+  }
+  token;
+  refreshable = false;
+  async getToken() {
+    return this.token;
+  }
+  invalidate() {
+  }
+};
+var UnauthenticatedProvider = class {
+  refreshable = false;
+  async getToken() {
+    throw new ConfigurationError("This client is unauthenticated: only login() and refreshSession() are available. Create a client with credentials (e.g. staticToken(loginResult.accessToken)).");
+  }
+  invalidate() {
+  }
+};
+function unauthenticated() {
+  return new UnauthenticatedProvider();
+}
+function apiKey(key) {
+  return new StaticTokenProvider(key);
+}
+function staticToken(token) {
+  return new StaticTokenProvider(token);
+}
+var OAuthTokenProvider = class {
+  refreshable = true;
+  cached = null;
+  inflight = null;
+  generation = 0;
+  /** Whether the grant may be retried on 5xx/network errors. */
+  idempotentGrant = true;
+  async getToken(ctx, signal) {
+    const now = ctx.clock.now();
+    if (this.cached && now < this.cached.refreshAt) return this.cached.accessToken;
+    if (!this.inflight) {
+      const gen = this.generation;
+      const p = this.fetchToken(ctx).then((t) => {
+        if (gen === this.generation) this.cached = t;
+        return t;
+      }).finally(() => {
+        if (this.inflight === p) this.inflight = null;
+      });
+      this.inflight = p;
+    }
+    const token = await raceAbort(this.inflight, signal);
+    return token.accessToken;
+  }
+  invalidate() {
+    this.generation++;
+    this.cached = null;
+    this.inflight = null;
+  }
+  async fetchToken(ctx) {
+    const started = ctx.clock.now();
+    const r = await ctx.requestToken(() => this.grant(ctx), { idempotent: this.idempotentGrant });
+    const ttlMs = Math.max(0, Number(r.expires_in ?? 0) * 1e3);
+    const skew = Math.min(6e4, ttlMs / 2);
+    return { accessToken: r.access_token, refreshAt: started + ttlMs - skew, scope: r.scope };
+  }
+};
+function raceAbort(p, signal) {
+  if (!signal) return p;
+  if (signal.aborted) return Promise.reject(abortReason(signal));
+  return new Promise((resolve, reject) => {
+    const onAbort = () => reject(abortReason(signal));
+    signal.addEventListener("abort", onAbort, { once: true });
+    p.then(
+      (v) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(v);
+      },
+      (e) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(e);
+      }
+    );
+  });
+}
+var ClientSecretProvider = class extends OAuthTokenProvider {
+  constructor(o) {
+    super();
+    this.o = o;
+    if (!o.clientSecret) throw new ConfigurationError("clientSecret is required");
+  }
+  o;
+  async grant() {
+    return {
+      grant_type: "client_credentials",
+      client_secret: this.o.clientSecret,
+      ...this.o.clientId ? { client_id: this.o.clientId } : {},
+      ...this.o.scope ? { scope: this.o.scope } : {}
+    };
+  }
+};
+function clientSecret(options) {
+  return new ClientSecretProvider(options);
+}
+var OID_ED25519 = [6, 3, 43, 101, 112];
+var OID_EC_PUBLIC_KEY = [6, 7, 42, 134, 72, 206, 61, 2, 1];
+var OID_P256 = [6, 8, 42, 134, 72, 206, 61, 3, 1, 7];
+var OID_RSA = [6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1];
+function contains(hay, needle) {
+  outer: for (let i = 0; i + needle.length <= hay.length; i++) {
+    for (let j = 0; j < needle.length; j++) if (hay[i + j] !== needle[j]) continue outer;
+    return true;
+  }
+  return false;
+}
+function pemToDer(pem) {
+  if (/BEGIN (EC |RSA |ENCRYPTED )PRIVATE KEY/.test(pem)) throw new ConfigurationError('Private key must be an unencrypted PKCS#8 PEM ("BEGIN PRIVATE KEY"); convert with `openssl pkcs8 -topk8 -nocrypt`');
+  const m = /-----BEGIN PRIVATE KEY-----([\s\S]+?)-----END PRIVATE KEY-----/.exec(pem);
+  if (!m) throw new ConfigurationError('Private key must be a PKCS#8 PEM ("BEGIN PRIVATE KEY") or a private JWK');
+  return base64Decode(m[1].replace(/\s+/g, ""));
+}
+function base64Decode(b64) {
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function base64url(data) {
+  const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var ALGS = {
+  EdDSA: { importParams: { name: "Ed25519" }, signParams: { name: "Ed25519" } },
+  ES256: { importParams: { name: "ECDSA", namedCurve: "P-256" }, signParams: { name: "ECDSA", hash: "SHA-256" } },
+  RS256: { importParams: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, signParams: { name: "RSASSA-PKCS1-v1_5" } }
+};
+function inferAlgorithm(key) {
+  if (typeof key === "string") {
+    const der = pemToDer(key);
+    if (contains(der, OID_ED25519)) return "EdDSA";
+    if (contains(der, OID_EC_PUBLIC_KEY)) {
+      if (!contains(der, OID_P256)) throw new ConfigurationError("Only the P-256 curve is supported for EC keys");
+      return "ES256";
+    }
+    if (contains(der, OID_RSA)) return "RS256";
+    throw new ConfigurationError("Unsupported private key type (use Ed25519, P-256 or RSA)");
+  }
+  if (key.kty === "OKP" && key.crv === "Ed25519") return "EdDSA";
+  if (key.kty === "EC" && key.crv === "P-256") return "ES256";
+  if (key.kty === "RSA") return "RS256";
+  throw new ConfigurationError("Unsupported JWK (use OKP/Ed25519, EC/P-256 or RSA)");
+}
+async function importSigningKey(key, alg) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) throw new ConfigurationError("WebCrypto (globalThis.crypto.subtle) is required for private_key_jwt");
+  if (typeof key === "string") return subtle.importKey("pkcs8", pemToDer(key), ALGS[alg].importParams, false, ["sign"]);
+  if (!key.d) throw new ConfigurationError('JWK must contain the private key ("d")');
+  const { kty, crv, x, y, d, n, e, p, q, dp, dq, qi } = key;
+  const jwk = Object.fromEntries(Object.entries({ kty, crv, x, y, d, n, e, p, q, dp, dq, qi }).filter(([, v]) => v !== void 0));
+  return subtle.importKey("jwk", jwk, ALGS[alg].importParams, false, ["sign"]);
+}
+async function createClientAssertion(args) {
+  const lifetime = args.lifetimeSeconds ?? 60;
+  if (!(lifetime > 0 && lifetime <= 300)) throw new ConfigurationError("Assertion lifetime must be between 1 and 300 seconds");
+  const iat = Math.floor(args.nowMs / 1e3);
+  const header = { alg: args.algorithm, typ: "JWT", kid: args.credentialId };
+  const claims = { iss: args.credentialId, sub: args.credentialId, aud: args.audience, iat, exp: iat + lifetime, jti: globalThis.crypto.randomUUID() };
+  const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(claims))}`;
+  const sig = await args.sign(new TextEncoder().encode(signingInput));
+  return `${signingInput}.${base64url(sig)}`;
+}
+var PrivateKeyJwtProvider = class extends OAuthTokenProvider {
+  constructor(o) {
+    super();
+    this.o = o;
+    if (!o.credentialId) throw new ConfigurationError("credentialId is required");
+    const lifetime = o.lifetimeSeconds ?? 60;
+    if (!(lifetime > 0 && lifetime <= 300)) throw new ConfigurationError("lifetimeSeconds must be between 1 and 300 (server maximum is 5 minutes)");
+    if (o.signer) {
+      if (!o.algorithm) throw new ConfigurationError("algorithm is required with a custom signer");
+      this.alg = o.algorithm;
+      this.signer = o.signer;
+      return;
+    }
+    const key = o.privateKey;
+    if (!key) throw new ConfigurationError("privateKey or signer is required");
+    if (typeof key === "string" || !("type" in key && "algorithm" in key)) this.alg = o.algorithm ?? inferAlgorithm(key);
+    else {
+      const name = key.algorithm.name;
+      this.alg = o.algorithm ?? (name === "Ed25519" ? "EdDSA" : name === "ECDSA" ? "ES256" : "RS256");
+    }
+    let imported = null;
+    this.signer = async (data) => {
+      const k = typeof key === "string" || !("algorithm" in key) ? await (imported ??= importSigningKey(key, this.alg)) : key;
+      return new Uint8Array(await globalThis.crypto.subtle.sign(ALGS[this.alg].signParams, k, data));
+    };
+  }
+  o;
+  alg;
+  signer;
+  async grant(ctx) {
+    const assertion = await createClientAssertion({
+      credentialId: this.o.credentialId,
+      audience: this.o.audience ?? ctx.tokenUrl,
+      algorithm: this.alg,
+      sign: this.signer,
+      nowMs: ctx.clock.now(),
+      ...this.o.lifetimeSeconds ? { lifetimeSeconds: this.o.lifetimeSeconds } : {}
+    });
+    return {
+      grant_type: "client_credentials",
+      client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+      client_assertion: assertion,
+      ...this.o.scope ? { scope: this.o.scope } : {}
+    };
+  }
+};
+function privateKeyJwt(options) {
+  return new PrivateKeyJwtProvider(options);
+}
+var DelegationProvider = class extends OAuthTokenProvider {
+  constructor(o) {
+    super();
+    this.o = o;
+    if (!o.subjectToken) throw new ConfigurationError("subjectToken is required");
+  }
+  o;
+  async grant(ctx, signal) {
+    return {
+      grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+      subject_token: this.o.subjectToken,
+      actor_token: await this.o.actor.getToken(ctx, signal),
+      ...this.o.scope ? { scope: this.o.scope } : {}
+    };
+  }
+};
+function delegation(options) {
+  return new DelegationProvider(options);
+}
+
+// src/version.ts
+var VERSION = "0.2.1";
+
+// src/http.ts
+var hex = (bytes) => {
+  const b = new Uint8Array(bytes);
+  globalThis.crypto.getRandomValues(b);
+  return Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+};
+var TRACEPARENT = /^[0-9a-f]{2}-([0-9a-f]{32})-[0-9a-f]{16}-[0-9a-f]{2}$/;
+function parseRetryAfter(value, now) {
+  if (!value) return null;
+  const v = value.trim();
+  if (/^\d+(\.\d+)?$/.test(v)) return Math.round(Number(v) * 1e3);
+  const at = Date.parse(v);
+  return Number.isNaN(at) ? null : Math.max(0, at - now);
+}
+function backoffDelay(attempt, o, random) {
+  const d = Math.min(o.maxDelayMs, o.baseDelayMs * 2 ** attempt);
+  return d / 2 + random() * (d / 2);
+}
+function joinUrl(base, path, query) {
+  let url = base.replace(/\/+$/, "") + path;
+  if (query) {
+    const qs = new URLSearchParams();
+    for (const [k, v] of Object.entries(query)) if (v !== void 0 && v !== null) qs.set(k, String(v));
+    const s = qs.toString();
+    if (s) url += `?${s}`;
+  }
+  return url;
+}
+var HttpCore = class {
+  constructor(o) {
+    this.o = o;
+    this.authContext = {
+      tokenUrl: o.tokenUrl,
+      clock: o.clock,
+      requestToken: async (buildBody, opts) => (await this.request({
+        method: "POST",
+        base: "api",
+        path: "",
+        url: o.tokenUrl,
+        idempotent: opts.idempotent,
+        buildBody,
+        ...opts.signal ? { signal: opts.signal } : {}
+      })).body
+    };
+  }
+  o;
+  authContext;
+  async request(spec) {
+    const url = spec.url ?? joinUrl(spec.base === "gateway" ? this.o.gatewayUrl : this.o.apiUrl, spec.path, spec.query);
+    const maxRetries = spec.maxRetries ?? this.o.maxRetries;
+    const incoming = spec.traceparent ? TRACEPARENT.exec(spec.traceparent) : null;
+    const traceId = incoming?.[1] ?? hex(16);
+    const idempotent = !spec.neverRetry && (spec.idempotent || !!spec.idempotencyKey);
+    let attempt = 0;
+    let replayed401 = false;
+    for (; ; ) {
+      if (spec.signal?.aborted) throw abortReason(spec.signal);
+      const headers = { accept: "application/json", ...this.o.headers, ...spec.headers, traceparent: `00-${traceId}-${hex(8)}-01` };
+      if (spec.idempotencyKey) headers["idempotency-key"] = spec.idempotencyKey;
+      if (this.o.userAgent) headers["user-agent"] = this.o.userAgent;
+      if (spec.auth) headers.authorization = `Bearer ${await spec.auth.getToken(this.authContext, spec.signal)}`;
+      const payload = spec.buildBody ? await spec.buildBody() : spec.body;
+      if (payload !== void 0) headers["content-type"] = "application/json";
+      let res;
+      try {
+        res = await this.fetchAttempt(url, spec.method, headers, payload === void 0 ? void 0 : JSON.stringify(payload), spec.timeoutMs ?? this.o.timeoutMs, spec.signal);
+      } catch (err) {
+        if (spec.signal?.aborted) throw abortReason(spec.signal);
+        if (idempotent && attempt < maxRetries) {
+          await this.o.clock.sleep(backoffDelay(attempt++, this.o, this.o.random), spec.signal);
+          continue;
+        }
+        throw err;
+      }
+      const text = await res.text().catch(() => "");
+      let body = void 0;
+      if (text && /json/i.test(res.headers.get("content-type") ?? "")) {
+        try {
+          body = JSON.parse(text);
+        } catch {
+          body = void 0;
+        }
+      }
+      if (res.ok && spec.responseType === "text") return { status: res.status, body: text, headers: res.headers };
+      if (res.ok || body !== void 0 && spec.terminalBody?.(res.status, body)) return { status: res.status, body, headers: res.headers };
+      if (res.status === 401 && spec.auth?.refreshable && !replayed401) {
+        spec.auth.invalidate();
+        replayed401 = true;
+        continue;
+      }
+      const retryAfterMs = parseRetryAfter(res.headers.get("retry-after"), this.o.clock.now());
+      const respTrace = TRACEPARENT.exec(res.headers.get("traceparent") ?? "");
+      const special = body !== void 0 ? spec.bodyError?.(res.status, body, { requestId: res.headers.get("x-request-id"), traceId: respTrace?.[1] ?? null }) : void 0;
+      if (special) throw special;
+      const error = errorFromResponse({ status: res.status, body, text, requestId: res.headers.get("x-request-id"), traceId: respTrace?.[1] ?? null, retryAfterMs });
+      const retryable = res.status === 429 || idempotent && (res.status === 502 || res.status === 503 || res.status === 504);
+      if (!retryable || attempt >= maxRetries) throw error;
+      if (retryAfterMs !== null && retryAfterMs > this.o.maxRetryAfterMs) throw error;
+      await this.o.clock.sleep(retryAfterMs ?? backoffDelay(attempt, this.o, this.o.random), spec.signal);
+      attempt++;
+    }
+  }
+  async fetchAttempt(url, method, headers, body, timeoutMs, signal) {
+    const ctrl = new AbortController();
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      ctrl.abort();
+    }, timeoutMs);
+    const onAbort = () => ctrl.abort(signal.reason);
+    signal?.addEventListener("abort", onAbort, { once: true });
+    try {
+      const res = await this.o.fetch(url, { method, headers, ...body !== void 0 ? { body } : {}, signal: ctrl.signal });
+      return res;
+    } catch (err) {
+      if (signal?.aborted) throw abortReason(signal);
+      if (timedOut) throw new TimeoutError({ status: 0, code: "timeout", detail: `No response within ${timeoutMs} ms`, cause: err });
+      if (err instanceof GebSecureError) throw err;
+      throw new ConnectionError(err instanceof Error ? err.message : String(err), err);
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+    }
+  }
+};
+var DEFAULT_USER_AGENT = `gebsecure-typescript/${VERSION}`;
+
+// src/client.ts
+var env = (name) => {
+  const p = globalThis.process;
+  return p?.env?.[name] || void 0;
+};
+var isNode = () => typeof globalThis.process?.versions?.node === "string";
+var seg = (id) => {
+  if (!id) throw new ConfigurationError("id must be a non-empty string");
+  return encodeURIComponent(id);
+};
+var ACTIVE_EXECUTION = /* @__PURE__ */ new Set(["awaiting_approval", "pending", "running", "cancelling"]);
+var GRANTED_APPROVAL = /* @__PURE__ */ new Set(["approved", "consumed"]);
+var isExecuteResult = (_status, body) => !!body && typeof body === "object" && typeof body.status === "string" && "decision" in body;
+var newIdempotencyKey = () => `sdk-${globalThis.crypto.randomUUID()}`;
+var isObject = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isDeployReport = (status, body) => status === 412 && isObject(body) && typeof body.deployed === "boolean";
+var simulationFailure = (status, body, meta) => status === 422 && isObject(body) && typeof body.status === "string" && isObject(body.summary) && Array.isArray(body.results) ? new SimulationFailedError(body, meta) : void 0;
+var GebSecure = class _GebSecure {
+  gatewayUrl;
+  apiUrl;
+  core;
+  auth;
+  clock;
+  maxRetries;
+  options;
+  constructor(options = {}) {
+    this.options = options;
+    this.gatewayUrl = (options.gatewayUrl ?? env("GEBSECURE_GATEWAY_URL") ?? "https://gateway.gebsecure.dev").replace(/\/+$/, "");
+    this.apiUrl = (options.apiUrl ?? env("GEBSECURE_API_URL") ?? "https://api.gebsecure.dev").replace(/\/+$/, "");
+    const key = options.apiKey ?? (options.auth ? void 0 : env("GEBSECURE_API_KEY"));
+    const secret = options.auth || key ? void 0 : env("GEBSECURE_CLIENT_SECRET");
+    const auth = options.auth ?? (key ? apiKey(key) : secret ? clientSecret({ clientSecret: secret }) : void 0);
+    if (!auth) throw new ConfigurationError("No credentials: pass `auth` or `apiKey`, or set GEBSECURE_API_KEY / GEBSECURE_CLIENT_SECRET");
+    this.auth = auth;
+    this.clock = options.clock ?? systemClock;
+    this.maxRetries = options.maxRetries ?? 3;
+    const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+    if (!fetchImpl) throw new ConfigurationError("No fetch implementation available; pass `fetch`");
+    this.core = new HttpCore({
+      gatewayUrl: this.gatewayUrl,
+      apiUrl: this.apiUrl,
+      tokenUrl: options.tokenUrl ?? `${this.apiUrl}/v1/auth/token`,
+      timeoutMs: options.timeoutMs ?? 3e4,
+      maxRetries: this.maxRetries,
+      baseDelayMs: options.baseDelayMs ?? 500,
+      maxDelayMs: options.maxDelayMs ?? 8e3,
+      maxRetryAfterMs: options.maxRetryAfterMs ?? 6e4,
+      fetch: fetchImpl,
+      clock: this.clock,
+      // eslint-disable-next-line no-restricted-properties -- retry jitter only; never security-relevant
+      random: options.random ?? Math.random,
+      userAgent: options.userAgent ?? (isNode() ? DEFAULT_USER_AGENT : ""),
+      headers: options.headers ?? {}
+    });
+  }
+  /** A client with the same configuration acting under a delegation token (RFC 8693 exchange). */
+  withDelegation(subjectToken, opts = {}) {
+    return new _GebSecure({ ...this.options, gatewayUrl: this.gatewayUrl, apiUrl: this.apiUrl, auth: delegation({ subjectToken, actor: this.auth, ...opts }) });
+  }
+  /** Returns a valid access token (cached/refreshed), e.g. to call GebSecure APIs not wrapped by the SDK. */
+  getAccessToken(opts = {}) {
+    return this.auth.getToken(this.core.authContext, opts.signal);
+  }
+  async call(spec, opts = {}) {
+    return (await this.core.request({ ...opts, ...spec, auth: this.auth })).body;
+  }
+  /** Calls an operation that returns no body (204); resolves to `undefined`. */
+  async callVoid(spec, opts = {}) {
+    await this.core.request({ ...opts, ...spec, auth: this.auth });
+  }
+  /** Unauthenticated session endpoints (login/refresh): no Authorization header. */
+  async callAnonymous(spec, opts = {}) {
+    return (await this.core.request({ ...opts, ...spec })).body;
+  }
+  // ─── Decisions ──────────────────────────────────────────────────────────────
+  /** Decides whether the principal may perform an action. DENY / APPROVAL_REQUIRED are results, not errors. */
+  authorize(request, opts) {
+    return this.call({ method: "POST", base: "gateway", path: "/v1/authorize", body: request, idempotent: request.dryRun === true }, opts);
+  }
+  /** Evaluates up to 100 requests in one call. */
+  authorizeBatch(request, opts) {
+    const idempotent = request.requests.length > 0 && request.requests.every((r) => r.dryRun === true);
+    return this.call({ method: "POST", base: "gateway", path: "/v1/authorize/batch", body: request, idempotent }, opts);
+  }
+  /** Convenience around `authorize`: `allowed` is true only for ALLOW. Never throws on DENY. */
+  async guard(action, resource, context, opts) {
+    const { signal, traceparent, timeoutMs, maxRetries, headers, ...rest } = opts ?? {};
+    const decision = await this.authorize({ ...rest, action, resource, ...context ? { context } : {} }, { signal, traceparent, timeoutMs, maxRetries, headers });
+    return { allowed: decision.decision === "ALLOW", decision };
+  }
+  // ─── Execution ──────────────────────────────────────────────────────────────
+  /**
+   * Authorizes and executes a connector action. Returns an `ExecuteResult` for succeeded, simulated,
+   * awaiting_approval, running, denied (HTTP 403) and failed (HTTP 502/504) outcomes; problem+json errors throw.
+   * With retries enabled, an idempotency key is generated when none is given.
+   */
+  execute(request, opts = {}) {
+    const retries = opts.maxRetries ?? this.maxRetries;
+    const body = !request.idempotencyKey && retries > 0 && !request.dryRun ? { ...request, idempotencyKey: newIdempotencyKey() } : request;
+    return this.call({ method: "POST", base: "gateway", path: "/v1/execute", body, idempotent: !!body.idempotencyKey || body.dryRun === true, terminalBody: isExecuteResult }, opts);
+  }
+  /** Execution status, result and step logs. */
+  getExecution(id, opts) {
+    return this.call({ method: "GET", base: "gateway", path: `/v1/executions/${seg(id)}`, idempotent: true }, opts);
+  }
+  /** Lists executions visible to the caller. */
+  listExecutions(params = {}, opts) {
+    return this.call({ method: "GET", base: "gateway", path: "/v1/executions", query: { ...params }, idempotent: true }, opts);
+  }
+  /** Cancels a pending, awaiting-approval or running execution. */
+  cancelExecution(id, opts) {
+    return this.call({ method: "POST", base: "gateway", path: `/v1/executions/${seg(id)}/cancel`, idempotent: true }, opts);
+  }
+  // ─── Approvals ──────────────────────────────────────────────────────────────
+  /** Status of an approval request (agent-facing, via the gateway). */
+  getApproval(id, opts) {
+    return this.call({ method: "GET", base: "gateway", path: `/v1/approvals/${seg(id)}`, idempotent: true }, opts);
+  }
+  /** Polls an approval until it leaves `pending`; returns it in its terminal state. */
+  async waitForApproval(id, opts = {}) {
+    const { timeoutMs = 6e5, pollIntervalMs = 2e3, ...req } = opts;
+    const deadline = this.clock.now() + timeoutMs;
+    for (; ; ) {
+      const a = await this.getApproval(id, req);
+      if (a.status !== "pending") return a;
+      const remaining = deadline - this.clock.now();
+      if (remaining <= 0) throw new ApprovalTimeoutError(id, timeoutMs);
+      await this.clock.sleep(Math.min(pollIntervalMs, remaining), req.signal);
+    }
+  }
+  /**
+   * Executes; if human approval is required, waits for it and then follows the execution until it is
+   * terminal. Once the approval is granted the platform resumes the stored execution itself (and consumes
+   * the single-use approval), so this helper never re-executes (conformance §5).
+   * Throws `ApprovalNotGrantedError` when the approval is rejected/expired/cancelled,
+   * `ApprovalTimeoutError` when it stays pending past `timeoutMs`, and `TimeoutError` when the approved
+   * execution has not finished by then. A resumed execution that fails is returned with `status: 'failed'`.
+   */
+  async executeWithApproval(request, opts = {}) {
+    const { timeoutMs = 6e5, pollIntervalMs = 2e3, ...req } = opts;
+    const deadline = this.clock.now() + timeoutMs;
+    const base = request.idempotencyKey || request.dryRun ? request : { ...request, idempotencyKey: newIdempotencyKey() };
+    const first = await this.execute(base, req);
+    if (first.status !== "awaiting_approval" || !first.approval || !first.executionId) return first;
+    const approval = await this.waitForApproval(first.approval.id, { ...req, timeoutMs: Math.max(0, deadline - this.clock.now()), pollIntervalMs });
+    if (!GRANTED_APPROVAL.has(approval.status)) throw new ApprovalNotGrantedError(approval);
+    for (; ; ) {
+      const e = await this.getExecution(first.executionId, req);
+      if (!ACTIVE_EXECUTION.has(e.status)) {
+        return {
+          executionId: e.id,
+          status: e.status,
+          decision: e.decision ?? first.decision,
+          reason: e.error?.message ?? first.reason ?? "",
+          output: e.output,
+          outputTruncated: e.outputTruncated ?? false,
+          error: e.error ?? null,
+          approval: first.approval,
+          risk: first.risk,
+          durationMs: e.durationMs ?? 0,
+          replayed: true
+        };
+      }
+      const remaining = deadline - this.clock.now();
+      if (remaining <= 0) throw new TimeoutError({ status: 0, code: "timeout", detail: `Execution ${first.executionId} still ${e.status} after ${timeoutMs} ms` });
+      await this.clock.sleep(Math.min(pollIntervalMs, remaining), req.signal);
+    }
+  }
+  // ─── Control plane ──────────────────────────────────────────────────────────
+  /** Agent directory. */
+  listAgents(params = {}, opts) {
+    return this.call({ method: "GET", base: "api", path: "/v1/agents", query: { ...params }, idempotent: true }, opts);
+  }
+  /** One agent, including credential metadata. */
+  getAgent(id, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/agents/${seg(id)}`, idempotent: true }, opts);
+  }
+  /** Policies. */
+  listPolicies(params = {}, opts) {
+    return this.call({ method: "GET", base: "api", path: "/v1/policies", query: { ...params }, idempotent: true }, opts);
+  }
+  /** Approval requests (`inbox: true` = those the caller can act on). */
+  listApprovals(params = {}, opts) {
+    return this.call({ method: "GET", base: "api", path: "/v1/approvals", query: { ...params }, idempotent: true }, opts);
+  }
+  /** Delegates a subset of authority to another agent. The returned `token` (gsd_…) is shown once. */
+  createDelegation(request, opts) {
+    return this.call({ method: "POST", base: "api", path: "/v1/delegations", body: request, idempotent: false }, opts);
+  }
+  // ─── Runtime: inspection, DLP, agent spans, simulation ──────────────────────
+  /**
+   * Inspects untrusted content (web page, email, RAG chunk, tool output) before the agent reads it:
+   * prompt-injection score/level/action, a sanitized form, and inbound DLP. Hand `result.content`
+   * (null when blocked) to the model instead of the original.
+   */
+  inspect(request, opts) {
+    return this.call({ method: "POST", base: "gateway", path: "/v1/inspect", body: request, idempotent: false }, opts);
+  }
+  /** Scans a payload for sensitive data and applies DLP rules. Retried like a read only when `dryRun` is true. */
+  dlpScan(request, opts) {
+    return this.call({ method: "POST", base: "gateway", path: "/v1/dlp/scan", body: request, idempotent: request.dryRun === true }, opts);
+  }
+  /** Reports agent-side spans (see `buildSpan`) into the shared trace. Safe to retry: duplicates are ignored. */
+  reportSpans(spans, opts) {
+    const body = Array.isArray(spans) ? { spans } : spans;
+    return this.call({ method: "POST", base: "gateway", path: "/v1/traces/spans", body, idempotent: true }, opts);
+  }
+  /**
+   * Runs simulation scenarios (nothing is executed). With `failOnMismatch: true`, a failed or errored run
+   * throws `SimulationFailedError` whose `run` is the full typed result.
+   */
+  runSimulation(request, opts) {
+    return this.call({ method: "POST", base: "api", path: "/v1/simulations/run", body: request, idempotent: request.persist === false, bodyError: simulationFailure }, opts);
+  }
+  // ─── Session auth (users) ───────────────────────────────────────────────────
+  /** Logs a user in (works on an `unauthenticated()` client). The refresh token is returned in the body. */
+  login(request, opts) {
+    return this.callAnonymous({ method: "POST", base: "api", path: "/v1/auth/login", body: { ...request, refreshTokenDelivery: "body" }, idempotent: false }, opts);
+  }
+  /** Exchanges a refresh token for new tokens. The refresh token rotates: persist the returned one. Never retried (except 429). */
+  refreshSession(refreshToken, opts) {
+    return this.callAnonymous({ method: "POST", base: "api", path: "/v1/auth/refresh", body: { refreshToken }, idempotent: false, neverRetry: true }, opts);
+  }
+  /** Revokes the current user session. */
+  logout(opts) {
+    return this.callVoid({ method: "POST", base: "api", path: "/v1/auth/logout", idempotent: false }, opts);
+  }
+  /** The authenticated principal, its organizations and effective permissions. */
+  me(opts) {
+    return this.call({ method: "GET", base: "api", path: "/v1/auth/me", idempotent: true }, opts);
+  }
+  // ─── Policies ───────────────────────────────────────────────────────────────
+  /** A policy with its versions, latest version and tests. */
+  getPolicy(id, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/policies/${seg(id)}`, idempotent: true }, opts);
+  }
+  /** Creates a policy (draft version 1) from GSL source or a template. */
+  createPolicy(request, opts) {
+    return this.call({ method: "POST", base: "api", path: "/v1/policies", body: request, idempotent: false }, opts);
+  }
+  /** Saves a new version. Not retried on 5xx/network errors: every call appends a version. */
+  updatePolicy(id, request, opts) {
+    return this.call({ method: "PUT", base: "api", path: `/v1/policies/${seg(id)}`, body: request, idempotent: false }, opts);
+  }
+  /** Archives a policy (stops enforcing it). */
+  deletePolicy(id, opts) {
+    return this.callVoid({ method: "DELETE", base: "api", path: `/v1/policies/${seg(id)}`, idempotent: true }, opts);
+  }
+  /** Validates, lints and formats GSL source. */
+  validatePolicy(source, opts) {
+    return this.call({ method: "POST", base: "api", path: "/v1/policies/validate", body: { source }, idempotent: true }, opts);
+  }
+  /** One immutable policy version. */
+  getPolicyVersion(id, versionId, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/policies/${seg(id)}/versions/${seg(versionId)}`, idempotent: true }, opts);
+  }
+  /** Semantic and unified diff between two versions. */
+  diffPolicyVersions(id, from, to, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/policies/${seg(id)}/diff`, query: { from, to }, idempotent: true }, opts);
+  }
+  /** Deploy and rollback history. */
+  listPolicyDeployments(id, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/policies/${seg(id)}/deployments`, idempotent: true }, opts);
+  }
+  /**
+   * Deploys a version (default: latest). When tests fail or blocking conflicts exist the server answers
+   * 412 with the deploy report; it is returned as a result with `deployed: false`.
+   */
+  deployPolicy(id, request = {}, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/policies/${seg(id)}/deploy`, body: request, idempotent: false, terminalBody: isDeployReport }, opts);
+  }
+  /** Rolls back to a version (default: the previously deployed one). */
+  rollbackPolicy(id, request = {}, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/policies/${seg(id)}/rollback`, body: request, idempotent: false }, opts);
+  }
+  /** Adds one test case. */
+  addPolicyTest(id, test, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/policies/${seg(id)}/tests`, body: test, idempotent: false }, opts);
+  }
+  /** Replaces the whole test suite atomically (policy-as-code sync). */
+  replacePolicyTests(id, tests, opts) {
+    return this.call({ method: "PUT", base: "api", path: `/v1/policies/${seg(id)}/tests`, body: { tests }, idempotent: true }, opts);
+  }
+  /** Deletes one test case. */
+  deletePolicyTest(id, testId, opts) {
+    return this.callVoid({ method: "DELETE", base: "api", path: `/v1/policies/${seg(id)}/tests/${seg(testId)}`, idempotent: true }, opts);
+  }
+  /** Runs the policy's tests against a version (default: latest). */
+  runPolicyTests(id, versionId, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/policies/${seg(id)}/tests/run`, body: versionId ? { versionId } : {}, idempotent: true }, opts);
+  }
+  /** Evaluates requests against deployed vs candidate policies. */
+  simulatePolicies(request, opts) {
+    return this.call({ method: "POST", base: "api", path: "/v1/policies/simulate", body: request, idempotent: true }, opts);
+  }
+  // ─── Agents & credentials ───────────────────────────────────────────────────
+  /** Registers an agent; with `credential`, its client secret is returned once in `credential.clientSecret`. */
+  createAgent(request, opts) {
+    return this.call({ method: "POST", base: "api", path: "/v1/agents", body: request, idempotent: false }, opts);
+  }
+  /** Updates agent metadata. */
+  updateAgent(id, request, opts) {
+    return this.call({ method: "PATCH", base: "api", path: `/v1/agents/${seg(id)}`, body: request, idempotent: false }, opts);
+  }
+  /** Activates, suspends, disables or quarantines an agent. */
+  setAgentStatus(id, request, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/agents/${seg(id)}/status`, body: request, idempotent: false }, opts);
+  }
+  /** Deletes an agent. */
+  deleteAgent(id, opts) {
+    return this.callVoid({ method: "DELETE", base: "api", path: `/v1/agents/${seg(id)}`, idempotent: true }, opts);
+  }
+  /** Credential metadata of an agent (never secrets). */
+  listAgentCredentials(id, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/agents/${seg(id)}/credentials`, idempotent: true }, opts);
+  }
+  /** Issues an agent credential; the client secret is returned once. */
+  createAgentCredential(id, request = {}, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/agents/${seg(id)}/credentials`, body: request, idempotent: false }, opts);
+  }
+  /** Rotates a credential; the previous one keeps working until `previous.graceUntil`. */
+  rotateCredential(credentialId, request = {}, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/credentials/${seg(credentialId)}/rotate`, body: request, idempotent: false }, opts);
+  }
+  /** Revokes a credential immediately (idempotent). */
+  revokeCredential(credentialId, reason, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/credentials/${seg(credentialId)}/revoke`, body: reason !== void 0 ? { reason } : {}, idempotent: true }, opts);
+  }
+  // ─── Secrets (values are write-only) ────────────────────────────────────────
+  /** Stores a secret. The value is never returned by the API and never logged by the SDK. */
+  createSecret(request, opts) {
+    return this.call({ method: "POST", base: "api", path: "/v1/secrets", body: request, idempotent: false }, opts);
+  }
+  /** Secret metadata and masks. */
+  listSecrets(params = {}, opts) {
+    return this.call({ method: "GET", base: "api", path: "/v1/secrets", query: { ...params }, idempotent: true }, opts);
+  }
+  /** One secret's metadata and version history (never the value). */
+  getSecret(id, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/secrets/${seg(id)}`, idempotent: true }, opts);
+  }
+  /** Updates secret metadata, access policy, expiry, rotation policy or status. */
+  updateSecret(id, request, opts) {
+    return this.call({ method: "PATCH", base: "api", path: `/v1/secrets/${seg(id)}`, body: request, idempotent: false }, opts);
+  }
+  /** Writes a new version (a value, or `generate`). */
+  rotateSecret(id, request, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/secrets/${seg(id)}/rotate`, body: request, idempotent: false }, opts);
+  }
+  /** Revokes one version or the whole secret. */
+  revokeSecret(id, request = {}, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/secrets/${seg(id)}/revoke`, body: request, idempotent: false }, opts);
+  }
+  /** Deletes a secret. */
+  deleteSecret(id, opts) {
+    return this.callVoid({ method: "DELETE", base: "api", path: `/v1/secrets/${seg(id)}`, idempotent: true }, opts);
+  }
+  // ─── Connectors & connections ───────────────────────────────────────────────
+  /** The connector catalog (actions, schemas, risk metadata, auth methods). */
+  listConnectors(opts) {
+    return this.call({ method: "GET", base: "api", path: "/v1/connectors", idempotent: true }, opts);
+  }
+  /** One connector of the catalog. */
+  getConnector(key, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/connectors/${seg(key)}`, idempotent: true }, opts);
+  }
+  /** Installed connections. */
+  listConnections(params = {}, opts) {
+    return this.call({ method: "GET", base: "api", path: "/v1/connections", query: { ...params }, idempotent: true }, opts);
+  }
+  /** One connection with its connector description and effective allowed hosts. */
+  getConnection(id, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/connections/${seg(id)}`, idempotent: true }, opts);
+  }
+  /** Installs a connector into a project. */
+  createConnection(request, opts) {
+    return this.call({ method: "POST", base: "api", path: "/v1/connections", body: request, idempotent: false }, opts);
+  }
+  /** Updates a connection. */
+  updateConnection(id, request, opts) {
+    return this.call({ method: "PATCH", base: "api", path: `/v1/connections/${seg(id)}`, body: request, idempotent: false }, opts);
+  }
+  /** Deletes a connection. */
+  deleteConnection(id, opts) {
+    return this.callVoid({ method: "DELETE", base: "api", path: `/v1/connections/${seg(id)}`, idempotent: true }, opts);
+  }
+  /** Runs the connection health check. */
+  checkConnectionHealth(id, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/connections/${seg(id)}/health`, idempotent: true }, opts);
+  }
+  /** Begins an OAuth installation (authorization code + PKCE); redirect the user to `authorizationUrl`. */
+  startConnectionOAuth(id, request, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/connections/${seg(id)}/oauth/start`, body: request, idempotent: false }, opts);
+  }
+  /** Completes an OAuth installation with the `state` and `code` from the redirect. */
+  completeConnectionOAuth(request, opts) {
+    return this.call({ method: "POST", base: "api", path: "/v1/connections/oauth/callback", body: request, idempotent: false }, opts);
+  }
+  /** Installs with the OAuth client-credentials grant (machine-to-machine). */
+  installClientCredentials(id, request, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/connections/${seg(id)}/oauth/client-credentials`, body: request, idempotent: false }, opts);
+  }
+  /** Installs with the RFC 7523 JWT-bearer grant (e.g. a Google service account). */
+  installJwtBearer(id, request, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/connections/${seg(id)}/oauth/jwt-bearer`, body: request, idempotent: false }, opts);
+  }
+  // ─── Audit ──────────────────────────────────────────────────────────────────
+  /** Searches audit events (newest first); with `afterSeq`, tails the events after that sequence number (oldest first). */
+  searchAudit(params = {}, opts) {
+    return this.call({ method: "GET", base: "api", path: "/v1/audit/events", query: { ...params }, idempotent: true }, opts);
+  }
+  /** One audit event. */
+  getAuditEvent(id, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/audit/events/${seg(id)}`, idempotent: true }, opts);
+  }
+  /** Exports audit events; resolves to the raw body (ndjson by default, csv or json). */
+  exportAudit(params = {}, opts) {
+    return this.call({ method: "GET", base: "api", path: "/v1/audit/export", query: { ...params }, idempotent: true, responseType: "text" }, opts);
+  }
+  /** Verifies the integrity of the audit hash chain. */
+  verifyAudit(request = {}, opts) {
+    return this.call({ method: "POST", base: "api", path: "/v1/audit/verify", body: request, idempotent: true }, opts);
+  }
+  // ─── Approvals (reviewers) ──────────────────────────────────────────────────
+  /** Full approval record (control plane): steps, decisions, comments, history and `canDecide`. */
+  getApprovalDetails(id, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/approvals/${seg(id)}`, idempotent: true }, opts);
+  }
+  /** Approves or rejects; `snapshotHash` must be the hash of the request snapshot the reviewer saw. */
+  decideApproval(id, request, opts) {
+    return this.call({ method: "POST", base: "api", path: `/v1/approvals/${seg(id)}/decision`, body: request, idempotent: false }, opts);
+  }
+  // ─── Alerts ─────────────────────────────────────────────────────────────────
+  /** Security alerts. */
+  listAlerts(params = {}, opts) {
+    return this.call({ method: "GET", base: "api", path: "/v1/alerts", query: { ...params }, idempotent: true }, opts);
+  }
+  /** One alert with its investigation context. */
+  getAlert(id, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/alerts/${seg(id)}`, idempotent: true }, opts);
+  }
+  /** Acknowledges, assigns, annotates, resolves or dismisses an alert. */
+  updateAlert(id, request, opts) {
+    return this.call({ method: "PATCH", base: "api", path: `/v1/alerts/${seg(id)}`, body: request, idempotent: false }, opts);
+  }
+  // ─── Traces & session replay ────────────────────────────────────────────────
+  /** Searches traces. */
+  searchTraces(params = {}, opts) {
+    return this.call({ method: "GET", base: "api", path: "/v1/traces", query: { ...params }, idempotent: true }, opts);
+  }
+  /** One trace: platform and agent spans, correlated records, timeline and performance breakdown. */
+  getTrace(traceId, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/traces/${seg(traceId)}`, idempotent: true }, opts);
+  }
+  /** Everything a principal (agent or user) did in a window, step by step. */
+  replaySession(principalId, params = {}, opts) {
+    return this.call({ method: "GET", base: "api", path: `/v1/replay/${seg(principalId)}`, query: { ...params }, idempotent: true }, opts);
+  }
+};
+
+// src/spans.ts
+var TRACEPARENT2 = /^[0-9a-f]{2}-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}$/;
+var randomHex = (bytes) => {
+  const b = new Uint8Array(bytes);
+  globalThis.crypto.getRandomValues(b);
+  return Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+};
+var ms = (t) => t instanceof Date ? t.getTime() : t;
+function buildSpan(name, start, end, options = {}) {
+  const parent = options.traceparent ? TRACEPARENT2.exec(options.traceparent) : null;
+  const startMs = ms(start);
+  const span = {
+    traceId: parent?.[1] ?? randomHex(16),
+    spanId: options.spanId ?? randomHex(8),
+    name,
+    startTime: new Date(startMs).toISOString(),
+    durationMs: Math.max(0, ms(end) - startMs)
+  };
+  const parentSpanId = options.parentSpanId ?? parent?.[2];
+  if (parentSpanId) span.parentSpanId = parentSpanId;
+  if (options.kind) span.kind = options.kind;
+  if (options.status) span.status = options.status;
+  if (options.statusMessage !== void 0) span.statusMessage = options.statusMessage;
+  if (options.attributes) span.attributes = options.attributes;
+  if (options.events) span.events = options.events;
+  return span;
+}
+function traceparentOf(span) {
+  return `00-${span.traceId}-${span.spanId}-01`;
+}
+
+// src/generated/models.ts
+var AgentStatus = {
+  ACTIVE: "active",
+  SUSPENDED: "suspended",
+  DISABLED: "disabled",
+  QUARANTINED: "quarantined"
+};
+var AlertStatus = {
+  OPEN: "open",
+  ACKNOWLEDGED: "acknowledged",
+  INVESTIGATING: "investigating",
+  RESOLVED: "resolved",
+  DISMISSED: "dismissed"
+};
+var ApprovalStatus = {
+  PENDING: "pending",
+  APPROVED: "approved",
+  REJECTED: "rejected",
+  EXPIRED: "expired",
+  CANCELLED: "cancelled",
+  CONSUMED: "consumed"
+};
+var ApprovalVerdict = {
+  APPROVE: "approve",
+  REJECT: "reject"
+};
+var ContentSource = {
+  PROMPT: "prompt",
+  WEB: "web",
+  EMAIL: "email",
+  DOCUMENT: "document",
+  RAG: "rag",
+  MCP_RESPONSE: "mcp_response",
+  TOOL_OUTPUT: "tool_output"
+};
+var Decision = {
+  ALLOW: "ALLOW",
+  DENY: "DENY",
+  APPROVAL_REQUIRED: "APPROVAL_REQUIRED"
+};
+var DelegationScope = {
+  AUTHORIZE: "authorize",
+  EXECUTE: "execute",
+  MCP_CONNECT: "mcp:connect",
+  SECRETS_USE: "secrets:use",
+  BROWSER_USE: "browser:use",
+  DATABASE_USE: "database:use",
+  DELEGATIONS_MANAGE: "delegations:manage"
+};
+var DlpAction = {
+  ALLOW: "ALLOW",
+  MASK: "MASK",
+  REDACT: "REDACT",
+  BLOCK: "BLOCK",
+  REQUIRE_APPROVAL: "REQUIRE_APPROVAL"
+};
+var DlpDirection = {
+  INBOUND: "inbound",
+  OUTBOUND: "outbound"
+};
+var ExecuteMode = {
+  SYNC: "sync",
+  ASYNC: "async"
+};
+var ExecutionStatus = {
+  PENDING: "pending",
+  RUNNING: "running",
+  SUCCEEDED: "succeeded",
+  FAILED: "failed",
+  DENIED: "denied",
+  AWAITING_APPROVAL: "awaiting_approval",
+  CANCELLED: "cancelled",
+  CANCELLING: "cancelling",
+  SIMULATED: "simulated"
+};
+var InjectionLevel = {
+  NONE: "none",
+  LOW: "low",
+  MEDIUM: "medium",
+  HIGH: "high",
+  CRITICAL: "critical"
+};
+var RiskLevel = {
+  LOW: "low",
+  MEDIUM: "medium",
+  HIGH: "high",
+  CRITICAL: "critical"
+};
+var RiskRecommendation = {
+  ALLOW: "allow",
+  APPROVAL_REQUIRED: "approval_required",
+  DENY: "deny"
+};
+var RiskTier = {
+  LOW: "low",
+  STANDARD: "standard",
+  ELEVATED: "elevated",
+  CRITICAL: "critical"
+};
+var SecretType = {
+  API_KEY: "api_key",
+  OAUTH_TOKEN: "oauth_token",
+  DATABASE: "database",
+  CERTIFICATE: "certificate",
+  CLOUD: "cloud",
+  SSH_KEY: "ssh_key",
+  GENERIC: "generic"
+};
+var SimulationStatus = {
+  PASSED: "passed",
+  FAILED: "failed",
+  ERROR: "error"
+};
+var SpanKind = {
+  SERVER: "server",
+  CLIENT: "client",
+  INTERNAL: "internal",
+  PRODUCER: "producer",
+  CONSUMER: "consumer"
+};
+var SpanStatus = {
+  UNSET: "unset",
+  OK: "ok",
+  ERROR: "error"
+};
+export {
+  AgentStatus,
+  AlertStatus,
+  ApiError,
+  ApprovalNotGrantedError,
+  ApprovalRequiredError,
+  ApprovalStatus,
+  ApprovalTimeoutError,
+  ApprovalVerdict,
+  AuthenticationError,
+  ConfigurationError,
+  ConflictError,
+  ConnectionError,
+  ContentSource,
+  Decision,
+  DelegationScope,
+  DlpAction,
+  DlpDirection,
+  ExecuteMode,
+  ExecutionStatus,
+  GebSecure,
+  GebSecureError,
+  InjectionLevel,
+  InternalError,
+  NotFoundError,
+  OAuthTokenProvider,
+  PermissionDeniedError,
+  PolicyDeniedError,
+  RateLimitError,
+  RiskLevel,
+  RiskRecommendation,
+  RiskTier,
+  SecretType,
+  SimulationFailedError,
+  SimulationStatus,
+  SpanKind,
+  SpanStatus,
+  TimeoutError,
+  UnavailableError,
+  UpstreamError,
+  VERSION,
+  ValidationError,
+  apiKey,
+  backoffDelay,
+  buildSpan,
+  clientSecret,
+  codeForStatus,
+  createClientAssertion,
+  delegation,
+  errorFromResponse,
+  importSigningKey,
+  inferAlgorithm,
+  parseRetryAfter,
+  privateKeyJwt,
+  staticToken,
+  systemClock,
+  traceparentOf,
+  unauthenticated
+};
+//# sourceMappingURL=index.js.map