@hasna/tenants 0.1.0

package/dist/migrations.d.ts

@@ -0,0 +1,3 @@
+import { type Migration } from "./generated/storage-kit/index.js";
+export declare const API_KEYS_TABLE = "api_keys";
+export declare function tenantsMigrations(): Migration[];

package/dist/migrations.js

@@ -0,0 +1,452 @@
+// @bun
+// src/generated/storage-kit/mode.ts
+var DEPRECATED_STORAGE_MODE_ALIASES = [
+  "remote",
+  "hybrid",
+  "self_hosted"
+];
+function normalizeStorageMode(value) {
+  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
+  if (normalized === "local")
+    return { mode: "local", deprecatedAlias: null };
+  if (normalized === "cloud")
+    return { mode: "cloud", deprecatedAlias: null };
+  if (DEPRECATED_STORAGE_MODE_ALIASES.includes(normalized)) {
+    return { mode: "cloud", deprecatedAlias: normalized };
+  }
+  throw new Error(`Unknown storage mode: ${value}. Use local or cloud.`);
+}
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function storageEnvKeys(name) {
+  const token = envToken(name);
+  return {
+    modeKeys: [`HASNA_${token}_STORAGE_MODE`, `${token}_STORAGE_MODE`],
+    databaseUrlKeys: [`HASNA_${token}_DATABASE_URL`, `${token}_DATABASE_URL`]
+  };
+}
+function firstEnv(env, keys) {
+  for (const key of keys) {
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+function resolveStorageMode(name, env = process.env) {
+  const { modeKeys, databaseUrlKeys } = storageEnvKeys(name);
+  const dbHit = firstEnv(env, databaseUrlKeys);
+  const databaseUrlPresent = Boolean(dbHit);
+  const databaseUrlSource = dbHit ? dbHit.key : null;
+  const modeHit = firstEnv(env, modeKeys);
+  if (!modeHit) {
+    return {
+      mode: "local",
+      source: "default",
+      deprecatedAlias: null,
+      databaseUrlPresent,
+      databaseUrlSource,
+      warning: null
+    };
+  }
+  const { mode, deprecatedAlias } = normalizeStorageMode(modeHit.value);
+  const warnings = [];
+  if (deprecatedAlias) {
+    warnings.push(`Deprecated storage mode '${deprecatedAlias}' from ${modeHit.key} is treated as 'cloud'. Set ${modeKeys[0]}=cloud instead.`);
+  }
+  if (mode === "cloud" && !databaseUrlPresent) {
+    warnings.push(`cloud mode needs ${databaseUrlKeys[0]} (PURE REMOTE: reads and writes go to cloud Postgres).`);
+  }
+  if (modeHit.key !== modeKeys[0]) {
+    warnings.push(`Using alias env ${modeHit.key}; the canonical key is ${modeKeys[0]}.`);
+  }
+  return {
+    mode,
+    source: modeHit.key,
+    deprecatedAlias,
+    databaseUrlPresent,
+    databaseUrlSource,
+    warning: warnings.length > 0 ? warnings.join(" ") : null
+  };
+}
+function resolveDatabaseUrl(name, env = process.env) {
+  const { databaseUrlKeys } = storageEnvKeys(name);
+  const hit = firstEnv(env, databaseUrlKeys);
+  return hit ? hit.value : null;
+}
+// src/generated/storage-kit/tls.ts
+import { readFileSync } from "fs";
+function sslModeFromConnectionString(connectionString) {
+  const queryStart = connectionString.indexOf("?");
+  const params = new URLSearchParams(queryStart === -1 ? "" : connectionString.slice(queryStart + 1));
+  const sslmode = params.get("sslmode")?.trim().toLowerCase();
+  if (sslmode) {
+    switch (sslmode) {
+      case "disable":
+      case "prefer":
+      case "require":
+      case "verify-ca":
+      case "verify-full":
+        return sslmode;
+      case "allow":
+        return "prefer";
+      default:
+        throw new Error(`Unknown sslmode '${sslmode}' in connection string.`);
+    }
+  }
+  const ssl = params.get("ssl")?.trim().toLowerCase();
+  if (ssl && ["1", "true", "yes", "on", "require"].includes(ssl))
+    return "require";
+  return "disable";
+}
+function loadCaBundle(options) {
+  const env = options.env ?? process.env;
+  if (options.ca && options.ca.trim())
+    return options.ca;
+  const path = options.caCertPath ?? env.PGSSLROOTCERT ?? env.NODE_EXTRA_CA_CERTS;
+  if (path && path.trim())
+    return readFileSync(path.trim(), "utf8");
+  return null;
+}
+function resolveTlsConfig(connectionString, options = {}) {
+  const mode = sslModeFromConnectionString(connectionString);
+  if (mode === "disable" || mode === "prefer") {
+    return;
+  }
+  const ca = loadCaBundle(options);
+  if (mode === "require") {
+    return ca ? { rejectUnauthorized: false, ca } : { rejectUnauthorized: false };
+  }
+  if (!ca) {
+    throw new Error(`sslmode=${mode} requires a CA bundle. Set PGSSLROOTCERT (or pass caCertPath/ca) to the ` + `Amazon RDS global bundle: https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem`);
+  }
+  return { rejectUnauthorized: true, ca };
+}
+// src/generated/storage-kit/query.ts
+function wrapExecutor(executor) {
+  return {
+    async query(sql, params) {
+      const result = await executor.query(sql, params);
+      return { rows: result.rows, rowCount: result.rowCount ?? result.rows.length };
+    },
+    async many(sql, params) {
+      const result = await executor.query(sql, params);
+      return result.rows;
+    },
+    async get(sql, params) {
+      const result = await executor.query(sql, params);
+      return result.rows[0] ?? null;
+    },
+    async one(sql, params) {
+      const result = await executor.query(sql, params);
+      if (result.rows.length !== 1) {
+        throw new Error(`Expected exactly one row, got ${result.rows.length}.`);
+      }
+      return result.rows[0];
+    },
+    async execute(sql, params) {
+      await executor.query(sql, params);
+    }
+  };
+}
+function createQueryClient(pool) {
+  const base = wrapExecutor(pool);
+  return {
+    ...base,
+    pool,
+    async transaction(fn) {
+      const client = await pool.connect();
+      try {
+        await client.query("BEGIN");
+        const result = await fn(wrapExecutor(client));
+        await client.query("COMMIT");
+        return result;
+      } catch (error) {
+        try {
+          await client.query("ROLLBACK");
+        } catch {}
+        throw error;
+      } finally {
+        client.release();
+      }
+    },
+    async close() {
+      await pool.end();
+    }
+  };
+}
+// src/generated/storage-kit/pool.ts
+import pg from "pg";
+function createPgPool(options) {
+  const ssl = resolveTlsConfig(options.connectionString, {
+    ...options.ca !== undefined ? { ca: options.ca } : {},
+    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
+    ...options.env !== undefined ? { env: options.env } : {}
+  });
+  const config = { connectionString: options.connectionString };
+  if (ssl !== undefined)
+    config.ssl = ssl;
+  if (options.max !== undefined)
+    config.max = options.max;
+  if (options.idleTimeoutMillis !== undefined)
+    config.idleTimeoutMillis = options.idleTimeoutMillis;
+  if (options.connectionTimeoutMillis !== undefined)
+    config.connectionTimeoutMillis = options.connectionTimeoutMillis;
+  if (options.applicationName !== undefined)
+    config.application_name = options.applicationName;
+  return new pg.Pool(config);
+}
+function createCloudPoolFromEnv(appName, options = {}) {
+  const env = options.env ?? process.env;
+  const resolution = resolveStorageMode(appName, env);
+  if (resolution.mode !== "cloud") {
+    throw new Error(`createCloudPoolFromEnv requires ${appName} storage mode 'cloud', got '${resolution.mode}'. ` + `Set HASNA_${appName.toUpperCase().replace(/-/g, "_")}_STORAGE_MODE=cloud.`);
+  }
+  const connectionString = resolveDatabaseUrl(appName, env);
+  if (!connectionString) {
+    throw new Error(`cloud mode for ${appName} needs a database URL. Set ` + `HASNA_${appName.toUpperCase().replace(/-/g, "_")}_DATABASE_URL.`);
+  }
+  const pool = createPgPool({
+    connectionString,
+    ...options.ca !== undefined ? { ca: options.ca } : {},
+    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
+    env,
+    ...options.max !== undefined ? { max: options.max } : {},
+    ...options.idleTimeoutMillis !== undefined ? { idleTimeoutMillis: options.idleTimeoutMillis } : {},
+    ...options.connectionTimeoutMillis !== undefined ? { connectionTimeoutMillis: options.connectionTimeoutMillis } : {},
+    ...options.applicationName !== undefined ? { applicationName: options.applicationName } : {}
+  });
+  return {
+    client: createQueryClient(pool),
+    connectionSource: resolution.databaseUrlSource ?? "unknown"
+  };
+}
+// src/generated/storage-kit/migrations.ts
+import { createHash } from "crypto";
+var DEFAULT_MIGRATION_LEDGER_TABLE = "schema_migrations";
+function checksumSql(sql) {
+  const normalized = sql.trim().replace(/\r\n/g, `
+`);
+  return `sha256:${createHash("sha256").update(normalized).digest("hex")}`;
+}
+function defineMigration(id, sql) {
+  return Object.freeze({ id, sql: sql.trim(), checksum: checksumSql(sql) });
+}
+
+class MigrationLedger {
+  client;
+  migrations;
+  ledgerTable;
+  constructor(client, migrations, options = {}) {
+    this.client = client;
+    this.migrations = migrations;
+    this.ledgerTable = options.ledgerTable ?? DEFAULT_MIGRATION_LEDGER_TABLE;
+    const seen = new Set;
+    for (const migration of migrations) {
+      if (seen.has(migration.id))
+        throw new Error(`Duplicate migration id: ${migration.id}`);
+      seen.add(migration.id);
+    }
+  }
+  async ensureLedger() {
+    await this.client.execute(`CREATE TABLE IF NOT EXISTS ${this.ledgerTable} (
+         id TEXT PRIMARY KEY,
+         checksum TEXT NOT NULL,
+         applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+       )`);
+  }
+  async listApplied() {
+    await this.ensureLedger();
+    return this.readApplied();
+  }
+  async readApplied() {
+    const rows = await this.client.many(`SELECT id, checksum, applied_at FROM ${this.ledgerTable} ORDER BY id ASC`);
+    return rows.map((row) => ({
+      id: row.id,
+      checksum: row.checksum,
+      appliedAt: row.applied_at instanceof Date ? row.applied_at.toISOString() : String(row.applied_at)
+    }));
+  }
+  buildPlan(applied) {
+    const known = new Set(this.migrations.map((m) => m.id));
+    for (const row of applied) {
+      if (!known.has(row.id)) {
+        throw new Error(`Applied migration '${row.id}' is not recognized by this build (downgrade?).`);
+      }
+    }
+    const appliedById = new Map(applied.map((row) => [row.id, row]));
+    for (const migration of this.migrations) {
+      const existing = appliedById.get(migration.id);
+      if (existing && existing.checksum !== migration.checksum) {
+        throw new Error(`Migration checksum mismatch for '${migration.id}': the SQL changed after it was applied.`);
+      }
+    }
+    return this.migrations.map((migration) => ({
+      migration,
+      state: appliedById.has(migration.id) ? "already_applied" : "pending"
+    }));
+  }
+  async migrate(opts = {}) {
+    const dryRun = opts.dryRun === true;
+    await this.ensureLedger();
+    const applied = await this.readApplied();
+    const plan = this.buildPlan(applied);
+    if (dryRun)
+      return { dryRun, applied, plan };
+    for (const item of plan) {
+      if (item.state === "already_applied")
+        continue;
+      await this.client.execute(item.migration.sql);
+      await this.client.execute(`INSERT INTO ${this.ledgerTable} (id, checksum, applied_at) VALUES ($1, $2, now())`, [item.migration.id, item.migration.checksum]);
+    }
+    return { dryRun, applied: await this.readApplied(), plan };
+  }
+}
+// src/generated/storage-kit/health.ts
+async function checkHealth(client) {
+  const start = Date.now();
+  try {
+    await client.get("SELECT 1 AS ok");
+    return { ok: true, latencyMs: Date.now() - start };
+  } catch (error) {
+    return {
+      ok: false,
+      latencyMs: Date.now() - start,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function checkReady(client, migrations, options = {}) {
+  const start = Date.now();
+  try {
+    const ledger = new MigrationLedger(client, migrations, options);
+    const result = await ledger.migrate({ dryRun: true });
+    const pending = result.plan.filter((item) => item.state === "pending").map((item) => item.migration.id);
+    return { ok: pending.length === 0, latencyMs: Date.now() - start, pendingMigrations: pending };
+  } catch (error) {
+    return {
+      ok: false,
+      latencyMs: Date.now() - start,
+      pendingMigrations: [],
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+// src/migrations.ts
+import { apiKeyMigrations } from "@hasna/contracts/auth";
+
+// src/idp/migrations.ts
+var TENANTS_TABLE = "tenants";
+var USERS_TABLE = "users";
+var SERVICE_PRINCIPALS_TABLE = "service_principals";
+var MEMBERSHIPS_TABLE = "memberships";
+var SESSIONS_TABLE = "sessions";
+var AUTH_CHALLENGES_TABLE = "auth_challenges";
+var JWT_SIGNING_KEYS_TABLE = "jwt_signing_keys";
+function idpMigrations(apiKeysTable) {
+  return [
+    defineMigration("tenants_0001_tenants", `CREATE TABLE IF NOT EXISTS ${TENANTS_TABLE} (
+         id          UUID PRIMARY KEY,
+         slug        TEXT UNIQUE NOT NULL,
+         name        TEXT NOT NULL,
+         kind        TEXT NOT NULL DEFAULT 'org',
+         parent_id   UUID REFERENCES ${TENANTS_TABLE}(id),
+         status      TEXT NOT NULL DEFAULT 'active',
+         identity_id TEXT,
+         metadata    JSONB NOT NULL DEFAULT '{}'::jsonb,
+         created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+         updated_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+       )`),
+    defineMigration("tenants_0002_users", `CREATE TABLE IF NOT EXISTS ${USERS_TABLE} (
+         id            UUID PRIMARY KEY,
+         kind          TEXT NOT NULL,
+         email         TEXT UNIQUE,
+         display_name  TEXT,
+         identity_id   TEXT,
+         home_tenant_id UUID REFERENCES ${TENANTS_TABLE}(id),
+         auth_method   TEXT,
+         password_hash TEXT,
+         status        TEXT NOT NULL DEFAULT 'active',
+         metadata      JSONB NOT NULL DEFAULT '{}'::jsonb,
+         created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+         updated_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+         email_verified_at TIMESTAMPTZ
+       )`),
+    defineMigration("tenants_0003_service_principals", `CREATE TABLE IF NOT EXISTS ${SERVICE_PRINCIPALS_TABLE} (
+         id            UUID PRIMARY KEY,
+         tenant_id     UUID NOT NULL REFERENCES ${TENANTS_TABLE}(id),
+         kind          TEXT NOT NULL DEFAULT 'machine',
+         display_name  TEXT,
+         identity_id   TEXT,
+         enrollment_secret_ref TEXT,
+         status        TEXT NOT NULL DEFAULT 'active',
+         metadata      JSONB NOT NULL DEFAULT '{}'::jsonb,
+         created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+         last_seen_at  TIMESTAMPTZ
+       )`),
+    defineMigration("tenants_0004_memberships", `CREATE TABLE IF NOT EXISTS ${MEMBERSHIPS_TABLE} (
+         id             BIGSERIAL PRIMARY KEY,
+         tenant_id      UUID NOT NULL REFERENCES ${TENANTS_TABLE}(id),
+         principal_id   UUID NOT NULL,
+         principal_type TEXT NOT NULL,
+         role           TEXT NOT NULL,
+         scopes         JSONB NOT NULL DEFAULT '[]'::jsonb,
+         status         TEXT NOT NULL DEFAULT 'active',
+         created_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
+         UNIQUE (tenant_id, principal_id, principal_type)
+       )`),
+    defineMigration("tenants_0005_sessions", `CREATE TABLE IF NOT EXISTS ${SESSIONS_TABLE} (
+         id         UUID PRIMARY KEY,
+         user_id    UUID REFERENCES ${USERS_TABLE}(id),
+         tenant_id  UUID REFERENCES ${TENANTS_TABLE}(id),
+         token_hash TEXT UNIQUE NOT NULL,
+         method     TEXT,
+         issued_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+         expires_at TIMESTAMPTZ,
+         revoked_at TIMESTAMPTZ,
+         ip         TEXT,
+         user_agent TEXT
+       )`),
+    defineMigration("tenants_0006_auth_challenges", `CREATE TABLE IF NOT EXISTS ${AUTH_CHALLENGES_TABLE} (
+         id          UUID PRIMARY KEY,
+         email       TEXT NOT NULL,
+         code_hash   TEXT NOT NULL,
+         purpose     TEXT NOT NULL,
+         expires_at  TIMESTAMPTZ NOT NULL,
+         consumed_at TIMESTAMPTZ,
+         attempts    INT NOT NULL DEFAULT 0,
+         created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+       )`),
+    defineMigration("tenants_0007_auth_challenges_email_idx", `CREATE INDEX IF NOT EXISTS ${AUTH_CHALLENGES_TABLE}_email_idx
+         ON ${AUTH_CHALLENGES_TABLE} (email, purpose, created_at DESC)`),
+    defineMigration("tenants_0008_jwt_signing_keys", `CREATE TABLE IF NOT EXISTS ${JWT_SIGNING_KEYS_TABLE} (
+         kid         TEXT PRIMARY KEY,
+         alg         TEXT NOT NULL DEFAULT 'EdDSA',
+         public_jwk  JSONB NOT NULL,
+         private_jwk JSONB NOT NULL,
+         status      TEXT NOT NULL DEFAULT 'active',
+         created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+         retired_at  TIMESTAMPTZ
+       )`),
+    defineMigration("tenants_0009_memberships_principal_idx", `CREATE INDEX IF NOT EXISTS ${MEMBERSHIPS_TABLE}_principal_idx
+         ON ${MEMBERSHIPS_TABLE} (principal_id, principal_type)`),
+    defineMigration("tenants_0010_api_keys_tenant", `ALTER TABLE ${apiKeysTable} ADD COLUMN IF NOT EXISTS tenant_id UUID;
+       ALTER TABLE ${apiKeysTable} ADD COLUMN IF NOT EXISTS user_id UUID;
+       ALTER TABLE ${apiKeysTable} ADD COLUMN IF NOT EXISTS principal_type TEXT;`),
+    defineMigration("tenants_0011_api_keys_tenant_idx", `CREATE INDEX IF NOT EXISTS ${apiKeysTable}_tenant_idx ON ${apiKeysTable} (tenant_id)`)
+  ];
+}
+
+// src/migrations.ts
+var API_KEYS_TABLE = "api_keys";
+function tenantsMigrations() {
+  return [
+    ...apiKeyMigrations(API_KEYS_TABLE).map((m) => defineMigration(m.id, m.sql)),
+    ...idpMigrations(API_KEYS_TABLE)
+  ];
+}
+export {
+  tenantsMigrations,
+  API_KEYS_TABLE
+};

package/dist/sdk/client.d.ts

@@ -0,0 +1,115 @@
+export interface ErrorResponse {
+    "error": string;
+    "reason"?: string;
+}
+export interface SignupInput {
+    "email": string;
+    "name"?: string;
+    "kind"?: "human" | "agent";
+    "org_name"?: string;
+    "password"?: string;
+}
+export interface LoginInput {
+    "email": string;
+    "password"?: string;
+}
+export interface VerifyInput {
+    "email": string;
+    "code": string;
+}
+export interface ResendInput {
+    "email": string;
+}
+export interface TokenInput {
+    "app": string;
+    "scopes"?: Array<string>;
+    "tenant_id"?: string;
+    "ttlSeconds"?: number;
+}
+export interface AuthResponse {
+    "session"?: string;
+    "session_expires_in"?: number;
+    "challenge"?: boolean;
+    "purpose"?: string;
+    "expires_in"?: number;
+    "confirmation_required"?: boolean;
+    "email_sent"?: boolean;
+    "email_message_id"?: string;
+    "principal"?: Record<string, unknown>;
+    "tenants"?: Array<Record<string, unknown>>;
+    "apps"?: Array<string>;
+}
+export interface TokenResponse {
+    "access_token"?: string;
+    "token_type"?: string;
+    "alg"?: string;
+    "kid"?: string;
+    "aud"?: string;
+    "tid"?: string;
+    "uid"?: string;
+    "pt"?: string;
+    "scope"?: Array<string>;
+    "expires_in"?: number;
+    "api_key"?: string;
+}
+export interface WhoamiResponse {
+    "principal"?: Record<string, unknown>;
+    "tenants"?: Array<Record<string, unknown>>;
+    "apps"?: Array<string>;
+}
+export interface IntrospectResponse {
+    "active"?: boolean;
+    "kid"?: string;
+    "tenant_id"?: string;
+    "user_id"?: string;
+    "principal_type"?: string;
+}
+export interface Jwks {
+    "keys": Array<Record<string, unknown>>;
+}
+export interface TenantsClientOptions {
+    /** Base URL, e.g. process.env.HASNA_TENANTS_API_URL. */
+    baseUrl: string;
+    /** API key, e.g. process.env.HASNA_TENANTS_API_KEY. Sent as the 'x-api-key' header. */
+    apiKey?: string;
+    /** Custom fetch (defaults to global fetch). */
+    fetch?: typeof fetch;
+    /** Extra headers merged into every request. */
+    headers?: Record<string, string>;
+}
+export declare class ApiError extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    constructor(status: number, message: string, body: unknown);
+}
+export declare class TenantsClient {
+    private readonly baseUrl;
+    private readonly apiKey;
+    private readonly fetchImpl;
+    private readonly baseHeaders;
+    constructor(options: TenantsClientOptions);
+    private request;
+    /** Public JWKS (EdDSA) for verifying tenants-issued fleet tokens. */
+    getJwks(init?: RequestInit): Promise<Jwks>;
+    /** Create a tenant/user (hasna emails only) and send an email confirmation code. */
+    signup(body: SignupInput, init?: RequestInit): Promise<AuthResponse>;
+    /** Log in with password (session) or request an OTP challenge. */
+    login(body: LoginInput, init?: RequestInit): Promise<AuthResponse>;
+    /** Verify an OTP code and open a session. */
+    verifyOtp(body: VerifyInput, init?: RequestInit): Promise<AuthResponse>;
+    /** Confirm an email via the one-click link (email + code) and open a session. */
+    confirm(query?: {
+        "email": string;
+        "code": string;
+    }, init?: RequestInit): Promise<AuthResponse>;
+    /** Re-send the email confirmation code for an unconfirmed account. */
+    resendConfirmation(body: ResendInput, init?: RequestInit): Promise<AuthResponse>;
+    /** Mint a per-app fleet access token from a session (Bearer session). */
+    issueToken(body: TokenInput, init?: RequestInit): Promise<TokenResponse>;
+    /** Resolve the session principal + tenant memberships. */
+    whoami(init?: RequestInit): Promise<WhoamiResponse>;
+    /** Introspect an issued key by kid (tenant/user binding + status). */
+    introspect(query?: {
+        "kid": string;
+    }, init?: RequestInit): Promise<IntrospectResponse>;
+}

package/dist/sdk/index.d.ts

@@ -0,0 +1 @@
+export * from "./client.js";

package/dist/sdk/index.js

@@ -0,0 +1,88 @@
+// @bun
+// src/sdk/client.ts
+class ApiError extends Error {
+  status;
+  body;
+  constructor(status, message, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "ApiError";
+  }
+}
+
+class TenantsClient {
+  baseUrl;
+  apiKey;
+  fetchImpl;
+  baseHeaders;
+  constructor(options) {
+    if (!options.baseUrl)
+      throw new Error("TenantsClient requires a baseUrl.");
+    this.baseUrl = options.baseUrl.replace(/\/$/, "");
+    this.apiKey = options.apiKey;
+    this.fetchImpl = options.fetch ?? globalThis.fetch;
+    this.baseHeaders = options.headers ?? {};
+  }
+  async request(method, path, opts) {
+    const url = new URL(this.baseUrl + path);
+    if (opts.query) {
+      for (const [key, value] of Object.entries(opts.query)) {
+        if (value !== undefined && value !== null)
+          url.searchParams.set(key, String(value));
+      }
+    }
+    const headers = { Accept: "application/json", ...this.baseHeaders, ...opts.init?.headers };
+    if (this.apiKey)
+      headers["x-api-key"] = this.apiKey;
+    let payload;
+    if (opts.body !== undefined) {
+      headers["Content-Type"] = "application/json";
+      payload = JSON.stringify(opts.body);
+    }
+    const response = await this.fetchImpl(url.toString(), { ...opts.init, method, headers, body: payload });
+    const text = await response.text();
+    const data = text ? (() => {
+      try {
+        return JSON.parse(text);
+      } catch {
+        return text;
+      }
+    })() : undefined;
+    if (!response.ok) {
+      throw new ApiError(response.status, `${method} ${path} failed: ${response.status}`, data);
+    }
+    return data;
+  }
+  async getJwks(init) {
+    return this.request("GET", `/v1/.well-known/jwks.json`, { body: undefined, query: undefined, init });
+  }
+  async signup(body, init) {
+    return this.request("POST", `/v1/auth/signup`, { body, query: undefined, init });
+  }
+  async login(body, init) {
+    return this.request("POST", `/v1/auth/login`, { body, query: undefined, init });
+  }
+  async verifyOtp(body, init) {
+    return this.request("POST", `/v1/auth/verify`, { body, query: undefined, init });
+  }
+  async confirm(query, init) {
+    return this.request("GET", `/v1/auth/confirm`, { body: undefined, query, init });
+  }
+  async resendConfirmation(body, init) {
+    return this.request("POST", `/v1/auth/resend`, { body, query: undefined, init });
+  }
+  async issueToken(body, init) {
+    return this.request("POST", `/v1/auth/token`, { body, query: undefined, init });
+  }
+  async whoami(init) {
+    return this.request("GET", `/v1/auth/whoami`, { body: undefined, query: undefined, init });
+  }
+  async introspect(query, init) {
+    return this.request("GET", `/v1/introspect`, { body: undefined, query, init });
+  }
+}
+export {
+  TenantsClient,
+  ApiError
+};

package/dist/server/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env bun
+export {};