@hybridb/sdk 0.1.0

package/dist/index.js

@@ -0,0 +1,342 @@
+/* @hybridb/sdk — Stellrai governed execution runtime */
+
+// src/client.ts
+var jwksCache = null;
+var jwksCachedAt = 0;
+var JWKS_CACHE_MS = 36e5;
+var HybriDBClient = class {
+  baseUrl;
+  apiKey;
+  timeout;
+  retries;
+  retryDelay;
+  constructor(config) {
+    if (!config.baseUrl) throw new HybriDBError("CONFIG_ERROR", "hybriDB SDK: baseUrl is required");
+    if (!config.apiKey) throw new HybriDBError("CONFIG_ERROR", "hybriDB SDK: apiKey is required");
+    this.baseUrl = config.baseUrl.replace(/\/$/, "");
+    this.apiKey = config.apiKey;
+    this.timeout = config.timeout ?? 1e4;
+    this.retries = config.retries ?? 3;
+    this.retryDelay = config.retryDelay ?? 500;
+  }
+  // ─── auth — token issuance ──────────────────────────────────────────────────
+  /** Exchange email + password for an access + refresh token pair. */
+  async authenticate(input) {
+    const res = await this.postPublic("/api/v1/auth/token", input);
+    return this.unwrap(res);
+  }
+  /** Refresh an access token using a refresh token. */
+  async refreshToken(refreshToken) {
+    const res = await this.postPublic("/api/v1/auth/refresh", { refreshToken });
+    return this.unwrap(res);
+  }
+  /** Revoke the current session (requires authenticated API key/JWT). */
+  async revokeSession() {
+    await this.delete("/api/v1/auth/token");
+  }
+  /**
+   * Verify a JWT token locally using JWKS from the hybriDB server.
+   * Returns the decoded actor context without making a decision API call.
+   * JWKS is cached for 1 hour (spec: Cache-Control: max-age=3600).
+   */
+  async verifyToken(token) {
+    const jwks = await this.getJwks();
+    const { createRemoteJWKSet, jwtVerify } = await import('jose').catch(() => {
+      throw new HybriDBError("DEPENDENCY_MISSING", "jose is required for verifyToken() \u2014 install it: npm i jose");
+    });
+    const { createLocalJWKSet } = await import('jose');
+    const keySet = createLocalJWKSet({ keys: jwks.keys });
+    const { payload } = await jwtVerify(token, keySet, { issuer: "hybridb" });
+    const p = payload;
+    return {
+      actorId: p["actor_id"],
+      actorType: p["actor_type"],
+      orgId: p["org_id"],
+      scopes: p["scopes"] ?? [],
+      policyVersion: p["policy_version"]
+    };
+  }
+  /** Fetch JWKS from the hybriDB server (cached for 1 hour). */
+  async getJwks() {
+    if (jwksCache && Date.now() - jwksCachedAt < JWKS_CACHE_MS) {
+      return jwksCache;
+    }
+    const res = await this.getPublic("/.well-known/jwks.json");
+    const data = this.unwrap(res);
+    jwksCache = data;
+    jwksCachedAt = Date.now();
+    return data;
+  }
+  // ─── db.actors — actor management ──────────────────────────────────────────
+  /** Namespace for actor management operations. */
+  actors = {
+    /** Issue an API key for an actor. Requires actor:admin scope. */
+    createApiKey: async (actorId, input) => {
+      const res = await this.post(
+        `/api/v1/actors/${actorId}/api-keys`,
+        input
+      );
+      return this.unwrap(res);
+    },
+    /** Revoke an API key. Requires actor:admin scope. */
+    revokeApiKey: async (actorId, keyId) => {
+      await this.delete(`/api/v1/actors/${actorId}/api-keys/${keyId}`);
+    },
+    /** Create an identity mapping (external provider → actor). Requires actor:write scope. */
+    createMapping: async (actorId, input) => {
+      const res = await this.post(
+        `/api/v1/actors/${actorId}/identity-mappings`,
+        input
+      );
+      return this.unwrap(res);
+    }
+  };
+  // ─── orgs — organisation membership ────────────────────────────────────────
+  /** Namespace for organisation membership operations. */
+  orgs = {
+    /** Add a member to an organisation. Requires org:admin scope. */
+    addMember: async (orgId, input) => {
+      const res = await this.post(`/api/v1/orgs/${orgId}/memberships`, input);
+      return this.unwrap(res);
+    },
+    /** Update a member's role. Requires org:admin scope. */
+    updateMemberRole: async (orgId, actorId, role) => {
+      const res = await this.patch(
+        `/api/v1/orgs/${orgId}/memberships/${actorId}`,
+        { role }
+      );
+      return this.unwrap(res);
+    },
+    /** Revoke an actor's membership. Requires org:admin scope. */
+    revokeMember: async (orgId, actorId) => {
+      await this.delete(`/api/v1/orgs/${orgId}/memberships/${actorId}`);
+    },
+    /** List organisation members. Requires org:read scope. */
+    listMembers: async (orgId) => {
+      const res = await this.get(`/api/v1/orgs/${orgId}/memberships`);
+      return this.unwrap(res);
+    }
+  };
+  // ─── Reversibility (v2.4) ──────────────────────────────────────────────────
+  /** Namespace for Reversible Autonomy operations (v2.4). */
+  reversibility = {
+    /**
+     * Initiate a rollback for an execution.
+     * Types: 'full' (all steps), 'selective' (targetSteps list), 'to_checkpoint'.
+     * Requires pipeline:rollback scope.
+     */
+    rollback: async (executionId, input) => {
+      const res = await this.post(`/api/v1/executions/${executionId}/rollback`, input);
+      return this.unwrap(res);
+    },
+    /**
+     * Initiate a replay from a checkpoint.
+     * Creates a new child execution starting from the checkpoint's step.
+     * Requires pipeline:replay scope.
+     */
+    replay: async (executionId, input) => {
+      const res = await this.post(`/api/v1/executions/${executionId}/replay`, input);
+      return this.unwrap(res);
+    },
+    /**
+     * List all checkpoints for an execution (ordered by step_index asc).
+     * Requires pipeline:read scope.
+     */
+    getCheckpoints: async (executionId) => {
+      const res = await this.get(`/api/v1/executions/${executionId}/checkpoints`);
+      return this.unwrap(res);
+    },
+    /**
+     * Get a specific checkpoint (with checksum verification).
+     * Throws REPLAY_CONTEXT_INVALID if checksum mismatches.
+     * Requires pipeline:read scope.
+     */
+    getCheckpoint: async (executionId, checkpointId) => {
+      const res = await this.get(`/api/v1/executions/${executionId}/checkpoints/${checkpointId}`);
+      return this.unwrap(res);
+    },
+    /**
+     * List all rollback log entries for an execution.
+     * Requires pipeline:read scope.
+     */
+    getRollbackLog: async (executionId) => {
+      const res = await this.get(`/api/v1/executions/${executionId}/rollback-log`);
+      return this.unwrap(res);
+    },
+    /**
+     * Get circuit breaker status for a pipeline.
+     * Requires pipeline:read scope.
+     */
+    getCircuitBreaker: async (pipelineId) => {
+      const res = await this.get(`/api/v1/pipelines/${pipelineId}/circuit-breaker`);
+      return this.unwrap(res);
+    },
+    /**
+     * Open or close the circuit breaker for a pipeline.
+     * Opening halts all future executions immediately.
+     * Requires pipeline:circuit_breaker scope.
+     */
+    setCircuitBreaker: async (pipelineId, input) => {
+      const res = await this.post(
+        `/api/v1/pipelines/${pipelineId}/circuit-breaker`,
+        input
+      );
+      return this.unwrap(res);
+    }
+  };
+  // ─── Decisions ─────────────────────────────────────────────────────────────
+  async requestDecision(request) {
+    const res = await this.post("/api/v1/decisions", request);
+    return this.unwrap(res);
+  }
+  async getDecision(decisionId) {
+    const res = await this.get(`/api/v1/decisions/${decisionId}`);
+    return this.unwrap(res);
+  }
+  // ─── Pipelines ─────────────────────────────────────────────────────────────
+  async triggerPipeline(input) {
+    const res = await this.post("/api/v1/pipelines/trigger", input);
+    return this.unwrap(res);
+  }
+  async getPipelineExecution(executionId) {
+    const res = await this.get(`/api/v1/pipelines/executions/${executionId}`);
+    return this.unwrap(res);
+  }
+  // ─── Events ────────────────────────────────────────────────────────────────
+  /** Publish a business event. Note: use actorId (v1.2), not identityId. */
+  async publishEvent(input) {
+    const res = await this.post("/api/v1/events", input);
+    return this.unwrap(res);
+  }
+  // ─── Audit ─────────────────────────────────────────────────────────────────
+  async queryAuditLog(params) {
+    const query = new URLSearchParams();
+    for (const [k, v] of Object.entries(params)) {
+      if (v !== void 0) query.set(k, String(v));
+    }
+    const res = await this.get(`/api/v1/audit?${query.toString()}`);
+    return this.unwrap(res);
+  }
+  // ─── Health ────────────────────────────────────────────────────────────────
+  async health() {
+    const res = await this.getPublic("/health");
+    return this.unwrap(res);
+  }
+  // ─── HTTP primitives ───────────────────────────────────────────────────────
+  async get(path) {
+    return this.request("GET", path, void 0, true);
+  }
+  async getPublic(path) {
+    return this.request("GET", path, void 0, false);
+  }
+  async post(path, body) {
+    return this.request("POST", path, body, true);
+  }
+  async postPublic(path, body) {
+    return this.request("POST", path, body, false);
+  }
+  async patch(path, body) {
+    return this.request("PATCH", path, body, true);
+  }
+  async delete(path) {
+    await this.request("DELETE", path, void 0, true);
+  }
+  async request(method, path, body, authenticated, attempt = 1) {
+    const controller = new AbortController();
+    const timerId = setTimeout(() => controller.abort(), this.timeout);
+    try {
+      const headers = {
+        "Content-Type": "application/json",
+        "X-SDK-Version": "1.3.0"
+      };
+      if (authenticated) {
+        headers["Authorization"] = `Bearer ${this.apiKey}`;
+      }
+      const response = await fetch(`${this.baseUrl}${path}`, {
+        method,
+        headers,
+        ...body !== void 0 ? { body: JSON.stringify(body) } : {},
+        signal: controller.signal
+      });
+      if (response.status === 204) {
+        return { success: true, data: void 0 };
+      }
+      const json = await response.json();
+      if (!response.ok && attempt < this.retries && this.isRetryable(response.status)) {
+        await this.sleep(this.retryDelay * attempt);
+        return this.request(method, path, body, authenticated, attempt + 1);
+      }
+      return json;
+    } finally {
+      clearTimeout(timerId);
+    }
+  }
+  unwrap(response) {
+    if (!response.success || response.data === void 0) {
+      throw new HybriDBError(
+        response.error?.code ?? "UNKNOWN_ERROR",
+        response.error?.message ?? "hybriDB request failed",
+        response.error?.details
+      );
+    }
+    return response.data;
+  }
+  isRetryable(status) {
+    return status === 429 || status >= 500;
+  }
+  sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+};
+var HybriDBError = class extends Error {
+  constructor(code, message, details) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = "HybriDBError";
+  }
+};
+
+// src/index.ts
+var HYBRIDB_EVENT_TYPES = {
+  // Decisions
+  DECISION_REQUESTED: "decision.requested",
+  DECISION_ALLOWED: "decision.allowed",
+  DECISION_BLOCKED: "decision.blocked",
+  DECISION_ESCALATED: "decision.escalated",
+  // Pipelines
+  PIPELINE_STARTED: "pipeline.started",
+  PIPELINE_COMPLETED: "pipeline.completed",
+  PIPELINE_FAILED: "pipeline.failed",
+  PIPELINE_COMPENSATED: "pipeline.compensated",
+  // Payments
+  PAYMENT_INITIATED: "payment.initiated",
+  PAYMENT_COMPLETED: "payment.completed",
+  PAYMENT_FAILED: "payment.failed",
+  PAYMENT_REVERSED: "payment.reversed",
+  // Identity (v1.2 — actor-centric)
+  ACTOR_CREATED: "actor.created",
+  ACTOR_SUSPENDED: "actor.suspended",
+  ACTOR_REVOKED: "actor.revoked",
+  IDENTITY_RESOLVED: "identity.resolved",
+  IDENTITY_RESOLUTION_FAILED: "identity.resolution_failed",
+  // Policy
+  POLICY_ACTIVATED: "policy.activated",
+  POLICY_DEACTIVATED: "policy.deactivated",
+  POLICY_VERSION_BUMPED: "policy.version_bumped",
+  // KYC
+  KYC_SUBMITTED: "kyc.submitted",
+  KYC_APPROVED: "kyc.approved",
+  KYC_REJECTED: "kyc.rejected",
+  // AI
+  AI_INFERENCE_COMPLETED: "ai.inference_completed",
+  AI_INFERENCE_FAILED: "ai.inference_failed",
+  // Fraud
+  FRAUD_SIGNAL_DETECTED: "fraud.signal_detected",
+  // sync-back
+  SYNC_BACK_EXHAUSTED: "sync_back.exhausted"
+};
+
+export { HYBRIDB_EVENT_TYPES, HybriDBClient, HybriDBError };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts","../src/index.ts"],"names":[],"mappings":";;;AAgGA,IAAI,SAAA,GAAwD,IAAA;AAC5D,IAAI,YAAA,GAAe,CAAA;AACnB,IAAM,aAAA,GAAgB,IAAA;AAIf,IAAM,gBAAN,MAAoB;AAAA,EACR,OAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,QAAe,IAAI,YAAA,CAAa,gBAAgB,kCAAkC,CAAA;AAC9F,IAAA,IAAI,CAAC,MAAA,CAAO,MAAA,QAAe,IAAI,YAAA,CAAa,gBAAgB,iCAAiC,CAAA;AAE7F,IAAA,IAAA,CAAK,OAAA,GAAa,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAClD,IAAA,IAAA,CAAK,SAAa,MAAA,CAAO,MAAA;AACzB,IAAA,IAAA,CAAK,OAAA,GAAa,OAAO,OAAA,IAAa,GAAA;AACtC,IAAA,IAAA,CAAK,OAAA,GAAa,OAAO,OAAA,IAAa,CAAA;AACtC,IAAA,IAAA,CAAK,UAAA,GAAa,OAAO,UAAA,IAAc,GAAA;AAAA,EACzC;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,KAAA,EAA8C;AAC/D,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,UAAA,CAAsB,sBAAsB,KAAK,CAAA;AACxE,IAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA;AAAA,EAGA,MAAM,aAAa,YAAA,EAA0C;AAC3D,IAAA,MAAM,MAAM,MAAM,IAAA,CAAK,WAAsB,sBAAA,EAAwB,EAAE,cAAc,CAAA;AACrF,IAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA;AAAA,EAGA,MAAM,aAAA,GAA+B;AACnC,IAAA,MAAM,IAAA,CAAK,OAAO,oBAAoB,CAAA;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,YAAY,KAAA,EAAsC;AACtD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,EAAQ;AAGhC,IAAA,MAAM,EAAE,oBAAoB,SAAA,EAAU,GAAI,MAAM,OAAO,MAAM,CAAA,CAAE,KAAA,CAAM,MAAM;AACzE,MAAA,MAAM,IAAI,YAAA,CAAa,oBAAA,EAAsB,kEAA6D,CAAA;AAAA,IAC5G,CAAC,CAAA;AAGD,IAAA,MAAM,EAAE,iBAAA,EAAkB,GAAI,MAAM,OAAO,MAAM,CAAA;AACjD,IAAA,MAAM,SAAS,iBAAA,CAAkB,EAAE,IAAA,EAAM,IAAA,CAAK,MAAoE,CAAA;AAElH,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,OAAO,MAAA,EAAQ,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAExE,IAAA,MAAM,CAAA,GAAI,OAAA;AACV,IAAA,OAAO;AAAA,MACL,OAAA,EAAe,EAAE,UAAU,CAAA;AAAA,MAC3B,SAAA,EAAe,EAAE,YAAY,CAAA;AAAA,MAC7B,KAAA,EAAe,EAAE,QAAQ,CAAA;AAAA,MACzB,MAAA,EAAgB,CAAA,CAAE,QAAQ,CAAA,IAAkB,EAAC;AAAA,MAC7C,aAAA,EAAe,EAAE,gBAAgB;AAAA,KACnC;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,OAAA,GAAwD;AAC5D,IAAA,IAAI,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,GAAI,eAAe,aAAA,EAAe;AAC1D,MAAA,OAAO,SAAA;AAAA,IACT;AAEA,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAA+C,wBAAwB,CAAA;AAC9F,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA;AAC5B,IAAA,SAAA,GAAe,IAAA;AACf,IAAA,YAAA,GAAe,KAAK,GAAA,EAAI;AACxB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAKS,MAAA,GAAS;AAAA;AAAA,IAEhB,YAAA,EAAc,OAAO,OAAA,EAAe,KAAA,KAA6D;AAC/F,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,IAAA;AAAA,QACrB,kBAAkB,OAAO,CAAA,SAAA,CAAA;AAAA,QAAa;AAAA,OACxC;AACA,MAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACxB,CAAA;AAAA;AAAA,IAGA,YAAA,EAAc,OAAO,OAAA,EAAe,KAAA,KAA+B;AACjE,MAAA,MAAM,KAAK,MAAA,CAAO,CAAA,eAAA,EAAkB,OAAO,CAAA,UAAA,EAAa,KAAK,CAAA,CAAE,CAAA;AAAA,IACjE,CAAA;AAAA;AAAA,IAGA,aAAA,EAAe,OAAO,OAAA,EAAe,KAAA,KAAwD;AAC3F,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,IAAA;AAAA,QACrB,kBAAkB,OAAO,CAAA,kBAAA,CAAA;AAAA,QAAsB;AAAA,OACjD;AACA,MAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACxB;AAAA,GACF;AAAA;AAAA;AAAA,EAKS,IAAA,GAAO;AAAA;AAAA,IAEd,SAAA,EAAW,OAAO,KAAA,EAAa,KAAA,KAAkD;AAC/E,MAAA,MAAM,MAAM,MAAM,IAAA,CAAK,KAAoB,CAAA,aAAA,EAAgB,KAAK,gBAAgB,KAAK,CAAA;AACrF,MAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACxB,CAAA;AAAA;AAAA,IAGA,gBAAA,EAAkB,OAAO,KAAA,EAAa,OAAA,EAAe,IAAA,KAAyC;AAC5F,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA;AAAA,QACrB,CAAA,aAAA,EAAgB,KAAK,CAAA,aAAA,EAAgB,OAAO,CAAA,CAAA;AAAA,QAAI,EAAE,IAAA;AAAK,OACzD;AACA,MAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACxB,CAAA;AAAA;AAAA,IAGA,YAAA,EAAc,OAAO,KAAA,EAAa,OAAA,KAAiC;AACjE,MAAA,MAAM,KAAK,MAAA,CAAO,CAAA,aAAA,EAAgB,KAAK,CAAA,aAAA,EAAgB,OAAO,CAAA,CAAE,CAAA;AAAA,IAClE,CAAA;AAAA;AAAA,IAGA,WAAA,EAAa,OAAO,KAAA,KAA0C;AAC5D,MAAA,MAAM,MAAM,MAAM,IAAA,CAAK,GAAA,CAAqB,CAAA,aAAA,EAAgB,KAAK,CAAA,YAAA,CAAc,CAAA;AAC/E,MAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACxB;AAAA,GACF;AAAA;AAAA;AAAA,EAKS,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMvB,QAAA,EAAU,OAAO,WAAA,EAAmB,KAAA,KAA+E;AACjH,MAAA,MAAM,MAAM,MAAM,IAAA,CAAK,KAAqB,CAAA,mBAAA,EAAsB,WAAW,aAAa,KAAK,CAAA;AAC/F,MAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACxB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAA,EAAQ,OAAO,WAAA,EAAmB,KAAA,KAA2E;AAC3G,MAAA,MAAM,MAAM,MAAM,IAAA,CAAK,KAAmB,CAAA,mBAAA,EAAsB,WAAW,WAAW,KAAK,CAAA;AAC3F,MAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACxB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,cAAA,EAAgB,OAAO,WAAA,KAAoD;AACzE,MAAA,MAAM,MAAM,MAAM,IAAA,CAAK,GAAA,CAAyB,CAAA,mBAAA,EAAsB,WAAW,CAAA,YAAA,CAAc,CAAA;AAC/F,MAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACxB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,aAAA,EAAe,OAAO,WAAA,EAAmB,YAAA,KAA4C;AACnF,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,CAAgB,sBAAsB,WAAW,CAAA,aAAA,EAAgB,YAAY,CAAA,CAAE,CAAA;AACtG,MAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACxB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,cAAA,EAAgB,OAAO,WAAA,KAA8C;AACnE,MAAA,MAAM,MAAM,MAAM,IAAA,CAAK,GAAA,CAAmB,CAAA,mBAAA,EAAsB,WAAW,CAAA,aAAA,CAAe,CAAA;AAC1F,MAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACxB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,iBAAA,EAAmB,OAAO,UAAA,KAAoD;AAC5E,MAAA,MAAM,MAAM,MAAM,IAAA,CAAK,GAAA,CAA0B,CAAA,kBAAA,EAAqB,UAAU,CAAA,gBAAA,CAAkB,CAAA;AAClG,MAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACxB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,iBAAA,EAAmB,OAAO,UAAA,EAAkB,KAAA,KAAqF;AAC/H,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,IAAA;AAAA,QACrB,qBAAqB,UAAU,CAAA,gBAAA,CAAA;AAAA,QAC/B;AAAA,OACF;AACA,MAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,IACxB;AAAA,GACF;AAAA;AAAA,EAIA,MAAM,gBAAgB,OAAA,EAAmD;AACvE,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,IAAA,CAAuB,qBAAqB,OAAO,CAAA;AAC1E,IAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA,EAEA,MAAM,YAAY,UAAA,EAA6C;AAC7D,IAAA,MAAM,MAAM,MAAM,IAAA,CAAK,GAAA,CAAsB,CAAA,kBAAA,EAAqB,UAAU,CAAA,CAAE,CAAA;AAC9E,IAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA;AAAA,EAIA,MAAM,gBAAgB,KAAA,EAAyD;AAC7E,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,IAAA,CAAwB,6BAA6B,KAAK,CAAA;AACjF,IAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA,EAEA,MAAM,qBAAqB,WAAA,EAA+C;AACxE,IAAA,MAAM,MAAM,MAAM,IAAA,CAAK,GAAA,CAAuB,CAAA,6BAAA,EAAgC,WAAW,CAAA,CAAE,CAAA;AAC3F,IAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,KAAA,EAAiD;AAClE,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,IAAA,CAAmB,kBAAkB,KAAK,CAAA;AACjE,IAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA;AAAA,EAIA,MAAM,cAAc,MAAA,EAAkE;AACpF,IAAA,MAAM,KAAA,GAAQ,IAAI,eAAA,EAAgB;AAClC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC3C,MAAA,IAAI,MAAM,MAAA,EAAW,KAAA,CAAM,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IAC7C;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,CAAmC,iBAAiB,KAAA,CAAM,QAAA,EAAU,CAAA,CAAE,CAAA;AAC7F,IAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA;AAAA,EAIA,MAAM,MAAA,GAAuD;AAC3D,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAA+C,SAAS,CAAA;AAC/E,IAAA,OAAO,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA;AAAA,EAIA,MAAc,IAAO,IAAA,EAAuC;AAC1D,IAAA,OAAO,IAAA,CAAK,OAAA,CAAW,KAAA,EAAO,IAAA,EAAM,QAAW,IAAI,CAAA;AAAA,EACrD;AAAA,EAEA,MAAc,UAAa,IAAA,EAAuC;AAChE,IAAA,OAAO,IAAA,CAAK,OAAA,CAAW,KAAA,EAAO,IAAA,EAAM,QAAW,KAAK,CAAA;AAAA,EACtD;AAAA,EAEA,MAAc,IAAA,CAAQ,IAAA,EAAc,IAAA,EAAwC;AAC1E,IAAA,OAAO,IAAA,CAAK,OAAA,CAAW,MAAA,EAAQ,IAAA,EAAM,MAAM,IAAI,CAAA;AAAA,EACjD;AAAA,EAEA,MAAc,UAAA,CAAc,IAAA,EAAc,IAAA,EAAwC;AAChF,IAAA,OAAO,IAAA,CAAK,OAAA,CAAW,MAAA,EAAQ,IAAA,EAAM,MAAM,KAAK,CAAA;AAAA,EAClD;AAAA,EAEA,MAAc,KAAA,CAAS,IAAA,EAAc,IAAA,EAAwC;AAC3E,IAAA,OAAO,IAAA,CAAK,OAAA,CAAW,OAAA,EAAS,IAAA,EAAM,MAAM,IAAI,CAAA;AAAA,EAClD;AAAA,EAEA,MAAc,OAAO,IAAA,EAA6B;AAChD,IAAA,MAAM,IAAA,CAAK,OAAA,CAAc,QAAA,EAAU,IAAA,EAAM,QAAW,IAAI,CAAA;AAAA,EAC1D;AAAA,EAEA,MAAc,OAAA,CACZ,MAAA,EACA,MACA,IAAA,EACA,aAAA,EACA,UAAU,CAAA,EACe;AACzB,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,UAAa,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,OAAO,CAAA;AAEpE,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAkC;AAAA,QACtC,cAAA,EAAiB,kBAAA;AAAA,QACjB,eAAA,EAAiB;AAAA,OACnB;AACA,MAAA,IAAI,aAAA,EAAe;AACjB,QAAA,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAA,MAClD;AAEA,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QACrD,MAAA;AAAA,QACA,OAAA;AAAA,QACA,GAAI,IAAA,KAAS,KAAA,CAAA,GAAY,EAAE,IAAA,EAAM,KAAK,SAAA,CAAU,IAAI,CAAA,EAAE,GAAI,EAAC;AAAA,QAC3D,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAGD,MAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,QAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,IAAA,EAAM,KAAA,CAAA,EAAe;AAAA,MAC/C;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAEjC,MAAA,IAAI,CAAC,QAAA,CAAS,EAAA,IAAM,OAAA,GAAU,IAAA,CAAK,WAAW,IAAA,CAAK,WAAA,CAAY,QAAA,CAAS,MAAM,CAAA,EAAG;AAC/E,QAAA,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,UAAA,GAAa,OAAO,CAAA;AAC1C,QAAA,OAAO,KAAK,OAAA,CAAW,MAAA,EAAQ,MAAM,IAAA,EAAM,aAAA,EAAe,UAAU,CAAC,CAAA;AAAA,MACvE;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,OAAO,CAAA;AAAA,IACtB;AAAA,EACF;AAAA,EAEQ,OAAU,QAAA,EAA6B;AAC7C,IAAA,IAAI,CAAC,QAAA,CAAS,OAAA,IAAW,QAAA,CAAS,SAAS,MAAA,EAAW;AACpD,MAAA,MAAM,IAAI,YAAA;AAAA,QACR,QAAA,CAAS,OAAO,IAAA,IAAQ,eAAA;AAAA,QACxB,QAAA,CAAS,OAAO,OAAA,IAAW,wBAAA;AAAA,QAC3B,SAAS,KAAA,EAAO;AAAA,OAClB;AAAA,IACF;AACA,IAAA,OAAO,QAAA,CAAS,IAAA;AAAA,EAClB;AAAA,EAEQ,YAAY,MAAA,EAAyB;AAC3C,IAAA,OAAO,MAAA,KAAW,OAAO,MAAA,IAAU,GAAA;AAAA,EACrC;AAAA,EAEQ,MAAM,EAAA,EAA2B;AACvC,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAA,OAAA,KAAW,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAAA,EACvD;AACF;AAIO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,WAAA,CACkB,IAAA,EAChB,OAAA,EACgB,OAAA,EAChB;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAJG,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAEA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAGhB,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AAAA,EACd;AACF;;;AC1ZO,IAAM,mBAAA,GAAsB;AAAA;AAAA,EAEjC,kBAAA,EAAyB,oBAAA;AAAA,EACzB,gBAAA,EAAyB,kBAAA;AAAA,EACzB,gBAAA,EAAyB,kBAAA;AAAA,EACzB,kBAAA,EAAyB,oBAAA;AAAA;AAAA,EAEzB,gBAAA,EAAyB,kBAAA;AAAA,EACzB,kBAAA,EAAyB,oBAAA;AAAA,EACzB,eAAA,EAAyB,iBAAA;AAAA,EACzB,oBAAA,EAAyB,sBAAA;AAAA;AAAA,EAEzB,iBAAA,EAAyB,mBAAA;AAAA,EACzB,iBAAA,EAAyB,mBAAA;AAAA,EACzB,cAAA,EAAyB,gBAAA;AAAA,EACzB,gBAAA,EAAyB,kBAAA;AAAA;AAAA,EAEzB,aAAA,EAAyB,eAAA;AAAA,EACzB,eAAA,EAAyB,iBAAA;AAAA,EACzB,aAAA,EAAyB,eAAA;AAAA,EACzB,iBAAA,EAAyB,mBAAA;AAAA,EACzB,0BAAA,EAA4B,4BAAA;AAAA;AAAA,EAE5B,gBAAA,EAAyB,kBAAA;AAAA,EACzB,kBAAA,EAAyB,oBAAA;AAAA,EACzB,qBAAA,EAAyB,uBAAA;AAAA;AAAA,EAEzB,aAAA,EAAyB,eAAA;AAAA,EACzB,YAAA,EAAyB,cAAA;AAAA,EACzB,YAAA,EAAyB,cAAA;AAAA;AAAA,EAEzB,sBAAA,EAAyB,wBAAA;AAAA,EACzB,mBAAA,EAAyB,qBAAA;AAAA;AAAA,EAEzB,qBAAA,EAAyB,uBAAA;AAAA;AAAA,EAEzB,mBAAA,EAAyB;AAC3B","file":"index.js","sourcesContent":["// hybriDB SDK Client — v1.3\n//\n// v1.3 changes (v2.4 Reversible Autonomy):\n//   - reversibility namespace: rollback(), replay(), getCheckpoints(), getCheckpoint(),\n//     getRollbackLog(), getCircuitBreaker(), setCircuitBreaker()\n//   - SDK-Version header bumped to 1.3.0\n//\n// v1.2 changes:\n//   - db.actors.* namespace (replaces db.identities.*)\n//   - createMapping() — create identity mapping for an actor\n//   - assignRole() — assign a role to an actor\n//   - orgs.addMember(), orgs.revokeMember(), orgs.listMembers(), orgs.updateMemberRole()\n//   - verifyToken() — JWKS-based local token verification\n//   - 7 new HybriDBErrorCode values (see @stellrai/types)\n//   - actorId field in PublishEventInput (replaces identityId)\n//   - SDK-Version header bumped to 1.2.0\n\nimport type {\n  UUID,\n  ApiResponse,\n  DecisionInput,\n  DecisionRequest,\n  DecisionResponse,\n  TriggerPipelineInput,\n  PipelineExecution,\n  PublishEventInput,\n  HybriDBEvent,\n  AuditEntry,\n  PaginatedResponse,\n  Actor,\n  ActorContext,\n  TokenPair,\n  OrgMembership,\n  IdentityMapping,\n  // v2.4 Reversible Autonomy\n  InitiateRollbackInput,\n  RollbackResult,\n  InitiateReplayInput,\n  ReplayResult,\n  Checkpoint,\n  CheckpointSummary,\n  RollbackLog,\n  CircuitBreakerStatus,\n  SetCircuitBreakerInput,\n} from '@stellrai/types';\n\n// ─── Client config ────────────────────────────────────────────────────────────\n\nexport interface HybriDBClientConfig {\n  baseUrl:      string;\n  apiKey:       string;\n  timeout?:     number;    // ms, default 10000\n  retries?:     number;    // default 3\n  retryDelay?:  number;    // ms, default 500\n}\n\n// ─── Auth inputs ─────────────────────────────────────────────────────────────\n\nexport interface AuthenticateInput {\n  email:    string;\n  password: string;\n  orgId?:   string;\n}\n\nexport interface CreateMappingInput {\n  providerId:  string;\n  externalId:  string;\n  userId:      string;\n  actorId:     string;\n}\n\nexport interface OrgMemberInput {\n  actorId: string;\n  role:    string;\n}\n\nexport interface ApiKeyInput {\n  name?:      string;\n  scopes:     string[];\n  expiresAt?: string;\n}\n\nexport interface AuditQueryParams {\n  actorId?:    string;\n  action?:     string;\n  outcome?:    string;\n  decisionId?: string;\n  sessionId?:  string;\n  from?:       string;\n  to?:         string;\n  page?:       number;\n  limit?:      number;\n}\n\n// ─── JWKS cache (module-level — shared across instances) ─────────────────────\n\nlet jwksCache: { keys: Record<string, unknown>[] } | null = null;\nlet jwksCachedAt = 0;\nconst JWKS_CACHE_MS = 3_600_000; // 1 hour\n\n// ─── HybriDBClient ────────────────────────────────────────────────────────────\n\nexport class HybriDBClient {\n  private readonly baseUrl:     string;\n  private readonly apiKey:      string;\n  private readonly timeout:     number;\n  private readonly retries:     number;\n  private readonly retryDelay:  number;\n\n  constructor(config: HybriDBClientConfig) {\n    if (!config.baseUrl) throw new HybriDBError('CONFIG_ERROR', 'hybriDB SDK: baseUrl is required');\n    if (!config.apiKey)  throw new HybriDBError('CONFIG_ERROR', 'hybriDB SDK: apiKey is required');\n\n    this.baseUrl    = config.baseUrl.replace(/\\/$/, '');\n    this.apiKey     = config.apiKey;\n    this.timeout    = config.timeout   ?? 10_000;\n    this.retries    = config.retries   ?? 3;\n    this.retryDelay = config.retryDelay ?? 500;\n  }\n\n  // ─── auth — token issuance ──────────────────────────────────────────────────\n\n  /** Exchange email + password for an access + refresh token pair. */\n  async authenticate(input: AuthenticateInput): Promise<TokenPair> {\n    const res = await this.postPublic<TokenPair>('/api/v1/auth/token', input);\n    return this.unwrap(res);\n  }\n\n  /** Refresh an access token using a refresh token. */\n  async refreshToken(refreshToken: string): Promise<TokenPair> {\n    const res = await this.postPublic<TokenPair>('/api/v1/auth/refresh', { refreshToken });\n    return this.unwrap(res);\n  }\n\n  /** Revoke the current session (requires authenticated API key/JWT). */\n  async revokeSession(): Promise<void> {\n    await this.delete('/api/v1/auth/token');\n  }\n\n  /**\n   * Verify a JWT token locally using JWKS from the hybriDB server.\n   * Returns the decoded actor context without making a decision API call.\n   * JWKS is cached for 1 hour (spec: Cache-Control: max-age=3600).\n   */\n  async verifyToken(token: string): Promise<ActorContext> {\n    const jwks = await this.getJwks();\n\n    // Dynamic import — jose is optional peer dependency for token verification\n    const { createRemoteJWKSet, jwtVerify } = await import('jose').catch(() => {\n      throw new HybriDBError('DEPENDENCY_MISSING', 'jose is required for verifyToken() — install it: npm i jose');\n    });\n\n    // Build an in-memory JWKS from our cached keys\n    const { createLocalJWKSet } = await import('jose');\n    const keySet = createLocalJWKSet({ keys: jwks.keys as unknown as Parameters<typeof createLocalJWKSet>[0]['keys'] });\n\n    const { payload } = await jwtVerify(token, keySet, { issuer: 'hybridb' });\n\n    const p = payload as Record<string, unknown>;\n    return {\n      actorId:       p['actor_id'] as string,\n      actorType:     p['actor_type'] as ActorContext['actorType'],\n      orgId:         p['org_id'] as string | null,\n      scopes:        (p['scopes'] as string[]) ?? [],\n      policyVersion: p['policy_version'] as number,\n    };\n  }\n\n  /** Fetch JWKS from the hybriDB server (cached for 1 hour). */\n  async getJwks(): Promise<{ keys: Record<string, unknown>[] }> {\n    if (jwksCache && Date.now() - jwksCachedAt < JWKS_CACHE_MS) {\n      return jwksCache;\n    }\n\n    const res = await this.getPublic<{ keys: Record<string, unknown>[] }>('/.well-known/jwks.json');\n    const data = this.unwrap(res);\n    jwksCache    = data;\n    jwksCachedAt = Date.now();\n    return data;\n  }\n\n  // ─── db.actors — actor management ──────────────────────────────────────────\n\n  /** Namespace for actor management operations. */\n  readonly actors = {\n    /** Issue an API key for an actor. Requires actor:admin scope. */\n    createApiKey: async (actorId: UUID, input: ApiKeyInput): Promise<{ id: string; key: string }> => {\n      const res = await this.post<{ id: string; key: string }>(\n        `/api/v1/actors/${actorId}/api-keys`, input,\n      );\n      return this.unwrap(res);\n    },\n\n    /** Revoke an API key. Requires actor:admin scope. */\n    revokeApiKey: async (actorId: UUID, keyId: UUID): Promise<void> => {\n      await this.delete(`/api/v1/actors/${actorId}/api-keys/${keyId}`);\n    },\n\n    /** Create an identity mapping (external provider → actor). Requires actor:write scope. */\n    createMapping: async (actorId: UUID, input: CreateMappingInput): Promise<IdentityMapping> => {\n      const res = await this.post<IdentityMapping>(\n        `/api/v1/actors/${actorId}/identity-mappings`, input,\n      );\n      return this.unwrap(res);\n    },\n  } as const;\n\n  // ─── orgs — organisation membership ────────────────────────────────────────\n\n  /** Namespace for organisation membership operations. */\n  readonly orgs = {\n    /** Add a member to an organisation. Requires org:admin scope. */\n    addMember: async (orgId: UUID, input: OrgMemberInput): Promise<OrgMembership> => {\n      const res = await this.post<OrgMembership>(`/api/v1/orgs/${orgId}/memberships`, input);\n      return this.unwrap(res);\n    },\n\n    /** Update a member's role. Requires org:admin scope. */\n    updateMemberRole: async (orgId: UUID, actorId: UUID, role: string): Promise<OrgMembership> => {\n      const res = await this.patch<OrgMembership>(\n        `/api/v1/orgs/${orgId}/memberships/${actorId}`, { role },\n      );\n      return this.unwrap(res);\n    },\n\n    /** Revoke an actor's membership. Requires org:admin scope. */\n    revokeMember: async (orgId: UUID, actorId: UUID): Promise<void> => {\n      await this.delete(`/api/v1/orgs/${orgId}/memberships/${actorId}`);\n    },\n\n    /** List organisation members. Requires org:read scope. */\n    listMembers: async (orgId: UUID): Promise<OrgMembership[]> => {\n      const res = await this.get<OrgMembership[]>(`/api/v1/orgs/${orgId}/memberships`);\n      return this.unwrap(res);\n    },\n  } as const;\n\n  // ─── Reversibility (v2.4) ──────────────────────────────────────────────────\n\n  /** Namespace for Reversible Autonomy operations (v2.4). */\n  readonly reversibility = {\n    /**\n     * Initiate a rollback for an execution.\n     * Types: 'full' (all steps), 'selective' (targetSteps list), 'to_checkpoint'.\n     * Requires pipeline:rollback scope.\n     */\n    rollback: async (executionId: UUID, input: Omit<InitiateRollbackInput, 'executionId'>): Promise<RollbackResult> => {\n      const res = await this.post<RollbackResult>(`/api/v1/executions/${executionId}/rollback`, input);\n      return this.unwrap(res);\n    },\n\n    /**\n     * Initiate a replay from a checkpoint.\n     * Creates a new child execution starting from the checkpoint's step.\n     * Requires pipeline:replay scope.\n     */\n    replay: async (executionId: UUID, input: Omit<InitiateReplayInput, 'executionId'>): Promise<ReplayResult> => {\n      const res = await this.post<ReplayResult>(`/api/v1/executions/${executionId}/replay`, input);\n      return this.unwrap(res);\n    },\n\n    /**\n     * List all checkpoints for an execution (ordered by step_index asc).\n     * Requires pipeline:read scope.\n     */\n    getCheckpoints: async (executionId: UUID): Promise<CheckpointSummary[]> => {\n      const res = await this.get<CheckpointSummary[]>(`/api/v1/executions/${executionId}/checkpoints`);\n      return this.unwrap(res);\n    },\n\n    /**\n     * Get a specific checkpoint (with checksum verification).\n     * Throws REPLAY_CONTEXT_INVALID if checksum mismatches.\n     * Requires pipeline:read scope.\n     */\n    getCheckpoint: async (executionId: UUID, checkpointId: UUID): Promise<Checkpoint> => {\n      const res = await this.get<Checkpoint>(`/api/v1/executions/${executionId}/checkpoints/${checkpointId}`);\n      return this.unwrap(res);\n    },\n\n    /**\n     * List all rollback log entries for an execution.\n     * Requires pipeline:read scope.\n     */\n    getRollbackLog: async (executionId: UUID): Promise<RollbackLog[]> => {\n      const res = await this.get<RollbackLog[]>(`/api/v1/executions/${executionId}/rollback-log`);\n      return this.unwrap(res);\n    },\n\n    /**\n     * Get circuit breaker status for a pipeline.\n     * Requires pipeline:read scope.\n     */\n    getCircuitBreaker: async (pipelineId: UUID): Promise<CircuitBreakerStatus> => {\n      const res = await this.get<CircuitBreakerStatus>(`/api/v1/pipelines/${pipelineId}/circuit-breaker`);\n      return this.unwrap(res);\n    },\n\n    /**\n     * Open or close the circuit breaker for a pipeline.\n     * Opening halts all future executions immediately.\n     * Requires pipeline:circuit_breaker scope.\n     */\n    setCircuitBreaker: async (pipelineId: UUID, input: Omit<SetCircuitBreakerInput, 'pipelineId'>): Promise<CircuitBreakerStatus> => {\n      const res = await this.post<CircuitBreakerStatus>(\n        `/api/v1/pipelines/${pipelineId}/circuit-breaker`,\n        input,\n      );\n      return this.unwrap(res);\n    },\n  } as const;\n\n  // ─── Decisions ─────────────────────────────────────────────────────────────\n\n  async requestDecision(request: DecisionInput): Promise<DecisionResponse> {\n    const res = await this.post<DecisionResponse>('/api/v1/decisions', request);\n    return this.unwrap(res);\n  }\n\n  async getDecision(decisionId: UUID): Promise<DecisionResponse> {\n    const res = await this.get<DecisionResponse>(`/api/v1/decisions/${decisionId}`);\n    return this.unwrap(res);\n  }\n\n  // ─── Pipelines ─────────────────────────────────────────────────────────────\n\n  async triggerPipeline(input: TriggerPipelineInput): Promise<PipelineExecution> {\n    const res = await this.post<PipelineExecution>('/api/v1/pipelines/trigger', input);\n    return this.unwrap(res);\n  }\n\n  async getPipelineExecution(executionId: UUID): Promise<PipelineExecution> {\n    const res = await this.get<PipelineExecution>(`/api/v1/pipelines/executions/${executionId}`);\n    return this.unwrap(res);\n  }\n\n  // ─── Events ────────────────────────────────────────────────────────────────\n\n  /** Publish a business event. Note: use actorId (v1.2), not identityId. */\n  async publishEvent(input: PublishEventInput): Promise<HybriDBEvent> {\n    const res = await this.post<HybriDBEvent>('/api/v1/events', input);\n    return this.unwrap(res);\n  }\n\n  // ─── Audit ─────────────────────────────────────────────────────────────────\n\n  async queryAuditLog(params: AuditQueryParams): Promise<PaginatedResponse<AuditEntry>> {\n    const query = new URLSearchParams();\n    for (const [k, v] of Object.entries(params)) {\n      if (v !== undefined) query.set(k, String(v));\n    }\n    const res = await this.get<PaginatedResponse<AuditEntry>>(`/api/v1/audit?${query.toString()}`);\n    return this.unwrap(res);\n  }\n\n  // ─── Health ────────────────────────────────────────────────────────────────\n\n  async health(): Promise<{ status: string; version: string }> {\n    const res = await this.getPublic<{ status: string; version: string }>('/health');\n    return this.unwrap(res);\n  }\n\n  // ─── HTTP primitives ───────────────────────────────────────────────────────\n\n  private async get<T>(path: string): Promise<ApiResponse<T>> {\n    return this.request<T>('GET', path, undefined, true);\n  }\n\n  private async getPublic<T>(path: string): Promise<ApiResponse<T>> {\n    return this.request<T>('GET', path, undefined, false);\n  }\n\n  private async post<T>(path: string, body: unknown): Promise<ApiResponse<T>> {\n    return this.request<T>('POST', path, body, true);\n  }\n\n  private async postPublic<T>(path: string, body: unknown): Promise<ApiResponse<T>> {\n    return this.request<T>('POST', path, body, false);\n  }\n\n  private async patch<T>(path: string, body: unknown): Promise<ApiResponse<T>> {\n    return this.request<T>('PATCH', path, body, true);\n  }\n\n  private async delete(path: string): Promise<void> {\n    await this.request<void>('DELETE', path, undefined, true);\n  }\n\n  private async request<T>(\n    method:        string,\n    path:          string,\n    body:          unknown,\n    authenticated: boolean,\n    attempt = 1,\n  ): Promise<ApiResponse<T>> {\n    const controller = new AbortController();\n    const timerId    = setTimeout(() => controller.abort(), this.timeout);\n\n    try {\n      const headers: Record<string, string> = {\n        'Content-Type':  'application/json',\n        'X-SDK-Version': '1.3.0',\n      };\n      if (authenticated) {\n        headers['Authorization'] = `Bearer ${this.apiKey}`;\n      }\n\n      const response = await fetch(`${this.baseUrl}${path}`, {\n        method,\n        headers,\n        ...(body !== undefined ? { body: JSON.stringify(body) } : {}),\n        signal: controller.signal,\n      });\n\n      // 204 No Content — return success with no data\n      if (response.status === 204) {\n        return { success: true, data: undefined as T };\n      }\n\n      const json = await response.json() as ApiResponse<T>;\n\n      if (!response.ok && attempt < this.retries && this.isRetryable(response.status)) {\n        await this.sleep(this.retryDelay * attempt);\n        return this.request<T>(method, path, body, authenticated, attempt + 1);\n      }\n\n      return json;\n    } finally {\n      clearTimeout(timerId);\n    }\n  }\n\n  private unwrap<T>(response: ApiResponse<T>): T {\n    if (!response.success || response.data === undefined) {\n      throw new HybriDBError(\n        response.error?.code ?? 'UNKNOWN_ERROR',\n        response.error?.message ?? 'hybriDB request failed',\n        response.error?.details,\n      );\n    }\n    return response.data;\n  }\n\n  private isRetryable(status: number): boolean {\n    return status === 429 || status >= 500;\n  }\n\n  private sleep(ms: number): Promise<void> {\n    return new Promise(resolve => setTimeout(resolve, ms));\n  }\n}\n\n// ─── HybriDBError ─────────────────────────────────────────────────────────────\n\nexport class HybriDBError extends Error {\n  constructor(\n    public readonly code: string,\n    message: string,\n    public readonly details?: Record<string, unknown>,\n  ) {\n    super(message);\n    this.name = 'HybriDBError';\n  }\n}\n","// hybriDB SDK — v1.2\nexport { HybriDBClient, HybriDBError } from './client.js';\nexport type {\n  HybriDBClientConfig,\n  AuthenticateInput,\n  CreateMappingInput,\n  OrgMemberInput,\n  ApiKeyInput,\n  AuditQueryParams,\n} from './client.js';\n\n// React context — exported from '@hybridb/sdk/react' (separate entry point, browser only)\n\n// Re-export commonly used types for SDK consumers\nexport type {\n  // Actor-centric (v1.2)\n  Actor,\n  ActorContext,\n  ActorType,\n  ActorStatus,\n  User,\n  OrgMembership,\n  IdentityMapping,\n  Session,\n  TokenPair,\n  // Decisions\n  DecisionRequest,\n  DecisionResponse,\n  DecisionResult,\n  // Pipelines\n  TriggerPipelineInput,\n  PipelineExecution,\n  // Events — actorId (v1.2), not identityId\n  PublishEventInput,\n  HybriDBEvent,\n  // Audit\n  AuditEntry,\n  AuditOutcome,\n  // Policy\n  Policy,\n  PolicyEvaluationResult,\n  // Shared\n  ApiResponse,\n  ApiError,\n  PaginatedResponse,\n  UUID,\n  ISO8601,\n  // Errors\n  HybriDBErrorCode,\n} from '@stellrai/types';\n\n// ─── Event type constants (v1.2) ──────────────────────────────────────────────\n\nexport const HYBRIDB_EVENT_TYPES = {\n  // Decisions\n  DECISION_REQUESTED:      'decision.requested',\n  DECISION_ALLOWED:        'decision.allowed',\n  DECISION_BLOCKED:        'decision.blocked',\n  DECISION_ESCALATED:      'decision.escalated',\n  // Pipelines\n  PIPELINE_STARTED:        'pipeline.started',\n  PIPELINE_COMPLETED:      'pipeline.completed',\n  PIPELINE_FAILED:         'pipeline.failed',\n  PIPELINE_COMPENSATED:    'pipeline.compensated',\n  // Payments\n  PAYMENT_INITIATED:       'payment.initiated',\n  PAYMENT_COMPLETED:       'payment.completed',\n  PAYMENT_FAILED:          'payment.failed',\n  PAYMENT_REVERSED:        'payment.reversed',\n  // Identity (v1.2 — actor-centric)\n  ACTOR_CREATED:           'actor.created',\n  ACTOR_SUSPENDED:         'actor.suspended',\n  ACTOR_REVOKED:           'actor.revoked',\n  IDENTITY_RESOLVED:       'identity.resolved',\n  IDENTITY_RESOLUTION_FAILED: 'identity.resolution_failed',\n  // Policy\n  POLICY_ACTIVATED:        'policy.activated',\n  POLICY_DEACTIVATED:      'policy.deactivated',\n  POLICY_VERSION_BUMPED:   'policy.version_bumped',\n  // KYC\n  KYC_SUBMITTED:           'kyc.submitted',\n  KYC_APPROVED:            'kyc.approved',\n  KYC_REJECTED:            'kyc.rejected',\n  // AI\n  AI_INFERENCE_COMPLETED:  'ai.inference_completed',\n  AI_INFERENCE_FAILED:     'ai.inference_failed',\n  // Fraud\n  FRAUD_SIGNAL_DETECTED:   'fraud.signal_detected',\n  // sync-back\n  SYNC_BACK_EXHAUSTED:     'sync_back.exhausted',\n} as const;\n\nexport type HybriDBEventType = typeof HYBRIDB_EVENT_TYPES[keyof typeof HYBRIDB_EVENT_TYPES];\n"]}

package/dist/react.cjs

@@ -0,0 +1,28 @@
+'use strict';
+
+var react = require('react');
+var jsxRuntime = require('react/jsx-runtime');
+
+/* @hybridb/sdk — Stellrai governed execution runtime */
+var HybriDBContext = react.createContext(null);
+function HybriDBProvider({
+  client,
+  identityId,
+  children
+}) {
+  return /* @__PURE__ */ jsxRuntime.jsx(HybriDBContext.Provider, { value: { client, identityId }, children });
+}
+function useHybriDBClient() {
+  const ctx = react.useContext(HybriDBContext);
+  if (!ctx) {
+    throw new Error(
+      "useHybriDBClient must be used inside <HybriDBProvider>. Wrap your app root (layout.tsx) with HybriDBProvider."
+    );
+  }
+  return ctx;
+}
+
+exports.HybriDBProvider = HybriDBProvider;
+exports.useHybriDBClient = useHybriDBClient;
+//# sourceMappingURL=react.cjs.map
+//# sourceMappingURL=react.cjs.map

package/dist/react.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/react.tsx"],"names":["createContext","jsx","useContext"],"mappings":";;;;;;AAsBA,IAAM,cAAA,GAAiBA,oBAA0C,IAAI,CAAA;AAQ9D,SAAS,eAAA,CAAgB;AAAA,EAC9B,MAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA,EAA6C;AAC3C,EAAA,uBACEC,cAAA,CAAC,eAAe,QAAA,EAAf,EAAwB,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAW,EAClD,QAAA,EACH,CAAA;AAEJ;AAEO,SAAS,gBAAA,GAAwC;AACtD,EAAA,MAAM,GAAA,GAAMC,iBAAW,cAAc,CAAA;AACrC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT","file":"react.cjs","sourcesContent":["'use client';\n\n// @hybridb/sdk — React context\n// Provides HybriDBClient and resolved hybriDB identity to all React components.\n// All @stellrai/licensing hooks depend on this context.\n//\n// Usage (in app layout.tsx):\n//   <HybriDBProvider client={hybridb} identityId={session.hybridbIdentityId}>\n//     {children}\n//   </HybriDBProvider>\n//\n// Usage (in any client component):\n//   const { client, identityId } = useHybriDBClient();\n\nimport React, { createContext, useContext } from 'react';\nimport type { HybriDBClient } from './client.js';\n\ninterface HybriDBContextValue {\n  client: HybriDBClient;\n  identityId: string;\n}\n\nconst HybriDBContext = createContext<HybriDBContextValue | null>(null);\n\ninterface HybriDBProviderProps {\n  client: HybriDBClient;\n  identityId: string;\n  children: React.ReactNode;\n}\n\nexport function HybriDBProvider({\n  client,\n  identityId,\n  children,\n}: HybriDBProviderProps): React.ReactElement {\n  return (\n    <HybriDBContext.Provider value={{ client, identityId }}>\n      {children}\n    </HybriDBContext.Provider>\n  );\n}\n\nexport function useHybriDBClient(): HybriDBContextValue {\n  const ctx = useContext(HybriDBContext);\n  if (!ctx) {\n    throw new Error(\n      'useHybriDBClient must be used inside <HybriDBProvider>. ' +\n      'Wrap your app root (layout.tsx) with HybriDBProvider.',\n    );\n  }\n  return ctx;\n}\n"]}

package/dist/react.d.cts

@@ -0,0 +1,17 @@
+import React from 'react';
+import { H as HybriDBClient } from './client-DzNX2jDR.cjs';
+import './common/index.js';
+
+interface HybriDBContextValue {
+    client: HybriDBClient;
+    identityId: string;
+}
+interface HybriDBProviderProps {
+    client: HybriDBClient;
+    identityId: string;
+    children: React.ReactNode;
+}
+declare function HybriDBProvider({ client, identityId, children, }: HybriDBProviderProps): React.ReactElement;
+declare function useHybriDBClient(): HybriDBContextValue;
+
+export { HybriDBProvider, useHybriDBClient };

package/dist/react.d.ts

@@ -0,0 +1,17 @@
+import React from 'react';
+import { H as HybriDBClient } from './client-DzNX2jDR.js';
+import './common/index.js';
+
+interface HybriDBContextValue {
+    client: HybriDBClient;
+    identityId: string;
+}
+interface HybriDBProviderProps {
+    client: HybriDBClient;
+    identityId: string;
+    children: React.ReactNode;
+}
+declare function HybriDBProvider({ client, identityId, children, }: HybriDBProviderProps): React.ReactElement;
+declare function useHybriDBClient(): HybriDBContextValue;
+
+export { HybriDBProvider, useHybriDBClient };

package/dist/react.js

@@ -0,0 +1,25 @@
+import { createContext, useContext } from 'react';
+import { jsx } from 'react/jsx-runtime';
+
+/* @hybridb/sdk — Stellrai governed execution runtime */
+var HybriDBContext = createContext(null);
+function HybriDBProvider({
+  client,
+  identityId,
+  children
+}) {
+  return /* @__PURE__ */ jsx(HybriDBContext.Provider, { value: { client, identityId }, children });
+}
+function useHybriDBClient() {
+  const ctx = useContext(HybriDBContext);
+  if (!ctx) {
+    throw new Error(
+      "useHybriDBClient must be used inside <HybriDBProvider>. Wrap your app root (layout.tsx) with HybriDBProvider."
+    );
+  }
+  return ctx;
+}
+
+export { HybriDBProvider, useHybriDBClient };
+//# sourceMappingURL=react.js.map
+//# sourceMappingURL=react.js.map

package/dist/react.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/react.tsx"],"names":[],"mappings":";;;;AAsBA,IAAM,cAAA,GAAiB,cAA0C,IAAI,CAAA;AAQ9D,SAAS,eAAA,CAAgB;AAAA,EAC9B,MAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA,EAA6C;AAC3C,EAAA,uBACE,GAAA,CAAC,eAAe,QAAA,EAAf,EAAwB,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAW,EAClD,QAAA,EACH,CAAA;AAEJ;AAEO,SAAS,gBAAA,GAAwC;AACtD,EAAA,MAAM,GAAA,GAAM,WAAW,cAAc,CAAA;AACrC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KAEF;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT","file":"react.js","sourcesContent":["'use client';\n\n// @hybridb/sdk — React context\n// Provides HybriDBClient and resolved hybriDB identity to all React components.\n// All @stellrai/licensing hooks depend on this context.\n//\n// Usage (in app layout.tsx):\n//   <HybriDBProvider client={hybridb} identityId={session.hybridbIdentityId}>\n//     {children}\n//   </HybriDBProvider>\n//\n// Usage (in any client component):\n//   const { client, identityId } = useHybriDBClient();\n\nimport React, { createContext, useContext } from 'react';\nimport type { HybriDBClient } from './client.js';\n\ninterface HybriDBContextValue {\n  client: HybriDBClient;\n  identityId: string;\n}\n\nconst HybriDBContext = createContext<HybriDBContextValue | null>(null);\n\ninterface HybriDBProviderProps {\n  client: HybriDBClient;\n  identityId: string;\n  children: React.ReactNode;\n}\n\nexport function HybriDBProvider({\n  client,\n  identityId,\n  children,\n}: HybriDBProviderProps): React.ReactElement {\n  return (\n    <HybriDBContext.Provider value={{ client, identityId }}>\n      {children}\n    </HybriDBContext.Provider>\n  );\n}\n\nexport function useHybriDBClient(): HybriDBContextValue {\n  const ctx = useContext(HybriDBContext);\n  if (!ctx) {\n    throw new Error(\n      'useHybriDBClient must be used inside <HybriDBProvider>. ' +\n      'Wrap your app root (layout.tsx) with HybriDBProvider.',\n    );\n  }\n  return ctx;\n}\n"]}

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@hybridb/sdk",
+  "version": "0.1.0",
+  "description": "Official TypeScript SDK for the Stellrai governed execution runtime",
+  "keywords": [
+    "hybridb",
+    "stellrai",
+    "governance",
+    "execution",
+    "reversibility",
+    "rollback",
+    "audit",
+    "policy",
+    "sdk"
+  ],
+  "homepage": "https://stellrai.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/3pplea-Holdings/stellrai.git"
+  },
+  "bugs": {
+    "url": "https://github.com/3pplea-Holdings/stellrai/issues"
+  },
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "import": "./dist/react.js",
+      "require": "./dist/react.cjs"
+    }
+  },
+  "files": [
+    "dist/",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test:unit": "vitest run tests/unit",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "jose": "^5.3.0"
+  },
+  "peerDependencies": {
+    "react": ">=18.0.0",
+    "react-dom": ">=18.0.0"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@stellrai/config": "workspace:*",
+    "@stellrai/types": "workspace:*",
+    "@types/react": "^18.2.0",
+    "tsup": "^8.5.1",
+    "typescript": "^5.3.0",
+    "vitest": "^1.3.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}