@intlayer/api 9.0.0-canary.10 → 9.0.0-canary.12

package/dist/cjs/proxy.cjs

@@ -1,111 +1,93 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_getIntlayerAPI_oAuth = require('./getIntlayerAPI/oAuth.cjs');
-const require_getIntlayerAPI_index = require('./getIntlayerAPI/index.cjs');
+const require_cms_createIntlayerCMS = require('./cms/createIntlayerCMS.cjs');
+const require_getIntlayerAPI_ai = require('./getIntlayerAPI/ai.cjs');
+const require_getIntlayerAPI_asset = require('./getIntlayerAPI/asset.cjs');
+const require_getIntlayerAPI_audit = require('./getIntlayerAPI/audit.cjs');
+const require_getIntlayerAPI_bitbucket = require('./getIntlayerAPI/bitbucket.cjs');
+const require_getIntlayerAPI_dictionary = require('./getIntlayerAPI/dictionary.cjs');
+const require_getIntlayerAPI_editor = require('./getIntlayerAPI/editor.cjs');
+const require_getIntlayerAPI_environment = require('./getIntlayerAPI/environment.cjs');
+const require_getIntlayerAPI_github = require('./getIntlayerAPI/github.cjs');
+const require_getIntlayerAPI_gitlab = require('./getIntlayerAPI/gitlab.cjs');
+const require_getIntlayerAPI_newsletter = require('./getIntlayerAPI/newsletter.cjs');
+const require_getIntlayerAPI_organization = require('./getIntlayerAPI/organization.cjs');
+const require_getIntlayerAPI_project = require('./getIntlayerAPI/project.cjs');
+const require_getIntlayerAPI_reviewer = require('./getIntlayerAPI/reviewer.cjs');
+const require_getIntlayerAPI_search = require('./getIntlayerAPI/search.cjs');
+const require_getIntlayerAPI_showcaseProject = require('./getIntlayerAPI/showcaseProject.cjs');
+const require_getIntlayerAPI_status = require('./getIntlayerAPI/status.cjs');
+const require_getIntlayerAPI_stripe = require('./getIntlayerAPI/stripe.cjs');
+const require_getIntlayerAPI_tag = require('./getIntlayerAPI/tag.cjs');
+const require_getIntlayerAPI_translate = require('./getIntlayerAPI/translate.cjs');
+const require_getIntlayerAPI_user = require('./getIntlayerAPI/user.cjs');
 let _intlayer_config_built = require("@intlayer/config/built");
 
 //#region src/proxy.ts
-const ONE_MINUTE_MS = 6e4;
-/**
-* Returns the expiration timestamp in ms from an OAuth token-like object.
-*/
-const getExpiryTimestamp = (token) => {
-	if (!token) return void 0;
-	const dateLike = token.accessTokenExpiresAt ?? token.expiresAt;
-	if (dateLike) {
-		const ts = typeof dateLike === "string" ? Date.parse(dateLike) : dateLike.getTime?.();
-		if (typeof ts === "number" && Number.isFinite(ts)) return ts;
-	}
-	const seconds = token.expires_in ?? token.expiresIn;
-	if (typeof seconds === "number" && Number.isFinite(seconds)) return Date.now() + seconds * 1e3;
+const sectionFactories = {
+	asset: require_getIntlayerAPI_asset.getAssetAPI,
+	organization: require_getIntlayerAPI_organization.getOrganizationAPI,
+	project: require_getIntlayerAPI_project.getProjectAPI,
+	environment: require_getIntlayerAPI_environment.getEnvironmentAPI,
+	user: require_getIntlayerAPI_user.getUserAPI,
+	oAuth: require_getIntlayerAPI_oAuth.getOAuthAPI,
+	dictionary: require_getIntlayerAPI_dictionary.getDictionaryAPI,
+	stripe: require_getIntlayerAPI_stripe.getStripeAPI,
+	ai: require_getIntlayerAPI_ai.getAiAPI,
+	audit: require_getIntlayerAPI_audit.getAuditAPI,
+	tag: require_getIntlayerAPI_tag.getTagAPI,
+	search: require_getIntlayerAPI_search.getSearchAPI,
+	editor: require_getIntlayerAPI_editor.getEditorAPI,
+	newsletter: require_getIntlayerAPI_newsletter.getNewsletterAPI,
+	github: require_getIntlayerAPI_github.getGithubAPI,
+	gitlab: require_getIntlayerAPI_gitlab.getGitlabAPI,
+	bitbucket: require_getIntlayerAPI_bitbucket.getBitbucketAPI,
+	showcaseProject: require_getIntlayerAPI_showcaseProject.getShowcaseProjectAPI,
+	translate: require_getIntlayerAPI_translate.getTranslateAPI,
+	reviewer: require_getIntlayerAPI_reviewer.getReviewerAPI,
+	status: require_getIntlayerAPI_status.getStatusAPI
 };
-let currentAccessToken;
-let currentExpiryTs;
-let pendingRefresh;
+const AUTH_FREE_SECTIONS = new Set(["oAuth"]);
 /**
-* Build an auto-auth proxy around getIntlayerAPI that:
-* - Fetches an OAuth2 token when needed
-* - Injects Authorization header for each request
-* - Refreshes token proactively when near expiry
-*
-* When `sessionToken` is provided (a CLI session token starting with
-* "clisession_"), it is used directly as the Bearer token without any OAuth2
-* exchange — the backend validates it against the CliSessionToken collection.
+* Builds the **complete** auto-authenticated Intlayer API as a single lazy
+* object. Every domain is reachable through it, so it pulls every domain client
+* into the bundle.
 *
-* The returned API matches the shape of getIntlayerAPI.
+* Prefer {@link createIntlayerCMS} together with the per-domain endpoint binders
+* (e.g. `dictionaryEndpoint`) in bundle-sensitive code — they include only the
+* domains you use. This helper is a convenience for Node tools (such as the CLI)
+* where bundle size is not a concern.
 */
 const getIntlayerAPIProxy = (baseAuthOptions = {}, intlayerConfig = { editor: _intlayer_config_built.editor }, sessionToken) => {
-	const authOptionsRef = {
-		...baseAuthOptions,
-		credentials: "omit"
-	};
-	const hasCMSAuth = Boolean(sessionToken) || Boolean(intlayerConfig?.editor?.clientId && intlayerConfig?.editor?.clientSecret);
-	if (sessionToken) authOptionsRef.headers = {
-		...authOptionsRef.headers ?? {},
-		Authorization: `Bearer ${sessionToken}`
-	};
-	const baseApi = require_getIntlayerAPI_index.getIntlayerAPI(authOptionsRef, intlayerConfig);
-	const needsRefresh = () => {
-		if (!currentAccessToken) return true;
-		if (!currentExpiryTs) return false;
-		return Date.now() + ONE_MINUTE_MS >= currentExpiryTs;
+	const cms = require_cms_createIntlayerCMS.createIntlayerCMS(intlayerConfig, {
+		baseFetcherOptions: baseAuthOptions,
+		sessionToken
+	});
+	const sectionCache = /* @__PURE__ */ new Map();
+	const buildSection = (key) => {
+		const factory = sectionFactories[key];
+		return cms.bindSection(factory, { skipAuth: AUTH_FREE_SECTIONS.has(key) ? true : void 0 });
 	};
-	const refreshToken = async () => {
-		const doRefresh = async () => {
-			const tokenData = (await require_getIntlayerAPI_oAuth.getOAuthAPI({}, intlayerConfig).getOAuth2AccessToken())?.data;
-			currentAccessToken = tokenData?.accessToken;
-			currentExpiryTs = getExpiryTimestamp(tokenData);
-		};
-		if (!pendingRefresh) pendingRefresh = doRefresh().finally(() => {
-			pendingRefresh = void 0;
-		});
-		await pendingRefresh;
-	};
-	const ensureValidToken = async () => {
-		if (needsRefresh()) await refreshToken();
-	};
-	const applyAuthHeaderToRef = () => {
-		if (!currentAccessToken) return;
-		authOptionsRef.headers = {
-			...authOptionsRef.headers ?? {},
-			Authorization: `Bearer ${currentAccessToken}`
-		};
-	};
-	const wrapSection = (section, skipAuth = !hasCMSAuth) => {
-		return new Proxy(section, { get(target, prop, receiver) {
-			const value = Reflect.get(target, prop, receiver);
-			if (typeof value === "function") return async (...args) => {
-				if (!skipAuth) if (sessionToken) {} else {
-					await ensureValidToken();
-					applyAuthHeaderToRef();
-				}
-				try {
-					return await value.apply(target, args);
-				} catch (err) {
-					if (!skipAuth && !sessionToken) {
-						await refreshToken();
-						applyAuthHeaderToRef();
-						return await value.apply(target, args);
-					}
-					throw err;
-				}
+	return new Proxy({}, {
+		get(_target, property) {
+			const key = property;
+			if (!(key in sectionFactories)) return void 0;
+			if (!sectionCache.has(key)) sectionCache.set(key, buildSection(key));
+			return sectionCache.get(key);
+		},
+		has(_target, property) {
+			return property in sectionFactories;
+		},
+		ownKeys() {
+			return Reflect.ownKeys(sectionFactories);
+		},
+		getOwnPropertyDescriptor() {
+			return {
+				enumerable: true,
+				configurable: true
 			};
-			return value;
-		} });
-	};
-	return {
-		organization: wrapSection(baseApi.organization),
-		project: wrapSection(baseApi.project),
-		user: wrapSection(baseApi.user),
-		oAuth: wrapSection(baseApi.oAuth, true),
-		dictionary: wrapSection(baseApi.dictionary),
-		stripe: wrapSection(baseApi.stripe),
-		ai: wrapSection(baseApi.ai),
-		tag: wrapSection(baseApi.tag),
-		search: wrapSection(baseApi.search),
-		editor: wrapSection(baseApi.editor),
-		newsletter: wrapSection(baseApi.newsletter),
-		github: wrapSection(baseApi.github)
-	};
+		}
+	});
 };
 
 //#endregion

package/dist/cjs/proxy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.cjs","names":["getIntlayerAPI","getOAuthAPI"],"sources":["../../src/proxy.ts"],"sourcesContent":["import { editor } from '@intlayer/config/built';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport type { FetcherOptions } from './fetcher';\nimport { getIntlayerAPI } from './getIntlayerAPI';\nimport type { IntlayerAPI } from './getIntlayerAPI/index';\nimport { getOAuthAPI } from './getIntlayerAPI/oAuth';\n\ntype OAuthTokenLike = {\n  accessToken?: string;\n  accessTokenExpiresAt?: string | Date;\n  expires_in?: number;\n  expiresIn?: number;\n  expiresAt?: string | Date;\n};\n\nconst ONE_MINUTE_MS = 60_000;\n\n/**\n * Returns the expiration timestamp in ms from an OAuth token-like object.\n */\nconst getExpiryTimestamp = (\n  token: OAuthTokenLike | undefined\n): number | undefined => {\n  if (!token) return undefined;\n  const dateLike = (token.accessTokenExpiresAt ?? token.expiresAt) as\n    | string\n    | Date\n    | undefined;\n  if (dateLike) {\n    const ts =\n      typeof dateLike === 'string'\n        ? Date.parse(dateLike)\n        : dateLike.getTime?.();\n    if (typeof ts === 'number' && Number.isFinite(ts)) return ts;\n  }\n  const seconds = token.expires_in ?? token.expiresIn;\n  if (typeof seconds === 'number' && Number.isFinite(seconds)) {\n    return Date.now() + seconds * 1000;\n  }\n  return undefined;\n};\n\nlet currentAccessToken: string | undefined;\nlet currentExpiryTs: number | undefined;\nlet pendingRefresh: Promise<void> | undefined;\n\n/**\n * Build an auto-auth proxy around getIntlayerAPI that:\n * - Fetches an OAuth2 token when needed\n * - Injects Authorization header for each request\n * - Refreshes token proactively when near expiry\n *\n * When `sessionToken` is provided (a CLI session token starting with\n * \"clisession_\"), it is used directly as the Bearer token without any OAuth2\n * exchange — the backend validates it against the CliSessionToken collection.\n *\n * The returned API matches the shape of getIntlayerAPI.\n */\nexport const getIntlayerAPIProxy = (\n  baseAuthOptions: FetcherOptions = {},\n  intlayerConfig: Pick<IntlayerConfig, 'editor'> = { editor },\n  sessionToken?: string\n): IntlayerAPI => {\n  // Use a shared mutable auth options object captured by the API closures.\n  // credentials: 'omit' prevents the browser from attaching session cookies to\n  // these requests; authentication is handled exclusively via the Bearer token\n  // injected below. This is required because the backend only sets\n  // Access-Control-Allow-Credentials: true for whitelisted first-party origins.\n  const authOptionsRef: FetcherOptions = {\n    ...baseAuthOptions,\n    credentials: 'omit',\n  };\n  const hasCMSAuth =\n    Boolean(sessionToken) ||\n    Boolean(\n      intlayerConfig?.editor?.clientId && intlayerConfig?.editor?.clientSecret\n    );\n\n  // When a CLI session token is provided, inject it immediately and skip the\n  // OAuth2 client_credentials exchange entirely.\n  if (sessionToken) {\n    authOptionsRef.headers = {\n      ...(authOptionsRef.headers ?? {}),\n      Authorization: `Bearer ${sessionToken}`,\n    } as HeadersInit;\n  }\n\n  const baseApi = getIntlayerAPI(authOptionsRef, intlayerConfig);\n\n  const needsRefresh = (): boolean => {\n    if (!currentAccessToken) return true;\n    if (!currentExpiryTs) return false; // If unknown, assume usable until failure\n\n    return Date.now() + ONE_MINUTE_MS >= currentExpiryTs; // refresh 1 min before expiry\n  };\n\n  const refreshToken = async (): Promise<void> => {\n    const doRefresh = async () => {\n      const authApi = getOAuthAPI({}, intlayerConfig);\n      const res = await authApi.getOAuth2AccessToken();\n      const tokenData = res?.data as OAuthTokenLike | undefined;\n\n      currentAccessToken = tokenData?.accessToken;\n      currentExpiryTs = getExpiryTimestamp(tokenData);\n    };\n\n    if (!pendingRefresh) {\n      pendingRefresh = doRefresh().finally(() => {\n        pendingRefresh = undefined;\n      });\n    }\n    await pendingRefresh;\n  };\n\n  const ensureValidToken = async () => {\n    if (needsRefresh()) {\n      await refreshToken();\n    }\n  };\n\n  const applyAuthHeaderToRef = () => {\n    if (!currentAccessToken) return;\n    authOptionsRef.headers = {\n      ...(authOptionsRef.headers ?? {}),\n      Authorization: `Bearer ${currentAccessToken}`,\n    } as HeadersInit;\n  };\n\n  const wrapSection = <T extends Record<string, unknown>>(\n    section: T,\n    skipAuth = !hasCMSAuth\n  ): T => {\n    return new Proxy(section, {\n      get(target, prop, receiver) {\n        const value = Reflect.get(target, prop, receiver);\n\n        if (typeof value === 'function') {\n          // Wrap section method to inject token and headers\n          return async (...args: unknown[]) => {\n            if (!skipAuth) {\n              if (sessionToken) {\n                // Session token is pre-injected in authOptionsRef; no OAuth2 exchange needed\n              } else {\n                await ensureValidToken();\n                applyAuthHeaderToRef();\n              }\n            }\n\n            try {\n              return await value.apply(target, args);\n            } catch (err) {\n              // Best-effort retry: if token might be stale, refresh once and retry\n              if (!skipAuth && !sessionToken) {\n                await refreshToken();\n                applyAuthHeaderToRef();\n                return await value.apply(target, args);\n              }\n              throw err;\n            }\n          };\n        }\n\n        return value;\n      },\n    });\n  };\n\n  return {\n    organization: wrapSection(baseApi.organization),\n    project: wrapSection(baseApi.project),\n    user: wrapSection(baseApi.user),\n    oAuth: wrapSection(baseApi.oAuth, true), // do NOT inject auth for token endpoint\n    dictionary: wrapSection(baseApi.dictionary),\n    stripe: wrapSection(baseApi.stripe),\n    ai: wrapSection(baseApi.ai),\n    tag: wrapSection(baseApi.tag),\n    search: wrapSection(baseApi.search),\n    editor: wrapSection(baseApi.editor),\n    newsletter: wrapSection(baseApi.newsletter),\n    github: wrapSection(baseApi.github),\n  } as IntlayerAPI;\n};\n\nexport type IntlayerAPIProxy = ReturnType<typeof getIntlayerAPIProxy>;\n"],"mappings":";;;;;;AAeA,MAAM,gBAAgB;;;;AAKtB,MAAM,sBACJ,UACuB;AACvB,KAAI,CAAC,MAAO,QAAO;CACnB,MAAM,WAAY,MAAM,wBAAwB,MAAM;AAItD,KAAI,UAAU;EACZ,MAAM,KACJ,OAAO,aAAa,WAChB,KAAK,MAAM,SAAS,GACpB,SAAS,WAAW;AAC1B,MAAI,OAAO,OAAO,YAAY,OAAO,SAAS,GAAG,CAAE,QAAO;;CAE5D,MAAM,UAAU,MAAM,cAAc,MAAM;AAC1C,KAAI,OAAO,YAAY,YAAY,OAAO,SAAS,QAAQ,CACzD,QAAO,KAAK,KAAK,GAAG,UAAU;;AAKlC,IAAI;AACJ,IAAI;AACJ,IAAI;;;;;;;;;;;;;AAcJ,MAAa,uBACX,kBAAkC,EAAE,EACpC,iBAAiD,EAAE,uCAAQ,EAC3D,iBACgB;CAMhB,MAAM,iBAAiC;EACrC,GAAG;EACH,aAAa;EACd;CACD,MAAM,aACJ,QAAQ,aAAa,IACrB,QACE,gBAAgB,QAAQ,YAAY,gBAAgB,QAAQ,aAC7D;AAIH,KAAI,aACF,gBAAe,UAAU;EACvB,GAAI,eAAe,WAAW,EAAE;EAChC,eAAe,UAAU;EAC1B;CAGH,MAAM,UAAUA,4CAAe,gBAAgB,eAAe;CAE9D,MAAM,qBAA8B;AAClC,MAAI,CAAC,mBAAoB,QAAO;AAChC,MAAI,CAAC,gBAAiB,QAAO;AAE7B,SAAO,KAAK,KAAK,GAAG,iBAAiB;;CAGvC,MAAM,eAAe,YAA2B;EAC9C,MAAM,YAAY,YAAY;GAG5B,MAAM,aAAY,MAFFC,yCAAY,EAAE,EAAE,eACP,CAAC,sBAAsB,GACzB;AAEvB,wBAAqB,WAAW;AAChC,qBAAkB,mBAAmB,UAAU;;AAGjD,MAAI,CAAC,eACH,kBAAiB,WAAW,CAAC,cAAc;AACzC,oBAAiB;IACjB;AAEJ,QAAM;;CAGR,MAAM,mBAAmB,YAAY;AACnC,MAAI,cAAc,CAChB,OAAM,cAAc;;CAIxB,MAAM,6BAA6B;AACjC,MAAI,CAAC,mBAAoB;AACzB,iBAAe,UAAU;GACvB,GAAI,eAAe,WAAW,EAAE;GAChC,eAAe,UAAU;GAC1B;;CAGH,MAAM,eACJ,SACA,WAAW,CAAC,eACN;AACN,SAAO,IAAI,MAAM,SAAS,EACxB,IAAI,QAAQ,MAAM,UAAU;GAC1B,MAAM,QAAQ,QAAQ,IAAI,QAAQ,MAAM,SAAS;AAEjD,OAAI,OAAO,UAAU,WAEnB,QAAO,OAAO,GAAG,SAAoB;AACnC,QAAI,CAAC,SACH,KAAI,cAAc,QAEX;AACL,WAAM,kBAAkB;AACxB,2BAAsB;;AAI1B,QAAI;AACF,YAAO,MAAM,MAAM,MAAM,QAAQ,KAAK;aAC/B,KAAK;AAEZ,SAAI,CAAC,YAAY,CAAC,cAAc;AAC9B,YAAM,cAAc;AACpB,4BAAsB;AACtB,aAAO,MAAM,MAAM,MAAM,QAAQ,KAAK;;AAExC,WAAM;;;AAKZ,UAAO;KAEV,CAAC;;AAGJ,QAAO;EACL,cAAc,YAAY,QAAQ,aAAa;EAC/C,SAAS,YAAY,QAAQ,QAAQ;EACrC,MAAM,YAAY,QAAQ,KAAK;EAC/B,OAAO,YAAY,QAAQ,OAAO,KAAK;EACvC,YAAY,YAAY,QAAQ,WAAW;EAC3C,QAAQ,YAAY,QAAQ,OAAO;EACnC,IAAI,YAAY,QAAQ,GAAG;EAC3B,KAAK,YAAY,QAAQ,IAAI;EAC7B,QAAQ,YAAY,QAAQ,OAAO;EACnC,QAAQ,YAAY,QAAQ,OAAO;EACnC,YAAY,YAAY,QAAQ,WAAW;EAC3C,QAAQ,YAAY,QAAQ,OAAO;EACpC"}
+{"version":3,"file":"proxy.cjs","names":["getAssetAPI","getOrganizationAPI","getProjectAPI","getEnvironmentAPI","getUserAPI","getOAuthAPI","getDictionaryAPI","getStripeAPI","getAiAPI","getAuditAPI","getTagAPI","getSearchAPI","getEditorAPI","getNewsletterAPI","getGithubAPI","getGitlabAPI","getBitbucketAPI","getShowcaseProjectAPI","getTranslateAPI","getReviewerAPI","getStatusAPI","createIntlayerCMS"],"sources":["../../src/proxy.ts"],"sourcesContent":["import { editor } from '@intlayer/config/built';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { createIntlayerCMS, type IntlayerCMS } from './cms/createIntlayerCMS';\nimport type { FetcherOptions } from './fetcher';\nimport { getAiAPI } from './getIntlayerAPI/ai';\nimport { getAssetAPI } from './getIntlayerAPI/asset';\nimport { getAuditAPI } from './getIntlayerAPI/audit';\nimport { getBitbucketAPI } from './getIntlayerAPI/bitbucket';\nimport { getDictionaryAPI } from './getIntlayerAPI/dictionary';\nimport { getEditorAPI } from './getIntlayerAPI/editor';\nimport { getEnvironmentAPI } from './getIntlayerAPI/environment';\nimport { getGithubAPI } from './getIntlayerAPI/github';\nimport { getGitlabAPI } from './getIntlayerAPI/gitlab';\nimport type { IntlayerAPI } from './getIntlayerAPI/index';\nimport { getNewsletterAPI } from './getIntlayerAPI/newsletter';\nimport { getOAuthAPI } from './getIntlayerAPI/oAuth';\nimport { getOrganizationAPI } from './getIntlayerAPI/organization';\nimport { getProjectAPI } from './getIntlayerAPI/project';\nimport { getReviewerAPI } from './getIntlayerAPI/reviewer';\nimport { getSearchAPI } from './getIntlayerAPI/search';\nimport { getShowcaseProjectAPI } from './getIntlayerAPI/showcaseProject';\nimport { getStatusAPI } from './getIntlayerAPI/status';\nimport { getStripeAPI } from './getIntlayerAPI/stripe';\nimport { getTagAPI } from './getIntlayerAPI/tag';\nimport { getTranslateAPI } from './getIntlayerAPI/translate';\nimport { getUserAPI } from './getIntlayerAPI/user';\n\ntype SectionKey = keyof IntlayerAPI;\n\n/**\n * Homogeneous factory map: every domain factory normalized to the same\n * `(fetcherOptions, config) => section` signature, keyed by section name.\n * Declaring it as a single mapped type lets a generic lookup stay callable\n * (a union of factory signatures would not be).\n */\ntype SectionFactories = {\n  [Key in SectionKey]: (\n    fetcherOptions: FetcherOptions,\n    intlayerConfig: IntlayerConfig\n  ) => IntlayerAPI[Key];\n};\n\nconst sectionFactories: SectionFactories = {\n  asset: getAssetAPI,\n  organization: getOrganizationAPI,\n  project: getProjectAPI,\n  environment: getEnvironmentAPI,\n  user: getUserAPI,\n  oAuth: getOAuthAPI,\n  dictionary: getDictionaryAPI,\n  stripe: getStripeAPI,\n  ai: getAiAPI,\n  audit: getAuditAPI,\n  tag: getTagAPI,\n  search: getSearchAPI,\n  editor: getEditorAPI,\n  newsletter: getNewsletterAPI,\n  github: getGithubAPI,\n  gitlab: getGitlabAPI,\n  bitbucket: getBitbucketAPI,\n  showcaseProject: getShowcaseProjectAPI,\n  translate: getTranslateAPI,\n  reviewer: getReviewerAPI,\n  status: getStatusAPI,\n};\n\n// The OAuth2 token endpoint must never receive an injected Bearer token —\n// it is the call that issues one.\nconst AUTH_FREE_SECTIONS: ReadonlySet<SectionKey> = new Set<SectionKey>([\n  'oAuth',\n]);\n\n/**\n * Builds the **complete** auto-authenticated Intlayer API as a single lazy\n * object. Every domain is reachable through it, so it pulls every domain client\n * into the bundle.\n *\n * Prefer {@link createIntlayerCMS} together with the per-domain endpoint binders\n * (e.g. `dictionaryEndpoint`) in bundle-sensitive code — they include only the\n * domains you use. This helper is a convenience for Node tools (such as the CLI)\n * where bundle size is not a concern.\n */\nexport const getIntlayerAPIProxy = (\n  baseAuthOptions: FetcherOptions = {},\n  intlayerConfig: Pick<IntlayerConfig, 'editor'> = { editor },\n  sessionToken?: string\n): IntlayerAPI => {\n  const cms: IntlayerCMS = createIntlayerCMS(intlayerConfig, {\n    baseFetcherOptions: baseAuthOptions,\n    sessionToken,\n  });\n\n  const sectionCache = new Map<SectionKey, unknown>();\n\n  // Generic over `Key` so `sectionFactories[key]` resolves to a single\n  // `(opts, config) => IntlayerAPI[Key]` signature rather than the union of all\n  // factory signatures (which would not be callable).\n  const buildSection = <Key extends SectionKey>(key: Key): IntlayerAPI[Key] => {\n    const factory = sectionFactories[key] as (\n      fetcherOptions: FetcherOptions,\n      intlayerConfig: IntlayerConfig\n    ) => Record<string, unknown>;\n\n    return cms.bindSection(factory, {\n      skipAuth: AUTH_FREE_SECTIONS.has(key) ? true : undefined,\n    }) as IntlayerAPI[Key];\n  };\n\n  return new Proxy({} as IntlayerAPI, {\n    get(_target, property) {\n      const key = property as SectionKey;\n      if (!(key in sectionFactories)) return undefined;\n\n      if (!sectionCache.has(key)) {\n        sectionCache.set(key, buildSection(key));\n      }\n\n      return sectionCache.get(key);\n    },\n    has(_target, property) {\n      return (property as SectionKey) in sectionFactories;\n    },\n    ownKeys() {\n      return Reflect.ownKeys(sectionFactories);\n    },\n    getOwnPropertyDescriptor() {\n      return { enumerable: true, configurable: true };\n    },\n  });\n};\n\n/**\n * The complete auto-authenticated Intlayer API returned by\n * {@link getIntlayerAPIProxy}. Equivalent in shape to `IntlayerAPI`.\n */\nexport type IntlayerAPIProxy = ReturnType<typeof getIntlayerAPIProxy>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,MAAM,mBAAqC;CACzC,OAAOA;CACP,cAAcC;CACd,SAASC;CACT,aAAaC;CACb,MAAMC;CACN,OAAOC;CACP,YAAYC;CACZ,QAAQC;CACR,IAAIC;CACJ,OAAOC;CACP,KAAKC;CACL,QAAQC;CACR,QAAQC;CACR,YAAYC;CACZ,QAAQC;CACR,QAAQC;CACR,WAAWC;CACX,iBAAiBC;CACjB,WAAWC;CACX,UAAUC;CACV,QAAQC;CACT;AAID,MAAM,qBAA8C,IAAI,IAAgB,CACtE,QACD,CAAC;;;;;;;;;;;AAYF,MAAa,uBACX,kBAAkC,EAAE,EACpC,iBAAiD,EAAE,uCAAQ,EAC3D,iBACgB;CAChB,MAAM,MAAmBC,gDAAkB,gBAAgB;EACzD,oBAAoB;EACpB;EACD,CAAC;CAEF,MAAM,+BAAe,IAAI,KAA0B;CAKnD,MAAM,gBAAwC,QAA+B;EAC3E,MAAM,UAAU,iBAAiB;AAKjC,SAAO,IAAI,YAAY,SAAS,EAC9B,UAAU,mBAAmB,IAAI,IAAI,GAAG,OAAO,QAChD,CAAC;;AAGJ,QAAO,IAAI,MAAM,EAAE,EAAiB;EAClC,IAAI,SAAS,UAAU;GACrB,MAAM,MAAM;AACZ,OAAI,EAAE,OAAO,kBAAmB,QAAO;AAEvC,OAAI,CAAC,aAAa,IAAI,IAAI,CACxB,cAAa,IAAI,KAAK,aAAa,IAAI,CAAC;AAG1C,UAAO,aAAa,IAAI,IAAI;;EAE9B,IAAI,SAAS,UAAU;AACrB,UAAQ,YAA2B;;EAErC,UAAU;AACR,UAAO,QAAQ,QAAQ,iBAAiB;;EAE1C,2BAA2B;AACzB,UAAO;IAAE,YAAY;IAAM,cAAc;IAAM;;EAElD,CAAC"}

package/dist/esm/cms/createAuthManager.mjs

@@ -0,0 +1,115 @@
+import { getOAuthAPI } from "../getIntlayerAPI/oAuth.mjs";
+import { editor } from "@intlayer/config/built";
+import { defu } from "defu";
+
+//#region src/cms/createAuthManager.ts
+const ONE_MINUTE_MS = 6e4;
+/**
+* Resolves the expiration timestamp (in ms since epoch) from an OAuth2
+* token-like payload, supporting both absolute dates and relative durations.
+*/
+const getExpiryTimestamp = (token) => {
+	if (!token) return void 0;
+	const dateLike = token.accessTokenExpiresAt ?? token.expiresAt;
+	if (dateLike) {
+		const timestamp = typeof dateLike === "string" ? Date.parse(dateLike) : dateLike.getTime?.();
+		if (typeof timestamp === "number" && Number.isFinite(timestamp)) return timestamp;
+	}
+	const seconds = token.expires_in ?? token.expiresIn;
+	if (typeof seconds === "number" && Number.isFinite(seconds)) return Date.now() + seconds * 1e3;
+};
+/**
+* Creates an instance-scoped {@link AuthManager} handling the OAuth2
+* `client_credentials` flow (or a pre-issued CLI session token).
+*
+* Unlike a global token cache, each manager keeps its own token state, so
+* independent SDK instances never interfere with one another.
+*
+* @param intlayerConfig - Intlayer configuration carrying the `editor`
+* credentials. Defaults to the build-time configuration.
+* @param options - Optional session token and base fetcher options.
+*/
+const createAuthManager = (intlayerConfig = { editor }, options = {}) => {
+	const { baseFetcherOptions = {}, sessionToken } = options;
+	const resolvedConfig = defu(intlayerConfig ?? {}, { editor });
+	const fetcherOptions = {
+		...baseFetcherOptions,
+		credentials: "omit"
+	};
+	const hasCredentials = Boolean(sessionToken) || Boolean(resolvedConfig?.editor?.clientId && resolvedConfig?.editor?.clientSecret);
+	if (sessionToken) fetcherOptions.headers = {
+		...fetcherOptions.headers ?? {},
+		Authorization: `Bearer ${sessionToken}`
+	};
+	let accessToken;
+	let expiryTimestamp;
+	let pendingRefresh;
+	const needsRefresh = () => {
+		if (!accessToken) return true;
+		if (!expiryTimestamp) return false;
+		return Date.now() + ONE_MINUTE_MS >= expiryTimestamp;
+	};
+	const refreshToken = async () => {
+		const doRefresh = async () => {
+			const tokenData = (await getOAuthAPI({}, resolvedConfig).getOAuth2AccessToken())?.data;
+			accessToken = tokenData?.accessToken;
+			expiryTimestamp = getExpiryTimestamp(tokenData);
+		};
+		pendingRefresh ??= doRefresh().finally(() => {
+			pendingRefresh = void 0;
+		});
+		await pendingRefresh;
+	};
+	const applyAuthHeader = () => {
+		if (!accessToken) return;
+		fetcherOptions.headers = {
+			...fetcherOptions.headers ?? {},
+			Authorization: `Bearer ${accessToken}`
+		};
+	};
+	const ensureAuth = async () => {
+		if (sessionToken) return;
+		if (needsRefresh()) await refreshToken();
+		applyAuthHeader();
+	};
+	const reset = () => {
+		accessToken = void 0;
+		expiryTimestamp = void 0;
+	};
+	const withAuth = (method, skipAuth = !hasCredentials) => {
+		if (skipAuth) return method;
+		return async (...args) => {
+			await ensureAuth();
+			try {
+				return await method(...args);
+			} catch (error) {
+				if (sessionToken) throw error;
+				await refreshToken();
+				applyAuthHeader();
+				return await method(...args);
+			}
+		};
+	};
+	const bindSection = (factory, bindOptions = {}) => {
+		const section = factory(fetcherOptions, resolvedConfig);
+		const skipAuth = bindOptions.skipAuth ?? !hasCredentials;
+		return new Proxy(section, { get(target, property, receiver) {
+			const value = Reflect.get(target, property, receiver);
+			if (typeof value !== "function") return value;
+			return withAuth(value.bind(target), skipAuth);
+		} });
+	};
+	return {
+		fetcherOptions,
+		intlayerConfig: resolvedConfig,
+		hasCredentials,
+		ensureAuth,
+		reset,
+		withAuth,
+		bindSection
+	};
+};
+
+//#endregion
+export { createAuthManager };
+//# sourceMappingURL=createAuthManager.mjs.map

package/dist/esm/cms/createAuthManager.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAuthManager.mjs","names":[],"sources":["../../../src/cms/createAuthManager.ts"],"sourcesContent":["import { editor } from '@intlayer/config/built';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { defu } from 'defu';\nimport type { FetcherOptions } from '../fetcher';\nimport { getOAuthAPI } from '../getIntlayerAPI/oAuth';\n\n/**\n * Shape of the various OAuth2 token payloads the backend may return. Only the\n * fields used to derive the expiration timestamp are described here.\n */\ntype OAuthTokenLike = {\n  accessToken?: string;\n  accessTokenExpiresAt?: string | Date;\n  expires_in?: number;\n  expiresIn?: number;\n  expiresAt?: string | Date;\n};\n\n/**\n * Any asynchronous API method exposed by a domain section\n * (e.g. `getDictionaries`, `pushDictionaries`).\n */\ntype AsyncMethod<Arguments extends unknown[], Result> = (\n  ...args: Arguments\n) => Promise<Result>;\n\n/**\n * A domain section factory: builds a plain object of async methods from shared\n * fetcher options and the Intlayer configuration.\n */\ntype SectionFactory<Section extends Record<string, unknown>> = (\n  fetcherOptions: FetcherOptions,\n  intlayerConfig: IntlayerConfig\n) => Section;\n\nconst ONE_MINUTE_MS = 60_000;\n\n/**\n * Resolves the expiration timestamp (in ms since epoch) from an OAuth2\n * token-like payload, supporting both absolute dates and relative durations.\n */\nconst getExpiryTimestamp = (\n  token: OAuthTokenLike | undefined\n): number | undefined => {\n  if (!token) return undefined;\n\n  const dateLike = (token.accessTokenExpiresAt ?? token.expiresAt) as\n    | string\n    | Date\n    | undefined;\n\n  if (dateLike) {\n    const timestamp =\n      typeof dateLike === 'string'\n        ? Date.parse(dateLike)\n        : dateLike.getTime?.();\n    if (typeof timestamp === 'number' && Number.isFinite(timestamp)) {\n      return timestamp;\n    }\n  }\n\n  const seconds = token.expires_in ?? token.expiresIn;\n  if (typeof seconds === 'number' && Number.isFinite(seconds)) {\n    return Date.now() + seconds * 1000;\n  }\n\n  return undefined;\n};\n\n/**\n * Options accepted when creating an {@link AuthManager}.\n */\nexport type AuthManagerOptions = {\n  /**\n   * Base fetcher options merged into every request (e.g. custom headers).\n   */\n  baseFetcherOptions?: FetcherOptions;\n  /**\n   * A pre-issued CLI session token (prefixed with `clisession_`). When provided,\n   * it is used directly as the Bearer token and the OAuth2 `client_credentials`\n   * exchange is skipped entirely.\n   */\n  sessionToken?: string;\n};\n\n/**\n * Options accepted when binding a domain section to an {@link AuthManager}.\n */\nexport type BindSectionOptions = {\n  /**\n   * Forces auth injection on (`false`) or off (`true`). Defaults to enabled\n   * whenever credentials are available.\n   */\n  skipAuth?: boolean;\n};\n\n/**\n * Manages CMS authentication for a set of API calls.\n *\n * The manager owns a single mutable {@link FetcherOptions} object\n * (`fetcherOptions`). Domain factories bound through it share the same\n * reference, so refreshing the token in place transparently authenticates every\n * call — without rebuilding the API clients.\n */\nexport type AuthManager = {\n  /**\n   * Mutable fetcher options carrying the `Authorization` header. Bound sections\n   * share this reference so the injected token is reused everywhere.\n   */\n  fetcherOptions: FetcherOptions;\n  /**\n   * The resolved Intlayer configuration (merged with the build-time defaults).\n   */\n  intlayerConfig: IntlayerConfig;\n  /**\n   * `true` when credentials are available — either a session token or a\n   * `clientId`/`clientSecret` pair in the configuration.\n   */\n  hasCredentials: boolean;\n  /**\n   * Ensures a valid access token is available and applies it to\n   * `fetcherOptions`. Called automatically by {@link withAuth}.\n   */\n  ensureAuth: () => Promise<void>;\n  /**\n   * Forces a token refresh on the next call by clearing the cached token.\n   */\n  reset: () => void;\n  /**\n   * Wraps a single API method so it injects (and, on failure, refreshes) the\n   * access token on every invocation while preserving the method's signature.\n   */\n  withAuth: <Arguments extends unknown[], Result>(\n    method: AsyncMethod<Arguments, Result>,\n    skipAuth?: boolean\n  ) => AsyncMethod<Arguments, Result>;\n  /**\n   * Instantiates a domain factory with the managed fetcher options and config,\n   * returning a section whose every method authenticates automatically.\n   *\n   * @example\n   * ```ts\n   * const dictionary = authManager.bindSection(getDictionaryAPI);\n   * await dictionary.pushDictionaries(dictionaries);\n   * ```\n   */\n  bindSection: <Section extends Record<string, unknown>>(\n    factory: SectionFactory<Section>,\n    options?: BindSectionOptions\n  ) => Section;\n};\n\n/**\n * Creates an instance-scoped {@link AuthManager} handling the OAuth2\n * `client_credentials` flow (or a pre-issued CLI session token).\n *\n * Unlike a global token cache, each manager keeps its own token state, so\n * independent SDK instances never interfere with one another.\n *\n * @param intlayerConfig - Intlayer configuration carrying the `editor`\n * credentials. Defaults to the build-time configuration.\n * @param options - Optional session token and base fetcher options.\n */\nexport const createAuthManager = (\n  intlayerConfig: Pick<IntlayerConfig, 'editor'> = { editor },\n  options: AuthManagerOptions = {}\n): AuthManager => {\n  const { baseFetcherOptions = {}, sessionToken } = options;\n\n  const resolvedConfig = defu(intlayerConfig ?? {}, {\n    editor,\n  }) as IntlayerConfig;\n\n  // `credentials: 'omit'` prevents the browser from attaching session cookies;\n  // authentication is handled exclusively through the injected Bearer token.\n  // This is required because the backend only allows credentialed requests for\n  // whitelisted first-party origins.\n  const fetcherOptions: FetcherOptions = {\n    ...baseFetcherOptions,\n    credentials: 'omit',\n  };\n\n  const hasCredentials =\n    Boolean(sessionToken) ||\n    Boolean(\n      resolvedConfig?.editor?.clientId && resolvedConfig?.editor?.clientSecret\n    );\n\n  // A session token is used as-is and never expires within the SDK's concern,\n  // so inject it once up-front and skip the OAuth2 exchange.\n  if (sessionToken) {\n    fetcherOptions.headers = {\n      ...(fetcherOptions.headers ?? {}),\n      Authorization: `Bearer ${sessionToken}`,\n    } as HeadersInit;\n  }\n\n  let accessToken: string | undefined;\n  let expiryTimestamp: number | undefined;\n  let pendingRefresh: Promise<void> | undefined;\n\n  const needsRefresh = (): boolean => {\n    if (!accessToken) return true;\n    if (!expiryTimestamp) return false; // Unknown expiry: assume usable until failure.\n\n    // Refresh one minute before the actual expiry to avoid edge-of-expiry races.\n    return Date.now() + ONE_MINUTE_MS >= expiryTimestamp;\n  };\n\n  const refreshToken = async (): Promise<void> => {\n    const doRefresh = async (): Promise<void> => {\n      const oAuthAPI = getOAuthAPI({}, resolvedConfig);\n      const response = await oAuthAPI.getOAuth2AccessToken();\n      const tokenData = response?.data as OAuthTokenLike | undefined;\n\n      accessToken = tokenData?.accessToken;\n      expiryTimestamp = getExpiryTimestamp(tokenData);\n    };\n\n    // De-duplicate concurrent refreshes so a burst of calls triggers one fetch.\n    pendingRefresh ??= doRefresh().finally(() => {\n      pendingRefresh = undefined;\n    });\n\n    await pendingRefresh;\n  };\n\n  const applyAuthHeader = (): void => {\n    if (!accessToken) return;\n    fetcherOptions.headers = {\n      ...(fetcherOptions.headers ?? {}),\n      Authorization: `Bearer ${accessToken}`,\n    } as HeadersInit;\n  };\n\n  const ensureAuth = async (): Promise<void> => {\n    if (sessionToken) return; // Already injected; nothing to refresh.\n    if (needsRefresh()) {\n      await refreshToken();\n    }\n    applyAuthHeader();\n  };\n\n  const reset = (): void => {\n    accessToken = undefined;\n    expiryTimestamp = undefined;\n  };\n\n  const withAuth = <Arguments extends unknown[], Result>(\n    method: AsyncMethod<Arguments, Result>,\n    skipAuth = !hasCredentials\n  ): AsyncMethod<Arguments, Result> => {\n    if (skipAuth) return method;\n\n    return async (...args: Arguments): Promise<Result> => {\n      await ensureAuth();\n\n      try {\n        return await method(...args);\n      } catch (error) {\n        // The token may have been revoked or expired early: refresh once and\n        // retry before surfacing the error. A session token cannot be\n        // refreshed, so re-throw immediately in that case.\n        if (sessionToken) throw error;\n\n        await refreshToken();\n        applyAuthHeader();\n        return await method(...args);\n      }\n    };\n  };\n\n  const bindSection = <Section extends Record<string, unknown>>(\n    factory: SectionFactory<Section>,\n    bindOptions: BindSectionOptions = {}\n  ): Section => {\n    const section = factory(fetcherOptions, resolvedConfig);\n    const skipAuth = bindOptions.skipAuth ?? !hasCredentials;\n\n    return new Proxy(section, {\n      get(target, property, receiver) {\n        const value = Reflect.get(target, property, receiver);\n\n        if (typeof value !== 'function') return value;\n\n        return withAuth(\n          (value as AsyncMethod<unknown[], unknown>).bind(target),\n          skipAuth\n        );\n      },\n    });\n  };\n\n  return {\n    fetcherOptions,\n    intlayerConfig: resolvedConfig,\n    hasCredentials,\n    ensureAuth,\n    reset,\n    withAuth,\n    bindSection,\n  };\n};\n"],"mappings":";;;;;AAmCA,MAAM,gBAAgB;;;;;AAMtB,MAAM,sBACJ,UACuB;AACvB,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,WAAY,MAAM,wBAAwB,MAAM;AAKtD,KAAI,UAAU;EACZ,MAAM,YACJ,OAAO,aAAa,WAChB,KAAK,MAAM,SAAS,GACpB,SAAS,WAAW;AAC1B,MAAI,OAAO,cAAc,YAAY,OAAO,SAAS,UAAU,CAC7D,QAAO;;CAIX,MAAM,UAAU,MAAM,cAAc,MAAM;AAC1C,KAAI,OAAO,YAAY,YAAY,OAAO,SAAS,QAAQ,CACzD,QAAO,KAAK,KAAK,GAAG,UAAU;;;;;;;;;;;;;AAoGlC,MAAa,qBACX,iBAAiD,EAAE,QAAQ,EAC3D,UAA8B,EAAE,KAChB;CAChB,MAAM,EAAE,qBAAqB,EAAE,EAAE,iBAAiB;CAElD,MAAM,iBAAiB,KAAK,kBAAkB,EAAE,EAAE,EAChD,QACD,CAAC;CAMF,MAAM,iBAAiC;EACrC,GAAG;EACH,aAAa;EACd;CAED,MAAM,iBACJ,QAAQ,aAAa,IACrB,QACE,gBAAgB,QAAQ,YAAY,gBAAgB,QAAQ,aAC7D;AAIH,KAAI,aACF,gBAAe,UAAU;EACvB,GAAI,eAAe,WAAW,EAAE;EAChC,eAAe,UAAU;EAC1B;CAGH,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,MAAM,qBAA8B;AAClC,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI,CAAC,gBAAiB,QAAO;AAG7B,SAAO,KAAK,KAAK,GAAG,iBAAiB;;CAGvC,MAAM,eAAe,YAA2B;EAC9C,MAAM,YAAY,YAA2B;GAG3C,MAAM,aAAY,MAFD,YAAY,EAAE,EAAE,eACF,CAAC,sBAAsB,GAC1B;AAE5B,iBAAc,WAAW;AACzB,qBAAkB,mBAAmB,UAAU;;AAIjD,qBAAmB,WAAW,CAAC,cAAc;AAC3C,oBAAiB;IACjB;AAEF,QAAM;;CAGR,MAAM,wBAA8B;AAClC,MAAI,CAAC,YAAa;AAClB,iBAAe,UAAU;GACvB,GAAI,eAAe,WAAW,EAAE;GAChC,eAAe,UAAU;GAC1B;;CAGH,MAAM,aAAa,YAA2B;AAC5C,MAAI,aAAc;AAClB,MAAI,cAAc,CAChB,OAAM,cAAc;AAEtB,mBAAiB;;CAGnB,MAAM,cAAoB;AACxB,gBAAc;AACd,oBAAkB;;CAGpB,MAAM,YACJ,QACA,WAAW,CAAC,mBACuB;AACnC,MAAI,SAAU,QAAO;AAErB,SAAO,OAAO,GAAG,SAAqC;AACpD,SAAM,YAAY;AAElB,OAAI;AACF,WAAO,MAAM,OAAO,GAAG,KAAK;YACrB,OAAO;AAId,QAAI,aAAc,OAAM;AAExB,UAAM,cAAc;AACpB,qBAAiB;AACjB,WAAO,MAAM,OAAO,GAAG,KAAK;;;;CAKlC,MAAM,eACJ,SACA,cAAkC,EAAE,KACxB;EACZ,MAAM,UAAU,QAAQ,gBAAgB,eAAe;EACvD,MAAM,WAAW,YAAY,YAAY,CAAC;AAE1C,SAAO,IAAI,MAAM,SAAS,EACxB,IAAI,QAAQ,UAAU,UAAU;GAC9B,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,SAAS;AAErD,OAAI,OAAO,UAAU,WAAY,QAAO;AAExC,UAAO,SACJ,MAA0C,KAAK,OAAO,EACvD,SACD;KAEJ,CAAC;;AAGJ,QAAO;EACL;EACA,gBAAgB;EAChB;EACA;EACA;EACA;EACA;EACD"}

package/dist/esm/cms/createIntlayerCMS.mjs

@@ -0,0 +1,62 @@
+import { createAuthManager } from "./createAuthManager.mjs";
+import { editor } from "@intlayer/config/built";
+
+//#region src/cms/createIntlayerCMS.ts
+/**
+* Creates an Intlayer CMS authenticator handling authentication automatically
+* (OAuth2 `client_credentials`, or a CLI session token).
+*
+* This factory is intentionally lightweight: it does **not** bundle any domain
+* client. Combine it with the per-domain endpoint binders — imported separately
+* so only the domains you use are included in your bundle.
+*
+* The configuration is optional: when omitted, the credentials are read from the
+* build-time configuration (`@intlayer/config/built`), which resolves the
+* `INTLAYER_CLIENT_ID` / `INTLAYER_CLIENT_SECRET` environment variables.
+*
+* > Security: the CMS credentials grant write access to your content. Only ever
+* > create the authenticator on the server side — never ship `clientId` /
+* > `clientSecret` to the browser.
+*
+* @param intlayerConfig - Intlayer configuration carrying the `editor`
+* credentials. Defaults to the build-time configuration.
+* @param options - Optional CLI session token and base fetcher options.
+*
+* @example
+* ```ts
+* import { createIntlayerCMS } from '@intlayer/api';
+* import { dictionaryEndpoint } from '@intlayer/api/dictionary';
+*
+* // Optional: reads INTLAYER_CLIENT_ID / INTLAYER_CLIENT_SECRET when omitted
+* const cms = createIntlayerCMS();
+*
+* // Read
+* const { data: dictionaries } = await dictionaryEndpoint(cms).getDictionaries();
+*
+* // Write
+* await dictionaryEndpoint(cms).pushDictionaries([myDictionary]);
+* ```
+*/
+const createIntlayerCMS = (intlayerConfig = { editor }, options = {}) => createAuthManager(intlayerConfig, options);
+/**
+* Turns a domain factory into a tree-shakeable endpoint binder.
+*
+* Each endpoint pulls in only its own domain client plus the auth machinery, so
+* importing `dictionaryEndpoint` never bundles the project, AI, or any other
+* domain.
+*
+* @param factory - The domain factory (e.g. `getDictionaryAPI`).
+* @param options - Binding options, e.g. `{ skipAuth: true }` for the token
+* endpoint itself.
+*
+* @example
+* ```ts
+* // inside @intlayer/api/dictionary
+* export const dictionaryEndpoint = createEndpoint(getDictionaryAPI);
+* ```
+*/
+const createEndpoint = (factory, options) => (cms = createIntlayerCMS()) => cms.bindSection(factory, options);
+
+//#endregion
+export { createEndpoint, createIntlayerCMS };
+//# sourceMappingURL=createIntlayerCMS.mjs.map

package/dist/esm/cms/createIntlayerCMS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"createIntlayerCMS.mjs","names":[],"sources":["../../../src/cms/createIntlayerCMS.ts"],"sourcesContent":["import { editor } from '@intlayer/config/built';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport type { FetcherOptions } from '../fetcher';\nimport {\n  type AuthManager,\n  type AuthManagerOptions,\n  type BindSectionOptions,\n  createAuthManager,\n} from './createAuthManager';\n\n/**\n * Options accepted when creating the Intlayer CMS authenticator.\n */\nexport type IntlayerCMSOptions = AuthManagerOptions;\n\n/**\n * The Intlayer CMS authenticator returned by {@link createIntlayerCMS}.\n *\n * It is a lightweight object that holds the credentials and the managed token,\n * but knows nothing about individual domains. Pair it with a domain endpoint\n * (e.g. `dictionaryEndpoint`) to issue authenticated requests.\n */\nexport type IntlayerCMS = AuthManager;\n\n/**\n * Creates an Intlayer CMS authenticator handling authentication automatically\n * (OAuth2 `client_credentials`, or a CLI session token).\n *\n * This factory is intentionally lightweight: it does **not** bundle any domain\n * client. Combine it with the per-domain endpoint binders — imported separately\n * so only the domains you use are included in your bundle.\n *\n * The configuration is optional: when omitted, the credentials are read from the\n * build-time configuration (`@intlayer/config/built`), which resolves the\n * `INTLAYER_CLIENT_ID` / `INTLAYER_CLIENT_SECRET` environment variables.\n *\n * > Security: the CMS credentials grant write access to your content. Only ever\n * > create the authenticator on the server side — never ship `clientId` /\n * > `clientSecret` to the browser.\n *\n * @param intlayerConfig - Intlayer configuration carrying the `editor`\n * credentials. Defaults to the build-time configuration.\n * @param options - Optional CLI session token and base fetcher options.\n *\n * @example\n * ```ts\n * import { createIntlayerCMS } from '@intlayer/api';\n * import { dictionaryEndpoint } from '@intlayer/api/dictionary';\n *\n * // Optional: reads INTLAYER_CLIENT_ID / INTLAYER_CLIENT_SECRET when omitted\n * const cms = createIntlayerCMS();\n *\n * // Read\n * const { data: dictionaries } = await dictionaryEndpoint(cms).getDictionaries();\n *\n * // Write\n * await dictionaryEndpoint(cms).pushDictionaries([myDictionary]);\n * ```\n */\nexport const createIntlayerCMS = (\n  intlayerConfig: Pick<IntlayerConfig, 'editor'> = { editor },\n  options: IntlayerCMSOptions = {}\n): IntlayerCMS => createAuthManager(intlayerConfig, options);\n\n/**\n * A domain endpoint binder: given an authenticator (or none, in which case a\n * default one is created from the build-time configuration), returns the\n * authenticated domain section.\n */\nexport type CMSEndpoint<Section extends Record<string, unknown>> = (\n  cms?: IntlayerCMS\n) => Section;\n\n/**\n * Turns a domain factory into a tree-shakeable endpoint binder.\n *\n * Each endpoint pulls in only its own domain client plus the auth machinery, so\n * importing `dictionaryEndpoint` never bundles the project, AI, or any other\n * domain.\n *\n * @param factory - The domain factory (e.g. `getDictionaryAPI`).\n * @param options - Binding options, e.g. `{ skipAuth: true }` for the token\n * endpoint itself.\n *\n * @example\n * ```ts\n * // inside @intlayer/api/dictionary\n * export const dictionaryEndpoint = createEndpoint(getDictionaryAPI);\n * ```\n */\nexport const createEndpoint =\n  <Section extends Record<string, unknown>>(\n    factory: (\n      fetcherOptions: FetcherOptions,\n      intlayerConfig: IntlayerConfig\n    ) => Section,\n    options?: BindSectionOptions\n  ): CMSEndpoint<Section> =>\n  (cms: IntlayerCMS = createIntlayerCMS()): Section =>\n    cms.bindSection(factory, options);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,MAAa,qBACX,iBAAiD,EAAE,QAAQ,EAC3D,UAA8B,EAAE,KAChB,kBAAkB,gBAAgB,QAAQ;;;;;;;;;;;;;;;;;;AA4B5D,MAAa,kBAET,SAIA,aAED,MAAmB,mBAAmB,KACrC,IAAI,YAAY,SAAS,QAAQ"}

package/dist/esm/cms/index.mjs

@@ -0,0 +1,4 @@
+import { createAuthManager } from "./createAuthManager.mjs";
+import { createEndpoint, createIntlayerCMS } from "./createIntlayerCMS.mjs";
+
+export { createAuthManager, createEndpoint, createIntlayerCMS };

package/dist/esm/distantDictionary/fetchDistantDictionaries.mjs

@@ -1,4 +1,5 @@
-import { getIntlayerAPIProxy } from "../proxy.mjs";
+import { createIntlayerCMS } from "../cms/createIntlayerCMS.mjs";
+import { dictionaryEndpoint } from "../getIntlayerAPI/dictionary.mjs";
 
 //#region src/distantDictionary/fetchDistantDictionaries.ts
 /**
@@ -8,7 +9,7 @@ const fetchDistantDictionaries = async (intlayerConfig) => {
 	try {
 		const { clientId, clientSecret } = intlayerConfig.editor;
 		if (!clientId || !clientSecret) throw new Error("Missing OAuth2 client ID or client secret. To get access token go to https://app.intlayer.org/project.");
-		return (await getIntlayerAPIProxy(void 0, intlayerConfig).dictionary.getDictionaries()).data;
+		return (await dictionaryEndpoint(createIntlayerCMS(intlayerConfig)).getDictionaries()).data;
 	} catch (error) {
 		console.error(error);
 		return;

package/dist/esm/distantDictionary/fetchDistantDictionaries.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"fetchDistantDictionaries.mjs","names":[],"sources":["../../../src/distantDictionary/fetchDistantDictionaries.ts"],"sourcesContent":["import type { DictionaryAPI } from '@intlayer/backend';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { getIntlayerAPIProxy } from '../proxy';\n\n/**\n * Fetch distant dictionary\n */\nexport const fetchDistantDictionaries = async (\n  intlayerConfig: IntlayerConfig\n): Promise<DictionaryAPI[] | null | undefined> => {\n  try {\n    const { clientId, clientSecret } = intlayerConfig.editor;\n\n    if (!clientId || !clientSecret) {\n      throw new Error(\n        'Missing OAuth2 client ID or client secret. To get access token go to https://app.intlayer.org/project.'\n      );\n    }\n\n    const api = getIntlayerAPIProxy(undefined, intlayerConfig);\n\n    // Fetch the dictionary list\n    const getDictionaryResult = await api.dictionary.getDictionaries();\n\n    const distantDictionaries = getDictionaryResult.data;\n\n    return distantDictionaries;\n  } catch (error) {\n    console.error(error);\n    return undefined;\n  }\n};\n"],"mappings":";;;;;;AAOA,MAAa,2BAA2B,OACtC,mBACgD;AAChD,KAAI;EACF,MAAM,EAAE,UAAU,iBAAiB,eAAe;AAElD,MAAI,CAAC,YAAY,CAAC,aAChB,OAAM,IAAI,MACR,yGACD;AAUH,UAF4B,MALhB,oBAAoB,QAAW,eAGN,CAAC,WAAW,iBAAiB,EAElB;UAGzC,OAAO;AACd,UAAQ,MAAM,MAAM;AACpB"}
+{"version":3,"file":"fetchDistantDictionaries.mjs","names":[],"sources":["../../../src/distantDictionary/fetchDistantDictionaries.ts"],"sourcesContent":["import type { DictionaryAPI } from '@intlayer/backend';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { createIntlayerCMS } from '../cms/createIntlayerCMS';\nimport { dictionaryEndpoint } from '../getIntlayerAPI/dictionary';\n\n/**\n * Fetch distant dictionary\n */\nexport const fetchDistantDictionaries = async (\n  intlayerConfig: IntlayerConfig\n): Promise<DictionaryAPI[] | null | undefined> => {\n  try {\n    const { clientId, clientSecret } = intlayerConfig.editor;\n\n    if (!clientId || !clientSecret) {\n      throw new Error(\n        'Missing OAuth2 client ID or client secret. To get access token go to https://app.intlayer.org/project.'\n      );\n    }\n\n    const dictionary = dictionaryEndpoint(createIntlayerCMS(intlayerConfig));\n\n    // Fetch the dictionary list\n    const getDictionaryResult = await dictionary.getDictionaries();\n\n    const distantDictionaries = getDictionaryResult.data;\n\n    return distantDictionaries;\n  } catch (error) {\n    console.error(error);\n    return undefined;\n  }\n};\n"],"mappings":";;;;;;;AAQA,MAAa,2BAA2B,OACtC,mBACgD;AAChD,KAAI;EACF,MAAM,EAAE,UAAU,iBAAiB,eAAe;AAElD,MAAI,CAAC,YAAY,CAAC,aAChB,OAAM,IAAI,MACR,yGACD;AAUH,UAF4B,MALT,mBAAmB,kBAAkB,eAAe,CAG3B,CAAC,iBAAiB,EAEd;UAGzC,OAAO;AACd,UAAQ,MAAM,MAAM;AACpB"}

package/dist/esm/distantDictionary/fetchDistantDictionary.mjs

@@ -1,4 +1,5 @@
-import { getIntlayerAPIProxy } from "../proxy.mjs";
+import { createIntlayerCMS } from "../cms/createIntlayerCMS.mjs";
+import { dictionaryEndpoint } from "../getIntlayerAPI/dictionary.mjs";
 
 //#region src/distantDictionary/fetchDistantDictionary.ts
 /**
@@ -8,7 +9,7 @@ const fetchDistantDictionary = async (dictionaryKey, intlayerConfig) => {
 	try {
 		const { clientId, clientSecret } = intlayerConfig.editor;
 		if (!clientId || !clientSecret) throw new Error("Missing OAuth2 client ID or client secret. To get access token go to https://app.intlayer.org/project.");
-		const distantDictionary = (await getIntlayerAPIProxy(void 0, intlayerConfig).dictionary.getDictionary(dictionaryKey)).data;
+		const distantDictionary = (await dictionaryEndpoint(createIntlayerCMS(intlayerConfig)).getDictionary(dictionaryKey)).data;
 		if (!distantDictionary) throw new Error(`Dictionary ${dictionaryKey} not found on remote`);
 		return distantDictionary;
 	} catch (error) {

package/dist/esm/distantDictionary/fetchDistantDictionary.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"fetchDistantDictionary.mjs","names":[],"sources":["../../../src/distantDictionary/fetchDistantDictionary.ts"],"sourcesContent":["import type { DictionaryAPI } from '@intlayer/backend';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { getIntlayerAPIProxy } from '../proxy';\n\n/**\n * Fetch distant dictionary\n */\nexport const fetchDistantDictionary = async (\n  dictionaryKey: string,\n  intlayerConfig: IntlayerConfig\n): Promise<DictionaryAPI | undefined> => {\n  try {\n    const { clientId, clientSecret } = intlayerConfig.editor;\n\n    if (!clientId || !clientSecret) {\n      throw new Error(\n        'Missing OAuth2 client ID or client secret. To get access token go to https://app.intlayer.org/project.'\n      );\n    }\n\n    const api = getIntlayerAPIProxy(undefined, intlayerConfig);\n\n    // Fetch the dictionary\n    const getDictionaryResult =\n      await api.dictionary.getDictionary(dictionaryKey);\n\n    const distantDictionary = getDictionaryResult.data;\n\n    if (!distantDictionary) {\n      throw new Error(`Dictionary ${dictionaryKey} not found on remote`);\n    }\n\n    return distantDictionary;\n  } catch (error) {\n    console.error(error);\n    return undefined;\n  }\n};\n"],"mappings":";;;;;;AAOA,MAAa,yBAAyB,OACpC,eACA,mBACuC;AACvC,KAAI;EACF,MAAM,EAAE,UAAU,iBAAiB,eAAe;AAElD,MAAI,CAAC,YAAY,CAAC,aAChB,OAAM,IAAI,MACR,yGACD;EASH,MAAM,qBAAoB,MANd,oBAAoB,QAAW,eAIhC,CAAC,WAAW,cAAc,cAAc,EAEL;AAE9C,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM,cAAc,cAAc,sBAAsB;AAGpE,SAAO;UACA,OAAO;AACd,UAAQ,MAAM,MAAM;AACpB"}
+{"version":3,"file":"fetchDistantDictionary.mjs","names":[],"sources":["../../../src/distantDictionary/fetchDistantDictionary.ts"],"sourcesContent":["import type { DictionaryAPI } from '@intlayer/backend';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { createIntlayerCMS } from '../cms/createIntlayerCMS';\nimport { dictionaryEndpoint } from '../getIntlayerAPI/dictionary';\n\n/**\n * Fetch distant dictionary\n */\nexport const fetchDistantDictionary = async (\n  dictionaryKey: string,\n  intlayerConfig: IntlayerConfig\n): Promise<DictionaryAPI | undefined> => {\n  try {\n    const { clientId, clientSecret } = intlayerConfig.editor;\n\n    if (!clientId || !clientSecret) {\n      throw new Error(\n        'Missing OAuth2 client ID or client secret. To get access token go to https://app.intlayer.org/project.'\n      );\n    }\n\n    const dictionary = dictionaryEndpoint(createIntlayerCMS(intlayerConfig));\n\n    // Fetch the dictionary\n    const getDictionaryResult = await dictionary.getDictionary(dictionaryKey);\n\n    const distantDictionary = getDictionaryResult.data;\n\n    if (!distantDictionary) {\n      throw new Error(`Dictionary ${dictionaryKey} not found on remote`);\n    }\n\n    return distantDictionary;\n  } catch (error) {\n    console.error(error);\n    return undefined;\n  }\n};\n"],"mappings":";;;;;;;AAQA,MAAa,yBAAyB,OACpC,eACA,mBACuC;AACvC,KAAI;EACF,MAAM,EAAE,UAAU,iBAAiB,eAAe;AAElD,MAAI,CAAC,YAAY,CAAC,aAChB,OAAM,IAAI,MACR,yGACD;EAQH,MAAM,qBAAoB,MALP,mBAAmB,kBAAkB,eAAe,CAG3B,CAAC,cAAc,cAAc,EAE3B;AAE9C,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM,cAAc,cAAc,sBAAsB;AAGpE,SAAO;UACA,OAAO;AACd,UAAQ,MAAM,MAAM;AACpB"}

package/dist/esm/getIntlayerAPI/ai.mjs

@@ -1,4 +1,5 @@
 import { fetcher } from "../fetcher.mjs";
+import { createEndpoint } from "../cms/createIntlayerCMS.mjs";
 import { editor } from "@intlayer/config/built";
 
 //#region src/getIntlayerAPI/ai.ts
@@ -222,7 +223,14 @@ const getAiAPI = (authAPIOptions = {}, intlayerConfig) => {
 		getAIStats
 	};
 };
+/**
+* Authenticated `ai` endpoint bound to an Intlayer CMS authenticator.
+*
+* Pass an authenticator created with `createIntlayerCMS`, or omit it to use
+* the build-time configuration (`@intlayer/config/built`).
+*/
+const aiEndpoint = createEndpoint(getAiAPI);
 
 //#endregion
-export { getAiAPI };
+export { aiEndpoint, getAiAPI };
 //# sourceMappingURL=ai.mjs.map