@introspection-sdk/introspection-node 0.22.0 → 0.31.0

package/README.md

@@ -1,7 +1,8 @@
 # @introspection-sdk/introspection-node
 
 Node.js platform SDK for [Introspection](https://introspection.dev) — open runtimes,
-drive tasks, and manage experiments, recipes, files, conversations, and shares.
+drive tasks, and manage experiments, recipes, repositories, members,
+automations, app connections, files, conversations, and shares.
 
 ## Install
 
@@ -54,6 +55,329 @@ teardown.
 Interrupted runs resume through
 `runner.tasks.runs.resume(taskId, { resume: entries })`.
 
+`identity.metadata` sets `key: value` labels on the `customer` member the
+identity names. It grants nothing, so unlike `identity.tags` (which seed a new
+member only) it merges into an existing member too: asserted keys overwrite
+keys of the same name and the rest are kept. Absent or `{}` changes nothing.
+
+```typescript
+const runner = await client.runtimes("customer-agent").run({
+  identity: { user_id: "u_42", metadata: { plan: "enterprise" } },
+});
+```
+
+### Data Plane resources: client and runner
+
+`IntrospectionClient` and `Runner` expose the same Data Plane namespaces, and
+both implement the exported `DataPlaneResources` interface: `tasks` (with
+`tasks.runs`), `files`, `conversations`, `events`, `metrics`, `shares`,
+`automations` and `connections`. So does the `DataPlaneClient` that
+`AuthClient.dataPlane()` returns. Code written against `DataPlaneResources`
+runs against any of them.
+
+```typescript
+import type { DataPlaneResources } from "@introspection-sdk/introspection-node";
+
+async function connectedApps(dp: DataPlaneResources) {
+  return (await dp.connections.list()).records.map((c) => c.app);
+}
+
+await connectedApps(client); // the client's own token, on its Data Plane
+await connectedApps(runner); // the runner's token, on the runner's Data Plane
+```
+
+The difference is the credential. A runner sends its session token, scoped to
+the runtime and identity it was opened for; the client sends its own token,
+so the server decides per call what that credential may do. A runner a member
+opens for themself carries `automations:read` and `automations:write`, so
+`runner.automations` manages that member's automations (a platform change in
+progress; until it ships those routes refuse a runner with a 403).
+
+### Members
+
+`client.members` lists, reads, creates and updates members on the Control
+Plane's `/v1/members`; removing one is an org-admin action left to the CLI. A
+member's `tags` are access-bearing (it receives every share whose `granted_tag`
+it holds) and writable only with `members:manage`. A member can also still read
+and write any file or task whose tags intersect its own, but that implicit tag
+access is deprecated: share with a cohort through a tag share instead. Its `metadata` is a
+map of string labels that grants nothing; keys are `[A-Za-z0-9_-]+`, values are
+non-empty strings, at most 64 entries.
+
+```typescript
+const ada = await client.members.create({
+  email: "ada@example.com",
+  name: "Ada Lovelace",
+  metadata: { plan: "enterprise" },
+});
+
+// `tag` and `metadata` narrow the list; metadata pairs are ANDed (at most 16).
+for await (const member of client.members.list({
+  member_type: "customer",
+  metadata: { plan: "enterprise", region: "eu" },
+})) {
+  console.log(member.id, member.metadata);
+}
+
+// PATCH replaces `tags` and `metadata` wholesale; `{}` clears metadata.
+await client.members.update(ada.id, { metadata: { plan: "team" } });
+```
+
+Seeding `tags` on create needs `members:manage` as well as `members:write`.
+
+### Automations
+
+`client.automations` (and `dataPlaneClient.automations`) lists, reads,
+creates, updates and deletes the project's automations on the Data Plane's
+`/v1/automations`, and `trigger(id)` runs one now. Reading needs
+`automations:read` and writing `automations:write`; each record's `can_manage`
+says whether the caller may change it. An automation is a scheduled prompt (`kind: null`) or platform work
+(`observation_synthesis`, `observation_clustering`, `project_check_in`). A
+`cron` automation fires on `cron_schedule`, or on `metadata.cron_schedules` in
+`metadata.timezone`; a one-off reminder is a `manual` automation with a future
+`next_trigger_at`. Set `task_id` to post each firing into an existing task
+instead of creating one.
+
+The server serves these routes to administrators only today (a 403 otherwise).
+introspection-cloud#3137, not yet released, opens them to members for their own
+automations that post into one of their tasks; until it ships, the `task_id`
+list filter is ignored by the server.
+
+```typescript
+const reminder = await client.automations.create({
+  name: "Friday check-in",
+  trigger_type: "manual",
+  prompt: "How did the week go?",
+  runtime_group_id: runtimeGroupId,
+  task_id: taskId,
+  next_trigger_at: "2026-10-09T09:00:00Z",
+});
+
+// Recurring: one or more cron schedules in a timezone.
+await client.automations.create({
+  name: "Weekday digest",
+  trigger_type: "cron",
+  cron_schedule: "0 9 * * 1-5",
+  metadata: {
+    cron_schedules: ["0 9 * * 1-5"],
+    timezone: "America/Los_Angeles",
+  },
+  prompt: "Summarize yesterday's conversations.",
+  runtime_group_id: runtimeGroupId,
+});
+
+// PATCH sends only the fields you set; `metadata` replaces wholesale.
+await client.automations.update(reminder.id, { enabled: false });
+
+for await (const automation of client.automations.list({ task_id: taskId })) {
+  console.log(automation.id, automation.next_trigger_at, automation.can_manage);
+}
+
+const { status, task_id } = await client.automations.trigger(reminder.id);
+```
+
+A firing clears a manual automation's slot; re-arm it with
+`update(id, { next_trigger_at })`. A `cron` automation derives its own slot and
+rejects one set by the client.
+
+Each task-run trigger is recorded as an `introspection.automation.triggered`
+event, and a scheduled slot that ran nothing as
+`introspection.automation.skipped` (with a `reason` such as
+`conditions_not_met` or `target_busy`; readable only with project-wide
+telemetry access). Read them with `client.events.list`, filtered by
+`automation_id` or `task_id`:
+
+```typescript
+const page = await client.events.list({
+  event_name: "introspection.automation.triggered",
+  automation_id: reminder.id,
+});
+for (const ev of page.records)
+  console.log(ev.payload.task_id, ev.payload.posted);
+```
+
+### Connections
+
+`connections` lists, reads, creates and deletes the apps members connected for
+themselves, on the Data Plane's `/v1/connections`. A caller who is not an
+administrator always sees and manages only their own. Reads need
+`connections:read`, `create` needs `connections:write` and `delete` needs
+`connections:delete`. These are a different resource from the Control Plane's
+`client.connectors.connections`, which are nested under a connector.
+
+`create` returns a single-use connect page; send the member to its
+`authorize_url`, and the connection exists once they finish there. On a runner,
+`runtime` defaults to the runner's runtime group. On the client, pass it.
+
+```typescript
+const { authorize_url } = await runner.connections.create({ app: "gmail" });
+
+for await (const connection of runner.connections.list({ app: "gmail" })) {
+  console.log(connection.id, connection.account_name, connection.healthy);
+}
+
+// Administrators can list another member's connections.
+await client.connections.list({ member_id: memberId });
+
+await runner.connections.delete(connectionId);
+```
+
+### Native email-code sign-in
+
+`AuthClient` signs in the end users of a `native` Application with emailed
+one-time codes, shaped like the Supabase Auth client. The session belongs to a
+`customer` member of the Application's organization, is scoped to one project,
+and carries the Application's `allowed_scopes`.
+
+```typescript
+import { AuthClient } from "@introspection-sdk/introspection-node";
+
+const auth = new AuthClient({
+  clientId: "intro_app_…", // a `native` Application
+  project: "my-project",
+  storage: sessionStore, // getItem / setItem / removeItem, sync or async
+});
+
+await auth.signInWithOtp({ email });
+await auth.verifyOtp({ email, token: code });
+
+const dp = await auth.dataPlane();
+const run = await dp.tasks.start({ prompt: "Hello", runtime_id: runtimeId });
+console.log(await run.text());
+```
+
+- **Codes are opaque.** A returning user's code is 6 digits; a new user's first
+  code is 6 characters of A–Z and 0–9. Do not restrict the input to digits.
+  A wrong, expired or reused code throws `ValidationError` with
+  `code === "invalid_grant"`; requesting codes too often throws
+  `RateLimitError` with `retryAfter`.
+- **Refresh.** `getSession()` renews the session within `leewaySeconds`
+  (default 60) of expiry, and every request made through `auth.dataPlane()`
+  renews it once after a `401`; concurrent renewals share one refresh. A
+  refresh the server rejects signs the user out and throws
+  `AuthenticationError`; a network failure keeps the session.
+- **Superseded responses.** A sign-in that resolves after a sign-out or a newer
+  sign-in rejects with an `AbortError` instead of overwriting the newer state.
+- **Events.** `onAuthStateChange((event, session) => …)` reports
+  `INITIAL_SESSION`, `SIGNED_IN`, `TOKEN_REFRESHED` and `SIGNED_OUT`.
+- **Data Plane only.** The token is a Data Plane credential, so the Control
+  Plane routes on `IntrospectionClient` (runtimes, connectors, members) reject
+  it. Pass the runtime as `runtime_id` when creating a task. `auth.dataPlane()`
+  returns a `DataPlaneClient`, which implements `DataPlaneResources`: `tasks`,
+  `files`, `conversations`, `shares`, `events`, `metrics`, `automations` and
+  `connections` (where `create` takes the `runtime`).
+- **Sign-out** clears the local session, then revokes it with
+  `POST /v1/oauth/revoke`; the local session is gone even if revocation fails.
+
+See [`examples/api/native-email-code.ts`](../../examples/api/native-email-code.ts).
+Federated sign-in through your own IdP (a `jwks` Application) keeps its session
+in that IdP's SDK; exchange its token with `tokenExchange()` instead.
+
+### Repositories
+
+`client.repositories` looks up a project's linked repositories on the Control
+Plane and reads their contents through the Data Plane (`repositories:read`).
+
+```typescript
+const [repo] = await client.repositories.list({
+  project: "demo",
+  slug: "acme/agent",
+});
+
+// Every entry of a directory; pages are followed automatically.
+for await (const entry of client.repositories.contents(repo.id, {
+  path: "src",
+  ref: "main",
+})) {
+  console.log(entry.type, entry.path);
+}
+
+// One path: a directory page or a file, discriminated on `type`.
+const readme = await client.repositories.contents.get(repo.id, "README.md");
+if (readme.type === "file") console.log(readme.encoding, readme.content);
+```
+
+Enumerating a path that is a file throws a `ValidationError`; read it with
+`contents.get()` instead.
+
+History reads the same way: `commits()` pages back from a branch, tag or sha
+(the default branch when omitted), and `commit()` returns one commit with its
+changed files and unified diff.
+
+```typescript
+for await (const commit of client.repositories.commits(repo.id, {
+  sha: "main",
+  path: "src",
+})) {
+  console.log(commit.sha, commit.message);
+}
+
+const detail = await client.repositories.commit(repo.id, "abc123");
+console.log(
+  detail.files.map((file) => file.filename),
+  detail.patch,
+);
+```
+
+`merge()` merges a branch or commit sha into a branch, like GitHub's merges API
+(`repositories:write`). It resolves to the merge commit, or `null` when `base`
+already contains `head`; a conflict throws a `ConflictError` and changes
+nothing.
+
+```typescript
+const merge = await client.repositories.merge(repo.id, {
+  base: "main",
+  head: "feature",
+});
+console.log(merge?.sha ?? "already up to date");
+```
+
+### Annotations
+
+Annotations capture what a domain expert found good or bad on an OTel span. They
+are labels, comments, and assignments—not numeric scores. Writes require an
+authenticated business-member token with `annotations:write`; project API
+keys and sandbox credentials cannot write annotations.
+
+```typescript
+const client = new IntrospectionClient({
+  token: memberAccessToken,
+  cpSession: encodedMemberSession,
+  advanced: {
+    baseApiUrl: "https://api.introspection.dev", // Control Plane
+    dpUrl: memberDataPlaneUrl,
+  },
+});
+
+const span = {
+  trace_id: "0123456789abcdef0123456789abcdef",
+  span_id: "0123456789abcdef",
+};
+
+await client.projectLabels.create({
+  slug: "strong-structure",
+  color: "#f97316",
+  description: "A useful structure to preserve during distillation",
+});
+await client.annotations.create(span, { labels: ["strong-structure"] });
+await client.annotations.create(span, {
+  comment: "Keep the conclusion before the evidence.",
+});
+await client.annotations.create(span, {
+  reviewerEmails: ["expert@example.com"],
+});
+await client.annotations.create(span, { reviewerEmails: [] });
+```
+
+Labels and reviewers are complete snapshots; pass `[]` to clear one. Comments
+append. Every mutation gets a UUIDv7 `event_id` before its
+first transport attempt, so an automatic retry remains one event. Supply
+`{ event_id }` as the final method argument when retrying across processes.
+`client.annotations.list()` and `client.projectLabels.list()` are both awaitable
+for the first page and async-iterable across every cursor page.
+Read immutable annotation history with
+`client.events.list({ event_name: "introspection.annotation", trace_id, span_id })`.
+
 ## Pi instrumentation
 
 Pi is the supported agent-instrumentation path:
@@ -148,13 +472,14 @@ await logs.shutdown();
 
 ### Methods
 
-| Method                      | Description                    |
-| --------------------------- | ------------------------------ |
-| `track(event, properties?)` | Track any user action          |
-| `feedback(type, options?)`  | Track feedback on AI responses |
-| `identify(userId, traits?)` | Associate a user with traits   |
-| `flush()`                   | Flush pending events           |
-| `shutdown()`                | Shutdown and flush             |
+| Method                                  | Description                                        |
+| --------------------------------------- | -------------------------------------------------- |
+| `logEvent(name, attributes?, options?)` | Log an app event under any custom name (see below) |
+| `track(event, properties?)`             | Track any user action (an alias of `logEvent`)     |
+| `feedback(type, options?)`              | Track feedback on AI responses                     |
+| `identify(userId, traits?)`             | Associate a user with traits                       |
+| `flush()`                               | Flush pending events                               |
+| `shutdown()`                            | Shutdown and flush                                 |
 
 ### Context helpers (OTel baggage)
 
@@ -166,6 +491,103 @@ await logs.shutdown();
 | `withAnonymousId(id, callback)`                | Set anonymous ID             |
 | `withBaggage(values, callback)`                | Set arbitrary baggage values |
 
+## Logging custom events
+
+`logEvent(name, attributes?, options?)` records an app event under a name you
+choose — `ark.feed.entry`, `checkout.completed` — so the platform stores it and
+you can query it back by name. `track()` is a thin alias of it. Attributes are
+stored under `properties.*`.
+
+```typescript
+import { IntrospectionLogs } from "@introspection-sdk/introspection-node/otel";
+
+const logs = new IntrospectionLogs({ serviceName: "ark" }); // INTROSPECTION_TOKEN
+
+logs.logEvent(
+  "ark.feed.entry",
+  { entry_id: entry.id, source: "rss", score: 0.92 },
+  {
+    eventId: `feed-entry:${entry.id}`, // stable id: consumers dedupe on it
+    timestamp: entry.publishedAt, // Date or epoch ms; default now
+    identity: { userId: entry.ownerId }, // overrides the scoped identity
+    severity: "INFO", // DEBUG | INFO | WARN | ERROR
+  },
+);
+
+await logs.shutdown(); // flushes
+```
+
+After `init()`, the same call is available as a module-level function:
+
+```typescript
+import * as introspection from "@introspection-sdk/introspection-node/otel";
+
+await introspection.init({ serviceName: "ark" });
+introspection.logEvent("ark.feed.entry", { entry_id: "e_1" });
+```
+
+- **Names.** Use your own namespace. Names starting with `introspection.`
+  (platform events) or `gen_ai.` (OpenTelemetry GenAI conventions) are
+  reserved and `logEvent` throws on them. `track()` delegates to `logEvent`,
+  so it rejects them too.
+- **Idempotency.** Without `eventId` each call gets a fresh id. When delivery
+  can repeat (retries, replayed jobs, an agent re-running a step), pass an id
+  derived from the thing being recorded: re-sending the same `eventId` is how
+  consumers recognise and drop the duplicate.
+- **Identity and context.** User / anonymous id and `gen_ai.conversation.id` /
+  agent come from the active baggage (`withUserId`, `withConversation`,
+  `withAgent`); `options.identity` overrides per field.
+
+### From a recipe or agent sandbox
+
+A Runtime sandbox is started with `INTROSPECTION_TOKEN` and
+`INTROSPECTION_BASE_OTEL_URL` in its environment, so a recipe tool or
+agent step needs no configuration — construct the logger and flush before the
+step returns:
+
+```typescript
+import { IntrospectionLogs } from "@introspection-sdk/introspection-node/otel";
+
+const events = new IntrospectionLogs({ serviceName: "ark-recipe" });
+
+export async function recordFeedEntries(entries: FeedEntry[]) {
+  for (const entry of entries) {
+    events.logEvent(
+      "ark.feed.entry",
+      { entry_id: entry.id, title: entry.title, url: entry.url },
+      { eventId: `ark.feed.entry:${entry.id}` },
+    );
+  }
+  await events.flush(); // the sandbox may be torn down after the step
+}
+```
+
+### Reading custom events back
+
+Custom events are served by `/v1/events` under the `introspection.track`
+family, whose `payload` carries the original `name` and the `properties`:
+
+```typescript
+import { IntrospectionClient } from "@introspection-sdk/introspection-node";
+
+const client = new IntrospectionClient();
+
+type TrackPayload = { name: string; properties?: Record<string, unknown> };
+
+for await (const ev of client.events.list({
+  event_name: "introspection.track",
+  lookback: "24h",
+})) {
+  const payload = ev.payload as TrackPayload;
+  if (payload.name !== "ark.feed.entry") continue;
+  console.log(ev.timestamp, payload.properties?.entry_id);
+}
+```
+
+Filtering by `name` server-side is not available yet — it arrives with a
+pending platform change. Until then, filter on `payload.name` client-side as
+above.
+
 ## OpenTelemetry span processor
 
 Attach the processor to a provider you already own, or stand one up with

package/dist/auth-client.d.ts

@@ -0,0 +1,182 @@
+import type { OAuthToken } from "./auth.js";
+import { DataPlaneClient } from "./data-plane.js";
+import type { BearerCredentials } from "./http.js";
+/** The `grant_type` of the native email-code grant. */
+export declare const EMAIL_CODE_GRANT_TYPE = "urn:introspection:params:oauth:grant-type:email_code";
+/**
+ * Where a session is kept between launches. The Web Storage shape (sync or
+ * async), so a file- or keychain-backed store or any `localStorage`-like
+ * object plugs in directly. Values are JSON strings.
+ */
+export interface SessionStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
+}
+/** Keeps the session in memory only; nothing survives a restart. */
+export declare class InMemorySessionStorage implements SessionStorage {
+    private readonly values;
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+/**
+ * A signed-in member's session: the token response plus when it expires.
+ * Field names stay on the wire (snake_case), as the token response sends them.
+ */
+export interface AuthSession {
+    access_token: string;
+    token_type: string;
+    /** Rotated on every refresh. */
+    refresh_token: string | null;
+    /** Epoch milliseconds the access token expires at, when known. */
+    expires_at: number | null;
+    /** The granted scope: the Application's `allowed_scopes` ceiling. */
+    scope: string | null;
+    /** The platform session; refresh and sign-out are keyed on it. */
+    session_id: string | null;
+    org_id: string | null;
+    project_id: string | null;
+    /** The `customer` member the session belongs to. */
+    member_id: string | null;
+    /** The Data Plane URL for the session's project. */
+    dp_url: string | null;
+}
+/** What changed, mirroring Supabase's `AuthChangeEvent`. */
+export type AuthChangeEvent = "INITIAL_SESSION" | "SIGNED_IN" | "SIGNED_OUT" | "TOKEN_REFRESHED";
+export type AuthStateListener = (event: AuthChangeEvent, session: AuthSession | null) => void;
+export interface AuthClientOptions {
+    /** The `native` Application's `client_id`. */
+    clientId: string;
+    /** The project the session is scoped to (slug or id). */
+    project: string;
+    /**
+     * CP API base URL. Defaults to `INTROSPECTION_BASE_API_URL` where a
+     * `process` global exists, then `https://api.introspection.dev`.
+     */
+    baseApiUrl?: string;
+    /** Session persistence. Defaults to {@link InMemorySessionStorage}. */
+    storage?: SessionStorage;
+    /** Storage key; change it to keep separate sessions per environment. */
+    storageKey?: string;
+    /** Refresh this many seconds before expiry. Default `60`. */
+    leewaySeconds?: number;
+    /** Custom `fetch` (for tests or non-standard runtimes). */
+    fetch?: typeof fetch;
+    /** Clock in epoch milliseconds (for tests). */
+    now?: () => number;
+}
+/**
+ * Email-code sign-in, session persistence and refresh for a `native`
+ * Application.
+ *
+ * @example
+ * ```typescript
+ * const auth = new AuthClient({
+ *   clientId: "intro_app_…",
+ *   project: "my-project",
+ *   storage: sessionStore, // getItem / setItem / removeItem
+ * });
+ *
+ * await auth.signInWithOtp({ email });
+ * // A returning user's code is 6 digits; a new user's first code is 6
+ * // characters of A–Z and 0–9, so do not restrict the input to digits.
+ * await auth.verifyOtp({ email, token: code });
+ *
+ * const dp = await auth.dataPlane();
+ * const run = await dp.tasks.start({ prompt: "Hello", runtime_id });
+ * ```
+ */
+export declare class AuthClient {
+    private readonly options;
+    private readonly baseApiUrl;
+    private readonly storage;
+    private readonly storageKey;
+    private readonly leewayMs;
+    private readonly fetchImpl;
+    private readonly now;
+    private current;
+    /** Bumped by every sign-in and sign-out; a response read under an older value is stale. */
+    private generation;
+    private restored;
+    private restoring?;
+    private refreshing?;
+    private storageWrite;
+    private readonly listeners;
+    constructor(options: AuthClientOptions);
+    /**
+     * Email a one-time code to `email`. The answer is the same whether or not
+     * the email has an account; a new address gets an account on verify.
+     * Throws `RateLimitError` (with `retryAfter`) when codes are requested too
+     * often.
+     */
+    signInWithOtp(params: {
+        email: string;
+    }): Promise<void>;
+    /**
+     * Verify the code sent to `email` and sign in. The code is opaque: 6 digits
+     * for a returning user, 6 characters of A–Z and 0–9 for a new user's first
+     * sign-in. A wrong, expired or reused code throws a `ValidationError` with
+     * `code === "invalid_grant"`.
+     *
+     * Rejects with an `AbortError` when a sign-out or another sign-in completes
+     * while the code is being verified, so a slow response never overwrites a
+     * newer session.
+     */
+    verifyOtp(params: {
+        email: string;
+        token: string;
+    }): Promise<AuthSession>;
+    /** Adopt a platform token obtained elsewhere, for example from your own backend. */
+    setSession(token: OAuthToken): Promise<AuthSession>;
+    /**
+     * The current session, restored from storage on first use and refreshed
+     * when it is within `leewaySeconds` of expiry. `null` when signed out.
+     */
+    getSession(): Promise<AuthSession | null>;
+    /**
+     * Renew the session now, or join the renewal already in flight. A refresh
+     * the server rejects signs the user out and throws `AuthenticationError`;
+     * a network failure keeps the session and rethrows.
+     */
+    refreshSession(): Promise<AuthSession>;
+    /**
+     * Sign out: forget the session locally, then revoke it on the platform.
+     * The local session is cleared even when revocation fails; the revocation
+     * error is still thrown.
+     */
+    signOut(): Promise<void>;
+    /**
+     * Listen for session changes. A new listener first receives
+     * `INITIAL_SESSION` with the session restored from storage (or `null`).
+     */
+    onAuthStateChange(listener: AuthStateListener): {
+        unsubscribe(): void;
+    };
+    /**
+     * A bearer credential backed by this client: refreshed before expiry, and
+     * once more after a `401` unless another request already renewed it.
+     */
+    get credentials(): BearerCredentials;
+    /**
+     * A Data Plane client authenticated as the signed-in member. The Data Plane
+     * URL defaults to the one returned with the session.
+     */
+    dataPlane(options?: {
+        dpUrl?: string;
+        additionalHeaders?: Record<string, string>;
+    }): Promise<DataPlaneClient>;
+    private postToken;
+    /** The refresh response omits `dp_url`, so it carries over from `previous`. */
+    private toSession;
+    private renew;
+    /** `expected` is the generation read before a sign-in request was sent. */
+    private signedIn;
+    /** Storage may be async, so writes are chained to land in transition order. */
+    private store;
+    private clear;
+    /** Concurrent first callers share one load, so none sees the session as absent while it is read. */
+    private restoreIfNeeded;
+    private emit;
+}
+//# sourceMappingURL=auth-client.d.ts.map

package/dist/auth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-client.d.ts","sourceRoot":"","sources":["../src/auth-client.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAGnD,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,yDACsB,CAAC;AAGzD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,oEAAoE;AACpE,qBAAa,sBAAuB,YAAW,cAAc;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IAEpD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAInC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAG9B;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qEAAqE;IACrE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oDAAoD;IACpD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oDAAoD;IACpD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GACzB,iBAAiB,GAAG,WAAW,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAErE,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,WAAW,GAAG,IAAI,KACxB,IAAI,CAAC;AAEV,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AA0BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,UAAU;IAiBT,OAAO,CAAC,QAAQ,CAAC,OAAO;IAhBpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,OAAO,CAAC,OAAO,CAA4B;IAC3C,2FAA2F;IAC3F,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAC,CAAgB;IAClC,OAAO,CAAC,UAAU,CAAC,CAAuB;IAC1C,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;gBAE7B,OAAO,EAAE,iBAAiB;IAsBvD;;;;;OAKG;IACG,aAAa,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAc7D;;;;;;;;;OASG;IACG,SAAS,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,WAAW,CAAC;IAYxB,oFAAoF;IAC9E,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAMzD;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAa/C;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAoC5C;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB9B;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG;QAAE,WAAW,IAAI,IAAI,CAAA;KAAE;IAWvE;;;OAGG;IACH,IAAI,WAAW,IAAI,iBAAiB,CAWnC;IAED;;;OAGG;IACG,SAAS,CACb,OAAO,GAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACvC,GACL,OAAO,CAAC,eAAe,CAAC;YAqBb,SAAS;IAWvB,+EAA+E;IAC/E,OAAO,CAAC,SAAS;YAkBH,KAAK;IAiBnB,2EAA2E;YAC7D,QAAQ;IAkBtB,+EAA+E;IAC/E,OAAO,CAAC,KAAK;YASC,KAAK;IAcnB,oGAAoG;IACpG,OAAO,CAAC,eAAe;IAiBvB,OAAO,CAAC,IAAI;CAGb"}