@introspection-sdk/introspection-node 0.22.0 → 0.31.0

package/dist/auth-client.js

@@ -0,0 +1,402 @@
+/**
+ * Native email-code sign-in for an app's end users, shaped like the Supabase
+ * Auth client: `signInWithOtp`, `verifyOtp`, `getSession`, `refreshSession`,
+ * `signOut` and `onAuthStateChange`.
+ *
+ * Requires a `native` Application. The Control Plane emails a one-time code
+ * (`POST /v1/oauth/email/code`) and exchanges it at `POST /v1/oauth/token` for
+ * a refreshable session of a `customer` member of the Application's
+ * organization, scoped to one project and capped to the Application's
+ * `allowed_scopes`. The access token is a Data Plane credential: hand the
+ * session to {@link AuthClient.dataPlane}, not to `IntrospectionClient`, whose
+ * Control Plane routes do not accept it.
+ *
+ * Federated sign-in (a `jwks` Application) keeps the session in the customer's
+ * own IdP SDK; use {@link tokenExchange} for that instead.
+ */
+import { toApiError, stripTrailingSlash } from "@introspection-sdk/http";
+import { AuthenticationError, IntrospectionAPIError, } from "@introspection-sdk/types";
+import { DataPlaneClient } from "./data-plane.js";
+const DEFAULT_BASE_API_URL = "https://api.introspection.dev";
+/** The `grant_type` of the native email-code grant. */
+export const EMAIL_CODE_GRANT_TYPE = "urn:introspection:params:oauth:grant-type:email_code";
+const GRANT_TYPE_REFRESH_TOKEN = "refresh_token";
+/** Keeps the session in memory only; nothing survives a restart. */
+export class InMemorySessionStorage {
+    values = new Map();
+    getItem(key) {
+        return this.values.get(key) ?? null;
+    }
+    setItem(key, value) {
+        this.values.set(key, value);
+    }
+    removeItem(key) {
+        this.values.delete(key);
+    }
+}
+/** Thrown when a sign-out or a newer sign-in completes while a sign-in is pending. */
+function superseded() {
+    return new DOMException("A sign-out or a newer sign-in superseded this response", "AbortError");
+}
+/** A rejection by the server, as opposed to a network failure that should not sign the user out. */
+function isRejection(err) {
+    return (err instanceof IntrospectionAPIError &&
+        ([400, 401, 403, 422].includes(err.status) || err.code === "invalid_grant"));
+}
+function defaultBaseApiUrl() {
+    const env = typeof process === "undefined"
+        ? undefined
+        : process.env?.INTROSPECTION_BASE_API_URL;
+    return env ?? DEFAULT_BASE_API_URL;
+}
+/**
+ * Email-code sign-in, session persistence and refresh for a `native`
+ * Application.
+ *
+ * @example
+ * ```typescript
+ * const auth = new AuthClient({
+ *   clientId: "intro_app_…",
+ *   project: "my-project",
+ *   storage: sessionStore, // getItem / setItem / removeItem
+ * });
+ *
+ * await auth.signInWithOtp({ email });
+ * // A returning user's code is 6 digits; a new user's first code is 6
+ * // characters of A–Z and 0–9, so do not restrict the input to digits.
+ * await auth.verifyOtp({ email, token: code });
+ *
+ * const dp = await auth.dataPlane();
+ * const run = await dp.tasks.start({ prompt: "Hello", runtime_id });
+ * ```
+ */
+export class AuthClient {
+    options;
+    baseApiUrl;
+    storage;
+    storageKey;
+    leewayMs;
+    fetchImpl;
+    now;
+    current = null;
+    /** Bumped by every sign-in and sign-out; a response read under an older value is stale. */
+    generation = 0;
+    restored = false;
+    restoring;
+    refreshing;
+    storageWrite = Promise.resolve();
+    listeners = new Set();
+    constructor(options) {
+        this.options = options;
+        if (!options.clientId)
+            throw new Error("AuthClient requires a clientId");
+        if (!options.project)
+            throw new Error("AuthClient requires a project");
+        this.baseApiUrl = stripTrailingSlash(options.baseApiUrl ?? defaultBaseApiUrl());
+        this.storage = options.storage ?? new InMemorySessionStorage();
+        this.storageKey = options.storageKey ?? "introspection.auth.session";
+        this.leewayMs = (options.leewaySeconds ?? 60) * 1000;
+        const fetchImpl = options.fetch ?? globalThis.fetch;
+        if (!fetchImpl) {
+            throw new Error("global fetch is unavailable; pass `fetch` or run on Node 18+");
+        }
+        // Bound so a browser's native fetch is not called with this client as `this`.
+        this.fetchImpl = (input, init) => fetchImpl(input, init);
+        this.now = options.now ?? Date.now;
+    }
+    // --- sign-in ---
+    /**
+     * Email a one-time code to `email`. The answer is the same whether or not
+     * the email has an account; a new address gets an account on verify.
+     * Throws `RateLimitError` (with `retryAfter`) when codes are requested too
+     * often.
+     */
+    async signInWithOtp(params) {
+        const res = await this.fetchImpl(`${this.baseApiUrl}/v1/oauth/email/code`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                client_id: this.options.clientId,
+                email: params.email,
+                project: this.options.project,
+            }),
+            cache: "no-store",
+        });
+        if (!res.ok)
+            throw await toApiError(res);
+    }
+    /**
+     * Verify the code sent to `email` and sign in. The code is opaque: 6 digits
+     * for a returning user, 6 characters of A–Z and 0–9 for a new user's first
+     * sign-in. A wrong, expired or reused code throws a `ValidationError` with
+     * `code === "invalid_grant"`.
+     *
+     * Rejects with an `AbortError` when a sign-out or another sign-in completes
+     * while the code is being verified, so a slow response never overwrites a
+     * newer session.
+     */
+    async verifyOtp(params) {
+        const generation = this.generation;
+        const token = await this.postToken({
+            grant_type: EMAIL_CODE_GRANT_TYPE,
+            client_id: this.options.clientId,
+            email: params.email,
+            code: params.token.trim(),
+            project: this.options.project,
+        });
+        return this.signedIn(this.toSession(token), generation);
+    }
+    /** Adopt a platform token obtained elsewhere, for example from your own backend. */
+    async setSession(token) {
+        return this.signedIn(this.toSession(token));
+    }
+    // --- session ---
+    /**
+     * The current session, restored from storage on first use and refreshed
+     * when it is within `leewaySeconds` of expiry. `null` when signed out.
+     */
+    async getSession() {
+        await this.restoreIfNeeded();
+        const current = this.current;
+        if (!current)
+            return null;
+        if (current.expires_at !== null &&
+            current.expires_at - this.leewayMs <= this.now()) {
+            return this.refreshSession();
+        }
+        return current;
+    }
+    /**
+     * Renew the session now, or join the renewal already in flight. A refresh
+     * the server rejects signs the user out and throws `AuthenticationError`;
+     * a network failure keeps the session and rethrows.
+     */
+    async refreshSession() {
+        await this.restoreIfNeeded();
+        if (this.refreshing)
+            return this.refreshing;
+        const session = this.current;
+        if (!session) {
+            throw new AuthenticationError({ message: "Not signed in", status: 401 });
+        }
+        const generation = this.generation;
+        const refreshing = (async () => {
+            try {
+                const next = await this.renew(session);
+                if (this.generation !== generation)
+                    throw superseded();
+                await this.store(next);
+                if (this.generation !== generation)
+                    throw superseded();
+                this.current = next;
+                this.emit("TOKEN_REFRESHED", next);
+                return next;
+            }
+            catch (err) {
+                if (!isRejection(err))
+                    throw err;
+                if (this.generation !== generation)
+                    throw superseded();
+                await this.clear();
+                throw new AuthenticationError({
+                    message: `The session is no longer valid: ${err.message}`,
+                    status: err.status,
+                    code: err.code,
+                    requestId: err.requestId,
+                    body: err.body,
+                });
+            }
+            finally {
+                if (this.generation === generation)
+                    this.refreshing = undefined;
+            }
+        })();
+        this.refreshing = refreshing;
+        return refreshing;
+    }
+    /**
+     * Sign out: forget the session locally, then revoke it on the platform.
+     * The local session is cleared even when revocation fails; the revocation
+     * error is still thrown.
+     */
+    async signOut() {
+        await this.restoreIfNeeded();
+        const session = this.current;
+        await this.clear();
+        if (!session?.refresh_token || !session.session_id || !session.org_id) {
+            return;
+        }
+        const res = await this.fetchImpl(`${this.baseApiUrl}/v1/oauth/revoke`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                client_id: this.options.clientId,
+                session_id: session.session_id,
+                org_id: session.org_id,
+            }).toString(),
+            cache: "no-store",
+        });
+        if (!res.ok)
+            throw await toApiError(res);
+    }
+    /**
+     * Listen for session changes. A new listener first receives
+     * `INITIAL_SESSION` with the session restored from storage (or `null`).
+     */
+    onAuthStateChange(listener) {
+        this.listeners.add(listener);
+        void this.restoreIfNeeded().then(() => {
+            if (this.listeners.has(listener))
+                listener("INITIAL_SESSION", this.current);
+        });
+        return { unsubscribe: () => this.listeners.delete(listener) };
+    }
+    // --- using the session ---
+    /**
+     * A bearer credential backed by this client: refreshed before expiry, and
+     * once more after a `401` unless another request already renewed it.
+     */
+    get credentials() {
+        return {
+            accessToken: async () => (await this.getSession())?.access_token ?? null,
+            refreshAfterUnauthorized: async (rejected) => {
+                const session = await this.getSession();
+                if (!session)
+                    return false;
+                if (rejected !== null && rejected !== session.access_token)
+                    return true;
+                await this.refreshSession();
+                return true;
+            },
+        };
+    }
+    /**
+     * A Data Plane client authenticated as the signed-in member. The Data Plane
+     * URL defaults to the one returned with the session.
+     */
+    async dataPlane(options = {}) {
+        const session = await this.getSession();
+        if (!session) {
+            throw new AuthenticationError({ message: "Not signed in", status: 401 });
+        }
+        const dpUrl = options.dpUrl ?? session.dp_url;
+        if (!dpUrl) {
+            throw new Error("The session carries no dp_url; pass `dpUrl` for this deployment");
+        }
+        return new DataPlaneClient({
+            dpUrl,
+            credentials: this.credentials,
+            additionalHeaders: options.additionalHeaders,
+            fetch: this.options.fetch,
+        });
+    }
+    // --- internals ---
+    async postToken(fields) {
+        const res = await this.fetchImpl(`${this.baseApiUrl}/v1/oauth/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams(fields).toString(),
+            cache: "no-store",
+        });
+        if (!res.ok)
+            throw await toApiError(res);
+        return (await res.json());
+    }
+    /** The refresh response omits `dp_url`, so it carries over from `previous`. */
+    toSession(token, previous) {
+        return {
+            access_token: token.access_token,
+            token_type: token.token_type ?? "Bearer",
+            refresh_token: token.refresh_token ?? previous?.refresh_token ?? null,
+            expires_at: typeof token.expires_in === "number"
+                ? this.now() + token.expires_in * 1000
+                : null,
+            scope: token.scope ?? previous?.scope ?? null,
+            session_id: token.session_id ?? previous?.session_id ?? null,
+            org_id: token.org_id ?? previous?.org_id ?? null,
+            project_id: token.project_id ?? previous?.project_id ?? null,
+            member_id: token.member_id ?? previous?.member_id ?? null,
+            dp_url: token.dp_url ?? previous?.dp_url ?? null,
+        };
+    }
+    async renew(session) {
+        if (!session.refresh_token || !session.session_id || !session.org_id) {
+            throw new AuthenticationError({
+                message: "The session has no refresh token",
+                status: 401,
+            });
+        }
+        const token = await this.postToken({
+            grant_type: GRANT_TYPE_REFRESH_TOKEN,
+            client_id: this.options.clientId,
+            refresh_token: session.refresh_token,
+            session_id: session.session_id,
+            org_id: session.org_id,
+        });
+        return this.toSession(token, session);
+    }
+    /** `expected` is the generation read before a sign-in request was sent. */
+    async signedIn(session, expected) {
+        if (expected !== undefined && this.generation !== expected) {
+            throw superseded();
+        }
+        const generation = ++this.generation;
+        this.refreshing = undefined;
+        this.restored = true;
+        this.current = null;
+        await this.store(session);
+        if (this.generation !== generation)
+            throw superseded();
+        this.current = session;
+        this.emit("SIGNED_IN", session);
+        return session;
+    }
+    /** Storage may be async, so writes are chained to land in transition order. */
+    store(session) {
+        const value = JSON.stringify(session);
+        const write = this.storageWrite
+            .catch(() => undefined)
+            .then(() => this.storage.setItem(this.storageKey, value));
+        this.storageWrite = write;
+        return write;
+    }
+    async clear() {
+        this.generation++;
+        this.refreshing = undefined;
+        const hadSession = this.current !== null;
+        this.current = null;
+        this.restored = true;
+        if (hadSession)
+            this.emit("SIGNED_OUT", null);
+        const write = this.storageWrite
+            .catch(() => undefined)
+            .then(() => this.storage.removeItem(this.storageKey));
+        this.storageWrite = write;
+        await write.catch(() => undefined);
+    }
+    /** Concurrent first callers share one load, so none sees the session as absent while it is read. */
+    restoreIfNeeded() {
+        if (this.restored)
+            return Promise.resolve();
+        this.restoring ??= (async () => {
+            let stored = null;
+            try {
+                const raw = await this.storage.getItem(this.storageKey);
+                stored = raw ? JSON.parse(raw) : null;
+            }
+            catch {
+                stored = null;
+            }
+            if (!this.restored && stored?.access_token)
+                this.current = stored;
+            this.restored = true;
+            this.restoring = undefined;
+        })();
+        return this.restoring;
+    }
+    emit(event, session) {
+        for (const listener of this.listeners)
+            listener(event, session);
+    }
+}
+//# sourceMappingURL=auth-client.js.map

package/dist/auth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-client.js","sourceRoot":"","sources":["../src/auth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGlD,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAC7D,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAChC,sDAAsD,CAAC;AACzD,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAajD,oEAAoE;AACpE,MAAM,OAAO,sBAAsB;IAChB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,KAAa;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF;AAwDD,sFAAsF;AACtF,SAAS,UAAU;IACjB,OAAO,IAAI,YAAY,CACrB,wDAAwD,EACxD,YAAY,CACb,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,CACL,GAAG,YAAY,qBAAqB;QACpC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,GAAG,GACP,OAAO,OAAO,KAAK,WAAW;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC;IAC9C,OAAO,GAAG,IAAI,oBAAoB,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,UAAU;IAiBQ;IAhBZ,UAAU,CAAS;IACnB,OAAO,CAAiB;IACxB,UAAU,CAAS;IACnB,QAAQ,CAAS;IACjB,SAAS,CAAe;IACxB,GAAG,CAAe;IAE3B,OAAO,GAAuB,IAAI,CAAC;IAC3C,2FAA2F;IACnF,UAAU,GAAG,CAAC,CAAC;IACf,QAAQ,GAAG,KAAK,CAAC;IACjB,SAAS,CAAiB;IAC1B,UAAU,CAAwB;IAClC,YAAY,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACvC,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE1D,YAA6B,OAA0B;QAA1B,YAAO,GAAP,OAAO,CAAmB;QACrD,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAClC,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAC1C,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,sBAAsB,EAAE,CAAC;QAC/D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,4BAA4B,CAAC;QACrE,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACrD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,8EAA8E;QAC9E,IAAI,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,kBAAkB;IAElB;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,MAAyB;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,UAAU,sBAAsB,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;aAC9B,CAAC;YACF,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,SAAS,CAAC,MAGf;QACC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;YACjC,UAAU,EAAE,qBAAqB;YACjC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,UAAU,CAAC,KAAiB;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,kBAAkB;IAElB;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,IACE,OAAO,CAAC,UAAU,KAAK,IAAI;YAC3B,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,EAChD,CAAC;YACD,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,UAAU,GAAG,CAAC,KAAK,IAA0B,EAAE;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvC,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;oBAAE,MAAM,UAAU,EAAE,CAAC;gBACvD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvB,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;oBAAE,MAAM,UAAU,EAAE,CAAC;gBACvD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;gBACnC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC;gBACjC,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;oBAAE,MAAM,UAAU,EAAE,CAAC;gBACvD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,mBAAmB,CAAC;oBAC5B,OAAO,EAAE,mCAAmC,GAAG,CAAC,OAAO,EAAE;oBACzD,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,IAAI,EAAE,GAAG,CAAC,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;oBAAE,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;YAClE,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACtE,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,UAAU,kBAAkB,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAChC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC,QAAQ,EAAE;YACb,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,QAA2B;QAC3C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YACpC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC9B,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,4BAA4B;IAE5B;;;OAGG;IACH,IAAI,WAAW;QACb,OAAO;YACL,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,YAAY,IAAI,IAAI;YACxE,wBAAwB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IAAI,CAAC,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAC3B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,OAAO,CAAC,YAAY;oBAAE,OAAO,IAAI,CAAC;gBACxE,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CACb,UAGI,EAAE;QAEN,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,eAAe,CAAC;YACzB,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB;IAEZ,KAAK,CAAC,SAAS,CAAC,MAA8B;QACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,UAAU,iBAAiB,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;YAC5C,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAC;IAC1C,CAAC;IAED,+EAA+E;IACvE,SAAS,CAAC,KAAiB,EAAE,QAAsB;QACzD,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ;YACxC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,QAAQ,EAAE,aAAa,IAAI,IAAI;YACrE,UAAU,EACR,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;gBAClC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI;gBACtC,CAAC,CAAC,IAAI;YACV,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,EAAE,KAAK,IAAI,IAAI;YAC7C,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ,EAAE,UAAU,IAAI,IAAI;YAC5D,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,IAAI;YAChD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ,EAAE,UAAU,IAAI,IAAI;YAC5D,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,QAAQ,EAAE,SAAS,IAAI,IAAI;YACzD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,IAAI;SACjD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAAoB;QACtC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACrE,MAAM,IAAI,mBAAmB,CAAC;gBAC5B,OAAO,EAAE,kCAAkC;gBAC3C,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;YACjC,UAAU,EAAE,wBAAwB;YACpC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,QAAQ,CACpB,OAAoB,EACpB,QAAiB;QAEjB,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC3D,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,UAAU,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;YAAE,MAAM,UAAU,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,+EAA+E;IACvE,KAAK,CAAC,OAAoB;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY;aAC5B,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACtB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY;aAC5B,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACtB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QAC1B,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED,oGAAoG;IAC5F,eAAe;QACrB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;YAC7B,IAAI,MAAM,GAAuB,IAAI,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACxD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,YAAY;gBAAE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;YAClE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,IAAI,CAAC,KAAsB,EAAE,OAA2B;QAC9D,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS;YAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;CACF"}

package/dist/auth.d.ts

@@ -1,6 +1,8 @@
 /**
- * CP `POST /v1/oauth/token` response. No refresh token is issued for the
- * machine grants — re-mint when it expires.
+ * CP `POST /v1/oauth/token` response. The machine and token-exchange grants
+ * issue no refresh token — re-mint when it expires; the `authorization_code`
+ * and native `email_code` grants add `refresh_token` and the session fields
+ * the `refresh_token` grant is keyed on.
  */
 export interface OAuthToken {
     /** Project-scoped RS256 access token (`Authorization: Bearer …`). */
@@ -18,6 +20,14 @@ export interface OAuthToken {
      * browser client as `dpUrl` so the SPA connects without separate DP config.
      */
     dp_url: string | null;
+    /** Rotating refresh token, for the grants that issue one. */
+    refresh_token?: string | null;
+    /** The platform session the refresh token belongs to. */
+    session_id?: string | null;
+    org_id?: string | null;
+    project_id?: string | null;
+    /** The member the token was minted for. */
+    member_id?: string | null;
 }
 export interface ServiceAccountTokenParams {
     /** Confidential Application client id (`intro_app_…`). */

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAyDA;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,UAAU,CAAC,CAarB;AAED,MAAM,WAAW,uBAAuB;IACtC,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAarB;AAED,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAcrB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAyDA;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,UAAU,CAAC,CAarB;AAED,MAAM,WAAW,uBAAuB;IACtC,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAarB;AAED,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAcrB"}

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAEzE,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAC7D,MAAM,6BAA6B,GAAG,oBAAoB,CAAC;AAC3D,MAAM,yBAAyB,GAC7B,iDAAiD,CAAC;AACpD,MAAM,6BAA6B,GAAG,oBAAoB,CAAC;AAC3D,MAAM,2BAA2B,GAAG,2CAA2C,CAAC;AAEhF,SAAS,iBAAiB,CAAC,UAAmB;IAC5C,OAAO,kBAAkB,CACvB,UAAU;QACR,OAAO,CAAC,GAAG,CAAC,0BAA0B;QACtC,oBAAoB,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB;IACzC,MAAM,SAAS,GAAG,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,UAAkB,EAClB,IAAqB,EACrB,SAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,UAAU,iBAAiB,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;QACrB,KAAK,EAAE,UAAU;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAC;AAC1C,CAAC;AAuDD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAiC;IAEjC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,6BAA6B;QACzC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,aAAa,CAClB,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,EACpC,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC;AAoBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAA+B;IAE/B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,6BAA6B;QACzC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,aAAa,EAAE,MAAM,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,OAAO,aAAa,CAClB,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,EACpC,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC;AAyBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,yBAAyB;QACrC,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,IAAI,2BAA2B;QAC1E,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,aAAa,CAClB,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,EACpC,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAEzE,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAC7D,MAAM,6BAA6B,GAAG,oBAAoB,CAAC;AAC3D,MAAM,yBAAyB,GAC7B,iDAAiD,CAAC;AACpD,MAAM,6BAA6B,GAAG,oBAAoB,CAAC;AAC3D,MAAM,2BAA2B,GAAG,2CAA2C,CAAC;AAEhF,SAAS,iBAAiB,CAAC,UAAmB;IAC5C,OAAO,kBAAkB,CACvB,UAAU;QACR,OAAO,CAAC,GAAG,CAAC,0BAA0B;QACtC,oBAAoB,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB;IACzC,MAAM,SAAS,GAAG,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,UAAkB,EAClB,IAAqB,EACrB,SAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,UAAU,iBAAiB,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;QACrB,KAAK,EAAE,UAAU;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAC;AAC1C,CAAC;AAiED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAiC;IAEjC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,6BAA6B;QACzC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,aAAa,CAClB,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,EACpC,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC;AAoBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAA+B;IAE/B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,6BAA6B;QACzC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,aAAa,EAAE,MAAM,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,OAAO,aAAa,CAClB,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,EACpC,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC;AAyBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,yBAAyB;QACrC,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,IAAI,2BAA2B;QAC1E,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,aAAa,CAClB,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,EACpC,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC"}

package/dist/client.d.ts

@@ -11,7 +11,8 @@
  * helpers, use {@link IntrospectionLogs} from
  * `@introspection-sdk/introspection-node/otel`.
  */
-import type { AdvancedOptions } from "@introspection-sdk/types";
+import type { AdvancedOptions, AppConnectionCreateParams } from "@introspection-sdk/types";
+import { ConversationsApi, EventsApi, FilesApi, MetricsApi, SharesApi, TasksApi } from "@introspection-sdk/http";
 import type { IntrospectionClientOptions } from "./types.js";
 import { type ServiceAccountTokenParams } from "./auth.js";
 import { HttpClient } from "./http.js";
@@ -19,6 +20,12 @@ import { type RuntimeHandleFactory, type RuntimesApi } from "./resources/runtime
 import { type ExperimentHandleFactory, type ExperimentsApi } from "./resources/experiments.js";
 import { type RecipesApi } from "./resources/recipes.js";
 import { type ConnectorsApi } from "./resources/connectors.js";
+import { type MembersApi } from "./resources/members.js";
+import { type AutomationsApi } from "./resources/automations.js";
+import { type AnnotationsApi, type ProjectLabelsApi } from "./resources/annotations.js";
+import { type RepositoriesApi } from "./resources/repositories.js";
+import { AppConnectionsApi } from "./resources/app-connections.js";
+import type { DataPlaneResources } from "./data-plane.js";
 /**
  * Introspection REST client.
  *
@@ -39,9 +46,11 @@ import { type ConnectorsApi } from "./resources/connectors.js";
  * await client.shutdown();
  * ```
  */
-export declare class IntrospectionClient {
+export declare class IntrospectionClient implements DataPlaneResources {
     /** @internal — HTTP client pointed at the CP API with the customer key. */
     readonly cpHttp: HttpClient;
+    /** @internal — HTTP client pointed at the project Data Plane. */
+    readonly dpHttp: HttpClient;
     /** @internal — passed through to Runner so it can build its own DP HTTP client. */
     readonly advancedOptions: AdvancedOptions;
     /**
@@ -50,10 +59,7 @@ export declare class IntrospectionClient {
      * through the Introspection CLI and platform.
      */
     readonly runtimes: RuntimesApi & RuntimeHandleFactory;
-    /**
-     * Reads on `/v1/experiments` plus the `(id) => ExperimentHandle` factory
-     * for run lifecycle. Authoring experiment definitions is a CLI action.
-     */
+    /** CRUD on `/v1/experiments` plus the callable run-lifecycle handle. */
     readonly experiments: ExperimentsApi & ExperimentHandleFactory;
     /**
      * Reads on `/v1/recipes`. Recipes are immutable build artefacts
@@ -67,6 +73,45 @@ export declare class IntrospectionClient {
      * single-use consent URL a Business hands its customer.
      */
     readonly connectors: ConnectorsApi;
+    /**
+     * List, read, create and update on `/v1/members`, including each
+     * member's access-bearing `tags` and its `metadata` labels, which grant
+     * nothing.
+     */
+    readonly members: MembersApi;
+    /**
+     * CRUD on `/v1/automations` (Data Plane) plus `automations.trigger(id)`.
+     * Administrator-only on the server today.
+     */
+    readonly automations: AutomationsApi;
+    /**
+     * Reads on `/v1/repositories` (CP) plus `repositories.contents` and
+     * `repositories.commits`, which read files, directories and history
+     * through the Data Plane, and `repositories.merge`, which merges branches.
+     */
+    readonly repositories: RepositoriesApi;
+    /** Read folded span annotations and append one annotation mutation. */
+    readonly annotations: AnnotationsApi;
+    /** Manage reusable project labels. */
+    readonly projectLabels: ProjectLabelsApi;
+    /** Read immutable annotation activity and other typed platform events. */
+    readonly events: EventsApi;
+    /** `/v1/tasks` (Data Plane), with `tasks.runs`. */
+    readonly tasks: TasksApi;
+    /** `/v1/files` (Data Plane). */
+    readonly files: FilesApi;
+    /** Read-only `/v1/conversations` (Data Plane). */
+    readonly conversations: ConversationsApi;
+    /** Bounded aggregations on `POST /v1/metrics` (Data Plane). */
+    readonly metrics: MetricsApi;
+    /** `/v1/shares` sharing grants (Data Plane). */
+    readonly shares: SharesApi;
+    /**
+     * CRUD on `/v1/connections` (Data Plane), the apps members connected for
+     * themselves. `create` takes the `runtime` explicitly, since the client
+     * has no runtime context.
+     */
+    readonly connections: AppConnectionsApi<Required<AppConnectionCreateParams>>;
     constructor(options?: IntrospectionClientOptions);
     /**
      * Authenticate as a confidential service account and return a ready

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,2BAA2B,CAAC;AAGnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAmB;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAE1C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,oBAAoB,CAAC;IAEtD;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,uBAAuB,CAAC;IAE/D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAE7B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;gBAEvB,OAAO,GAAE,0BAA+B;IAmDpD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;WACU,kBAAkB,CAC7B,MAAM,EAAE,yBAAyB,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3D,OAAO,CAAC,mBAAmB,CAAC;IAS/B,wCAAwC;IAClC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAKhC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,yBAAyB,EAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,SAAS,EACT,QAAQ,EACT,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAoB,YAAW,kBAAkB;IAC5D,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAE1C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,oBAAoB,CAAC;IAEtD,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,uBAAuB,CAAC;IAE/D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAE7B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IAEnC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAE7B;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IAEvC,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IAErC,sCAAsC;IACtC,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IAEzC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAM3B,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAEzB,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAEzB,kDAAkD;IAClD,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IAEzC,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAE7B,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC;gBAEjE,OAAO,GAAE,0BAA+B;IA0EpD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;WACU,kBAAkB,CAC7B,MAAM,EAAE,yBAAyB,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3D,OAAO,CAAC,mBAAmB,CAAC;IAa/B,wCAAwC;IAClC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAKhC"}