@ironflow/browser 0.30.0 → 0.32.0

package/dist/client.js

@@ -3,8 +3,8 @@
  *
  * Singleton client for browser-based real-time interactions with Ironflow.
  */
-import { NotConfiguredError, IronflowError, RunFailedError, RunCancelledError, UnauthenticatedError, EnterpriseRequiredError, UnauthorizedError, ValidationError, createLogger, createNoopLogger, DEFAULT_TIMEOUTS, HEADERS, TriggerResponseSchema, TriggerSyncResponseSchema, RunResponseSchema, ListRunsResponseSchema, RunStatusSchema, ErrorResponseSchema, safeJsonParse, patterns, peelProjectionEnvelope, webhookVerifyConfigToWire, webhookGraceToWire, webhookSourceFromWire, webhookDeliveryFromWire, } from "@ironflow/core";
-import { mergeConfig } from "./config.js";
+import { NotConfiguredError, IronflowError, RunFailedError, RunCancelledError, UnauthenticatedError, EnterpriseRequiredError, UnauthorizedError, ValidationError, createLogger, createNoopLogger, DEFAULT_TIMEOUTS, HEADERS, TriggerResponseSchema, TriggerSyncResponseSchema, RunResponseSchema, ListRunsResponseSchema, RunStatusSchema, ErrorResponseSchema, safeJsonParse, patterns, peelProjectionEnvelope, webhookVerifyConfigToWire, webhookGraceToWire, webhookSourceFromWire, webhookDeliveryFromWire, registeredFunctionFromWire, functionHistoryEntryFromWire, storedEventFromWire, runStepFromWire, consumerGroupFromWire, } from "@ironflow/core";
+import { mergeConfig, warnAboutLongLivedBrowserKey } from "./config.js";
 import { SubscriptionManager, } from "./subscription.js";
 import { createWebSocketTransport } from "./transport/websocket.js";
 import { createConnectRPCTransport } from "./transport/connectrpc.js";
@@ -12,6 +12,18 @@ import { filterWaitStreamFrames } from "./projection-stream.js";
 import { BrowserKVClient } from "./kv.js";
 import { BrowserConfigClient } from "./config-client.js";
 import { createAgentsNamespace } from "./agents/index.js";
+function auditEventFromWire(raw) {
+    return {
+        id: String(raw.id ?? ""),
+        runId: String(raw.run_id ?? raw.runId ?? ""),
+        functionId: String(raw.function_id ?? raw.functionId ?? ""),
+        stepId: (raw.step_id ?? raw.stepId),
+        eventType: String(raw.event_type ?? raw.eventType ?? ""),
+        payload: raw.payload ?? {},
+        metadata: raw.metadata,
+        createdAt: String(raw.created_at ?? raw.createdAt ?? ""),
+    };
+}
 /**
  * Key for the offline queue's replay entry point.
  *
@@ -71,6 +83,7 @@ class IronflowClient {
      */
     configure(options = {}) {
         this.config = mergeConfig(options);
+        warnAboutLongLivedBrowserKey(this.config.auth);
         // Set up logger
         if (this.config.logger === false) {
             this.logger = createNoopLogger();
@@ -326,6 +339,21 @@ class IronflowClient {
         const response = await this.request(RunResponseSchema, "POST", "/ironflow.v1.IronflowService/GetRun", { id: runId });
         return this.mapRunResponse(response);
     }
+    /** Get the durable steps recorded for a run. */
+    async getRunSteps(runId) {
+        this.ensureConfigured();
+        const response = await this.restRequest("GET", `/api/v1/runs/${encodeURIComponent(runId)}/steps`);
+        return {
+            steps: (response.steps ?? []).map(runStepFromWire),
+            count: response.count ?? 0,
+        };
+    }
+    /** Get the entity stream IDs touched by a run. */
+    async getRunStreams(runId) {
+        this.ensureConfigured();
+        const response = await this.restRequest("GET", `/api/v1/runs/${encodeURIComponent(runId)}/streams`);
+        return { entityIds: response.entity_ids ?? [] };
+    }
     /**
      * List runs with filtering
      */
@@ -365,9 +393,7 @@ class IronflowClient {
                 "Content-Type": "application/json",
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "POST",
                 headers,
@@ -397,9 +423,7 @@ class IronflowClient {
                 "Content-Type": "application/json",
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "POST",
                 headers,
@@ -430,9 +454,7 @@ class IronflowClient {
                 "Content-Type": "application/json",
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "POST",
                 headers,
@@ -463,9 +485,7 @@ class IronflowClient {
                 "Content-Type": "application/json",
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "POST",
                 headers,
@@ -507,9 +527,7 @@ class IronflowClient {
                 "Content-Type": "application/json",
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "POST",
                 headers,
@@ -554,9 +572,7 @@ class IronflowClient {
                 "Content-Type": "application/json",
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "POST",
                 headers,
@@ -614,9 +630,7 @@ class IronflowClient {
                 "Content-Type": "application/json",
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "POST",
                 headers,
@@ -656,9 +670,7 @@ class IronflowClient {
                 "Content-Type": "application/json",
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "POST",
                 headers,
@@ -687,9 +699,61 @@ class IronflowClient {
             clearTimeout(timeoutId);
         }
     }
-    /**
-     * List registered functions
-     */
+    /** Get a registered function by ID. */
+    async getFunction(functionId) {
+        this.ensureConfigured();
+        const response = await this.streamRequest("/ironflow.v1.IronflowService/GetFunction", { id: functionId });
+        return registeredFunctionFromWire(response);
+    }
+    /** Change a function's lifecycle status. */
+    async updateFunctionStatus(functionId, status) {
+        this.ensureConfigured();
+        const response = await this.streamRequest("/ironflow.v1.IronflowService/UpdateFunctionStatus", {
+            id: functionId,
+            status: `FUNCTION_STATUS_${status.toUpperCase()}`,
+        });
+        return registeredFunctionFromWire(response);
+    }
+    /** Permanently delete a registered function. */
+    async deleteFunction(functionId) {
+        this.ensureConfigured();
+        await this.streamRequest("/ironflow.v1.IronflowService/DeleteFunction", { id: functionId });
+    }
+    /** List immutable configuration snapshots, newest first. */
+    async listFunctionHistory(functionId, options = {}) {
+        this.ensureConfigured();
+        const response = await this.streamRequest("/ironflow.v1.IronflowService/ListFunctionHistory", {
+            functionId,
+            ...(options.limit !== undefined ? { limit: options.limit } : {}),
+            ...(options.fromVersion !== undefined
+                ? { fromVersion: String(options.fromVersion) }
+                : {}),
+        });
+        return {
+            entries: (response.entries ?? []).map(functionHistoryEntryFromWire),
+            hasMore: response.hasMore ?? false,
+        };
+    }
+    /** Get one historical configuration snapshot by entity version. */
+    async getFunctionAtVersion(functionId, version) {
+        this.ensureConfigured();
+        const response = await this.streamRequest("/ironflow.v1.IronflowService/GetFunctionAtVersion", {
+            functionId,
+            version: String(version),
+        });
+        return functionHistoryEntryFromWire(response.entry);
+    }
+    /** Restore a function's configuration from a historical version. */
+    async rollbackFunction(functionId, version, changeReason) {
+        this.ensureConfigured();
+        const response = await this.streamRequest("/ironflow.v1.IronflowService/RollbackFunction", {
+            functionId,
+            version: String(version),
+            ...(changeReason ? { changeReason } : {}),
+        });
+        return registeredFunctionFromWire(response.function);
+    }
+    /** List registered functions. */
     async listFunctions() {
         this.ensureConfigured();
         const url = `${this.config.serverUrl}/api/v1/functions`;
@@ -700,9 +764,7 @@ class IronflowClient {
             const headers = {
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "GET",
                 headers,
@@ -731,9 +793,7 @@ class IronflowClient {
             const headers = {
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "GET",
                 headers,
@@ -824,6 +884,104 @@ class IronflowClient {
             eventId: response.eventId,
         };
     }
+    /**
+     * Publish a message to a developer pub/sub topic.
+     * Unlike emit(), this does not trigger workflow functions.
+     */
+    async publish(topic, data, options) {
+        this.ensureConfigured();
+        const response = await this.streamRequest("/ironflow.v1.PubSubService/Publish", {
+            topic,
+            data: data ?? {},
+            ...(options?.idempotencyKey
+                ? { idempotencyKey: options.idempotencyKey }
+                : {}),
+        });
+        return {
+            eventId: response.eventId,
+            sequence: Number(response.sequence) || 0,
+        };
+    }
+    /** Trigger multiple events in one request. */
+    async triggerBatch(events) {
+        this.ensureConfigured();
+        const response = await this.streamRequest("/ironflow.v1.IronflowService/TriggerBatch", {
+            events: events.map((event) => ({
+                event: event.event,
+                data: event.data,
+                ...(event.version !== undefined ? { version: event.version } : {}),
+                ...(event.idempotencyKey
+                    ? { idempotencyKey: event.idempotencyKey }
+                    : {}),
+                ...(event.metadata ? { metadata: event.metadata } : {}),
+            })),
+        });
+        return (response.results ?? []).map((result) => ({
+            runIds: result.runIds ?? [],
+            eventId: result.eventId,
+        }));
+    }
+    /** Read a keyset-paginated page from the event log. */
+    async listEvents(options = {}) {
+        this.ensureConfigured();
+        const query = new URLSearchParams();
+        if (options.name)
+            query.set("name", options.name);
+        if (options.names?.length)
+            query.set("names", options.names.join(","));
+        if (options.sources?.length)
+            query.set("source", options.sources.join(","));
+        if (options.search)
+            query.set("search", options.search);
+        if (options.since)
+            query.set("since", options.since);
+        if (options.until)
+            query.set("until", options.until);
+        if (options.limit !== undefined)
+            query.set("limit", String(options.limit));
+        if (options.cursor)
+            query.set("cursor", options.cursor);
+        if (options.before)
+            query.set("before", options.before);
+        const suffix = query.size ? `?${query}` : "";
+        const response = await this.restRequest("GET", `/api/v1/events${suffix}`);
+        return {
+            events: (response.events ?? []).map(storedEventFromWire),
+            count: response.count ?? 0,
+            limit: response.limit ?? options.limit ?? 20,
+            nextCursor: response.next_cursor,
+            prevCursor: response.prev_cursor,
+            hasNext: response.has_next ?? false,
+            hasPrev: response.has_prev ?? false,
+            approxTotal: response.approx_total,
+            approxTotalCapped: response.approx_total_capped ?? false,
+        };
+    }
+    /** Get one persisted event by ID. */
+    async getEvent(eventId) {
+        this.ensureConfigured();
+        const response = await this.restRequest("GET", `/api/v1/events/${encodeURIComponent(eventId)}`);
+        return storedEventFromWire(response);
+    }
+    /** List event names and counts for filter UIs. */
+    async listEventNames(options = {}) {
+        this.ensureConfigured();
+        const query = new URLSearchParams();
+        if (options.sources?.length)
+            query.set("source", options.sources.join(","));
+        if (options.since)
+            query.set("since", options.since);
+        if (options.until)
+            query.set("until", options.until);
+        const suffix = query.size ? `?${query}` : "";
+        const response = await this.restRequest("GET", `/api/v1/events/names${suffix}`);
+        return {
+            names: response.names ?? [],
+            scanned: response.scanned ?? 0,
+            truncated: response.truncated ?? false,
+            scanCap: response.scan_cap ?? 0,
+        };
+    }
     /**
      * Emit an event synchronously — waits for the triggered run to complete and returns the result.
      *
@@ -877,6 +1035,84 @@ class IronflowClient {
         });
         return sub;
     }
+    /** Consumer-group lifecycle management. */
+    consumerGroups = {
+        create: async (config) => {
+            this.ensureConfigured();
+            const response = await this.streamRequest("/ironflow.v1.PubSubService/CreateConsumerGroup", {
+                name: config.name,
+                pattern: config.pattern,
+                namespace: config.namespace ?? "default",
+                ...(config.filterExpr !== undefined ? { filter_expr: config.filterExpr } : {}),
+                ...(config.ackMode ? { ack_mode: `ACK_MODE_${config.ackMode.toUpperCase()}` } : {}),
+                ...(config.backpressure
+                    ? { backpressure: `BACKPRESSURE_MODE_${config.backpressure.toUpperCase()}` }
+                    : {}),
+                ...(config.maxInflight !== undefined ? { max_inflight: config.maxInflight } : {}),
+                ...(config.maxRedeliveries !== undefined
+                    ? { max_redeliveries: config.maxRedeliveries }
+                    : {}),
+                ...(config.redeliverDelayMs !== undefined
+                    ? { redeliver_delay_ms: config.redeliverDelayMs }
+                    : {}),
+                ...(config.metadata !== undefined ? { metadata: config.metadata } : {}),
+            });
+            return consumerGroupFromWire(response);
+        },
+        get: async (name, namespace = "default") => {
+            this.ensureConfigured();
+            const response = await this.streamRequest("/ironflow.v1.PubSubService/GetConsumerGroup", { name, namespace });
+            return consumerGroupFromWire(response);
+        },
+        list: async (namespace) => {
+            this.ensureConfigured();
+            const groups = [];
+            let cursor;
+            do {
+                const response = await this.streamRequest("/ironflow.v1.PubSubService/ListConsumerGroups", {
+                    ...(namespace ? { namespace } : {}),
+                    limit: 100,
+                    ...(cursor ? { cursor } : {}),
+                });
+                groups.push(...(response.groups ?? []).map(consumerGroupFromWire));
+                cursor = response.nextCursor || response.next_cursor || undefined;
+            } while (cursor);
+            return groups;
+        },
+        update: async (name, input, namespace = "default") => {
+            this.ensureConfigured();
+            const group = { name, namespace };
+            const paths = [];
+            const set = (path, value) => {
+                if (value !== undefined) {
+                    group[path] = value;
+                    paths.push(path);
+                }
+            };
+            set("pattern", input.pattern);
+            set("filter_expr", input.filterExpr);
+            set("ack_mode", input.ackMode ? `ACK_MODE_${input.ackMode.toUpperCase()}` : undefined);
+            set("backpressure", input.backpressure
+                ? `BACKPRESSURE_MODE_${input.backpressure.toUpperCase()}`
+                : undefined);
+            set("max_inflight", input.maxInflight);
+            set("max_redeliveries", input.maxRedeliveries);
+            set("redeliver_delay_ms", input.redeliverDelayMs);
+            set("metadata", input.metadata);
+            set("status", input.status
+                ? `CONSUMER_GROUP_STATUS_${input.status.toUpperCase()}`
+                : undefined);
+            if (paths.length === 0) {
+                throw new ValidationError("Consumer group update requires at least one field");
+            }
+            const response = await this.streamRequest("/ironflow.v1.PubSubService/UpdateConsumerGroup", { group, update_mask: { paths } });
+            return consumerGroupFromWire(response);
+        },
+        delete: async (name, namespace = "default") => {
+            this.ensureConfigured();
+            await this.streamRequest("/ironflow.v1.PubSubService/DeleteConsumerGroup", { name, namespace });
+        },
+    };
     // ============================================================================
     // Entity Streams
     // ============================================================================
@@ -1015,6 +1251,29 @@ class IronflowClient {
                 createdAt: response.createdAt ?? "",
             };
         },
+        /** List entity streams visible in the current environment. */
+        listStreams: async () => {
+            this.ensureConfigured();
+            const response = await this.restRequest("GET", "/api/v1/streams");
+            return (response.streams ?? []).map((stream) => ({
+                entityId: String(stream.entity_id ?? stream.entityId ?? ""),
+                entityType: String(stream.entity_type ?? stream.entityType ?? ""),
+                version: Number(stream.version ?? 0),
+                eventCount: Number(stream.event_count ?? stream.eventCount ?? 0),
+                lastEventAt: String(stream.last_event_at ?? stream.lastEventAt ?? stream.updated_at ?? ""),
+            }));
+        },
+        /** Get the unified event history for an entity. */
+        getEntityHistory: async (entityId) => {
+            this.ensureConfigured();
+            const response = await this.restRequest("GET", `/api/v1/streams/${encodeURIComponent(entityId)}/history`);
+            return (response.entries ?? []).map((entry) => ({
+                eventName: String(entry.event_name ?? entry.eventName ?? ""),
+                data: entry.event_data ?? entry.data,
+                version: Number(entry.entity_version ?? entry.version ?? 0),
+                timestamp: String(entry.timestamp ?? ""),
+            }));
+        },
         /**
          * Subscribe to real-time events for an entity stream
          *
@@ -1087,9 +1346,7 @@ class IronflowClient {
             const headers = {
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "GET",
                 headers,
@@ -1153,9 +1410,7 @@ class IronflowClient {
             const headers = {
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "GET",
                 headers,
@@ -1180,48 +1435,6 @@ class IronflowClient {
             clearTimeout(timeoutId);
         }
     }
-    /**
-     * Trigger a rebuild of a projection
-     *
-     * @example
-     * ```typescript
-     * const result = await ironflow.rebuildProjection('order-stats');
-     * ```
-     */
-    async rebuildProjection(name, options) {
-        this.ensureConfigured();
-        const url = `${this.config.serverUrl}/api/v1/projections/${encodeURIComponent(name)}/rebuild`;
-        const timeout = this.config.timeout ?? DEFAULT_TIMEOUTS.CLIENT;
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeout);
-        try {
-            const headers = {
-                "Content-Type": "application/json",
-                [HEADERS.ENVIRONMENT]: this.config.environment,
-            };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
-            const response = await fetch(url, {
-                method: "POST",
-                headers,
-                body: JSON.stringify({
-                    partition: options?.partition,
-                    from_event_id: options?.fromEventId,
-                    dry_run: options?.dryRun,
-                }),
-                signal: controller.signal,
-            });
-            if (!response.ok) {
-                const error = safeJsonParse(await response.text());
-                throw new IronflowError(error?.message || `Rebuild projection failed: ${response.status}`, { code: error?.code || "REBUILD_PROJECTION_FAILED" });
-            }
-            return response.json();
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
-    }
     /**
      * Wait until the named projection has processed events up to `minSeq`,
      * or the timeout elapses. Read-your-writes primitive for CQRS UIs:
@@ -1248,9 +1461,7 @@ class IronflowClient {
             const headers = {
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "GET",
                 headers,
@@ -1305,7 +1516,7 @@ class IronflowClient {
             interceptors: [
                 (next) => async (req) => {
                     req.header.set(HEADERS.ENVIRONMENT, this.config.environment);
-                    const token = this.config.auth?.apiKey || this.config.auth?.token;
+                    const token = this.authCredential();
                     if (token)
                         req.header.set("Authorization", `Bearer ${token}`);
                     return next(req);
@@ -1345,9 +1556,7 @@ class IronflowClient {
                 "Content-Type": "application/json",
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const body = { eventId, projection };
             if (opts.timeoutMs !== undefined)
                 body.timeoutMs = opts.timeoutMs;
@@ -1388,9 +1597,7 @@ class IronflowClient {
             const headers = {
                 [HEADERS.ENVIRONMENT]: this.config.environment,
             };
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
+            this.applyAuthHeader(headers);
             const response = await fetch(url, {
                 method: "GET",
                 headers,
@@ -1493,11 +1700,8 @@ class IronflowClient {
      * @example
      * ```typescript
      * const cfg = ironflow.configManager();
-     * await cfg.set("app", { featureX: true, maxRetries: 3 });
      * const { data, revision } = await cfg.get("app");
-     * await cfg.patch("app", { maxRetries: 5 });
      * const configs = await cfg.list();
-     * await cfg.delete("app");
      *
      * // Watch for changes
      * const sub = await cfg.watch("app", {
@@ -1684,6 +1888,12 @@ class IronflowClient {
             this.ensureConfigured();
             await this.restRequest("DELETE", `/api/v1/roles/${encodeURIComponent(roleId)}/policies/${encodeURIComponent(policyId)}`);
         },
+        /** List policies assigned to a role. */
+        listPolicies: async (roleId) => {
+            this.ensureConfigured();
+            const response = await this.restRequest("GET", `/api/v1/roles/${encodeURIComponent(roleId)}/policies`);
+            return response.policies ?? [];
+        },
     };
     /**
      * Policy management operations (enterprise-only)
@@ -1848,6 +2058,32 @@ class IronflowClient {
             nextCursor: response.next_cursor,
         };
     }
+    /** Query the environment-wide audit stream. */
+    async listAuditEvents(options = {}) {
+        this.ensureConfigured();
+        const query = new URLSearchParams();
+        if (options.runId)
+            query.set("run_id", options.runId);
+        if (options.functionId)
+            query.set("function_id", options.functionId);
+        if (options.eventType)
+            query.set("event_type", options.eventType);
+        if (options.fromTimestamp)
+            query.set("from", options.fromTimestamp);
+        if (options.toTimestamp)
+            query.set("to", options.toTimestamp);
+        if (options.limit !== undefined)
+            query.set("limit", String(options.limit));
+        if (options.cursor)
+            query.set("cursor", options.cursor);
+        const suffix = query.size ? `?${query}` : "";
+        const response = await this.restRequest("GET", `/api/v1/audit${suffix}`);
+        return {
+            events: (response.events ?? []).map(auditEventFromWire),
+            totalCount: response.total_count ?? 0,
+            nextCursor: response.next_cursor || undefined,
+        };
+    }
     // ============================================================================
     // Webhook Management
     // ============================================================================
@@ -1995,55 +2231,6 @@ class IronflowClient {
             };
         },
     };
-    // ============================================================================
-    // User Management
-    // ============================================================================
-    /**
-     * User management operations
-     *
-     * @example
-     * ```typescript
-     * // List all users
-     * const users = await ironflow.users.list();
-     *
-     * // Create a user
-     * const user = await ironflow.users.create({
-     *   email: "alice@example.com",
-     *   password: "secret",
-     *   roles: ["admin"],
-     * });
-     *
-     * // Update a user
-     * await ironflow.users.update(user.id, { name: "Alice" });
-     * ```
-     */
-    users = {
-        /** Create a new user (admin only) */
-        create: async (input) => {
-            this.ensureConfigured();
-            return this.restRequest("POST", "/api/v1/users", input);
-        },
-        /** List all users in the current organization (admin only) */
-        list: async () => {
-            this.ensureConfigured();
-            return this.restRequest("GET", "/api/v1/users");
-        },
-        /** Get a user by ID */
-        get: async (id) => {
-            this.ensureConfigured();
-            return this.restRequest("GET", `/api/v1/users/${encodeURIComponent(id)}`);
-        },
-        /** Update a user's profile (admin only) */
-        update: async (id, input) => {
-            this.ensureConfigured();
-            return this.restRequest("PATCH", `/api/v1/users/${encodeURIComponent(id)}`, input);
-        },
-        /** Delete a user (admin only) */
-        delete: async (id) => {
-            this.ensureConfigured();
-            await this.restRequest("DELETE", `/api/v1/users/${encodeURIComponent(id)}`);
-        },
-    };
     /**
      * Tenant management operations (enterprise-only)
      *
@@ -2059,6 +2246,19 @@ class IronflowClient {
             this.ensureConfigured();
             return this.restRequest("GET", "/api/v1/tenants");
         },
+        /** Provision an organization, environment, and initial administrator key. */
+        provision: async (input) => {
+            this.ensureConfigured();
+            const response = await this.restRequest("POST", "/api/v1/tenants/provision", {
+                org_name: input.orgName,
+                env_name: input.envName ?? "production",
+            });
+            return {
+                org: response.org,
+                environment: response.environment,
+                apiKey: { key: response.api_key.key, roles: response.api_key.roles ?? [] },
+            };
+        },
     };
     // ============================================================================
     // Pattern Helpers (static)
@@ -2075,6 +2275,15 @@ class IronflowClient {
             throw new NotConfiguredError();
         }
     }
+    authCredential() {
+        return this.config.auth?.apiKey || this.config.auth?.token;
+    }
+    applyAuthHeader(headers) {
+        const credential = this.authCredential();
+        if (credential) {
+            headers["Authorization"] = `Bearer ${credential}`;
+        }
+    }
     cleanup() {
         if (this.visibilityHandler) {
             document.removeEventListener("visibilitychange", this.visibilityHandler);
@@ -2151,12 +2360,7 @@ class IronflowClient {
             if (body !== undefined) {
                 headers["Content-Type"] = "application/json";
             }
-            if (this.config.auth?.apiKey) {
-                headers["Authorization"] = `Bearer ${this.config.auth.apiKey}`;
-            }
-            else if (this.config.auth?.token) {
-                headers["Authorization"] = `Bearer ${this.config.auth.token}`;
-            }
+            this.applyAuthHeader(headers);
             const fetchOptions = {
                 method,
                 headers,