@kaitencloud/server 1.0.0

package/dist/index.mjs

@@ -0,0 +1,2744 @@
+//#region src/generated/core/bodySerializer.gen.ts
+const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
+//#endregion
+//#region src/generated/core/serverSentEvents.gen.ts
+function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
+	let lastEventId;
+	const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const createStream = async function* () {
+		let retryDelay = sseDefaultRetryDelay ?? 3e3;
+		let attempt = 0;
+		const signal = options.signal ?? new AbortController().signal;
+		while (true) {
+			if (signal.aborted) break;
+			attempt++;
+			const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+			if (lastEventId !== void 0) headers.set("Last-Event-ID", lastEventId);
+			try {
+				const requestInit = {
+					redirect: "follow",
+					...options,
+					body: options.serializedBody,
+					headers,
+					signal
+				};
+				let request = new Request(url, requestInit);
+				if (onRequest) request = await onRequest(url, requestInit);
+				const response = await (options.fetch ?? globalThis.fetch)(request);
+				if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);
+				if (!response.body) throw new Error("No body in SSE response");
+				const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
+				let buffer = "";
+				const abortHandler = () => {
+					try {
+						reader.cancel();
+					} catch {}
+				};
+				signal.addEventListener("abort", abortHandler);
+				try {
+					while (true) {
+						const { done, value } = await reader.read();
+						if (done) break;
+						buffer += value;
+						buffer = buffer.replace(/\r\n?/g, "\n");
+						const chunks = buffer.split("\n\n");
+						buffer = chunks.pop() ?? "";
+						for (const chunk of chunks) {
+							const lines = chunk.split("\n");
+							const dataLines = [];
+							let eventName;
+							for (const line of lines) if (line.startsWith("data:")) dataLines.push(line.replace(/^data:\s*/, ""));
+							else if (line.startsWith("event:")) eventName = line.replace(/^event:\s*/, "");
+							else if (line.startsWith("id:")) lastEventId = line.replace(/^id:\s*/, "");
+							else if (line.startsWith("retry:")) {
+								const parsed = Number.parseInt(line.replace(/^retry:\s*/, ""), 10);
+								if (!Number.isNaN(parsed)) retryDelay = parsed;
+							}
+							let data;
+							let parsedJson = false;
+							if (dataLines.length) {
+								const rawData = dataLines.join("\n");
+								try {
+									data = JSON.parse(rawData);
+									parsedJson = true;
+								} catch {
+									data = rawData;
+								}
+							}
+							if (parsedJson) {
+								if (responseValidator) await responseValidator(data);
+								if (responseTransformer) data = await responseTransformer(data);
+							}
+							onSseEvent?.({
+								data,
+								event: eventName,
+								id: lastEventId,
+								retry: retryDelay
+							});
+							if (dataLines.length) yield data;
+						}
+					}
+				} finally {
+					signal.removeEventListener("abort", abortHandler);
+					reader.releaseLock();
+				}
+				break;
+			} catch (error) {
+				onSseError?.(error);
+				if (sseMaxRetryAttempts !== void 0 && attempt >= sseMaxRetryAttempts) break;
+				const backoff = Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 3e4);
+				await sleep(backoff);
+			}
+		}
+	};
+	return { stream: createStream() };
+}
+//#endregion
+//#region src/generated/core/pathSerializer.gen.ts
+const separatorArrayExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+const separatorArrayNoExplode = (style) => {
+	switch (style) {
+		case "form": return ",";
+		case "pipeDelimited": return "|";
+		case "spaceDelimited": return "%20";
+		default: return ",";
+	}
+};
+const separatorObjectExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+const serializeArrayParam = ({ allowReserved, explode, name, style, value }) => {
+	if (!explode) {
+		const joinedValues = (allowReserved ? value : value.map((v) => encodeURIComponent(v))).join(separatorArrayNoExplode(style));
+		switch (style) {
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			case "simple": return joinedValues;
+			default: return `${name}=${joinedValues}`;
+		}
+	}
+	const separator = separatorArrayExplode(style);
+	const joinedValues = value.map((v) => {
+		if (style === "label" || style === "simple") return allowReserved ? v : encodeURIComponent(v);
+		return serializePrimitiveParam({
+			allowReserved,
+			name,
+			value: v
+		});
+	}).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+const serializePrimitiveParam = ({ allowReserved, name, value }) => {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "object") throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");
+	return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+};
+const serializeObjectParam = ({ allowReserved, explode, name, style, value, valueOnly }) => {
+	if (value instanceof Date) return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+	if (style !== "deepObject" && !explode) {
+		let values = [];
+		Object.entries(value).forEach(([key, v]) => {
+			values = [
+				...values,
+				key,
+				allowReserved ? v : encodeURIComponent(v)
+			];
+		});
+		const joinedValues = values.join(",");
+		switch (style) {
+			case "form": return `${name}=${joinedValues}`;
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			default: return joinedValues;
+		}
+	}
+	const separator = separatorObjectExplode(style);
+	const joinedValues = Object.entries(value).map(([key, v]) => serializePrimitiveParam({
+		allowReserved,
+		name: style === "deepObject" ? `${name}[${key}]` : key,
+		value: v
+	})).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+//#endregion
+//#region src/generated/core/utils.gen.ts
+const PATH_PARAM_RE = /\{[^{}]+\}/g;
+const defaultPathSerializer = ({ path, url: _url }) => {
+	let url = _url;
+	const matches = _url.match(PATH_PARAM_RE);
+	if (matches) for (const match of matches) {
+		let explode = false;
+		let name = match.substring(1, match.length - 1);
+		let style = "simple";
+		if (name.endsWith("*")) {
+			explode = true;
+			name = name.substring(0, name.length - 1);
+		}
+		if (name.startsWith(".")) {
+			name = name.substring(1);
+			style = "label";
+		} else if (name.startsWith(";")) {
+			name = name.substring(1);
+			style = "matrix";
+		}
+		const value = path[name];
+		if (value === void 0 || value === null) continue;
+		if (Array.isArray(value)) {
+			url = url.replace(match, serializeArrayParam({
+				explode,
+				name,
+				style,
+				value
+			}));
+			continue;
+		}
+		if (typeof value === "object") {
+			url = url.replace(match, serializeObjectParam({
+				explode,
+				name,
+				style,
+				value,
+				valueOnly: true
+			}));
+			continue;
+		}
+		if (style === "matrix") {
+			url = url.replace(match, `;${serializePrimitiveParam({
+				name,
+				value
+			})}`);
+			continue;
+		}
+		const replaceValue = encodeURIComponent(style === "label" ? `.${value}` : value);
+		url = url.replace(match, replaceValue);
+	}
+	return url;
+};
+const getUrl = ({ baseUrl, path, query, querySerializer, url: _url }) => {
+	const pathUrl = _url.startsWith("/") ? _url : `/${_url}`;
+	let url = (baseUrl ?? "") + pathUrl;
+	if (path) url = defaultPathSerializer({
+		path,
+		url
+	});
+	let search = query ? querySerializer(query) : "";
+	if (search.startsWith("?")) search = search.substring(1);
+	if (search) url += `?${search}`;
+	return url;
+};
+function getValidRequestBody(options) {
+	const hasBody = options.body !== void 0;
+	if (hasBody && options.bodySerializer) {
+		if ("serializedBody" in options) return options.serializedBody !== void 0 && options.serializedBody !== "" ? options.serializedBody : null;
+		return options.body !== "" ? options.body : null;
+	}
+	if (hasBody) return options.body;
+}
+//#endregion
+//#region src/generated/core/auth.gen.ts
+const getAuthToken = async (auth, callback) => {
+	const token = typeof callback === "function" ? await callback(auth) : callback;
+	if (!token) return;
+	if (auth.scheme === "bearer") return `Bearer ${token}`;
+	if (auth.scheme === "basic") return `Basic ${btoa(token)}`;
+	return token;
+};
+//#endregion
+//#region src/generated/client/utils.gen.ts
+const createQuerySerializer = ({ parameters = {}, ...args } = {}) => {
+	const querySerializer = (queryParams) => {
+		const search = [];
+		if (queryParams && typeof queryParams === "object") for (const name in queryParams) {
+			const value = queryParams[name];
+			if (value === void 0 || value === null) continue;
+			const options = parameters[name] || args;
+			if (Array.isArray(value)) {
+				const serializedArray = serializeArrayParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "form",
+					value,
+					...options.array
+				});
+				if (serializedArray) search.push(serializedArray);
+			} else if (typeof value === "object") {
+				const serializedObject = serializeObjectParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "deepObject",
+					value,
+					...options.object
+				});
+				if (serializedObject) search.push(serializedObject);
+			} else {
+				const serializedPrimitive = serializePrimitiveParam({
+					allowReserved: options.allowReserved,
+					name,
+					value
+				});
+				if (serializedPrimitive) search.push(serializedPrimitive);
+			}
+		}
+		return search.join("&");
+	};
+	return querySerializer;
+};
+/**
+* Infers parseAs value from provided Content-Type header.
+*/
+const getParseAs = (contentType) => {
+	if (!contentType) return "stream";
+	const cleanContent = contentType.split(";")[0]?.trim();
+	if (!cleanContent) return;
+	if (cleanContent.startsWith("application/json") || cleanContent.endsWith("+json")) return "json";
+	if (cleanContent === "multipart/form-data") return "formData";
+	if ([
+		"application/",
+		"audio/",
+		"image/",
+		"video/"
+	].some((type) => cleanContent.startsWith(type))) return "blob";
+	if (cleanContent.startsWith("text/")) return "text";
+};
+const checkForExistence = (options, name) => {
+	if (!name) return false;
+	if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) return true;
+	return false;
+};
+async function setAuthParams(options) {
+	for (const auth of options.security ?? []) {
+		if (checkForExistence(options, auth.name)) continue;
+		const token = await getAuthToken(auth, options.auth);
+		if (!token) continue;
+		const name = auth.name ?? "Authorization";
+		switch (auth.in) {
+			case "query":
+				if (!options.query) options.query = {};
+				options.query[name] = token;
+				break;
+			case "cookie":
+				options.headers.append("Cookie", `${name}=${token}`);
+				break;
+			default: options.headers.set(name, token);
+		}
+	}
+}
+const buildUrl = (options) => getUrl({
+	baseUrl: options.baseUrl,
+	path: options.path,
+	query: options.query,
+	querySerializer: typeof options.querySerializer === "function" ? options.querySerializer : createQuerySerializer(options.querySerializer),
+	url: options.url
+});
+const mergeConfigs = (a, b) => {
+	const config = {
+		...a,
+		...b
+	};
+	if (config.baseUrl?.endsWith("/")) config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
+	config.headers = mergeHeaders(a.headers, b.headers);
+	return config;
+};
+const headersEntries = (headers) => {
+	const entries = [];
+	headers.forEach((value, key) => {
+		entries.push([key, value]);
+	});
+	return entries;
+};
+const mergeHeaders = (...headers) => {
+	const mergedHeaders = new Headers();
+	for (const header of headers) {
+		if (!header) continue;
+		const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+		for (const [key, value] of iterator) if (value === null) mergedHeaders.delete(key);
+		else if (Array.isArray(value)) for (const v of value) mergedHeaders.append(key, v);
+		else if (value !== void 0) mergedHeaders.set(key, typeof value === "object" ? JSON.stringify(value) : value);
+	}
+	return mergedHeaders;
+};
+var Interceptors = class {
+	fns = [];
+	clear() {
+		this.fns = [];
+	}
+	eject(id) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) this.fns[index] = null;
+	}
+	exists(id) {
+		const index = this.getInterceptorIndex(id);
+		return Boolean(this.fns[index]);
+	}
+	getInterceptorIndex(id) {
+		if (typeof id === "number") return this.fns[id] ? id : -1;
+		return this.fns.indexOf(id);
+	}
+	update(id, fn) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) {
+			this.fns[index] = fn;
+			return id;
+		}
+		return false;
+	}
+	use(fn) {
+		this.fns.push(fn);
+		return this.fns.length - 1;
+	}
+};
+const createInterceptors = () => ({
+	error: new Interceptors(),
+	request: new Interceptors(),
+	response: new Interceptors()
+});
+const defaultQuerySerializer = createQuerySerializer({
+	allowReserved: false,
+	array: {
+		explode: true,
+		style: "form"
+	},
+	object: {
+		explode: true,
+		style: "deepObject"
+	}
+});
+const defaultHeaders = { "Content-Type": "application/json" };
+const createConfig = (override = {}) => ({
+	...jsonBodySerializer,
+	headers: defaultHeaders,
+	parseAs: "auto",
+	querySerializer: defaultQuerySerializer,
+	...override
+});
+//#endregion
+//#region src/generated/client/client.gen.ts
+const createClient = (config = {}) => {
+	let _config = mergeConfigs(createConfig(), config);
+	const getConfig = () => ({ ..._config });
+	const setConfig = (config) => {
+		_config = mergeConfigs(_config, config);
+		return getConfig();
+	};
+	const interceptors = createInterceptors();
+	const beforeRequest = async (options) => {
+		const opts = {
+			..._config,
+			...options,
+			fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
+			headers: mergeHeaders(_config.headers, options.headers),
+			serializedBody: void 0
+		};
+		if (opts.security) await setAuthParams(opts);
+		if (opts.requestValidator) await opts.requestValidator(opts);
+		if (opts.body !== void 0 && opts.bodySerializer) opts.serializedBody = opts.bodySerializer(opts.body);
+		if (opts.body === void 0 || opts.serializedBody === "") opts.headers.delete("Content-Type");
+		const resolvedOpts = opts;
+		return {
+			opts: resolvedOpts,
+			url: buildUrl(resolvedOpts)
+		};
+	};
+	const request = async (options) => {
+		const throwOnError = options.throwOnError ?? _config.throwOnError;
+		const responseStyle = options.responseStyle ?? _config.responseStyle;
+		let request;
+		let response;
+		try {
+			const { opts, url } = await beforeRequest(options);
+			const requestInit = {
+				redirect: "follow",
+				...opts,
+				body: getValidRequestBody(opts)
+			};
+			request = new Request(url, requestInit);
+			for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+			const _fetch = opts.fetch;
+			response = await _fetch(request);
+			for (const fn of interceptors.response.fns) if (fn) response = await fn(response, request, opts);
+			const result = {
+				request,
+				response
+			};
+			if (response.ok) {
+				const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+				if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+					let emptyData;
+					switch (parseAs) {
+						case "arrayBuffer":
+						case "blob":
+						case "text":
+							emptyData = await response[parseAs]();
+							break;
+						case "formData":
+							emptyData = new FormData();
+							break;
+						case "stream":
+							emptyData = response.body;
+							break;
+						default: emptyData = {};
+					}
+					return opts.responseStyle === "data" ? emptyData : {
+						data: emptyData,
+						...result
+					};
+				}
+				let data;
+				switch (parseAs) {
+					case "arrayBuffer":
+					case "blob":
+					case "formData":
+					case "text":
+						data = await response[parseAs]();
+						break;
+					case "json": {
+						const text = await response.text();
+						data = text ? JSON.parse(text) : {};
+						break;
+					}
+					case "stream": return opts.responseStyle === "data" ? response.body : {
+						data: response.body,
+						...result
+					};
+				}
+				if (parseAs === "json") {
+					if (opts.responseValidator) await opts.responseValidator(data);
+					if (opts.responseTransformer) data = await opts.responseTransformer(data);
+				}
+				return opts.responseStyle === "data" ? data : {
+					data,
+					...result
+				};
+			}
+			const textError = await response.text();
+			let jsonError;
+			try {
+				jsonError = JSON.parse(textError);
+			} catch {}
+			throw jsonError ?? textError;
+		} catch (error) {
+			let finalError = error;
+			for (const fn of interceptors.error.fns) if (fn) finalError = await fn(finalError, response, request, options);
+			finalError = finalError || {};
+			if (throwOnError) throw finalError;
+			return responseStyle === "data" ? void 0 : {
+				error: finalError,
+				request,
+				response
+			};
+		}
+	};
+	const makeMethodFn = (method) => (options) => request({
+		...options,
+		method
+	});
+	const makeSseFn = (method) => async (options) => {
+		const { opts, url } = await beforeRequest(options);
+		return createSseClient({
+			...opts,
+			body: opts.body,
+			method,
+			onRequest: async (url, init) => {
+				let request = new Request(url, init);
+				for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+				return request;
+			},
+			serializedBody: getValidRequestBody(opts),
+			url
+		});
+	};
+	const _buildUrl = (options) => buildUrl({
+		..._config,
+		...options
+	});
+	return {
+		buildUrl: _buildUrl,
+		connect: makeMethodFn("CONNECT"),
+		delete: makeMethodFn("DELETE"),
+		get: makeMethodFn("GET"),
+		getConfig,
+		head: makeMethodFn("HEAD"),
+		interceptors,
+		options: makeMethodFn("OPTIONS"),
+		patch: makeMethodFn("PATCH"),
+		post: makeMethodFn("POST"),
+		put: makeMethodFn("PUT"),
+		request,
+		setConfig,
+		sse: {
+			connect: makeSseFn("CONNECT"),
+			delete: makeSseFn("DELETE"),
+			get: makeSseFn("GET"),
+			head: makeSseFn("HEAD"),
+			options: makeSseFn("OPTIONS"),
+			patch: makeSseFn("PATCH"),
+			post: makeSseFn("POST"),
+			put: makeSseFn("PUT"),
+			trace: makeSseFn("TRACE")
+		},
+		trace: makeMethodFn("TRACE")
+	};
+};
+//#endregion
+//#region src/errors.ts
+/**
+* Thrown when the API responds with an error status. Carries the HTTP `status`
+* and the parsed {@link KaitenApiError} body. Narrow with `instanceof KaitenError`
+* or the `kind === "api"` discriminant.
+*/
+var KaitenError = class extends Error {
+	kind = "api";
+	status;
+	detail;
+	/** Stable, machine-readable error code, such as `License.NotFound`. */
+	code;
+	/** Correlation id of the API's log entry for this failure. */
+	errorId;
+	errors;
+	raw;
+	constructor(apiError) {
+		super(apiError.title);
+		this.name = "KaitenError";
+		this.status = apiError.status;
+		this.detail = apiError.detail;
+		this.code = apiError.code;
+		this.errorId = apiError.errorId;
+		this.errors = apiError.errors;
+		this.raw = apiError;
+	}
+};
+/**
+* Thrown when the request never reached the API (offline, DNS, abort) — there
+* is no HTTP status. Narrow with `instanceof KaitenNetworkError` or the
+* `kind === "network"` discriminant.
+*/
+var KaitenNetworkError = class extends Error {
+	kind = "network";
+	cause;
+	constructor(message, cause) {
+		super(message);
+		this.name = "KaitenNetworkError";
+		this.cause = cause;
+	}
+};
+const isRecord = (value) => typeof value === "object" && value !== null;
+/**
+* Converts whatever the generated client rejected with into a real `Error`.
+*
+* The generated transport throws the *parsed response body* (or the raw text
+* when it is not JSON), so without this the value reaching a `catch` has no
+* stack, no `message`, and does not satisfy `instanceof Error`.
+*/
+function toKaitenError(error, response) {
+	if (error instanceof KaitenError || error instanceof KaitenNetworkError) return error;
+	if (!response) {
+		if (error instanceof Error) return new KaitenNetworkError(error.message, error);
+		return new KaitenNetworkError("Request to the Kaiten API failed", error);
+	}
+	if (isRecord(error) && typeof error["title"] === "string") {
+		const body = error;
+		return new KaitenError({
+			...body,
+			status: typeof body.status === "number" ? body.status : response.status
+		});
+	}
+	const detail = typeof error === "string" && error.length > 0 ? error : isRecord(error) && typeof error["detail"] === "string" ? error["detail"] : void 0;
+	return new KaitenError({
+		title: response.statusText || `HTTP ${response.status}`,
+		status: response.status,
+		...detail === void 0 ? {} : { detail }
+	});
+}
+/** The code the API returns when a usage report would cross the entitlement's limit. */
+const THRESHOLD_EXCEEDED = "ReportEntitlementUsageMetric.ThresholdExceeded";
+/**
+* True when the API refused a usage report because the entitlement's threshold
+* is already reached: HTTP 409 with the code
+* `ReportEntitlementUsageMetric.ThresholdExceeded`.
+*
+* `POST /instances/{instanceSlug}/entitlements/{entitlementSlug}/usage` answers
+* that way when the increment would cross the license limit. That response is
+* the enforcement signal the whole metering path exists to produce, so it gets a
+* named predicate. Other operations answer 409 for other conflicts, such as a
+* slug already taken: the code tells them apart, so the predicate is safe in a
+* shared error handler.
+*/
+function isThresholdExceeded(error) {
+	return error instanceof KaitenError && error.status === 409 && error.code === THRESHOLD_EXCEEDED;
+}
+//#endregion
+//#region src/webhooks.ts
+/** Thrown when a webhook cannot be attributed to Kaiten. */
+var KaitenWebhookVerificationError = class extends Error {
+	kind = "webhook-verification";
+	constructor(message) {
+		super(message);
+		this.name = "KaitenWebhookVerificationError";
+	}
+};
+const DEFAULT_TOLERANCE_SECONDS = 300;
+function readHeader(headers, ...names) {
+	for (const name of names) {
+		const value = headers instanceof Headers ? headers.get(name) : headers[name] ?? headers[name.toLowerCase()] ?? headers[name.toUpperCase()];
+		const resolved = Array.isArray(value) ? value[0] : value;
+		if (typeof resolved === "string" && resolved.length > 0) return resolved;
+	}
+}
+function base64ToBytes(value) {
+	const binary = atob(value);
+	const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+	for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+function bytesToBase64(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+}
+/**
+* Compares two strings without leaking where they first differ.
+*
+* Hand-written rather than `node:crypto.timingSafeEqual` for two reasons: that
+* function **throws** on unequal lengths (unlike the `hmac.Equal` the reference
+* implementation uses), so a signature of the wrong length would surface as an
+* unhandled RangeError — a 500 where a 401 belongs; and importing `node:crypto`
+* would make this package Node-only, where today it touches nothing outside the
+* web platform and runs unchanged on Deno, Bun and edge runtimes.
+*/
+function constantTimeEquals(left, right) {
+	if (left.length !== right.length) return false;
+	let diff = 0;
+	for (let i = 0; i < left.length; i += 1) diff |= left.charCodeAt(i) ^ right.charCodeAt(i);
+	return diff === 0;
+}
+/**
+* Verifies a Kaiten webhook and returns its typed payload.
+*
+* Throws {@link KaitenWebhookVerificationError} when the request cannot be
+* attributed to Kaiten — respond `400`/`401` and do not process the body.
+*
+* ```ts
+* app.post("/kaiten", express.raw({ type: "application/json" }), async (req, res) => {
+*   let event;
+*   try {
+*     event = await verifyKaitenWebhook({
+*       payload: req.body,               // the RAW bytes, not a parsed object
+*       headers: req.headers,
+*       secret: process.env.KAITEN_WEBHOOK_SECRET!,
+*     });
+*   } catch {
+*     return res.sendStatus(401);
+*   }
+*
+*   switch (event.type) {
+*     case "com.kaiten.customer.v1.created":
+*       // `event` is narrowed to the customer-created payload here.
+*       break;
+*   }
+*   res.sendStatus(204);
+* });
+* ```
+*/
+async function verifyKaitenWebhook(input) {
+	const { headers, secret, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS } = input;
+	const id = readHeader(headers, "svix-id", "webhook-id");
+	const timestamp = readHeader(headers, "svix-timestamp", "webhook-timestamp");
+	const signatureHeader = readHeader(headers, "svix-signature", "webhook-signature");
+	if (!id || !timestamp || !signatureHeader) throw new KaitenWebhookVerificationError("Kaiten webhook: missing signature headers (svix-id, svix-timestamp, svix-signature).");
+	const sentAt = Number.parseInt(timestamp, 10);
+	if (!Number.isFinite(sentAt)) throw new KaitenWebhookVerificationError("Kaiten webhook: timestamp is not a number.");
+	const nowSeconds = Math.floor((input.now ?? Date.now()) / 1e3);
+	const drift = Math.abs(nowSeconds - sentAt);
+	if (drift > toleranceSeconds) throw new KaitenWebhookVerificationError(`Kaiten webhook: timestamp is ${drift}s away from now, outside the ${toleranceSeconds}s tolerance.`);
+	if (!secret) throw new KaitenWebhookVerificationError("Kaiten webhook: no signing secret supplied.");
+	const rawSecret = secret.startsWith("whsec_") ? secret.slice(6) : secret;
+	const payload = typeof input.payload === "string" ? input.payload : new TextDecoder().decode(input.payload);
+	const key = await crypto.subtle.importKey("raw", base64ToBytes(rawSecret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const digest = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${id}.${timestamp}.${payload}`));
+	const expected = bytesToBase64(new Uint8Array(digest));
+	if (!signatureHeader.split(" ").some((entry) => {
+		const [version, signature] = entry.split(",");
+		if (version !== "v1" || !signature) return false;
+		return constantTimeEquals(signature, expected);
+	})) throw new KaitenWebhookVerificationError("Kaiten webhook: no signature in the request matched the payload.");
+	let parsed;
+	try {
+		parsed = JSON.parse(payload);
+	} catch {
+		throw new KaitenWebhookVerificationError("Kaiten webhook: signature is valid but the body is not JSON.");
+	}
+	if (!parsed || typeof parsed !== "object" || typeof parsed.type !== "string") throw new KaitenWebhookVerificationError("Kaiten webhook: signature is valid but the body carries no `type`.");
+	return parsed;
+}
+/** Narrows a verified event to one `com.kaiten.*` type. */
+function isKaitenWebhookOfType(event, type) {
+	return event.type === type;
+}
+/** True when the value is a verification failure, for a typed `catch`. */
+function isWebhookVerificationError(error) {
+	return error instanceof KaitenWebhookVerificationError;
+}
+//#endregion
+//#region src/generated/client.gen.ts
+const client = createClient(createConfig({ baseUrl: "/api" }));
+//#endregion
+//#region src/generated/sdk.gen.ts
+var Components = class {
+	/**
+	* List components
+	*
+	* Returns a cursor-paginated page of components for the current organization.
+	*/
+	static listComponents(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/components",
+			...options
+		});
+	}
+	/**
+	* Create a new component
+	*
+	* Create a new standalone component. Optionally derive it from a previous component version.
+	*/
+	static createComponent(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/components",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete a component
+	*
+	* Delete a component by slug if it is not linked to any release.
+	*/
+	static deleteComponent(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/components/{componentSlug}",
+			...options
+		});
+	}
+	/**
+	* Get a component by slug
+	*
+	* Returns a single component by its slug.
+	*/
+	static getComponent(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/components/{componentSlug}",
+			...options
+		});
+	}
+	/**
+	* Update a component
+	*
+	* Update a component in place when unlinked, or create a new version when it is already linked to releases.
+	*/
+	static updateComponent(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/components/{componentSlug}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+};
+var Connectors = class {
+	/**
+	* List registered connectors
+	*
+	* Returns every registered connector with its version and settings schema, ordered by name. The registry is platform-wide rather than per-organization and holds one row per connector, so the response is not paginated.
+	*/
+	static listConnectors(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/connectors",
+			...options
+		});
+	}
+	/**
+	* Get connector registration
+	*
+	* Retrieves a registered connector resource including version and settings schema
+	*/
+	static getConnector(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/connectors/{connectorName}",
+			...options
+		});
+	}
+	/**
+	* Deactivate connector
+	*
+	* Deactivates a connector for the authenticated organization. Idempotent, and never refused for an unregistered or unlicensed connector: an organization must always be able to stop using something.
+	*/
+	static deactivateConnector(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/connectors/{connectorName}/activation",
+			...options
+		});
+	}
+	/**
+	* Activate connector
+	*
+	* Activates a registered connector for the authenticated organization. Idempotent: activating an already-active connector succeeds without changing when it was first activated. Refused when the organization's licence does not include the connector.
+	*/
+	static activateConnector(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/connectors/{connectorName}/activation",
+			...options
+		});
+	}
+	/**
+	* Delete connector settings
+	*
+	* Delete connector settings for the authenticated organization
+	*/
+	static deleteConnectorSettings(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/connectors/{connectorName}/settings",
+			...options
+		});
+	}
+	/**
+	* Get connector settings
+	*
+	* Get settings for a connector scoped to the authenticated organization. Write-only fields (flagged `writeOnly` in the connector settings schema) are returned redacted as `***`.
+	*/
+	static getConnectorSettings(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/connectors/{connectorName}/settings",
+			...options
+		});
+	}
+	/**
+	* Upsert connector settings
+	*
+	* Create or update connector settings for the authenticated organization. Write-only fields (flagged `writeOnly` in the connector settings schema) may be omitted or sent as `***` to keep the stored value; they are returned redacted.
+	*/
+	static updateConnectorSettings(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/connectors/{connectorName}/settings",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Get connector settings schema
+	*
+	* Get the JSON schema used to validate connector settings payloads
+	*/
+	static getConnectorSettingsSchema(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/connectors/{connectorName}/settings/schema",
+			...options
+		});
+	}
+	/**
+	* Get connector state for this organization
+	*
+	* Returns whether the connector is registered in this deployment, whether the authenticated organization's licence includes it, and whether the organization has activated it. Answers 200 with `available: false` for a connector this deployment does not have.
+	*/
+	static getConnectorState(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/connectors/{connectorName}/state",
+			...options
+		});
+	}
+};
+var Customers = class {
+	/**
+	* List customers
+	*
+	* Returns a cursor-paginated page of customers for the current organization.
+	*/
+	static listCustomers(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/customers",
+			...options
+		});
+	}
+	/**
+	* Create a new customer
+	*
+	* Create a new customer with the provided details.
+	*/
+	static createCustomer(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/customers",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete a customer
+	*
+	* Delete a customer by their slug.
+	*/
+	static deleteCustomer(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/customers/{customerSlug}",
+			...options
+		});
+	}
+	/**
+	* Get a customer by slug
+	*
+	* Returns a single customer by their slug.
+	*/
+	static getCustomer(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/customers/{customerSlug}",
+			...options
+		});
+	}
+	/**
+	* Update a customer
+	*
+	* Update a customer's details. Slug and integrations are not renameable/settable through this endpoint -- omit them, or send the values already on record.
+	*/
+	static updateCustomer(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/customers/{customerSlug}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete a customer integration
+	*
+	* Delete a single integration for a customer
+	*/
+	static deleteCustomerIntegration(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/customers/{customerSlug}/integrations/{integrationName}",
+			...options
+		});
+	}
+	/**
+	* Get a customer integration
+	*
+	* Retrieve a single integration for a customer
+	*/
+	static getCustomerIntegration(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/customers/{customerSlug}/integrations/{integrationName}",
+			...options
+		});
+	}
+	/**
+	* Create a customer integration
+	*
+	* Create a single integration for a customer
+	*/
+	static createCustomerIntegration(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/customers/{customerSlug}/integrations/{integrationName}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Update a customer integration
+	*
+	* Update a single integration for a customer
+	*/
+	static updateCustomerIntegration(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/customers/{customerSlug}/integrations/{integrationName}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Get a customer by integration external ID
+	*
+	* Resolve a customer through one of its integrations using adapter + external ID.
+	*/
+	static getCustomerIntegrationByExternalId(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/integration/{adapter}/customer/{externalId}",
+			...options
+		});
+	}
+	/**
+	* Upsert a customer by integration external ID
+	*
+	* Create or partially update a customer resolved through adapter + external ID. Missing fields are left unchanged.
+	*/
+	static upsertCustomerIntegrationByExternalId(options) {
+		return (options.client ?? client).patch({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/integration/{adapter}/customer/{externalId}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+};
+var DeploymentZones = class {
+	/**
+	* List deployment zones
+	*
+	* Returns a cursor-paginated page of deployment zones for the current organization. A deployment zone is one place a customer runs a release -- a target they name and classify themselves, holding the release currently on it. It is not an installation of Kaiten; that sense of the term belongs to operations and is not reachable through this API.
+	*/
+	static listDeploymentZones(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/deployment-zones",
+			...options
+		});
+	}
+	/**
+	* Create a new deployment zone
+	*
+	* Create a new deployment zone with the provided details. Supplying releaseId records the zone's first deployment. A deployment zone is one place a customer runs a release -- a target they name and classify themselves, holding the release currently on it. It is not an installation of Kaiten; that sense of the term belongs to operations and is not reachable through this API.
+	*/
+	static createDeploymentZone(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/deployment-zones",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete a deployment zone
+	*
+	* Delete a deployment zone by their slug.
+	*/
+	static deleteDeploymentZone(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/deployment-zones/{deploymentZoneSlug}",
+			...options
+		});
+	}
+	/**
+	* Get a deployment zone by slug
+	*
+	* Returns a single deployment zone by their slug.
+	*/
+	static getDeploymentZoneBySlug(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/deployment-zones/{deploymentZoneSlug}",
+			...options
+		});
+	}
+	/**
+	* Update a deployment zone
+	*
+	* Update a deployment zone's details. Changing releaseId records a deployment: the zone's current release becomes the new one and the change is appended to its deployment history, including when the new release is one the zone already ran (a rollback). Omitting releaseId, or echoing back the current one, leaves the history untouched.
+	*/
+	static updateDeploymentZone(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/deployment-zones/{deploymentZoneSlug}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Get a release by slug
+	*
+	* Returns a single release by their slug.
+	*/
+	static getReleaseBySlug(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/releases/{releaseSlug}",
+			...options
+		});
+	}
+};
+var EntitlementGroups = class {
+	/**
+	* List all entitlement groups
+	*
+	* Returns a cursor-paginated page of entitlement groups for the current organization.
+	*/
+	static listEntitlementGroups(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlement-groups",
+			...options
+		});
+	}
+	/**
+	* Create a new entitlement group
+	*
+	* Create a new entitlement group to aggregate entitlements
+	*/
+	static createEntitlementGroup(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlement-groups",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete an entitlement group
+	*
+	* Delete an entitlement group by its slug. This does not delete the member entitlements.
+	*/
+	static deleteEntitlementGroup(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlement-groups/{entitlementGroupSlug}",
+			...options
+		});
+	}
+	/**
+	* Get entitlement group by slug
+	*
+	* Retrieve details of a specific entitlement group by its slug
+	*/
+	static getEntitlementGroup(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlement-groups/{entitlementGroupSlug}",
+			...options
+		});
+	}
+	/**
+	* Update an entitlement group
+	*
+	* Update an existing entitlement group with the provided details
+	*/
+	static updateEntitlementGroup(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlement-groups/{entitlementGroupSlug}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Add an entitlement to a group
+	*
+	* Add an existing entitlement as a member of an entitlement group
+	*/
+	static addEntitlementToGroup(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlement-groups/{entitlementGroupSlug}/entitlements",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Remove an entitlement from a group
+	*
+	* Remove an entitlement from an entitlement group. The entitlement itself is not deleted.
+	*/
+	static removeEntitlementFromGroup(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlement-groups/{entitlementGroupSlug}/entitlements/{entitlementSlug}",
+			...options
+		});
+	}
+	/**
+	* Get aggregated usage for an entitlement group
+	*
+	* Retrieve the aggregated usage metrics of all member entitlements for a given instance
+	*/
+	static getEntitlementGroupUsage(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlement-groups/{entitlementGroupSlug}/usage",
+			...options
+		});
+	}
+};
+var Entitlements = class {
+	/**
+	* List all entitlements
+	*
+	* Returns a cursor-paginated page of entitlements for the current organization.
+	*/
+	static listEntitlements(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlements",
+			...options
+		});
+	}
+	/**
+	* Create a new entitlement
+	*
+	* Create a new entitlement with the provided details
+	*/
+	static createEntitlement(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlements",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete an entitlement
+	*
+	* Delete an entitlement by its slug
+	*/
+	static deleteEntitlement(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlements/{entitlementSlug}",
+			...options
+		});
+	}
+	/**
+	* Get entitlement by slug
+	*
+	* Retrieve details of a specific entitlement by its slug
+	*/
+	static getEntitlement(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlements/{entitlementSlug}",
+			...options
+		});
+	}
+	/**
+	* Update an entitlement
+	*
+	* Update an existing entitlement with the provided details
+	*/
+	static updateEntitlement(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/entitlements/{entitlementSlug}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+};
+var Featureflags = class {
+	/**
+	* Get a list of feature flags
+	*
+	* Returns a cursor-paginated page of feature flags for the given organization.
+	*/
+	static getFeatureFlags(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/feature-flags",
+			...options
+		});
+	}
+	/**
+	* Create a new featureflag
+	*
+	* Create a new featureflag with the provided details
+	*/
+	static createFeatureFlag(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/feature-flags",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Get the targeting context schema
+	*
+	* Returns the identifiers a targeting rule may read, with their types and descriptions, including the organization's own entitlement slugs. Intended for an editor: it is what autocomplete and hover documentation are built from. The set is not closed — a rule may also target on attributes the caller supplies in its own evaluation context.
+	*/
+	static getTargetingContext(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/feature-flags/targeting/context",
+			...options
+		});
+	}
+	/**
+	* Check a targeting rule
+	*
+	* Runs the same check create and update run before accepting a targeting rule, and reports what it found without writing anything. A rule that references a fact or an entitlement that does not exist does not fail loudly at evaluation — it simply never matches — so this is what lets an editor say so while the rule is being written. A rejected rule is a 200 carrying `valid: false`, not a client error.
+	*/
+	static lintTargetingRule(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/feature-flags/targeting/lint",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Rehearse a targeting rule against a context
+	*
+	* Runs a rule the way an evaluation would, without a flag and without writing anything: the context is enriched from the same sources (license, entitlements, instance, customer, deployment zone), anything the caller forged under __kaiten is discarded the same way, and the same engine answers. The response carries the enriched facts so an author can see exactly what the rule read — which is usually the answer to why it did or did not match. Nothing is metered or audited: this is authoring, not serving.
+	*/
+	static testTargetingRule(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/feature-flags/targeting/test",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete a featureflag
+	*
+	* Delete a featureflag with the provided details
+	*/
+	static deleteFeatureFlag(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/feature-flags/{featureFlagSlug}",
+			...options
+		});
+	}
+	/**
+	* Get a feature flag by slug
+	*
+	* Get a feature flag with the provided slug
+	*/
+	static getFeatureFlag(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/feature-flags/{featureFlagSlug}",
+			...options
+		});
+	}
+	/**
+	* Update a featureflag
+	*
+	* Update a featureflag with the provided details
+	*/
+	static updateFeatureFlag(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/feature-flags/{featureFlagSlug}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+};
+var Instances = class {
+	/**
+	* List all instances
+	*
+	* Returns a cursor-paginated page of instances for the current organization.
+	*/
+	static getInstances(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances",
+			...options
+		});
+	}
+	/**
+	* Create a new instance
+	*
+	* Create a new instance with the provided details
+	*/
+	static createInstance(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete an instance
+	*
+	* Delete an instance with the provided slug
+	*/
+	static deleteInstance(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances/{instanceSlug}",
+			...options
+		});
+	}
+	/**
+	* Get an instance by slug
+	*
+	* Retrieve an instance by their unique slug
+	*/
+	static getInstance(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances/{instanceSlug}",
+			...options
+		});
+	}
+	/**
+	* Patch an instance
+	*
+	* Partially update an instance. Currently supports the operational status and the commercial lifecycle stage.
+	*/
+	static patchInstance(options) {
+		return (options.client ?? client).patch({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances/{instanceSlug}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Update an instance
+	*
+	* Update an instance with the provided details
+	*/
+	static updateInstance(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances/{instanceSlug}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* List audit trail entries for an instance
+	*
+	* Returns audit trail events for a given instance, optionally filtered by event name and time range. Results are cursor-paginated (default limit: 50, max: 200) — pass the previous response's nextCursor as the cursor parameter to fetch the next page.
+	*/
+	static getAuditTrails(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances/{instanceSlug}/audit-trails",
+			...options
+		});
+	}
+	/**
+	* List all entitlements usage metrics
+	*
+	* Retrieve a list of all entitlements usage metrics for a specific instance
+	*/
+	static getEntitlementsUsageMetrics(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances/{instanceSlug}/entitlements/usage",
+			...options
+		});
+	}
+	/**
+	* Get entitlement usage metrics for an instance
+	*
+	* Retrieve the usage metrics for a specific entitlement in a given instance
+	*/
+	static getEntitlementUsageMetrics(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances/{instanceSlug}/entitlements/{entitlementSlug}/usage",
+			...options
+		});
+	}
+	/**
+	* Report entitlement usage metric for an instance
+	*
+	* Report a usage metric for a specific entitlement in a given instance. This endpoint allows you to report the usage of an entitlement, including optional metadata and a timestamp.
+	*/
+	static reportEntitlementUsageMetric(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances/{instanceSlug}/entitlements/{entitlementSlug}/usage",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete an instance integration
+	*
+	* Delete a single integration for an instance
+	*/
+	static deleteInstanceIntegration(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances/{instanceSlug}/integrations/{integrationName}",
+			...options
+		});
+	}
+	/**
+	* Get an instance integration
+	*
+	* Retrieve a single integration for an instance
+	*/
+	static getInstanceIntegration(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances/{instanceSlug}/integrations/{integrationName}",
+			...options
+		});
+	}
+	/**
+	* Create an instance integration
+	*
+	* Create a single integration for an instance
+	*/
+	static createInstanceIntegration(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances/{instanceSlug}/integrations/{integrationName}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Update an instance integration
+	*
+	* Update a single integration for an instance
+	*/
+	static updateInstanceIntegration(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/instances/{instanceSlug}/integrations/{integrationName}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Get an instance by integration external ID
+	*
+	* Resolve an instance through one of its integrations using adapter + external ID.
+	*/
+	static getInstanceIntegrationByExternalId(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/integration/{adapter}/instance/{externalId}",
+			...options
+		});
+	}
+	/**
+	* Upsert an instance by integration external ID
+	*
+	* Create or partially update an instance resolved through adapter + external ID. Missing fields are left unchanged.
+	*/
+	static upsertInstanceIntegrationByExternalId(options) {
+		return (options.client ?? client).patch({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/integration/{adapter}/instance/{externalId}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+};
+var Integrations = class {
+	/**
+	* Get a customer by integration external ID
+	*
+	* Resolve a customer through one of its integrations using adapter + external ID.
+	*/
+	static getCustomerIntegrationByExternalId(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/integration/{adapter}/customer/{externalId}",
+			...options
+		});
+	}
+	/**
+	* Upsert a customer by integration external ID
+	*
+	* Create or partially update a customer resolved through adapter + external ID. Missing fields are left unchanged.
+	*/
+	static upsertCustomerIntegrationByExternalId(options) {
+		return (options.client ?? client).patch({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/integration/{adapter}/customer/{externalId}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Get an instance by integration external ID
+	*
+	* Resolve an instance through one of its integrations using adapter + external ID.
+	*/
+	static getInstanceIntegrationByExternalId(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/integration/{adapter}/instance/{externalId}",
+			...options
+		});
+	}
+	/**
+	* Upsert an instance by integration external ID
+	*
+	* Create or partially update an instance resolved through adapter + external ID. Missing fields are left unchanged.
+	*/
+	static upsertInstanceIntegrationByExternalId(options) {
+		return (options.client ?? client).patch({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/integration/{adapter}/instance/{externalId}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+};
+var LicenseFamilies = class {
+	/**
+	* List license families
+	*
+	* Returns a cursor-paginated page of license families for the current organization, each with the version it currently resolves to: the family's default version, or its highest-numbered published version. A family whose versions are all drafts or all archived is still listed, with no current version.
+	*/
+	static listLicenseFamilies(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/license-families",
+			...options
+		});
+	}
+	/**
+	* Get a license family by slug
+	*
+	* Resolves a license family to the version it currently serves, returned as currentVersion: the family's default version if it has one, otherwise its highest-numbered PUBLISHED version. This is the stable address for "the current version of this product", so a caller never has to name a version slug.
+	*
+	* A family with a default keeps serving it when a newer version is published -- the default is what the vendor puts forward, and superseding it is an explicit act (make another version the default, or unset it). A family without a default follows publication: the newest PUBLISHED version wins.
+	*
+	* Returns 404 GetLicenseFamily.NoPublishedVersion when the family exists but has no PUBLISHED version, since there is nothing to resolve to. Use ?include=versions to read such a family anyway: with the history requested, the family is returned with its versions and no currentVersion. Use ?version=N for explicit access to one version, including draft and archived ones.
+	*/
+	static getLicenseFamily(options) {
+		return (options.client ?? client).get({
+			querySerializer: { parameters: { include: { array: { explode: false } } } },
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/license-families/{familySlug}",
+			...options
+		});
+	}
+};
+var Licenses = class {
+	/**
+	* GetUser all licenses
+	*
+	* Returns a cursor-paginated page of licenses for the current organization.
+	*/
+	static getLicenses(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses",
+			...options
+		});
+	}
+	/**
+	* Create a new license
+	*
+	* Create a new license with the provided details. Without familySlug or familyId this creates a new license family and the license becomes its version 1. With one of them it adds the next version to that family (familySlug names it by slug, familyId by identifier; sent together they must agree), and the version number is assigned by the server as the next one in the family's sequence. The version starts PUBLISHED, or DRAFT when lifecycleState says so; ARCHIVED is refused (422 CreateLicense.LifecycleStateNotSettable), because a version is archived with archive-license once it has been on sale.
+	*
+	* Where the deployment limits how many licenses an organization may have, only a new family counts against that limit (409 CreateLicense.EntitlementLimitReached once it is reached): a new version of an existing family never does.
+	*/
+	static createLicense(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete a license
+	*
+	* Delete a license with the provided details. Deleting the last version of a license family also deletes the family, and frees its slug for a new product to take. A deleted version's number is not reused by the next version of its family.
+	*/
+	static deleteLicense(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses/{licenseSlug}",
+			...options
+		});
+	}
+	/**
+	* Get a license by slug
+	*
+	* Retrieve a license by their unique slug
+	*/
+	static getLicense(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses/{licenseSlug}",
+			...options
+		});
+	}
+	/**
+	* Update a license
+	*
+	* Update a license with the provided details
+	*/
+	static updateLicense(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses/{licenseSlug}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Archive a license version
+	*
+	* Withdraws a PUBLISHED license version from sale: its family stops resolving to it and no instance can be assigned to it any more, while instances already on it keep it. Only a published version can be archived (409 ArchiveLicense.NotPublished) -- a draft that was never on sale is deleted instead -- and not while it is its family's default (409 ArchiveLicense.DefaultMustBePublished): make another version the default, or unset it, first. Emits LICENSE_ARCHIVED.
+	*/
+	static archiveLicense(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses/{licenseSlug}/archive",
+			...options
+		});
+	}
+	/**
+	* Get all entitlements for a license
+	*
+	* Returns a cursor-paginated page of entitlements granted by a license, identified by its unique slug.
+	*/
+	static getLicenseEntitlements(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses/{licenseSlug}/entitlements",
+			...options
+		});
+	}
+	/**
+	* Associate an entitlement with a license
+	*
+	* Associate an entitlement with a license by providing the license slug and entitlement details
+	*/
+	static associateEntitlementWithLicense(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses/{licenseSlug}/entitlements",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete a license entitlement
+	*
+	* Delete a license entitlement with the provided details
+	*/
+	static deleteLicenseEntitlement(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses/{licenseSlug}/entitlements/{entitlementSlug}",
+			...options
+		});
+	}
+	/**
+	* Get a license entitlement
+	*
+	* Retrieve a entitlement for a license by their unique slugs
+	*/
+	static getLicenseEntitlement(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses/{licenseSlug}/entitlements/{entitlementSlug}",
+			...options
+		});
+	}
+	/**
+	* Update an license entitlement
+	*
+	* Update an license entitlement with the provided details
+	*/
+	static updateLicenseEntitlement(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses/{licenseSlug}/entitlements/{entitlementSlug}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Publish a license version
+	*
+	* Puts a DRAFT license version on sale: it becomes PUBLISHED, so it can be made its family's default, and its family resolves to it when the family has no default and this is its highest published version. Only a draft can be published (409 PublishLicense.NotADraft); an archived version goes back on sale with unarchive-license. Emits LICENSE_PUBLISHED.
+	*/
+	static publishLicense(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses/{licenseSlug}/publish",
+			...options
+		});
+	}
+	/**
+	* Unarchive a license version
+	*
+	* Puts an ARCHIVED license version back on sale: it is PUBLISHED again, can be assigned to instances, and can be what its family resolves to. Only an archived version can be unarchived (409 UnarchiveLicense.NotArchived). Emits LICENSE_UNARCHIVED.
+	*/
+	static unarchiveLicense(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/licenses/{licenseSlug}/unarchive",
+			...options
+		});
+	}
+};
+var MetadataFields = class {
+	/**
+	* List active metadata fields for a resource type
+	*
+	* Returns a cursor-paginated page of the active (non-archived) metadata fields declared for the org and the given resource type, ordered by displayOrder then createdAt.
+	*/
+	static listMetadataFields(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/metadata-fields",
+			...options
+		});
+	}
+	/**
+	* Create a metadata field
+	*
+	* Declares a typed metadata field for a given resource type (DEPLOYMENT_ZONE, INSTANCE). The json_schema is validated against JSON Schema 2020-12 before insertion. Restricted to write:metadata_fields scope (admin-only policy).
+	*/
+	static createMetadataField(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/metadata-fields",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Reorder metadata fields
+	*
+	* Sets the displayOrder of the listed fields to their position in the array (0-indexed). All ids must belong to the same organization, resource type, and be non-archived; the entire reorder is applied in a single transaction.
+	*/
+	static reorderMetadataFields(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/metadata-fields/reorder",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Update a metadata field
+	*
+	* Updates label and json_schema. `key` and `resourceType` are immutable, and `displayOrder` belongs to POST /metadata-fields/reorder. The new json_schema is validated against JSON Schema 2020-12 and the transition rules: type changes, cardinality changes, and free-string ↔ enum toggles are rejected with 422.
+	*/
+	static updateMetadataField(options) {
+		return (options.client ?? client).patch({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/metadata-fields/{id}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Archive a metadata field
+	*
+	* Soft-deletes a metadata field. The row stays in the DB (its archived_at is set) so historic metadata is still interpretable; the field stops appearing in the active schema composition.
+	*/
+	static archiveMetadataField(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/metadata-fields/{id}/archive",
+			...options
+		});
+	}
+	/**
+	* Preview the impact of a metadata field schema change
+	*
+	* Computes, server-side, how many existing resources of this field's resource type carry a value under this field's key that would NOT satisfy the supplied candidate JSON Schema, plus a small sample. Read-only — does not mutate the field. Replaces the former client-side dry-run that pulled every resource's metadata.
+	*/
+	static dryRunMetadataField(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/metadata-fields/{id}/dry-run",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Unarchive a metadata field
+	*
+	* Restores a previously archived metadata field (clears its archived_at). The field re-enters the active schema composition. Returns 409 if an active field already uses the same key for this resource type, or 404 if the field does not exist or is not archived.
+	*/
+	static unarchiveMetadataField(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/metadata-fields/{id}/unarchive",
+			...options
+		});
+	}
+};
+var OfrepCore = class {
+	/**
+	* OFREP bulk flag evaluation contract
+	*
+	* OFREP bulk evaluation request.
+	* The endpoint is called by the client providers to evaluate all flags at once.
+	*/
+	static evaluateFlagsBulk(options) {
+		return (options?.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/ofrep/v1/evaluate/flags",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options?.headers
+			}
+		});
+	}
+	/**
+	* OFREP single flag evaluation contract
+	*
+	* EvaluateVariant a single feature flag for a given key
+	*/
+	static evaluateFlag(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/ofrep/v1/evaluate/flags/{key}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+};
+var OpenFeature = class {
+	/**
+	* Get OpenFeature manifest
+	*
+	* Returns a manifest of all feature flags that have a fallback_value set in their metadata
+	*/
+	static getOpenfeatureManifest(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/openfeature/v0/manifest",
+			...options
+		});
+	}
+};
+var Releases = class {
+	/**
+	* List releases
+	*
+	* Returns a cursor-paginated page of releases for the current organization.
+	*/
+	static listReleases(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/releases",
+			...options
+		});
+	}
+	/**
+	* Create a new release
+	*
+	* Create a new release with the provided details and link the requested components. A release is immutable: there is no update endpoint, and the component list cannot change afterwards. Correcting one means deleting it and creating a new one, which starts a new deployment history.
+	*/
+	static createRelease(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/releases",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Delete a release
+	*
+	* Delete a release by their slug. Since a release is immutable, this plus a fresh create is the only way to change one -- and it discards the deployment history recorded against the old release. A release still deployed to a zone cannot be deleted (409).
+	*/
+	static deleteRelease(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/releases/{releaseSlug}",
+			...options
+		});
+	}
+};
+var ServiceAccounts = class {
+	/**
+	* List all service accounts
+	*
+	* Returns a cursor-paginated page of service accounts (machine users) for the current organization.
+	*/
+	static getServiceAccounts(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/service-accounts",
+			...options
+		});
+	}
+	/**
+	* Create a new service account
+	*
+	* Create a new service account (machine user) with the provided name. Service accounts can be used to generate API tokens for programmatic access.
+	*/
+	static createServiceAccount(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/service-accounts",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Get a service account by slug
+	*
+	* Retrieve details of a specific service account (machine user) by its slug.
+	*/
+	static getServiceAccount(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/service-accounts/{serviceAccountSlug}",
+			...options
+		});
+	}
+	/**
+	* Update a service account
+	*
+	* Update the name of a service account (machine user) by its slug.
+	*/
+	static updateServiceAccount(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/service-accounts/{serviceAccountSlug}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* List all tokens for a service account
+	*
+	* Returns a cursor-paginated page of API tokens associated with a service account. The organization context is derived from the authenticated user's JWT token. Token secret values are never returned, only metadata.
+	*/
+	static getServiceAccountTokens(options) {
+		return (options.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/service-accounts/{serviceAccountSlug}/tokens",
+			...options
+		});
+	}
+	/**
+	* Create a new token for a service account
+	*
+	* Create a new API token for a service account. The token value is only returned once upon creation and cannot be retrieved again. The organization context is derived from the authenticated user's JWT token.
+	*/
+	static createServiceAccountToken(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/service-accounts/{serviceAccountSlug}/tokens",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Revoke a token for a service account
+	*
+	* Revoke an API token for a service account. Once revoked, the token can no longer be used for authentication. The organization context is derived from the authenticated user's JWT token.
+	*/
+	static deleteServiceAccountToken(options) {
+		return (options.client ?? client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/service-accounts/{serviceAccountSlug}/tokens/{tokenSlug}",
+			...options
+		});
+	}
+};
+var Notifications = class {
+	/**
+	* Read the caller's notification preferences
+	*
+	* Every notifiable event, with this user's effective value per channel: their own choice where they made one, the catalogue default otherwise. Events absent from the catalogue of a deployment never appear, which is what keeps high-volume system events out of the feed.
+	*/
+	static getNotificationPreferences(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/v1/notification-preferences",
+			...options
+		});
+	}
+	/**
+	* Set the caller's notification preferences
+	*
+	* Stores the signed-in user's choices and answers with the whole matrix. A value that equals the catalogue default is stored as no row at all, so a later change to that default still reaches this user.
+	*/
+	static putNotificationPreferences(options) {
+		return (options.client ?? client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/v1/notification-preferences",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* List the caller's notifications
+	*
+	* Returns the signed-in user's notification feed, newest first, with the unread count. Notifications are a view over this organization's audit trail, narrowed to the events the user subscribes to; the id of a notification is the id of the audit trail entry it reports.
+	*/
+	static listNotifications(options) {
+		return (options?.client ?? client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/v1/notifications",
+			...options
+		});
+	}
+	/**
+	* Mark notifications read
+	*
+	* Marks the given notifications read for the signed-in user, or all of them with all: true. Ids belonging to another organization are ignored rather than rejected, so a retry of a partially applied call is safe.
+	*/
+	static markNotificationsRead(options) {
+		return (options.client ?? client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/v1/notifications/mark-read",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+};
+//#endregion
+//#region src/index.ts
+/**
+* Puts a base URL in the shape the contract is served under.
+*
+* The OpenAPI document mounts every operation below `/api` (`servers: - url:
+* /api`), and the operation paths are emitted bare (`/customers`), so a base URL
+* without that prefix 404s on every call. This follows the convention the
+* platform's own usage reporter already uses: require an absolute URL, drop a
+* trailing slash, append `/api` when it is not already there.
+*
+* Appending rather than rejecting accepts a bare origin as it is, and leaves a
+* gateway that already terminates on `/api` untouched.
+*/
+function normalizeBaseUrl(raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw.trim());
+	} catch {
+		throw new TypeError(`Kaiten baseUrl must be an absolute URL (received ${JSON.stringify(raw)}).`);
+	}
+	if (!parsed.protocol || !parsed.host) throw new TypeError(`Kaiten baseUrl must be an absolute URL (received ${JSON.stringify(raw)}).`);
+	const path = parsed.pathname.replace(/\/+$/, "");
+	parsed.pathname = path.endsWith("/api") ? path : `${path}/api`;
+	return `${parsed.origin}${parsed.pathname}`;
+}
+/**
+* Create a Bearer-authenticated client to pass to the generated resource
+* classes via their `{ client }` option. Each call to the factory yields an
+* independent client, so a single process can talk to the API with several
+* tokens.
+*
+* Failed calls **throw**. The generated resource methods are typed
+* `ThrowOnError extends boolean = false`, which would otherwise resolve
+* `{ data: undefined, error }` on every failure — so a caller reading `data`
+* sees a successful-looking `undefined`, and the 409 that
+* `Instances.reportEntitlementUsageMetric` answers with when an entitlement
+* threshold is reached reads as success. Errors are normalized to
+* {@link KaitenError} / {@link KaitenNetworkError}; use {@link isThresholdExceeded}
+* to detect the threshold case.
+*/
+function createKaitenClient(config) {
+	if (typeof config.baseUrl !== "string" || config.baseUrl.trim() === "") throw new TypeError("Kaiten baseUrl is required: the URL of your Kaiten API.");
+	const client = createClient(createConfig({
+		baseUrl: normalizeBaseUrl(config.baseUrl),
+		throwOnError: true,
+		...config.fetch ? { fetch: config.fetch } : {}
+	}));
+	client.interceptors.request.use(async (request) => {
+		const token = typeof config.token === "function" ? await config.token() : config.token;
+		const headers = new Headers(request.headers);
+		headers.set("Authorization", `Bearer ${token}`);
+		return new Request(request, { headers });
+	});
+	client.interceptors.error.use((error, response) => toKaitenError(error, response));
+	return client;
+}
+//#endregion
+export { Components, Connectors, Customers, DeploymentZones, EntitlementGroups, Entitlements, Featureflags, Instances, Integrations, KaitenError, KaitenNetworkError, KaitenWebhookVerificationError, LicenseFamilies, Licenses, MetadataFields, Notifications, OfrepCore, OpenFeature, Releases, ServiceAccounts, createKaitenClient, isKaitenWebhookOfType, isThresholdExceeded, isWebhookVerificationError, toKaitenError, verifyKaitenWebhook };