@kortexya/reasoninglayer 0.23.1 → 1.0.0

package/dist/index.d.cts

@@ -109,21 +109,53 @@ type JsonValue$1 = string | number | boolean | null | JsonValue$1[] | object;
  * This is the single source of truth for the version constant.
  * The `scripts/release.sh` script updates this value alongside `package.json`.
  */
-declare const SDK_VERSION = "0.23.1";
+declare const SDK_VERSION = "1.0.0";
+/**
+ * Authentication mode for the SDK.
+ *
+ * Two modes are supported:
+ *
+ * - `bearer` — send `Authorization: Bearer <token>` on every request. Use this
+ *   for server-to-server SDK usage where you hold a long-lived API token (e.g.
+ *   a service-account token issued by the auth gateway).
+ * - `cookie` — rely on the browser's session cookie set by the auth gateway
+ *   after an interactive login. The SDK will issue requests with
+ *   `credentials: 'include'` so the cookie is attached. Use this for
+ *   in-browser SPAs.
+ *
+ * The choice is **required and explicit** — there is no implicit "no auth"
+ * fallback. This prevents silently shipping unauthenticated requests that the
+ * gateway will reject at runtime.
+ */
+type AuthConfig = {
+    readonly mode: 'bearer';
+    readonly token: string;
+} | {
+    readonly mode: 'cookie';
+};
 /**
  * Configuration for the Reasoning Layer client.
  *
  * @remarks
- * Required fields: `baseUrl` and `tenantId`. All other fields have sensible defaults.
- * No environment variable auto-detection — configuration is always explicit.
+ * Required fields: `baseUrl`, `tenantId`, and `auth`. All other fields have
+ * sensible defaults. No environment variable auto-detection — configuration
+ * is always explicit.
  *
- * @example
+ * @example Bearer token (server-side)
  * ```typescript
  * const config: ClientConfig = {
  *   baseUrl: 'http://localhost:8083',
  *   tenantId: '550e8400-e29b-41d4-a716-446655440000',
- *   timeoutMs: 15000,
- *   maxRetries: 2,
+ *   auth: { mode: 'bearer', token: process.env.RL_API_TOKEN! },
+ * };
+ * ```
+ *
+ * @example Session cookie (browser)
+ * ```typescript
+ * const config: ClientConfig = {
+ *   baseUrl: 'https://platform.example.com',
+ *   tenantId: '550e8400-e29b-41d4-a716-446655440000',
+ *   auth: { mode: 'cookie' },
  * };
  * ```
  */
@@ -132,17 +164,17 @@ interface ClientConfig {
     baseUrl: string;
     /** Tenant UUID. Set once, NOT overridable per-call. */
     tenantId: string;
+    /**
+     * Authentication mode. Required — pick one of {@link AuthConfig}.
+     * There is no unauthenticated mode.
+     */
+    auth: AuthConfig;
     /** Default user UUID for `X-User-Id` header. Overridable per-call via `RequestOptions`. */
     userId?: string;
     /** Default namespace UUID for `X-Namespace-Id` header. Overridable per-call via `RequestOptions`. */
     namespaceId?: string;
     /** Authenticated user identifier for `X-Authenticated-User` header. */
     authenticatedUser?: string;
-    /**
-     * Bearer token for `Authorization: Bearer <token>` header.
-     * Optional — omit when using cookie-based authentication.
-     */
-    bearerToken?: string;
     /** Default request timeout in milliseconds. Overridable per-call. Default: 30000. */
     timeoutMs?: number;
     /** Maximum number of retry attempts. Default: 3. */
@@ -175,8 +207,8 @@ interface ResolvedConfig {
     namespaceId: string | undefined;
     /** Authenticated user identifier, or undefined if not set. */
     authenticatedUser: string | undefined;
-    /** Bearer token, or undefined if using cookie-based auth. */
-    bearerToken: string | undefined;
+    /** Resolved authentication mode. */
+    auth: AuthConfig;
     /** Request timeout in milliseconds. */
     timeoutMs: number;
     /** Maximum number of retry attempts. */
@@ -38045,8 +38077,13 @@ interface ComponentHealthDto {
 }
 /** Enriched health response with component statuses and build info. */
 interface EnrichedHealthResponse {
-    /** Build information for the running server. */
-    buildInfo: BuildInfoDto;
+    /**
+     * Build information for the running server.
+     *
+     * Optional: some deployments (typically the gateway-fronted production
+     * health endpoint) omit build info and return `null` here.
+     */
+    buildInfo?: BuildInfoDto;
     /** Health status of individual components. */
     components: ComponentHealthDto[];
     /** Overall health status. */
@@ -42646,4 +42683,4 @@ declare function toUntaggedFeatures(features: PlainFeatureMap): Record<string, F
  */
 declare function toTermInputDto(input: PsiTermInput | TermInputDto): TermInputDto;
 
-export { ANY_ROLE, actionReviews as ActionReviews, type AddFactRequest, type AddFactResponse, type AddRuleRequest, type AddRuleResponse, admin as Admin, type AiGroup, analysis as Analysis, type AnalysisGroup, ApiError, type ApiResponse, AuthenticationError, type BackwardChainRequest, type BackwardChainResponse, BadRequestError, type BulkAddTermsRequest, type BulkAddTermsResponse, type BulkCreateSortsRequest, type BulkCreateSortsResponse, cdl as CDL, causal as Causal, type ClearTermsResponse, type ClientConfig, cognitive as Cognitive, collections as Collections, communities as Communities, type ConstrainedPlainVar, ConstraintViolationError, constraints as Constraints, control as Control, conversation as Conversation, type ConversationMessageRequest, type ConversationMessageResponse, type ConversationSummaryDto, type ConversationTurnsResponse, type CoreGroup, type CreateResearchSessionRequest, type CreateResearchSessionResponse, type CreateSortRequest, type CreateTermRequest, type DataGroup, discovery as Discovery, type ErrorResponse$1 as ErrorResponse, execution as Execution, extract as Extract, type FeatureInputValueDto, type FeatureValueDto, ForbiddenError, type ForwardChainRequest, type ForwardChainResponse, functions as Functions, fuzzy as Fuzzy, FuzzyShape, type FuzzyShapeDto, generation as Generation, type GlbRequest, type GlbResponse, health as Health, homoiconic as Homoiconic, ilp as ILP, imageExtraction as ImageExtraction, inference as Inference, type IngestPaperRequest, type IngestPaperResponse, ingestion as Ingestion, IngestionFailedError, IngestionSession, type IngestionSyncOptions, type Interceptor, InternalServerError, type JsonValue$1 as JsonValue, LP, type ListConversationsResponse, type LubRequest, type LubResponse, namespaces as Namespaces, NetworkError, neuroSymbolic as NeuroSymbolic, NotFoundError, ontology as Ontology, optimize as Optimize, type OsfSearchRequest, type OsfSearchResponse, osfql as Osfql, type OsfqlRequest, type OsfqlResponse, type OsfqlValue, oversight as Oversight, type PaginationParams, type PaperMetadataDto, type PaperSource, type PlainFeatureMap, type PlainFeatureValue, plainValues as PlainValues, preferences as Preferences, proofEngine as ProofEngine, type PsiTermDto, type PsiTermInput, query as Query, rag as RAG, RateLimitError, type RateLimitInfo, reasoning as Reasoning, type ReasoningGroup, ReasoningLayerClient, ReasoningLayerError, type RequestOptions, research as Research, type ResearchContradictionsResponse, type ResearchCycleResponse, type ResearchFindingsResponse, type ResearchGapsResponse, type ResearchReportResponse, type ResearchSessionResponse, reviews as Reviews, row as Row, SDK_VERSION, scenarios as Scenarios, scheduling as Scheduling, type SearchPapersRequest, type SearchPapersResponse, SortBuilder, type SortDto, type SortInfoDto, sorts as Sorts, sources as Sources, spaces as Spaces, statistical as Statistical, synthetic as Synthetic, type SystemGroup, type TermDto, type TermInputArg, type TermInputDto, type TermListResponse, type TermPatternDto, type TermResponse, terms as Terms, TimeoutError, type TurnDto, type UpdateTermRequest, utilities as Utilities, ValidationError, Value, type ValueDto, values as Values, type VerifyClaimRequest, type VerifyClaimResponse, visualization as Visualization, WebSocketClient, WebSocketConnection, webhookActions as WebhookActions, type WorkflowGroup, allen, constrained, discriminateFeatureValue, guard, isConstrainedPlainVar, isPsiTermInput, isTaggedValueDto, isUuid, psi, toTaggedFeatures, toTaggedValue, toTermInputDto, toUntaggedFeatures, toUntaggedValue };
+export { ANY_ROLE, actionReviews as ActionReviews, type AddFactRequest, type AddFactResponse, type AddRuleRequest, type AddRuleResponse, admin as Admin, type AiGroup, analysis as Analysis, type AnalysisGroup, ApiError, type ApiResponse, type AuthConfig, AuthenticationError, type BackwardChainRequest, type BackwardChainResponse, BadRequestError, type BulkAddTermsRequest, type BulkAddTermsResponse, type BulkCreateSortsRequest, type BulkCreateSortsResponse, cdl as CDL, causal as Causal, type ClearTermsResponse, type ClientConfig, cognitive as Cognitive, collections as Collections, communities as Communities, type ConstrainedPlainVar, ConstraintViolationError, constraints as Constraints, control as Control, conversation as Conversation, type ConversationMessageRequest, type ConversationMessageResponse, type ConversationSummaryDto, type ConversationTurnsResponse, type CoreGroup, type CreateResearchSessionRequest, type CreateResearchSessionResponse, type CreateSortRequest, type CreateTermRequest, type DataGroup, discovery as Discovery, type ErrorResponse$1 as ErrorResponse, execution as Execution, extract as Extract, type FeatureInputValueDto, type FeatureValueDto, ForbiddenError, type ForwardChainRequest, type ForwardChainResponse, functions as Functions, fuzzy as Fuzzy, FuzzyShape, type FuzzyShapeDto, generation as Generation, type GlbRequest, type GlbResponse, health as Health, homoiconic as Homoiconic, ilp as ILP, imageExtraction as ImageExtraction, inference as Inference, type IngestPaperRequest, type IngestPaperResponse, ingestion as Ingestion, IngestionFailedError, IngestionSession, type IngestionSyncOptions, type Interceptor, InternalServerError, type JsonValue$1 as JsonValue, LP, type ListConversationsResponse, type LubRequest, type LubResponse, namespaces as Namespaces, NetworkError, neuroSymbolic as NeuroSymbolic, NotFoundError, ontology as Ontology, optimize as Optimize, type OsfSearchRequest, type OsfSearchResponse, osfql as Osfql, type OsfqlRequest, type OsfqlResponse, type OsfqlValue, oversight as Oversight, type PaginationParams, type PaperMetadataDto, type PaperSource, type PlainFeatureMap, type PlainFeatureValue, plainValues as PlainValues, preferences as Preferences, proofEngine as ProofEngine, type PsiTermDto, type PsiTermInput, query as Query, rag as RAG, RateLimitError, type RateLimitInfo, reasoning as Reasoning, type ReasoningGroup, ReasoningLayerClient, ReasoningLayerError, type RequestOptions, research as Research, type ResearchContradictionsResponse, type ResearchCycleResponse, type ResearchFindingsResponse, type ResearchGapsResponse, type ResearchReportResponse, type ResearchSessionResponse, reviews as Reviews, row as Row, SDK_VERSION, scenarios as Scenarios, scheduling as Scheduling, type SearchPapersRequest, type SearchPapersResponse, SortBuilder, type SortDto, type SortInfoDto, sorts as Sorts, sources as Sources, spaces as Spaces, statistical as Statistical, synthetic as Synthetic, type SystemGroup, type TermDto, type TermInputArg, type TermInputDto, type TermListResponse, type TermPatternDto, type TermResponse, terms as Terms, TimeoutError, type TurnDto, type UpdateTermRequest, utilities as Utilities, ValidationError, Value, type ValueDto, values as Values, type VerifyClaimRequest, type VerifyClaimResponse, visualization as Visualization, WebSocketClient, WebSocketConnection, webhookActions as WebhookActions, type WorkflowGroup, allen, constrained, discriminateFeatureValue, guard, isConstrainedPlainVar, isPsiTermInput, isTaggedValueDto, isUuid, psi, toTaggedFeatures, toTaggedValue, toTermInputDto, toUntaggedFeatures, toUntaggedValue };

package/dist/index.d.ts

@@ -109,21 +109,53 @@ type JsonValue$1 = string | number | boolean | null | JsonValue$1[] | object;
  * This is the single source of truth for the version constant.
  * The `scripts/release.sh` script updates this value alongside `package.json`.
  */
-declare const SDK_VERSION = "0.23.1";
+declare const SDK_VERSION = "1.0.0";
+/**
+ * Authentication mode for the SDK.
+ *
+ * Two modes are supported:
+ *
+ * - `bearer` — send `Authorization: Bearer <token>` on every request. Use this
+ *   for server-to-server SDK usage where you hold a long-lived API token (e.g.
+ *   a service-account token issued by the auth gateway).
+ * - `cookie` — rely on the browser's session cookie set by the auth gateway
+ *   after an interactive login. The SDK will issue requests with
+ *   `credentials: 'include'` so the cookie is attached. Use this for
+ *   in-browser SPAs.
+ *
+ * The choice is **required and explicit** — there is no implicit "no auth"
+ * fallback. This prevents silently shipping unauthenticated requests that the
+ * gateway will reject at runtime.
+ */
+type AuthConfig = {
+    readonly mode: 'bearer';
+    readonly token: string;
+} | {
+    readonly mode: 'cookie';
+};
 /**
  * Configuration for the Reasoning Layer client.
  *
  * @remarks
- * Required fields: `baseUrl` and `tenantId`. All other fields have sensible defaults.
- * No environment variable auto-detection — configuration is always explicit.
+ * Required fields: `baseUrl`, `tenantId`, and `auth`. All other fields have
+ * sensible defaults. No environment variable auto-detection — configuration
+ * is always explicit.
  *
- * @example
+ * @example Bearer token (server-side)
  * ```typescript
  * const config: ClientConfig = {
  *   baseUrl: 'http://localhost:8083',
  *   tenantId: '550e8400-e29b-41d4-a716-446655440000',
- *   timeoutMs: 15000,
- *   maxRetries: 2,
+ *   auth: { mode: 'bearer', token: process.env.RL_API_TOKEN! },
+ * };
+ * ```
+ *
+ * @example Session cookie (browser)
+ * ```typescript
+ * const config: ClientConfig = {
+ *   baseUrl: 'https://platform.example.com',
+ *   tenantId: '550e8400-e29b-41d4-a716-446655440000',
+ *   auth: { mode: 'cookie' },
  * };
  * ```
  */
@@ -132,17 +164,17 @@ interface ClientConfig {
     baseUrl: string;
     /** Tenant UUID. Set once, NOT overridable per-call. */
     tenantId: string;
+    /**
+     * Authentication mode. Required — pick one of {@link AuthConfig}.
+     * There is no unauthenticated mode.
+     */
+    auth: AuthConfig;
     /** Default user UUID for `X-User-Id` header. Overridable per-call via `RequestOptions`. */
     userId?: string;
     /** Default namespace UUID for `X-Namespace-Id` header. Overridable per-call via `RequestOptions`. */
     namespaceId?: string;
     /** Authenticated user identifier for `X-Authenticated-User` header. */
     authenticatedUser?: string;
-    /**
-     * Bearer token for `Authorization: Bearer <token>` header.
-     * Optional — omit when using cookie-based authentication.
-     */
-    bearerToken?: string;
     /** Default request timeout in milliseconds. Overridable per-call. Default: 30000. */
     timeoutMs?: number;
     /** Maximum number of retry attempts. Default: 3. */
@@ -175,8 +207,8 @@ interface ResolvedConfig {
     namespaceId: string | undefined;
     /** Authenticated user identifier, or undefined if not set. */
     authenticatedUser: string | undefined;
-    /** Bearer token, or undefined if using cookie-based auth. */
-    bearerToken: string | undefined;
+    /** Resolved authentication mode. */
+    auth: AuthConfig;
     /** Request timeout in milliseconds. */
     timeoutMs: number;
     /** Maximum number of retry attempts. */
@@ -38045,8 +38077,13 @@ interface ComponentHealthDto {
 }
 /** Enriched health response with component statuses and build info. */
 interface EnrichedHealthResponse {
-    /** Build information for the running server. */
-    buildInfo: BuildInfoDto;
+    /**
+     * Build information for the running server.
+     *
+     * Optional: some deployments (typically the gateway-fronted production
+     * health endpoint) omit build info and return `null` here.
+     */
+    buildInfo?: BuildInfoDto;
     /** Health status of individual components. */
     components: ComponentHealthDto[];
     /** Overall health status. */
@@ -42646,4 +42683,4 @@ declare function toUntaggedFeatures(features: PlainFeatureMap): Record<string, F
  */
 declare function toTermInputDto(input: PsiTermInput | TermInputDto): TermInputDto;
 
-export { ANY_ROLE, actionReviews as ActionReviews, type AddFactRequest, type AddFactResponse, type AddRuleRequest, type AddRuleResponse, admin as Admin, type AiGroup, analysis as Analysis, type AnalysisGroup, ApiError, type ApiResponse, AuthenticationError, type BackwardChainRequest, type BackwardChainResponse, BadRequestError, type BulkAddTermsRequest, type BulkAddTermsResponse, type BulkCreateSortsRequest, type BulkCreateSortsResponse, cdl as CDL, causal as Causal, type ClearTermsResponse, type ClientConfig, cognitive as Cognitive, collections as Collections, communities as Communities, type ConstrainedPlainVar, ConstraintViolationError, constraints as Constraints, control as Control, conversation as Conversation, type ConversationMessageRequest, type ConversationMessageResponse, type ConversationSummaryDto, type ConversationTurnsResponse, type CoreGroup, type CreateResearchSessionRequest, type CreateResearchSessionResponse, type CreateSortRequest, type CreateTermRequest, type DataGroup, discovery as Discovery, type ErrorResponse$1 as ErrorResponse, execution as Execution, extract as Extract, type FeatureInputValueDto, type FeatureValueDto, ForbiddenError, type ForwardChainRequest, type ForwardChainResponse, functions as Functions, fuzzy as Fuzzy, FuzzyShape, type FuzzyShapeDto, generation as Generation, type GlbRequest, type GlbResponse, health as Health, homoiconic as Homoiconic, ilp as ILP, imageExtraction as ImageExtraction, inference as Inference, type IngestPaperRequest, type IngestPaperResponse, ingestion as Ingestion, IngestionFailedError, IngestionSession, type IngestionSyncOptions, type Interceptor, InternalServerError, type JsonValue$1 as JsonValue, LP, type ListConversationsResponse, type LubRequest, type LubResponse, namespaces as Namespaces, NetworkError, neuroSymbolic as NeuroSymbolic, NotFoundError, ontology as Ontology, optimize as Optimize, type OsfSearchRequest, type OsfSearchResponse, osfql as Osfql, type OsfqlRequest, type OsfqlResponse, type OsfqlValue, oversight as Oversight, type PaginationParams, type PaperMetadataDto, type PaperSource, type PlainFeatureMap, type PlainFeatureValue, plainValues as PlainValues, preferences as Preferences, proofEngine as ProofEngine, type PsiTermDto, type PsiTermInput, query as Query, rag as RAG, RateLimitError, type RateLimitInfo, reasoning as Reasoning, type ReasoningGroup, ReasoningLayerClient, ReasoningLayerError, type RequestOptions, research as Research, type ResearchContradictionsResponse, type ResearchCycleResponse, type ResearchFindingsResponse, type ResearchGapsResponse, type ResearchReportResponse, type ResearchSessionResponse, reviews as Reviews, row as Row, SDK_VERSION, scenarios as Scenarios, scheduling as Scheduling, type SearchPapersRequest, type SearchPapersResponse, SortBuilder, type SortDto, type SortInfoDto, sorts as Sorts, sources as Sources, spaces as Spaces, statistical as Statistical, synthetic as Synthetic, type SystemGroup, type TermDto, type TermInputArg, type TermInputDto, type TermListResponse, type TermPatternDto, type TermResponse, terms as Terms, TimeoutError, type TurnDto, type UpdateTermRequest, utilities as Utilities, ValidationError, Value, type ValueDto, values as Values, type VerifyClaimRequest, type VerifyClaimResponse, visualization as Visualization, WebSocketClient, WebSocketConnection, webhookActions as WebhookActions, type WorkflowGroup, allen, constrained, discriminateFeatureValue, guard, isConstrainedPlainVar, isPsiTermInput, isTaggedValueDto, isUuid, psi, toTaggedFeatures, toTaggedValue, toTermInputDto, toUntaggedFeatures, toUntaggedValue };
+export { ANY_ROLE, actionReviews as ActionReviews, type AddFactRequest, type AddFactResponse, type AddRuleRequest, type AddRuleResponse, admin as Admin, type AiGroup, analysis as Analysis, type AnalysisGroup, ApiError, type ApiResponse, type AuthConfig, AuthenticationError, type BackwardChainRequest, type BackwardChainResponse, BadRequestError, type BulkAddTermsRequest, type BulkAddTermsResponse, type BulkCreateSortsRequest, type BulkCreateSortsResponse, cdl as CDL, causal as Causal, type ClearTermsResponse, type ClientConfig, cognitive as Cognitive, collections as Collections, communities as Communities, type ConstrainedPlainVar, ConstraintViolationError, constraints as Constraints, control as Control, conversation as Conversation, type ConversationMessageRequest, type ConversationMessageResponse, type ConversationSummaryDto, type ConversationTurnsResponse, type CoreGroup, type CreateResearchSessionRequest, type CreateResearchSessionResponse, type CreateSortRequest, type CreateTermRequest, type DataGroup, discovery as Discovery, type ErrorResponse$1 as ErrorResponse, execution as Execution, extract as Extract, type FeatureInputValueDto, type FeatureValueDto, ForbiddenError, type ForwardChainRequest, type ForwardChainResponse, functions as Functions, fuzzy as Fuzzy, FuzzyShape, type FuzzyShapeDto, generation as Generation, type GlbRequest, type GlbResponse, health as Health, homoiconic as Homoiconic, ilp as ILP, imageExtraction as ImageExtraction, inference as Inference, type IngestPaperRequest, type IngestPaperResponse, ingestion as Ingestion, IngestionFailedError, IngestionSession, type IngestionSyncOptions, type Interceptor, InternalServerError, type JsonValue$1 as JsonValue, LP, type ListConversationsResponse, type LubRequest, type LubResponse, namespaces as Namespaces, NetworkError, neuroSymbolic as NeuroSymbolic, NotFoundError, ontology as Ontology, optimize as Optimize, type OsfSearchRequest, type OsfSearchResponse, osfql as Osfql, type OsfqlRequest, type OsfqlResponse, type OsfqlValue, oversight as Oversight, type PaginationParams, type PaperMetadataDto, type PaperSource, type PlainFeatureMap, type PlainFeatureValue, plainValues as PlainValues, preferences as Preferences, proofEngine as ProofEngine, type PsiTermDto, type PsiTermInput, query as Query, rag as RAG, RateLimitError, type RateLimitInfo, reasoning as Reasoning, type ReasoningGroup, ReasoningLayerClient, ReasoningLayerError, type RequestOptions, research as Research, type ResearchContradictionsResponse, type ResearchCycleResponse, type ResearchFindingsResponse, type ResearchGapsResponse, type ResearchReportResponse, type ResearchSessionResponse, reviews as Reviews, row as Row, SDK_VERSION, scenarios as Scenarios, scheduling as Scheduling, type SearchPapersRequest, type SearchPapersResponse, SortBuilder, type SortDto, type SortInfoDto, sorts as Sorts, sources as Sources, spaces as Spaces, statistical as Statistical, synthetic as Synthetic, type SystemGroup, type TermDto, type TermInputArg, type TermInputDto, type TermListResponse, type TermPatternDto, type TermResponse, terms as Terms, TimeoutError, type TurnDto, type UpdateTermRequest, utilities as Utilities, ValidationError, Value, type ValueDto, values as Values, type VerifyClaimRequest, type VerifyClaimResponse, visualization as Visualization, WebSocketClient, WebSocketConnection, webhookActions as WebhookActions, type WorkflowGroup, allen, constrained, discriminateFeatureValue, guard, isConstrainedPlainVar, isPsiTermInput, isTaggedValueDto, isUuid, psi, toTaggedFeatures, toTaggedValue, toTermInputDto, toUntaggedFeatures, toUntaggedValue };

package/dist/index.js

@@ -5,7 +5,7 @@ var __export = (target, all) => {
 };
 
 // src/config.ts
-var SDK_VERSION = "0.23.1";
+var SDK_VERSION = "1.0.0";
 function resolveConfig(config) {
   if (!config.baseUrl) {
     throw new Error("ClientConfig.baseUrl is required");
@@ -13,13 +13,21 @@ function resolveConfig(config) {
   if (!config.tenantId) {
     throw new Error("ClientConfig.tenantId is required");
   }
+  if (!config.auth) {
+    throw new Error(
+      "ClientConfig.auth is required \u2014 pass { mode: 'bearer', token } or { mode: 'cookie' }"
+    );
+  }
+  if (config.auth.mode === "bearer" && !config.auth.token) {
+    throw new Error("ClientConfig.auth.token is required when mode is 'bearer'");
+  }
   return {
     baseUrl: config.baseUrl.replace(/\/+$/, ""),
     tenantId: config.tenantId,
     userId: config.userId,
     namespaceId: config.namespaceId,
     authenticatedUser: config.authenticatedUser,
-    bearerToken: config.bearerToken,
+    auth: config.auth,
     timeoutMs: config.timeoutMs ?? 3e4,
     maxRetries: config.maxRetries ?? 3,
     retryOn503: config.retryOn503 ?? false,
@@ -375,8 +383,8 @@ var WebSocketClient = class {
   buildUrl(path, params) {
     const baseUrl = this.config.baseUrl.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
     const queryParams = new URLSearchParams({ tenant_id: this.config.tenantId });
-    if (this.config.bearerToken) {
-      queryParams.set("token", this.config.bearerToken);
+    if (this.config.auth.mode === "bearer") {
+      queryParams.set("token", this.config.auth.token);
     }
     if (params) {
       for (const [key, value] of Object.entries(params)) {
@@ -615,7 +623,7 @@ function buildAuthHeaders(config) {
   if (config.userId) headers["X-User-Id"] = config.userId;
   if (config.namespaceId) headers["X-Namespace-Id"] = config.namespaceId;
   if (config.authenticatedUser) headers["X-Authenticated-User"] = config.authenticatedUser;
-  if (config.bearerToken) headers["Authorization"] = `Bearer ${config.bearerToken}`;
+  if (config.auth.mode === "bearer") headers["Authorization"] = `Bearer ${config.auth.token}`;
   return headers;
 }
 function transformRequestInit(init) {
@@ -642,10 +650,14 @@ function createCustomFetch(config) {
         const response = await executeFetch(input, transformedInit, timeoutMs, config);
         if (response.ok) return response;
         let body;
+        const rawText = await response.clone().text().catch(() => "");
         try {
-          body = await response.clone().json();
+          body = rawText ? JSON.parse(rawText) : { error: "unknown", message: `HTTP ${response.status}` };
         } catch {
-          body = { error: "unknown", message: `HTTP ${response.status}` };
+          body = {
+            error: "unknown",
+            message: rawText.trim() || `HTTP ${response.status}`
+          };
         }
         const apiError = createApiError(response.status, body, response.headers);
         if (response.status === 429 && attempt < maxRetries) {
@@ -683,7 +695,11 @@ async function executeFetch(input, init, timeoutMs, config) {
   const existingSignal = init?.signal;
   const combinedSignal = existingSignal ? AbortSignal.any([timeoutController.signal, existingSignal]) : timeoutController.signal;
   const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-  const request = new Request(url, { ...init, signal: combinedSignal });
+  const request = new Request(url, {
+    ...init,
+    signal: combinedSignal,
+    credentials: config.auth.mode === "cookie" ? "include" : "same-origin"
+  });
   try {
     const fetchFn = config.fetch;
     const baseFetch = (req) => fetchFn(req);
@@ -19391,10 +19407,14 @@ function ComponentHealthDtoFromApiToFront(dto) {
   };
 }
 function EnrichedHealthResponseFromApiToFront(dto) {
+  if (dto == null) {
+    return { buildInfo: void 0, components: [], status: "unknown" };
+  }
+  const rawBuildInfo = dto.build_info;
   return {
-    buildInfo: BuildInfoDtoFromApiToFront(dto.build_info),
-    components: dto.components.map(ComponentHealthDtoFromApiToFront),
-    status: dto.status
+    buildInfo: rawBuildInfo == null ? void 0 : BuildInfoDtoFromApiToFront(rawBuildInfo),
+    components: (dto.components ?? []).map(ComponentHealthDtoFromApiToFront),
+    status: dto.status ?? "unknown"
   };
 }