@kortix/sdk 0.9.98

package/dist/platform/projects-client/access.d.ts

@@ -0,0 +1,273 @@
+import { type ApiClientOptions } from '../api-client.js';
+import { type AccountRole, type ProjectRole } from './shared.js';
+export interface ProjectGroupAccessSource {
+    group_id: string;
+    group_name: string;
+    role: ProjectRole;
+}
+export interface ProjectAccessMember {
+    user_id: string;
+    email: string | null;
+    account_role: AccountRole;
+    project_role: ProjectRole | null;
+    effective_project_role: ProjectRole | null;
+    has_implicit_access: boolean;
+    /** Which path produced effective_project_role. 'implicit' = account
+     *  owner/admin; 'direct' = explicit project_members row; 'group' =
+     *  inherited via a project_group_grants attachment. null = no access. */
+    effective_source?: 'implicit' | 'direct' | 'group' | null;
+    /** Every group attachment that includes this user, sorted by role
+     *  desc. Used to label "via X group" on the row. */
+    group_sources?: ProjectGroupAccessSource[];
+    joined_at: string;
+    granted_by: string | null;
+    granted_at: string | null;
+    updated_at: string | null;
+    /** Auto-revoke timestamp for the DIRECT grant (ISO). null = permanent
+     *  or no direct grant. */
+    expires_at?: string | null;
+}
+export interface ProjectAccessResponse {
+    project_id: string;
+    account_id: string;
+    can_manage: boolean;
+    viewer_user_id: string;
+    members: ProjectAccessMember[];
+}
+export interface ProjectAccessRequest {
+    request_id: string;
+    account_id: string;
+    project_id: string;
+    requester_user_id: string;
+    requester_email: string;
+    message: string | null;
+    status: 'pending' | 'approved' | 'rejected';
+    reviewed_by: string | null;
+    reviewed_at: string | null;
+    created_at: string;
+    updated_at: string;
+}
+export type RequestProjectAccessResult = {
+    status: 'created';
+    request: ProjectAccessRequest;
+} | {
+    status: 'pending';
+    request: ProjectAccessRequest;
+} | {
+    status: 'already_has_access';
+    project_id: string;
+};
+export declare function requestProjectAccess(projectId: string, message?: string): Promise<{
+    status: "created";
+    request: ProjectAccessRequest;
+} | {
+    status: "pending";
+    request: ProjectAccessRequest;
+} | {
+    status: "already_has_access";
+    project_id: string;
+}>;
+export declare function listProjectAccessRequests(projectId: string, options?: ApiClientOptions): Promise<{
+    requests: ProjectAccessRequest[];
+}>;
+export declare function approveProjectAccessRequest(projectId: string, requestId: string, role?: ProjectRole): Promise<{
+    request: ProjectAccessRequest;
+    member: ProjectAccessMember;
+}>;
+export declare function rejectProjectAccessRequest(projectId: string, requestId: string): Promise<{
+    request: ProjectAccessRequest;
+}>;
+export declare function listProjectAccess(projectId: string): Promise<ProjectAccessResponse>;
+export declare function updateProjectAccess(projectId: string, userId: string, role: ProjectRole): Promise<ProjectAccessMember>;
+export declare function revokeProjectAccess(projectId: string, userId: string): Promise<{
+    ok: boolean;
+}>;
+/** Two-shape response:
+ *  - User had a Kortix account already → ProjectAccessMember row was
+ *    inserted/updated; UI refreshes the access list and shows them.
+ *  - User had no Kortix account → an account invitation was created
+ *    with a bootstrap_grant. UI shows "invitation sent" and skips the
+ *    access-list refresh (the user won't appear until they accept). */
+export type InviteProjectMemberResult = ProjectAccessMember | {
+    status: 'invited';
+    email: string;
+    invite_id: string;
+    project_role: ProjectRole;
+    message: string;
+    /** Public invite link — share manually when email delivery is skipped. */
+    invite_url: string;
+    /** false = invite email skipped (e.g. Mailtrap unconfigured) or failed. */
+    email_sent: boolean;
+    email_skip_reason: string | null;
+};
+export declare function isInviteSent(r: InviteProjectMemberResult): r is Extract<InviteProjectMemberResult, {
+    status: 'invited';
+}>;
+export declare function inviteProjectMember(projectId: string, email: string, role: ProjectRole): Promise<ProjectAccessMember | {
+    status: "invited";
+    email: string;
+    invite_id: string;
+    project_role: ProjectRole;
+    message: string;
+    /** Public invite link — share manually when email delivery is skipped. */
+    invite_url: string;
+    /** false = invite email skipped (e.g. Mailtrap unconfigured) or failed. */
+    email_sent: boolean;
+    email_skip_reason: string | null;
+}>;
+/** Pending account-invitation that bootstraps into THIS project on accept.
+ *  Shape mirrors the backend GET /access/pending-invites response.
+ *
+ *  `expires_at` here is the *grant's* time-bounded clock (auto-revoke once
+ *  they're in). `invite_expires_at` is the *invitation* clock — after that
+ *  the user can't redeem the link and needs a resend. */
+export interface PendingProjectInvite {
+    invite_id: string;
+    email: string;
+    project_role: ProjectRole;
+    expires_at: string | null;
+    invited_by_email: string | null;
+    created_at: string;
+    invite_expires_at: string;
+    invite_expired: boolean;
+}
+export declare function listPendingProjectInvites(projectId: string): Promise<{
+    pending: PendingProjectInvite[];
+}>;
+export declare function revokePendingProjectInvite(projectId: string, inviteId: string): Promise<{
+    ok: boolean;
+    invitation_cancelled: boolean;
+}>;
+export interface ResendProjectInviteResult {
+    ok: boolean;
+    expires_at: string;
+    invite_url: string;
+    email_sent: boolean;
+    email_skip_reason: string | null;
+}
+export declare function resendPendingProjectInvite(projectId: string, inviteId: string): Promise<ResendProjectInviteResult>;
+export interface ProjectGroupGrant {
+    group_id: string;
+    group_name: string;
+    role: ProjectRole;
+    granted_by: string | null;
+    created_at: string;
+    /** Auto-revoke timestamp (ISO). null = permanent. */
+    expires_at?: string | null;
+    /** Total members in this group. */
+    member_count?: number;
+    /** Members who are account owners/admins — they get implicit Manager
+     *  on every project, so this grant's role doesn't apply to them. */
+    override_count?: number;
+}
+export declare function listProjectGroupGrants(projectId: string): Promise<{
+    grants: ProjectGroupGrant[];
+}>;
+export declare function attachGroupToProject(projectId: string, groupId: string, role: ProjectRole, expiresAt?: string | null): Promise<{
+    project_id: string;
+    group_id: string;
+    role: ProjectRole;
+}>;
+export declare function updateProjectGroupGrant(projectId: string, groupId: string, role: ProjectRole, expiresAt?: string | null): Promise<{
+    project_id: string;
+    group_id: string;
+    role: ProjectRole;
+}>;
+export declare function detachGroupFromProject(projectId: string, groupId: string): Promise<{
+    ok: boolean;
+}>;
+export type ResourceGrantType = 'agent' | 'skill' | 'secret';
+/** A grantable resource (agent name / skill slug) discovered from the repo. */
+export interface ProjectResourceItem {
+    /** Stable grant key — agent name / skill slug. */
+    id: string;
+    /** Display name. */
+    name: string;
+    description: string | null;
+}
+/** An agent resource, enriched with its DECLARED scope so the grant UI can
+ *  preview the blast radius of an assignment (the inheritance pyramid): assigning
+ *  the agent also grants these secrets + connectors. `'all'` = every one the
+ *  assignee can already see (nothing extra inherited). */
+export interface ProjectAgentResourceItem extends ProjectResourceItem {
+    declares?: {
+        secrets: string[] | 'all';
+        connectors: string[] | 'all';
+    };
+}
+export interface ProjectResourceGrant {
+    grant_id: string;
+    resource_type: ResourceGrantType;
+    resource_id: string;
+    principal_type: 'member' | 'group';
+    principal_id: string;
+    /** Resolved label — member email or group name. */
+    principal_label: string;
+    granted_by: string | null;
+    created_at: string;
+    expires_at: string | null;
+    /** true = the scoped agent/skill no longer exists (renamed/deleted) — the
+     *  grant is inert and the restriction has lapsed; remove or re-point it. */
+    orphaned?: boolean;
+}
+export interface ProjectResourceGrantsResponse {
+    resources: {
+        agents: ProjectAgentResourceItem[];
+        skills: ProjectResourceItem[];
+        /** Secret sharing was retired (a secret is always project-wide; the only
+         *  access gate is the agent-side `secrets` grant) — never populated, kept
+         *  optional for older API responses. */
+        secrets?: ProjectResourceItem[];
+    };
+    grants: ProjectResourceGrant[];
+}
+export declare function listProjectResourceGrants(projectId: string): Promise<ProjectResourceGrantsResponse>;
+export declare function createProjectResourceGrant(projectId: string, input: {
+    resourceType: ResourceGrantType;
+    resourceId: string;
+    principalType: 'member' | 'group';
+    principalId: string;
+    expiresAt?: string | null;
+}): Promise<{
+    grant_id: string;
+}>;
+export declare function deleteProjectResourceGrant(projectId: string, grantId: string): Promise<{
+    ok: boolean;
+}>;
+/** An executor action a policy gated as `require_approval`, still awaiting a
+ *  human decision. */
+export interface PendingApproval {
+    execution_id: string;
+    action: string;
+    risk: string | null;
+    session_id: string | null;
+    requested_by: string | null;
+    requested_by_email: string | null;
+    requested_at: string;
+    detail: Record<string, unknown> | null;
+}
+export interface PendingApprovalsResponse {
+    count: number;
+    approvals: PendingApproval[];
+}
+/** The manager inbox of gated actions awaiting approve/deny. */
+export declare function listPendingApprovals(projectId: string, options?: {
+    showErrors?: boolean;
+}): Promise<PendingApprovalsResponse>;
+/** Per-session pending-approval summary for the sidebar "needs input" badge:
+ *  `sessions` maps a (Kortix) session id → count of actions awaiting a decision.
+ *  A manager sees every session; others only the ones they launched. */
+export interface SessionsNeedingInputResponse {
+    total: number;
+    sessions: Record<string, number>;
+}
+export declare function listSessionsNeedingInput(projectId: string, options?: {
+    showErrors?: boolean;
+}): Promise<SessionsNeedingInputResponse>;
+/** Resolve a pending approval. Allowed for a project manager or the session
+ *  launcher; approve lets the action proceed on retry, deny records a refusal. */
+export declare function resolveApproval(projectId: string, executionId: string, decision: 'approve' | 'deny', scope?: 'once' | 'session' | 'session_all'): Promise<{
+    ok: boolean;
+    scope?: "once" | "session" | "session_all";
+}>;
+//# sourceMappingURL=access.d.ts.map

package/dist/platform/projects-client/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/platform/projects-client/access.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAU,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAEtE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,WAAW,CAAC;IAC1B,YAAY,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;6EAEyE;IACzE,gBAAgB,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;IAC1D;wDACoD;IACpD,aAAa,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;8BAC0B;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,mBAAmB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;IAC5C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;YAJhE,SAAS;aAAW,oBAAoB;;YACxC,SAAS;aAAW,oBAAoB;;YACxC,oBAAoB;gBAAc,MAAM;GAUrD;AAED,wBAAsB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;cAExD,oBAAoB,EAAE;GAK1D;AAED,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,WAAsB;aAIf,oBAAoB;YACrB,mBAAmB;GAGhC;AAED,wBAAsB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;aAEhD,oBAAoB;GAKxD;AAED,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,kCAMxD;AAED,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,gCAQlB;AAED,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;QAEzC,OAAO;GAIxC;AAED;;;;;uEAKuE;AACvE,MAAM,MAAM,yBAAyB,GACjC,mBAAmB,GACnB;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,WAAW,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAEN,wBAAgB,YAAY,CAC1B,CAAC,EAAE,yBAAyB,GAC3B,CAAC,IAAI,OAAO,CAAC,yBAAyB,EAAE;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC,CAEhE;AAED,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW;YArBL,SAAS;WACV,MAAM;eACF,MAAM;kBACH,WAAW;aAChB,MAAM;IACf,0EAA0E;gBAC9D,MAAM;IAClB,2EAA2E;gBAC/D,OAAO;uBACA,MAAM,GAAG,IAAI;GAoBrC;AAID;;;;;yDAKyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,WAAW,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wBAAsB,yBAAyB,CAAC,SAAS,EAAE,MAAM;aAE7B,oBAAoB,EAAE;GAIzD;AAED,wBAAsB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;QAElD,OAAO;0BAAwB,OAAO;GAIvE;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,wBAAsB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,sCAMnF;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;wEACoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM;YAE3B,iBAAiB,EAAE;GAIrD;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,EACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;gBAGa,MAAM;cAAY,MAAM;UAAQ,WAAW;GAQlF;AAED,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,EACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;gBAGc,MAAM;cAAY,MAAM;UAAQ,WAAW;GAKnF;AAED,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;QAE7C,OAAO;GAIxC;AAID,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE7D,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;KAAE,CAAC;CACxE;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,QAAQ,GAAG,OAAO,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE;QACT,MAAM,EAAE,wBAAwB,EAAE,CAAC;QACnC,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAC9B;;gDAEwC;QACxC,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACjC,CAAC;IACF,MAAM,EAAE,oBAAoB,EAAE,CAAC;CAChC;AAED,wBAAsB,yBAAyB,CAAC,SAAS,EAAE,MAAM,0CAMhE;AAED,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IACL,YAAY,EAAE,iBAAiB,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,QAAQ,GAAG,OAAO,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;cAGmC,MAAM;GAQ3C;AAED,wBAAsB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;QAEjD,OAAO;GAIxC;AAID;sBACsB;AACtB,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,eAAe,EAAE,CAAC;CAC9B;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,qCAM/F;AAED;;wEAEwE;AACxE,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,yCAQnC;AAED;kFACkF;AAClF,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,SAAS,GAAG,MAAM,EAI5B,KAAK,GAAE,MAAM,GAAG,SAAS,GAAG,aAAsB;QAGpB,OAAO;YAAU,MAAM,GAAG,SAAS,GAAG,aAAa;GAKlF"}

package/dist/platform/projects-client/access.js

@@ -0,0 +1,89 @@
+// Project access — members, access requests, project invites, and group grants.
+import { backendApi } from '../api-client.js';
+import { unwrap } from './shared.js';
+export async function requestProjectAccess(projectId, message) {
+    return unwrap(await backendApi.post(`/projects/${projectId}/access-requests`, { message: message?.trim() || undefined }, { showErrors: false }));
+}
+export async function listProjectAccessRequests(projectId, options) {
+    return unwrap(await backendApi.get(`/projects/${projectId}/access-requests`, options));
+}
+export async function approveProjectAccessRequest(projectId, requestId, role = 'member') {
+    return unwrap(await backendApi.post(`/projects/${projectId}/access-requests/${requestId}/approve`, { role }));
+}
+export async function rejectProjectAccessRequest(projectId, requestId) {
+    return unwrap(await backendApi.post(`/projects/${projectId}/access-requests/${requestId}/reject`, {}));
+}
+export async function listProjectAccess(projectId) {
+    return unwrap(await backendApi.get(`/projects/${projectId}/access`));
+}
+export async function updateProjectAccess(projectId, userId, role) {
+    return unwrap(await backendApi.put(`/projects/${projectId}/access/${userId}`, { role }));
+}
+export async function revokeProjectAccess(projectId, userId) {
+    return unwrap(await backendApi.delete(`/projects/${projectId}/access/${userId}`));
+}
+export function isInviteSent(r) {
+    return 'status' in r && r.status === 'invited';
+}
+export async function inviteProjectMember(projectId, email, role) {
+    return unwrap(await backendApi.post(`/projects/${projectId}/access/invite`, { email, role }));
+}
+export async function listPendingProjectInvites(projectId) {
+    return unwrap(await backendApi.get(`/projects/${projectId}/access/pending-invites`));
+}
+export async function revokePendingProjectInvite(projectId, inviteId) {
+    return unwrap(await backendApi.delete(`/projects/${projectId}/access/pending-invites/${inviteId}`));
+}
+export async function resendPendingProjectInvite(projectId, inviteId) {
+    return unwrap(await backendApi.post(`/projects/${projectId}/access/pending-invites/${inviteId}/resend`));
+}
+export async function listProjectGroupGrants(projectId) {
+    return unwrap(await backendApi.get(`/projects/${projectId}/group-grants`));
+}
+export async function attachGroupToProject(projectId, groupId, role, expiresAt) {
+    return unwrap(await backendApi.post(`/projects/${projectId}/group-grants`, 
+    // undefined = field omitted (don't touch); null = clear expiry.
+    expiresAt === undefined
+        ? { group_id: groupId, role }
+        : { group_id: groupId, role, expires_at: expiresAt }));
+}
+export async function updateProjectGroupGrant(projectId, groupId, role, expiresAt) {
+    return unwrap(await backendApi.patch(`/projects/${projectId}/group-grants/${groupId}`, expiresAt === undefined ? { role } : { role, expires_at: expiresAt }));
+}
+export async function detachGroupFromProject(projectId, groupId) {
+    return unwrap(await backendApi.delete(`/projects/${projectId}/group-grants/${groupId}`));
+}
+export async function listProjectResourceGrants(projectId) {
+    return unwrap(await backendApi.get(`/projects/${projectId}/resource-grants`));
+}
+export async function createProjectResourceGrant(projectId, input) {
+    return unwrap(await backendApi.post(`/projects/${projectId}/resource-grants`, {
+        resource_type: input.resourceType,
+        resource_id: input.resourceId,
+        principal_type: input.principalType,
+        principal_id: input.principalId,
+        ...(input.expiresAt !== undefined ? { expires_at: input.expiresAt } : {}),
+    }));
+}
+export async function deleteProjectResourceGrant(projectId, grantId) {
+    return unwrap(await backendApi.delete(`/projects/${projectId}/resource-grants/${grantId}`));
+}
+/** The manager inbox of gated actions awaiting approve/deny. */
+export async function listPendingApprovals(projectId, options) {
+    return unwrap(await backendApi.get(`/projects/${projectId}/approvals`, {
+        showErrors: options?.showErrors,
+    }));
+}
+export async function listSessionsNeedingInput(projectId, options) {
+    return unwrap(await backendApi.get(`/projects/${projectId}/approvals/needs-input`, { showErrors: options?.showErrors }));
+}
+/** Resolve a pending approval. Allowed for a project manager or the session
+ *  launcher; approve lets the action proceed on retry, deny records a refusal. */
+export async function resolveApproval(projectId, executionId, decision, 
+// 'once' (default) = just this call; 'session' = also stop asking for this
+// connector+action for the rest of the session; 'session_all' = stop asking
+// for ANY gated action for the rest of the session.
+scope = 'once') {
+    return unwrap(await backendApi.post(`/projects/${projectId}/approvals/${executionId}`, { decision, scope }));
+}
+//# sourceMappingURL=access.js.map

package/dist/platform/projects-client/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../../src/platform/projects-client/access.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,EAAE,UAAU,EAAyB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,MAAM,EAAsC,MAAM,UAAU,CAAC;AA0DtE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAgB;IAC5E,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,kBAAkB,EACxC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,EACzC,EAAE,UAAU,EAAE,KAAK,EAAE,CACtB,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,SAAiB,EAAE,OAA0B;IAC3F,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,aAAa,SAAS,kBAAkB,EACxC,OAAO,CACR,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAiB,EACjB,SAAiB,EACjB,OAAoB,QAAQ;IAE5B,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CAGlB,aAAa,SAAS,oBAAoB,SAAS,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,SAAiB,EAAE,SAAiB;IACnF,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,oBAAoB,SAAS,SAAS,EAC5D,EAAE,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,aAAa,SAAS,SAAS,CAChC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,MAAc,EACd,IAAiB;IAEjB,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,aAAa,SAAS,WAAW,MAAM,EAAE,EACzC,EAAE,IAAI,EAAE,CACT,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc;IACzE,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,MAAM,CACrB,aAAa,SAAS,WAAW,MAAM,EAAE,CAC1C,CACF,CAAC;AACJ,CAAC;AAuBD,MAAM,UAAU,YAAY,CAC1B,CAA4B;IAE5B,OAAO,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,KAAa,EACb,IAAiB;IAEjB,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,gBAAgB,EACtC,EAAE,KAAK,EAAE,IAAI,EAAE,CAChB,CACF,CAAC;AACJ,CAAC;AAqBD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,SAAiB;IAC/D,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,aAAa,SAAS,yBAAyB,CAChD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,SAAiB,EAAE,QAAgB;IAClF,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,MAAM,CACrB,aAAa,SAAS,2BAA2B,QAAQ,EAAE,CAC5D,CACF,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,SAAiB,EAAE,QAAgB;IAClF,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,2BAA2B,QAAQ,SAAS,CACnE,CACF,CAAC;AACJ,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IAC5D,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,aAAa,SAAS,eAAe,CACtC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,OAAe,EACf,IAAiB,EACjB,SAAyB;IAEzB,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,eAAe;IACrC,gEAAgE;IAChE,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;QAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CACvD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,OAAe,EACf,IAAiB,EACjB,SAAyB;IAEzB,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,KAAK,CACpB,aAAa,SAAS,iBAAiB,OAAO,EAAE,EAChD,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CACrE,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB,EAAE,OAAe;IAC7E,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,MAAM,CACrB,aAAa,SAAS,iBAAiB,OAAO,EAAE,CACjD,CACF,CAAC;AACJ,CAAC;AAmDD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,SAAiB;IAC/D,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,aAAa,SAAS,kBAAkB,CACzC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAAiB,EACjB,KAMC;IAED,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CAAuB,aAAa,SAAS,kBAAkB,EAAE;QACpF,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,SAAiB,EAAE,OAAe;IACjF,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,MAAM,CACrB,aAAa,SAAS,oBAAoB,OAAO,EAAE,CACpD,CACF,CAAC;AACJ,CAAC;AAsBD,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAkC;IAC9F,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAA2B,aAAa,SAAS,YAAY,EAAE;QACjF,UAAU,EAAE,OAAO,EAAE,UAAU;KAChC,CAAC,CACH,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAiB,EACjB,OAAkC;IAElC,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,aAAa,SAAS,wBAAwB,EAC9C,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CACpC,CACF,CAAC;AACJ,CAAC;AAED;kFACkF;AAClF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,WAAmB,EACnB,QAA4B;AAC5B,2EAA2E;AAC3E,4EAA4E;AAC5E,oDAAoD;AACpD,QAA4C,MAAM;IAElD,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,cAAc,WAAW,EAAE,EACjD,EAAE,QAAQ,EAAE,KAAK,EAAE,CACpB,CACF,CAAC;AACJ,CAAC"}

package/dist/platform/projects-client/accounts.d.ts

@@ -0,0 +1,184 @@
+import type { ApiError } from '../api/errors.js';
+import { type AccountRole, type ServerTokenOptions } from './shared.js';
+export interface KortixAccount {
+    account_id: string;
+    name: string;
+    slug?: string;
+    account_role?: string;
+    is_primary_owner?: boolean;
+}
+export interface AccountDetail {
+    account_id: string;
+    name: string;
+    /** When true the account is on the simplified IAM V2 model (3 account
+     *  roles + 3 project roles, no DB-driven policies). Drives whether the
+     *  frontend shows the V1 Policies/Roles tabs or the V2 simple UI. */
+    iam_v2_enabled?: boolean;
+    member_count: number;
+    project_count: number;
+    role: AccountRole;
+    created_at: string;
+    updated_at: string;
+}
+export interface AccountMemberGroup {
+    group_id: string;
+    name: string;
+}
+export interface AccountMember {
+    user_id: string;
+    email: string | null;
+    account_role: AccountRole;
+    is_super_admin?: boolean;
+    explicit_project_count?: number;
+    groups?: AccountMemberGroup[];
+    /** Number of active CLI Personal Access Tokens this user owns in
+     *  this account. Lets the UI flag members with API automation. */
+    active_pat_count?: number;
+    /** True when the user has at least one verified MFA factor in
+     *  Supabase Auth. */
+    has_verified_mfa?: boolean;
+    joined_at: string;
+}
+export type InviteMemberResult = {
+    status: 'added';
+    user_id: string;
+    email: string;
+    account_role: AccountRole;
+} | {
+    status: 'pending';
+    invite_id: string;
+    email: string;
+    account_role: AccountRole;
+    expires_at: string;
+    invite_url: string;
+    email_sent: boolean;
+    email_skip_reason: string | null;
+};
+export interface AccountInvitation {
+    invite_id: string;
+    email: string;
+    initial_role: AccountRole;
+    invited_by: string;
+    created_at: string;
+    expires_at: string;
+    invite_url: string;
+}
+export interface ResendInviteResult {
+    ok: boolean;
+    expires_at: string;
+    invite_url: string;
+    email_sent: boolean;
+    email_skip_reason: string | null;
+}
+export interface AccountInviteDescribeFull {
+    invite_id: string;
+    account_id: string;
+    account_name: string | null;
+    email: string;
+    initial_role: AccountRole;
+    inviter_email: string | null;
+    created_at: string;
+    expires_at: string;
+    expired: boolean;
+    accepted_at: string | null;
+    email_matches_caller: true;
+}
+export interface AccountInviteDescribeRedacted {
+    invite_id: string;
+    expired: boolean;
+    accepted_at: string | null;
+    email_matches_caller: false;
+    account_id?: null;
+    account_name?: null;
+    email?: null;
+    initial_role?: null;
+    inviter_email?: null;
+    created_at?: null;
+    expires_at?: null;
+}
+export type AccountInviteDescribe = AccountInviteDescribeFull | AccountInviteDescribeRedacted;
+export declare function listAccounts(): Promise<KortixAccount[]>;
+export declare function createAccount(input: {
+    name: string;
+}): Promise<KortixAccount>;
+export declare function getAccount(accountId: string): Promise<AccountDetail>;
+export declare function updateAccountName(accountId: string, name: string): Promise<AccountDetail>;
+export declare function listAccountMembers(accountId: string): Promise<AccountMember[]>;
+export declare function inviteAccountMember(accountId: string, input: {
+    email: string;
+    role?: AccountRole;
+}): Promise<{
+    status: "added";
+    user_id: string;
+    email: string;
+    account_role: AccountRole;
+} | {
+    status: "pending";
+    invite_id: string;
+    email: string;
+    account_role: AccountRole;
+    expires_at: string;
+    invite_url: string;
+    email_sent: boolean;
+    email_skip_reason: string | null;
+}>;
+export declare function listAccountInvites(accountId: string): Promise<AccountInvitation[]>;
+export declare function cancelAccountInvite(accountId: string, inviteId: string): Promise<{
+    ok: boolean;
+}>;
+export declare function resendAccountInvite(accountId: string, inviteId: string): Promise<ResendInviteResult>;
+export declare function describeAccountInvite(inviteId: string): Promise<AccountInviteDescribeFull | AccountInviteDescribeRedacted>;
+export declare function acceptAccountInvite(inviteId: string): Promise<{
+    account_id: string;
+    account_role: AccountRole;
+}>;
+export declare function declineAccountInvite(inviteId: string): Promise<{
+    ok: boolean;
+}>;
+export declare function removeAccountMember(accountId: string, userId: string): Promise<{
+    ok: boolean;
+}>;
+export declare function updateAccountMemberRole(accountId: string, userId: string, role: AccountRole): Promise<AccountMember>;
+export declare function leaveAccount(accountId: string): Promise<{
+    ok: boolean;
+}>;
+/**
+ * Server-side / explicit-token variant of {@link listAccounts}. Next.js
+ * server actions and route handlers (e.g. the post-signup first-project
+ * bootstrap) run per-request and already hold the caller's access token —
+ * they must not rely on the SDK's process-wide `configureKortix()` seam.
+ * Returns `null` on any failure.
+ */
+export declare function fetchAccountsWithToken(opts: ServerTokenOptions): Promise<KortixAccount[] | null>;
+/** The identity `GET /accounts/me` resolves — the authenticated user + their account memberships. */
+export interface AccountIdentity {
+    user_id: string;
+    email: string;
+    token_context?: {
+        auth_type: string | null;
+        project_id: string | null;
+        session_id: string | null;
+        agent: string | null;
+        connectors: 'all' | string[] | null;
+        kortix_cli: 'all' | string[] | null;
+    };
+    accounts: Array<{
+        account_id: string;
+        slug: string;
+        name: string;
+        role: string;
+    }>;
+}
+export interface ValidateTokenResult {
+    valid: boolean;
+    identity?: AccountIdentity;
+    error?: ApiError;
+}
+/**
+ * The "did I paste a valid API key?" check — hits `GET /accounts/me` and
+ * NEVER throws, unlike every other call in this module. Built for a
+ * pasted-token UX (a CLI/SDK setup screen) that wants to render "invalid
+ * token" inline rather than catch an exception.
+ */
+export declare function validateToken(): Promise<ValidateTokenResult>;
+//# sourceMappingURL=accounts.d.ts.map

package/dist/platform/projects-client/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../src/platform/projects-client/accounts.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAA0B,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAE7F,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb;;yEAEqE;IACrE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,WAAW,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC9B;sEACkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;yBACqB;IACrB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IACE,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,WAAW,CAAC;CAC3B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,WAAW,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAEN,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,WAAW,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,WAAW,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oBAAoB,EAAE,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oBAAoB,EAAE,KAAK,CAAC;IAC5B,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,IAAI,CAAC;IACb,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,MAAM,qBAAqB,GAC7B,yBAAyB,GACzB,6BAA6B,CAAC;AAElC,wBAAsB,YAAY,6BAEjC;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,0BAE1D;AAED,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,0BAEjD;AAED,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,0BAItE;AAED,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,4BAIzD;AAED,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,WAAW,CAAA;CAAE;YA5FhC,OAAO;aACN,MAAM;WACR,MAAM;kBACC,WAAW;;YAGjB,SAAS;eACN,MAAM;WACV,MAAM;kBACC,WAAW;gBACb,MAAM;gBACN,MAAM;gBACN,OAAO;uBACA,MAAM,GAAG,IAAI;GA2FrC;AAED,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,gCAIzD;AAED,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;QAE3C,OAAO;GAIxC;AAED,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,+BAO5E;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,sEAU3D;AAED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM;gBAElB,MAAM;kBAAgB,WAAW;GAKxE;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM;QAE3B,OAAO;GAKtC;AAED,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;QAEzC,OAAO;GAIxC;AAED,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,0BAQlB;AAED,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM;QAEpB,OAAO;GAEtC;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAEjC;AAED,qGAAqG;AACrG,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE;QACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,UAAU,EAAE,KAAK,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;QACpC,UAAU,EAAE,KAAK,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;KACrC,CAAC;IACF,QAAQ,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAMlE"}

package/dist/platform/projects-client/accounts.js

@@ -0,0 +1,78 @@
+// Accounts — account CRUD, members, and account-level invitations.
+import { backendApi } from '../api-client.js';
+import { serverTokenGet, unwrap } from './shared.js';
+export async function listAccounts() {
+    return unwrap(await backendApi.get('/accounts'));
+}
+export async function createAccount(input) {
+    return unwrap(await backendApi.post('/accounts', input));
+}
+export async function getAccount(accountId) {
+    return unwrap(await backendApi.get(`/accounts/${accountId}`));
+}
+export async function updateAccountName(accountId, name) {
+    return unwrap(await backendApi.patch(`/accounts/${accountId}`, { name }));
+}
+export async function listAccountMembers(accountId) {
+    return unwrap(await backendApi.get(`/accounts/${accountId}/members`));
+}
+export async function inviteAccountMember(accountId, input) {
+    return unwrap(await backendApi.post(`/accounts/${accountId}/members`, input, {
+        // 409 (already member) is an expected business error; page surfaces it inline.
+        showErrors: false,
+    }));
+}
+export async function listAccountInvites(accountId) {
+    return unwrap(await backendApi.get(`/accounts/${accountId}/invites`));
+}
+export async function cancelAccountInvite(accountId, inviteId) {
+    return unwrap(await backendApi.delete(`/accounts/${accountId}/invites/${inviteId}`));
+}
+export async function resendAccountInvite(accountId, inviteId) {
+    return unwrap(await backendApi.post(`/accounts/${accountId}/invites/${inviteId}/resend`, {}));
+}
+export async function describeAccountInvite(inviteId) {
+    return unwrap(await backendApi.get(`/account-invites/${inviteId}`, {
+        // The redirect/landing page handles "not for you" / expired states inline.
+        showErrors: false,
+    }));
+}
+export async function acceptAccountInvite(inviteId) {
+    return unwrap(await backendApi.post(`/account-invites/${inviteId}/accept`, {}));
+}
+export async function declineAccountInvite(inviteId) {
+    return unwrap(await backendApi.post(`/account-invites/${inviteId}/decline`, {}));
+}
+export async function removeAccountMember(accountId, userId) {
+    return unwrap(await backendApi.delete(`/accounts/${accountId}/members/${userId}`));
+}
+export async function updateAccountMemberRole(accountId, userId, role) {
+    return unwrap(await backendApi.patch(`/accounts/${accountId}/members/${userId}`, { role }));
+}
+export async function leaveAccount(accountId) {
+    return unwrap(await backendApi.post(`/accounts/${accountId}/leave`, {}));
+}
+/**
+ * Server-side / explicit-token variant of {@link listAccounts}. Next.js
+ * server actions and route handlers (e.g. the post-signup first-project
+ * bootstrap) run per-request and already hold the caller's access token —
+ * they must not rely on the SDK's process-wide `configureKortix()` seam.
+ * Returns `null` on any failure.
+ */
+export async function fetchAccountsWithToken(opts) {
+    return serverTokenGet(opts, '/v1/accounts');
+}
+/**
+ * The "did I paste a valid API key?" check — hits `GET /accounts/me` and
+ * NEVER throws, unlike every other call in this module. Built for a
+ * pasted-token UX (a CLI/SDK setup screen) that wants to render "invalid
+ * token" inline rather than catch an exception.
+ */
+export async function validateToken() {
+    const res = await backendApi.get('/accounts/me', { showErrors: false });
+    if (!res.success || !res.data) {
+        return { valid: false, error: res.error };
+    }
+    return { valid: true, identity: res.data };
+}
+//# sourceMappingURL=accounts.js.map

package/dist/platform/projects-client/accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../src/platform/projects-client/accounts.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,EAAE,cAAc,EAAE,MAAM,EAA6C,MAAM,UAAU,CAAC;AAiH7F,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,OAAO,MAAM,CAAC,MAAM,UAAU,CAAC,GAAG,CAAkB,WAAW,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAuB;IACzD,OAAO,MAAM,CAAC,MAAM,UAAU,CAAC,IAAI,CAAgB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB;IAChD,OAAO,MAAM,CAAC,MAAM,UAAU,CAAC,GAAG,CAAgB,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,IAAY;IACrE,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,KAAK,CAAgB,aAAa,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAiB;IACxD,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAAkB,aAAa,SAAS,UAAU,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,KAA4C;IAE5C,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,UAAU,EAChC,KAAK,EACL;QACE,+EAA+E;QAC/E,UAAU,EAAE,KAAK;KAClB,CACF,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAiB;IACxD,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAAsB,aAAa,SAAS,UAAU,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,QAAgB;IAC3E,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,MAAM,CACrB,aAAa,SAAS,YAAY,QAAQ,EAAE,CAC7C,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,QAAgB;IAC3E,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,YAAY,QAAQ,SAAS,EACnD,EAAE,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAgB;IAC1D,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,oBAAoB,QAAQ,EAAE,EAC9B;QACE,2EAA2E;QAC3E,UAAU,EAAE,KAAK;KAClB,CACF,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,oBAAoB,QAAQ,SAAS,EACrC,EAAE,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,oBAAoB,QAAQ,UAAU,EACtC,EAAE,CACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc;IACzE,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,MAAM,CACrB,aAAa,SAAS,YAAY,MAAM,EAAE,CAC3C,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,MAAc,EACd,IAAiB;IAEjB,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,KAAK,CACpB,aAAa,SAAS,YAAY,MAAM,EAAE,EAC1C,EAAE,IAAI,EAAE,CACT,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB;IAClD,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CAAkB,aAAa,SAAS,QAAQ,EAAE,EAAE,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAwB;IAExB,OAAO,cAAc,CAAkB,IAAI,EAAE,cAAc,CAAC,CAAC;AAC/D,CAAC;AAuBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAkB,cAAc,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC"}