@kortix/sdk 0.9.98

package/dist/platform/projects-client/sessions.d.ts

@@ -0,0 +1,216 @@
+import { type ConnectorSharing } from './shared.js';
+export type ProjectSessionStatus = 'queued' | 'branching' | 'provisioning' | 'running' | 'stopped' | 'failed' | 'completed';
+export interface ProjectSession {
+    session_id: string;
+    account_id: string;
+    project_id: string;
+    branch_name: string;
+    base_ref: string;
+    sandbox_provider: string | null;
+    sandbox_id: string;
+    sandbox_url: string | null;
+    opencode_session_id: string | null;
+    /**
+     * Resolved display name: the user-set `custom_name` if present, otherwise the
+     * auto title mirrored from OpenCode server-side during project session reads.
+     */
+    name: string | null;
+    /**
+     * The user-set name override (metadata.custom_name). Authoritative — when
+     * present it always wins over the server-mirrored OpenCode title. null = no
+     * override (display falls back to the auto title / branch).
+     */
+    custom_name: string | null;
+    agent_name: string | null;
+    status: ProjectSessionStatus;
+    error: string | null;
+    metadata: Record<string, unknown>;
+    opencode_sessions: ProjectOpenCodeSession[];
+    created_by?: string | null;
+    owner_email?: string | null;
+    visibility?: 'private' | 'project' | 'restricted';
+    sharing?: ConnectorSharing | null;
+    is_owner?: boolean;
+    can_manage_sharing?: boolean;
+    created_at: string;
+    updated_at: string;
+}
+export interface ProjectOpenCodeSession {
+    id: string;
+    title: string | null;
+    parent_id: string | null;
+    project_id: string | null;
+    created_at: number | null;
+    updated_at: number | null;
+    archived_at: number | null;
+}
+export declare function listProjectSessions(projectId: string): Promise<ProjectSession[]>;
+/**
+ * Set who can see/open a session (private | project | members). Owner or
+ * project manager only. Reuses the connector/secret sharing intent shape.
+ */
+export declare function setProjectSessionSharing(projectId: string, sessionId: string, intent: ConnectorSharing): Promise<ProjectSession>;
+export interface SessionPreviewCandidate {
+    id: string;
+    label: string;
+    port: number;
+    path: string;
+    status: 'online' | 'offline' | 'unknown';
+    source: string;
+}
+export interface SessionPublicShare {
+    share_id: string;
+    session_id: string;
+    project_id: string;
+    resource_type: 'preview' | 'file' | string;
+    label: string;
+    port: number | null;
+    path: string;
+    file_path: string | null;
+    mode: 'view' | 'interactive' | string;
+    allow_websocket: boolean;
+    expires_at: string | null;
+    revoked_at: string | null;
+    created_at: string;
+    updated_at: string;
+    public_token?: string;
+    public_path?: string;
+    proxy_path?: string;
+}
+export interface CreateSessionPublicShareInput {
+    preview_id?: string;
+    preview?: {
+        label?: string;
+        url?: string;
+        port?: number;
+        path?: string;
+    };
+    file?: {
+        label?: string;
+        path: string;
+    };
+    mode?: 'view' | 'interactive';
+    label?: string;
+    expires_at?: string | null;
+}
+export declare function getSessionPreviewCandidates(projectId: string, sessionId: string): Promise<{
+    candidates: SessionPreviewCandidate[];
+}>;
+export declare function listSessionPublicShares(projectId: string, sessionId: string): Promise<{
+    shares: SessionPublicShare[];
+}>;
+export declare function createSessionPublicShare(projectId: string, sessionId: string, input: CreateSessionPublicShareInput): Promise<{
+    share: SessionPublicShare;
+}>;
+export declare function revokeSessionPublicShare(projectId: string, sessionId: string, shareId: string): Promise<{
+    share: SessionPublicShare;
+}>;
+export declare function createProjectSession(projectId: string, input?: {
+    base_ref?: string;
+    agent_name?: string;
+    /** Slug of the sandbox template to boot from. Defaults to "default". */
+    sandbox_slug?: string;
+    initial_prompt?: string;
+    name?: string;
+    /**
+     * Client-generated session id. The API accepts any RFC 4122 v4 UUID;
+     * we use this so the FE can navigate optimistically the moment the user
+     * clicks "send" — the page renders before the POST has even returned.
+     */
+    session_id?: string;
+}): Promise<ProjectSession>;
+export declare function getProjectSession(projectId: string, sessionId: string, options?: {
+    showErrors?: boolean;
+}): Promise<ProjectSession>;
+/** One governed action an agent took in a session (from the executor audit). */
+export interface SessionAuditAction {
+    execution_id: string;
+    action: string;
+    connector_id: string | null;
+    /** Connector slug — `${connector}.${action}` is the fully-qualified tool
+     *  path project policies match against. Null on very old rows whose
+     *  connector was deleted. */
+    connector?: string | null;
+    /** ok | error | denied | pending_approval */
+    status: string;
+    /** read | write | destructive | null */
+    risk: string | null;
+    acted_by: string | null;
+    acted_by_email: string | null;
+    /** Who resolved the gated action — set for both approve and deny; null while
+     *  still awaiting a decision. */
+    resolved_by: string | null;
+    resolved_by_email: string | null;
+    result_summary: Record<string, unknown> | null;
+    at: string;
+    resolved_at: string | null;
+}
+export interface SessionAudit {
+    session_id: string;
+    agent: string | null;
+    /** False when the account lacks the Enterprise `auditAccess` entitlement —
+     *  `actions` then contains only unresolved pending approvals, not the full
+     *  historical trail. Absent on older backends (treat as true). */
+    audit_access?: boolean;
+    count: number;
+    actions: SessionAuditAction[];
+}
+/** Per-session audit trail: every executor-gated action the agent took, with its
+ *  risk + allow/ask/block verdict + who resolved it. Visible to anyone who can
+ *  see the session (its launcher + project managers). */
+export declare function getSessionAudit(projectId: string, sessionId: string, limit?: number, options?: {
+    showErrors?: boolean;
+}): Promise<SessionAudit>;
+export interface SessionTranscriptToolCall {
+    tool: string;
+    status: string | null;
+}
+export interface SessionTranscriptMessage {
+    role: string;
+    created: string | null;
+    completed: string | null;
+    text: string;
+    tools: SessionTranscriptToolCall[];
+    files: Array<{
+        filename: string | null;
+        mime: string | null;
+    }>;
+    reasoning_omitted: boolean;
+    error: {
+        name?: string;
+        message?: string;
+    } | null;
+}
+/** Compact server-side transcript read — text + tool calls, stripped of tool
+ *  inputs/outputs, for project automation (callable with project-scoped
+ *  session tokens, unlike the raw sandbox proxy). */
+export interface SessionTranscript {
+    available: boolean;
+    reason: string | null;
+    opencode_session_id: string | null;
+    message_count: number;
+    messages: SessionTranscriptMessage[];
+}
+export declare function getSessionTranscript(projectId: string, sessionId: string, options?: {
+    limit?: number;
+    chars?: number;
+}): Promise<SessionTranscript>;
+export declare function updateProjectSession(projectId: string, sessionId: string, input: {
+    name?: string;
+    metadata?: Record<string, unknown>;
+}): Promise<ProjectSession>;
+export declare function deleteProjectSession(projectId: string, sessionId: string): Promise<{
+    ok: boolean;
+}>;
+export declare function restartProjectSession(projectId: string, sessionId: string): Promise<{
+    ok: boolean;
+    session_id: string;
+    status: string;
+}>;
+/** Manual pause: stops the running sandbox in place, resumable via start(). */
+export declare function stopProjectSession(projectId: string, sessionId: string): Promise<{
+    ok: boolean;
+    session_id: string;
+    status: string;
+}>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/platform/projects-client/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../src/platform/projects-client/sessions.ts"],"names":[],"mappings":"AAIA,OAAO,EAAU,KAAK,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAQzD,MAAM,MAAM,oBAAoB,GAC5B,QAAQ,GACR,WAAW,GACX,cAAc,GACd,SAAS,GACT,SAAS,GACT,QAAQ,GACR,WAAW,CAAC;AAEhB,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;IAE5C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAClD,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,6BAI1D;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,2BAQzB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,MAAM,CAAC;IACtC,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;gBAE/C,uBAAuB,EAAE;GAI/D;AAED,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;YAE/C,kBAAkB,EAAE;GAKtD;AAED,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,6BAA6B;WAGH,kBAAkB;GAKpD;AAED,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM;WAGoB,kBAAkB;GAItD;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;IACN,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,2BAkBF;AAED,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,2BAQnC;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;iCAE6B;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;qCACiC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;sEAEkE;IAClE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAED;;yDAEyD;AACzD,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,yBAQnC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACnC,KAAK,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC/D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACnD;AAED;;qDAEqD;AACrD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,wBAAwB,EAAE,CAAC;CACtC;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,8BAW7C;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IACL,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,2BAQF;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;QAGe,OAAO;GAIxC;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;QAGa,OAAO;gBAAc,MAAM;YAAU,MAAM;GAK1E;AAED,+EAA+E;AAC/E,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;QAGa,OAAO;gBAAc,MAAM;YAAU,MAAM;GAK1E"}

package/dist/platform/projects-client/sessions.js

@@ -0,0 +1,74 @@
+// Project sessions — session CRUD, sharing, public shares, preview candidates.
+import { backendApi } from '../api-client.js';
+import { markSessionFresh } from '../fresh-sessions.js';
+import { unwrap } from './shared.js';
+export async function listProjectSessions(projectId) {
+    return unwrap(await backendApi.get(`/projects/${projectId}/sessions`));
+}
+/**
+ * Set who can see/open a session (private | project | members). Owner or
+ * project manager only. Reuses the connector/secret sharing intent shape.
+ */
+export async function setProjectSessionSharing(projectId, sessionId, intent) {
+    return unwrap(await backendApi.put(`/projects/${projectId}/sessions/${sessionId}/sharing`, intent));
+}
+export async function getSessionPreviewCandidates(projectId, sessionId) {
+    return unwrap(await backendApi.get(`/projects/${projectId}/sessions/${sessionId}/previews`));
+}
+export async function listSessionPublicShares(projectId, sessionId) {
+    return unwrap(await backendApi.get(`/projects/${projectId}/sessions/${sessionId}/public-shares`, { showErrors: false }));
+}
+export async function createSessionPublicShare(projectId, sessionId, input) {
+    return unwrap(await backendApi.post(`/projects/${projectId}/sessions/${sessionId}/public-shares`, input));
+}
+export async function revokeSessionPublicShare(projectId, sessionId, shareId) {
+    return unwrap(await backendApi.delete(`/projects/${projectId}/sessions/${sessionId}/public-shares/${shareId}`));
+}
+export async function createProjectSession(projectId, input) {
+    const session = unwrap(await backendApi.post(`/projects/${projectId}/sessions`, input ?? {}));
+    // Mark freshly-created EMPTY sessions so the session page shows the instant
+    // typeable shell instead of the resume loader. THE chokepoint for every empty
+    // project-session create path (sidebar button, ⌘T shortcut, command palette).
+    // `session_id` is exactly the route param those navigations land on.
+    // Skip when an initial_prompt is set: those sessions get a server-side reply,
+    // so they must mount the real chat to stream it (the shell would hold it back).
+    if (!input?.initial_prompt) {
+        markSessionFresh(session?.session_id);
+    }
+    return session;
+}
+export async function getProjectSession(projectId, sessionId, options) {
+    return unwrap(await backendApi.get(`/projects/${projectId}/sessions/${sessionId}`, { showErrors: options?.showErrors }));
+}
+/** Per-session audit trail: every executor-gated action the agent took, with its
+ *  risk + allow/ask/block verdict + who resolved it. Visible to anyone who can
+ *  see the session (its launcher + project managers). */
+export async function getSessionAudit(projectId, sessionId, limit, options) {
+    const qs = limit ? `?limit=${limit}` : '';
+    return unwrap(await backendApi.get(`/projects/${projectId}/sessions/${sessionId}/audit${qs}`, {
+        showErrors: options?.showErrors,
+    }));
+}
+export async function getSessionTranscript(projectId, sessionId, options) {
+    const search = new URLSearchParams();
+    if (options?.limit != null)
+        search.set('limit', String(options.limit));
+    if (options?.chars != null)
+        search.set('chars', String(options.chars));
+    const qs = search.toString();
+    return unwrap(await backendApi.get(`/projects/${projectId}/sessions/${sessionId}/transcript${qs ? `?${qs}` : ''}`));
+}
+export async function updateProjectSession(projectId, sessionId, input) {
+    return unwrap(await backendApi.patch(`/projects/${projectId}/sessions/${sessionId}`, input));
+}
+export async function deleteProjectSession(projectId, sessionId) {
+    return unwrap(await backendApi.delete(`/projects/${projectId}/sessions/${sessionId}`));
+}
+export async function restartProjectSession(projectId, sessionId) {
+    return unwrap(await backendApi.post(`/projects/${projectId}/sessions/${sessionId}/restart`, {}));
+}
+/** Manual pause: stops the running sandbox in place, resumable via start(). */
+export async function stopProjectSession(projectId, sessionId) {
+    return unwrap(await backendApi.post(`/projects/${projectId}/sessions/${sessionId}/stop`, {}));
+}
+//# sourceMappingURL=sessions.js.map

package/dist/platform/projects-client/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/platform/projects-client/sessions.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAyB,MAAM,UAAU,CAAC;AAgEzD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAAmB,aAAa,SAAS,WAAW,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAiB,EACjB,SAAiB,EACjB,MAAwB;IAExB,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,aAAa,SAAS,aAAa,SAAS,UAAU,EACtD,MAAM,CACP,CACF,CAAC;AACJ,CAAC;AAgDD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,SAAiB,EAAE,SAAiB;IACpF,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,aAAa,SAAS,aAAa,SAAS,WAAW,CACxD,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,SAAiB,EAAE,SAAiB;IAChF,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,aAAa,SAAS,aAAa,SAAS,gBAAgB,EAC5D,EAAE,UAAU,EAAE,KAAK,EAAE,CACtB,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAiB,EACjB,SAAiB,EACjB,KAAoC;IAEpC,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,aAAa,SAAS,gBAAgB,EAC5D,KAAK,CACN,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAiB,EACjB,SAAiB,EACjB,OAAe;IAEf,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,MAAM,CACrB,aAAa,SAAS,aAAa,SAAS,kBAAkB,OAAO,EAAE,CACxE,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,KAaC;IAED,MAAM,OAAO,GAAG,MAAM,CACpB,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,WAAW,EACjC,KAAK,IAAI,EAAE,CACZ,CACF,CAAC;IACF,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,8EAA8E;IAC9E,gFAAgF;IAChF,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC;QAC3B,gBAAgB,CAAE,OAAsC,EAAE,UAAU,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAiB,EACjB,SAAiB,EACjB,OAAkC;IAElC,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,aAAa,SAAS,aAAa,SAAS,EAAE,EAC9C,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CACpC,CACF,CAAC;AACJ,CAAC;AAqCD;;yDAEyD;AACzD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,SAAiB,EACjB,KAAc,EACd,OAAkC;IAElC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAAe,aAAa,SAAS,aAAa,SAAS,SAAS,EAAE,EAAE,EAAE;QAC5F,UAAU,EAAE,OAAO,EAAE,UAAU;KAChC,CAAC,CACH,CAAC;AACJ,CAAC;AA6BD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,SAAiB,EACjB,OAA4C;IAE5C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,OAAO,EAAE,KAAK,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,EAAE,KAAK,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC7B,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAClB,aAAa,SAAS,aAAa,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/E,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,SAAiB,EACjB,KAGC;IAED,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,KAAK,CACpB,aAAa,SAAS,aAAa,SAAS,EAAE,EAC9C,KAAK,CACN,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,SAAiB;IAEjB,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,MAAM,CACrB,aAAa,SAAS,aAAa,SAAS,EAAE,CAC/C,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,SAAiB;IAEjB,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,aAAa,SAAS,UAAU,EACtD,EAAE,CACH,CACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,SAAiB;IAEjB,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,aAAa,SAAS,OAAO,EACnD,EAAE,CACH,CACF,CAAC;AACJ,CAAC"}

package/dist/platform/projects-client/setup-links.d.ts

@@ -0,0 +1,35 @@
+export interface RequestProjectSecretInput {
+    /** One or more env var names to request (A-Z, 0-9, _; max 64 chars each). */
+    names: string[];
+    /** Optional per-name display label, keyed by name. */
+    labels?: Record<string, string>;
+    /** Optional per-name description, keyed by name. */
+    descriptions?: Record<string, string>;
+    /** `'runtime'` (project secret, default) or `'connector'` (connector credential). */
+    scope?: 'runtime' | 'connector';
+    expiresInMinutes?: number;
+}
+export interface SecretRequestLink {
+    kind: 'secret';
+    url: string;
+    names: string[];
+    scope: 'runtime' | 'connector';
+    expires_at: string;
+}
+/** Mint a link a human opens to enter one or more secret values. */
+export declare function requestProjectSecret(projectId: string, input: RequestProjectSecretInput): Promise<SecretRequestLink>;
+export interface RequestProjectConnectorInput {
+    /** The Pipedream connector slug (already declared in kortix.toml). */
+    slug: string;
+    expiresInMinutes?: number;
+}
+export interface ConnectorRequestLink {
+    kind: 'connector';
+    url: string;
+    slug: string;
+    app: string;
+    expires_at: string;
+}
+/** Mint a link a human opens to 1-click connect a Pipedream app (Quick Connect). */
+export declare function requestProjectConnector(projectId: string, input: RequestProjectConnectorInput): Promise<ConnectorRequestLink>;
+//# sourceMappingURL=setup-links.d.ts.map

package/dist/platform/projects-client/setup-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-links.d.ts","sourceRoot":"","sources":["../../../src/platform/projects-client/setup-links.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,yBAAyB;IACxC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,qFAAqF;IACrF,KAAK,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,SAAS,GAAG,WAAW,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,oEAAoE;AACpE,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAW5B;AAED,MAAM,WAAW,4BAA4B;IAC3C,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,oFAAoF;AACpF,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAQ/B"}

package/dist/platform/projects-client/setup-links.js

@@ -0,0 +1,24 @@
+// Agent-minted SETUP LINKS — short-lived links the in-sandbox agent mints so
+// a human can (a) enter a project secret VALUE, or (b) 1-click connect a
+// Pipedream app, without the agent ever seeing the value/credential itself.
+// See apps/api/src/projects/routes/setup-links.ts for the server-side handlers.
+import { backendApi } from '../api-client.js';
+import { unwrap } from './shared.js';
+/** Mint a link a human opens to enter one or more secret values. */
+export async function requestProjectSecret(projectId, input) {
+    return unwrap(await backendApi.post(`/projects/${projectId}/secret-requests`, {
+        names: input.names,
+        labels: input.labels,
+        descriptions: input.descriptions,
+        scope: input.scope,
+        expires_in_minutes: input.expiresInMinutes,
+    }), 'Failed to mint secret-entry link');
+}
+/** Mint a link a human opens to 1-click connect a Pipedream app (Quick Connect). */
+export async function requestProjectConnector(projectId, input) {
+    return unwrap(await backendApi.post(`/projects/${projectId}/connect-requests`, {
+        slug: input.slug,
+        expires_in_minutes: input.expiresInMinutes,
+    }), 'Failed to mint connect link');
+}
+//# sourceMappingURL=setup-links.js.map

package/dist/platform/projects-client/setup-links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-links.js","sourceRoot":"","sources":["../../../src/platform/projects-client/setup-links.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,gFAAgF;AAEhF,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAsBlC,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,KAAgC;IAEhC,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CAAoB,aAAa,SAAS,kBAAkB,EAAE;QACjF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,kBAAkB,EAAE,KAAK,CAAC,gBAAgB;KAC3C,CAAC,EACF,kCAAkC,CACnC,CAAC;AACJ,CAAC;AAgBD,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,KAAmC;IAEnC,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CAAuB,aAAa,SAAS,mBAAmB,EAAE;QACrF,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,kBAAkB,EAAE,KAAK,CAAC,gBAAgB;KAC3C,CAAC,EACF,6BAA6B,CAC9B,CAAC;AACJ,CAAC"}

package/dist/platform/projects-client/shared.d.ts

@@ -0,0 +1,66 @@
+export type AccountRole = 'owner' | 'admin' | 'member';
+export type ProjectRole = 'manager' | 'editor' | 'member';
+export type ConnectorSharing = {
+    mode: 'project';
+} | {
+    mode: 'private';
+    ownerId: string;
+} | {
+    mode: 'members';
+    memberIds?: string[];
+    groupIds?: string[];
+};
+export interface ProjectGitConnection {
+    connection_id: string;
+    account_id: string;
+    project_id: string;
+    provider: string;
+    repo_url: string;
+    repo_owner: string | null;
+    repo_name: string | null;
+    external_repo_id: string | null;
+    default_branch: string;
+    auth_method: string;
+    installation_id: string | null;
+    visibility: string | null;
+    status: string;
+    last_validated_at: string | null;
+    last_error_code: string | null;
+    last_error_message: string | null;
+    metadata: Record<string, unknown>;
+    created_at: string;
+    updated_at: string;
+}
+export interface ProjectFileEntry {
+    path: string;
+    type: 'file';
+    size: number | null;
+}
+/**
+ * Unwrap a `backendApi` response, throwing on failure. `fallbackMessage` is
+ * used only when the response carries no `error` of its own (e.g. a 200 whose
+ * body is missing/empty) — pass the old per-endpoint string a call site had
+ * before it was consolidated onto this shared helper, so failures still read
+ * like "Failed to connect" instead of a generic "Project request failed".
+ */
+export declare function unwrap<T>(response: {
+    data?: T;
+    success: boolean;
+    error?: Error;
+}, fallbackMessage?: string): T & ({} | null);
+export interface ServerTokenOptions {
+    /** Absolute backend base URL, with or without a trailing `/v1`. */
+    backendUrl: string;
+    /** Caller's bearer token (Supabase JWT), already resolved server-side. */
+    accessToken: string;
+    timeoutMs?: number;
+}
+export declare function normalizeServerBackendBase(backendUrl: string): string;
+/**
+ * Best-effort explicit-token GET. Returns `null` on any non-2xx status,
+ * network error, or missing credentials — every current caller is a
+ * best-effort server-side lookup that falls back to a default when the read
+ * fails, never something that must throw.
+ */
+export declare function serverTokenGet<T>(opts: ServerTokenOptions, path: string): Promise<T | null>;
+//# sourceMappingURL=shared.d.ts.map

package/dist/platform/projects-client/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/platform/projects-client/shared.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AACvD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE1D,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,CAAC,EACtB,QAAQ,EAAE;IAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,EACvD,eAAe,SAA2B,mBAM3C;AAuBD,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAgBnB"}

package/dist/platform/projects-client/shared.js

@@ -0,0 +1,44 @@
+// Shared helpers + cross-cutting types used by multiple projects-client modules.
+/**
+ * Unwrap a `backendApi` response, throwing on failure. `fallbackMessage` is
+ * used only when the response carries no `error` of its own (e.g. a 200 whose
+ * body is missing/empty) — pass the old per-endpoint string a call site had
+ * before it was consolidated onto this shared helper, so failures still read
+ * like "Failed to connect" instead of a generic "Project request failed".
+ */
+export function unwrap(response, fallbackMessage = 'Project request failed') {
+    if (!response.success || response.data === undefined) {
+        throw response.error ?? new Error(fallbackMessage);
+    }
+    return response.data;
+}
+export function normalizeServerBackendBase(backendUrl) {
+    return backendUrl.replace(/\/v1\/?$/, '');
+}
+/**
+ * Best-effort explicit-token GET. Returns `null` on any non-2xx status,
+ * network error, or missing credentials — every current caller is a
+ * best-effort server-side lookup that falls back to a default when the read
+ * fails, never something that must throw.
+ */
+export async function serverTokenGet(opts, path) {
+    if (!opts.backendUrl || !opts.accessToken)
+        return null;
+    const base = normalizeServerBackendBase(opts.backendUrl);
+    try {
+        const res = await fetch(`${base}${path}`, {
+            headers: {
+                Authorization: `Bearer ${opts.accessToken}`,
+                'Content-Type': 'application/json',
+            },
+            signal: AbortSignal.timeout(opts.timeoutMs ?? 8000),
+        });
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=shared.js.map

package/dist/platform/projects-client/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/platform/projects-client/shared.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAsCjF;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CACpB,QAAuD,EACvD,eAAe,GAAG,wBAAwB;IAE1C,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,QAAQ,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AA+BD,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAwB,EACxB,IAAY;IAEZ,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YACxC,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/platform/projects-client/tokens.d.ts

@@ -0,0 +1,77 @@
+/** One account-scoped CLI PAT (secret never returned again after creation). */
+export interface AccountToken {
+    token_id: string;
+    name: string;
+    /** Set when this token was minted project-scoped (still visible from the
+     *  account-wide list). */
+    project_id: string | null;
+    public_key: string;
+    status: string;
+    expires_at: string | null;
+    last_used_at: string | null;
+    created_at: string;
+    revoked_at: string | null;
+}
+export interface CreateAccountTokenInput {
+    name: string;
+    /** Defaults to the caller's resolved account when omitted. */
+    accountId?: string;
+    /** ISO-8601. Omit for a non-expiring token. */
+    expiresAt?: string;
+    /** Scope the minted token to a single project (still a "kortix_pat_..." token,
+     *  but the auth middleware rejects it outside this project). */
+    projectId?: string;
+}
+/** The newly minted token — `secret_key` is the plaintext PAT, returned ONCE. */
+export interface CreatedAccountToken {
+    token_id: string;
+    name: string;
+    project_id: string | null;
+    public_key: string;
+    secret_key: string;
+    status: string;
+    expires_at: string | null;
+    created_at: string;
+}
+/** List CLI PATs for an account (defaults to the caller's resolved account). */
+export declare function listAccountTokens(accountId?: string): Promise<AccountToken[]>;
+/** Mint a new account-scoped CLI PAT. The `secret_key` is returned once — the
+ *  caller must persist it immediately; subsequent reads only ever see `public_key`. */
+export declare function createAccountToken(input: CreateAccountTokenInput): Promise<CreatedAccountToken>;
+/** Revoke an account-scoped CLI PAT. */
+export declare function revokeAccountToken(tokenId: string, accountId?: string): Promise<{
+    ok: boolean;
+}>;
+export interface ProjectCliToken {
+    token_id: string;
+    name: string;
+    public_key: string;
+    status: string;
+    expires_at: string | null;
+    last_used_at: string | null;
+    created_at: string;
+    revoked_at: string | null;
+}
+export interface ProjectCliTokenListResponse {
+    items: ProjectCliToken[];
+}
+/** The newly minted project-scoped token — `secret_key` is returned once. */
+export interface CreatedProjectCliToken {
+    token_id: string;
+    name: string;
+    public_key: string;
+    secret_key: string;
+    status: string;
+    project_id: string;
+    expires_at: string | null;
+    created_at: string;
+}
+export declare function listProjectCliTokens(projectId: string): Promise<ProjectCliTokenListResponse>;
+/** Mint a project-scoped CLI PAT. Defaults `name` to "cli · <project name>" server-side. */
+export declare function createProjectCliToken(projectId: string, input?: {
+    name?: string;
+}): Promise<CreatedProjectCliToken>;
+export declare function revokeProjectCliToken(projectId: string, tokenId: string): Promise<{
+    ok: boolean;
+}>;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/platform/projects-client/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/platform/projects-client/tokens.ts"],"names":[],"mappings":"AAaA,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb;8BAC0B;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;oEACgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,gFAAgF;AAChF,wBAAsB,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,2BAGzD;AAED;uFACuF;AACvF,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,gCAUtE;AAED,wCAAwC;AACxC,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;QAG1C,OAAO;GAExC;AASD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,6EAA6E;AAC7E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,wCAI3D;AAED,4FAA4F;AAC5F,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,mCAQ1B;AAED,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;QAE5C,OAAO;GAIxC"}

package/dist/platform/projects-client/tokens.js

@@ -0,0 +1,43 @@
+// CLI PAT minting — account-scoped personal access tokens (`kortix_pat_...`)
+// and their project-scoped siblings. Both mint via the same backend
+// repository (`repositories/account-tokens.ts`); the project-scoped route
+// additionally binds the minted token to one `project_id` (the auth
+// middleware then rejects it outside that project). These are the tokens
+// the CLI / "Kortix as a Backend" hosts use to authenticate without a human
+// Supabase session — the account variant is minted by a human from
+// account settings, the project variant is auto-minted at session-create
+// time and injected into the sandbox as `KORTIX_TOKEN`.
+import { backendApi } from '../api-client.js';
+import { unwrap } from './shared.js';
+/** List CLI PATs for an account (defaults to the caller's resolved account). */
+export async function listAccountTokens(accountId) {
+    const qs = accountId ? `?account_id=${encodeURIComponent(accountId)}` : '';
+    return unwrap(await backendApi.get(`/accounts/tokens${qs}`));
+}
+/** Mint a new account-scoped CLI PAT. The `secret_key` is returned once — the
+ *  caller must persist it immediately; subsequent reads only ever see `public_key`. */
+export async function createAccountToken(input) {
+    const { accountId, expiresAt, projectId, name } = input;
+    return unwrap(await backendApi.post('/accounts/tokens', {
+        name,
+        ...(accountId ? { account_id: accountId } : {}),
+        ...(expiresAt ? { expires_at: expiresAt } : {}),
+        ...(projectId ? { project_id: projectId } : {}),
+    }));
+}
+/** Revoke an account-scoped CLI PAT. */
+export async function revokeAccountToken(tokenId, accountId) {
+    const qs = accountId ? `?account_id=${encodeURIComponent(accountId)}` : '';
+    return unwrap(await backendApi.delete(`/accounts/tokens/${tokenId}${qs}`));
+}
+export async function listProjectCliTokens(projectId) {
+    return unwrap(await backendApi.get(`/projects/${projectId}/cli-token`));
+}
+/** Mint a project-scoped CLI PAT. Defaults `name` to "cli · <project name>" server-side. */
+export async function createProjectCliToken(projectId, input) {
+    return unwrap(await backendApi.post(`/projects/${projectId}/cli-token`, input ?? {}));
+}
+export async function revokeProjectCliToken(projectId, tokenId) {
+    return unwrap(await backendApi.delete(`/projects/${projectId}/cli-token/${tokenId}`));
+}
+//# sourceMappingURL=tokens.js.map

package/dist/platform/projects-client/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/platform/projects-client/tokens.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,oEAAoE;AACpE,0EAA0E;AAC1E,oEAAoE;AACpE,yEAAyE;AACzE,4EAA4E;AAC5E,mEAAmE;AACnE,yEAAyE;AACzE,wDAAwD;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAwClC,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAkB;IACxD,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,OAAO,MAAM,CAAC,MAAM,UAAU,CAAC,GAAG,CAAiB,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;uFACuF;AACvF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B;IACrE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACxD,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CAAsB,kBAAkB,EAAE;QAC7D,IAAI;QACJ,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAAkB;IAC1E,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,MAAM,CAAkB,oBAAoB,OAAO,GAAG,EAAE,EAAE,CAAC,CAC7E,CAAC;AACJ,CAAC;AAoCD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB;IAC1D,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,GAAG,CAA8B,aAAa,SAAS,YAAY,CAAC,CACtF,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,KAAyB;IAEzB,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,IAAI,CACnB,aAAa,SAAS,YAAY,EAClC,KAAK,IAAI,EAAE,CACZ,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,SAAiB,EAAE,OAAe;IAC5E,OAAO,MAAM,CACX,MAAM,UAAU,CAAC,MAAM,CACrB,aAAa,SAAS,cAAc,OAAO,EAAE,CAC9C,CACF,CAAC;AACJ,CAAC"}

package/dist/platform/projects-client/transcription.d.ts

@@ -0,0 +1,5 @@
+export interface TranscriptionResponse {
+    text: string;
+}
+export declare function transcribeAudio(audioFile: File): Promise<TranscriptionResponse>;
+//# sourceMappingURL=transcription.d.ts.map

package/dist/platform/projects-client/transcription.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcription.d.ts","sourceRoot":"","sources":["../../../src/platform/projects-client/transcription.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAerF"}