@loams/client 0.1.0-preview.2 → 0.1.0

package/README.md

@@ -2,7 +2,7 @@
 
 # The TypeScript SDK (`@loams/client`)
 
-> **Preview.** `0.1.0-preview.2` tracks the Loams preview server and may change between previews; pin an exact version. Installed with `npm install @loams/client@preview`.
+> **Preview.** `0.1.0` tracks the Loams preview server and may change between previews; pin an exact version. Installed with `npm install @loams/client@preview`.
 
 Design §44 §7 and §10.2: the SDK is a `Loams` object with namespaced modules,
 generated from the `loams.options.v1` annotations on the protos, over the
@@ -23,6 +23,14 @@ sdks/typescript/
 generated package — as a workspace dependency and share one lockfile. The
 generator inputs stay outside the workspace, next to `proto/`.
 
+## Install
+
+```sh
+npm i @loams/client        # and @loams/live for Live's stubs
+```
+
+`0.1.0` tracks Loams 0.1.0; in 0.x the API may change between minor versions. <!-- verify after publish -->
+
 ## Using it
 
 ```ts

package/dist/gen/facade.d.ts

@@ -10,7 +10,7 @@ import type { CallOptions } from '../runtime/call.js';
 import type { AddTeamMemberRequestSchema, AddTeamMemberResponse, CreateAgentRequestSchema, CreateAgentResponse, CreateEnvironmentRequestSchema, CreateEnvironmentResponse, CreateInvitationRequestSchema, CreateInvitationResponse, CreateKeyRequestSchema, CreateKeyResponse, CreateProjectRequestSchema, CreateProjectResponse, CreateServiceAccountRequestSchema, CreateServiceAccountResponse, CreateTeamRequestSchema, CreateTeamResponse, CreateTrustPolicyRequestSchema, CreateTrustPolicyResponse, GetAgentRequestSchema, GetAgentResponse, GetEnvironmentActivityRequestSchema, GetEnvironmentActivityResponse, GetEnvironmentRequestSchema, GetEnvironmentResponse, GetOrgRequestSchema, GetOrgResponse, GetProjectRequestSchema, GetProjectResponse, GetTeamRequestSchema, GetTeamResponse, GrantAccessRequestSchema, GrantAccessResponse, ListAccessRequestSchema, ListAccessResponse, ListAgentTokensRequestSchema, ListAgentTokensResponse, ListAgentsRequestSchema, ListAgentsResponse, ListAuditEventsRequestSchema, ListAuditEventsResponse, ListEnvironmentsRequestSchema, ListEnvironmentsResponse, ListInvitationsRequestSchema, ListInvitationsResponse, ListKeysRequestSchema, ListKeysResponse, ListMembersRequestSchema, ListMembersResponse, ListProjectsRequestSchema, ListProjectsResponse, ListServiceAccountsRequestSchema, ListServiceAccountsResponse, ListTeamsRequestSchema, ListTeamsResponse, ListTrustPoliciesRequestSchema, ListTrustPoliciesResponse, RemoveMemberRequestSchema, RemoveMemberResponse, ResumeAgentRequestSchema, ResumeAgentResponse, RevokeKeyRequestSchema, RevokeKeyResponse, RevokeTokenRequestSchema, RevokeTokenResponse, SuspendAgentRequestSchema, SuspendAgentResponse, UpdateAgentRequestSchema, UpdateAgentResponse, UpdateOrgRequestSchema, UpdateOrgResponse, WatchAuditEventsRequestSchema, WatchAuditEventsResponse } from '../vendor/proto/admin.js';
 import type { CompleteSetupRequestSchema, CompleteSetupResponse, CreateSessionRequestSchema, CreateSessionResponse, DecideConsentRequestSchema, DecideConsentResponse, DeleteSessionRequestSchema, DeleteSessionResponse, GetSessionRequestSchema, GetSessionResponse, ListProvidersRequestSchema, ListProvidersResponse } from '../vendor/proto/gen/loams/auth/v1/auth_pb.js';
 import type { GetInstanceRequestSchema, GetInstanceResponse, WhoAmIRequestSchema, WhoAmIResponse } from '../vendor/proto/gen/loams/instance/v1/instance_pb.js';
-import type { ActivateDeploymentRequestSchema, ActivateDeploymentResponse, DeployRequestSchema, DeployResponse, GetDeploymentRequestSchema, GetDeploymentResponse, GetIndexStatusRequestSchema, GetIndexStatusResponse, ListDeploymentsRequestSchema, ListDeploymentsResponse, ModifyQuerySetRequestSchema, ModifyQuerySetResponse, MutateRequestSchema, MutateResponse, QueryRequestSchema, QueryResponse, TailLogsRequestSchema, TailLogsResponse, Transition, WatchRequestSchema } from '@loams/live/live';
+import type { ActivateDeploymentRequestSchema, ActivateDeploymentResponse, AuthenticateRequestSchema, AuthenticateResponse, CreateAppRequestSchema, CreateAppResponse, DeleteAppRequestSchema, DeleteAppResponse, DeployRequestSchema, DeployResponse, GetAppRequestSchema, GetAppResponse, GetDeploymentRequestSchema, GetDeploymentResponse, GetIndexStatusRequestSchema, GetIndexStatusResponse, ListAppsRequestSchema, ListAppsResponse, ListDeploymentsRequestSchema, ListDeploymentsResponse, ModifyQuerySetRequestSchema, ModifyQuerySetResponse, MutateRequestSchema, MutateResponse, QueryRequestSchema, QueryResponse, TailLogsRequestSchema, TailLogsResponse, Transition, UpdateAppRequestSchema, UpdateAppResponse, WatchRequestSchema } from '@loams/live/live';
 /**
  *  `loams.admin.agents` — Agents, their tokens and trust policies, and service accounts.
  *
@@ -290,6 +290,10 @@ export interface LiveModule {
     readonly service: 'loams.live.v1.LiveService';
     /** Whether the package's wire contract may still change. */
     readonly unstable: true;
+    /**
+     *  `loams.live.v1.LiveService/Authenticate`, retried: manual.
+     */
+    authenticate(request: MessageInitShape<typeof AuthenticateRequestSchema>, options?: CallOptions): Promise<AuthenticateResponse>;
     /**
      *  `loams.live.v1.LiveService/ModifyQuerySet`, retried: manual.
      */
@@ -300,7 +304,7 @@ export interface LiveModule {
     watch(request: MessageInitShape<typeof WatchRequestSchema>, options?: CallOptions): AsyncIterable<Transition>;
 }
 /**
- *  `loams.live.admin` — Live administration: deploy, roll back, index status and function logs.
+ *  `loams.live.admin` — Live administration: apps, deploy, roll back, index status and function logs.
  *
  *  Wraps `loams.live.v1.LiveAdminService`. Its wire contract may still change, so `buf breaking` skips it and an SDK marks it experimental (§44 §10.3).
  */
@@ -315,10 +319,22 @@ export interface LiveAdminModule {
      *  `loams.live.v1.LiveAdminService/ActivateDeployment`, retried: manual.
      */
     activateDeployment(request: MessageInitShape<typeof ActivateDeploymentRequestSchema>, options?: CallOptions): Promise<ActivateDeploymentResponse>;
+    /**
+     *  `loams.live.v1.LiveAdminService/CreateApp`, retried: manual.
+     */
+    createApp(request: MessageInitShape<typeof CreateAppRequestSchema>, options?: CallOptions): Promise<CreateAppResponse>;
+    /**
+     *  `loams.live.v1.LiveAdminService/DeleteApp`, retried: manual.
+     */
+    deleteApp(request: MessageInitShape<typeof DeleteAppRequestSchema>, options?: CallOptions): Promise<DeleteAppResponse>;
     /**
      *  `loams.live.v1.LiveAdminService/Deploy`, retried: manual.
      */
     deploy(request: MessageInitShape<typeof DeployRequestSchema>, options?: CallOptions): Promise<DeployResponse>;
+    /**
+     *  `loams.live.v1.LiveAdminService/GetApp`, retried: safe.
+     */
+    getApp(request: MessageInitShape<typeof GetAppRequestSchema>, options?: CallOptions): Promise<GetAppResponse>;
     /**
      *  `loams.live.v1.LiveAdminService/GetDeployment`, retried: safe.
      */
@@ -327,6 +343,10 @@ export interface LiveAdminModule {
      *  `loams.live.v1.LiveAdminService/GetIndexStatus`, retried: safe.
      */
     getIndexStatus(request: MessageInitShape<typeof GetIndexStatusRequestSchema>, options?: CallOptions): Promise<GetIndexStatusResponse>;
+    /**
+     *  `loams.live.v1.LiveAdminService/ListApps`, retried: safe. AIP-158: page with `apps` and follow `next_page_token` through `loams.paginate`.
+     */
+    listApps(request: MessageInitShape<typeof ListAppsRequestSchema>, options?: CallOptions): Promise<ListAppsResponse>;
     /**
      *  `loams.live.v1.LiveAdminService/ListDeployments`, retried: safe. AIP-158: page with `deployments` and follow `next_page_token` through `loams.paginate`.
      */
@@ -335,6 +355,10 @@ export interface LiveAdminModule {
      *  `loams.live.v1.LiveAdminService/TailLogs`, retried: manual.
      */
     tailLogs(request: MessageInitShape<typeof TailLogsRequestSchema>, options?: CallOptions): AsyncIterable<TailLogsResponse>;
+    /**
+     *  `loams.live.v1.LiveAdminService/UpdateApp`, retried: manual.
+     */
+    updateApp(request: MessageInitShape<typeof UpdateAppRequestSchema>, options?: CallOptions): Promise<UpdateAppResponse>;
 }
 /**
  *  A second facade name for the same RPCs, exposed as `loams.tables`.
@@ -406,7 +430,7 @@ export declare const PROTO_PACKAGES: readonly ["google.protobuf", "loams.admin.v
 *  an API major version a reason is never renamed and never removed, so
 *  this union only grows; a caller switching on it is exhaustive.
 */
-export declare const REASONS: readonly ["approval_expired", "approval_already_decided", "approval_stale_revision", "requester_cannot_approve", "decision_proof_invalid", "step_up_required", "reason_required", "invalid_decision", "pairing_expired", "pairing_used", "device_revoked", "push_target_unknown", "not_implemented", "feature_not_in_variant", "house_not_configured", "house_syntax_error", "house_unknown_table", "house_unknown_database", "house_access_denied", "house_read_only", "house_timeout", "house_memory_limit", "house_too_many_queries", "house_quota_exceeded", "house_disabled_function", "house_cancelled", "house_query_not_found", "house_query_failed", "project_not_found", "branch_has_children", "branch_protected", "lsn_out_of_retention", "endpoint_exists_for_branch", "compute_start_failed", "quota_exceeded", "storage_unavailable", "secret_already_issued", "repo_not_found", "repo_already_exists", "repo_deleting", "ref_stale", "ref_protected", "out_of_scope", "object_format_unsupported", "fork_too_deep", "sequencer_unavailable", "idempotency_key_reused", "workspace_not_found", "workspace_fenced", "workspace_read_only", "workspace_name_taken", "object_missing", "secret_detected", "env_unsealed", "env_access_denied", "env_foreign_reference", "live_bad_cursor", "live_worker_crashed", "live_deploy_conflict", "live_schema_violation", "live_index_not_ready", "role_required", "setup_required", "token_missing", "token_malformed", "token_revoked", "token_not_yet_valid", "token_bad_signature", "token_wrong_audience", "token_wrong_issuer", "token_unknown_key", "token_algorithm_not_allowed", "api_key_invalid", "credential_not_accepted", "credential_in_query_string", "csrf_token_invalid", "principal_not_allowed", "cors_origin_not_allowed", "auth_unavailable", "invalid_argument", "not_found", "already_exists", "permission_denied", "token_expired", "unauthenticated", "failed_precondition", "resource_exhausted", "unavailable", "deadline_exceeded", "aborted", "internal"];
+export declare const REASONS: readonly ["approval_expired", "approval_already_decided", "approval_stale_revision", "requester_cannot_approve", "decision_proof_invalid", "step_up_required", "reason_required", "invalid_decision", "pairing_expired", "pairing_used", "device_revoked", "push_target_unknown", "not_implemented", "feature_not_in_variant", "house_not_configured", "house_syntax_error", "house_unknown_table", "house_unknown_database", "house_access_denied", "house_read_only", "house_timeout", "house_memory_limit", "house_too_many_queries", "house_quota_exceeded", "house_disabled_function", "house_cancelled", "house_query_not_found", "house_query_failed", "project_not_found", "branch_has_children", "branch_protected", "lsn_out_of_retention", "endpoint_exists_for_branch", "compute_start_failed", "quota_exceeded", "storage_unavailable", "secret_already_issued", "repo_not_found", "repo_already_exists", "repo_deleting", "ref_stale", "ref_protected", "out_of_scope", "object_format_unsupported", "fork_too_deep", "sequencer_unavailable", "idempotency_key_reused", "workspace_not_found", "workspace_fenced", "workspace_read_only", "workspace_name_taken", "object_missing", "secret_detected", "env_unsealed", "env_access_denied", "env_foreign_reference", "live_bad_cursor", "live_worker_crashed", "live_deploy_conflict", "live_schema_violation", "live_index_not_ready", "live_app_disabled", "live_app_exists", "live_function_error", "live_function_timeout", "live_function_out_of_memory", "live_limit_exceeded", "live_app_mismatch", "live_origin_not_allowed", "session_rotate", "session_gone", "node_draining", "role_required", "setup_required", "token_missing", "token_malformed", "token_revoked", "token_not_yet_valid", "token_bad_signature", "token_wrong_audience", "token_wrong_issuer", "token_unknown_key", "token_algorithm_not_allowed", "api_key_invalid", "credential_not_accepted", "credential_in_query_string", "csrf_token_invalid", "principal_not_allowed", "cors_origin_not_allowed", "auth_unavailable", "invalid_argument", "not_found", "already_exists", "permission_denied", "token_expired", "unauthenticated", "failed_precondition", "resource_exhausted", "unavailable", "deadline_exceeded", "aborted", "internal"];
 /** A stable, machine-readable cause of a failed RPC. */
 export type Reason = (typeof REASONS)[number];
 /** The Connect code each reason is raised under, from the same registry. */

package/dist/gen/facade.js

@@ -140,24 +140,30 @@ export const MODULES = [
         unstable: true,
         derived: false,
         calls: [
+            { module: 'live', name: 'authenticate', protoName: 'authenticate', method: 'Authenticate', rpc: 'loams.live.v1.LiveService/Authenticate', service: 'loams.live.v1.LiveService', package: 'loams.live.v1', idempotency: 'none', retry: 'manual', streaming: 'unary', pagination: null },
             { module: 'live', name: 'modifyQuerySet', protoName: 'modifyQuerySet', method: 'ModifyQuerySet', rpc: 'loams.live.v1.LiveService/ModifyQuerySet', service: 'loams.live.v1.LiveService', package: 'loams.live.v1', idempotency: 'none', retry: 'manual', streaming: 'unary', pagination: null },
             { module: 'live', name: 'watch', protoName: 'watch', method: 'Watch', rpc: 'loams.live.v1.LiveService/Watch', service: 'loams.live.v1.LiveService', package: 'loams.live.v1', idempotency: 'none', retry: 'manual', streaming: 'server', pagination: null },
         ],
     },
     {
         name: 'live.admin',
-        summary: 'Live administration: deploy, roll back, index status and function logs.',
+        summary: 'Live administration: apps, deploy, roll back, index status and function logs.',
         service: 'loams.live.v1.LiveAdminService',
         package: 'loams.live.v1',
         unstable: true,
         derived: false,
         calls: [
             { module: 'live.admin', name: 'activateDeployment', protoName: 'activateDeployment', method: 'ActivateDeployment', rpc: 'loams.live.v1.LiveAdminService/ActivateDeployment', service: 'loams.live.v1.LiveAdminService', package: 'loams.live.v1', idempotency: 'none', retry: 'manual', streaming: 'unary', pagination: null },
+            { module: 'live.admin', name: 'createApp', protoName: 'createApp', method: 'CreateApp', rpc: 'loams.live.v1.LiveAdminService/CreateApp', service: 'loams.live.v1.LiveAdminService', package: 'loams.live.v1', idempotency: 'none', retry: 'manual', streaming: 'unary', pagination: null },
+            { module: 'live.admin', name: 'deleteApp', protoName: 'deleteApp', method: 'DeleteApp', rpc: 'loams.live.v1.LiveAdminService/DeleteApp', service: 'loams.live.v1.LiveAdminService', package: 'loams.live.v1', idempotency: 'none', retry: 'manual', streaming: 'unary', pagination: null },
             { module: 'live.admin', name: 'deploy', protoName: 'deploy', method: 'Deploy', rpc: 'loams.live.v1.LiveAdminService/Deploy', service: 'loams.live.v1.LiveAdminService', package: 'loams.live.v1', idempotency: 'none', retry: 'manual', streaming: 'unary', pagination: null },
+            { module: 'live.admin', name: 'getApp', protoName: 'getApp', method: 'GetApp', rpc: 'loams.live.v1.LiveAdminService/GetApp', service: 'loams.live.v1.LiveAdminService', package: 'loams.live.v1', idempotency: 'none', retry: 'safe', streaming: 'unary', pagination: null },
             { module: 'live.admin', name: 'getDeployment', protoName: 'getDeployment', method: 'GetDeployment', rpc: 'loams.live.v1.LiveAdminService/GetDeployment', service: 'loams.live.v1.LiveAdminService', package: 'loams.live.v1', idempotency: 'none', retry: 'safe', streaming: 'unary', pagination: null },
             { module: 'live.admin', name: 'getIndexStatus', protoName: 'getIndexStatus', method: 'GetIndexStatus', rpc: 'loams.live.v1.LiveAdminService/GetIndexStatus', service: 'loams.live.v1.LiveAdminService', package: 'loams.live.v1', idempotency: 'none', retry: 'safe', streaming: 'unary', pagination: null },
+            { module: 'live.admin', name: 'listApps', protoName: 'listApps', method: 'ListApps', rpc: 'loams.live.v1.LiveAdminService/ListApps', service: 'loams.live.v1.LiveAdminService', package: 'loams.live.v1', idempotency: 'none', retry: 'safe', streaming: 'unary', pagination: { items: 'apps', nextPageToken: 'nextPageToken' } },
             { module: 'live.admin', name: 'listDeployments', protoName: 'listDeployments', method: 'ListDeployments', rpc: 'loams.live.v1.LiveAdminService/ListDeployments', service: 'loams.live.v1.LiveAdminService', package: 'loams.live.v1', idempotency: 'none', retry: 'safe', streaming: 'unary', pagination: { items: 'deployments', nextPageToken: 'nextPageToken' } },
             { module: 'live.admin', name: 'tailLogs', protoName: 'tailLogs', method: 'TailLogs', rpc: 'loams.live.v1.LiveAdminService/TailLogs', service: 'loams.live.v1.LiveAdminService', package: 'loams.live.v1', idempotency: 'none', retry: 'manual', streaming: 'server', pagination: null },
+            { module: 'live.admin', name: 'updateApp', protoName: 'updateApp', method: 'UpdateApp', rpc: 'loams.live.v1.LiveAdminService/UpdateApp', service: 'loams.live.v1.LiveAdminService', package: 'loams.live.v1', idempotency: 'none', retry: 'manual', streaming: 'unary', pagination: null },
         ],
     },
     {
@@ -277,6 +283,17 @@ export const REASONS = [
     'live_deploy_conflict',
     'live_schema_violation',
     'live_index_not_ready',
+    'live_app_disabled',
+    'live_app_exists',
+    'live_function_error',
+    'live_function_timeout',
+    'live_function_out_of_memory',
+    'live_limit_exceeded',
+    'live_app_mismatch',
+    'live_origin_not_allowed',
+    'session_rotate',
+    'session_gone',
+    'node_draining',
     'role_required',
     'setup_required',
     'token_missing',
@@ -371,6 +388,17 @@ export const REASON_CODES = {
     live_deploy_conflict: 'failed_precondition',
     live_schema_violation: 'invalid_argument',
     live_index_not_ready: 'failed_precondition',
+    live_app_disabled: 'failed_precondition',
+    live_app_exists: 'failed_precondition',
+    live_function_error: 'unknown',
+    live_function_timeout: 'deadline_exceeded',
+    live_function_out_of_memory: 'resource_exhausted',
+    live_limit_exceeded: 'resource_exhausted',
+    live_app_mismatch: 'permission_denied',
+    live_origin_not_allowed: 'permission_denied',
+    session_rotate: 'unavailable',
+    session_gone: 'not_found',
+    node_draining: 'unavailable',
     role_required: 'permission_denied',
     setup_required: 'failed_precondition',
     token_missing: 'unauthenticated',

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { Loams, type LoamsModules, type LoamsOptions } from './loams.js';
+export { Loams, type AdminNamespace, type LiveNamespace, type LoamsModules, type LoamsOptions, } from './loams.js';
 export { SystemApi, type Catalogue, type SystemConfig, type VersionReport, } from './system.js';
 export { FEATURE_NOT_IN_VARIANT, MODULES, PROTO_PACKAGES, PROTO_REV, REASON_CODES, REASONS, SERVICE_DESCRIPTORS, type CallBinding, type InstanceModule, type LiveModule, type ModuleBinding, type Reason, type TablesModule, } from './gen/facade.js';
 export { CallInvoker, callWithRetry, withIdempotencyKey, type Attempt, type CallOptions, type ConsistencyOptions, type ConsistencyTokenStore, type RetryPlan, type Send, } from './runtime/call.js';
@@ -8,5 +8,5 @@ export { paginate, pageFields, type PageFetcher, type PageRequestOptions } from
 export { BASE_DELAY_MS, DEFAULT_MAX_RETRIES, MAX_DELAY_MS, MAX_SERVER_DELAY_MS, backoffMs, isRetryableCode, shouldRetry, sleep, } from './runtime/retry.js';
 export { watch, type CursorOf, type ResumeOptions, type StreamOpener } from './runtime/streams.js';
 export { apiKey, envToken, oidcExchange, refreshing, staticToken, type TokenSource, } from './runtime/token-source.js';
-export { createLoamsTransport, type TransportOptions } from './runtime/transports.js';
+export { createLoamsTransport, headersInterceptor, type TransportOptions, } from './runtime/transports.js';
 export { uuidv7, uuidv7Time } from './runtime/uuidv7.js';

package/dist/index.js

@@ -14,7 +14,7 @@
 // What a caller imports from here: the `Loams` client, the module types the
 // generator produced, the typed error hierarchy, the token sources, and the
 // reason registry as a type.
-export { Loams } from './loams.js';
+export { Loams, } from './loams.js';
 export { SystemApi, } from './system.js';
 // The generated facade: the module interfaces, the binding table, the proto
 // revision, and the reason registry as a type. Everything here is written by
@@ -28,5 +28,5 @@ export { paginate, pageFields } from './runtime/pagination.js';
 export { BASE_DELAY_MS, DEFAULT_MAX_RETRIES, MAX_DELAY_MS, MAX_SERVER_DELAY_MS, backoffMs, isRetryableCode, shouldRetry, sleep, } from './runtime/retry.js';
 export { watch } from './runtime/streams.js';
 export { apiKey, envToken, oidcExchange, refreshing, staticToken, } from './runtime/token-source.js';
-export { createLoamsTransport } from './runtime/transports.js';
+export { createLoamsTransport, headersInterceptor, } from './runtime/transports.js';
 export { uuidv7, uuidv7Time } from './runtime/uuidv7.js';

package/dist/loams.d.ts

@@ -1,5 +1,5 @@
 import type { Transport } from '@connectrpc/connect';
-import { type CallBinding, type InstanceModule, type LiveModule, type ModuleBinding, type TablesModule } from './gen/facade.js';
+import { type AdminAgentsModule, type AdminAuditModule, type AdminKeysModule, type AdminOrgModule, type AdminProjectsModule, type AuthModule, type CallBinding, type InstanceModule, type LiveAdminModule, type LiveModule, type ModuleBinding, type TablesModule } from './gen/facade.js';
 import { type CallOptions, type ConsistencyTokenStore } from './runtime/call.js';
 import { type PageRequestOptions } from './runtime/pagination.js';
 import { SystemApi } from './system.js';
@@ -51,18 +51,38 @@ export interface LoamsModules {
     readonly tables: TablesModule;
     readonly [module: string]: unknown;
 }
+/** `loams.live`: the session calls, with `loams.live.admin` under it. */
+export type LiveNamespace = LiveModule & {
+    /** `loams.live.admin` — apps, deploy, roll back, index status and logs. */
+    readonly admin: LiveAdminModule;
+};
+/** `loams.admin`: the console's administration modules (design §44 §7.2). */
+export interface AdminNamespace {
+    readonly agents: AdminAgentsModule;
+    readonly audit: AdminAuditModule;
+    readonly keys: AdminKeysModule;
+    readonly org: AdminOrgModule;
+    readonly projects: AdminProjectsModule;
+}
 /** One SDK, over one instance. */
 export declare class Loams {
     #private;
     /** `loams.instance` — what this instance is, and who the caller is. */
     readonly instance: InstanceModule;
-    /** `loams.live` — the live sync session half. Its package is `unstable`. */
-    readonly live: LiveModule;
+    /** `loams.live` — the live sync session half, and `loams.live.admin`.
+     * Its package is `unstable`. */
+    readonly live: LiveNamespace;
     /** `loams.tables` — the table half of the same service (design §44 §7.2). */
     readonly tables: TablesModule;
+    /** `loams.admin` — org, projects, agents, keys and audit. */
+    readonly admin: AdminNamespace;
+    /** `loams.auth` — sessions and sign-in. */
+    readonly auth: AuthModule;
     /** The module catalogue, feature detection and the version check. */
     readonly system: SystemApi;
-    /** Every generated module, by name: the catalogue a caller iterates. */
+    /** Every generated module, by its dotted name (`'live.admin'`): the
+     * catalogue a caller iterates. The same objects are reachable as
+     * properties, `loams.live.admin` for `'live.admin'`. */
     readonly modules: Readonly<Record<string, unknown>>;
     constructor(options: LoamsOptions);
     /** The session consistency token store, when `sessionConsistency` is on. */

package/dist/loams.js

@@ -29,13 +29,20 @@ import { watch } from './runtime/streams.js';
 export class Loams {
     /** `loams.instance` — what this instance is, and who the caller is. */
     instance;
-    /** `loams.live` — the live sync session half. Its package is `unstable`. */
+    /** `loams.live` — the live sync session half, and `loams.live.admin`.
+     * Its package is `unstable`. */
     live;
     /** `loams.tables` — the table half of the same service (design §44 §7.2). */
     tables;
+    /** `loams.admin` — org, projects, agents, keys and audit. */
+    admin;
+    /** `loams.auth` — sessions and sign-in. */
+    auth;
     /** The module catalogue, feature detection and the version check. */
     system;
-    /** Every generated module, by name: the catalogue a caller iterates. */
+    /** Every generated module, by its dotted name (`'live.admin'`): the
+     * catalogue a caller iterates. The same objects are reachable as
+     * properties, `loams.live.admin` for `'live.admin'`. */
     modules;
     #invoker;
     #consistency;
@@ -54,9 +61,12 @@ export class Loams {
         this.#consistency = options.sessionConsistency === true ? new ConsistencySession() : undefined;
         this.#invoker = new CallInvoker(transport, tokenSource, options.maxRetries ?? DEFAULT_MAX_RETRIES, this.#consistency);
         this.modules = buildModules(this.#invoker);
-        this.instance = this.modules.instance;
-        this.live = this.modules.live;
-        this.tables = this.modules.tables;
+        const tree = nestModules(this.modules);
+        this.instance = tree.instance;
+        this.live = tree.live;
+        this.tables = tree.tables;
+        this.admin = tree.admin;
+        this.auth = tree.auth;
         this.system = new SystemApi((request, callOptions) => this.instance.getInstance(request, callOptions), {
             endpoint: options.endpoint,
             maxRetries: options.maxRetries,
@@ -155,3 +165,39 @@ function buildModules(invoker) {
     }
     return modules;
 }
+/**
+ * The module tree a dotted name implies: `'live.admin'` becomes `live.admin`
+ * and `'admin.org'` becomes `admin.org`.
+ *
+ * A child is attached to its parent module object when the parent exists
+ * (`live` is a module with calls of its own), and to a plain namespace object
+ * when it does not (`admin` has only children). The flat catalogue is left as
+ * it is; the tree reuses its objects, so `loams.live.admin` and
+ * `loams.modules['live.admin']` are the same object.
+ */
+function nestModules(flat) {
+    const tree = {};
+    // Parents before children, so a module with calls of its own is the node
+    // its children hang from rather than being replaced by a namespace.
+    const names = Object.keys(flat).sort((a, b) => a.split('.').length - b.split('.').length);
+    for (const name of names) {
+        const path = name.split('.');
+        const leaf = path.pop();
+        let node = tree;
+        for (const part of path) {
+            let next = node[part];
+            if (next === undefined) {
+                next = {};
+                node[part] = next;
+            }
+            node = next;
+        }
+        if (leaf in node) {
+            throw new LoamsError(`the module ${name} collides with a call of the same name`, {
+                code: Code.Internal,
+            });
+        }
+        node[leaf] = flat[name];
+    }
+    return tree;
+}

package/dist/node.d.ts

@@ -1,5 +1,5 @@
 import type { Transport } from '@connectrpc/connect';
-import type { TransportOptions } from './runtime/transports.js';
+import { type TransportOptions } from './runtime/transports.js';
 export * from './index.js';
 /**
  * HTTP/2 gRPC, over `node:http2`.

package/dist/node.js

@@ -20,6 +20,7 @@
 // down. Prefer this one on a loopback stack or inside the cluster; prefer the
 // default one in a browser, an edge function, or behind an HTTP/1.1 proxy.
 import { createGrpcTransport } from '@connectrpc/connect-node';
+import { transportInterceptors } from './runtime/transports.js';
 export * from './index.js';
 /**
  * HTTP/2 gRPC, over `node:http2`.
@@ -30,13 +31,13 @@ export * from './index.js';
  * retries.
  */
 export function createNodeTransport(options = {}) {
+    const interceptors = transportInterceptors(options);
     return createGrpcTransport({
         baseUrl: options.baseUrl ?? '',
         useBinaryFormat: options.useBinaryFormat ?? true,
-        ...(options.headers === undefined ? {} : { headers: options.headers }),
         ...(options.defaultTimeoutMs === undefined
             ? {}
             : { defaultTimeoutMs: options.defaultTimeoutMs }),
-        ...(options.interceptors === undefined ? {} : { interceptors: options.interceptors }),
+        ...(interceptors.length === 0 ? {} : { interceptors }),
     });
 }

package/dist/runtime/transports.d.ts

@@ -1,5 +1,5 @@
 import { createConnectTransport } from '@connectrpc/connect-web';
-import type { Transport } from '@connectrpc/connect';
+import type { Interceptor, Transport } from '@connectrpc/connect';
 /** What a caller may configure on the transport. */
 export interface TransportOptions {
     /**
@@ -7,7 +7,13 @@ export interface TransportOptions {
      * `endpoint`, so a caller building a transport by hand rarely needs it.
      */
     baseUrl?: string;
-    /** Extra headers on every request, for a gateway or a proxy. */
+    /**
+     * Extra headers on every request, unary and streaming: for a gateway, a
+     * proxy, or a routing header such as the Live app a call is for. They are
+     * attached by an interceptor (`headersInterceptor`), because neither
+     * connect-web's nor connect-node's transport has a `headers` option; a
+     * header the call already sets (a credential, a per-call header) wins.
+     */
     headers?: Record<string, string>;
     /**
      * `useBinaryFormat` picks the encoding: `true` is protobuf, `false` is the
@@ -37,3 +43,16 @@ export interface TransportOptions {
  * case, not a fallback: it is the default in every runtime.
  */
 export declare function createLoamsTransport(options?: TransportOptions): Transport;
+/**
+ * An interceptor that sets `headers` on every request, unary and streaming.
+ *
+ * A header already on the request is left alone, so a per-call header or the
+ * credential the invoker attaches is never overwritten by a static default.
+ */
+export declare function headersInterceptor(headers: Record<string, string>): Interceptor;
+/**
+ * The interceptors a transport built from `options` runs: the static headers
+ * first (outermost), then the caller's own, so a caller's interceptor sees the
+ * headers and may still change them.
+ */
+export declare function transportInterceptors(options: TransportOptions): Interceptor[];

package/dist/runtime/transports.js

@@ -26,13 +26,41 @@ import { createConnectTransport } from '@connectrpc/connect-web';
  * case, not a fallback: it is the default in every runtime.
  */
 export function createLoamsTransport(options = {}) {
+    const interceptors = transportInterceptors(options);
     return createConnectTransport({
         baseUrl: options.baseUrl ?? '',
         useBinaryFormat: options.useBinaryFormat ?? true,
-        ...(options.headers === undefined ? {} : { headers: options.headers }),
         ...(options.defaultTimeoutMs === undefined
             ? {}
             : { defaultTimeoutMs: options.defaultTimeoutMs }),
-        ...(options.interceptors === undefined ? {} : { interceptors: options.interceptors }),
+        ...(interceptors.length === 0 ? {} : { interceptors }),
     });
 }
+/**
+ * An interceptor that sets `headers` on every request, unary and streaming.
+ *
+ * A header already on the request is left alone, so a per-call header or the
+ * credential the invoker attaches is never overwritten by a static default.
+ */
+export function headersInterceptor(headers) {
+    const entries = Object.entries(headers);
+    return (next) => (request) => {
+        for (const [name, value] of entries) {
+            if (!request.header.has(name)) {
+                request.header.set(name, value);
+            }
+        }
+        return next(request);
+    };
+}
+/**
+ * The interceptors a transport built from `options` runs: the static headers
+ * first (outermost), then the caller's own, so a caller's interceptor sees the
+ * headers and may still change them.
+ */
+export function transportInterceptors(options) {
+    const headers = options.headers === undefined || Object.keys(options.headers).length === 0
+        ? []
+        : [headersInterceptor(options.headers)];
+    return [...headers, ...(options.interceptors ?? [])];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loams/client",
-  "version": "0.1.0-preview.2",
+  "version": "0.1.0",
   "description": "The Loams SDK for TypeScript and JavaScript: one Loams object with namespaced modules over the unified Connect API, generated from proto/.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ostrium-labs/loams/tree/dev/sdks/typescript",
@@ -43,7 +43,7 @@
     "@connectrpc/connect": "2.2.0",
     "@connectrpc/connect-node": "2.2.0",
     "@connectrpc/connect-web": "2.2.0",
-    "@loams/live": "0.1.0-preview.2"
+    "@loams/live": "0.1.0"
   },
   "publishConfig": {
     "access": "public"