@lumiblue/secrets 0.1.15

package/dist/index.js

@@ -0,0 +1,1496 @@
+/*! @lumiblue/secrets v0.1.15 */
+//#region src/backend/core/bodySerializer.gen.ts
+var jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
+Object.entries({
+	$body_: "body",
+	$headers_: "headers",
+	$path_: "path",
+	$query_: "query"
+});
+//#endregion
+//#region src/backend/core/serverSentEvents.gen.ts
+function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
+	let lastEventId;
+	const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const createStream = async function* () {
+		let retryDelay = sseDefaultRetryDelay ?? 3e3;
+		let attempt = 0;
+		const signal = options.signal ?? new AbortController().signal;
+		while (true) {
+			if (signal.aborted) break;
+			attempt++;
+			const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+			if (lastEventId !== void 0) headers.set("Last-Event-ID", lastEventId);
+			try {
+				const requestInit = {
+					redirect: "follow",
+					...options,
+					body: options.serializedBody,
+					headers,
+					signal
+				};
+				let request = new Request(url, requestInit);
+				if (onRequest) request = await onRequest(url, requestInit);
+				const response = await (options.fetch ?? globalThis.fetch)(request);
+				if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);
+				if (!response.body) throw new Error("No body in SSE response");
+				const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
+				let buffer = "";
+				const abortHandler = () => {
+					try {
+						reader.cancel();
+					} catch {}
+				};
+				signal.addEventListener("abort", abortHandler);
+				try {
+					while (true) {
+						const { done, value } = await reader.read();
+						if (done) break;
+						buffer += value;
+						buffer = buffer.replace(/\r\n?/g, "\n");
+						const chunks = buffer.split("\n\n");
+						buffer = chunks.pop() ?? "";
+						for (const chunk of chunks) {
+							const lines = chunk.split("\n");
+							const dataLines = [];
+							let eventName;
+							for (const line of lines) if (line.startsWith("data:")) dataLines.push(line.replace(/^data:\s*/, ""));
+							else if (line.startsWith("event:")) eventName = line.replace(/^event:\s*/, "");
+							else if (line.startsWith("id:")) lastEventId = line.replace(/^id:\s*/, "");
+							else if (line.startsWith("retry:")) {
+								const parsed = Number.parseInt(line.replace(/^retry:\s*/, ""), 10);
+								if (!Number.isNaN(parsed)) retryDelay = parsed;
+							}
+							let data;
+							let parsedJson = false;
+							if (dataLines.length) {
+								const rawData = dataLines.join("\n");
+								try {
+									data = JSON.parse(rawData);
+									parsedJson = true;
+								} catch {
+									data = rawData;
+								}
+							}
+							if (parsedJson) {
+								if (responseValidator) await responseValidator(data);
+								if (responseTransformer) data = await responseTransformer(data);
+							}
+							onSseEvent?.({
+								data,
+								event: eventName,
+								id: lastEventId,
+								retry: retryDelay
+							});
+							if (dataLines.length) yield data;
+						}
+					}
+				} finally {
+					signal.removeEventListener("abort", abortHandler);
+					reader.releaseLock();
+				}
+				break;
+			} catch (error) {
+				onSseError?.(error);
+				if (sseMaxRetryAttempts !== void 0 && attempt >= sseMaxRetryAttempts) break;
+				const backoff = Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 3e4);
+				await sleep(backoff);
+			}
+		}
+	};
+	return { stream: createStream() };
+}
+//#endregion
+//#region src/backend/core/pathSerializer.gen.ts
+var separatorArrayExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+var separatorArrayNoExplode = (style) => {
+	switch (style) {
+		case "form": return ",";
+		case "pipeDelimited": return "|";
+		case "spaceDelimited": return "%20";
+		default: return ",";
+	}
+};
+var separatorObjectExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+var serializeArrayParam = ({ allowReserved, explode, name, style, value }) => {
+	if (!explode) {
+		const joinedValues = (allowReserved ? value : value.map((v) => encodeURIComponent(v))).join(separatorArrayNoExplode(style));
+		switch (style) {
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			case "simple": return joinedValues;
+			default: return `${name}=${joinedValues}`;
+		}
+	}
+	const separator = separatorArrayExplode(style);
+	const joinedValues = value.map((v) => {
+		if (style === "label" || style === "simple") return allowReserved ? v : encodeURIComponent(v);
+		return serializePrimitiveParam({
+			allowReserved,
+			name,
+			value: v
+		});
+	}).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+var serializePrimitiveParam = ({ allowReserved, name, value }) => {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "object") throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");
+	return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+};
+var serializeObjectParam = ({ allowReserved, explode, name, style, value, valueOnly }) => {
+	if (value instanceof Date) return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+	if (style !== "deepObject" && !explode) {
+		let values = [];
+		Object.entries(value).forEach(([key, v]) => {
+			values = [
+				...values,
+				key,
+				allowReserved ? v : encodeURIComponent(v)
+			];
+		});
+		const joinedValues = values.join(",");
+		switch (style) {
+			case "form": return `${name}=${joinedValues}`;
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			default: return joinedValues;
+		}
+	}
+	const separator = separatorObjectExplode(style);
+	const joinedValues = Object.entries(value).map(([key, v]) => serializePrimitiveParam({
+		allowReserved,
+		name: style === "deepObject" ? `${name}[${key}]` : key,
+		value: v
+	})).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+//#endregion
+//#region src/backend/core/utils.gen.ts
+var PATH_PARAM_RE = /\{[^{}]+\}/g;
+var defaultPathSerializer = ({ path, url: _url }) => {
+	let url = _url;
+	const matches = _url.match(PATH_PARAM_RE);
+	if (matches) for (const match of matches) {
+		let explode = false;
+		let name = match.substring(1, match.length - 1);
+		let style = "simple";
+		if (name.endsWith("*")) {
+			explode = true;
+			name = name.substring(0, name.length - 1);
+		}
+		if (name.startsWith(".")) {
+			name = name.substring(1);
+			style = "label";
+		} else if (name.startsWith(";")) {
+			name = name.substring(1);
+			style = "matrix";
+		}
+		const value = path[name];
+		if (value === void 0 || value === null) continue;
+		if (Array.isArray(value)) {
+			url = url.replace(match, serializeArrayParam({
+				explode,
+				name,
+				style,
+				value
+			}));
+			continue;
+		}
+		if (typeof value === "object") {
+			url = url.replace(match, serializeObjectParam({
+				explode,
+				name,
+				style,
+				value,
+				valueOnly: true
+			}));
+			continue;
+		}
+		if (style === "matrix") {
+			url = url.replace(match, `;${serializePrimitiveParam({
+				name,
+				value
+			})}`);
+			continue;
+		}
+		const replaceValue = encodeURIComponent(style === "label" ? `.${value}` : value);
+		url = url.replace(match, replaceValue);
+	}
+	return url;
+};
+var getUrl = ({ baseUrl, path, query, querySerializer, url: _url }) => {
+	const pathUrl = _url.startsWith("/") ? _url : `/${_url}`;
+	let url = (baseUrl ?? "") + pathUrl;
+	if (path) url = defaultPathSerializer({
+		path,
+		url
+	});
+	let search = query ? querySerializer(query) : "";
+	if (search.startsWith("?")) search = search.substring(1);
+	if (search) url += `?${search}`;
+	return url;
+};
+function getValidRequestBody(options) {
+	const hasBody = options.body !== void 0;
+	if (hasBody && options.bodySerializer) {
+		if ("serializedBody" in options) return options.serializedBody !== void 0 && options.serializedBody !== "" ? options.serializedBody : null;
+		return options.body !== "" ? options.body : null;
+	}
+	if (hasBody) return options.body;
+}
+//#endregion
+//#region src/backend/core/auth.gen.ts
+var getAuthToken = async (auth, callback) => {
+	const token = typeof callback === "function" ? await callback(auth) : callback;
+	if (!token) return;
+	if (auth.scheme === "bearer") return `Bearer ${token}`;
+	if (auth.scheme === "basic") return `Basic ${btoa(token)}`;
+	return token;
+};
+//#endregion
+//#region src/backend/client/utils.gen.ts
+var createQuerySerializer = ({ parameters = {}, ...args } = {}) => {
+	const querySerializer = (queryParams) => {
+		const search = [];
+		if (queryParams && typeof queryParams === "object") for (const name in queryParams) {
+			const value = queryParams[name];
+			if (value === void 0 || value === null) continue;
+			const options = parameters[name] || args;
+			if (Array.isArray(value)) {
+				const serializedArray = serializeArrayParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "form",
+					value,
+					...options.array
+				});
+				if (serializedArray) search.push(serializedArray);
+			} else if (typeof value === "object") {
+				const serializedObject = serializeObjectParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "deepObject",
+					value,
+					...options.object
+				});
+				if (serializedObject) search.push(serializedObject);
+			} else {
+				const serializedPrimitive = serializePrimitiveParam({
+					allowReserved: options.allowReserved,
+					name,
+					value
+				});
+				if (serializedPrimitive) search.push(serializedPrimitive);
+			}
+		}
+		return search.join("&");
+	};
+	return querySerializer;
+};
+/**
+* Infers parseAs value from provided Content-Type header.
+*/
+var getParseAs = (contentType) => {
+	if (!contentType) return "stream";
+	const cleanContent = contentType.split(";")[0]?.trim();
+	if (!cleanContent) return;
+	if (cleanContent.startsWith("application/json") || cleanContent.endsWith("+json")) return "json";
+	if (cleanContent === "multipart/form-data") return "formData";
+	if ([
+		"application/",
+		"audio/",
+		"image/",
+		"video/"
+	].some((type) => cleanContent.startsWith(type))) return "blob";
+	if (cleanContent.startsWith("text/")) return "text";
+};
+var checkForExistence = (options, name) => {
+	if (!name) return false;
+	if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) return true;
+	return false;
+};
+async function setAuthParams(options) {
+	for (const auth of options.security ?? []) {
+		if (checkForExistence(options, auth.name)) continue;
+		const token = await getAuthToken(auth, options.auth);
+		if (!token) continue;
+		const name = auth.name ?? "Authorization";
+		switch (auth.in) {
+			case "query":
+				if (!options.query) options.query = {};
+				options.query[name] = token;
+				break;
+			case "cookie":
+				options.headers.append("Cookie", `${name}=${token}`);
+				break;
+			default: options.headers.set(name, token);
+		}
+	}
+}
+var buildUrl = (options) => getUrl({
+	baseUrl: options.baseUrl,
+	path: options.path,
+	query: options.query,
+	querySerializer: typeof options.querySerializer === "function" ? options.querySerializer : createQuerySerializer(options.querySerializer),
+	url: options.url
+});
+var mergeConfigs = (a, b) => {
+	const config = {
+		...a,
+		...b
+	};
+	if (config.baseUrl?.endsWith("/")) config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
+	config.headers = mergeHeaders(a.headers, b.headers);
+	return config;
+};
+var headersEntries = (headers) => {
+	const entries = [];
+	headers.forEach((value, key) => {
+		entries.push([key, value]);
+	});
+	return entries;
+};
+var mergeHeaders = (...headers) => {
+	const mergedHeaders = new Headers();
+	for (const header of headers) {
+		if (!header) continue;
+		const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+		for (const [key, value] of iterator) if (value === null) mergedHeaders.delete(key);
+		else if (Array.isArray(value)) for (const v of value) mergedHeaders.append(key, v);
+		else if (value !== void 0) mergedHeaders.set(key, typeof value === "object" ? JSON.stringify(value) : value);
+	}
+	return mergedHeaders;
+};
+var Interceptors = class {
+	constructor() {
+		this.fns = [];
+	}
+	clear() {
+		this.fns = [];
+	}
+	eject(id) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) this.fns[index] = null;
+	}
+	exists(id) {
+		const index = this.getInterceptorIndex(id);
+		return Boolean(this.fns[index]);
+	}
+	getInterceptorIndex(id) {
+		if (typeof id === "number") return this.fns[id] ? id : -1;
+		return this.fns.indexOf(id);
+	}
+	update(id, fn) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) {
+			this.fns[index] = fn;
+			return id;
+		}
+		return false;
+	}
+	use(fn) {
+		this.fns.push(fn);
+		return this.fns.length - 1;
+	}
+};
+var createInterceptors = () => ({
+	error: new Interceptors(),
+	request: new Interceptors(),
+	response: new Interceptors()
+});
+var defaultQuerySerializer = createQuerySerializer({
+	allowReserved: false,
+	array: {
+		explode: true,
+		style: "form"
+	},
+	object: {
+		explode: true,
+		style: "deepObject"
+	}
+});
+var defaultHeaders = { "Content-Type": "application/json" };
+var createConfig = (override = {}) => ({
+	...jsonBodySerializer,
+	headers: defaultHeaders,
+	parseAs: "auto",
+	querySerializer: defaultQuerySerializer,
+	...override
+});
+//#endregion
+//#region src/backend/client/client.gen.ts
+var createClient = (config = {}) => {
+	let _config = mergeConfigs(createConfig(), config);
+	const getConfig = () => ({ ..._config });
+	const setConfig = (config) => {
+		_config = mergeConfigs(_config, config);
+		return getConfig();
+	};
+	const interceptors = createInterceptors();
+	const beforeRequest = async (options) => {
+		const opts = {
+			..._config,
+			...options,
+			fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
+			headers: mergeHeaders(_config.headers, options.headers),
+			serializedBody: void 0
+		};
+		if (opts.security) await setAuthParams(opts);
+		if (opts.requestValidator) await opts.requestValidator(opts);
+		if (opts.body !== void 0 && opts.bodySerializer) opts.serializedBody = opts.bodySerializer(opts.body);
+		if (opts.body === void 0 || opts.serializedBody === "") opts.headers.delete("Content-Type");
+		const resolvedOpts = opts;
+		return {
+			opts: resolvedOpts,
+			url: buildUrl(resolvedOpts)
+		};
+	};
+	const request = async (options) => {
+		const throwOnError = options.throwOnError ?? _config.throwOnError;
+		const responseStyle = options.responseStyle ?? _config.responseStyle;
+		let request;
+		let response;
+		try {
+			const { opts, url } = await beforeRequest(options);
+			const requestInit = {
+				redirect: "follow",
+				...opts,
+				body: getValidRequestBody(opts)
+			};
+			request = new Request(url, requestInit);
+			for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+			const _fetch = opts.fetch;
+			response = await _fetch(request);
+			for (const fn of interceptors.response.fns) if (fn) response = await fn(response, request, opts);
+			const result = {
+				request,
+				response
+			};
+			if (response.ok) {
+				const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+				if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+					let emptyData;
+					switch (parseAs) {
+						case "arrayBuffer":
+						case "blob":
+						case "text":
+							emptyData = await response[parseAs]();
+							break;
+						case "formData":
+							emptyData = new FormData();
+							break;
+						case "stream":
+							emptyData = response.body;
+							break;
+						default: emptyData = {};
+					}
+					return opts.responseStyle === "data" ? emptyData : {
+						data: emptyData,
+						...result
+					};
+				}
+				let data;
+				switch (parseAs) {
+					case "arrayBuffer":
+					case "blob":
+					case "formData":
+					case "text":
+						data = await response[parseAs]();
+						break;
+					case "json": {
+						const text = await response.text();
+						data = text ? JSON.parse(text) : {};
+						break;
+					}
+					case "stream": return opts.responseStyle === "data" ? response.body : {
+						data: response.body,
+						...result
+					};
+				}
+				if (parseAs === "json") {
+					if (opts.responseValidator) await opts.responseValidator(data);
+					if (opts.responseTransformer) data = await opts.responseTransformer(data);
+				}
+				return opts.responseStyle === "data" ? data : {
+					data,
+					...result
+				};
+			}
+			const textError = await response.text();
+			let jsonError;
+			try {
+				jsonError = JSON.parse(textError);
+			} catch {}
+			throw jsonError ?? textError;
+		} catch (error) {
+			let finalError = error;
+			for (const fn of interceptors.error.fns) if (fn) finalError = await fn(finalError, response, request, options);
+			finalError = finalError || {};
+			if (throwOnError) throw finalError;
+			return responseStyle === "data" ? void 0 : {
+				error: finalError,
+				request,
+				response
+			};
+		}
+	};
+	const makeMethodFn = (method) => (options) => request({
+		...options,
+		method
+	});
+	const makeSseFn = (method) => async (options) => {
+		const { opts, url } = await beforeRequest(options);
+		return createSseClient({
+			...opts,
+			body: opts.body,
+			method,
+			onRequest: async (url, init) => {
+				let request = new Request(url, init);
+				for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+				return request;
+			},
+			serializedBody: getValidRequestBody(opts),
+			url
+		});
+	};
+	const _buildUrl = (options) => buildUrl({
+		..._config,
+		...options
+	});
+	return {
+		buildUrl: _buildUrl,
+		connect: makeMethodFn("CONNECT"),
+		delete: makeMethodFn("DELETE"),
+		get: makeMethodFn("GET"),
+		getConfig,
+		head: makeMethodFn("HEAD"),
+		interceptors,
+		options: makeMethodFn("OPTIONS"),
+		patch: makeMethodFn("PATCH"),
+		post: makeMethodFn("POST"),
+		put: makeMethodFn("PUT"),
+		request,
+		setConfig,
+		sse: {
+			connect: makeSseFn("CONNECT"),
+			delete: makeSseFn("DELETE"),
+			get: makeSseFn("GET"),
+			head: makeSseFn("HEAD"),
+			options: makeSseFn("OPTIONS"),
+			patch: makeSseFn("PATCH"),
+			post: makeSseFn("POST"),
+			put: makeSseFn("PUT"),
+			trace: makeSseFn("TRACE")
+		},
+		trace: makeMethodFn("TRACE")
+	};
+};
+//#endregion
+//#region src/backend/client.gen.ts
+var DEFAULT_API_SERVERS = ["http://localhost:3001"];
+var SERVER_DOWN_STATUS_CODES = /* @__PURE__ */ new Set([
+	502,
+	503,
+	504
+]);
+function isServerDownStatus(status) {
+	return SERVER_DOWN_STATUS_CODES.has(status);
+}
+/**
+* Identity hosts for JWT minting. Local when DEFAULT_API_SERVERS includes localhost.
+* @returns Ordered Identity base URLs.
+*/
+function resolveIdentityServers() {
+	return DEFAULT_API_SERVERS.some((url) => url.includes("localhost")) ? ["http://localhost:3000"] : ["https://identity.lumiblue.nl", "https://identity2.lumiblue.nl"];
+}
+/**
+* Creates an Identity HTTP client with multi-server failover, JWT refresh,
+* and optional M2M API-key auth. Each call gets isolated credential state.
+*
+* @param options - Optional servers and apiKey overrides.
+* @returns Augmented client usable with `new Sdk({ client })`.
+*/
+function createSdkClient(options) {
+	let availableServers = [...options?.servers ?? DEFAULT_API_SERVERS];
+	const identityServers = resolveIdentityServers();
+	let authToken;
+	let apiKey = options?.apiKey;
+	let refreshPromise = null;
+	function getAvailableServers() {
+		return [...availableServers];
+	}
+	function setApiKey(key) {
+		apiKey = key;
+		authToken = void 0;
+	}
+	function setToken(token) {
+		authToken = token;
+	}
+	function promoteServer(server) {
+		availableServers = [server, ...availableServers.filter((entry) => entry !== server)];
+	}
+	async function cloneRequest(baseUrl, input, init, bearer) {
+		const isRequestInstance = input instanceof Request;
+		const rawUrl = isRequestInstance ? input.url : String(input);
+		const reqUrl = URL.canParse(rawUrl) ? new URL(rawUrl) : new URL(rawUrl, baseUrl);
+		const recreatedURL = new URL(reqUrl.pathname, baseUrl);
+		recreatedURL.search = reqUrl.search;
+		recreatedURL.hash = reqUrl.hash;
+		const method = isRequestInstance ? input.method : init?.method || "GET";
+		const hasBody = ![
+			"GET",
+			"HEAD",
+			"OPTIONS"
+		].includes(method.toUpperCase());
+		const headers = new Headers(isRequestInstance ? input.headers : init?.headers);
+		if (bearer) headers.set("Authorization", "Bearer " + bearer);
+		const attemptInit = isRequestInstance ? {
+			method,
+			headers,
+			credentials: input.credentials,
+			mode: input.mode,
+			redirect: input.redirect,
+			referrer: input.referrer,
+			referrerPolicy: input.referrerPolicy,
+			cache: input.cache,
+			integrity: input.integrity,
+			keepalive: input.keepalive,
+			signal: input.signal,
+			body: hasBody ? await input.clone().arrayBuffer() : void 0
+		} : {
+			...init,
+			headers
+		};
+		return new Request(recreatedURL, attemptInit);
+	}
+	async function refreshWithApiKey() {
+		let lastError;
+		for (const server of identityServers) try {
+			const response = await fetch(server + "/api/lumiblue-token", {
+				method: "POST",
+				credentials: "omit",
+				headers: {
+					"content-type": "application/json",
+					"x-api-key": apiKey
+				},
+				body: JSON.stringify({})
+			});
+			if (isServerDownStatus(response.status)) continue;
+			if (response.ok) {
+				const data = await response.json();
+				authToken = data.token;
+				return data.token;
+			}
+			throw new Error("Identity - API key token mint failed: " + response.status);
+		} catch (error) {
+			lastError = error;
+			console.warn("Identity - Failed contacting ", server, error);
+		}
+		if (lastError instanceof Error) throw lastError;
+		throw new Error("All identity servers unreachable");
+	}
+	async function refreshWithSessionCookie() {
+		let activeServer;
+		for (const server of identityServers) try {
+			const response = await fetch(server + "/api/lumiblue-token", {
+				method: "POST",
+				credentials: "include",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({})
+			});
+			if (isServerDownStatus(response.status)) continue;
+			if (response.ok) {
+				const data = await response.json();
+				authToken = data.token;
+				return data.token;
+			}
+			activeServer = server;
+		} catch (error) {
+			console.warn("Identity - Failed contacting ", server, error);
+		}
+		if (activeServer && typeof window !== "undefined") {
+			const loginUrl = new URL(activeServer + "/login.html");
+			loginUrl.searchParams.set("redirect_uri", window.location.href);
+			window.location.assign(loginUrl.toString());
+			return;
+		}
+		throw new Error("All identity servers unreachable");
+	}
+	async function getAuthToken() {
+		if (refreshPromise) return refreshPromise;
+		refreshPromise = (async () => {
+			try {
+				return apiKey ? await refreshWithApiKey() : await refreshWithSessionCookie();
+			} finally {
+				refreshPromise = null;
+			}
+		})();
+		return refreshPromise;
+	}
+	async function multiServersRetryWithAuth(input, init) {
+		let lastResponse;
+		let lastError;
+		for (let i = 0; i < availableServers.length; i++) {
+			const baseUrl = availableServers[i].replace(/\/$/, "");
+			const attempt = await cloneRequest(baseUrl, input, init, authToken);
+			try {
+				const response = await fetch(attempt);
+				if (isServerDownStatus(response.status)) {
+					lastResponse = response;
+					continue;
+				}
+				promoteServer(baseUrl);
+				if (response.status === 401) {
+					authToken = await getAuthToken();
+					return await fetch(await cloneRequest(baseUrl, input, init, authToken));
+				}
+				return response;
+			} catch (error) {
+				lastError = error;
+				continue;
+			}
+		}
+		if (lastResponse) return lastResponse;
+		if (lastError instanceof Error) throw lastError;
+		throw new Error("All servers unreachable");
+	}
+	async function logout() {
+		if (apiKey) {
+			apiKey = void 0;
+			authToken = void 0;
+			return;
+		}
+		for (const server of identityServers) try {
+			const response = await fetch(server + "/api/auth/sign-out", {
+				method: "POST",
+				credentials: "include",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({})
+			});
+			if (isServerDownStatus(response.status)) continue;
+			if (!response.ok) console.error("Identity - Failed signing out from " + server);
+			else {
+				await multiServersRetryWithAuth("http://localhost/api/lumiblue-token", {
+					method: "DELETE",
+					credentials: "include"
+				});
+				authToken = void 0;
+			}
+		} catch (error) {
+			console.error("Identity - Failed signing out", error);
+		}
+	}
+	const baseClient = createClient(createConfig({
+		auth: () => authToken,
+		credentials: "include",
+		baseUrl: availableServers[0],
+		fetch: multiServersRetryWithAuth
+	}));
+	return Object.assign(baseClient, {
+		logout,
+		getAvailableServers,
+		setApiKey,
+		setToken
+	});
+}
+/** Default shared client used by `new Sdk()` when no client is passed. */
+var client = createSdkClient();
+//#endregion
+//#region src/backend/sdk.gen.ts
+var HeyApiClient = class {
+	constructor(args) {
+		this.client = args?.client ?? client;
+	}
+};
+var HeyApiRegistry = class {
+	constructor() {
+		this.defaultKey = "default";
+		this.instances = /* @__PURE__ */ new Map();
+	}
+	get(key) {
+		const instance = this.instances.get(key ?? this.defaultKey);
+		if (!instance) throw new Error(`No SDK client found. Create one with "new Sdk()" to fix this error.`);
+		return instance;
+	}
+	set(value, key) {
+		this.instances.set(key ?? this.defaultKey, value);
+	}
+};
+var Sdk = class Sdk extends HeyApiClient {
+	static {
+		this.__registry = new HeyApiRegistry();
+	}
+	constructor(args) {
+		super(args);
+		Sdk.__registry.set(this, args?.key);
+	}
+	/**
+	* Service health check response
+	*/
+	getApiHealth(options) {
+		return (options?.client ?? this.client).get({
+			url: "/api/health",
+			...options
+		});
+	}
+	/**
+	* Bearer Auth - service health check plus JWT payload
+	*/
+	getApiHealthMe(options) {
+		return (options?.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/health/me",
+			...options
+		});
+	}
+	/**
+	* Bulk delete projects by array of IDs (project-admin only).
+	*/
+	deleteApiVaultProjects(options) {
+		return (options.client ?? this.client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/projects",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* List all projects accessible to the authenticated user, with per-project secret count.
+	*/
+	getApiVaultProjects(options) {
+		return (options?.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/projects",
+			...options
+		});
+	}
+	/**
+	* Bulk update projects (project-admin only).
+	*/
+	patchApiVaultProjects(options) {
+		return (options.client ?? this.client).patch({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/projects",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Create one or more projects and auto-assign the creator as admin on each.
+	*/
+	putApiVaultProjects(options) {
+		return (options.client ?? this.client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/projects",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Get all secrets for a project, pivoted by environment (dev, staging, production).
+	*/
+	getApiVaultProjectsByProjectIdSecrets(options) {
+		return (options.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/projects/{projectId}/secrets",
+			...options
+		});
+	}
+	/**
+	* Reveal the decrypted plaintext value of a single secret. Call on demand when the user chooses to view it.
+	*/
+	getApiVaultSecretsBySecretId(options) {
+		return (options.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/secrets/{secretId}",
+			...options
+		});
+	}
+	/**
+	* Update a single secret value. The plaintext value is encrypted before persisting.
+	*/
+	patchApiVaultSecretsBySecretId(options) {
+		return (options.client ?? this.client).patch({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/secrets/{secretId}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Inject secrets for a machine identity. Authenticates via SHA-256 hash of machineId.
+	*/
+	postApiVaultInject(options) {
+		return (options.client ?? this.client).post({
+			url: "/api/vault/inject",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Batch query projects by array of IDs (access-scoped).
+	*/
+	postApiVaultProjectsQuery(options) {
+		return (options.client ?? this.client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/projects/query",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Bulk delete secrets by array of IDs (permission-scoped).
+	*/
+	deleteApiVaultSecrets(options) {
+		return (options.client ?? this.client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/secrets",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Bulk update secrets (permission-scoped).
+	*/
+	patchApiVaultSecrets(options) {
+		return (options.client ?? this.client).patch({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/secrets",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Bulk create secrets (plaintext values are encrypted before persisting).
+	*/
+	putApiVaultSecrets(options) {
+		return (options.client ?? this.client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/secrets",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Batch query secrets by array of IDs (permission-scoped).
+	*/
+	postApiVaultSecretsQuery(options) {
+		return (options.client ?? this.client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/secrets/query",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Turn DMS off by hard-deleting the dms row (owner only). Idempotent when already off.
+	*/
+	deleteApiVaultProjectsByProjectIdDms(options) {
+		return (options.client ?? this.client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/projects/{projectId}/dms",
+			...options
+		});
+	}
+	/**
+	* Read DMS settings for a vault project (owner only). Missing row returns stable off payload.
+	*/
+	getApiVaultProjectsByProjectIdDms(options) {
+		return (options.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/projects/{projectId}/dms",
+			...options
+		});
+	}
+	/**
+	* Edit DMS settings (owner only). Emails-only edits preserve delivery/reminder/claim fields.
+	*/
+	patchApiVaultProjectsByProjectIdDms(options) {
+		return (options.client ?? this.client).patch({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/projects/{projectId}/dms",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Arm / create DMS for a project (owner only). Resets reminder, delivery, and claim cursors.
+	*/
+	putApiVaultProjectsByProjectIdDms(options) {
+		return (options.client ?? this.client).put({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/vault/projects/{projectId}/dms",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Public proof-of-life HTML page (signed magic-link token; no JWT).
+	*/
+	getApiDmsProofByToken(options) {
+		return (options.client ?? this.client).get({
+			url: "/api/dms/proof/{token}",
+			...options
+		});
+	}
+	/**
+	* Public proof-of-life update. Omit deliveryDate to extend by DMS_DEFAULT_EXTEND_DAYS.
+	*/
+	patchApiDmsProofByToken(options) {
+		return (options.client ?? this.client).patch({
+			url: "/api/dms/proof/{token}",
+			...options
+		});
+	}
+	/**
+	* Public project wipe via claim token. Confirmation must equal the project name.
+	*/
+	deleteApiDmsClaimByToken(options) {
+		return (options.client ?? this.client).delete({
+			url: "/api/dms/claim/{token}",
+			...options
+		});
+	}
+	/**
+	* Public claim HTML page with project notes and decrypted secrets (token credential).
+	*/
+	getApiDmsClaimByToken(options) {
+		return (options.client ?? this.client).get({
+			url: "/api/dms/claim/{token}",
+			...options
+		});
+	}
+	/**
+	* List audit logs for a project. Only accessible by project admins. Supports date range filtering, pagination, and optional filters.
+	*/
+	getApiProjectsByProjectIdAuditLogs(options) {
+		return (options.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/projects/{projectId}/audit-logs",
+			...options
+		});
+	}
+	/**
+	* List all admins for a project
+	*/
+	getApiProjectsByProjectIdAdmins(options) {
+		return (options.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/projects/{projectId}/admins",
+			...options
+		});
+	}
+	/**
+	* Add a new admin to a project
+	*/
+	postApiProjectsByProjectIdAdmins(options) {
+		return (options.client ?? this.client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/projects/{projectId}/admins",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Remove an admin from a project
+	*/
+	deleteApiProjectsByProjectIdAdminsBySubjectId(options) {
+		return (options.client ?? this.client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/projects/{projectId}/admins/{subjectId}",
+			...options
+		});
+	}
+	/**
+	* List all users with access to a project (admins and/or users with permission grants)
+	*/
+	getApiProjectsByProjectIdAccess(options) {
+		return (options.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/projects/{projectId}/access",
+			...options
+		});
+	}
+	/**
+	* List or search all subjects in the authenticated tenant (users and machines)
+	*/
+	getApiSubjects(options) {
+		return (options?.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/subjects",
+			...options
+		});
+	}
+	/**
+	* List all tenant users annotated with admin status and permission-grant count for this project
+	*/
+	getApiProjectsByProjectIdSubjects(options) {
+		return (options.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/projects/{projectId}/subjects",
+			...options
+		});
+	}
+	/**
+	* Get the permission matrix for a user subject within a project
+	*/
+	getApiProjectsByProjectIdPermissionsMatrix(options) {
+		return (options.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/projects/{projectId}/permissions/matrix",
+			...options
+		});
+	}
+	/**
+	* Atomically add and remove permissions for a user subject in a project
+	*/
+	postApiProjectsByProjectIdPermissionsBatch(options) {
+		return (options.client ?? this.client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/projects/{projectId}/permissions/batch",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Get permission change audit logs for a project
+	*/
+	getApiProjectsByProjectIdPermissionsAuditLogs(options) {
+		return (options.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/projects/{projectId}/permissions/audit-logs",
+			...options
+		});
+	}
+	/**
+	* Get a read-only permission summary for a machine
+	*/
+	getApiMachinesByIdPermissions(options) {
+		return (options.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/machines/{id}/permissions",
+			...options
+		});
+	}
+	/**
+	* Assignable permission matrix for an owned machine (secrets the caller can see)
+	*/
+	getApiMachinesByIdPermissionsMatrix(options) {
+		return (options.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/machines/{id}/permissions/matrix",
+			...options
+		});
+	}
+	/**
+	* Add/remove permissions on an owned machine, capped by secrets the caller can see
+	*/
+	postApiMachinesByIdPermissionsBatch(options) {
+		return (options.client ?? this.client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/machines/{id}/permissions/batch",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Regenerate a machine ID (old ID invalidated immediately)
+	*/
+	postApiMachinesByIdRegenerate(options) {
+		return (options.client ?? this.client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/machines/{id}/regenerate",
+			...options
+		});
+	}
+	/**
+	* Delete a machine (cascade permissions)
+	*/
+	deleteApiMachinesById(options) {
+		return (options.client ?? this.client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/machines/{id}",
+			...options
+		});
+	}
+	/**
+	* Get a single machine by ID (masked)
+	*/
+	getApiMachinesById(options) {
+		return (options.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/machines/{id}",
+			...options
+		});
+	}
+	/**
+	* Rename a machine (name only)
+	*/
+	patchApiMachinesById(options) {
+		return (options.client ?? this.client).patch({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/machines/{id}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Bulk delete machines (cascade permissions)
+	*/
+	deleteApiMachines(options) {
+		return (options.client ?? this.client).delete({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/machines",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* List own machines (creator-scoped, masked IDs)
+	*/
+	getApiMachines(options) {
+		return (options?.client ?? this.client).get({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/machines",
+			...options
+		});
+	}
+	/**
+	* Bulk update machine names
+	*/
+	patchApiMachines(options) {
+		return (options.client ?? this.client).patch({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/machines",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Create a new machine identity (rawId shown once)
+	*/
+	postApiMachines(options) {
+		return (options.client ?? this.client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/machines",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Batch-get machines by IDs
+	*/
+	postApiMachinesQuery(options) {
+		return (options.client ?? this.client).post({
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/machines/query",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Clears the lumiblue-token HttpOnly cookie so the browser stops sending it on subsequent requests.
+	*/
+	deleteApiLumiblueToken(options) {
+		return (options?.client ?? this.client).delete({
+			url: "/api/lumiblue-token",
+			...options
+		});
+	}
+};
+//#endregion
+export { Sdk, client, createSdkClient };