@miadi/connector 0.0.0-stage → 0.1.1

package/dist/oauth.d.ts

@@ -0,0 +1,89 @@
+/**
+ * OAuth 2.1 for the connector, so ChatGPT (and any MCP client that speaks
+ * the MCP authorization spec) can sign a person in.
+ *
+ * There is no password: a person proves who they are with the Miadi person
+ * token they already hold. The sign-in page asks for it once, Miadi says
+ * whose it is, and from then on the client holds connector tokens only. A
+ * Miadi person token sent directly as a Bearer token is also accepted, so a
+ * terminal client (Claude Code, curl) needs no OAuth dance.
+ */
+import type { Request, Response } from "express";
+import type { OAuthServerProvider, AuthorizationParams } from "@modelcontextprotocol/sdk/server/auth/provider.js";
+import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
+import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+import type { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationRequest } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { JsonFile } from "./store.js";
+export declare const SCOPE_READ = "miadi:read";
+export declare const SCOPE_CONTRIBUTE = "miadi:contribute";
+export declare const SCOPES: string[];
+/** Who a Miadi person token belongs to, as Miadi itself answers. */
+export interface Person {
+    id: string;
+    name: string;
+    /** The Miadi person token, so calls to Miadi are made as this person. */
+    token: string;
+}
+export type Identify = (token: string) => Promise<Person | null>;
+interface Pending {
+    client_id: string;
+    params: {
+        state?: string;
+        scopes?: string[];
+        codeChallenge: string;
+        redirectUri: string;
+        resource?: string;
+    };
+    created_at: number;
+}
+interface Grant {
+    client_id: string;
+    person: Person;
+    scopes: string[];
+    expires_at: number;
+    resource?: string;
+}
+interface CodeGrant extends Grant {
+    codeChallenge: string;
+    redirectUri: string;
+}
+interface TokenGrant extends Grant {
+    kind: "access" | "refresh";
+}
+export interface OAuthState {
+    clients: Record<string, OAuthClientInformationFull>;
+    pending: Record<string, Pending>;
+    codes: Record<string, CodeGrant>;
+    tokens: Record<string, TokenGrant>;
+}
+export declare const emptyOAuthState: () => OAuthState;
+export declare class MiadiOAuthProvider implements OAuthServerProvider {
+    private readonly state;
+    private readonly identify;
+    /**
+     * The issuer as the metadata states it. It goes back on every authorization
+     * response as `iss` (RFC 9207), which ChatGPT requires to use its stable
+     * callback URL.
+     */
+    private readonly issuer?;
+    private readonly confirmPath;
+    private readonly direct;
+    constructor(state: JsonFile<OAuthState>, identify: Identify, 
+    /**
+     * The issuer as the metadata states it. It goes back on every authorization
+     * response as `iss` (RFC 9207), which ChatGPT requires to use its stable
+     * callback URL.
+     */
+    issuer?: string | undefined, confirmPath?: string);
+    get clientsStore(): OAuthRegisteredClientsStore;
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    /** POST from the sign-in page: the person's token, or a refusal. */
+    confirm(req: Request, res: Response): Promise<void>;
+    challengeForAuthorizationCode(_client: OAuthClientInformationFull, code: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, code: string): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[]): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    revokeToken(_client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+    private issue;
+}
+export {};

package/dist/oauth.js

@@ -0,0 +1,258 @@
+import { InvalidGrantError, InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { escapeHtml } from "@miadi/node-service-kit/format";
+import { digest, newSecret } from "./store.js";
+export const SCOPE_READ = "miadi:read";
+export const SCOPE_CONTRIBUTE = "miadi:contribute";
+export const SCOPES = [SCOPE_READ, SCOPE_CONTRIBUTE];
+export const emptyOAuthState = () => ({ clients: {}, pending: {}, codes: {}, tokens: {} });
+const ACCESS_TTL = 8 * 3600;
+const REFRESH_TTL = 90 * 24 * 3600;
+const CODE_TTL = 600;
+const PENDING_TTL = 1800;
+const DIRECT_TTL = 300;
+const now = () => Math.floor(Date.now() / 1000);
+export class MiadiOAuthProvider {
+    state;
+    identify;
+    issuer;
+    confirmPath;
+    direct = new Map();
+    constructor(state, identify, 
+    /**
+     * The issuer as the metadata states it. It goes back on every authorization
+     * response as `iss` (RFC 9207), which ChatGPT requires to use its stable
+     * callback URL.
+     */
+    issuer, confirmPath = "/authorize/confirm") {
+        this.state = state;
+        this.identify = identify;
+        this.issuer = issuer;
+        this.confirmPath = confirmPath;
+    }
+    get clientsStore() {
+        return {
+            getClient: (id) => this.state.read().clients[id],
+            registerClient: (client) => {
+                const full = {
+                    ...client,
+                    client_id: `miadi-${newSecret(12)}`,
+                    client_id_issued_at: now(),
+                };
+                this.state.update((s) => {
+                    s.clients[full.client_id] = full;
+                });
+                return full;
+            },
+        };
+    }
+    async authorize(client, params, res) {
+        const requestId = newSecret(18);
+        this.state.update((s) => {
+            prune(s);
+            s.pending[requestId] = {
+                client_id: client.client_id,
+                params: {
+                    state: params.state,
+                    scopes: params.scopes,
+                    codeChallenge: params.codeChallenge,
+                    redirectUri: params.redirectUri,
+                    resource: params.resource?.href,
+                },
+                created_at: now(),
+            };
+        });
+        res.status(200).type("html").send(signInPage({ requestId, client, scopes: wanted(params.scopes), action: this.confirmPath }));
+    }
+    /** POST from the sign-in page: the person's token, or a refusal. */
+    async confirm(req, res) {
+        const body = (req.body ?? {});
+        const s = this.state.read();
+        const pending = s.pending[body.request_id ?? ""];
+        if (!pending || now() - pending.created_at > PENDING_TTL) {
+            res.status(400).type("html").send(page("Sign-in expired", "<p>This sign-in request has expired. Start again from your client.</p>"));
+            return;
+        }
+        const client = s.clients[pending.client_id];
+        const redirect = new URL(pending.params.redirectUri);
+        if (pending.params.state)
+            redirect.searchParams.set("state", pending.params.state);
+        if (this.issuer)
+            redirect.searchParams.set("iss", this.issuer);
+        if (body.decision === "deny") {
+            this.state.update((st) => delete st.pending[body.request_id]);
+            redirect.searchParams.set("error", "access_denied");
+            res.redirect(302, redirect.href);
+            return;
+        }
+        const person = await this.identify(String(body.person_token ?? "").trim());
+        if (!person) {
+            res
+                .status(401)
+                .type("html")
+                .send(signInPage({
+                requestId: body.request_id,
+                client,
+                scopes: wanted(pending.params.scopes),
+                action: this.confirmPath,
+                error: "Miadi did not recognise that person token.",
+            }));
+            return;
+        }
+        let scopes = wanted(pending.params.scopes);
+        if (body.contribute !== "on")
+            scopes = scopes.filter((x) => x !== SCOPE_CONTRIBUTE);
+        const code = newSecret(24);
+        this.state.update((st) => {
+            delete st.pending[body.request_id];
+            st.codes[digest(code)] = {
+                client_id: pending.client_id,
+                person,
+                scopes,
+                expires_at: now() + CODE_TTL,
+                resource: pending.params.resource,
+                codeChallenge: pending.params.codeChallenge,
+                redirectUri: pending.params.redirectUri,
+            };
+        });
+        redirect.searchParams.set("code", code);
+        res.redirect(302, redirect.href);
+    }
+    async challengeForAuthorizationCode(_client, code) {
+        const grant = this.state.read().codes[digest(code)];
+        if (!grant)
+            throw new InvalidGrantError("Unknown authorization code");
+        return grant.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, code) {
+        let grant;
+        this.state.update((s) => {
+            grant = s.codes[digest(code)];
+            delete s.codes[digest(code)];
+        });
+        if (!grant || grant.client_id !== client.client_id || grant.expires_at < now()) {
+            throw new InvalidGrantError("Authorization code is invalid or expired");
+        }
+        return this.issue(grant);
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes) {
+        let grant;
+        this.state.update((s) => {
+            const key = digest(refreshToken);
+            grant = s.tokens[key];
+            if (grant?.kind === "refresh")
+                delete s.tokens[key];
+        });
+        if (!grant || grant.kind !== "refresh" || grant.client_id !== client.client_id || grant.expires_at < now()) {
+            throw new InvalidGrantError("Refresh token is invalid or expired");
+        }
+        const narrowed = scopes?.length ? grant.scopes.filter((x) => scopes.includes(x)) : grant.scopes;
+        return this.issue({ ...grant, scopes: narrowed });
+    }
+    async verifyAccessToken(token) {
+        const grant = this.state.read().tokens[digest(token)];
+        if (grant && grant.kind === "access") {
+            if (grant.expires_at < now())
+                throw new InvalidTokenError("Access token expired");
+            return info(token, grant.client_id, grant.scopes, grant.expires_at, grant.person, grant.resource);
+        }
+        // A Miadi person token used directly (terminal clients).
+        const cached = this.direct.get(digest(token));
+        if (cached && cached.until > now()) {
+            return info(token, "direct", SCOPES, cached.until, cached.person);
+        }
+        const person = await this.identify(token);
+        if (!person)
+            throw new InvalidTokenError("Unknown token");
+        const until = now() + DIRECT_TTL;
+        this.direct.set(digest(token), { person, until });
+        return info(token, "direct", SCOPES, until, person);
+    }
+    async revokeToken(_client, request) {
+        this.state.update((s) => {
+            delete s.tokens[digest(request.token)];
+        });
+    }
+    issue(grant) {
+        const access = newSecret();
+        const refresh = newSecret();
+        this.state.update((s) => {
+            prune(s);
+            const base = { client_id: grant.client_id, person: grant.person, scopes: grant.scopes, resource: grant.resource };
+            s.tokens[digest(access)] = { ...base, kind: "access", expires_at: now() + ACCESS_TTL };
+            s.tokens[digest(refresh)] = { ...base, kind: "refresh", expires_at: now() + REFRESH_TTL };
+        });
+        return {
+            access_token: access,
+            token_type: "bearer",
+            expires_in: ACCESS_TTL,
+            refresh_token: refresh,
+            scope: grant.scopes.join(" "),
+        };
+    }
+}
+function info(token, clientId, scopes, expiresAt, person, resource) {
+    return {
+        token,
+        clientId,
+        scopes,
+        expiresAt,
+        resource: resource ? new URL(resource) : undefined,
+        extra: { person },
+    };
+}
+function wanted(scopes) {
+    const asked = (scopes ?? []).filter((x) => SCOPES.includes(x));
+    return asked.length ? asked : [...SCOPES];
+}
+function prune(s) {
+    const t = now();
+    for (const [k, v] of Object.entries(s.pending))
+        if (t - v.created_at > PENDING_TTL)
+            delete s.pending[k];
+    for (const [k, v] of Object.entries(s.codes))
+        if (v.expires_at < t)
+            delete s.codes[k];
+    for (const [k, v] of Object.entries(s.tokens))
+        if (v.expires_at < t)
+            delete s.tokens[k];
+}
+function page(title, body) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<style>
+:root{color-scheme:light dark;--bg:#fbfaf7;--fg:#1d1b18;--muted:#5b5650;--line:#d9d4cc;--accent:#7a4a00}
+@media (prefers-color-scheme:dark){:root{--bg:#141311;--fg:#ece8e1;--muted:#b3ada4;--line:#3a3631;--accent:#ffd700}}
+body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.5 system-ui,sans-serif}
+main{max-width:34rem;margin:0 auto;padding:2rem 1rem}
+h1{font-size:1.4rem;margin:0 0 .5rem}
+p,li{color:var(--muted)}
+label{display:block;margin:1rem 0 .3rem;font-weight:600}
+input[type=password]{width:100%;box-sizing:border-box;padding:.6rem;border:1px solid var(--line);border-radius:.4rem;background:transparent;color:var(--fg);font:inherit}
+.row{display:flex;gap:.6rem;margin-top:1.2rem;flex-wrap:wrap}
+button{padding:.6rem 1.1rem;border-radius:.4rem;border:1px solid var(--line);background:transparent;color:var(--fg);font:inherit;cursor:pointer}
+button.primary{border-color:var(--accent);outline:1px solid var(--accent)}
+.err{color:#b00020}
+@media (prefers-color-scheme:dark){.err{color:#ff8a80}}
+</style></head><body><main>${body}</main></body></html>`;
+}
+function signInPage(o) {
+    const name = o.client?.client_name || o.client?.client_id || "An MCP client";
+    const contribute = o.scopes.includes(SCOPE_CONTRIBUTE);
+    return page("Sign in to Miadi", `<h1>Sign in to Miadi</h1>
+<p><strong>${escapeHtml(name)}</strong> asks to use Miadi as you.</p>
+<ul>
+<li>Read sessions, reviews, episodes, circles and the records people contributed.</li>
+${contribute ? "<li>Contribute in your name: observations, inquiries, links, handoffs and proposals. Nothing it proposes runs, publishes or closes without a person's approval.</li>" : ""}
+</ul>
+${o.error ? `<p class="err" role="alert">${escapeHtml(o.error)}</p>` : ""}
+<form method="post" action="${escapeHtml(o.action)}">
+<input type="hidden" name="request_id" value="${escapeHtml(o.requestId)}">
+<label for="person_token">Your Miadi person token</label>
+<input id="person_token" name="person_token" type="password" autocomplete="off" required>
+${contribute ? '<label><input type="checkbox" name="contribute" checked> Allow contributions in my name</label>' : ""}
+<div class="row">
+<button class="primary" type="submit" name="decision" value="allow">Sign in</button>
+<button type="submit" name="decision" value="deny" formnovalidate>Refuse</button>
+</div>
+</form>`);
+}

package/dist/people.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Who a Miadi person token belongs to, answered by Miadi itself:
+ * GET /api/identity/me with the token as Bearer. The answer carries the
+ * person, their role, their API tier (`write`, `read` or none, lib/api-access.ts
+ * in Miadi) and their permissions. The connector applies that same tier to
+ * every tool, so a person reaches through it exactly what they reach in Miadi.
+ */
+import type { Person } from "./oauth.js";
+export type ApiTier = "write" | "read" | null;
+export interface MiadiPerson extends Person {
+    role?: string;
+    api_tier: ApiTier;
+    permissions: string[];
+}
+export declare function identifyThroughMiadi(miadiUrl: string, fetchImpl?: typeof fetch): (token: string) => Promise<MiadiPerson | null>;

package/dist/people.js

@@ -0,0 +1,28 @@
+export function identifyThroughMiadi(miadiUrl, fetchImpl = fetch) {
+    return async (token) => {
+        if (!token || token.length < 16)
+            return null;
+        let res;
+        try {
+            res = await fetchImpl(`${miadiUrl}/api/identity/me`, {
+                headers: { accept: "application/json", authorization: `Bearer ${token}` },
+            });
+        }
+        catch {
+            return null;
+        }
+        if (!res.ok)
+            return null;
+        const me = await res.json().catch(() => null);
+        if (!me?.person?.id)
+            return null;
+        return {
+            id: String(me.person.id),
+            name: String(me.person.name ?? me.person.id),
+            token,
+            role: me.person.role,
+            api_tier: me.api_tier === "write" || me.api_tier === "read" ? me.api_tier : null,
+            permissions: Array.isArray(me.permissions) ? me.permissions.map(String) : [],
+        };
+    };
+}

package/dist/records.d.ts

@@ -0,0 +1,86 @@
+export declare const CIRCLES: readonly [{
+    readonly id: "story";
+    readonly glyph: "📖";
+    readonly name: "Story";
+    readonly accountable_for: "An author can build chapters, music, prompts and narrative beats from lived observations and imagined futures, retaining authorship.";
+    readonly returns: "A human-selected artistic direction grounded in identifiable source material.";
+}, {
+    readonly id: "stewardship";
+    readonly glyph: "🌿";
+    readonly name: "Stewardship";
+    readonly accountable_for: "Participants have clear consent, cultural boundaries, relationships and genuine agency.";
+    readonly returns: "A stewardship record identifying applicable responsibilities, relationships, and human-held decisions.";
+}, {
+    readonly id: "engineering";
+    readonly glyph: "🧠";
+    readonly name: "Engineering";
+    readonly accountable_for: "Useful capabilities work reliably; agents return deliverables that support creation.";
+    readonly returns: "Demonstrable capabilities, tested implementations, and inspectable engineering contributions.";
+}, {
+    readonly id: "evaluation";
+    readonly glyph: "🔬";
+    readonly name: "Evaluation";
+    readonly accountable_for: "Operational evidence and creator experience are visible as distinct assessments; genuine provider traces accompany measured claims.";
+    readonly returns: "A reproducible evaluation report distinguishing source evidence, model interpretation, technical reliability, and artistic usefulness.";
+}, {
+    readonly id: "continuity";
+    readonly glyph: "🪶";
+    readonly name: "Continuity";
+    readonly accountable_for: "The author or a new agent can find what matters, how it was learned, and how to continue without reconstructing the session history.";
+    readonly returns: "A navigable creative history that human participants and computational agents can continue developing.";
+}];
+export type CircleId = (typeof CIRCLES)[number]["id"];
+export declare const CIRCLE_IDS: [CircleId, ...CircleId[]];
+export declare const DOMAINS: readonly ["creative", "ceremonial", "engineering"];
+/** #815 "claim category": what kind of statement a record makes. */
+export declare const CLAIM_CATEGORIES: readonly ["observed", "hypothesis", "desired_future", "fiction", "verified_implementation"];
+export type ClaimCategory = (typeof CLAIM_CATEGORIES)[number];
+export declare const RECORD_KINDS: readonly ["observation", "inquiry", "link", "work_proposal", "run_request", "handoff", "source_intent", "review_operation_request", "deep_diver_request", "review_episode_link_request", "calendar_event_draft", "session_completion_proposal"];
+export type RecordKind = (typeof RECORD_KINDS)[number];
+/** #816 handoff states. */
+export declare const HANDOFF_STATES: readonly ["pending", "blocked", "ready", "in_progress", "completed", "withdrawn"];
+export type HandoffState = (typeof HANDOFF_STATES)[number];
+/** Approval of a request that a person must grant before anything runs. */
+export declare const APPROVAL_STATES: readonly ["awaiting_approval", "approved", "declined", "not_required"];
+export type ApprovalState = (typeof APPROVAL_STATES)[number];
+export interface Actor {
+    person_id: string;
+    name: string;
+    /** The OAuth client the person used, e.g. ChatGPT's registration id, or "direct". */
+    client_id: string;
+    client_name?: string;
+}
+export interface ConnectorRecord {
+    /** Typed stable id, `<kind>:<uuid>`. */
+    id: string;
+    kind: RecordKind;
+    created_at: string;
+    actor: Actor;
+    /** The role the person said they act in (free text: author, steward, agent, reviewer…). */
+    role?: string;
+    intention?: string;
+    claim_category?: ClaimCategory;
+    circle?: CircleId;
+    from_circle?: CircleId;
+    to_circle?: CircleId;
+    domain?: (typeof DOMAINS)[number];
+    consent_boundary?: string;
+    /** References this record is about: miadi-review:<uuid>, miadi-chronicle://<n>, owner/repo#n, session:<uuid>, https URLs. */
+    refs: string[];
+    evidence_refs: string[];
+    /** The record's content, by kind. */
+    body: Record<string, unknown>;
+    state?: HandoffState;
+    approval_state?: ApprovalState;
+    next_action?: string;
+    /** A later record that changes this one points back with `supersedes`. */
+    supersedes?: string;
+    idempotency_key?: string;
+    completion_receipt?: Record<string, unknown>;
+}
+export declare function newRecordId(kind: RecordKind): string;
+/**
+ * Fold the ledger: a record superseded by a later one shows the later one's
+ * state, approval and receipt, keeping its own id and history.
+ */
+export declare function current(records: ConnectorRecord[]): ConnectorRecord[];

package/dist/records.js

@@ -0,0 +1,91 @@
+/**
+ * The shared record and the five circles, as jgwill/Miadi#815 and #816 state
+ * them. Every contribution made through the connector is one ConnectorRecord
+ * appended to the ledger, with the person who made it.
+ */
+import { randomUUID } from "node:crypto";
+export const CIRCLES = [
+    {
+        id: "story",
+        glyph: "📖",
+        name: "Story",
+        accountable_for: "An author can build chapters, music, prompts and narrative beats from lived observations and imagined futures, retaining authorship.",
+        returns: "A human-selected artistic direction grounded in identifiable source material.",
+    },
+    {
+        id: "stewardship",
+        glyph: "🌿",
+        name: "Stewardship",
+        accountable_for: "Participants have clear consent, cultural boundaries, relationships and genuine agency.",
+        returns: "A stewardship record identifying applicable responsibilities, relationships, and human-held decisions.",
+    },
+    {
+        id: "engineering",
+        glyph: "🧠",
+        name: "Engineering",
+        accountable_for: "Useful capabilities work reliably; agents return deliverables that support creation.",
+        returns: "Demonstrable capabilities, tested implementations, and inspectable engineering contributions.",
+    },
+    {
+        id: "evaluation",
+        glyph: "🔬",
+        name: "Evaluation",
+        accountable_for: "Operational evidence and creator experience are visible as distinct assessments; genuine provider traces accompany measured claims.",
+        returns: "A reproducible evaluation report distinguishing source evidence, model interpretation, technical reliability, and artistic usefulness.",
+    },
+    {
+        id: "continuity",
+        glyph: "🪶",
+        name: "Continuity",
+        accountable_for: "The author or a new agent can find what matters, how it was learned, and how to continue without reconstructing the session history.",
+        returns: "A navigable creative history that human participants and computational agents can continue developing.",
+    },
+];
+export const CIRCLE_IDS = CIRCLES.map((c) => c.id);
+export const DOMAINS = ["creative", "ceremonial", "engineering"];
+/** #815 "claim category": what kind of statement a record makes. */
+export const CLAIM_CATEGORIES = ["observed", "hypothesis", "desired_future", "fiction", "verified_implementation"];
+export const RECORD_KINDS = [
+    "observation",
+    "inquiry",
+    "link",
+    "work_proposal",
+    "run_request",
+    "handoff",
+    "source_intent",
+    "review_operation_request",
+    "deep_diver_request",
+    "review_episode_link_request",
+    "calendar_event_draft",
+    "session_completion_proposal",
+];
+/** #816 handoff states. */
+export const HANDOFF_STATES = ["pending", "blocked", "ready", "in_progress", "completed", "withdrawn"];
+/** Approval of a request that a person must grant before anything runs. */
+export const APPROVAL_STATES = ["awaiting_approval", "approved", "declined", "not_required"];
+export function newRecordId(kind) {
+    return `${kind}:${randomUUID()}`;
+}
+/**
+ * Fold the ledger: a record superseded by a later one shows the later one's
+ * state, approval and receipt, keeping its own id and history.
+ */
+export function current(records) {
+    const byId = new Map();
+    for (const r of records) {
+        if (r.supersedes && byId.has(r.supersedes)) {
+            const base = byId.get(r.supersedes);
+            byId.set(r.supersedes, {
+                ...base,
+                state: r.state ?? base.state,
+                approval_state: r.approval_state ?? base.approval_state,
+                next_action: r.next_action ?? base.next_action,
+                completion_receipt: r.completion_receipt ?? base.completion_receipt,
+                history: [...(base.history ?? []), r.id],
+            });
+            continue;
+        }
+        byId.set(r.id, { ...r });
+    }
+    return [...byId.values()];
+}

package/dist/reviews.d.ts

@@ -0,0 +1,26 @@
+export declare function reviewToken(env?: NodeJS.ProcessEnv): string | undefined;
+export declare function videoIdOf(input: string): string | null;
+export declare function reviewIdOf(input: string): string | null;
+export interface ReviewSummary {
+    review_id: string;
+    ref: string;
+    url: string;
+    title: string | null;
+    video_id: string | null;
+    video_url: string | null;
+    latest_version: number | null;
+    diver_ready: unknown;
+    created_at?: string;
+    updated_at?: string;
+}
+export declare class ReviewClient {
+    readonly baseUrl: string;
+    private readonly token;
+    private readonly fetchImpl;
+    constructor(baseUrl: string, token: string | undefined, fetchImpl?: typeof fetch);
+    get canSearch(): boolean;
+    /** `/review/<id>/json`, optionally pinned to a version. Null on 404. */
+    get(reviewId: string, version?: number): Promise<any | null>;
+    search(q: string, limit?: number): Promise<any[]>;
+    summary(r: any): ReviewSummary;
+}