@msg91comm/m91 0.0.0-stage → 1.2.0

package/dist/src/exceptions.js

@@ -0,0 +1,199 @@
+/**
+ * Every failure the SDK can throw, and the one place an HTTP response becomes one.
+ *
+ * Branch on `.code` — a stable string the API contract pins down — never on
+ * `.message`, which is written for a person reading a terminal and is expected
+ * to change.
+ */
+export class M91Error extends Error {
+    code;
+    statusCode;
+    details;
+    constructor(message, code = 'M91_ERROR', statusCode, details) {
+        super(message);
+        this.name = new.target.name;
+        this.code = code;
+        this.statusCode = statusCode;
+        this.details = details;
+        // Without this, `err instanceof M91ValidationError` is false when the
+        // package is compiled down to ES5 by a consumer's bundler.
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/**
+ * 400/413. The request was wrong, and it is never retried.
+ *
+ * Also thrown locally, before any HTTP call, when a field breaks a documented
+ * limit. Every schema server-side is `.strict()`, so a mistyped field name is a
+ * 400 rather than a silent drop — and a round trip to learn that is a round
+ * trip wasted.
+ */
+export class M91ValidationError extends M91Error {
+    constructor(message, details, statusCode = 400, code = 'VALIDATION_ERROR') {
+        super(message, code, statusCode, details);
+    }
+}
+/** 401. Credential invalid, expired or revoked — nothing is cached server-side. */
+export class M91AuthError extends M91Error {
+    constructor(message = 'Unauthorized', details) {
+        super(message, 'UNAUTHORIZED', 401, details);
+    }
+}
+/** 403. Authenticated, but not allowed. On `close()` this means success. */
+export class M91ForbiddenError extends M91Error {
+    constructor(message = 'Forbidden', details) {
+        super(message, 'FORBIDDEN', 403, details);
+    }
+}
+/**
+ * 404. Absent — **or present and not yours**. The API answers the same way to
+ * both on purpose, so an id cannot become an oracle for what exists.
+ */
+export class M91NotFoundError extends M91Error {
+    constructor(message = 'Not found', details) {
+        super(message, 'NOT_FOUND', 404, details);
+    }
+}
+/**
+ * 409. The channel has nobody who can actually be woken.
+ *
+ * `unregistered` is the invited numbers with no M91 account — invited, never
+ * installed the app, and unreachable. An ordinary SMS would not pierce Do Not
+ * Disturb, would not repeat, and would not escalate.
+ */
+export class M91ChannelEmptyError extends M91Error {
+    unregistered;
+    constructor(message, unregistered = [], details) {
+        super(message, 'CHANNEL_EMPTY', 409, details);
+        this.unregistered = unregistered;
+    }
+}
+/**
+ * 429. 60 sends a minute per send link.
+ *
+ * `retryAfter` always has a value: the server sets `Retry-After` on every 429
+ * precisely so a caller does not have to guess, and the usual guess is to retry
+ * immediately and forever.
+ */
+export class M91RateLimitError extends M91Error {
+    retryAfter;
+    constructor(message = 'Rate limited', retryAfter = 60, details) {
+        super(message, 'RATE_LIMITED', 429, details);
+        this.retryAfter = retryAfter;
+    }
+}
+/** 5xx. Not the caller's fault. Retried with backoff before it reaches you. */
+export class M91ServerError extends M91Error {
+    constructor(message = 'Internal server error', statusCode = 500, details) {
+        super(message, 'INTERNAL_ERROR', statusCode, details);
+    }
+}
+/**
+ * The request never got an answer — DNS, TLS, connect or read timeout.
+ *
+ * Not retried. A send that timed out may or may not have raised an alert, and
+ * retrying it blindly is how one condition wakes a team four times.
+ */
+export class M91NetworkError extends M91Error {
+    constructor(message = 'Network error', details) {
+        super(message, 'NETWORK_ERROR', undefined, details);
+    }
+}
+/**
+ * The API said 2xx and **nobody's phone rang**.
+ *
+ * The failure mode integrations actually hit, and it is invisible if you only
+ * check the status code. `delivered` counts phones sent to, not the size of the
+ * roster: a channel of four whose device tokens are all stale answers 201 with
+ * `delivered: 0`.
+ *
+ * A *deduplicated* send is not this error — `delivered` is 0 because the same
+ * alert is already open and already ringing, which is success.
+ */
+export class M91DeliveryError extends M91Error {
+    delivered;
+    unregistered;
+    noDevice;
+    pending;
+    constructor(message, delivered = 0, unregistered = [], noDevice = 0, pending = 0) {
+        super(message, 'DELIVERY_FAILED');
+        this.delivered = delivered;
+        this.unregistered = unregistered;
+        this.noDevice = noDevice;
+        this.pending = pending;
+    }
+}
+/** `waitForDecision` ran out of time with no SHARED response. Nobody answered. */
+export class M91TimeoutError extends M91Error {
+    customId;
+    timeoutMs;
+    constructor(customId, timeoutMs) {
+        super(`Nobody answered '${customId}' within ${Math.round(timeoutMs / 1000)}s. The alert is still open.`, 'TIMEOUT');
+        this.customId = customId;
+        this.timeoutMs = timeoutMs;
+    }
+}
+/**
+ * Turn one HTTP response into either the payload or a thrown error.
+ *
+ * **Every M91 route answers in an envelope** — `{ success: true, data }` or
+ * `{ success: false, error: { code, message, details } }` — and this is the only
+ * place the SDK knows that. Everything above this line sees the inner `data`.
+ *
+ * The error class is chosen by HTTP status rather than by `error.code`, because
+ * the status is what the server derives the code from in the first place;
+ * keeping them in step in two places is how they drift apart. The body's `code`
+ * is still carried onto the error.
+ */
+export function unwrap(status, body, headers) {
+    const envelope = (body ?? {});
+    const err = envelope.error ?? {};
+    const details = err.details;
+    const code = err.code;
+    if (status >= 200 && status < 300) {
+        if (envelope && typeof envelope === 'object' && 'data' in envelope)
+            return envelope.data;
+        // A route outside the envelope, or a proxy that rewrote the body. Hand it
+        // back rather than inventing a failure the server never reported.
+        return body;
+    }
+    const message = err.message || `M91 request failed with HTTP ${status}`;
+    if (status === 409 || code === 'CHANNEL_EMPTY') {
+        const unregistered = details?.unregistered ?? [];
+        throw new M91ChannelEmptyError(message, unregistered, details);
+    }
+    if (status === 429)
+        throw new M91RateLimitError(message, retryAfter(headers) ?? 60, details);
+    if (status === 400)
+        throw withCode(new M91ValidationError(message, details), code);
+    if (status === 413) {
+        throw new M91ValidationError(message, details, 413, code || 'PAYLOAD_TOO_LARGE');
+    }
+    if (status === 401)
+        throw withCode(new M91AuthError(message, details), code);
+    if (status === 403)
+        throw withCode(new M91ForbiddenError(message, details), code);
+    if (status === 404)
+        throw withCode(new M91NotFoundError(message, details), code);
+    if (status >= 500)
+        throw new M91ServerError(message, status, details);
+    throw new M91Error(message, code || 'M91_ERROR', status, details);
+}
+function withCode(error, code) {
+    if (code)
+        error.code = code;
+    return error;
+}
+/** Seconds from `Retry-After`, or undefined. Header lookups are case-insensitive. */
+export function retryAfter(headers) {
+    if (!headers)
+        return undefined;
+    const raw = typeof headers.get === 'function'
+        ? headers.get('retry-after')
+        : Object.entries(headers).find(([k]) => k.toLowerCase() === 'retry-after')?.[1];
+    if (raw === null || raw === undefined)
+        return undefined;
+    const seconds = Number(String(raw).trim());
+    return Number.isFinite(seconds) ? Math.max(0, Math.trunc(seconds)) : undefined;
+}
+//# sourceMappingURL=exceptions.js.map

package/dist/src/exceptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../../src/exceptions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAS;IACb,UAAU,CAAU;IACpB,OAAO,CAAW;IAE3B,YAAY,OAAe,EAAE,IAAI,GAAG,WAAW,EAAE,UAAmB,EAAE,OAAiB;QACrF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IAC9C,YAAY,OAAe,EAAE,OAAiB,EAAE,UAAU,GAAG,GAAG,EAAE,IAAI,GAAG,kBAAkB;QACzF,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACxC,YAAY,OAAO,GAAG,cAAc,EAAE,OAAiB;QACrD,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAO,GAAG,WAAW,EAAE,OAAiB;QAClD,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IAC5C,YAAY,OAAO,GAAG,WAAW,EAAE,OAAiB;QAClD,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IACvC,YAAY,CAAW;IAEhC,YAAY,OAAe,EAAE,eAAyB,EAAE,EAAE,OAAiB;QACzE,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IACpC,UAAU,CAAS;IAE5B,YAAY,OAAO,GAAG,cAAc,EAAE,UAAU,GAAG,EAAE,EAAE,OAAiB;QACtE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,OAAO,cAAe,SAAQ,QAAQ;IAC1C,YAAY,OAAO,GAAG,uBAAuB,EAAE,UAAU,GAAG,GAAG,EAAE,OAAiB;QAChF,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAO,GAAG,eAAe,EAAE,OAAiB;QACtD,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IACnC,SAAS,CAAS;IAClB,YAAY,CAAW;IACvB,QAAQ,CAAS;IACjB,OAAO,CAAS;IAEzB,YACE,OAAe,EACf,SAAS,GAAG,CAAC,EACb,eAAyB,EAAE,EAC3B,QAAQ,GAAG,CAAC,EACZ,OAAO,GAAG,CAAC;QAEX,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAClC,QAAQ,CAAS;IACjB,SAAS,CAAS;IAE3B,YAAY,QAAgB,EAAE,SAAiB;QAC7C,KAAK,CACH,oBAAoB,QAAQ,YAAY,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,6BAA6B,EACjG,SAAS,CACV,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,IAAa,EAAE,OAA0C;IAC9F,MAAM,QAAQ,GAAG,CAAC,IAAI,IAAI,EAAE,CAAkB,CAAC;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAEtB,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;QACzF,0EAA0E;QAC1E,kEAAkE;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,gCAAgC,MAAM,EAAE,CAAC;IAExE,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC/C,MAAM,YAAY,GAAI,OAAmD,EAAE,YAAY,IAAI,EAAE,CAAC;QAC9F,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IAC7F,IAAI,MAAM,KAAK,GAAG;QAAE,MAAM,QAAQ,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACnF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,mBAAmB,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,KAAK,GAAG;QAAE,MAAM,QAAQ,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,GAAG;QAAE,MAAM,QAAQ,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IAClF,IAAI,MAAM,KAAK,GAAG;QAAE,MAAM,QAAQ,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACjF,IAAI,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAEtE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAqB,KAAQ,EAAE,IAAa;IAC3D,IAAI,IAAI;QAAG,KAA0B,CAAC,IAAI,GAAG,IAAI,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,UAAU,CAAC,OAA0C;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GACP,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU;QAC5C,CAAC,CAAE,OAAmB,CAAC,GAAG,CAAC,aAAa,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAiC,CAAC,CAAC,IAAI,CACpD,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa,CAC3C,EAAE,CAAC,CAAC,CAAC,CAAC;IACb,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC"}

package/dist/src/http.d.ts

@@ -0,0 +1,71 @@
+/**
+ * HTTP on native `fetch`, with the retry policy applied. Zero dependencies.
+ *
+ * The rules, which are the interesting part:
+ *
+ * - **429 is retried exactly once**, after exactly the delay the server asked
+ *   for. The send limit is 60/minute per link and every 429 carries
+ *   `Retry-After: 60`. Retrying a second time would be arguing with it.
+ * - **5xx is retried with backoff.** Not the caller's fault, and the alert has
+ *   not been raised, so repeating it cannot double-page anybody.
+ * - **4xx is never retried.** Not transient; the next identical request fails
+ *   identically.
+ * - **A network failure is never retried.** A send that timed out may or may not
+ *   have raised the alert — the response is what was lost, not necessarily the
+ *   request. Blind retries are how one condition wakes a team four times.
+ */
+export declare const USER_AGENT = "m91-node/1.0.0";
+/** Delays before the 2nd, 3rd and 4th attempt at a 5xx. Four requests total. */
+export declare const SERVER_BACKOFF: readonly [1000, 2000, 4000];
+export declare const RETRYABLE_STATUSES: Set<number>;
+/**
+ * A 429 whose `Retry-After` is longer than this is thrown rather than slept
+ * through. The server sends 60; anything far past that is a caller sitting
+ * blocked in an alerting path, which is worse than an error it can see.
+ */
+export declare const MAX_RETRY_AFTER_MS = 120000;
+/**
+ * Milliseconds to wait before trying again, or `null` to stop and throw.
+ * `attempt` is 1-based and counts requests already made.
+ */
+export declare function retryDelay(status: number, attempt: number, retryAfterSeconds?: number): number | null;
+/**
+ * Replace a send link's token with `***`, wherever it appears.
+ *
+ * **The token is the credential and it lives in the path**, so a URL is as
+ * sensitive as a password and must never reach a log, an error message or a
+ * stack trace intact. The server holds itself to the same rule — its error
+ * handler reports the route *pattern*, never `req.path`.
+ *
+ * This takes free text, not only a URL, and that is the point. Redacting only
+ * the URL the SDK interpolates is not enough: a fetch failure can carry the URL
+ * in its own message, so a carefully-redacted sentence would arrive with the
+ * raw token attached to it by the runtime.
+ *
+ * Query strings go too: a GET-form send carries the alert title, and titles
+ * routinely name customers and hosts.
+ */
+export declare function redact(text: string): string;
+export interface RequestOptions {
+    method: string;
+    url: string;
+    body?: unknown;
+    query?: Record<string, string>;
+}
+export interface TransportOptions {
+    /** Whole-request budget in milliseconds. Default 15s (5s connect + 10s read). */
+    timeoutMs?: number;
+    headers?: Record<string, string>;
+    /** Swappable so tests need no network and no mocking library. */
+    fetchImpl?: typeof fetch;
+    sleepImpl?: (ms: number) => Promise<void>;
+}
+export declare class Transport {
+    private readonly timeoutMs;
+    private readonly headers;
+    private readonly fetchImpl;
+    private readonly sleepImpl;
+    constructor(options?: TransportOptions);
+    request({ method, url, body, query }: RequestOptions): Promise<unknown>;
+}
+//# sourceMappingURL=http.d.ts.map

package/dist/src/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAE3C,gFAAgF;AAChF,eAAO,MAAM,cAAc,6BAA8B,CAAC;AAE1D,eAAO,MAAM,kBAAkB,aAAgC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAE1C;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYrG;AASD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG3C;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iEAAiE;IACjE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAID,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;gBAE9C,OAAO,GAAE,gBAAqB;IAepC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;CAsC9E"}

package/dist/src/http.js

@@ -0,0 +1,150 @@
+/**
+ * HTTP on native `fetch`, with the retry policy applied. Zero dependencies.
+ *
+ * The rules, which are the interesting part:
+ *
+ * - **429 is retried exactly once**, after exactly the delay the server asked
+ *   for. The send limit is 60/minute per link and every 429 carries
+ *   `Retry-After: 60`. Retrying a second time would be arguing with it.
+ * - **5xx is retried with backoff.** Not the caller's fault, and the alert has
+ *   not been raised, so repeating it cannot double-page anybody.
+ * - **4xx is never retried.** Not transient; the next identical request fails
+ *   identically.
+ * - **A network failure is never retried.** A send that timed out may or may not
+ *   have raised the alert — the response is what was lost, not necessarily the
+ *   request. Blind retries are how one condition wakes a team four times.
+ */
+import { M91NetworkError, retryAfter, unwrap } from './exceptions.js';
+export const USER_AGENT = 'm91-node/1.0.0';
+/** Delays before the 2nd, 3rd and 4th attempt at a 5xx. Four requests total. */
+export const SERVER_BACKOFF = [1000, 2000, 4000];
+export const RETRYABLE_STATUSES = new Set([500, 502, 503, 504]);
+/**
+ * A 429 whose `Retry-After` is longer than this is thrown rather than slept
+ * through. The server sends 60; anything far past that is a caller sitting
+ * blocked in an alerting path, which is worse than an error it can see.
+ */
+export const MAX_RETRY_AFTER_MS = 120_000;
+/**
+ * Milliseconds to wait before trying again, or `null` to stop and throw.
+ * `attempt` is 1-based and counts requests already made.
+ */
+export function retryDelay(status, attempt, retryAfterSeconds) {
+    if (status === 429) {
+        // Once, and only on the first 429. A second means the window has not
+        // actually cleared and the caller needs to hear about it.
+        if (attempt >= 2)
+            return null;
+        const wait = (retryAfterSeconds ?? 60) * 1000;
+        return wait > MAX_RETRY_AFTER_MS ? null : Math.max(wait, 0);
+    }
+    if (RETRYABLE_STATUSES.has(status)) {
+        return attempt > SERVER_BACKOFF.length ? null : SERVER_BACKOFF[attempt - 1];
+    }
+    return null;
+}
+/**
+ * Matches a send link anywhere — in a bare URL, or buried in a sentence — and
+ * takes any query string attached to it. Bounded on whitespace so it stops at
+ * the end of the URL rather than eating the rest of the message.
+ */
+const SEND_URL_RE = /(\/s\/)[^\s/?#]+(\?[^\s]*)?/g;
+/**
+ * Replace a send link's token with `***`, wherever it appears.
+ *
+ * **The token is the credential and it lives in the path**, so a URL is as
+ * sensitive as a password and must never reach a log, an error message or a
+ * stack trace intact. The server holds itself to the same rule — its error
+ * handler reports the route *pattern*, never `req.path`.
+ *
+ * This takes free text, not only a URL, and that is the point. Redacting only
+ * the URL the SDK interpolates is not enough: a fetch failure can carry the URL
+ * in its own message, so a carefully-redacted sentence would arrive with the
+ * raw token attached to it by the runtime.
+ *
+ * Query strings go too: a GET-form send carries the alert title, and titles
+ * routinely name customers and hosts.
+ */
+export function redact(text) {
+    if (typeof text !== 'string')
+        return text;
+    return text.replace(SEND_URL_RE, '$1***');
+}
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+export class Transport {
+    timeoutMs;
+    headers;
+    fetchImpl;
+    sleepImpl;
+    constructor(options = {}) {
+        this.timeoutMs = options.timeoutMs ?? 15_000;
+        this.headers = {
+            // A GET-form send answers with a rendered HTML page when the caller looks
+            // like a browser. That page exists so a person tapping a bookmark sees
+            // something other than a wall of JSON — but an SDK is not a person, and
+            // has to opt out of it explicitly.
+            accept: 'application/json',
+            'user-agent': USER_AGENT,
+            ...options.headers,
+        };
+        this.fetchImpl = options.fetchImpl ?? globalThis.fetch;
+        this.sleepImpl = options.sleepImpl ?? defaultSleep;
+    }
+    async request({ method, url, body, query }) {
+        const target = query ? `${url}?${new URLSearchParams(query).toString()}` : url;
+        let attempt = 0;
+        for (;;) {
+            attempt += 1;
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+            let status;
+            let headers;
+            let parsed;
+            try {
+                const response = await this.fetchImpl(target, {
+                    method,
+                    headers: body === undefined
+                        ? this.headers
+                        : { ...this.headers, 'content-type': 'application/json' },
+                    body: body === undefined ? undefined : JSON.stringify(body),
+                    signal: controller.signal,
+                });
+                status = response.status;
+                headers = response.headers;
+                parsed = await readBody(response);
+            }
+            catch (error) {
+                // Redacted AFTER composing, not before: a fetch failure can name the
+                // URL in its own message, so masking only our half still ships the token.
+                const reason = error instanceof Error ? error.message : String(error);
+                throw new M91NetworkError(redact(`Could not reach M91 at ${target}: ${reason}`));
+            }
+            finally {
+                clearTimeout(timer);
+            }
+            const delay = retryDelay(status, attempt, retryAfter(headers));
+            if (delay === null)
+                return unwrap(status, parsed, headers);
+            await this.sleepImpl(delay);
+        }
+    }
+}
+/**
+ * The parsed envelope, or something `unwrap` can still turn into an error.
+ *
+ * A non-JSON body here means a proxy, a load balancer or an HTML error page
+ * answered instead of M91. Wrapping the text in an envelope-shaped object keeps
+ * all the error construction in one place rather than adding a second path.
+ */
+async function readBody(response) {
+    const text = await response.text();
+    if (!text)
+        return { error: { message: `HTTP ${response.status} with an empty body` } };
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { error: { message: text.slice(0, 300) } };
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/src/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEtE,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAE3C,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC;AAE1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,iBAA0B;IACpF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,qEAAqE;QACrE,0DAA0D;QAC1D,IAAI,OAAO,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAC9C,OAAO,IAAI,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,WAAW,GAAG,8BAA8B,CAAC;AAEnD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAkBD,MAAM,YAAY,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE7F,MAAM,OAAO,SAAS;IACH,SAAS,CAAS;IAClB,OAAO,CAAyB;IAChC,SAAS,CAAe;IACxB,SAAS,CAAgC;IAE1D,YAAY,UAA4B,EAAE;QACxC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG;YACb,0EAA0E;YAC1E,uEAAuE;YACvE,wEAAwE;YACxE,mCAAmC;YACnC,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,UAAU;YACxB,GAAG,OAAO,CAAC,OAAO;SACnB,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;QACvD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAkB;QACxD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/E,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,SAAS,CAAC;YACR,OAAO,IAAI,CAAC,CAAC;YACb,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAEnE,IAAI,MAAc,CAAC;YACnB,IAAI,OAAgB,CAAC;YACrB,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;oBAC5C,MAAM;oBACN,OAAO,EAAE,IAAI,KAAK,SAAS;wBACzB,CAAC,CAAC,IAAI,CAAC,OAAO;wBACd,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC3D,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;oBAC3D,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBACH,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACzB,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;gBAC3B,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,qEAAqE;gBACrE,0EAA0E;gBAC1E,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,0BAA0B,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YACnF,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/D,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC3D,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,QAAQ,CAAC,MAAM,qBAAqB,EAAE,EAAE,CAAC;IACvF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,49 @@
+/**
+ * M91 — wake a human when software cannot carry on alone.
+ *
+ * An alert rings every phone in a channel at full volume, through silent mode
+ * and Do Not Disturb, and keeps ringing until somebody answers. HIGH and
+ * CRITICAL place a voice call if 45 seconds pass with no answer. Whoever takes
+ * it on is recorded, and it clears for everyone else.
+ *
+ * ```ts
+ * import { M91Client } from '@msg91comm/m91';
+ *
+ * const m91 = new M91Client(process.env.M91_SEND_LINK!);
+ * await m91.verify();                              // raises nothing; names the channel
+ * await m91.send('Payments API is down', { severity: 'CRITICAL', customId: 'payments-down' });
+ * await m91.close({ customId: 'payments-down' });
+ * ```
+ *
+ * And the reason an agent wants it — a question that blocks until a person
+ * answers on their phone:
+ *
+ * ```ts
+ * if (await m91.requestApproval('Refund 48,000 on ORD-40122?', { customId: 'refund-ORD-40122' })) {
+ *   await processRefund();
+ * }
+ * ```
+ *
+ * Everything here is a convenience over one URL. The send link works from a
+ * browser bar, a cron `curl` or an `<img>` tag with no client at all, and
+ * `M91URLBuilder` is for exactly those.
+ */
+export { M91Client } from './client.js';
+export type { ApprovalOptions, ClientOptions, SendOptions, WaitOptions } from './client.js';
+export { M91Platform, DEFAULT_BASE_URL } from './platform.js';
+export type { PlatformOptions } from './platform.js';
+export { M91URLBuilder, normalizeSendLink } from './url-builder.js';
+export type { BuildManySpec, BuildUrlOptions } from './url-builder.js';
+export { redact } from './http.js';
+export { M91Error, M91ValidationError, M91AuthError, M91ForbiddenError, M91NotFoundError, M91ChannelEmptyError, M91RateLimitError, M91ServerError, M91NetworkError, M91DeliveryError, M91TimeoutError, } from './exceptions.js';
+export { SEVERITIES, EFFECTS, ESCALATING_SEVERITIES, isApproved, validatePhone, buildAlertPayload, } from './models.js';
+export type { AlertDetail, AlertResponse, AlertStatus, ApiKeyInfo, ChannelInfo, Attachment, Decision, Response, Effect, InviteResult, ProvisionedChannel, Recipient, RecipientState, ResponseOption, Severity, } from './models.js';
+/**
+ * Kept in step with package.json by `tests/version.test.ts`, not by hand.
+ *
+ * ESM has no portable way to read package.json at runtime, so this number is
+ * written twice — and it drifted, reporting 1.0.0 while the package shipped as
+ * 1.1.0. A test is what makes two copies safe.
+ */
+export declare const VERSION = "1.2.0";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5F,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACpE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,UAAU,EACV,OAAO,EACP,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,UAAU,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,cAAc,EACd,QAAQ,GACT,MAAM,aAAa,CAAC;AAErB;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,UAAU,CAAC"}

package/dist/src/index.js

@@ -0,0 +1,45 @@
+/**
+ * M91 — wake a human when software cannot carry on alone.
+ *
+ * An alert rings every phone in a channel at full volume, through silent mode
+ * and Do Not Disturb, and keeps ringing until somebody answers. HIGH and
+ * CRITICAL place a voice call if 45 seconds pass with no answer. Whoever takes
+ * it on is recorded, and it clears for everyone else.
+ *
+ * ```ts
+ * import { M91Client } from '@msg91comm/m91';
+ *
+ * const m91 = new M91Client(process.env.M91_SEND_LINK!);
+ * await m91.verify();                              // raises nothing; names the channel
+ * await m91.send('Payments API is down', { severity: 'CRITICAL', customId: 'payments-down' });
+ * await m91.close({ customId: 'payments-down' });
+ * ```
+ *
+ * And the reason an agent wants it — a question that blocks until a person
+ * answers on their phone:
+ *
+ * ```ts
+ * if (await m91.requestApproval('Refund 48,000 on ORD-40122?', { customId: 'refund-ORD-40122' })) {
+ *   await processRefund();
+ * }
+ * ```
+ *
+ * Everything here is a convenience over one URL. The send link works from a
+ * browser bar, a cron `curl` or an `<img>` tag with no client at all, and
+ * `M91URLBuilder` is for exactly those.
+ */
+export { M91Client } from './client.js';
+export { M91Platform, DEFAULT_BASE_URL } from './platform.js';
+export { M91URLBuilder, normalizeSendLink } from './url-builder.js';
+export { redact } from './http.js';
+export { M91Error, M91ValidationError, M91AuthError, M91ForbiddenError, M91NotFoundError, M91ChannelEmptyError, M91RateLimitError, M91ServerError, M91NetworkError, M91DeliveryError, M91TimeoutError, } from './exceptions.js';
+export { SEVERITIES, EFFECTS, ESCALATING_SEVERITIES, isApproved, validatePhone, buildAlertPayload, } from './models.js';
+/**
+ * Kept in step with package.json by `tests/version.test.ts`, not by hand.
+ *
+ * ESM has no portable way to read package.json at runtime, so this number is
+ * written twice — and it drifted, reporting 1.0.0 while the package shipped as
+ * 1.1.0. A test is what makes two copies safe.
+ */
+export const VERSION = '1.2.0';
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGpE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,UAAU,EACV,OAAO,EACP,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAoBrB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC"}

package/dist/src/integrations/claude-agent-sdk.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Claude Agent SDK (`@anthropic-ai/claude-agent-sdk`): M91 as the permission
+ * prompt, and M91 as tools.
+ *
+ * **Permission prompt.** `createM91CanUseTool` is a `canUseTool` callback: the
+ * tools you name ring a phone and run only if a person approves. Everything
+ * else is allowed through untouched.
+ *
+ * ```ts
+ * import { query } from '@anthropic-ai/claude-agent-sdk';
+ * import { M91Client } from '@msg91comm/m91';
+ * import { createM91CanUseTool } from '@msg91comm/m91/integrations/claude-agent-sdk';
+ *
+ * const client = new M91Client(process.env.M91_SEND_LINK!);
+ *
+ * for await (const message of query({
+ *   prompt: 'Clean up the stale feature branches and deploy main.',
+ *   options: { canUseTool: createM91CanUseTool(client, { tools: ['Bash', 'Write'] }) },
+ * })) {
+ *   if (message.type === 'result') console.log(message);
+ * }
+ * ```
+ *
+ * `canUseTool` only runs when the SDK would otherwise ask. To gate a tool
+ * whatever the permission mode (including `bypassPermissions`), use the
+ * `PreToolUse` hook from `createM91PreToolUseHook` instead.
+ *
+ * **Tools.** `createM91McpServer` exposes `m91_request_approval` and
+ * `m91_send_alert` as an in-process MCP server, for when the agent itself
+ * should decide to ask or to wake somebody.
+ */
+import type { CanUseTool, HookCallbackMatcher, McpSdkServerConfigWithInstance } from '@anthropic-ai/claude-agent-sdk';
+import type { M91Client } from '../client.js';
+import { type AlertDefaults, type ApprovalDefaults, type GateOptions } from './specs.js';
+/** Tool names, or a predicate. Required: an agent that rings for every `Read` gets muted. */
+type ClaudeGateOptions = GateOptions & {
+    tools: NonNullable<GateOptions['tools']>;
+};
+/**
+ * A `canUseTool` callback that asks a person on their phone before the tools
+ * in `options.tools` run.
+ */
+export declare function createM91CanUseTool(client: M91Client, options: ClaudeGateOptions): CanUseTool;
+/**
+ * A `PreToolUse` hook matcher that asks a person before the tools in
+ * `options.tools` run, in every permission mode. Pass it as
+ * `options.hooks.PreToolUse`.
+ *
+ * ```ts
+ * query({ prompt, options: { hooks: { PreToolUse: createM91PreToolUseHook(client, { tools: ['Bash'] }) } } })
+ * ```
+ */
+export declare function createM91PreToolUseHook(client: M91Client, options: ClaudeGateOptions & {
+    timeoutSeconds?: number;
+}): HookCallbackMatcher[];
+/**
+ * `m91_request_approval` and `m91_send_alert` as an in-process MCP server.
+ * Register it under `mcpServers.m91`; the tools appear to Claude as
+ * `mcp__m91__m91_request_approval` and `mcp__m91__m91_send_alert`.
+ */
+export declare function createM91McpServer(client: M91Client, defaults?: ApprovalDefaults & AlertDefaults): Promise<McpSdkServerConfigWithInstance>;
+export {};
+//# sourceMappingURL=claude-agent-sdk.d.ts.map

package/dist/src/integrations/claude-agent-sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-agent-sdk.d.ts","sourceRoot":"","sources":["../../../src/integrations/claude-agent-sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,mBAAmB,EACnB,8BAA8B,EAE/B,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAML,KAAK,aAAa,EAElB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAKjB,MAAM,YAAY,CAAC;AAGpB,6FAA6F;AAC7F,KAAK,iBAAiB,GAAG,WAAW,GAAG;IAAE,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC;AAEpF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,GAAG,UAAU,CAU7F;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,iBAAiB,GAAG;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD,mBAAmB,EAAE,CAyBvB;AAsBD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,SAAS,EACjB,QAAQ,GAAE,gBAAgB,GAAG,aAAkB,GAC9C,OAAO,CAAC,8BAA8B,CAAC,CAczC"}