@mymehq/sdk 4.10.0 → 5.1.0

package/dist/auth/index.js

@@ -142,12 +142,12 @@ var StoredTokenProvider = class {
       try {
         const res = await this.fetch(`${this.issuer}/auth/token`, {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
             grant_type: "refresh_token",
             refresh_token: refreshToken,
             client_id: this.clientId
-          })
+          }).toString()
         });
         const body = await res.json();
         if (!res.ok || !body.access_token) {
@@ -269,14 +269,14 @@ var MymeAuth = class {
     }
     const res = await this.fetch(`${this.issuer}/auth/token`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
         grant_type: "authorization_code",
         code,
         code_verifier: pending.verifier,
         redirect_uri: pending.redirectUri,
         client_id: this.clientId
-      })
+      }).toString()
     });
     const body = await res.json();
     if (!res.ok || !body.access_token || !body.refresh_token) {

package/dist/index.d.ts

@@ -524,7 +524,7 @@ declare class MymeClient {
     readonly keys: {
         /** Creates an API key. The raw key value is returned exactly once on
          * creation; the rest of the shape mirrors the persisted ApiKey record
-         * (source, default_origin, default_tier, type_permissions, and
+         * (source, default_tier, type_permissions, and
          * extension_permissions are all stamped at create time and visible
          * here so the caller doesn't need a follow-up GET /keys to inspect
          * them). */
@@ -608,15 +608,17 @@ declare class MymeClient {
          */
         previewEvent: (input: PreviewEventRequest) => Promise<PreviewEventResult>;
     };
-    /** Tenant-scoped configuration. Controls feed-tier retention per type
-     * and the three optional schema-enforcement levers (TSC42 §5). All
-     * endpoints are admin-only. */
+    /** Tenant-scoped configuration. Carries the three optional schema-
+     * enforcement levers (TSC42 §5: `strict_mode`, `source_allowlist`,
+     * `source_filter`) and the per-tenant cleanup-job overrides
+     * (`audit_retention_days`, `event_log_retention_hours`,
+     * `trash_retention_days`). All endpoints are admin-only. */
     readonly tenants: {
         /** Returns the current tenant's config. Empty object when nothing
          * is configured. */
         getConfig: () => Promise<TenantConfig>;
-        /** Replaces the current tenant's config. Server validates that any
-         * type IDs in retention overrides resolve in the registry. */
+        /** Replaces the current tenant's config (PUT semantics — full
+         * replacement, not merge). */
         setConfig: (config: TenantConfig) => Promise<TenantConfig>;
         /** Per-tenant resource quotas (T-052). Empty / missing limits fall
          *  back to the instance defaults from env. Quotas are platform-

package/dist/index.js

@@ -818,7 +818,7 @@ var MymeClient = class {
   keys = {
     /** Creates an API key. The raw key value is returned exactly once on
      * creation; the rest of the shape mirrors the persisted ApiKey record
-     * (source, default_origin, default_tier, type_permissions, and
+     * (source, default_tier, type_permissions, and
      * extension_permissions are all stamped at create time and visible
      * here so the caller doesn't need a follow-up GET /keys to inspect
      * them). */
@@ -956,9 +956,11 @@ var MymeClient = class {
     }
   };
   // ---- Tenants (admin) ----
-  /** Tenant-scoped configuration. Controls feed-tier retention per type
-   * and the three optional schema-enforcement levers (TSC42 §5). All
-   * endpoints are admin-only. */
+  /** Tenant-scoped configuration. Carries the three optional schema-
+   * enforcement levers (TSC42 §5: `strict_mode`, `source_allowlist`,
+   * `source_filter`) and the per-tenant cleanup-job overrides
+   * (`audit_retention_days`, `event_log_retention_hours`,
+   * `trash_retention_days`). All endpoints are admin-only. */
   tenants = {
     /** Returns the current tenant's config. Empty object when nothing
      * is configured. */
@@ -968,8 +970,8 @@ var MymeClient = class {
         "/tenants/current/config"
       );
     },
-    /** Replaces the current tenant's config. Server validates that any
-     * type IDs in retention overrides resolve in the registry. */
+    /** Replaces the current tenant's config (PUT semantics — full
+     * replacement, not merge). */
     setConfig: async (config) => {
       return this.transport.request(
         "PUT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mymehq/sdk",
-  "version": "4.10.0",
+  "version": "5.1.0",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -20,7 +20,7 @@
     "dist"
   ],
   "dependencies": {
-    "@mymehq/shared": "4.10.0"
+    "@mymehq/shared": "5.1.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",