@onebooks/node 0.0.0-stage → 0.1.0

package/dist/client.js

@@ -0,0 +1,214 @@
+import { OneBooksApiError, parseRetryAfterMs, retryAfterSeconds } from './errors.js';
+import { AppDataResource } from './app-data.js';
+import { EventsResource } from './events.js';
+const DEFAULT_API_BASE = 'https://api.getonebooks.com';
+const DEFAULT_MAX_RETRIES = 3;
+// 502/503/504 (and a network error) can mean the API DID process the request
+// and only the response was lost — safe to replay only for a read, or for a
+// write the server can de-duplicate by its Idempotency-Key.
+const GATEWAY_STATUS = new Set([502, 503, 504]);
+const BASE_BACKOFF_MS = 500;
+const MAX_BACKOFF_MS = 8_000;
+/**
+ * The retry rule, in one place:
+ * - `429` is retried for EVERY method — a rate-limited request was never
+ *   processed, so replaying it can't duplicate anything.
+ * - A network error or `502`/`503`/`504` is retried only for `GET`/`HEAD`, or
+ *   for any other method when the call set an `idempotencyKey` — otherwise a
+ *   POST that the API processed before the connection dropped would be sent
+ *   twice (a duplicate customer, expense, quote, …).
+ * - Nothing else is ever retried.
+ */
+export function canReplayAfterAmbiguousFailure(method, idempotencyKey) {
+    return method === 'GET' || method === 'HEAD' || !!idempotencyKey;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** 429 honors `Retry-After` (seconds, or an HTTP date) when present; every
+ * other retryable status uses jittered exponential backoff. */
+function computeDelayMs(attempt, retryAfterHeader) {
+    const retryAfterMs = parseRetryAfterMs(retryAfterHeader);
+    if (retryAfterMs !== undefined)
+        return retryAfterMs;
+    const base = Math.min(MAX_BACKOFF_MS, BASE_BACKOFF_MS * 2 ** attempt);
+    const jitter = Math.random() * base * 0.5;
+    return Math.min(MAX_BACKOFF_MS, base + jitter);
+}
+async function readBody(res) {
+    const text = await res.text();
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function extractMessage(body, res) {
+    if (body && typeof body === 'object' && 'message' in body) {
+        const m = body.message;
+        if (typeof m === 'string')
+            return m;
+        if (Array.isArray(m))
+            return m.join('; ');
+    }
+    return res.statusText || `HTTP ${res.status}`;
+}
+function extractCode(body) {
+    if (body && typeof body === 'object' && 'code' in body) {
+        const c = body.code;
+        if (typeof c === 'string')
+            return c;
+    }
+    return undefined;
+}
+/**
+ * Server-side OneBooks API client: authenticated `request()` with retries,
+ * plus `appData`/`events` resource helpers. OAuth flow helpers (PKCE, code
+ * exchange, session-token exchange, …) are standalone — see `oauth.ts` — since
+ * you need them before a client (and its token) exists.
+ */
+export class OneBooksClient {
+    apiBase;
+    apiVersion;
+    appData;
+    events;
+    maxRetries;
+    fetchImpl;
+    staticToken;
+    getAccessTokenFn;
+    constructor(options) {
+        if (!options.accessToken && !options.getAccessToken) {
+            throw new Error('OneBooksClient: provide either "accessToken" or "getAccessToken".');
+        }
+        this.staticToken = options.accessToken;
+        this.getAccessTokenFn = options.getAccessToken;
+        this.apiBase = (options.apiBase ?? DEFAULT_API_BASE).replace(/\/+$/, '');
+        this.apiVersion = options.apiVersion;
+        this.maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES;
+        this.fetchImpl = options.fetch ?? fetch;
+        this.appData = new AppDataResource(this);
+        this.events = new EventsResource(this);
+    }
+    async resolveAccessToken() {
+        if (this.getAccessTokenFn)
+            return this.getAccessTokenFn();
+        if (this.staticToken)
+            return this.staticToken;
+        throw new Error('OneBooksClient: no access token available.');
+    }
+    buildUrl(path, query) {
+        const rel = path.startsWith('/') ? path.slice(1) : path;
+        const url = new URL(`${this.apiBase}/${rel}`);
+        if (query) {
+            for (const [key, value] of Object.entries(query)) {
+                if (value === undefined || value === null)
+                    continue;
+                if (Array.isArray(value)) {
+                    if (value.length === 0)
+                        continue;
+                    url.searchParams.set(key, value.join(','));
+                }
+                else {
+                    url.searchParams.set(key, String(value));
+                }
+            }
+        }
+        return url.toString();
+    }
+    /**
+     * Issues one authenticated API request. Retries (up to `maxRetries`) a
+     * `429` for any method, honoring `Retry-After`; retries a network error or
+     * `502`/`503`/`504` (jittered backoff) only for `GET`/`HEAD` or when
+     * `options.idempotencyKey` is set — see `canReplayAfterAmbiguousFailure`.
+     * Never retries any other status. Resolves the parsed JSON body (or
+     * `undefined` for a `204`); throws `OneBooksApiError` on a non-retried
+     * failure (or rethrows the network error).
+     */
+    async request(method, path, options = {}) {
+        const url = this.buildUrl(path, options.query);
+        const replayable = canReplayAfterAmbiguousFailure(method, options.idempotencyKey);
+        let attempt = 0;
+        for (;;) {
+            const headers = new Headers(options.headers);
+            headers.set('Accept', 'application/json');
+            headers.set('Authorization', `Bearer ${await this.resolveAccessToken()}`);
+            if (this.apiVersion)
+                headers.set('OneBooks-Version', this.apiVersion);
+            if (options.idempotencyKey)
+                headers.set('Idempotency-Key', options.idempotencyKey);
+            let body;
+            if (options.body !== undefined) {
+                headers.set('Content-Type', 'application/json');
+                body = JSON.stringify(options.body);
+            }
+            let res;
+            try {
+                res = await this.fetchImpl(url, { method, headers, body, signal: options.signal });
+            }
+            catch (err) {
+                if (options.signal?.aborted || !replayable || attempt >= this.maxRetries)
+                    throw err;
+                await sleep(computeDelayMs(attempt, null));
+                attempt += 1;
+                continue;
+            }
+            if (res.ok) {
+                if (res.status === 204)
+                    return undefined;
+                return (await readBody(res));
+            }
+            const retryable = res.status === 429 || (GATEWAY_STATUS.has(res.status) && replayable);
+            if (retryable && attempt < this.maxRetries) {
+                await readBody(res); // drain so keep-alive sockets stay reusable
+                await sleep(computeDelayMs(attempt, res.headers.get('retry-after')));
+                attempt += 1;
+                continue;
+            }
+            const parsedBody = await readBody(res);
+            throw new OneBooksApiError(res.status, extractMessage(parsedBody, res), {
+                code: extractCode(parsedBody),
+                body: parsedBody,
+                retryAfter: retryAfterSeconds(res),
+            });
+        }
+    }
+    get(path, options) {
+        return this.request('GET', path, options);
+    }
+    post(path, body, options) {
+        return this.request('POST', path, { ...options, body });
+    }
+    put(path, body, options) {
+        return this.request('PUT', path, { ...options, body });
+    }
+    patch(path, body, options) {
+        return this.request('PATCH', path, { ...options, body });
+    }
+    delete(path, options) {
+        return this.request('DELETE', path, options);
+    }
+    /**
+     * Async-iterates every item of a `{ data, hasMore, nextCursor }` endpoint,
+     * paging automatically. `cursorParam` names the query parameter the
+     * endpoint reads the cursor from (default `"cursor"`; the events endpoint
+     * uses `"after"` — see `events.iterate()`, built on this).
+     */
+    async *paginate(path, query = {}, paginateOptions = {}) {
+        const cursorParam = paginateOptions.cursorParam ?? 'cursor';
+        let cursor = query[cursorParam];
+        for (;;) {
+            const page = await this.get(path, {
+                query: { ...query, [cursorParam]: cursor },
+            });
+            for (const item of page.data)
+                yield item;
+            if (!page.hasMore || !page.nextCursor)
+                return;
+            cursor = page.nextCursor;
+        }
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAS7C,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,6EAA6E;AAC7E,4EAA4E;AAC5E,4DAA4D;AAC5D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAChD,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAkB,EAAE,cAAkC;IACnG,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC;AACnE,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;+DAC+D;AAC/D,SAAS,cAAc,CAAC,OAAe,EAAE,gBAA+B;IACtE,MAAM,YAAY,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IACzD,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,GAAG,GAAG,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAa,EAAE,GAAa;IAClD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAI,IAA6B,CAAC,OAAO,CAAC;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC,UAAU,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACvD,MAAM,CAAC,GAAI,IAA0B,CAAC,IAAI,CAAC;QAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IAChB,OAAO,CAAS;IAChB,UAAU,CAAU;IACpB,OAAO,CAAkB;IACzB,MAAM,CAAiB;IAEf,UAAU,CAAS;IACnB,SAAS,CAAe;IACxB,WAAW,CAAU;IACrB,gBAAgB,CAAkC;IAEnE,YAAY,OAA8B;QACxC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC5D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QAExC,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,KAAmB;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;oBAAE,SAAS;gBACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;wBAAE,SAAS;oBACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7C,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CACX,MAAkB,EAClB,IAAY,EACZ,UAA0B,EAAE;QAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,8BAA8B,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAClF,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,SAAS,CAAC;YACR,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAC1E,IAAI,IAAI,CAAC,UAAU;gBAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACtE,IAAI,OAAO,CAAC,cAAc;gBAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;YAEnF,IAAI,IAAwB,CAAC;YAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAChD,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;YAED,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACrF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU;oBAAE,MAAM,GAAG,CAAC;gBACpF,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC3C,OAAO,IAAI,CAAC,CAAC;gBACb,SAAS;YACX,CAAC;YAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,SAAc,CAAC;gBAC9C,OAAO,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAM,CAAC;YACpC,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC;YACvF,IAAI,SAAS,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3C,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,4CAA4C;gBACjE,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBACrE,OAAO,IAAI,CAAC,CAAC;gBACb,SAAS;YACX,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE;gBACtE,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC;gBAC7B,IAAI,EAAE,UAAU;gBAChB,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,GAAG,CAAc,IAAY,EAAE,OAAsC;QACnE,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,CAAc,IAAY,EAAE,IAAc,EAAE,OAAsC;QACpF,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,GAAG,CAAc,IAAY,EAAE,IAAc,EAAE,OAAsC;QACnF,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAc,IAAY,EAAE,IAAc,EAAE,OAAsC;QACrF,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAc,IAAY,EAAE,OAAsC;QACtE,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,CAAC,QAAQ,CACb,IAAY,EACZ,QAAqB,EAAE,EACvB,kBAA4C,EAAE;QAE9C,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,IAAI,QAAQ,CAAC;QAC5D,IAAI,MAAM,GAAG,KAAK,CAAC,WAAW,CAAuB,CAAC;QACtD,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAuB,IAAI,EAAE;gBACtD,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE;aAC3C,CAAC,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,OAAO;YAC9C,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3B,CAAC;IACH,CAAC;CACF"}

package/dist/errors.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The `error` codes the standard OAuth endpoints (`/oauth/token`,
+ * `/oauth/revoke`, `/oauth/introspect`, `/oauth/device/authorize`,
+ * `/oauth/register`) answer with — RFC 6749 §5.2, RFC 7009, RFC 7662,
+ * RFC 8628 §3.5, RFC 7591 §3.2.2 and RFC 8707 — plus `temporarily_unavailable`
+ * (rate limited) and `server_error`. An open union: a code added later still
+ * comes through as a plain string.
+ */
+export type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope' | 'invalid_target' | 'unsupported_token_type' | 'authorization_pending' | 'slow_down' | 'expired_token' | 'access_denied' | 'invalid_redirect_uri' | 'invalid_client_metadata' | 'temporarily_unavailable' | 'server_error' | (string & {});
+export interface OneBooksApiErrorInit {
+    code?: string;
+    body?: unknown;
+    oauthError?: OAuthErrorCode;
+    oauthErrorDescription?: string;
+    retryAfter?: number;
+}
+/**
+ * Thrown by every SDK call that receives a non-2xx response the client isn't
+ * retrying (see client.ts's retry policy).
+ *
+ * - `code` is the API's stable machine-readable error code when present (see
+ *   the `errors` doc) — branch on it instead of matching `message` text. The
+ *   standard OAuth endpoints never carry one.
+ * - `oauthError` is set instead on errors from the OAuth helpers: the RFC 6749
+ *   §5.2 `error` code (e.g. `invalid_grant`), with `oauthErrorDescription` the
+ *   optional `error_description`. `message` there reads
+ *   `"<error>: <error_description>"` (just `"<error>"` without a description).
+ * - `retryAfter` is the response's `Retry-After`, in seconds, when it sent one
+ *   (every `429` from the API does).
+ */
+export declare class OneBooksApiError extends Error {
+    readonly status: number;
+    readonly code?: string;
+    readonly body: unknown;
+    readonly oauthError?: OAuthErrorCode;
+    readonly oauthErrorDescription?: string;
+    readonly retryAfter?: number;
+    constructor(status: number, message: string, init?: OneBooksApiErrorInit);
+}
+/**
+ * `Retry-After` (delta-seconds, or an HTTP date) as milliseconds from `now`;
+ * `undefined` when the header is absent or unparseable.
+ */
+export declare function parseRetryAfterMs(header: string | null, now?: number): number | undefined;
+/** `Retry-After` in whole seconds (an HTTP date rounded up), for `OneBooksApiError.retryAfter`. */
+export declare function retryAfterSeconds(res: Response): number | undefined;
+/**
+ * The error for a failed response from a standard OAuth endpoint.
+ *
+ * Reads the RFC 6749 §5.2 body — `{ "error": "<code>", "error_description"?: "<text>" }`.
+ * Against a server that predates it, falls back to the OneBooks-shaped body
+ * those endpoints used to send (`{ statusCode, message, error }`, where
+ * `message` carried the code and `error` is only the HTTP reason phrase), so
+ * `oauthError` is filled either way. Never parses prose: a legacy `message`
+ * that doesn't start with a known OAuth code leaves `oauthError` unset.
+ */
+export declare function oauthErrorFromResponse(res: Response, body: unknown): OneBooksApiError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe,GACf,gBAAgB,GAChB,wBAAwB,GACxB,uBAAuB,GACvB,WAAW,GACX,eAAe,GACf,eAAe,GACf,sBAAsB,GACtB,yBAAyB,GACzB,yBAAyB,GACzB,cAAc,GACd,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB;CAW7E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,GAAG,SAAS,CAOrG;AAED,mGAAmG;AACnG,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAGnE;AA0BD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,GAAG,gBAAgB,CA2BrF"}

package/dist/errors.js

@@ -0,0 +1,114 @@
+/**
+ * Thrown by every SDK call that receives a non-2xx response the client isn't
+ * retrying (see client.ts's retry policy).
+ *
+ * - `code` is the API's stable machine-readable error code when present (see
+ *   the `errors` doc) — branch on it instead of matching `message` text. The
+ *   standard OAuth endpoints never carry one.
+ * - `oauthError` is set instead on errors from the OAuth helpers: the RFC 6749
+ *   §5.2 `error` code (e.g. `invalid_grant`), with `oauthErrorDescription` the
+ *   optional `error_description`. `message` there reads
+ *   `"<error>: <error_description>"` (just `"<error>"` without a description).
+ * - `retryAfter` is the response's `Retry-After`, in seconds, when it sent one
+ *   (every `429` from the API does).
+ */
+export class OneBooksApiError extends Error {
+    status;
+    code;
+    body;
+    oauthError;
+    oauthErrorDescription;
+    retryAfter;
+    constructor(status, message, init = {}) {
+        super(message);
+        this.name = 'OneBooksApiError';
+        this.status = status;
+        this.code = init.code;
+        this.body = init.body;
+        this.oauthError = init.oauthError;
+        this.oauthErrorDescription = init.oauthErrorDescription;
+        this.retryAfter = init.retryAfter;
+        Object.setPrototypeOf(this, OneBooksApiError.prototype);
+    }
+}
+/**
+ * `Retry-After` (delta-seconds, or an HTTP date) as milliseconds from `now`;
+ * `undefined` when the header is absent or unparseable.
+ */
+export function parseRetryAfterMs(header, now = Date.now()) {
+    if (!header)
+        return undefined;
+    const asSeconds = Number(header);
+    if (Number.isFinite(asSeconds) && asSeconds >= 0)
+        return asSeconds * 1000;
+    const asDate = Date.parse(header);
+    if (!Number.isNaN(asDate))
+        return Math.max(0, asDate - now);
+    return undefined;
+}
+/** `Retry-After` in whole seconds (an HTTP date rounded up), for `OneBooksApiError.retryAfter`. */
+export function retryAfterSeconds(res) {
+    const ms = parseRetryAfterMs(res.headers.get('retry-after'));
+    return ms === undefined ? undefined : Math.ceil(ms / 1000);
+}
+// The codes a server that predates the RFC-shaped OAuth errors put in
+// `message` — bare, or as "<code>: <detail>" (e.g. "invalid_grant: expired").
+const LEGACY_OAUTH_CODES = new Set([
+    'invalid_request',
+    'invalid_client',
+    'invalid_grant',
+    'unauthorized_client',
+    'unsupported_grant_type',
+    'invalid_scope',
+    'invalid_target',
+    'unsupported_token_type',
+    'authorization_pending',
+    'slow_down',
+    'expired_token',
+    'access_denied',
+    'invalid_redirect_uri',
+    'invalid_client_metadata',
+]);
+const LEGACY_OAUTH_MESSAGE = /^([a-z_]+)(?::\s*([\s\S]+))?$/;
+function nonEmptyString(value) {
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+/**
+ * The error for a failed response from a standard OAuth endpoint.
+ *
+ * Reads the RFC 6749 §5.2 body — `{ "error": "<code>", "error_description"?: "<text>" }`.
+ * Against a server that predates it, falls back to the OneBooks-shaped body
+ * those endpoints used to send (`{ statusCode, message, error }`, where
+ * `message` carried the code and `error` is only the HTTP reason phrase), so
+ * `oauthError` is filled either way. Never parses prose: a legacy `message`
+ * that doesn't start with a known OAuth code leaves `oauthError` unset.
+ */
+export function oauthErrorFromResponse(res, body) {
+    const retryAfter = retryAfterSeconds(res);
+    if (body && typeof body === 'object') {
+        const fields = body;
+        const rfcError = 'statusCode' in fields ? undefined : nonEmptyString(fields.error);
+        if (rfcError) {
+            const description = nonEmptyString(fields.error_description);
+            return new OneBooksApiError(res.status, description ? `${rfcError}: ${description}` : rfcError, {
+                body,
+                oauthError: rfcError,
+                oauthErrorDescription: description,
+                retryAfter,
+            });
+        }
+        const legacyMessage = nonEmptyString(fields.message);
+        if (legacyMessage) {
+            const match = LEGACY_OAUTH_MESSAGE.exec(legacyMessage);
+            const legacyCode = match && LEGACY_OAUTH_CODES.has(match[1]) ? match[1] : undefined;
+            return new OneBooksApiError(res.status, legacyMessage, {
+                body,
+                oauthError: legacyCode,
+                oauthErrorDescription: legacyCode ? match?.[2] : undefined,
+                retryAfter,
+            });
+        }
+    }
+    return new OneBooksApiError(res.status, res.statusText || `HTTP ${res.status}`, { body, retryAfter });
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAmCA;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,CAAS;IACf,IAAI,CAAU;IACd,IAAI,CAAU;IACd,UAAU,CAAkB;IAC5B,qBAAqB,CAAU;IAC/B,UAAU,CAAU;IAE7B,YAAY,MAAc,EAAE,OAAe,EAAE,OAA6B,EAAE;QAC1E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC/E,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,SAAS,GAAG,IAAI,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,iBAAiB,CAAC,GAAa;IAC7C,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7D,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,sEAAsE;AACtE,8EAA8E;AAC9E,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,eAAe;IACf,gBAAgB;IAChB,wBAAwB;IACxB,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;IACf,sBAAsB;IACtB,yBAAyB;CAC1B,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAE7D,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAa,EAAE,IAAa;IACjE,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,MAAM,QAAQ,GAAG,YAAY,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC7D,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;gBAC9F,IAAI;gBACJ,UAAU,EAAE,QAAQ;gBACpB,qBAAqB,EAAE,WAAW;gBAClC,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,KAAK,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrF,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE;gBACrD,IAAI;gBACJ,UAAU,EAAE,UAAU;gBACtB,qBAAqB,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1D,UAAU;aACX,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AACxG,CAAC"}

package/dist/events.d.ts

@@ -0,0 +1,49 @@
+import type { PaginatedResponse, QueryParams } from './types.js';
+interface RequestClient {
+    get<T>(path: string, options?: {
+        query?: QueryParams;
+    }): Promise<T>;
+}
+/**
+ * The event envelope from Contract 6's `/events` endpoints
+ * (`EventListItemDto` in `app-platform/events/events-query.service.ts`).
+ * `resourceType`/`resourceId` are null for app-targeted events that aren't
+ * about one ledger resource (`app.installed`, `business.redact`, …) — see
+ * the event catalog's `audience: 'app' | 'privacy'` entries.
+ */
+export interface OneBooksEventEnvelope<T = unknown> {
+    id: string;
+    type: string;
+    apiVersion: string;
+    createdAt: string;
+    resourceType: string | null;
+    resourceId: string | null;
+    data: T;
+}
+export interface EventsListParams {
+    /** Event id cursor — resume after this event. */
+    after?: string;
+    /** ISO 8601 — only events created at or after this instant. */
+    since?: string;
+    /** Event type filter, e.g. `['invoice.paid', 'payment.received']`. */
+    types?: string[];
+    /** 1–100, default 50 server-side. */
+    limit?: number;
+}
+/** Partner events API (Contract 6): `client.events.*`. */
+export declare class EventsResource {
+    private readonly client;
+    constructor(client: RequestClient);
+    /** `GET /events?after=&since=&types=&limit=`. */
+    list(params?: EventsListParams): Promise<PaginatedResponse<OneBooksEventEnvelope>>;
+    /** `GET /events/:id`. */
+    get(id: string): Promise<OneBooksEventEnvelope>;
+    /**
+     * Async-iterates every event from `params.after` (or the beginning)
+     * onward, paging automatically via `nextCursor`. Safe to persist the last
+     * consumed event's `id` and resume with `{ after: lastId }` later.
+     */
+    iterate(params?: EventsListParams): AsyncGenerator<OneBooksEventEnvelope, void, undefined>;
+}
+export {};
+//# sourceMappingURL=events.d.ts.map

package/dist/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAIjE,UAAU,aAAa;IACrB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACrE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,OAAO;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC;CACT;AAED,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,aAAa;IAElD,iDAAiD;IACjD,IAAI,CAAC,MAAM,GAAE,gBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAWtF,yBAAyB;IACzB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAI/C;;;;OAIG;IACI,OAAO,CAAC,MAAM,GAAE,gBAAqB,GAAG,cAAc,CAAC,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC;CAStG"}

package/dist/events.js

@@ -0,0 +1,39 @@
+/** Partner events API (Contract 6): `client.events.*`. */
+export class EventsResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /** `GET /events?after=&since=&types=&limit=`. */
+    list(params = {}) {
+        return this.client.get('/events', {
+            query: {
+                after: params.after,
+                since: params.since,
+                types: params.types,
+                limit: params.limit,
+            },
+        });
+    }
+    /** `GET /events/:id`. */
+    get(id) {
+        return this.client.get(`/events/${encodeURIComponent(id)}`);
+    }
+    /**
+     * Async-iterates every event from `params.after` (or the beginning)
+     * onward, paging automatically via `nextCursor`. Safe to persist the last
+     * consumed event's `id` and resume with `{ after: lastId }` later.
+     */
+    async *iterate(params = {}) {
+        let after = params.after;
+        for (;;) {
+            const page = await this.list({ ...params, after });
+            for (const event of page.data)
+                yield event;
+            if (!page.hasMore || !page.nextCursor)
+                return;
+            after = page.nextCursor;
+        }
+    }
+}
+//# sourceMappingURL=events.js.map

package/dist/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAoCA,0DAA0D;AAC1D,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,iDAAiD;IACjD,IAAI,CAAC,SAA2B,EAAE;QAChC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAA2C,SAAS,EAAE;YAC1E,KAAK,EAAE;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB;SACF,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB;IACzB,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAwB,WAAW,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,OAAO,CAAC,SAA2B,EAAE;QAC1C,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACzB,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM,KAAK,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,OAAO;YAC9C,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC;QAC1B,CAAC;IACH,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+export { OneBooksClient } from './client.js';
+export { OneBooksApiError } from './errors.js';
+export type { OAuthErrorCode, OneBooksApiErrorInit } from './errors.js';
+export type { HttpMethod, OneBooksClientOptions, PaginatedResponse, QueryParams, QueryValue, RequestOptions, } from './types.js';
+export { AppDataResource } from './app-data.js';
+export type { AppDataDefinition, AppDataFieldType, AppDataGetParams, AppDataSetInput, AppDataValue, LocalizedText, } from './app-data.js';
+export { EventsResource } from './events.js';
+export type { EventsListParams, OneBooksEventEnvelope } from './events.js';
+export { verifySessionToken } from './session-token.js';
+export type { SessionTokenClaims, VerifySessionTokenOptions } from './session-token.js';
+export { verifyWebhook, parseWebhookEvent } from './webhook.js';
+export type { VerifyWebhookOptions, WebhookEventEnvelope } from './webhook.js';
+export * as oauth from './oauth.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,YAAY,EACV,UAAU,EACV,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,YAAY,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAExF,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAK/E,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,11 @@
+export { OneBooksClient } from './client.js';
+export { OneBooksApiError } from './errors.js';
+export { AppDataResource } from './app-data.js';
+export { EventsResource } from './events.js';
+export { verifySessionToken } from './session-token.js';
+export { verifyWebhook, parseWebhookEvent } from './webhook.js';
+// Standalone OAuth helpers (used before a client/token exists), grouped
+// under a namespace so `oauth.exchangeCode(...)` reads like a client method
+// without requiring a OneBooksClient instance to call them.
+export * as oauth from './oauth.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAW/C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAUhD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGhE,wEAAwE;AACxE,4EAA4E;AAC5E,4DAA4D;AAC5D,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,87 @@
+export interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+    codeChallengeMethod: 'S256';
+}
+/** RFC 7636 PKCE pair: a 43-character verifier and its S256 challenge. */
+export declare function createPkcePair(): Promise<PkcePair>;
+export interface BuildAuthorizeUrlOptions {
+    clientId: string;
+    redirectUri: string;
+    scopes: string[];
+    state: string;
+    codeChallenge: string;
+    codeChallengeMethod?: 'S256';
+    /** Default `https://app.getonebooks.com/oauth/authorize` — the authorize endpoint lives on the APP host, not the API host. */
+    authorizeUrl?: string;
+}
+/** Builds the `https://app.getonebooks.com/oauth/authorize` URL (Step 1 of the code + PKCE flow). */
+export declare function buildAuthorizeUrl(options: BuildAuthorizeUrlOptions): string;
+export interface TokenResponse {
+    access_token: string;
+    refresh_token?: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    scope?: string;
+    issued_token_type?: string;
+}
+interface ClientAuth {
+    clientId: string;
+    /** Omit for a PUBLIC client — PKCE takes the place of a secret. */
+    clientSecret?: string;
+}
+interface OAuthCallOptions extends ClientAuth {
+    apiBase?: string;
+    fetch?: typeof fetch;
+}
+export interface ExchangeCodeOptions extends OAuthCallOptions {
+    code: string;
+    redirectUri: string;
+    /** Required for a PUBLIC (PKCE) client; omit for a CONFIDENTIAL client that skipped PKCE. */
+    codeVerifier?: string;
+}
+/** Step 3: exchange an authorization code for tokens (`POST /oauth/token`). */
+export declare function exchangeCode(options: ExchangeCodeOptions): Promise<TokenResponse>;
+export interface RefreshOptions extends OAuthCallOptions {
+    refreshToken: string;
+}
+/** Refreshes an access token. Rotation is strict: persist BOTH new tokens before discarding the old ones. */
+export declare function refresh(options: RefreshOptions): Promise<TokenResponse>;
+export interface RevokeOptions extends OAuthCallOptions {
+    token: string;
+    tokenTypeHint?: 'access_token' | 'refresh_token';
+}
+/**
+ * `POST /oauth/revoke` (RFC 7009) — resolves for an unknown or already-invalid
+ * token too; rejects only when the request itself fails (`invalid_client`, a
+ * rate limit, …).
+ */
+export declare function revoke(options: RevokeOptions): Promise<void>;
+export interface ExchangeSessionTokenOptions {
+    clientId: string;
+    /** Required — session-token exchange is confidential-client only (Contract 3). */
+    clientSecret: string;
+    sessionToken: string;
+    apiBase?: string;
+    fetch?: typeof fetch;
+}
+/**
+ * RFC 8693 token exchange (Contract 3): trades an App Bridge session token
+ * (short-lived, ~60s) for a normal access/refresh token pair scoped to the
+ * installation. Confidential clients only.
+ */
+export declare function exchangeSessionToken(options: ExchangeSessionTokenOptions): Promise<TokenResponse>;
+export interface IntrospectOptions extends OAuthCallOptions {
+    token: string;
+}
+export interface IntrospectionResult {
+    active: boolean;
+    scope?: string;
+    exp?: number;
+    client_id?: string;
+    sub?: string;
+}
+/** `POST /oauth/introspect` — a debugging aid, not a production hot path (just call the API and handle 401). */
+export declare function introspect(options: IntrospectOptions): Promise<IntrospectionResult>;
+export {};
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,0EAA0E;AAC1E,wBAAsB,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,CAQxD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8HAA8H;IAC9H,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qGAAqG;AACrG,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAU3E;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,UAAU;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,gBAAiB,SAAQ,UAAU;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAoDD,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,+EAA+E;AAC/E,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAavF;AAED,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACtD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,6GAA6G;AAC7G,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAQ7E;AAED,MAAM,WAAW,aAAc,SAAQ,gBAAgB;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBlE;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,aAAa,CAAC,CAYvG;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,gHAAgH;AAChH,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAQzF"}