@pingroom/sdk 0.1.0

package/dist/errors.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Error types. PingRoomError carries the HTTP status and the API's machine
+ * `code` (e.g. `pings_closed`, `cooldown`, `rate_limited`) so callers can branch
+ * without string-matching messages. The agent token is NEVER stored on or
+ * serialized through an error.
+ */
+export interface ApiErrorBody {
+    code?: string;
+    error?: string;
+    message?: string;
+    retry_after?: number;
+    [key: string]: unknown;
+}
+export interface PingRoomErrorInit {
+    status?: number;
+    code?: string | null;
+    retryAfter?: number | null;
+    body?: unknown;
+}
+export declare class PingRoomError extends Error {
+    /** HTTP status, or 0 for client-side/network errors. */
+    readonly status: number;
+    /** Machine-readable code from the API body (`code` or `error`), or a client code. */
+    readonly code: string | null;
+    /** Seconds to wait before retrying, when the API or a Retry-After header provides it. */
+    readonly retryAfter: number | null;
+    /** The parsed response body (or raw text), for inspection. Contains no credentials. */
+    readonly body: unknown;
+    constructor(message: string, init?: PingRoomErrorInit);
+    static fromResponse(status: number, body: unknown, headers?: Headers): PingRoomError;
+}
+/** Thrown when a request exceeds its timeout. */
+export declare class PingRoomTimeoutError extends PingRoomError {
+    constructor(message?: string);
+}
+/** Thrown when the underlying fetch fails (DNS, connection, TLS, etc.). */
+export declare class PingRoomNetworkError extends PingRoomError {
+    constructor(message: string, cause?: unknown);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB;IAUzD,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,aAAa;CAoBrF;AAED,iDAAiD;AACjD,qBAAa,oBAAqB,SAAQ,aAAa;gBACzC,OAAO,SAAsB;CAI1C;AAED,2EAA2E;AAC3E,qBAAa,oBAAqB,SAAQ,aAAa;gBACzC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAO7C"}

package/dist/errors.js

@@ -0,0 +1,59 @@
+/**
+ * Error types. PingRoomError carries the HTTP status and the API's machine
+ * `code` (e.g. `pings_closed`, `cooldown`, `rate_limited`) so callers can branch
+ * without string-matching messages. The agent token is NEVER stored on or
+ * serialized through an error.
+ */
+export class PingRoomError extends Error {
+    /** HTTP status, or 0 for client-side/network errors. */
+    status;
+    /** Machine-readable code from the API body (`code` or `error`), or a client code. */
+    code;
+    /** Seconds to wait before retrying, when the API or a Retry-After header provides it. */
+    retryAfter;
+    /** The parsed response body (or raw text), for inspection. Contains no credentials. */
+    body;
+    constructor(message, init = {}) {
+        super(message);
+        this.name = 'PingRoomError';
+        this.status = init.status ?? 0;
+        this.code = init.code ?? null;
+        this.retryAfter = init.retryAfter ?? null;
+        this.body = init.body ?? null;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+    static fromResponse(status, body, headers) {
+        const b = body && typeof body === 'object' ? body : {};
+        const code = (typeof b.code === 'string' && b.code) ||
+            (typeof b.error === 'string' && b.error) ||
+            null;
+        const message = (typeof b.message === 'string' && b.message) ||
+            (code ? code : `HTTP ${status}`);
+        let retryAfter = typeof b.retry_after === 'number' ? b.retry_after : null;
+        if (retryAfter === null && headers) {
+            const h = headers.get('retry-after');
+            if (h && /^\d+$/.test(h.trim())) {
+                retryAfter = Number(h.trim());
+            }
+        }
+        return new PingRoomError(message, { status, code, retryAfter, body });
+    }
+}
+/** Thrown when a request exceeds its timeout. */
+export class PingRoomTimeoutError extends PingRoomError {
+    constructor(message = 'Request timed out') {
+        super(message, { code: 'timeout' });
+        this.name = 'PingRoomTimeoutError';
+    }
+}
+/** Thrown when the underlying fetch fails (DNS, connection, TLS, etc.). */
+export class PingRoomNetworkError extends PingRoomError {
+    constructor(message, cause) {
+        super(message, { code: 'network_error' });
+        this.name = 'PingRoomNetworkError';
+        if (cause !== undefined) {
+            this.cause = cause;
+        }
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,wDAAwD;IAC/C,MAAM,CAAS;IACxB,qFAAqF;IAC5E,IAAI,CAAgB;IAC7B,yFAAyF;IAChF,UAAU,CAAgB;IACnC,uFAAuF;IAC9E,IAAI,CAAU;IAEvB,YAAY,OAAe,EAAE,OAA0B,EAAE;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAC9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,MAAc,EAAE,IAAa,EAAE,OAAiB;QAClE,MAAM,CAAC,GAAiB,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,GACR,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC;YACtC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC;YACxC,IAAI,CAAC;QACP,MAAM,OAAO,GACX,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC;YAC5C,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC;QAEnC,IAAI,UAAU,GAAkB,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QACzF,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAChC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;CACF;AAED,iDAAiD;AACjD,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACrD,YAAY,OAAO,GAAG,mBAAmB;QACvC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACrD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACvB,IAA4B,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,CAAC;IACH,CAAC;CACF"}

package/dist/http.d.ts

@@ -0,0 +1,38 @@
+import type { FetchLike } from './types.js';
+export interface HttpClientOptions {
+    baseUrl: string;
+    token?: string | null;
+    timeoutMs?: number;
+    fetch?: FetchLike;
+    userAgent?: string;
+    allowInsecure?: boolean;
+}
+export interface RequestOptions {
+    query?: Record<string, string | number | boolean | undefined>;
+    body?: unknown;
+    headers?: Record<string, string>;
+    /** Send the Authorization header (default true). Public endpoints pass false. */
+    auth?: boolean;
+    /** Per-call timeout override in ms. */
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}
+/**
+ * Thin authenticated fetch wrapper. Holds the token privately, enforces https
+ * for credentialed traffic, applies a timeout, and maps non-2xx responses to a
+ * PingRoomError. The token is never written into thrown errors or logs.
+ */
+export declare class HttpClient {
+    private token;
+    private readonly baseUrl;
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    private readonly userAgent;
+    constructor(options: HttpClientOptions);
+    setToken(token: string | null): void;
+    getToken(): string | null;
+    request<T>(method: string, path: string, opts?: RequestOptions): Promise<T>;
+    private parse;
+    private buildUrl;
+}
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iFAAiF;IACjF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAID;;;;GAIG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,OAAO,EAAE,iBAAiB;IAkBtC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIpC,QAAQ,IAAI,MAAM,GAAG,IAAI;IAInB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;YAiDvE,KAAK;IAmBnB,OAAO,CAAC,QAAQ;CAejB"}

package/dist/http.js

@@ -0,0 +1,118 @@
+import { PingRoomError, PingRoomNetworkError, PingRoomTimeoutError } from './errors.js';
+import { combineSignals } from './internal/async.js';
+import { assertSecureUrl } from './internal/url.js';
+import { VERSION } from './version.js';
+const DEFAULT_TIMEOUT_MS = 30_000;
+/**
+ * Thin authenticated fetch wrapper. Holds the token privately, enforces https
+ * for credentialed traffic, applies a timeout, and maps non-2xx responses to a
+ * PingRoomError. The token is never written into thrown errors or logs.
+ */
+export class HttpClient {
+    token;
+    baseUrl;
+    timeoutMs;
+    fetchImpl;
+    userAgent;
+    constructor(options) {
+        const base = assertSecureUrl(options.baseUrl, options.allowInsecure ?? false);
+        // Normalise: keep origin + any path prefix, drop a trailing slash.
+        this.baseUrl = (base.origin + base.pathname).replace(/\/$/, '');
+        this.token = options.token ?? null;
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const f = options.fetch ?? globalThis.fetch;
+        if (!f) {
+            throw new PingRoomError('No fetch implementation available. Use Node >= 18, a modern browser, or pass `fetch`.', { code: 'no_fetch' });
+        }
+        this.fetchImpl = f;
+        this.userAgent = options.userAgent ?? `pingroom-sdk/${VERSION}`;
+    }
+    setToken(token) {
+        this.token = token;
+    }
+    getToken() {
+        return this.token;
+    }
+    async request(method, path, opts = {}) {
+        const url = this.buildUrl(path, opts.query);
+        const headers = {
+            Accept: 'application/json',
+            'User-Agent': this.userAgent,
+            ...opts.headers,
+        };
+        if (opts.auth !== false) {
+            if (!this.token) {
+                throw new PingRoomError('This call requires an agent token. Pass `token` to the client or call setToken().', { code: 'no_token' });
+            }
+            headers['Authorization'] = `Bearer ${this.token}`;
+        }
+        let bodyText;
+        if (opts.body !== undefined) {
+            headers['Content-Type'] = 'application/json';
+            bodyText = JSON.stringify(opts.body);
+        }
+        const timeoutMs = opts.timeoutMs ?? this.timeoutMs;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(new PingRoomTimeoutError()), timeoutMs);
+        const signal = combineSignals(controller.signal, opts.signal);
+        let res;
+        try {
+            res = await this.fetchImpl(url, { method, headers, body: bodyText, signal });
+        }
+        catch (err) {
+            // Our own timeout reason propagates as the rejection.
+            if (err instanceof PingRoomError) {
+                throw err;
+            }
+            if (isAbortError(err) || opts.signal?.aborted) {
+                throw err;
+            }
+            throw new PingRoomNetworkError(`Network request failed: ${errMessage(err)}`, err);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        return this.parse(res);
+    }
+    async parse(res) {
+        if (res.status === 204) {
+            return undefined;
+        }
+        const text = await res.text();
+        let json = null;
+        if (text) {
+            try {
+                json = JSON.parse(text);
+            }
+            catch {
+                json = text;
+            }
+        }
+        if (!res.ok) {
+            throw PingRoomError.fromResponse(res.status, json, res.headers);
+        }
+        return json;
+    }
+    buildUrl(path, query) {
+        const full = /^https?:\/\//i.test(path)
+            ? path
+            : this.baseUrl + (path.startsWith('/') ? path : `/${path}`);
+        if (!query) {
+            return full;
+        }
+        const url = new URL(full);
+        for (const [k, v] of Object.entries(query)) {
+            if (v !== undefined) {
+                url.searchParams.set(k, String(v));
+            }
+        }
+        return url.toString();
+    }
+}
+function isAbortError(err) {
+    return Boolean(err) && typeof err === 'object' && err.name === 'AbortError';
+}
+function errMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAsBvC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;GAIG;AACH,MAAM,OAAO,UAAU;IACb,KAAK,CAAgB;IACZ,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,SAAS,CAAY;IACrB,SAAS,CAAS;IAEnC,YAAY,OAA0B;QACpC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,CAAC;QAC9E,mEAAmE;QACnE,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QAEzD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,IAAK,UAAU,CAAC,KAA0C,CAAC;QAClF,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,uFAAuF,EACvF,EAAE,IAAI,EAAE,UAAU,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,OAAO,EAAE,CAAC;IAClE,CAAC;IAED,QAAQ,CAAC,KAAoB;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,OAAuB,EAAE;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAE5C,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,IAAI,CAAC,SAAS;YAC5B,GAAG,IAAI,CAAC,OAAO;SAChB,CAAC;QAEF,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,aAAa,CACrB,mFAAmF,EACnF,EAAE,IAAI,EAAE,UAAU,EAAE,CACrB,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QACpD,CAAC;QAED,IAAI,QAA4B,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACnD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE9D,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sDAAsD;YACtD,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC9C,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAI,GAAG,CAAC,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,KAAK,CAAI,GAAa;QAClC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,SAAc,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,KAA+B;QAC5D,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YACrC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;CACF;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAK,GAAyB,CAAC,IAAI,KAAK,YAAY,CAAC;AACrG,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @pingroom/sdk — official TypeScript/JavaScript SDK for the PingRoom agent API.
+ *
+ *   import { PingRoom } from '@pingroom/sdk';
+ *   const pr = new PingRoom({ token: process.env.PINGROOM_TOKEN });
+ *   await pr.broadcast('ab12cd', { message: 'Deploy shipped ✅' });
+ */
+import { PingRoom } from './client.js';
+export { PingRoom };
+/** Alias for {@link PingRoom}. */
+export { PingRoom as PingRoomClient } from './client.js';
+export { McpClient } from './mcp.js';
+export type { JsonRpcError, McpTool, McpToolResult } from './mcp.js';
+export { PingRoomError, PingRoomTimeoutError, PingRoomNetworkError } from './errors.js';
+export type { ApiErrorBody, PingRoomErrorInit } from './errors.js';
+export { verifyWebhookSignature, sendIncomingWebhook, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_TIMESTAMP_HEADER, WEBHOOK_DELIVERY_HEADER, WEBHOOK_EVENT_HEADER, } from './webhooks.js';
+export type { VerifyWebhookSignatureOptions, IncomingWebhookPayload, SendIncomingWebhookOptions, IncomingWebhookResult, } from './webhooks.js';
+export { VERSION } from './version.js';
+export type * from './types.js';
+export default PingRoom;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpB,kCAAkC;AAClC,OAAO,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxF,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,6BAA6B,EAC7B,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,mBAAmB,YAAY,CAAC;AAEhC,eAAe,QAAQ,CAAC"}

package/dist/index.js

@@ -0,0 +1,17 @@
+/**
+ * @pingroom/sdk — official TypeScript/JavaScript SDK for the PingRoom agent API.
+ *
+ *   import { PingRoom } from '@pingroom/sdk';
+ *   const pr = new PingRoom({ token: process.env.PINGROOM_TOKEN });
+ *   await pr.broadcast('ab12cd', { message: 'Deploy shipped ✅' });
+ */
+import { PingRoom } from './client.js';
+export { PingRoom };
+/** Alias for {@link PingRoom}. */
+export { PingRoom as PingRoomClient } from './client.js';
+export { McpClient } from './mcp.js';
+export { PingRoomError, PingRoomTimeoutError, PingRoomNetworkError } from './errors.js';
+export { verifyWebhookSignature, sendIncomingWebhook, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_TIMESTAMP_HEADER, WEBHOOK_DELIVERY_HEADER, WEBHOOK_EVENT_HEADER, } from './webhooks.js';
+export { VERSION } from './version.js';
+export default PingRoom;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpB,kCAAkC;AAClC,OAAO,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGxF,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAQvB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC,eAAe,QAAQ,CAAC"}

package/dist/internal/async.d.ts

@@ -0,0 +1,5 @@
+/** Merge two abort signals into one (uses AbortSignal.any when available). */
+export declare function combineSignals(primary: AbortSignal, extra?: AbortSignal): AbortSignal;
+/** Resolve after `ms`, or early (without rejecting) if `signal` aborts. */
+export declare function sleep(ms: number, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=async.d.ts.map

package/dist/internal/async.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async.d.ts","sourceRoot":"","sources":["../../src/internal/async.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,WAAW,CAsBrF;AAED,2EAA2E;AAC3E,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBrE"}

package/dist/internal/async.js

@@ -0,0 +1,47 @@
+/** Merge two abort signals into one (uses AbortSignal.any when available). */
+export function combineSignals(primary, extra) {
+    if (!extra) {
+        return primary;
+    }
+    const anyFn = AbortSignal.any;
+    if (typeof anyFn === 'function') {
+        return anyFn([primary, extra]);
+    }
+    const controller = new AbortController();
+    const forward = (s) => {
+        if (!controller.signal.aborted) {
+            controller.abort(s.reason);
+        }
+    };
+    for (const s of [primary, extra]) {
+        if (s.aborted) {
+            forward(s);
+            break;
+        }
+        s.addEventListener('abort', () => forward(s), { once: true });
+    }
+    return controller.signal;
+}
+/** Resolve after `ms`, or early (without rejecting) if `signal` aborts. */
+export function sleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal?.aborted) {
+            resolve();
+            return;
+        }
+        const timer = setTimeout(() => {
+            cleanup();
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            cleanup();
+            resolve();
+        };
+        const cleanup = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+        };
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
+//# sourceMappingURL=async.js.map

package/dist/internal/async.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"async.js","sourceRoot":"","sources":["../../src/internal/async.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,OAAoB,EAAE,KAAmB;IACtE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAI,WAA4E,CAAC,GAAG,CAAC;IAChG,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,CAAc,EAAQ,EAAE;QACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,CAAC,CAAC;YACX,MAAM;QACR,CAAC;QACD,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC;AAC3B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,KAAK,CAAC,EAAU,EAAE,MAAoB;IACpD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC,CAAC;QACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/internal/guards.d.ts

@@ -0,0 +1,7 @@
+/** Mirrors the server's structured-`data` limits so oversized payloads fail fast, locally. */
+export declare const MAX_DATA_BYTES: number;
+export declare const MAX_DATA_KEYS = 25;
+export declare function assertStructuredData(data: unknown): void;
+export declare function assertActionNumber(n: unknown): void;
+export declare function requireNonEmpty(value: unknown, field: string): void;
+//# sourceMappingURL=guards.d.ts.map

package/dist/internal/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/internal/guards.ts"],"names":[],"mappings":"AAEA,8FAA8F;AAC9F,eAAO,MAAM,cAAc,QAAW,CAAC;AACvC,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAqBxD;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAOnD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAInE"}

package/dist/internal/guards.js

@@ -0,0 +1,41 @@
+import { PingRoomError } from '../errors.js';
+/** Mirrors the server's structured-`data` limits so oversized payloads fail fast, locally. */
+export const MAX_DATA_BYTES = 8 * 1024;
+export const MAX_DATA_KEYS = 25;
+export function assertStructuredData(data) {
+    if (data === undefined || data === null) {
+        return;
+    }
+    if (typeof data !== 'object' || Array.isArray(data)) {
+        throw new PingRoomError('`data` must be a JSON object (not an array or scalar).', { code: 'invalid_data' });
+    }
+    const keys = Object.keys(data);
+    if (keys.length > MAX_DATA_KEYS) {
+        throw new PingRoomError(`\`data\` may have at most ${MAX_DATA_KEYS} keys (got ${keys.length}).`, { code: 'invalid_data' });
+    }
+    let encoded;
+    try {
+        encoded = JSON.stringify(data);
+    }
+    catch {
+        throw new PingRoomError('`data` must be JSON-serializable.', { code: 'invalid_data' });
+    }
+    const bytes = new TextEncoder().encode(encoded).length;
+    if (bytes > MAX_DATA_BYTES) {
+        throw new PingRoomError(`\`data\` is too large (${bytes} bytes, max ${MAX_DATA_BYTES}).`, { code: 'invalid_data' });
+    }
+}
+export function assertActionNumber(n) {
+    if (n === undefined || n === null) {
+        return;
+    }
+    if (typeof n !== 'number' || !Number.isInteger(n) || n < 1 || n > 4) {
+        throw new PingRoomError('action_number must be an integer 1–4.', { code: 'invalid_request' });
+    }
+}
+export function requireNonEmpty(value, field) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new PingRoomError(`\`${field}\` is required.`, { code: 'invalid_request' });
+    }
+}
+//# sourceMappingURL=guards.js.map

package/dist/internal/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/internal/guards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AACvC,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,aAAa,CAAC,wDAAwD,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,aAAa,CAAC,6BAA6B,aAAa,cAAc,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACvD,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,0BAA0B,KAAK,eAAe,cAAc,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACtH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,aAAa,CAAC,uCAAuC,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,aAAa,CAAC,KAAK,KAAK,iBAAiB,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}

package/dist/internal/url.d.ts

@@ -0,0 +1,8 @@
+export declare function isLoopbackHost(hostname: string): boolean;
+/**
+ * Refuse to carry a bearer credential over plain http to a non-loopback host —
+ * a token on the wire over http is a token leaked. https always passes; http is
+ * allowed only to loopback dev hosts, or anywhere when `allowInsecure` is set.
+ */
+export declare function assertSecureUrl(rawUrl: string, allowInsecure: boolean): URL;
+//# sourceMappingURL=url.d.ts.map

package/dist/internal/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/internal/url.ts"],"names":[],"mappings":"AAEA,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,GAAG,CAkB3E"}

package/dist/internal/url.js

@@ -0,0 +1,28 @@
+import { PingRoomError } from '../errors.js';
+export function isLoopbackHost(hostname) {
+    const h = hostname.toLowerCase().replace(/^\[/, '').replace(/\]$/, '');
+    return h === 'localhost' || h === '127.0.0.1' || h === '::1' || h.endsWith('.localhost');
+}
+/**
+ * Refuse to carry a bearer credential over plain http to a non-loopback host —
+ * a token on the wire over http is a token leaked. https always passes; http is
+ * allowed only to loopback dev hosts, or anywhere when `allowInsecure` is set.
+ */
+export function assertSecureUrl(rawUrl, allowInsecure) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new PingRoomError(`Invalid URL: ${rawUrl}`, { code: 'invalid_url' });
+    }
+    if (url.protocol === 'https:') {
+        return url;
+    }
+    if (url.protocol === 'http:' && (allowInsecure || isLoopbackHost(url.hostname))) {
+        return url;
+    }
+    throw new PingRoomError(`Refusing to send credentials over an insecure URL (${url.protocol}//${url.host}). ` +
+        'Use https, or set allowInsecure: true for trusted local development.', { code: 'insecure_url' });
+}
+//# sourceMappingURL=url.js.map

package/dist/internal/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/internal/url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,aAAsB;IACpE,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,gBAAgB,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,IAAI,aAAa,CACrB,sDAAsD,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,KAAK;QAClF,sEAAsE,EACxE,EAAE,IAAI,EAAE,cAAc,EAAE,CACzB,CAAC;AACJ,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1,40 @@
+import type { HttpClient } from './http.js';
+export interface JsonRpcError {
+    code: number;
+    message: string;
+    data?: unknown;
+}
+export interface McpTool {
+    name: string;
+    description?: string;
+    inputSchema?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+export interface McpToolResult {
+    content: Array<{
+        type: string;
+        text?: string;
+        [key: string]: unknown;
+    }>;
+    isError?: boolean;
+    [key: string]: unknown;
+}
+/**
+ * Thin client for the PingRoom MCP endpoint (`POST /api/agent/mcp`,
+ * JSON-RPC 2.0). Tools are scope-filtered server-side, so `listTools()` returns
+ * only what the credential can call.
+ */
+export declare class McpClient {
+    private readonly http;
+    private readonly path;
+    private nextId;
+    constructor(http: HttpClient, path?: string);
+    /** Raw JSON-RPC call. Resolves the `result`; throws PingRoomError on a JSON-RPC `error`. */
+    call<T = unknown>(method: string, params?: Record<string, unknown>): Promise<T>;
+    initialize(params?: Record<string, unknown>): Promise<unknown>;
+    listTools(): Promise<{
+        tools: McpTool[];
+    }>;
+    callTool(name: string, args?: Record<string, unknown>): Promise<McpToolResult>;
+}
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAG5C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,qBAAa,SAAS;IAIlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,MAAM,CAAK;gBAGA,IAAI,EAAE,UAAU,EAChB,IAAI,SAAmB;IAG1C,4FAA4F;IACtF,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAgBrF,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAW9D,SAAS,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAI1C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CAGnF"}

package/dist/mcp.js

@@ -0,0 +1,46 @@
+import { PingRoomError } from './errors.js';
+import { VERSION } from './version.js';
+/**
+ * Thin client for the PingRoom MCP endpoint (`POST /api/agent/mcp`,
+ * JSON-RPC 2.0). Tools are scope-filtered server-side, so `listTools()` returns
+ * only what the credential can call.
+ */
+export class McpClient {
+    http;
+    path;
+    nextId = 1;
+    constructor(http, path = '/api/agent/mcp') {
+        this.http = http;
+        this.path = path;
+    }
+    /** Raw JSON-RPC call. Resolves the `result`; throws PingRoomError on a JSON-RPC `error`. */
+    async call(method, params) {
+        const id = this.nextId++;
+        const envelope = { jsonrpc: '2.0', id, method, ...(params ? { params } : {}) };
+        const res = await this.http.request('POST', this.path, {
+            body: envelope,
+            headers: { Accept: 'application/json, text/event-stream' },
+        });
+        if (res && res.error) {
+            throw new PingRoomError(`MCP error ${res.error.code}: ${res.error.message}`, {
+                code: `mcp_${res.error.code}`,
+                body: res.error,
+            });
+        }
+        return res?.result;
+    }
+    initialize(params) {
+        return this.call('initialize', params ?? {
+            protocolVersion: '2025-06-18',
+            capabilities: {},
+            clientInfo: { name: 'pingroom-sdk', version: VERSION },
+        });
+    }
+    listTools() {
+        return this.call('tools/list');
+    }
+    callTool(name, args = {}) {
+        return this.call('tools/call', { name, arguments: args });
+    }
+}
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAqBvC;;;;GAIG;AACH,MAAM,OAAO,SAAS;IAID;IACA;IAJX,MAAM,GAAG,CAAC,CAAC;IAEnB,YACmB,IAAgB,EAChB,OAAO,gBAAgB;QADvB,SAAI,GAAJ,IAAI,CAAY;QAChB,SAAI,GAAJ,IAAI,CAAmB;IACvC,CAAC;IAEJ,4FAA4F;IAC5F,KAAK,CAAC,IAAI,CAAc,MAAc,EAAE,MAAgC;QACtE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAuC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE;YAC3F,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,qCAAqC,EAAE;SAC3D,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,aAAa,CAAC,aAAa,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE;gBAC3E,IAAI,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;gBAC7B,IAAI,EAAE,GAAG,CAAC,KAAK;aAChB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,EAAE,MAAW,CAAC;IAC1B,CAAC;IAED,UAAU,CAAC,MAAgC;QACzC,OAAO,IAAI,CAAC,IAAI,CACd,YAAY,EACZ,MAAM,IAAI;YACR,eAAe,EAAE,YAAY;YAC7B,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE;SACvD,CACF,CAAC;IACJ,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,CAAuB,YAAY,CAAC,CAAC;IACvD,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,OAAgC,EAAE;QACvD,OAAO,IAAI,CAAC,IAAI,CAAgB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}