@playaos/api-client 0.2.0 → 0.3.0

package/README.md

@@ -102,3 +102,4 @@ try {
 ## MCP server
 
 For AI agent access, use the companion [@playaos/mcp](https://www.npmjs.com/package/@playaos/mcp) package.
+

package/dist/index.d.ts

@@ -180,6 +180,24 @@ interface WaiverSignPayload {
 interface WaiverSignResponse {
     signatureId: string;
 }
+interface ApplicationNote {
+    id: string;
+    authorId: string;
+    authorName: string | null;
+    body: string;
+    createdAt: string;
+}
+interface ApplicationScore {
+    adminId: string;
+    adminName: string | null;
+    value: number;
+    updatedAt: string;
+}
+interface ApplicationAnnotations {
+    notes: ApplicationNote[];
+    tags: string[];
+    scores: ApplicationScore[];
+}
 
 interface ClientOptions {
     /** Base URL for authenticated /api/v1 routes, e.g. https://api.playaos.app */
@@ -204,6 +222,24 @@ declare class PlayaOSClient {
         get: (id: string, opts?: {
             signal?: AbortSignal;
         }) => Promise<Member>;
+        /** Member-self profile update (PLA-700). Requires camp key + member Bearer token. */
+        selfUpdate: (payload: {
+            bio?: string | null;
+            playaName?: string | null;
+            socialMedia?: Record<string, unknown> | null;
+            showSocialsInDirectory?: boolean;
+            phone?: string | null;
+            emergencyContactName?: string | null;
+            emergencyContactRelationship?: string | null;
+            emergencyContactPhone?: string | null;
+            profilePhotoPath?: string | null;
+            yearJoined?: number | null;
+        }, opts: {
+            accessToken: string;
+            signal?: AbortSignal;
+        }) => Promise<{
+            profileId: string;
+        }>;
     };
     readonly applications: {
         list: (params?: {
@@ -276,6 +312,28 @@ declare class PlayaOSClient {
                 accessToken: string;
                 signal?: AbortSignal;
             }) => Promise<ApplicationTransitionResponse>;
+            getAnnotations: (id: string, opts: {
+                accessToken: string;
+                signal?: AbortSignal;
+            }) => Promise<ApplicationAnnotations>;
+            addNote: (id: string, payload: {
+                body: string;
+            }, opts: {
+                accessToken: string;
+                signal?: AbortSignal;
+            }) => Promise<ApplicationNote>;
+            setTags: (id: string, payload: {
+                tags: string[];
+            }, opts: {
+                accessToken: string;
+                signal?: AbortSignal;
+            }) => Promise<string[]>;
+            setScore: (id: string, payload: {
+                value: number;
+            }, opts: {
+                accessToken: string;
+                signal?: AbortSignal;
+            }) => Promise<ApplicationScore>;
         };
         members: {
             create: (payload: MemberCreatePayload, opts: {
@@ -323,4 +381,4 @@ interface ExchangeResult {
 }
 declare function exchangeCode(params: ExchangeParams): Promise<ExchangeResult>;
 
-export { ApiClientError, type Application, type ApplicationCreatePayload, type ApplicationCreateResponse, type ApplicationStatus, type ApplicationTransitionPayload, type ApplicationTransitionResponse, type DuesStatus, type ExchangeParams, type ExchangeResult, type Member, type MemberCreatePayload, type MemberCreateResponse, type MemberDeactivateResponse, type MemberRole, type MemberUpdatePayload, type MemberUpdateResponse, type OrgConfig, type PaymentPageResponse, PlayaOSClient, type Shift, type ShiftSignup, type ShiftType, type Waiver, type WaiverContent, type WaiverSection, type WaiverSignPayload, type WaiverSignResponse, type WaiverStatus, createClient, exchangeCode };
+export { ApiClientError, type Application, type ApplicationAnnotations, type ApplicationCreatePayload, type ApplicationCreateResponse, type ApplicationNote, type ApplicationScore, type ApplicationStatus, type ApplicationTransitionPayload, type ApplicationTransitionResponse, type DuesStatus, type ExchangeParams, type ExchangeResult, type Member, type MemberCreatePayload, type MemberCreateResponse, type MemberDeactivateResponse, type MemberRole, type MemberUpdatePayload, type MemberUpdateResponse, type OrgConfig, type PaymentPageResponse, PlayaOSClient, type Shift, type ShiftSignup, type ShiftType, type Waiver, type WaiverContent, type WaiverSection, type WaiverSignPayload, type WaiverSignResponse, type WaiverStatus, createClient, exchangeCode };

package/dist/index.js

@@ -79,16 +79,32 @@ async function postEmbed(url, campKey, body, opts) {
   if (!res.ok) throw await parseError(res);
   return res.json();
 }
-async function adminEmbed(method, url, accessToken, body, signal) {
+async function putEmbed(url, campKey, body, opts) {
+  const headers = {
+    "X-Camp-Key": campKey,
+    "Content-Type": "application/json"
+  };
+  if (opts?.accessToken) headers.Authorization = `Bearer ${opts.accessToken}`;
   const res = await fetch(url, {
-    method,
-    headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
+    method: "PUT",
+    headers,
     body: JSON.stringify(body),
-    signal
+    signal: opts?.signal
   });
   if (!res.ok) throw await parseError(res);
   return res.json();
 }
+async function adminEmbed(method, url, accessToken, body, signal) {
+  const headers = { Authorization: `Bearer ${accessToken}` };
+  const init = { method, headers, signal };
+  if (body !== void 0) {
+    headers["Content-Type"] = "application/json";
+    init.body = JSON.stringify(body);
+  }
+  const res = await fetch(url, init);
+  if (!res.ok) throw await parseError(res);
+  return res.json();
+}
 var PlayaOSClient = class {
   baseUrl;
   embedBaseUrl;
@@ -100,7 +116,9 @@ var PlayaOSClient = class {
   }
   members = {
     list: (params, opts) => request(buildUrl(this.baseUrl, "/members", params), this.apiKey, opts?.signal),
-    get: (id, opts) => request(buildUrl(this.baseUrl, `/members/${encodeURIComponent(id)}`), this.apiKey, opts?.signal)
+    get: (id, opts) => request(buildUrl(this.baseUrl, `/members/${encodeURIComponent(id)}`), this.apiKey, opts?.signal),
+    /** Member-self profile update (PLA-700). Requires camp key + member Bearer token. */
+    selfUpdate: (payload, opts) => putEmbed(buildEmbedUrl(this.embedBaseUrl, "/members/self"), this.apiKey, payload, opts)
   };
   applications = {
     list: (params, opts) => request(buildUrl(this.baseUrl, "/applications", params), this.apiKey, opts?.signal),
@@ -154,6 +172,34 @@ var PlayaOSClient = class {
         opts.accessToken,
         payload,
         opts.signal
+      ),
+      getAnnotations: (id, opts) => adminEmbed(
+        "GET",
+        buildEmbedUrl(this.embedBaseUrl, `/admin/applications/${encodeURIComponent(id)}/annotations`),
+        opts.accessToken,
+        void 0,
+        opts.signal
+      ),
+      addNote: (id, payload, opts) => adminEmbed(
+        "POST",
+        buildEmbedUrl(this.embedBaseUrl, `/admin/applications/${encodeURIComponent(id)}/notes`),
+        opts.accessToken,
+        payload,
+        opts.signal
+      ),
+      setTags: (id, payload, opts) => adminEmbed(
+        "PUT",
+        buildEmbedUrl(this.embedBaseUrl, `/admin/applications/${encodeURIComponent(id)}/tags`),
+        opts.accessToken,
+        payload,
+        opts.signal
+      ),
+      setScore: (id, payload, opts) => adminEmbed(
+        "PUT",
+        buildEmbedUrl(this.embedBaseUrl, `/admin/applications/${encodeURIComponent(id)}/scores`),
+        opts.accessToken,
+        payload,
+        opts.signal
       )
     },
     members: {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/error.ts","../src/client.ts","../src/exchange.ts"],"sourcesContent":["export class ApiClientError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: string,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"ApiClientError\";\n  }\n}\n\nexport async function parseError(res: Response): Promise<ApiClientError> {\n  try {\n    const body = (await res.json()) as { error?: string; code?: string };\n    return new ApiClientError(res.status, body.code ?? \"UNKNOWN\", body.error ?? res.statusText);\n  } catch {\n    return new ApiClientError(res.status, \"UNKNOWN\", res.statusText);\n  }\n}\n","import { type ApiClientError, parseError } from \"./error.js\";\nimport type {\n  Application,\n  ApplicationCreatePayload,\n  ApplicationCreateResponse,\n  ApplicationStatus,\n  ApplicationTransitionPayload,\n  ApplicationTransitionResponse,\n  DuesStatus,\n  Member,\n  MemberCreatePayload,\n  MemberCreateResponse,\n  MemberDeactivateResponse,\n  MemberRole,\n  MemberUpdatePayload,\n  MemberUpdateResponse,\n  OrgConfig,\n  PaymentPageResponse,\n  Shift,\n  Waiver,\n  WaiverSignPayload,\n  WaiverSignResponse,\n  WaiverStatus,\n} from \"./types.js\";\n\nexport type { ApiClientError };\n\ninterface ClientOptions {\n  /** Base URL for authenticated /api/v1 routes, e.g. https://api.playaos.app */\n  baseUrl: string;\n  /** Optional base URL for /api/embed/v1 routes when they live on a different host. */\n  embedBaseUrl?: string;\n  /** API key in the format pk_live_* */\n  apiKey: string;\n}\n\nfunction buildUrl(base: string, path: string, params?: Record<string, string | number | boolean | undefined>): string {\n  const url = new URL(`${base}/api/v1${path}`);\n  if (params) {\n    for (const [k, v] of Object.entries(params)) {\n      // Skip undefined and false booleans — z.coerce.boolean() on the server uses Boolean(),\n      // which treats any non-empty string (including \"false\") as true. Omitting a false boolean\n      // param has the same effect as the server default (unfiltered).\n      if (v !== undefined && v !== false) url.searchParams.set(k, String(v));\n    }\n  }\n  return url.toString();\n}\n\nfunction buildEmbedUrl(base: string, path: string): string {\n  return `${base}/api/embed/v1${path}`;\n}\n\nasync function getEmbed<T>(url: string, campKey: string, signal?: AbortSignal): Promise<T> {\n  const res = await fetch(url, {\n    headers: { \"X-Camp-Key\": campKey },\n    signal,\n  });\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\nasync function getEmbedAuthed<T>(\n  url: string,\n  campKey: string,\n  opts?: { accessToken?: string; signal?: AbortSignal },\n): Promise<T> {\n  const headers: Record<string, string> = { \"X-Camp-Key\": campKey };\n  if (opts?.accessToken) headers.Authorization = `Bearer ${opts.accessToken}`;\n  const res = await fetch(url, { headers, signal: opts?.signal });\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\nasync function request<T>(url: string, apiKey: string, signal?: AbortSignal): Promise<T> {\n  const res = await fetch(url, {\n    headers: { Authorization: `Bearer ${apiKey}` },\n    signal,\n  });\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\nasync function post<T>(url: string, apiKey: string, body: unknown, signal?: AbortSignal): Promise<T> {\n  const res = await fetch(url, {\n    method: \"POST\",\n    headers: { Authorization: `Bearer ${apiKey}`, \"Content-Type\": \"application/json\" },\n    body: JSON.stringify(body),\n    signal,\n  });\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\nasync function postEmbed<T>(\n  url: string,\n  campKey: string,\n  body: unknown,\n  opts?: { accessToken?: string; signal?: AbortSignal },\n): Promise<T> {\n  const headers: Record<string, string> = {\n    \"X-Camp-Key\": campKey,\n    \"Content-Type\": \"application/json\",\n  };\n  if (opts?.accessToken) headers.Authorization = `Bearer ${opts.accessToken}`;\n  const res = await fetch(url, {\n    method: \"POST\",\n    headers,\n    body: JSON.stringify(body),\n    signal: opts?.signal,\n  });\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\n/**\n * Admin write helper for /api/embed/v1/admin/* (PLA-489). Bearer-only: the\n * admin token is the sole credential (no X-Camp-Key — orgId comes from the JWT\n * claims server-side). `method` is POST for create, PATCH for transition/update/\n * deactivate.\n */\nasync function adminEmbed<T>(\n  method: \"POST\" | \"PATCH\",\n  url: string,\n  accessToken: string,\n  body: unknown,\n  signal?: AbortSignal,\n): Promise<T> {\n  const res = await fetch(url, {\n    method,\n    headers: { Authorization: `Bearer ${accessToken}`, \"Content-Type\": \"application/json\" },\n    body: JSON.stringify(body),\n    signal,\n  });\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\nexport class PlayaOSClient {\n  private readonly baseUrl: string;\n  private readonly embedBaseUrl: string;\n  private readonly apiKey: string;\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n    this.embedBaseUrl = (opts.embedBaseUrl ?? opts.baseUrl).replace(/\\/+$/, \"\");\n    this.apiKey = opts.apiKey;\n  }\n\n  readonly members = {\n    list: (params?: { role?: MemberRole; status?: string }, opts?: { signal?: AbortSignal }): Promise<Member[]> =>\n      request(buildUrl(this.baseUrl, \"/members\", params), this.apiKey, opts?.signal),\n\n    get: (id: string, opts?: { signal?: AbortSignal }): Promise<Member> =>\n      request(buildUrl(this.baseUrl, `/members/${encodeURIComponent(id)}`), this.apiKey, opts?.signal),\n  };\n\n  readonly applications = {\n    list: (\n      params?: { status?: ApplicationStatus; year?: number },\n      opts?: { signal?: AbortSignal },\n    ): Promise<Application[]> => request(buildUrl(this.baseUrl, \"/applications\", params), this.apiKey, opts?.signal),\n\n    // Anonymous external-camp submission against POST /api/embed/v1/applications\n    // (PLA-481). Uses the X-Camp-Key header rather than Bearer auth. Pass\n    // `accessToken` to additionally send a PlayaOS IdP JWT (PLA-573 path) so\n    // the server trusts the verified profile claim and skips the email-based\n    // bootstrap.\n    create: (\n      payload: ApplicationCreatePayload,\n      opts?: { accessToken?: string; signal?: AbortSignal },\n    ): Promise<ApplicationCreateResponse> =>\n      postEmbed(buildEmbedUrl(this.embedBaseUrl, \"/applications\"), this.apiKey, payload, opts),\n  };\n\n  readonly waivers = {\n    /** Get the active waiver for an org for the current year. */\n    active: (orgId: string, opts?: { signal?: AbortSignal }): Promise<Waiver> =>\n      getEmbed(buildEmbedUrl(this.embedBaseUrl, `/waivers/${orgId}/active`), this.apiKey, opts?.signal),\n\n    /** Sign a waiver. Requires X-Camp-Key; optional accessToken for Bearer path. */\n    sign: (\n      payload: WaiverSignPayload,\n      opts?: { accessToken?: string; signal?: AbortSignal },\n    ): Promise<WaiverSignResponse> =>\n      postEmbed(buildEmbedUrl(this.embedBaseUrl, \"/waivers/sign\"), this.apiKey, payload, opts),\n\n    /** Has this applicant/member signed the active waiver? Anchor: applicationId query or Bearer accessToken. */\n    status: (\n      orgId: string,\n      opts?: { applicationId?: string; accessToken?: string; signal?: AbortSignal },\n    ): Promise<WaiverStatus> => {\n      const query = opts?.applicationId ? `?applicationId=${encodeURIComponent(opts.applicationId)}` : \"\";\n      return getEmbedAuthed(buildEmbedUrl(this.embedBaseUrl, `/waivers/${orgId}/status${query}`), this.apiKey, opts);\n    },\n\n    /** Get a short-lived download URL for a completed signature's PDF. Anchor: applicationId query or Bearer. */\n    signedPdf: (\n      orgId: string,\n      signatureId: string,\n      opts?: { applicationId?: string; accessToken?: string; signal?: AbortSignal },\n    ): Promise<{ url: string }> => {\n      const query = opts?.applicationId ? `?applicationId=${encodeURIComponent(opts.applicationId)}` : \"\";\n      return getEmbedAuthed(\n        buildEmbedUrl(this.embedBaseUrl, `/waivers/${orgId}/signatures/${encodeURIComponent(signatureId)}/pdf${query}`),\n        this.apiKey,\n        opts,\n      );\n    },\n  };\n\n  readonly dues = {\n    list: (params?: { userId?: string; year?: number }, opts?: { signal?: AbortSignal }): Promise<DuesStatus[]> =>\n      request(buildUrl(this.baseUrl, \"/dues\", params), this.apiKey, opts?.signal),\n  };\n\n  readonly shifts = {\n    list: (\n      params?: { year?: number; fromDate?: string; toDate?: string; publishedOnly?: boolean },\n      opts?: { signal?: AbortSignal },\n    ): Promise<Shift[]> => request(buildUrl(this.baseUrl, \"/shifts\", params), this.apiKey, opts?.signal),\n  };\n\n  readonly org = {\n    get: (opts?: { signal?: AbortSignal }): Promise<OrgConfig> =>\n      request(buildUrl(this.baseUrl, \"/org\"), this.apiKey, opts?.signal),\n  };\n\n  readonly payments = {\n    page: (\n      memberId: string,\n      duesCollectionId?: string,\n      opts?: { signal?: AbortSignal },\n    ): Promise<PaymentPageResponse> =>\n      post(buildUrl(this.baseUrl, \"/payments/page\"), this.apiKey, { memberId, duesCollectionId }, opts?.signal),\n  };\n\n  // Admin write APIs (PLA-489). Each method requires `accessToken` — a Supabase\n  // JWT for a camp admin/super_admin. The org boundary is enforced server-side\n  // from the JWT claims; these endpoints do not use the X-Camp-Key.\n  readonly admin = {\n    applications: {\n      transition: (\n        id: string,\n        payload: ApplicationTransitionPayload,\n        opts: { accessToken: string; signal?: AbortSignal },\n      ): Promise<ApplicationTransitionResponse> =>\n        adminEmbed(\n          \"PATCH\",\n          buildEmbedUrl(this.embedBaseUrl, `/admin/applications/${encodeURIComponent(id)}`),\n          opts.accessToken,\n          payload,\n          opts.signal,\n        ),\n    },\n    members: {\n      create: (\n        payload: MemberCreatePayload,\n        opts: { accessToken: string; signal?: AbortSignal },\n      ): Promise<MemberCreateResponse> =>\n        adminEmbed(\"POST\", buildEmbedUrl(this.embedBaseUrl, \"/admin/members\"), opts.accessToken, payload, opts.signal),\n\n      update: (\n        id: string,\n        patch: MemberUpdatePayload,\n        opts: { accessToken: string; signal?: AbortSignal },\n      ): Promise<MemberUpdateResponse> =>\n        adminEmbed(\n          \"PATCH\",\n          buildEmbedUrl(this.embedBaseUrl, `/admin/members/${encodeURIComponent(id)}`),\n          opts.accessToken,\n          patch,\n          opts.signal,\n        ),\n\n      deactivate: (\n        id: string,\n        opts: { accessToken: string; signal?: AbortSignal },\n      ): Promise<MemberDeactivateResponse> =>\n        adminEmbed(\n          \"PATCH\",\n          buildEmbedUrl(this.embedBaseUrl, `/admin/members/${encodeURIComponent(id)}`),\n          opts.accessToken,\n          { status: \"inactive\" },\n          opts.signal,\n        ),\n    },\n  };\n}\n\n/** Convenience factory — equivalent to `new PlayaOSClient(opts)`. */\nexport function createClient(opts: ClientOptions): PlayaOSClient {\n  return new PlayaOSClient(opts);\n}\n","/**\n * Server-side OAuth-code → ID-token exchange.\n *\n * Swaps a one-time authorization code from the PlayaOS IdP for a short-lived\n * ID token. Confidential clients pass `clientSecret`, which is sent to the\n * token endpoint server-side. Public/PKCE-only clients omit it — the\n * authorization-code + code_verifier pair is the sole credential. Public\n * clients can also exchange directly from the browser via `usePlayaOSAuth`\n * in `@playaos/react`.\n */\n\nexport interface ExchangeParams {\n  authBaseUrl?: string;\n  code: string;\n  codeVerifier: string;\n  clientId: string;\n  /** Confidential clients only. Omit for public/PKCE-only clients. */\n  clientSecret?: string;\n  redirectUri: string;\n}\n\nexport interface ExchangeResult {\n  idToken: string;\n  expiresAt: string;\n  /** Confidential clients only. Undefined for public clients. */\n  refreshToken?: string;\n}\n\nexport async function exchangeCode(params: ExchangeParams): Promise<ExchangeResult> {\n  const base = params.authBaseUrl ?? \"https://auth.playaos.app\";\n  // A confidential client is identified by passing clientSecret at all — even an\n  // empty string. We forward it as-is so the server validates it (an empty or\n  // wrong secret is rejected there); public clients omit the field entirely.\n  const isConfidential = params.clientSecret !== undefined;\n  const res = await fetch(`${base}/api/auth/v1/exchange`, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\" },\n    body: JSON.stringify({\n      code: params.code,\n      code_verifier: params.codeVerifier,\n      client_id: params.clientId,\n      ...(isConfidential ? { client_secret: params.clientSecret } : {}),\n      redirect_uri: params.redirectUri,\n    }),\n  });\n  let body: unknown;\n  try {\n    body = await res.json();\n  } catch {\n    throw new Error(`Exchange failed: non-JSON response (${res.status})`);\n  }\n\n  if (!res.ok) {\n    const errorReason =\n      typeof body === \"object\" && body !== null && \"error\" in body && typeof body.error === \"string\"\n        ? body.error\n        : String(res.status);\n    throw new Error(`Exchange failed: ${errorReason}`);\n  }\n\n  if (\n    typeof body !== \"object\" ||\n    body === null ||\n    !(\"idToken\" in body) ||\n    typeof body.idToken !== \"string\" ||\n    !(\"expiresAt\" in body) ||\n    typeof body.expiresAt !== \"string\"\n  ) {\n    throw new Error(\"Exchange failed: malformed success response\");\n  }\n\n  // The server mints a refresh token only for confidential clients (it sets\n  // `withRefreshToken: client.type === \"confidential\"`); public clients get\n  // none. Surface it when present, otherwise leave it undefined.\n  const refreshToken = \"refreshToken\" in body && typeof body.refreshToken === \"string\" ? body.refreshToken : undefined;\n\n  // A confidential client that gets no refresh token means the server response\n  // is malformed or the rotation flow is broken — surface it rather than\n  // silently returning a result the caller can't refresh.\n  if (isConfidential && refreshToken === undefined) {\n    throw new Error(\"Exchange failed: confidential client response missing refreshToken\");\n  }\n\n  return {\n    idToken: body.idToken,\n    expiresAt: body.expiresAt,\n    ...(refreshToken !== undefined ? { refreshToken } : {}),\n  };\n}\n"],"mappings":";AAAO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YACkB,QACA,MAChB,SACA;AACA,UAAM,OAAO;AAJG;AACA;AAIhB,SAAK,OAAO;AAAA,EACd;AAAA,EANkB;AAAA,EACA;AAMpB;AAEA,eAAsB,WAAW,KAAwC;AACvE,MAAI;AACF,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,WAAO,IAAI,eAAe,IAAI,QAAQ,KAAK,QAAQ,WAAW,KAAK,SAAS,IAAI,UAAU;AAAA,EAC5F,QAAQ;AACN,WAAO,IAAI,eAAe,IAAI,QAAQ,WAAW,IAAI,UAAU;AAAA,EACjE;AACF;;;ACkBA,SAAS,SAAS,MAAc,MAAc,QAAwE;AACpH,QAAM,MAAM,IAAI,IAAI,GAAG,IAAI,UAAU,IAAI,EAAE;AAC3C,MAAI,QAAQ;AACV,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAI3C,UAAI,MAAM,UAAa,MAAM,MAAO,KAAI,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,IACvE;AAAA,EACF;AACA,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,cAAc,MAAc,MAAsB;AACzD,SAAO,GAAG,IAAI,gBAAgB,IAAI;AACpC;AAEA,eAAe,SAAY,KAAa,SAAiB,QAAkC;AACzF,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,SAAS,EAAE,cAAc,QAAQ;AAAA,IACjC;AAAA,EACF,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAEA,eAAe,eACb,KACA,SACA,MACY;AACZ,QAAM,UAAkC,EAAE,cAAc,QAAQ;AAChE,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,KAAK,WAAW;AACzE,QAAM,MAAM,MAAM,MAAM,KAAK,EAAE,SAAS,QAAQ,MAAM,OAAO,CAAC;AAC9D,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAEA,eAAe,QAAW,KAAa,QAAgB,QAAkC;AACvF,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,IAC7C;AAAA,EACF,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAEA,eAAe,KAAQ,KAAa,QAAgB,MAAe,QAAkC;AACnG,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,IACjF,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB;AAAA,EACF,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAEA,eAAe,UACb,KACA,SACA,MACA,MACY;AACZ,QAAM,UAAkC;AAAA,IACtC,cAAc;AAAA,IACd,gBAAgB;AAAA,EAClB;AACA,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,KAAK,WAAW;AACzE,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB,QAAQ,MAAM;AAAA,EAChB,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAQA,eAAe,WACb,QACA,KACA,aACA,MACA,QACY;AACZ,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B;AAAA,IACA,SAAS,EAAE,eAAe,UAAU,WAAW,IAAI,gBAAgB,mBAAmB;AAAA,IACtF,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB;AAAA,EACF,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAEO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAqB;AAC/B,SAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC9C,SAAK,gBAAgB,KAAK,gBAAgB,KAAK,SAAS,QAAQ,QAAQ,EAAE;AAC1E,SAAK,SAAS,KAAK;AAAA,EACrB;AAAA,EAES,UAAU;AAAA,IACjB,MAAM,CAAC,QAAiD,SACtD,QAAQ,SAAS,KAAK,SAAS,YAAY,MAAM,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA,IAE/E,KAAK,CAAC,IAAY,SAChB,QAAQ,SAAS,KAAK,SAAS,YAAY,mBAAmB,EAAE,CAAC,EAAE,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA,EACnG;AAAA,EAES,eAAe;AAAA,IACtB,MAAM,CACJ,QACA,SAC2B,QAAQ,SAAS,KAAK,SAAS,iBAAiB,MAAM,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO/G,QAAQ,CACN,SACA,SAEA,UAAU,cAAc,KAAK,cAAc,eAAe,GAAG,KAAK,QAAQ,SAAS,IAAI;AAAA,EAC3F;AAAA,EAES,UAAU;AAAA;AAAA,IAEjB,QAAQ,CAAC,OAAe,SACtB,SAAS,cAAc,KAAK,cAAc,YAAY,KAAK,SAAS,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA;AAAA,IAGlG,MAAM,CACJ,SACA,SAEA,UAAU,cAAc,KAAK,cAAc,eAAe,GAAG,KAAK,QAAQ,SAAS,IAAI;AAAA;AAAA,IAGzF,QAAQ,CACN,OACA,SAC0B;AAC1B,YAAM,QAAQ,MAAM,gBAAgB,kBAAkB,mBAAmB,KAAK,aAAa,CAAC,KAAK;AACjG,aAAO,eAAe,cAAc,KAAK,cAAc,YAAY,KAAK,UAAU,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI;AAAA,IAC/G;AAAA;AAAA,IAGA,WAAW,CACT,OACA,aACA,SAC6B;AAC7B,YAAM,QAAQ,MAAM,gBAAgB,kBAAkB,mBAAmB,KAAK,aAAa,CAAC,KAAK;AACjG,aAAO;AAAA,QACL,cAAc,KAAK,cAAc,YAAY,KAAK,eAAe,mBAAmB,WAAW,CAAC,OAAO,KAAK,EAAE;AAAA,QAC9G,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAES,OAAO;AAAA,IACd,MAAM,CAAC,QAA6C,SAClD,QAAQ,SAAS,KAAK,SAAS,SAAS,MAAM,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA,EAC9E;AAAA,EAES,SAAS;AAAA,IAChB,MAAM,CACJ,QACA,SACqB,QAAQ,SAAS,KAAK,SAAS,WAAW,MAAM,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA,EACrG;AAAA,EAES,MAAM;AAAA,IACb,KAAK,CAAC,SACJ,QAAQ,SAAS,KAAK,SAAS,MAAM,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA,EACrE;AAAA,EAES,WAAW;AAAA,IAClB,MAAM,CACJ,UACA,kBACA,SAEA,KAAK,SAAS,KAAK,SAAS,gBAAgB,GAAG,KAAK,QAAQ,EAAE,UAAU,iBAAiB,GAAG,MAAM,MAAM;AAAA,EAC5G;AAAA;AAAA;AAAA;AAAA,EAKS,QAAQ;AAAA,IACf,cAAc;AAAA,MACZ,YAAY,CACV,IACA,SACA,SAEA;AAAA,QACE;AAAA,QACA,cAAc,KAAK,cAAc,uBAAuB,mBAAmB,EAAE,CAAC,EAAE;AAAA,QAChF,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,MACP;AAAA,IACJ;AAAA,IACA,SAAS;AAAA,MACP,QAAQ,CACN,SACA,SAEA,WAAW,QAAQ,cAAc,KAAK,cAAc,gBAAgB,GAAG,KAAK,aAAa,SAAS,KAAK,MAAM;AAAA,MAE/G,QAAQ,CACN,IACA,OACA,SAEA;AAAA,QACE;AAAA,QACA,cAAc,KAAK,cAAc,kBAAkB,mBAAmB,EAAE,CAAC,EAAE;AAAA,QAC3E,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,MACP;AAAA,MAEF,YAAY,CACV,IACA,SAEA;AAAA,QACE;AAAA,QACA,cAAc,KAAK,cAAc,kBAAkB,mBAAmB,EAAE,CAAC,EAAE;AAAA,QAC3E,KAAK;AAAA,QACL,EAAE,QAAQ,WAAW;AAAA,QACrB,KAAK;AAAA,MACP;AAAA,IACJ;AAAA,EACF;AACF;AAGO,SAAS,aAAa,MAAoC;AAC/D,SAAO,IAAI,cAAc,IAAI;AAC/B;;;ACzQA,eAAsB,aAAa,QAAiD;AAClF,QAAM,OAAO,OAAO,eAAe;AAInC,QAAM,iBAAiB,OAAO,iBAAiB;AAC/C,QAAM,MAAM,MAAM,MAAM,GAAG,IAAI,yBAAyB;AAAA,IACtD,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,MAAM,OAAO;AAAA,MACb,eAAe,OAAO;AAAA,MACtB,WAAW,OAAO;AAAA,MAClB,GAAI,iBAAiB,EAAE,eAAe,OAAO,aAAa,IAAI,CAAC;AAAA,MAC/D,cAAc,OAAO;AAAA,IACvB,CAAC;AAAA,EACH,CAAC;AACD,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,MAAM,uCAAuC,IAAI,MAAM,GAAG;AAAA,EACtE;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,cACJ,OAAO,SAAS,YAAY,SAAS,QAAQ,WAAW,QAAQ,OAAO,KAAK,UAAU,WAClF,KAAK,QACL,OAAO,IAAI,MAAM;AACvB,UAAM,IAAI,MAAM,oBAAoB,WAAW,EAAE;AAAA,EACnD;AAEA,MACE,OAAO,SAAS,YAChB,SAAS,QACT,EAAE,aAAa,SACf,OAAO,KAAK,YAAY,YACxB,EAAE,eAAe,SACjB,OAAO,KAAK,cAAc,UAC1B;AACA,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAKA,QAAM,eAAe,kBAAkB,QAAQ,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe;AAK3G,MAAI,kBAAkB,iBAAiB,QAAW;AAChD,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AAEA,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,WAAW,KAAK;AAAA,IAChB,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,EACvD;AACF;","names":[]}
+{"version":3,"sources":["../src/error.ts","../src/client.ts","../src/exchange.ts"],"sourcesContent":["export class ApiClientError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: string,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"ApiClientError\";\n  }\n}\n\nexport async function parseError(res: Response): Promise<ApiClientError> {\n  try {\n    const body = (await res.json()) as { error?: string; code?: string };\n    return new ApiClientError(res.status, body.code ?? \"UNKNOWN\", body.error ?? res.statusText);\n  } catch {\n    return new ApiClientError(res.status, \"UNKNOWN\", res.statusText);\n  }\n}\n","import { type ApiClientError, parseError } from \"./error.js\";\nimport type {\n  Application,\n  ApplicationAnnotations,\n  ApplicationCreatePayload,\n  ApplicationCreateResponse,\n  ApplicationNote,\n  ApplicationScore,\n  ApplicationStatus,\n  ApplicationTransitionPayload,\n  ApplicationTransitionResponse,\n  DuesStatus,\n  Member,\n  MemberCreatePayload,\n  MemberCreateResponse,\n  MemberDeactivateResponse,\n  MemberRole,\n  MemberUpdatePayload,\n  MemberUpdateResponse,\n  OrgConfig,\n  PaymentPageResponse,\n  Shift,\n  Waiver,\n  WaiverSignPayload,\n  WaiverSignResponse,\n  WaiverStatus,\n} from \"./types.js\";\n\nexport type { ApiClientError };\n\ninterface ClientOptions {\n  /** Base URL for authenticated /api/v1 routes, e.g. https://api.playaos.app */\n  baseUrl: string;\n  /** Optional base URL for /api/embed/v1 routes when they live on a different host. */\n  embedBaseUrl?: string;\n  /** API key in the format pk_live_* */\n  apiKey: string;\n}\n\nfunction buildUrl(base: string, path: string, params?: Record<string, string | number | boolean | undefined>): string {\n  const url = new URL(`${base}/api/v1${path}`);\n  if (params) {\n    for (const [k, v] of Object.entries(params)) {\n      // Skip undefined and false booleans — z.coerce.boolean() on the server uses Boolean(),\n      // which treats any non-empty string (including \"false\") as true. Omitting a false boolean\n      // param has the same effect as the server default (unfiltered).\n      if (v !== undefined && v !== false) url.searchParams.set(k, String(v));\n    }\n  }\n  return url.toString();\n}\n\nfunction buildEmbedUrl(base: string, path: string): string {\n  return `${base}/api/embed/v1${path}`;\n}\n\nasync function getEmbed<T>(url: string, campKey: string, signal?: AbortSignal): Promise<T> {\n  const res = await fetch(url, {\n    headers: { \"X-Camp-Key\": campKey },\n    signal,\n  });\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\nasync function getEmbedAuthed<T>(\n  url: string,\n  campKey: string,\n  opts?: { accessToken?: string; signal?: AbortSignal },\n): Promise<T> {\n  const headers: Record<string, string> = { \"X-Camp-Key\": campKey };\n  if (opts?.accessToken) headers.Authorization = `Bearer ${opts.accessToken}`;\n  const res = await fetch(url, { headers, signal: opts?.signal });\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\nasync function request<T>(url: string, apiKey: string, signal?: AbortSignal): Promise<T> {\n  const res = await fetch(url, {\n    headers: { Authorization: `Bearer ${apiKey}` },\n    signal,\n  });\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\nasync function post<T>(url: string, apiKey: string, body: unknown, signal?: AbortSignal): Promise<T> {\n  const res = await fetch(url, {\n    method: \"POST\",\n    headers: { Authorization: `Bearer ${apiKey}`, \"Content-Type\": \"application/json\" },\n    body: JSON.stringify(body),\n    signal,\n  });\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\nasync function postEmbed<T>(\n  url: string,\n  campKey: string,\n  body: unknown,\n  opts?: { accessToken?: string; signal?: AbortSignal },\n): Promise<T> {\n  const headers: Record<string, string> = {\n    \"X-Camp-Key\": campKey,\n    \"Content-Type\": \"application/json\",\n  };\n  if (opts?.accessToken) headers.Authorization = `Bearer ${opts.accessToken}`;\n  const res = await fetch(url, {\n    method: \"POST\",\n    headers,\n    body: JSON.stringify(body),\n    signal: opts?.signal,\n  });\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\nasync function putEmbed<T>(\n  url: string,\n  campKey: string,\n  body: unknown,\n  opts?: { accessToken?: string; signal?: AbortSignal },\n): Promise<T> {\n  const headers: Record<string, string> = {\n    \"X-Camp-Key\": campKey,\n    \"Content-Type\": \"application/json\",\n  };\n  if (opts?.accessToken) headers.Authorization = `Bearer ${opts.accessToken}`;\n  const res = await fetch(url, {\n    method: \"PUT\",\n    headers,\n    body: JSON.stringify(body),\n    signal: opts?.signal,\n  });\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\n/**\n * Bearer-only helper for /api/embed/v1/admin/* (PLA-489). The admin token is\n * the sole credential (no X-Camp-Key — orgId comes from the JWT claims\n * server-side). `method` can be GET, POST, PATCH, or PUT; `body` is optional\n * (omitted for GET reads like getAnnotations).\n */\nasync function adminEmbed<T>(\n  method: \"GET\" | \"POST\" | \"PATCH\" | \"PUT\",\n  url: string,\n  accessToken: string,\n  body?: unknown,\n  signal?: AbortSignal,\n): Promise<T> {\n  const headers: Record<string, string> = { Authorization: `Bearer ${accessToken}` };\n  const init: RequestInit = { method, headers, signal };\n  if (body !== undefined) {\n    headers[\"Content-Type\"] = \"application/json\";\n    init.body = JSON.stringify(body);\n  }\n  const res = await fetch(url, init);\n  if (!res.ok) throw await parseError(res);\n  return res.json() as Promise<T>;\n}\n\nexport class PlayaOSClient {\n  private readonly baseUrl: string;\n  private readonly embedBaseUrl: string;\n  private readonly apiKey: string;\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n    this.embedBaseUrl = (opts.embedBaseUrl ?? opts.baseUrl).replace(/\\/+$/, \"\");\n    this.apiKey = opts.apiKey;\n  }\n\n  readonly members = {\n    list: (params?: { role?: MemberRole; status?: string }, opts?: { signal?: AbortSignal }): Promise<Member[]> =>\n      request(buildUrl(this.baseUrl, \"/members\", params), this.apiKey, opts?.signal),\n\n    get: (id: string, opts?: { signal?: AbortSignal }): Promise<Member> =>\n      request(buildUrl(this.baseUrl, `/members/${encodeURIComponent(id)}`), this.apiKey, opts?.signal),\n\n    /** Member-self profile update (PLA-700). Requires camp key + member Bearer token. */\n    selfUpdate: (\n      payload: {\n        bio?: string | null;\n        playaName?: string | null;\n        socialMedia?: Record<string, unknown> | null;\n        showSocialsInDirectory?: boolean;\n        phone?: string | null;\n        emergencyContactName?: string | null;\n        emergencyContactRelationship?: string | null;\n        emergencyContactPhone?: string | null;\n        profilePhotoPath?: string | null;\n        yearJoined?: number | null;\n      },\n      opts: { accessToken: string; signal?: AbortSignal },\n    ): Promise<{ profileId: string }> =>\n      putEmbed(buildEmbedUrl(this.embedBaseUrl, \"/members/self\"), this.apiKey, payload, opts),\n  };\n\n  readonly applications = {\n    list: (\n      params?: { status?: ApplicationStatus; year?: number },\n      opts?: { signal?: AbortSignal },\n    ): Promise<Application[]> => request(buildUrl(this.baseUrl, \"/applications\", params), this.apiKey, opts?.signal),\n\n    // Anonymous external-camp submission against POST /api/embed/v1/applications\n    // (PLA-481). Uses the X-Camp-Key header rather than Bearer auth. Pass\n    // `accessToken` to additionally send a PlayaOS IdP JWT (PLA-573 path) so\n    // the server trusts the verified profile claim and skips the email-based\n    // bootstrap.\n    create: (\n      payload: ApplicationCreatePayload,\n      opts?: { accessToken?: string; signal?: AbortSignal },\n    ): Promise<ApplicationCreateResponse> =>\n      postEmbed(buildEmbedUrl(this.embedBaseUrl, \"/applications\"), this.apiKey, payload, opts),\n  };\n\n  readonly waivers = {\n    /** Get the active waiver for an org for the current year. */\n    active: (orgId: string, opts?: { signal?: AbortSignal }): Promise<Waiver> =>\n      getEmbed(buildEmbedUrl(this.embedBaseUrl, `/waivers/${orgId}/active`), this.apiKey, opts?.signal),\n\n    /** Sign a waiver. Requires X-Camp-Key; optional accessToken for Bearer path. */\n    sign: (\n      payload: WaiverSignPayload,\n      opts?: { accessToken?: string; signal?: AbortSignal },\n    ): Promise<WaiverSignResponse> =>\n      postEmbed(buildEmbedUrl(this.embedBaseUrl, \"/waivers/sign\"), this.apiKey, payload, opts),\n\n    /** Has this applicant/member signed the active waiver? Anchor: applicationId query or Bearer accessToken. */\n    status: (\n      orgId: string,\n      opts?: { applicationId?: string; accessToken?: string; signal?: AbortSignal },\n    ): Promise<WaiverStatus> => {\n      const query = opts?.applicationId ? `?applicationId=${encodeURIComponent(opts.applicationId)}` : \"\";\n      return getEmbedAuthed(buildEmbedUrl(this.embedBaseUrl, `/waivers/${orgId}/status${query}`), this.apiKey, opts);\n    },\n\n    /** Get a short-lived download URL for a completed signature's PDF. Anchor: applicationId query or Bearer. */\n    signedPdf: (\n      orgId: string,\n      signatureId: string,\n      opts?: { applicationId?: string; accessToken?: string; signal?: AbortSignal },\n    ): Promise<{ url: string }> => {\n      const query = opts?.applicationId ? `?applicationId=${encodeURIComponent(opts.applicationId)}` : \"\";\n      return getEmbedAuthed(\n        buildEmbedUrl(this.embedBaseUrl, `/waivers/${orgId}/signatures/${encodeURIComponent(signatureId)}/pdf${query}`),\n        this.apiKey,\n        opts,\n      );\n    },\n  };\n\n  readonly dues = {\n    list: (params?: { userId?: string; year?: number }, opts?: { signal?: AbortSignal }): Promise<DuesStatus[]> =>\n      request(buildUrl(this.baseUrl, \"/dues\", params), this.apiKey, opts?.signal),\n  };\n\n  readonly shifts = {\n    list: (\n      params?: { year?: number; fromDate?: string; toDate?: string; publishedOnly?: boolean },\n      opts?: { signal?: AbortSignal },\n    ): Promise<Shift[]> => request(buildUrl(this.baseUrl, \"/shifts\", params), this.apiKey, opts?.signal),\n  };\n\n  readonly org = {\n    get: (opts?: { signal?: AbortSignal }): Promise<OrgConfig> =>\n      request(buildUrl(this.baseUrl, \"/org\"), this.apiKey, opts?.signal),\n  };\n\n  readonly payments = {\n    page: (\n      memberId: string,\n      duesCollectionId?: string,\n      opts?: { signal?: AbortSignal },\n    ): Promise<PaymentPageResponse> =>\n      post(buildUrl(this.baseUrl, \"/payments/page\"), this.apiKey, { memberId, duesCollectionId }, opts?.signal),\n  };\n\n  // Admin write APIs (PLA-489). Each method requires `accessToken` — a Supabase\n  // JWT for a camp admin/super_admin. The org boundary is enforced server-side\n  // from the JWT claims; these endpoints do not use the X-Camp-Key.\n  readonly admin = {\n    applications: {\n      transition: (\n        id: string,\n        payload: ApplicationTransitionPayload,\n        opts: { accessToken: string; signal?: AbortSignal },\n      ): Promise<ApplicationTransitionResponse> =>\n        adminEmbed(\n          \"PATCH\",\n          buildEmbedUrl(this.embedBaseUrl, `/admin/applications/${encodeURIComponent(id)}`),\n          opts.accessToken,\n          payload,\n          opts.signal,\n        ),\n      getAnnotations: (\n        id: string,\n        opts: { accessToken: string; signal?: AbortSignal },\n      ): Promise<ApplicationAnnotations> =>\n        adminEmbed(\n          \"GET\",\n          buildEmbedUrl(this.embedBaseUrl, `/admin/applications/${encodeURIComponent(id)}/annotations`),\n          opts.accessToken,\n          undefined,\n          opts.signal,\n        ),\n      addNote: (\n        id: string,\n        payload: { body: string },\n        opts: { accessToken: string; signal?: AbortSignal },\n      ): Promise<ApplicationNote> =>\n        adminEmbed(\n          \"POST\",\n          buildEmbedUrl(this.embedBaseUrl, `/admin/applications/${encodeURIComponent(id)}/notes`),\n          opts.accessToken,\n          payload,\n          opts.signal,\n        ),\n      setTags: (\n        id: string,\n        payload: { tags: string[] },\n        opts: { accessToken: string; signal?: AbortSignal },\n      ): Promise<string[]> =>\n        adminEmbed(\n          \"PUT\",\n          buildEmbedUrl(this.embedBaseUrl, `/admin/applications/${encodeURIComponent(id)}/tags`),\n          opts.accessToken,\n          payload,\n          opts.signal,\n        ),\n      setScore: (\n        id: string,\n        payload: { value: number },\n        opts: { accessToken: string; signal?: AbortSignal },\n      ): Promise<ApplicationScore> =>\n        adminEmbed(\n          \"PUT\",\n          buildEmbedUrl(this.embedBaseUrl, `/admin/applications/${encodeURIComponent(id)}/scores`),\n          opts.accessToken,\n          payload,\n          opts.signal,\n        ),\n    },\n    members: {\n      create: (\n        payload: MemberCreatePayload,\n        opts: { accessToken: string; signal?: AbortSignal },\n      ): Promise<MemberCreateResponse> =>\n        adminEmbed(\"POST\", buildEmbedUrl(this.embedBaseUrl, \"/admin/members\"), opts.accessToken, payload, opts.signal),\n\n      update: (\n        id: string,\n        patch: MemberUpdatePayload,\n        opts: { accessToken: string; signal?: AbortSignal },\n      ): Promise<MemberUpdateResponse> =>\n        adminEmbed(\n          \"PATCH\",\n          buildEmbedUrl(this.embedBaseUrl, `/admin/members/${encodeURIComponent(id)}`),\n          opts.accessToken,\n          patch,\n          opts.signal,\n        ),\n\n      deactivate: (\n        id: string,\n        opts: { accessToken: string; signal?: AbortSignal },\n      ): Promise<MemberDeactivateResponse> =>\n        adminEmbed(\n          \"PATCH\",\n          buildEmbedUrl(this.embedBaseUrl, `/admin/members/${encodeURIComponent(id)}`),\n          opts.accessToken,\n          { status: \"inactive\" },\n          opts.signal,\n        ),\n    },\n  };\n}\n\n/** Convenience factory — equivalent to `new PlayaOSClient(opts)`. */\nexport function createClient(opts: ClientOptions): PlayaOSClient {\n  return new PlayaOSClient(opts);\n}\n","/**\n * Server-side OAuth-code → ID-token exchange.\n *\n * Swaps a one-time authorization code from the PlayaOS IdP for a short-lived\n * ID token. Confidential clients pass `clientSecret`, which is sent to the\n * token endpoint server-side. Public/PKCE-only clients omit it — the\n * authorization-code + code_verifier pair is the sole credential. Public\n * clients can also exchange directly from the browser via `usePlayaOSAuth`\n * in `@playaos/react`.\n */\n\nexport interface ExchangeParams {\n  authBaseUrl?: string;\n  code: string;\n  codeVerifier: string;\n  clientId: string;\n  /** Confidential clients only. Omit for public/PKCE-only clients. */\n  clientSecret?: string;\n  redirectUri: string;\n}\n\nexport interface ExchangeResult {\n  idToken: string;\n  expiresAt: string;\n  /** Confidential clients only. Undefined for public clients. */\n  refreshToken?: string;\n}\n\nexport async function exchangeCode(params: ExchangeParams): Promise<ExchangeResult> {\n  const base = params.authBaseUrl ?? \"https://auth.playaos.app\";\n  // A confidential client is identified by passing clientSecret at all — even an\n  // empty string. We forward it as-is so the server validates it (an empty or\n  // wrong secret is rejected there); public clients omit the field entirely.\n  const isConfidential = params.clientSecret !== undefined;\n  const res = await fetch(`${base}/api/auth/v1/exchange`, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\" },\n    body: JSON.stringify({\n      code: params.code,\n      code_verifier: params.codeVerifier,\n      client_id: params.clientId,\n      ...(isConfidential ? { client_secret: params.clientSecret } : {}),\n      redirect_uri: params.redirectUri,\n    }),\n  });\n  let body: unknown;\n  try {\n    body = await res.json();\n  } catch {\n    throw new Error(`Exchange failed: non-JSON response (${res.status})`);\n  }\n\n  if (!res.ok) {\n    const errorReason =\n      typeof body === \"object\" && body !== null && \"error\" in body && typeof body.error === \"string\"\n        ? body.error\n        : String(res.status);\n    throw new Error(`Exchange failed: ${errorReason}`);\n  }\n\n  if (\n    typeof body !== \"object\" ||\n    body === null ||\n    !(\"idToken\" in body) ||\n    typeof body.idToken !== \"string\" ||\n    !(\"expiresAt\" in body) ||\n    typeof body.expiresAt !== \"string\"\n  ) {\n    throw new Error(\"Exchange failed: malformed success response\");\n  }\n\n  // The server mints a refresh token only for confidential clients (it sets\n  // `withRefreshToken: client.type === \"confidential\"`); public clients get\n  // none. Surface it when present, otherwise leave it undefined.\n  const refreshToken = \"refreshToken\" in body && typeof body.refreshToken === \"string\" ? body.refreshToken : undefined;\n\n  // A confidential client that gets no refresh token means the server response\n  // is malformed or the rotation flow is broken — surface it rather than\n  // silently returning a result the caller can't refresh.\n  if (isConfidential && refreshToken === undefined) {\n    throw new Error(\"Exchange failed: confidential client response missing refreshToken\");\n  }\n\n  return {\n    idToken: body.idToken,\n    expiresAt: body.expiresAt,\n    ...(refreshToken !== undefined ? { refreshToken } : {}),\n  };\n}\n"],"mappings":";AAAO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YACkB,QACA,MAChB,SACA;AACA,UAAM,OAAO;AAJG;AACA;AAIhB,SAAK,OAAO;AAAA,EACd;AAAA,EANkB;AAAA,EACA;AAMpB;AAEA,eAAsB,WAAW,KAAwC;AACvE,MAAI;AACF,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,WAAO,IAAI,eAAe,IAAI,QAAQ,KAAK,QAAQ,WAAW,KAAK,SAAS,IAAI,UAAU;AAAA,EAC5F,QAAQ;AACN,WAAO,IAAI,eAAe,IAAI,QAAQ,WAAW,IAAI,UAAU;AAAA,EACjE;AACF;;;ACqBA,SAAS,SAAS,MAAc,MAAc,QAAwE;AACpH,QAAM,MAAM,IAAI,IAAI,GAAG,IAAI,UAAU,IAAI,EAAE;AAC3C,MAAI,QAAQ;AACV,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAI3C,UAAI,MAAM,UAAa,MAAM,MAAO,KAAI,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,IACvE;AAAA,EACF;AACA,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,cAAc,MAAc,MAAsB;AACzD,SAAO,GAAG,IAAI,gBAAgB,IAAI;AACpC;AAEA,eAAe,SAAY,KAAa,SAAiB,QAAkC;AACzF,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,SAAS,EAAE,cAAc,QAAQ;AAAA,IACjC;AAAA,EACF,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAEA,eAAe,eACb,KACA,SACA,MACY;AACZ,QAAM,UAAkC,EAAE,cAAc,QAAQ;AAChE,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,KAAK,WAAW;AACzE,QAAM,MAAM,MAAM,MAAM,KAAK,EAAE,SAAS,QAAQ,MAAM,OAAO,CAAC;AAC9D,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAEA,eAAe,QAAW,KAAa,QAAgB,QAAkC;AACvF,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,IAC7C;AAAA,EACF,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAEA,eAAe,KAAQ,KAAa,QAAgB,MAAe,QAAkC;AACnG,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,IACjF,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB;AAAA,EACF,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAEA,eAAe,UACb,KACA,SACA,MACA,MACY;AACZ,QAAM,UAAkC;AAAA,IACtC,cAAc;AAAA,IACd,gBAAgB;AAAA,EAClB;AACA,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,KAAK,WAAW;AACzE,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB,QAAQ,MAAM;AAAA,EAChB,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAEA,eAAe,SACb,KACA,SACA,MACA,MACY;AACZ,QAAM,UAAkC;AAAA,IACtC,cAAc;AAAA,IACd,gBAAgB;AAAA,EAClB;AACA,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,KAAK,WAAW;AACzE,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB,QAAQ,MAAM;AAAA,EAChB,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAQA,eAAe,WACb,QACA,KACA,aACA,MACA,QACY;AACZ,QAAM,UAAkC,EAAE,eAAe,UAAU,WAAW,GAAG;AACjF,QAAM,OAAoB,EAAE,QAAQ,SAAS,OAAO;AACpD,MAAI,SAAS,QAAW;AACtB,YAAQ,cAAc,IAAI;AAC1B,SAAK,OAAO,KAAK,UAAU,IAAI;AAAA,EACjC;AACA,QAAM,MAAM,MAAM,MAAM,KAAK,IAAI;AACjC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,WAAW,GAAG;AACvC,SAAO,IAAI,KAAK;AAClB;AAEO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAqB;AAC/B,SAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC9C,SAAK,gBAAgB,KAAK,gBAAgB,KAAK,SAAS,QAAQ,QAAQ,EAAE;AAC1E,SAAK,SAAS,KAAK;AAAA,EACrB;AAAA,EAES,UAAU;AAAA,IACjB,MAAM,CAAC,QAAiD,SACtD,QAAQ,SAAS,KAAK,SAAS,YAAY,MAAM,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA,IAE/E,KAAK,CAAC,IAAY,SAChB,QAAQ,SAAS,KAAK,SAAS,YAAY,mBAAmB,EAAE,CAAC,EAAE,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA;AAAA,IAGjG,YAAY,CACV,SAYA,SAEA,SAAS,cAAc,KAAK,cAAc,eAAe,GAAG,KAAK,QAAQ,SAAS,IAAI;AAAA,EAC1F;AAAA,EAES,eAAe;AAAA,IACtB,MAAM,CACJ,QACA,SAC2B,QAAQ,SAAS,KAAK,SAAS,iBAAiB,MAAM,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO/G,QAAQ,CACN,SACA,SAEA,UAAU,cAAc,KAAK,cAAc,eAAe,GAAG,KAAK,QAAQ,SAAS,IAAI;AAAA,EAC3F;AAAA,EAES,UAAU;AAAA;AAAA,IAEjB,QAAQ,CAAC,OAAe,SACtB,SAAS,cAAc,KAAK,cAAc,YAAY,KAAK,SAAS,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA;AAAA,IAGlG,MAAM,CACJ,SACA,SAEA,UAAU,cAAc,KAAK,cAAc,eAAe,GAAG,KAAK,QAAQ,SAAS,IAAI;AAAA;AAAA,IAGzF,QAAQ,CACN,OACA,SAC0B;AAC1B,YAAM,QAAQ,MAAM,gBAAgB,kBAAkB,mBAAmB,KAAK,aAAa,CAAC,KAAK;AACjG,aAAO,eAAe,cAAc,KAAK,cAAc,YAAY,KAAK,UAAU,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI;AAAA,IAC/G;AAAA;AAAA,IAGA,WAAW,CACT,OACA,aACA,SAC6B;AAC7B,YAAM,QAAQ,MAAM,gBAAgB,kBAAkB,mBAAmB,KAAK,aAAa,CAAC,KAAK;AACjG,aAAO;AAAA,QACL,cAAc,KAAK,cAAc,YAAY,KAAK,eAAe,mBAAmB,WAAW,CAAC,OAAO,KAAK,EAAE;AAAA,QAC9G,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAES,OAAO;AAAA,IACd,MAAM,CAAC,QAA6C,SAClD,QAAQ,SAAS,KAAK,SAAS,SAAS,MAAM,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA,EAC9E;AAAA,EAES,SAAS;AAAA,IAChB,MAAM,CACJ,QACA,SACqB,QAAQ,SAAS,KAAK,SAAS,WAAW,MAAM,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA,EACrG;AAAA,EAES,MAAM;AAAA,IACb,KAAK,CAAC,SACJ,QAAQ,SAAS,KAAK,SAAS,MAAM,GAAG,KAAK,QAAQ,MAAM,MAAM;AAAA,EACrE;AAAA,EAES,WAAW;AAAA,IAClB,MAAM,CACJ,UACA,kBACA,SAEA,KAAK,SAAS,KAAK,SAAS,gBAAgB,GAAG,KAAK,QAAQ,EAAE,UAAU,iBAAiB,GAAG,MAAM,MAAM;AAAA,EAC5G;AAAA;AAAA;AAAA;AAAA,EAKS,QAAQ;AAAA,IACf,cAAc;AAAA,MACZ,YAAY,CACV,IACA,SACA,SAEA;AAAA,QACE;AAAA,QACA,cAAc,KAAK,cAAc,uBAAuB,mBAAmB,EAAE,CAAC,EAAE;AAAA,QAChF,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,MACP;AAAA,MACF,gBAAgB,CACd,IACA,SAEA;AAAA,QACE;AAAA,QACA,cAAc,KAAK,cAAc,uBAAuB,mBAAmB,EAAE,CAAC,cAAc;AAAA,QAC5F,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,MACP;AAAA,MACF,SAAS,CACP,IACA,SACA,SAEA;AAAA,QACE;AAAA,QACA,cAAc,KAAK,cAAc,uBAAuB,mBAAmB,EAAE,CAAC,QAAQ;AAAA,QACtF,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,MACP;AAAA,MACF,SAAS,CACP,IACA,SACA,SAEA;AAAA,QACE;AAAA,QACA,cAAc,KAAK,cAAc,uBAAuB,mBAAmB,EAAE,CAAC,OAAO;AAAA,QACrF,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,MACP;AAAA,MACF,UAAU,CACR,IACA,SACA,SAEA;AAAA,QACE;AAAA,QACA,cAAc,KAAK,cAAc,uBAAuB,mBAAmB,EAAE,CAAC,SAAS;AAAA,QACvF,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,MACP;AAAA,IACJ;AAAA,IACA,SAAS;AAAA,MACP,QAAQ,CACN,SACA,SAEA,WAAW,QAAQ,cAAc,KAAK,cAAc,gBAAgB,GAAG,KAAK,aAAa,SAAS,KAAK,MAAM;AAAA,MAE/G,QAAQ,CACN,IACA,OACA,SAEA;AAAA,QACE;AAAA,QACA,cAAc,KAAK,cAAc,kBAAkB,mBAAmB,EAAE,CAAC,EAAE;AAAA,QAC3E,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,MACP;AAAA,MAEF,YAAY,CACV,IACA,SAEA;AAAA,QACE;AAAA,QACA,cAAc,KAAK,cAAc,kBAAkB,mBAAmB,EAAE,CAAC,EAAE;AAAA,QAC3E,KAAK;AAAA,QACL,EAAE,QAAQ,WAAW;AAAA,QACrB,KAAK;AAAA,MACP;AAAA,IACJ;AAAA,EACF;AACF;AAGO,SAAS,aAAa,MAAoC;AAC/D,SAAO,IAAI,cAAc,IAAI;AAC/B;;;ACnWA,eAAsB,aAAa,QAAiD;AAClF,QAAM,OAAO,OAAO,eAAe;AAInC,QAAM,iBAAiB,OAAO,iBAAiB;AAC/C,QAAM,MAAM,MAAM,MAAM,GAAG,IAAI,yBAAyB;AAAA,IACtD,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,MAAM,OAAO;AAAA,MACb,eAAe,OAAO;AAAA,MACtB,WAAW,OAAO;AAAA,MAClB,GAAI,iBAAiB,EAAE,eAAe,OAAO,aAAa,IAAI,CAAC;AAAA,MAC/D,cAAc,OAAO;AAAA,IACvB,CAAC;AAAA,EACH,CAAC;AACD,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,MAAM,uCAAuC,IAAI,MAAM,GAAG;AAAA,EACtE;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,cACJ,OAAO,SAAS,YAAY,SAAS,QAAQ,WAAW,QAAQ,OAAO,KAAK,UAAU,WAClF,KAAK,QACL,OAAO,IAAI,MAAM;AACvB,UAAM,IAAI,MAAM,oBAAoB,WAAW,EAAE;AAAA,EACnD;AAEA,MACE,OAAO,SAAS,YAChB,SAAS,QACT,EAAE,aAAa,SACf,OAAO,KAAK,YAAY,YACxB,EAAE,eAAe,SACjB,OAAO,KAAK,cAAc,UAC1B;AACA,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAKA,QAAM,eAAe,kBAAkB,QAAQ,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe;AAK3G,MAAI,kBAAkB,iBAAiB,QAAW;AAChD,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AAEA,SAAO;AAAA,IACL,SAAS,KAAK;AAAA,IACd,WAAW,KAAK;AAAA,IAChB,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,EACvD;AACF;","names":[]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@playaos/api-client",
-  "version": "0.2.0",
-  "description": "Typed API client for PlayaOS \u2014 manage camp members, dues, shifts, applications, and waivers",
+  "version": "0.3.0",
+  "description": "Typed API client for PlayaOS \u2014 manage camp members, dues, shifts, applications, waivers, and annotations",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",