@possibl/rcrt-sdk 0.1.2 → 0.5.0

package/dist/internal/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../src/internal/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,yEAAyE;IACzE,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC3E,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;IACnC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACrD,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IACpB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,KAAK,sBAAsB,GAAG,KAAK,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KAAK,eAAe,CAAC;AAElI,UAAU,eAAe;IACvB,QAAQ,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,KAAK,IAAI,IAAI,CAAC;IACd,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,YAAY,GAAG,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IACnF,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,KAAK,IAAI,IAAI,CAAC;IACd,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;CAClD;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,GAAG,aAAa,CA6ItF"}

package/dist/internal/sse.js

@@ -0,0 +1,161 @@
+/**
+ * SSE client with automatic reconnection + typed event dispatch.
+ *
+ * Works in three environments:
+ *   - Browsers: uses the built-in `EventSource`. Auth goes via query
+ *     params because `EventSource` can't set custom headers.
+ *   - Node 18+: uses the built-in `EventSource` (Node 22+) or a
+ *     pluggable polyfill (see `config.eventSource`).
+ *   - React Native: install `react-native-sse` and pass its
+ *     constructor as `config.eventSource`. Custom headers work there.
+ *
+ * Subscribers get typed events. Streams auto-reconnect with
+ * exponential backoff unless `close()` was called explicitly.
+ */
+export function connect(config, handlers) {
+    const maxBackoff = config.maxBackoffMs ?? 30_000;
+    let backoff = 1_000;
+    let closed = false;
+    let es = null;
+    let state = 'connecting';
+    let reconnectTimer = null;
+    async function open() {
+        if (closed)
+            return;
+        const token = await config.getToken();
+        const u = new URL(config.apiUrl.replace(/\/$/, '') + config.path);
+        if (config.query) {
+            for (const [k, v] of Object.entries(config.query)) {
+                u.searchParams.set(k, v);
+            }
+        }
+        const EventSourceCtor = (config.eventSource
+            ?? globalThis.EventSource);
+        if (!EventSourceCtor) {
+            handlers.onError?.({ message: 'No EventSource implementation available. Pass config.eventSource for React Native.', fatal: true }, true);
+            closed = true;
+            state = 'closed';
+            return;
+        }
+        // Prefer header auth when the EventSource impl supports it (React
+        // Native with `react-native-sse`, Node 22+, any custom
+        // `config.eventSource` that accepts a `headers` init). The browser's
+        // built-in EventSource constructor has NO support for custom
+        // headers — there's no proposal in the WHATWG spec to change that —
+        // so when we're stuck with it we fall back to passing the bearer
+        // token and tenant ID as query params.
+        //
+        // Security note (Sonar hotspot review): tokens in URLs are a
+        // documented smell — they can leak via proxy logs, HTTP Referer
+        // headers, and browser history. We mitigate:
+        //   * TLS is assumed (RCRT's api-gateway rejects plaintext HTTP).
+        //   * Firebase ID tokens are short-lived (60 min) and auto-rotated.
+        //     A leaked token in a server log expires fast; it can't be used
+        //     to escalate outside the scope Firebase already granted.
+        //   * `tk_*` workspace API keys are long-lived and should NEVER be
+        //     passed through this path. Callers holding a tk_ key are
+        //     server-side and must set `useHeaderAuth: true`. The SDK docs
+        //     and the TokenProvider interface make this explicit.
+        //   * This fallback only triggers for SSE subscriptions. The regular
+        //     fetch-based surface (`src/internal/fetch.ts`) always uses the
+        //     Authorization header.
+        // Without this fallback the SDK cannot open SSE connections from a
+        // browser at all, which would break every chat UI built on RCRT.
+        const init = {};
+        if (config.useHeaderAuth) {
+            init.headers = {
+                Authorization: `Bearer ${token}`,
+                ...(config.tenantId ? { 'X-Tenant-ID': config.tenantId } : {}),
+            };
+        }
+        else {
+            u.searchParams.set('token', token); // NOSONAR - required for browser EventSource; see block comment above
+            if (config.tenantId)
+                u.searchParams.set('tenant_id', config.tenantId);
+        }
+        try {
+            es = new EventSourceCtor(u.toString(), init);
+        }
+        catch (err) {
+            handlers.onError?.({ message: err.message, fatal: true }, true);
+            scheduleReconnect();
+            return;
+        }
+        es.onopen = () => {
+            backoff = 1_000;
+            state = 'open';
+            handlers.onOpen?.();
+        };
+        es.addEventListener('connected', (e) => {
+            const data = tryJson(e.data);
+            handlers.onConnected?.(data);
+        });
+        es.addEventListener('delta', (e) => {
+            const data = tryJson(e.data);
+            if (data)
+                handlers.onDelta?.(data);
+        });
+        es.addEventListener('message', (e) => {
+            const data = tryJson(e.data);
+            if (data)
+                handlers.onMessage?.(data);
+        });
+        es.addEventListener('thought', (e) => {
+            const data = tryJson(e.data);
+            if (data)
+                handlers.onThought?.(data);
+        });
+        es.addEventListener('action', (e) => {
+            const data = tryJson(e.data);
+            if (data)
+                handlers.onAction?.(data);
+        });
+        es.addEventListener('error', (e) => {
+            const data = tryJson(e?.data ?? '');
+            handlers.onError?.(data ?? { message: 'stream error' }, false);
+        });
+        es.onerror = () => {
+            state = 'closed';
+            handlers.onClose?.();
+            es?.close();
+            es = null;
+            scheduleReconnect();
+        };
+    }
+    function scheduleReconnect() {
+        if (closed)
+            return;
+        state = 'connecting';
+        const delay = backoff + Math.floor(Math.random() * 500);
+        backoff = Math.min(maxBackoff, backoff * 2);
+        reconnectTimer = setTimeout(() => {
+            reconnectTimer = null;
+            void open();
+        }, delay);
+    }
+    void open();
+    return {
+        close() {
+            closed = true;
+            state = 'closed';
+            if (reconnectTimer)
+                clearTimeout(reconnectTimer);
+            es?.close();
+            es = null;
+        },
+        get state() {
+            return state;
+        },
+    };
+}
+function tryJson(raw) {
+    if (typeof raw !== 'string' || !raw)
+        return undefined;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=sse.js.map

package/dist/internal/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../src/internal/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAwEH,MAAM,UAAU,OAAO,CAAC,MAAwB,EAAE,QAAqB;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC;IACjD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,EAAE,GAA2B,IAAI,CAAC;IACtC,IAAI,KAAK,GAAqC,YAAY,CAAC;IAC3D,IAAI,cAAc,GAAyC,IAAI,CAAC;IAEhE,KAAK,UAAU,IAAI;QACjB,IAAI,MAAM;YAAE,OAAO;QAEnB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAA2B,CAAC,MAAM,CAAC,WAAW;eAC7D,UAAkE,CAAC,WAAW,CAA2B,CAAC;QAChH,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,oFAAoF,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YACzI,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,GAAG,QAAQ,CAAC;YACjB,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,uDAAuD;QACvD,qEAAqE;QACrE,6DAA6D;QAC7D,oEAAoE;QACpE,iEAAiE;QACjE,uCAAuC;QACvC,EAAE;QACF,6DAA6D;QAC7D,gEAAgE;QAChE,6CAA6C;QAC7C,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,8DAA8D;QAC9D,mEAAmE;QACnE,8DAA8D;QAC9D,mEAAmE;QACnE,0DAA0D;QAC1D,qEAAqE;QACrE,oEAAoE;QACpE,4BAA4B;QAC5B,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,IAAI,GAA2D,EAAE,CAAC;QACxE,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,GAAG;gBACb,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,sEAAsE;YAC1G,IAAI,MAAM,CAAC,QAAQ;gBAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YAC3E,iBAAiB,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,EAAE,CAAC,MAAM,GAAG,GAAG,EAAE;YACf,OAAO,GAAG,KAAK,CAAC;YAChB,KAAK,GAAG,MAAM,CAAC;YACf,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,CAAC,CAAC;QAEF,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,OAAO,CAAE,CAAkB,CAAC,IAAI,CAAC,CAAC;YAC/C,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAiD,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACjC,MAAM,IAAI,GAAG,OAAO,CAAY,CAAkB,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,IAAI;gBAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,OAAO,CAAc,CAAkB,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,IAAI;gBAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,OAAO,CAAc,CAAkB,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,IAAI;gBAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,OAAO,CAAa,CAAkB,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,IAAI;gBAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACjC,MAAM,IAAI,GAAG,OAAO,CAAY,CAA8B,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC5E,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,OAAO,GAAG,GAAG,EAAE;YAChB,KAAK,GAAG,QAAQ,CAAC;YACjB,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrB,EAAE,EAAE,KAAK,EAAE,CAAC;YACZ,EAAE,GAAG,IAAI,CAAC;YACV,iBAAiB,EAAE,CAAC;QACtB,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,iBAAiB;QACxB,IAAI,MAAM;YAAE,OAAO;QACnB,KAAK,GAAG,YAAY,CAAC;QACrB,MAAM,KAAK,GAAG,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;QACxD,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;QAC5C,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,cAAc,GAAG,IAAI,CAAC;YACtB,KAAK,IAAI,EAAE,CAAC;QACd,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED,KAAK,IAAI,EAAE,CAAC;IAEZ,OAAO;QACL,KAAK;YACH,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,GAAG,QAAQ,CAAC;YACjB,IAAI,cAAc;gBAAE,YAAY,CAAC,cAAc,CAAC,CAAC;YACjD,EAAE,EAAE,KAAK,EAAE,CAAC;YACZ,EAAE,GAAG,IAAI,CAAC;QACZ,CAAC;QACD,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAc,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/marketplace.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Marketplace module — bundle catalogue, install state and lifecycle.
+ *
+ * Mirrors the gateway's `/v1/marketplace/*` surface:
+ *
+ *     GET    /v1/marketplace/bundles                                  list catalogue bundles
+ *     GET    /v1/marketplace/bundles/{scope}/{bundle}                 one bundle definition
+ *     GET    /v1/marketplace/bundles/{scope}/{bundle}/status          install status in this workspace
+ *     POST   /v1/marketplace/bundles/{scope}/{bundle}/install         install into this workspace
+ *     POST   /v1/marketplace/bundles/{scope}/{bundle}/update          upgrade install to latest published
+ *     POST   /v1/marketplace/bundles/{scope}/{bundle}/repair          re-install drifted items
+ *     POST   /v1/marketplace/bundles/{scope}/{bundle}/prune           remove items dropped from the bundle
+ *     POST   /v1/marketplace/bundles/{scope}/{bundle}/uninstall       remove the install
+ *     GET    /v1/marketplace/installed/bundles                        all bundle installs in this workspace
+ *
+ * All calls run against the client's current tenant — use
+ * `client.forTenant(id)` for fleet fan-out across workspaces.
+ */
+import type { FetchContext } from './internal/fetch.js';
+/** Where a marketplace bundle is published. */
+export type BundleScope = 'platform' | 'org' | 'tenant';
+/** Per-item state inside a bundle install. */
+export interface BundleItemStatus {
+    name: string;
+    /** e.g. current | drifted | missing */
+    status: string;
+}
+/**
+ * One bundle's install state in the active workspace, as returned by
+ * `GET /v1/marketplace/installed/bundles` and `.../status`.
+ */
+export interface BundleStatus {
+    bundle_name: string;
+    /** current | update_available | drifted | prune_available | not_installed | … */
+    status: string;
+    installed?: boolean;
+    effective_source?: {
+        display_name?: string;
+        version?: string;
+        scope?: string;
+    };
+    install_record?: {
+        installed_version?: string;
+        source_scope?: string;
+    };
+    item_statuses?: BundleItemStatus[];
+    missing_item_names?: string[];
+    removed_item_names?: string[];
+}
+/** Per-item outcome of an install / update / repair call. */
+export interface BundleItemResult {
+    name: string;
+    /** created | updated | platform (skipped — platform-scope copy exists) | error */
+    status: string;
+    error?: string;
+}
+/** A catalogue bundle (`GET /v1/marketplace/bundles`). */
+export interface BundleSummary {
+    name: string;
+    scope: string;
+    display_name?: string;
+    description?: string;
+    version?: string;
+    item_count?: number;
+    items?: Array<{
+        name: string;
+        kind?: string;
+    }>;
+    [key: string]: unknown;
+}
+export declare class MarketplaceModule {
+    private readonly ctx;
+    constructor(ctx: FetchContext);
+    /** All bundle installs in the active workspace, with version/drift status. */
+    listInstalledBundles(): Promise<BundleStatus[]>;
+    /** Catalogue of bundles visible from the active workspace. */
+    listBundles(): Promise<BundleSummary[]>;
+    /** One bundle's definition. */
+    getBundle(scope: BundleScope, bundle: string): Promise<BundleSummary>;
+    /** Install status of one bundle in the active workspace. */
+    bundleStatus(scope: BundleScope, bundle: string): Promise<BundleStatus>;
+    /** Install a bundle into the active workspace. */
+    installBundle(scope: BundleScope, bundle: string): Promise<BundleItemResult[]>;
+    /**
+     * Upgrade an installed bundle to the latest published version.
+     * Items that also exist at platform scope are skipped (status
+     * `"platform"`), so callers can detect no-op updates.
+     */
+    updateBundle(scope: BundleScope, bundle: string): Promise<BundleItemResult[]>;
+    /** Re-install drifted items from the published source. */
+    repairBundle(scope: BundleScope, bundle: string): Promise<BundleItemResult[]>;
+    /** Remove installed items that were dropped from the bundle definition. */
+    pruneBundle(scope: BundleScope, bundle: string): Promise<BundleItemResult[]>;
+    /** Uninstall a bundle from the active workspace. */
+    uninstallBundle(scope: BundleScope, bundle: string): Promise<BundleItemResult[]>;
+    private lifecycle;
+}
+//# sourceMappingURL=marketplace.d.ts.map

package/dist/marketplace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplace.d.ts","sourceRoot":"","sources":["../src/marketplace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,+CAA+C;AAC/C,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;AAExD,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,cAAc,CAAC,EAAE;QACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,aAAa,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,YAAY;IAE9C,8EAA8E;IACxE,oBAAoB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAQrD,8DAA8D;IACxD,WAAW,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAQ7C,+BAA+B;IACzB,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAI3E,4DAA4D;IACtD,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAO7E,kDAAkD;IAC5C,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIpF;;;;OAIG;IACG,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAInF,0DAA0D;IACpD,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAInF,2EAA2E;IACrE,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIlF,oDAAoD;IAC9C,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAIxE,SAAS;CAaxB"}

package/dist/marketplace.js

@@ -0,0 +1,74 @@
+/**
+ * Marketplace module — bundle catalogue, install state and lifecycle.
+ *
+ * Mirrors the gateway's `/v1/marketplace/*` surface:
+ *
+ *     GET    /v1/marketplace/bundles                                  list catalogue bundles
+ *     GET    /v1/marketplace/bundles/{scope}/{bundle}                 one bundle definition
+ *     GET    /v1/marketplace/bundles/{scope}/{bundle}/status          install status in this workspace
+ *     POST   /v1/marketplace/bundles/{scope}/{bundle}/install         install into this workspace
+ *     POST   /v1/marketplace/bundles/{scope}/{bundle}/update          upgrade install to latest published
+ *     POST   /v1/marketplace/bundles/{scope}/{bundle}/repair          re-install drifted items
+ *     POST   /v1/marketplace/bundles/{scope}/{bundle}/prune           remove items dropped from the bundle
+ *     POST   /v1/marketplace/bundles/{scope}/{bundle}/uninstall       remove the install
+ *     GET    /v1/marketplace/installed/bundles                        all bundle installs in this workspace
+ *
+ * All calls run against the client's current tenant — use
+ * `client.forTenant(id)` for fleet fan-out across workspaces.
+ */
+import { request } from './internal/fetch.js';
+export class MarketplaceModule {
+    ctx;
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    /** All bundle installs in the active workspace, with version/drift status. */
+    async listInstalledBundles() {
+        const res = await request(this.ctx, '/v1/marketplace/installed/bundles');
+        return Array.isArray(res) ? res : (res?.bundles ?? []);
+    }
+    /** Catalogue of bundles visible from the active workspace. */
+    async listBundles() {
+        const res = await request(this.ctx, '/v1/marketplace/bundles');
+        return Array.isArray(res) ? res : (res?.bundles ?? []);
+    }
+    /** One bundle's definition. */
+    async getBundle(scope, bundle) {
+        return request(this.ctx, `/v1/marketplace/bundles/${scope}/${encodeURIComponent(bundle)}`);
+    }
+    /** Install status of one bundle in the active workspace. */
+    async bundleStatus(scope, bundle) {
+        return request(this.ctx, `/v1/marketplace/bundles/${scope}/${encodeURIComponent(bundle)}/status`);
+    }
+    /** Install a bundle into the active workspace. */
+    async installBundle(scope, bundle) {
+        return this.lifecycle(scope, bundle, 'install');
+    }
+    /**
+     * Upgrade an installed bundle to the latest published version.
+     * Items that also exist at platform scope are skipped (status
+     * `"platform"`), so callers can detect no-op updates.
+     */
+    async updateBundle(scope, bundle) {
+        return this.lifecycle(scope, bundle, 'update');
+    }
+    /** Re-install drifted items from the published source. */
+    async repairBundle(scope, bundle) {
+        return this.lifecycle(scope, bundle, 'repair');
+    }
+    /** Remove installed items that were dropped from the bundle definition. */
+    async pruneBundle(scope, bundle) {
+        return this.lifecycle(scope, bundle, 'prune');
+    }
+    /** Uninstall a bundle from the active workspace. */
+    async uninstallBundle(scope, bundle) {
+        return this.lifecycle(scope, bundle, 'uninstall');
+    }
+    async lifecycle(scope, bundle, action) {
+        const res = await request(this.ctx, `/v1/marketplace/bundles/${scope}/${encodeURIComponent(bundle)}/${action}`, { method: 'POST', body: {} });
+        if (Array.isArray(res))
+            return res;
+        return res?.items ?? [];
+    }
+}
+//# sourceMappingURL=marketplace.js.map

package/dist/marketplace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplace.js","sourceRoot":"","sources":["../src/marketplace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAuD9C,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,GAAiB;QAAjB,QAAG,GAAH,GAAG,CAAc;IAAG,CAAC;IAElD,8EAA8E;IAC9E,KAAK,CAAC,oBAAoB;QACxB,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,CAAC,GAAG,EACR,mCAAmC,CACpC,CAAC;QACF,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,WAAW;QACf,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,CAAC,GAAG,EACR,yBAAyB,CAC1B,CAAC;QACF,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,+BAA+B;IAC/B,KAAK,CAAC,SAAS,CAAC,KAAkB,EAAE,MAAc;QAChD,OAAO,OAAO,CAAgB,IAAI,CAAC,GAAG,EAAE,2BAA2B,KAAK,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,YAAY,CAAC,KAAkB,EAAE,MAAc;QACnD,OAAO,OAAO,CACZ,IAAI,CAAC,GAAG,EACR,2BAA2B,KAAK,IAAI,kBAAkB,CAAC,MAAM,CAAC,SAAS,CACxE,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,aAAa,CAAC,KAAkB,EAAE,MAAc;QACpD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,KAAkB,EAAE,MAAc;QACnD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,KAAkB,EAAE,MAAc;QACnD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,WAAW,CAAC,KAAkB,EAAE,MAAc;QAClD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,eAAe,CAAC,KAAkB,EAAE,MAAc;QACtD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,KAAkB,EAClB,MAAc,EACd,MAA+D;QAE/D,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,CAAC,GAAG,EACR,2BAA2B,KAAK,IAAI,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,EAC1E,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAC7B,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,OAAO,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC;IAC1B,CAAC;CACF"}

package/dist/members.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Members module — workspace membership + invitations.
+ *
+ *   GET/POST        /v1/tenants/{tenant_id}/members
+ *   PUT/DELETE      /v1/tenants/{tenant_id}/members/{user_id}
+ *   GET/POST        /v1/tenants/{tenant_id}/invitations
+ *   DELETE          /v1/tenants/{tenant_id}/invitations/{invitation_id}
+ *
+ * Accept/decline/pending live on the IdentityModule (`auth.*`) because
+ * they are keyed by the *caller's* email, not a workspace.
+ *
+ * Note: creating an invitation also sends the invite email server-side;
+ * there is no separate "resend" endpoint — re-create to resend.
+ */
+import type { FetchContext } from './internal/fetch.js';
+export interface TenantMember {
+    id: string;
+    email: string;
+    name: string;
+    avatar_url?: string | null;
+    role: string;
+    joined_at: string;
+}
+export interface TenantInvitation {
+    id: string;
+    email: string;
+    role: string;
+    status: 'pending' | 'accepted' | 'declined' | 'expired' | 'cancelled' | string;
+    created_at?: string;
+    expires_at?: string | null;
+    invited_by_name?: string | null;
+    invited_by_email?: string | null;
+}
+export declare class MembersModule {
+    private readonly ctx;
+    constructor(ctx: FetchContext);
+    private tenant;
+    /** `GET /v1/tenants/{id}/members` */
+    list(tenantId?: string): Promise<TenantMember[]>;
+    /** `POST /v1/tenants/{id}/members` — direct add (caller must know the user id). */
+    add(userId: string, role: string, tenantId?: string): Promise<void>;
+    /** `PUT /v1/tenants/{id}/members/{userId}` — change a member's role. */
+    updateRole(userId: string, role: string, tenantId?: string): Promise<void>;
+    /** `DELETE /v1/tenants/{id}/members/{userId}` */
+    remove(userId: string, tenantId?: string): Promise<void>;
+    /** `GET /v1/tenants/{id}/invitations` — all invitations incl. resolved ones. */
+    listInvitations(tenantId?: string): Promise<TenantInvitation[]>;
+    /**
+     * `POST /v1/tenants/{id}/invitations` — creates the invite AND sends
+     * the email. Role defaults server-side to 'member'.
+     */
+    invite(email: string, options?: {
+        role?: string;
+        message?: string;
+        tenantId?: string;
+    }): Promise<TenantInvitation>;
+    /** `DELETE /v1/tenants/{id}/invitations/{invId}` — soft-cancel (status → cancelled). */
+    cancelInvitation(invitationId: string, tenantId?: string): Promise<void>;
+}
+//# sourceMappingURL=members.d.ts.map

package/dist/members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.d.ts","sourceRoot":"","sources":["../src/members.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,YAAY;IAE9C,OAAO,CAAC,MAAM;IAMd,qCAAqC;IAC/B,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAQtD,mFAAmF;IAC7E,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzE,wEAAwE;IAClE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOhF,iDAAiD;IAC3C,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9D,gFAAgF;IAC1E,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAQrE;;;OAGG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GACnE,OAAO,CAAC,gBAAgB,CAAC;IAO5B,wFAAwF;IAClF,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAK/E"}

package/dist/members.js

@@ -0,0 +1,74 @@
+/**
+ * Members module — workspace membership + invitations.
+ *
+ *   GET/POST        /v1/tenants/{tenant_id}/members
+ *   PUT/DELETE      /v1/tenants/{tenant_id}/members/{user_id}
+ *   GET/POST        /v1/tenants/{tenant_id}/invitations
+ *   DELETE          /v1/tenants/{tenant_id}/invitations/{invitation_id}
+ *
+ * Accept/decline/pending live on the IdentityModule (`auth.*`) because
+ * they are keyed by the *caller's* email, not a workspace.
+ *
+ * Note: creating an invitation also sends the invite email server-side;
+ * there is no separate "resend" endpoint — re-create to resend.
+ */
+import { request } from './internal/fetch.js';
+export class MembersModule {
+    ctx;
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    tenant(tenantId) {
+        const id = tenantId ?? this.ctx.tenantId;
+        if (!id)
+            throw new Error('MembersModule requires a tenant id (set via setTenantId or pass explicitly)');
+        return id;
+    }
+    /** `GET /v1/tenants/{id}/members` */
+    async list(tenantId) {
+        const res = await request(this.ctx, `/v1/tenants/${this.tenant(tenantId)}/members`);
+        return res.members ?? [];
+    }
+    /** `POST /v1/tenants/{id}/members` — direct add (caller must know the user id). */
+    async add(userId, role, tenantId) {
+        await request(this.ctx, `/v1/tenants/${this.tenant(tenantId)}/members`, {
+            method: 'POST',
+            body: { user_id: userId, role },
+        });
+    }
+    /** `PUT /v1/tenants/{id}/members/{userId}` — change a member's role. */
+    async updateRole(userId, role, tenantId) {
+        await request(this.ctx, `/v1/tenants/${this.tenant(tenantId)}/members/${userId}`, {
+            method: 'PUT',
+            body: { role },
+        });
+    }
+    /** `DELETE /v1/tenants/{id}/members/{userId}` */
+    async remove(userId, tenantId) {
+        await request(this.ctx, `/v1/tenants/${this.tenant(tenantId)}/members/${userId}`, {
+            method: 'DELETE',
+        });
+    }
+    /** `GET /v1/tenants/{id}/invitations` — all invitations incl. resolved ones. */
+    async listInvitations(tenantId) {
+        const res = await request(this.ctx, `/v1/tenants/${this.tenant(tenantId)}/invitations`);
+        return res.invitations ?? [];
+    }
+    /**
+     * `POST /v1/tenants/{id}/invitations` — creates the invite AND sends
+     * the email. Role defaults server-side to 'member'.
+     */
+    async invite(email, options = {}) {
+        return request(this.ctx, `/v1/tenants/${this.tenant(options.tenantId)}/invitations`, {
+            method: 'POST',
+            body: { email, role: options.role, message: options.message },
+        });
+    }
+    /** `DELETE /v1/tenants/{id}/invitations/{invId}` — soft-cancel (status → cancelled). */
+    async cancelInvitation(invitationId, tenantId) {
+        await request(this.ctx, `/v1/tenants/${this.tenant(tenantId)}/invitations/${invitationId}`, {
+            method: 'DELETE',
+        });
+    }
+}
+//# sourceMappingURL=members.js.map

package/dist/members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.js","sourceRoot":"","sources":["../src/members.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAsB9C,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,GAAiB;QAAjB,QAAG,GAAH,GAAG,CAAc;IAAG,CAAC;IAE1C,MAAM,CAAC,QAAiB;QAC9B,MAAM,EAAE,GAAG,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACxG,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,IAAI,CAAC,QAAiB;QAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,CAAC,GAAG,EACR,eAAe,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAC/C,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,QAAiB;QACvD,MAAM,OAAO,CAAO,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,QAAiB;QAC9D,MAAM,OAAO,CAAO,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,MAAM,EAAE,EAAE;YACtF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE,IAAI,EAAE;SACf,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAAiB;QAC5C,MAAM,OAAO,CAAO,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,MAAM,EAAE,EAAE;YACtF,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,eAAe,CAAC,QAAiB;QACrC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,CAAC,GAAG,EACR,eAAe,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CACnD,CAAC;QACF,OAAO,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACV,KAAa,EACb,UAAkE,EAAE;QAEpE,OAAO,OAAO,CAAmB,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE;YACrG,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,gBAAgB,CAAC,YAAoB,EAAE,QAAiB;QAC5D,MAAM,OAAO,CAAO,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,YAAY,EAAE,EAAE;YAChG,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/org.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Org admin module — `/v1/orgs/*` management surface.
+ *
+ * Everything here requires org-admin (or platform-admin) rights on the
+ * target org. Tenant scoping does not apply — calls are addressed by
+ * org id, not by the client's X-Tenant-ID.
+ */
+import type { FetchContext } from './internal/fetch.js';
+export interface OrgSummary {
+    id: string;
+    name: string;
+    slug?: string;
+    allowed_domains?: string[];
+    [key: string]: unknown;
+}
+export interface OrgMember {
+    user_id: string;
+    email?: string;
+    name?: string;
+    role: string;
+    [key: string]: unknown;
+}
+export interface OrgTenant {
+    id: string;
+    name: string;
+    slug?: string;
+    org_id?: string;
+    [key: string]: unknown;
+}
+/** Response of `POST /v1/orgs/{org_id}/customers` — a child customer org + its default workspace. */
+export interface CustomerOrgResponse {
+    org?: {
+        id: string;
+        name?: string;
+    };
+    workspace?: {
+        id: string;
+        name?: string;
+    };
+    [key: string]: unknown;
+}
+/**
+ * A stored org LLM provider credential.
+ *
+ * `org_llm_providers` is now purely a credential store keyed by route (see
+ * docs/design/LLM_PROVIDER_MODEL_RESOLUTION.md). `is_default` is retained only
+ * as a convenience flag for credential listing and does NOT influence
+ * resolution. The removed `fallback_for_id` column and the tier-override
+ * surface are gone — model selection is the agent breadcrumb's concrete
+ * `route/provider/model` address.
+ */
+export interface OrgLLMProvider {
+    id: string;
+    provider_type: string;
+    name: string;
+    is_default: boolean;
+}
+export declare class OrgModule {
+    private readonly ctx;
+    constructor(ctx: FetchContext);
+    /** `GET /v1/orgs/{org_id}` */
+    get(orgId: string): Promise<OrgSummary>;
+    /** `GET /v1/orgs/{org_id}/members` */
+    listMembers(orgId: string): Promise<OrgMember[]>;
+    /**
+     * `GET /v1/orgs/{org_id}/tenants` — all workspaces in the org.
+     *
+     * Privacy note for fleet apps: never enumerate a *customer-run*
+     * platform org's tenants; use org-level rollups instead.
+     */
+    listTenants(orgId: string): Promise<OrgTenant[]>;
+    /** `POST /v1/orgs/{org_id}/tenants` — create a workspace inside the org. Returns the new tenant id. */
+    createTenant(orgId: string, name: string, slug?: string): Promise<OrgTenant>;
+    /**
+     * `POST /v1/orgs/{org_id}/customers` — create a child customer org
+     * (optionally adopting an existing workspace as its default).
+     */
+    createCustomerOrg(orgId: string, opts: {
+        name: string;
+        adoptTenantId?: string;
+    }): Promise<CustomerOrgResponse>;
+    /** `GET /v1/orgs/{org_id}/llm-providers` — list stored BYO credentials (no fallback role). */
+    listLLMProviders(orgId: string): Promise<OrgLLMProvider[]>;
+}
+//# sourceMappingURL=org.d.ts.map

package/dist/org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.d.ts","sourceRoot":"","sources":["../src/org.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qGAAqG;AACrG,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,SAAS,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,YAAY;IAE9C,8BAA8B;IACxB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAI7C,sCAAsC;IAChC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAQtD;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAQtD,uGAAuG;IACjG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAclF;;;OAGG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,mBAAmB,CAAC;IAgB/B,8FAA8F;IACxF,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;CAOjE"}