@productcraft/core 0.0.5 → 0.1.0

package/README.md

@@ -2,7 +2,7 @@
 
 Shared transport + auth primitives for the ProductCraft Node.js SDKs.
 
-You **don't install this directly**. It's a runtime dependency of every product SDK (`@productcraft/heimdall`, `@productcraft/envoi`, `@productcraft/rally`, `@productcraft/agora`, `@productcraft/platform-auth`) plus the `productcraft` umbrella. Installing one of those pulls `@productcraft/core` along automatically.
+You **don't install this directly**. It's a runtime dependency of every product SDK (`@productcraft/auth`, `@productcraft/mail`, `@productcraft/waitlist`, `@productcraft/social`, `@productcraft/platform-auth`) plus the `productcraft` umbrella. Installing one of those pulls `@productcraft/core` along automatically.
 
 ## What it provides
 

package/dist/index.cjs

@@ -8,15 +8,14 @@ var createClient__default = /*#__PURE__*/_interopDefault(createClient);
 
 // src/index.ts
 var PC_BASE_URL = {
-  // platformAuth moved api.auth → api.platform-auth (the platform
-  // identity layer vacated api.auth so the customer-facing Auth product
-  // could take it). heimdall (the Auth product) → api.auth; agora →
-  // social.productcraft.co. Old hosts stay live as aliases.
+  // platformAuth is the platform identity layer (workspaces, PATs);
+  // it vacated api.auth so the customer-facing Auth product could
+  // take that host.
   platformAuth: "https://api.platform-auth.productcraft.co",
-  heimdall: "https://api.auth.productcraft.co",
-  envoi: "https://api.mail.productcraft.co",
-  rally: "https://api.waitlist.productcraft.co",
-  agora: "https://social.productcraft.co"
+  auth: "https://api.auth.productcraft.co",
+  mail: "https://api.mail.productcraft.co",
+  waitlist: "https://api.waitlist.productcraft.co",
+  social: "https://social.productcraft.co"
 };
 function authMiddleware(auth) {
   return {

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["createClient"],"mappings":";;;;;;;;;AAiDO,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzB,YAAA,EAAc,2CAAA;AAAA,EACd,QAAA,EAAU,kCAAA;AAAA,EACV,KAAA,EAAO,kCAAA;AAAA,EACP,KAAA,EAAO,sCAAA;AAAA,EACP,KAAA,EAAO;AACT;AAMO,SAAS,eAAe,IAAA,EAAsC;AACnE,EAAA,OAAO;AAAA,IACL,MAAM,SAAA,CAAU,EAAE,OAAA,EAAQ,EAAG;AAC3B,MAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,MAAA,QAAQ,KAAK,IAAA;AAAM,QACjB,KAAK,QAAA;AACH,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACzD,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AAC3D,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,QAAA,EAAU,CAAA,WAAA,EAAc,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AACxD,UAAA;AAAA;AAEJ,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,GACF;AACF;AAQO,SAAS,UAAA,CACd,cAAA,EACA,MAAA,GAAyB,EAAC,EACV;AAChB,EAAA,MAAM,SAASA,6BAAA,CAAqB;AAAA,IAClC,OAAA,EAAS,OAAO,OAAA,IAAW,cAAA;AAAA,IAC3B,OAAO,MAAA,CAAO;AAAA,GACf,CAAA;AACD,EAAA,MAAA,CAAO,GAAA,CAAI,cAAA,CAAe,MAAA,CAAO,IAAI,CAAC,CAAA;AACtC,EAAA,OAAO,MAAA;AACT","file":"index.cjs","sourcesContent":["/**\n * Shared transport + auth plumbing used by every surface client.\n *\n * Each surface package (`@productcraft/heimdall`, `@productcraft/envoi`,\n * ...) defines a thin class around `openapi-fetch` plus the generated\n * `paths` types from its own `_generated.d.ts`. The class delegates\n * wire I/O to `openapi-fetch`, but exposes a Stripe-style ergonomic\n * surface where callers reach for `pc.envoi.messages.send(...)` rather\n * than the underlying `client.POST(\"/v1/...\")` shape.\n *\n * v0 ships only the underlying `client` (named `client` on each\n * surface) — every endpoint is reachable through it. Ergonomic\n * resource surfaces land in v0.1+ as we hand-roll them.\n */\n\nimport createClient, { type Client, type Middleware } from \"openapi-fetch\";\n\n/**\n * The auth credential the SDK presents to ProductCraft APIs.\n *\n * - `apiKey` — Platform API Key (`pcft_live_*`). Server-side only;\n *   never embed in a shipped browser bundle.\n * - `bearer` — pre-resolved JWT (e.g. a Heimdall app-scoped EndUser\n *   token your backend minted and shipped to the device).\n * - `cookie` — captured `auth_token` cookie value. Mostly useful in\n *   dev / E2E tests where you've already signed in.\n */\nexport type PCAuth =\n  | { type: \"apiKey\"; key: string }\n  | { type: \"bearer\"; token: string }\n  | { type: \"cookie\"; value: string };\n\nexport interface PCClientConfig {\n  auth?: PCAuth;\n  /** Override the prod base URL — useful for dev / staging. */\n  baseUrl?: string;\n  /** Custom fetch (e.g. node-fetch with retries, undici, ...). */\n  fetch?: typeof fetch;\n}\n\n/**\n * Default prod base URL per surface.\n *\n * Pointed at the renamed services (Rally→Waitlist, Agora→Feed,\n * Heimdall→users) so the SDK targets the canonical new domains and the\n * old aliases (api.rally, agora.*, api.heimdall) can eventually retire.\n * The surface KEYS (rally/agora/heimdall) are intentionally kept until\n * the v1.0.0 public-API rename, so this stays a non-breaking retarget.\n */\nexport const PC_BASE_URL = {\n  // platformAuth moved api.auth → api.platform-auth (the platform\n  // identity layer vacated api.auth so the customer-facing Auth product\n  // could take it). heimdall (the Auth product) → api.auth; agora →\n  // social.productcraft.co. Old hosts stay live as aliases.\n  platformAuth: \"https://api.platform-auth.productcraft.co\",\n  heimdall: \"https://api.auth.productcraft.co\",\n  envoi: \"https://api.mail.productcraft.co\",\n  rally: \"https://api.waitlist.productcraft.co\",\n  agora: \"https://social.productcraft.co\",\n} as const;\n\n/**\n * Build an `openapi-fetch` middleware that adds the configured auth\n * credential as a header on every outbound request.\n */\nexport function authMiddleware(auth: PCAuth | undefined): Middleware {\n  return {\n    async onRequest({ request }) {\n      if (!auth) return undefined;\n      switch (auth.type) {\n        case \"apiKey\":\n          request.headers.set(\"Authorization\", `Bearer ${auth.key}`);\n          break;\n        case \"bearer\":\n          request.headers.set(\"Authorization\", `Bearer ${auth.token}`);\n          break;\n        case \"cookie\":\n          request.headers.set(\"Cookie\", `auth_token=${auth.value}`);\n          break;\n      }\n      return request;\n    },\n  };\n}\n\n/**\n * Construct an `openapi-fetch` client for a surface. Each surface\n * package calls this with its own generated `paths` type and default\n * base URL. The returned client is the v0 surface — every endpoint is\n * reachable through `client.GET(...)`, `client.POST(...)`, etc.\n */\nexport function makeClient<TPaths extends object>(\n  defaultBaseUrl: string,\n  config: PCClientConfig = {},\n): Client<TPaths> {\n  const client = createClient<TPaths>({\n    baseUrl: config.baseUrl ?? defaultBaseUrl,\n    fetch: config.fetch,\n  });\n  client.use(authMiddleware(config.auth));\n  return client;\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["createClient"],"mappings":";;;;;;;;;AAgDO,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA,EAIzB,YAAA,EAAc,2CAAA;AAAA,EACd,IAAA,EAAM,kCAAA;AAAA,EACN,IAAA,EAAM,kCAAA;AAAA,EACN,QAAA,EAAU,sCAAA;AAAA,EACV,MAAA,EAAQ;AACV;AAMO,SAAS,eAAe,IAAA,EAAsC;AACnE,EAAA,OAAO;AAAA,IACL,MAAM,SAAA,CAAU,EAAE,OAAA,EAAQ,EAAG;AAC3B,MAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,MAAA,QAAQ,KAAK,IAAA;AAAM,QACjB,KAAK,QAAA;AACH,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACzD,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AAC3D,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,QAAA,EAAU,CAAA,WAAA,EAAc,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AACxD,UAAA;AAAA;AAEJ,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,GACF;AACF;AAQO,SAAS,UAAA,CACd,cAAA,EACA,MAAA,GAAyB,EAAC,EACV;AAChB,EAAA,MAAM,SAASA,6BAAA,CAAqB;AAAA,IAClC,OAAA,EAAS,OAAO,OAAA,IAAW,cAAA;AAAA,IAC3B,OAAO,MAAA,CAAO;AAAA,GACf,CAAA;AACD,EAAA,MAAA,CAAO,GAAA,CAAI,cAAA,CAAe,MAAA,CAAO,IAAI,CAAC,CAAA;AACtC,EAAA,OAAO,MAAA;AACT","file":"index.cjs","sourcesContent":["/**\n * Shared transport + auth plumbing used by every surface client.\n *\n * Each surface package (`@productcraft/auth`, `@productcraft/mail`,\n * ...) defines a thin class around `openapi-fetch` plus the generated\n * `paths` types from its own `_generated.d.ts`. The class delegates\n * wire I/O to `openapi-fetch`, but exposes a Stripe-style ergonomic\n * surface where callers reach for `pc.mail.messages.send(...)` rather\n * than the underlying `client.POST(\"/v1/...\")` shape.\n *\n * v0 ships only the underlying `client` (named `client` on each\n * surface) — every endpoint is reachable through it. Ergonomic\n * resource surfaces land in v0.1+ as we hand-roll them.\n */\n\nimport createClient, { type Client, type Middleware } from \"openapi-fetch\";\n\n/**\n * The auth credential the SDK presents to ProductCraft APIs.\n *\n * - `apiKey` — Platform API Key (`pcft_live_*`). Server-side only;\n *   never embed in a shipped browser bundle.\n * - `bearer` — pre-resolved JWT (e.g. an Auth app-scoped EndUser\n *   token your backend minted and shipped to the device).\n * - `cookie` — captured `auth_token` cookie value. Mostly useful in\n *   dev / E2E tests where you've already signed in.\n */\nexport type PCAuth =\n  | { type: \"apiKey\"; key: string }\n  | { type: \"bearer\"; token: string }\n  | { type: \"cookie\"; value: string };\n\nexport interface PCClientConfig {\n  auth?: PCAuth;\n  /** Override the prod base URL — useful for dev / staging. */\n  baseUrl?: string;\n  /** Custom fetch (e.g. node-fetch with retries, undici, ...). */\n  fetch?: typeof fetch;\n}\n\n/**\n * Default prod base URL per surface.\n *\n * Keys use the rebranded product names (Auth, Mail, Waitlist, Social)\n * matching the package + class names since the 2026-07 SDK rename.\n * Prior releases (`@productcraft/heimdall` 0.x etc.) exposed the same\n * hosts under the old keys (heimdall/envoi/rally/agora).\n */\nexport const PC_BASE_URL = {\n  // platformAuth is the platform identity layer (workspaces, PATs);\n  // it vacated api.auth so the customer-facing Auth product could\n  // take that host.\n  platformAuth: \"https://api.platform-auth.productcraft.co\",\n  auth: \"https://api.auth.productcraft.co\",\n  mail: \"https://api.mail.productcraft.co\",\n  waitlist: \"https://api.waitlist.productcraft.co\",\n  social: \"https://social.productcraft.co\",\n} as const;\n\n/**\n * Build an `openapi-fetch` middleware that adds the configured auth\n * credential as a header on every outbound request.\n */\nexport function authMiddleware(auth: PCAuth | undefined): Middleware {\n  return {\n    async onRequest({ request }) {\n      if (!auth) return undefined;\n      switch (auth.type) {\n        case \"apiKey\":\n          request.headers.set(\"Authorization\", `Bearer ${auth.key}`);\n          break;\n        case \"bearer\":\n          request.headers.set(\"Authorization\", `Bearer ${auth.token}`);\n          break;\n        case \"cookie\":\n          request.headers.set(\"Cookie\", `auth_token=${auth.value}`);\n          break;\n      }\n      return request;\n    },\n  };\n}\n\n/**\n * Construct an `openapi-fetch` client for a surface. Each surface\n * package calls this with its own generated `paths` type and default\n * base URL. The returned client is the v0 surface — every endpoint is\n * reachable through `client.GET(...)`, `client.POST(...)`, etc.\n */\nexport function makeClient<TPaths extends object>(\n  defaultBaseUrl: string,\n  config: PCClientConfig = {},\n): Client<TPaths> {\n  const client = createClient<TPaths>({\n    baseUrl: config.baseUrl ?? defaultBaseUrl,\n    fetch: config.fetch,\n  });\n  client.use(authMiddleware(config.auth));\n  return client;\n}\n"]}

package/dist/index.d.cts

@@ -3,11 +3,11 @@ import { Middleware, Client } from 'openapi-fetch';
 /**
  * Shared transport + auth plumbing used by every surface client.
  *
- * Each surface package (`@productcraft/heimdall`, `@productcraft/envoi`,
+ * Each surface package (`@productcraft/auth`, `@productcraft/mail`,
  * ...) defines a thin class around `openapi-fetch` plus the generated
  * `paths` types from its own `_generated.d.ts`. The class delegates
  * wire I/O to `openapi-fetch`, but exposes a Stripe-style ergonomic
- * surface where callers reach for `pc.envoi.messages.send(...)` rather
+ * surface where callers reach for `pc.mail.messages.send(...)` rather
  * than the underlying `client.POST("/v1/...")` shape.
  *
  * v0 ships only the underlying `client` (named `client` on each
@@ -20,7 +20,7 @@ import { Middleware, Client } from 'openapi-fetch';
  *
  * - `apiKey` — Platform API Key (`pcft_live_*`). Server-side only;
  *   never embed in a shipped browser bundle.
- * - `bearer` — pre-resolved JWT (e.g. a Heimdall app-scoped EndUser
+ * - `bearer` — pre-resolved JWT (e.g. an Auth app-scoped EndUser
  *   token your backend minted and shipped to the device).
  * - `cookie` — captured `auth_token` cookie value. Mostly useful in
  *   dev / E2E tests where you've already signed in.
@@ -45,18 +45,17 @@ interface PCClientConfig {
 /**
  * Default prod base URL per surface.
  *
- * Pointed at the renamed services (Rally→Waitlist, Agora→Feed,
- * Heimdall→users) so the SDK targets the canonical new domains and the
- * old aliases (api.rally, agora.*, api.heimdall) can eventually retire.
- * The surface KEYS (rally/agora/heimdall) are intentionally kept until
- * the v1.0.0 public-API rename, so this stays a non-breaking retarget.
+ * Keys use the rebranded product names (Auth, Mail, Waitlist, Social)
+ * matching the package + class names since the 2026-07 SDK rename.
+ * Prior releases (`@productcraft/heimdall` 0.x etc.) exposed the same
+ * hosts under the old keys (heimdall/envoi/rally/agora).
  */
 declare const PC_BASE_URL: {
     readonly platformAuth: "https://api.platform-auth.productcraft.co";
-    readonly heimdall: "https://api.auth.productcraft.co";
-    readonly envoi: "https://api.mail.productcraft.co";
-    readonly rally: "https://api.waitlist.productcraft.co";
-    readonly agora: "https://social.productcraft.co";
+    readonly auth: "https://api.auth.productcraft.co";
+    readonly mail: "https://api.mail.productcraft.co";
+    readonly waitlist: "https://api.waitlist.productcraft.co";
+    readonly social: "https://social.productcraft.co";
 };
 /**
  * Build an `openapi-fetch` middleware that adds the configured auth

package/dist/index.d.ts

@@ -3,11 +3,11 @@ import { Middleware, Client } from 'openapi-fetch';
 /**
  * Shared transport + auth plumbing used by every surface client.
  *
- * Each surface package (`@productcraft/heimdall`, `@productcraft/envoi`,
+ * Each surface package (`@productcraft/auth`, `@productcraft/mail`,
  * ...) defines a thin class around `openapi-fetch` plus the generated
  * `paths` types from its own `_generated.d.ts`. The class delegates
  * wire I/O to `openapi-fetch`, but exposes a Stripe-style ergonomic
- * surface where callers reach for `pc.envoi.messages.send(...)` rather
+ * surface where callers reach for `pc.mail.messages.send(...)` rather
  * than the underlying `client.POST("/v1/...")` shape.
  *
  * v0 ships only the underlying `client` (named `client` on each
@@ -20,7 +20,7 @@ import { Middleware, Client } from 'openapi-fetch';
  *
  * - `apiKey` — Platform API Key (`pcft_live_*`). Server-side only;
  *   never embed in a shipped browser bundle.
- * - `bearer` — pre-resolved JWT (e.g. a Heimdall app-scoped EndUser
+ * - `bearer` — pre-resolved JWT (e.g. an Auth app-scoped EndUser
  *   token your backend minted and shipped to the device).
  * - `cookie` — captured `auth_token` cookie value. Mostly useful in
  *   dev / E2E tests where you've already signed in.
@@ -45,18 +45,17 @@ interface PCClientConfig {
 /**
  * Default prod base URL per surface.
  *
- * Pointed at the renamed services (Rally→Waitlist, Agora→Feed,
- * Heimdall→users) so the SDK targets the canonical new domains and the
- * old aliases (api.rally, agora.*, api.heimdall) can eventually retire.
- * The surface KEYS (rally/agora/heimdall) are intentionally kept until
- * the v1.0.0 public-API rename, so this stays a non-breaking retarget.
+ * Keys use the rebranded product names (Auth, Mail, Waitlist, Social)
+ * matching the package + class names since the 2026-07 SDK rename.
+ * Prior releases (`@productcraft/heimdall` 0.x etc.) exposed the same
+ * hosts under the old keys (heimdall/envoi/rally/agora).
  */
 declare const PC_BASE_URL: {
     readonly platformAuth: "https://api.platform-auth.productcraft.co";
-    readonly heimdall: "https://api.auth.productcraft.co";
-    readonly envoi: "https://api.mail.productcraft.co";
-    readonly rally: "https://api.waitlist.productcraft.co";
-    readonly agora: "https://social.productcraft.co";
+    readonly auth: "https://api.auth.productcraft.co";
+    readonly mail: "https://api.mail.productcraft.co";
+    readonly waitlist: "https://api.waitlist.productcraft.co";
+    readonly social: "https://social.productcraft.co";
 };
 /**
  * Build an `openapi-fetch` middleware that adds the configured auth

package/dist/index.js

@@ -2,15 +2,14 @@ import createClient from 'openapi-fetch';
 
 // src/index.ts
 var PC_BASE_URL = {
-  // platformAuth moved api.auth → api.platform-auth (the platform
-  // identity layer vacated api.auth so the customer-facing Auth product
-  // could take it). heimdall (the Auth product) → api.auth; agora →
-  // social.productcraft.co. Old hosts stay live as aliases.
+  // platformAuth is the platform identity layer (workspaces, PATs);
+  // it vacated api.auth so the customer-facing Auth product could
+  // take that host.
   platformAuth: "https://api.platform-auth.productcraft.co",
-  heimdall: "https://api.auth.productcraft.co",
-  envoi: "https://api.mail.productcraft.co",
-  rally: "https://api.waitlist.productcraft.co",
-  agora: "https://social.productcraft.co"
+  auth: "https://api.auth.productcraft.co",
+  mail: "https://api.mail.productcraft.co",
+  waitlist: "https://api.waitlist.productcraft.co",
+  social: "https://social.productcraft.co"
 };
 function authMiddleware(auth) {
   return {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAiDO,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzB,YAAA,EAAc,2CAAA;AAAA,EACd,QAAA,EAAU,kCAAA;AAAA,EACV,KAAA,EAAO,kCAAA;AAAA,EACP,KAAA,EAAO,sCAAA;AAAA,EACP,KAAA,EAAO;AACT;AAMO,SAAS,eAAe,IAAA,EAAsC;AACnE,EAAA,OAAO;AAAA,IACL,MAAM,SAAA,CAAU,EAAE,OAAA,EAAQ,EAAG;AAC3B,MAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,MAAA,QAAQ,KAAK,IAAA;AAAM,QACjB,KAAK,QAAA;AACH,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACzD,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AAC3D,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,QAAA,EAAU,CAAA,WAAA,EAAc,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AACxD,UAAA;AAAA;AAEJ,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,GACF;AACF;AAQO,SAAS,UAAA,CACd,cAAA,EACA,MAAA,GAAyB,EAAC,EACV;AAChB,EAAA,MAAM,SAAS,YAAA,CAAqB;AAAA,IAClC,OAAA,EAAS,OAAO,OAAA,IAAW,cAAA;AAAA,IAC3B,OAAO,MAAA,CAAO;AAAA,GACf,CAAA;AACD,EAAA,MAAA,CAAO,GAAA,CAAI,cAAA,CAAe,MAAA,CAAO,IAAI,CAAC,CAAA;AACtC,EAAA,OAAO,MAAA;AACT","file":"index.js","sourcesContent":["/**\n * Shared transport + auth plumbing used by every surface client.\n *\n * Each surface package (`@productcraft/heimdall`, `@productcraft/envoi`,\n * ...) defines a thin class around `openapi-fetch` plus the generated\n * `paths` types from its own `_generated.d.ts`. The class delegates\n * wire I/O to `openapi-fetch`, but exposes a Stripe-style ergonomic\n * surface where callers reach for `pc.envoi.messages.send(...)` rather\n * than the underlying `client.POST(\"/v1/...\")` shape.\n *\n * v0 ships only the underlying `client` (named `client` on each\n * surface) — every endpoint is reachable through it. Ergonomic\n * resource surfaces land in v0.1+ as we hand-roll them.\n */\n\nimport createClient, { type Client, type Middleware } from \"openapi-fetch\";\n\n/**\n * The auth credential the SDK presents to ProductCraft APIs.\n *\n * - `apiKey` — Platform API Key (`pcft_live_*`). Server-side only;\n *   never embed in a shipped browser bundle.\n * - `bearer` — pre-resolved JWT (e.g. a Heimdall app-scoped EndUser\n *   token your backend minted and shipped to the device).\n * - `cookie` — captured `auth_token` cookie value. Mostly useful in\n *   dev / E2E tests where you've already signed in.\n */\nexport type PCAuth =\n  | { type: \"apiKey\"; key: string }\n  | { type: \"bearer\"; token: string }\n  | { type: \"cookie\"; value: string };\n\nexport interface PCClientConfig {\n  auth?: PCAuth;\n  /** Override the prod base URL — useful for dev / staging. */\n  baseUrl?: string;\n  /** Custom fetch (e.g. node-fetch with retries, undici, ...). */\n  fetch?: typeof fetch;\n}\n\n/**\n * Default prod base URL per surface.\n *\n * Pointed at the renamed services (Rally→Waitlist, Agora→Feed,\n * Heimdall→users) so the SDK targets the canonical new domains and the\n * old aliases (api.rally, agora.*, api.heimdall) can eventually retire.\n * The surface KEYS (rally/agora/heimdall) are intentionally kept until\n * the v1.0.0 public-API rename, so this stays a non-breaking retarget.\n */\nexport const PC_BASE_URL = {\n  // platformAuth moved api.auth → api.platform-auth (the platform\n  // identity layer vacated api.auth so the customer-facing Auth product\n  // could take it). heimdall (the Auth product) → api.auth; agora →\n  // social.productcraft.co. Old hosts stay live as aliases.\n  platformAuth: \"https://api.platform-auth.productcraft.co\",\n  heimdall: \"https://api.auth.productcraft.co\",\n  envoi: \"https://api.mail.productcraft.co\",\n  rally: \"https://api.waitlist.productcraft.co\",\n  agora: \"https://social.productcraft.co\",\n} as const;\n\n/**\n * Build an `openapi-fetch` middleware that adds the configured auth\n * credential as a header on every outbound request.\n */\nexport function authMiddleware(auth: PCAuth | undefined): Middleware {\n  return {\n    async onRequest({ request }) {\n      if (!auth) return undefined;\n      switch (auth.type) {\n        case \"apiKey\":\n          request.headers.set(\"Authorization\", `Bearer ${auth.key}`);\n          break;\n        case \"bearer\":\n          request.headers.set(\"Authorization\", `Bearer ${auth.token}`);\n          break;\n        case \"cookie\":\n          request.headers.set(\"Cookie\", `auth_token=${auth.value}`);\n          break;\n      }\n      return request;\n    },\n  };\n}\n\n/**\n * Construct an `openapi-fetch` client for a surface. Each surface\n * package calls this with its own generated `paths` type and default\n * base URL. The returned client is the v0 surface — every endpoint is\n * reachable through `client.GET(...)`, `client.POST(...)`, etc.\n */\nexport function makeClient<TPaths extends object>(\n  defaultBaseUrl: string,\n  config: PCClientConfig = {},\n): Client<TPaths> {\n  const client = createClient<TPaths>({\n    baseUrl: config.baseUrl ?? defaultBaseUrl,\n    fetch: config.fetch,\n  });\n  client.use(authMiddleware(config.auth));\n  return client;\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAgDO,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA,EAIzB,YAAA,EAAc,2CAAA;AAAA,EACd,IAAA,EAAM,kCAAA;AAAA,EACN,IAAA,EAAM,kCAAA;AAAA,EACN,QAAA,EAAU,sCAAA;AAAA,EACV,MAAA,EAAQ;AACV;AAMO,SAAS,eAAe,IAAA,EAAsC;AACnE,EAAA,OAAO;AAAA,IACL,MAAM,SAAA,CAAU,EAAE,OAAA,EAAQ,EAAG;AAC3B,MAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,MAAA,QAAQ,KAAK,IAAA;AAAM,QACjB,KAAK,QAAA;AACH,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACzD,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AAC3D,UAAA;AAAA,QACF,KAAK,QAAA;AACH,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,QAAA,EAAU,CAAA,WAAA,EAAc,IAAA,CAAK,KAAK,CAAA,CAAE,CAAA;AACxD,UAAA;AAAA;AAEJ,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,GACF;AACF;AAQO,SAAS,UAAA,CACd,cAAA,EACA,MAAA,GAAyB,EAAC,EACV;AAChB,EAAA,MAAM,SAAS,YAAA,CAAqB;AAAA,IAClC,OAAA,EAAS,OAAO,OAAA,IAAW,cAAA;AAAA,IAC3B,OAAO,MAAA,CAAO;AAAA,GACf,CAAA;AACD,EAAA,MAAA,CAAO,GAAA,CAAI,cAAA,CAAe,MAAA,CAAO,IAAI,CAAC,CAAA;AACtC,EAAA,OAAO,MAAA;AACT","file":"index.js","sourcesContent":["/**\n * Shared transport + auth plumbing used by every surface client.\n *\n * Each surface package (`@productcraft/auth`, `@productcraft/mail`,\n * ...) defines a thin class around `openapi-fetch` plus the generated\n * `paths` types from its own `_generated.d.ts`. The class delegates\n * wire I/O to `openapi-fetch`, but exposes a Stripe-style ergonomic\n * surface where callers reach for `pc.mail.messages.send(...)` rather\n * than the underlying `client.POST(\"/v1/...\")` shape.\n *\n * v0 ships only the underlying `client` (named `client` on each\n * surface) — every endpoint is reachable through it. Ergonomic\n * resource surfaces land in v0.1+ as we hand-roll them.\n */\n\nimport createClient, { type Client, type Middleware } from \"openapi-fetch\";\n\n/**\n * The auth credential the SDK presents to ProductCraft APIs.\n *\n * - `apiKey` — Platform API Key (`pcft_live_*`). Server-side only;\n *   never embed in a shipped browser bundle.\n * - `bearer` — pre-resolved JWT (e.g. an Auth app-scoped EndUser\n *   token your backend minted and shipped to the device).\n * - `cookie` — captured `auth_token` cookie value. Mostly useful in\n *   dev / E2E tests where you've already signed in.\n */\nexport type PCAuth =\n  | { type: \"apiKey\"; key: string }\n  | { type: \"bearer\"; token: string }\n  | { type: \"cookie\"; value: string };\n\nexport interface PCClientConfig {\n  auth?: PCAuth;\n  /** Override the prod base URL — useful for dev / staging. */\n  baseUrl?: string;\n  /** Custom fetch (e.g. node-fetch with retries, undici, ...). */\n  fetch?: typeof fetch;\n}\n\n/**\n * Default prod base URL per surface.\n *\n * Keys use the rebranded product names (Auth, Mail, Waitlist, Social)\n * matching the package + class names since the 2026-07 SDK rename.\n * Prior releases (`@productcraft/heimdall` 0.x etc.) exposed the same\n * hosts under the old keys (heimdall/envoi/rally/agora).\n */\nexport const PC_BASE_URL = {\n  // platformAuth is the platform identity layer (workspaces, PATs);\n  // it vacated api.auth so the customer-facing Auth product could\n  // take that host.\n  platformAuth: \"https://api.platform-auth.productcraft.co\",\n  auth: \"https://api.auth.productcraft.co\",\n  mail: \"https://api.mail.productcraft.co\",\n  waitlist: \"https://api.waitlist.productcraft.co\",\n  social: \"https://social.productcraft.co\",\n} as const;\n\n/**\n * Build an `openapi-fetch` middleware that adds the configured auth\n * credential as a header on every outbound request.\n */\nexport function authMiddleware(auth: PCAuth | undefined): Middleware {\n  return {\n    async onRequest({ request }) {\n      if (!auth) return undefined;\n      switch (auth.type) {\n        case \"apiKey\":\n          request.headers.set(\"Authorization\", `Bearer ${auth.key}`);\n          break;\n        case \"bearer\":\n          request.headers.set(\"Authorization\", `Bearer ${auth.token}`);\n          break;\n        case \"cookie\":\n          request.headers.set(\"Cookie\", `auth_token=${auth.value}`);\n          break;\n      }\n      return request;\n    },\n  };\n}\n\n/**\n * Construct an `openapi-fetch` client for a surface. Each surface\n * package calls this with its own generated `paths` type and default\n * base URL. The returned client is the v0 surface — every endpoint is\n * reachable through `client.GET(...)`, `client.POST(...)`, etc.\n */\nexport function makeClient<TPaths extends object>(\n  defaultBaseUrl: string,\n  config: PCClientConfig = {},\n): Client<TPaths> {\n  const client = createClient<TPaths>({\n    baseUrl: config.baseUrl ?? defaultBaseUrl,\n    fetch: config.fetch,\n  });\n  client.use(authMiddleware(config.auth));\n  return client;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@productcraft/core",
-  "version": "0.0.5",
+  "version": "0.1.0",
   "description": "Shared transport, auth, and config primitives for the ProductCraft SDKs. Depended on by every per-surface package.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -34,8 +34,7 @@
   },
   "homepage": "https://github.com/clauderanelagh/productcraft-node/tree/main/packages/core",
   "publishConfig": {
-    "access": "public",
-    "provenance": true
+    "access": "public"
   },
   "dependencies": {
     "openapi-fetch": "^0.13.0"