@seliseblocks/client 0.1.1 → 0.1.2

package/AI_USAGE_GUIDE.md

@@ -1,149 +1,149 @@
-# AI Usage Guide
-
-Use this file only for `@seliseblocks/client` app-code work. For full method details, read the source docstrings.
-
-Source refs:
-
-- Client setup: `src/client.ts`
-- Auth: `src/auth/auth-client.ts`
-- IAM: `src/iam/iam-client.ts`
-- Data: `src/data/data-client.ts`
-- Localization: `src/localization/localization-client.ts`
-- HTTP/errors: `src/http/http-client.ts`, `src/http/errors.ts`
-
-## Non-Negotiable Rules
-
-- Configure `xBlocksKey`; SDK sends it as `x-blocks-key`.
-- Do not send `ProjectKey` or `projectKey`.
-- Do not add `/api` after `/v4`.
-- Valid route shapes: `/iam/v4/...`, `/data/v4/...`, `/localization/v4/...`.
-- SDK does not store tokens. App owns access token, refresh token, storage, and logout cleanup.
-- Frontend code must not contain client secrets.
-- Do not add impersonation, release deploy, schema/rules mutation, or localization authoring/admin APIs.
-
-## Create Client
-
-```ts
-import { createBlocksClient } from "@seliseblocks/client";
-
-export const blocks = createBlocksClient({
-  apiUrl: "https://api.seliseblocks.com",
-  xBlocksKey: env.BLOCKS_KEY,
-  accessToken: () => session.accessToken,
-  oidc: {
-    url: "https://iam.seliseblocks.com",
-    clientId: env.OIDC_CLIENT_ID,
-    redirectUri: env.OIDC_REDIRECT_URI ?? `${window.location.origin}/login/callback`
-  }
-});
-```
-
-Use `accessToken` only for the current token resolver. Do not add SDK token storage.
-Use a configured `redirectUri` when available; the current-origin `/login/callback` URL is only a browser fallback.
-
-## Auth Decision
-
-There are two auth flows.
-
-OIDC/hosted IAM flow:
-
-- Login: `blocks.auth.idp.initiate()`, `blocks.auth.idp.redirectToProvider()`, `blocks.auth.idp.callback(...)`
-- Refresh: `blocks.auth.oidc.refreshToken({ refreshToken })`
-- Refresh route: `POST /iam/v4/oidc/token`
-- Must send `client_id`; SDK uses `request.clientId` or configured `oidc.clientId`.
-- Do not manually build `oidc/authorize`.
-
-Embedded/app-owned flow:
-
-- Login: `blocks.auth.login(...)`
-- Social: `blocks.auth.socialInitiate(...)`, `blocks.auth.socialCallback(...)`
-- Refresh: `blocks.auth.refresh({ refreshToken })`
-- Routes: `/iam/v4/auth/login`, `/iam/v4/auth/social/*`, `/iam/v4/auth/refresh`
-
-Shared auth methods for both flows:
-
-- `userInfo()`
-- `switchOrganization(...)`
-- `logout(...)`, `logoutAll(...)`
-- `signup(...)`, `recover(...)`, `resetPassword(...)`
-- `changePassword(...)`
-- `activate(...)`, `resendActivation(...)`, `validateActivation(...)`
-- `identityProviders.*`, `config.*`, `userCodes.*`, `clientCredentials.*` when app has permission
-
-## Service Map
-
-IAM:
-
-- `blocks.iam.me()`
-- `blocks.iam.users.*`
-- `blocks.iam.roles.*`
-- `blocks.iam.permissions.*`
-- `blocks.iam.resources.*`
-- `blocks.iam.organizations.*`
-- `blocks.iam.signup.*`
-
-Data:
-
-- `blocks.data.schemas.*` for schema reads only
-- `blocks.data.validations.*` for validation reads
-- `blocks.data.collection("Name").list/get/create/update/delete`
-- `blocks.data.graphql(...)`
-- `blocks.data.files.*` for file/storage helpers
-- `blocks.data.dms.*` for DMS file/folder helpers
-- `blocks.data.utilities.*` for runtime utility helpers
-
-Localization:
-
-- `blocks.localization.languages()`
-- `blocks.localization.modules()`
-- `blocks.localization.languagesForCurrentTenant()`
-- `blocks.localization.modulesForCurrentTenant()`
-- `blocks.localization.translations(moduleName, language)`
-- `blocks.localization.load(language, modules)`
-- `blocks.localization.cloudTranslations(moduleName, language)`
-- `blocks.localization.loadCloud(language, modules)`
-- `blocks.localization.keysByNames(...)`
-- `blocks.localization.t(key, fallback, options)`
-
-HTTP fallback:
-
-- Use `blocks.http.request("/service/v4/...")` only when no typed method exists.
-- Use `blocks.http.external(url, ...)` only for external URLs such as pre-signed uploads.
-
-## Minimal Examples
-
-```ts
-const me = await blocks.iam.me();
-const schemas = await blocks.data.schemas.list({ pageNo: 1, pageSize: 20 });
-const rows = await blocks.data.collection("Students").list({ pageNo: 1, pageSize: 20 });
-await blocks.localization.load("en-US", ["common"]);
-const label = blocks.localization.t("save", "Save");
-```
-
-OIDC refresh with explicit client id:
-
-```ts
-await blocks.auth.oidc.refreshToken({
-  clientId: env.OIDC_CLIENT_ID,
-  refreshToken: session.refreshToken
-});
-```
-
-Embedded refresh:
-
-```ts
-await blocks.auth.refresh({
-  refreshToken: session.refreshToken
-});
-```
-
-## Check Before Finishing
-
-```bash
-npm test
-npm run lint
-npm pack --dry-run
-rg -n "v4[/\\]api|iam[/\\]v4[/\\]api|data[/\\]v4[/\\]api|localization[/\\]v4[/\\]api" src README.md AI_USAGE_GUIDE.md test
-```
-
-Only negative route-guard tests should match.
+# AI Usage Guide
+
+Use this file only for `@seliseblocks/client` app-code work. For full method details, read the source docstrings.
+
+Source refs:
+
+- Client setup: `src/client.ts`
+- Auth: `src/auth/auth-client.ts`
+- IAM: `src/iam/iam-client.ts`
+- Data: `src/data/data-client.ts`
+- Localization: `src/localization/localization-client.ts`
+- HTTP/errors: `src/http/http-client.ts`, `src/http/errors.ts`
+
+## Non-Negotiable Rules
+
+- Configure `xBlocksKey`; SDK sends it as `x-blocks-key`.
+- Do not send `ProjectKey` or `projectKey`.
+- Do not add `/api` after `/v4`.
+- Valid route shapes: `/iam/v4/...`, `/data/v4/...`, `/localization/v4/...`.
+- SDK does not store tokens. App owns access token, refresh token, storage, and logout cleanup.
+- Frontend code must not contain client secrets.
+- Do not add impersonation, release deploy, schema/rules mutation, or localization authoring/admin APIs.
+
+## Create Client
+
+```ts
+import { createBlocksClient } from "@seliseblocks/client";
+
+export const blocks = createBlocksClient({
+  apiUrl: "https://api.seliseblocks.com",
+  xBlocksKey: env.BLOCKS_KEY,
+  accessToken: () => session.accessToken,
+  oidc: {
+    url: "https://iam.seliseblocks.com",
+    clientId: env.OIDC_CLIENT_ID,
+    redirectUri: env.OIDC_REDIRECT_URI ?? `${window.location.origin}/login/callback`
+  }
+});
+```
+
+Use `accessToken` only for the current token resolver. Do not add SDK token storage.
+Use a configured `redirectUri` when available; the current-origin `/login/callback` URL is only a browser fallback.
+
+## Auth Decision
+
+There are two auth flows.
+
+OIDC/hosted IAM flow:
+
+- Login: `blocks.auth.idp.initiate()`, `blocks.auth.idp.redirectToProvider()`, `blocks.auth.idp.callback(...)`
+- Refresh: `blocks.auth.oidc.refreshToken({ refreshToken })`
+- Refresh route: `POST /iam/v4/oidc/token`
+- Must send `client_id`; SDK uses `request.clientId` or configured `oidc.clientId`.
+- Do not manually build `oidc/authorize`.
+
+Embedded/app-owned flow:
+
+- Login: `blocks.auth.login(...)`
+- Social: `blocks.auth.socialInitiate(...)`, `blocks.auth.socialCallback(...)`
+- Refresh: `blocks.auth.refresh({ refreshToken })`
+- Routes: `/iam/v4/auth/login`, `/iam/v4/auth/social/*`, `/iam/v4/auth/refresh`
+
+Shared auth methods for both flows:
+
+- `userInfo()`
+- `switchOrganization(...)`
+- `logout(...)`, `logoutAll(...)`
+- `signup(...)`, `recover(...)`, `resetPassword(...)`
+- `changePassword(...)`
+- `activate(...)`, `resendActivation(...)`, `validateActivation(...)`
+- `identityProviders.*`, `config.*`, `userCodes.*`, `clientCredentials.*` when app has permission
+
+## Service Map
+
+IAM:
+
+- `blocks.iam.me()`
+- `blocks.iam.users.*`
+- `blocks.iam.roles.*`
+- `blocks.iam.permissions.*`
+- `blocks.iam.resources.*`
+- `blocks.iam.organizations.*`
+- `blocks.iam.signup.*`
+
+Data:
+
+- `blocks.data.schemas.*` for schema reads only
+- `blocks.data.validations.*` for validation reads
+- `blocks.data.collection("Name").list/get/create/update/delete`
+- `blocks.data.graphql(...)`
+- `blocks.data.files.*` for file/storage helpers
+- `blocks.data.dms.*` for DMS file/folder helpers
+- `blocks.data.utilities.*` for runtime utility helpers
+
+Localization:
+
+- `blocks.localization.languages()`
+- `blocks.localization.modules()`
+- `blocks.localization.languagesForCurrentTenant()`
+- `blocks.localization.modulesForCurrentTenant()`
+- `blocks.localization.translations(moduleName, language)`
+- `blocks.localization.load(language, modules)`
+- `blocks.localization.cloudTranslations(moduleName, language)`
+- `blocks.localization.loadCloud(language, modules)`
+- `blocks.localization.keysByNames(...)`
+- `blocks.localization.t(key, fallback, options)`
+
+HTTP fallback:
+
+- Use `blocks.http.request("/service/v4/...")` only when no typed method exists.
+- Use `blocks.http.external(url, ...)` only for external URLs such as pre-signed uploads.
+
+## Minimal Examples
+
+```ts
+const me = await blocks.iam.me();
+const schemas = await blocks.data.schemas.list({ pageNo: 1, pageSize: 20 });
+const rows = await blocks.data.collection("Students").list({ pageNo: 1, pageSize: 20 });
+await blocks.localization.load("en-US", ["common"]);
+const label = blocks.localization.t("save", "Save");
+```
+
+OIDC refresh with explicit client id:
+
+```ts
+await blocks.auth.oidc.refreshToken({
+  clientId: env.OIDC_CLIENT_ID,
+  refreshToken: session.refreshToken
+});
+```
+
+Embedded refresh:
+
+```ts
+await blocks.auth.refresh({
+  refreshToken: session.refreshToken
+});
+```
+
+## Check Before Finishing
+
+```bash
+npm test
+npm run lint
+npm pack --dry-run
+rg -n "v4[/\\]api|iam[/\\]v4[/\\]api|data[/\\]v4[/\\]api|localization[/\\]v4[/\\]api" src README.md AI_USAGE_GUIDE.md test
+```
+
+Only negative route-guard tests should match.

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) SELISE Blocks
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) SELISE Blocks
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,161 +1,161 @@
-# Blocks Client
-
-Framework-neutral TypeScript SDK for SELISE Blocks frontend and app-runtime code.
-
-`@seliseblocks/client` gives consumer apps a small, typed wrapper around the Blocks APIs they normally call at runtime: Auth/IAM, Data, Localization, and shared HTTP configuration. Detailed `what / why / how` descriptions are kept on the SDK functions themselves so editors and generated typings show the guidance where developers use the API.
-
-Admin/control-plane work belongs in `@seliseblocks/cli-os`: project setup, schema/rules deploy, release deploy, and AI/admin terminal workflows.
-
-For AI agents and automation, see [AI_USAGE_GUIDE.md](AI_USAGE_GUIDE.md).
-
-## Install
-
-```bash
-npm install @seliseblocks/client
-```
-
-Requires Node.js 20+ or a browser/runtime with `fetch`.
-
-## Create A Client
-
-```ts
-import { createBlocksClient } from "@seliseblocks/client";
-
-const blocks = createBlocksClient({
-  apiUrl: "https://api.seliseblocks.com",
-  xBlocksKey: "<blocks-key>",
-  accessToken: () => currentUserSession?.accessToken,
-  oidc: {
-    url: "https://iam.seliseblocks.com",
-    clientId: "<public-browser-client-id>",
-    redirectUri: configuredRedirectUri ?? `${window.location.origin}/login/callback`
-  }
-});
-```
-
-`xBlocksKey` is always sent as the `x-blocks-key` header. Do not send `ProjectKey` or `projectKey` in request query/body payloads.
-
-The SDK does not store tokens. Your app owns login state, refresh scheduling, storage, and logout cleanup.
-
-Use a configured OIDC redirect URI when your app has one. The current-origin `/login/callback` URL is only a browser fallback.
-
-## Auth
-
-Auth has two login flows.
-
-OIDC/hosted IAM login uses `auth.idp`. The SDK relies on Blocks IAM `IdpController`, sends the configured public `clientId`, and does not manually build `oidc/authorize` URLs. Refresh OIDC sessions with `auth.oidc.refreshToken()`, which calls `/iam/v4/oidc/token` and sends `client_id`.
-
-```ts
-await blocks.auth.idp.redirectToProvider();
-
-const result = await blocks.auth.idp.callback(window.location.href);
-
-const refreshed = await blocks.auth.oidc.refreshToken({
-  refreshToken: result.refresh_token,
-  clientId: "<public-browser-client-id>"
-});
-```
-
-Embedded/app-owned login UI uses AuthController methods directly on `auth`: `auth.login()`, `auth.socialInitiate()`, `auth.socialCallback()`, and `auth.refresh()`.
-
-```ts
-const login = await blocks.auth.login({
-  username: "user@example.com",
-  password: "password"
-});
-
-const refreshed = await blocks.auth.refresh({
-  refreshToken: login.refresh_token
-});
-```
-
-Other auth APIs, such as user info, organization switch, logout, signup, recovery, activation, auth config, user codes, client credentials, and identity providers, can be used by either flow when the app has the required token/permission.
-
-`auth.oidc.clientCredentials()` is for trusted non-browser runtimes only because it requires a client secret.
-
-## Common Runtime Calls
-
-```ts
-const me = await blocks.iam.me();
-const orgs = await blocks.iam.organizations.my();
-const features = await blocks.iam.resources.features();
-```
-
-```ts
-const schemas = await blocks.data.schemas.list();
-const schemaInfo = await blocks.data.schemas.infoByName("Student");
-const schemaRules = await blocks.data.validations.bySchemaId("schema-id");
-
-const students = blocks.data.collection("Students");
-const rows = await students.list({ pageNo: 1, pageSize: 20 });
-await students.create({ firstName: "Test" });
-
-const graph = await blocks.data.graphql({
-  query: "{ students { items { itemId firstName } } }"
-});
-```
-
-```ts
-const upload = await blocks.data.files.presignedUploadUrl({
-  name: "avatar.png",
-  configurationName: "default",
-  parentDirectoryId: "root",
-  accessModifier: "Private"
-});
-
-await blocks.data.files.uploadToUrl({
-  url: upload.uploadUrl,
-  body: file,
-  contentType: file.type
-});
-
-const items = await blocks.data.dms.list({
-  configurationName: "default",
-  parentId: "root",
-  skip: 0,
-  take: 20
-});
-```
-
-```ts
-await blocks.localization.load("en-US", ["common", "dashboard"]);
-const label = blocks.localization.t("dashboard.title", "Dashboard");
-
-const tenantLanguages = await blocks.localization.languagesForCurrentTenant();
-const selectedKeys = await blocks.localization.keysByNames({
-  keyNames: ["dashboard.title"]
-});
-```
-
-## API Surface
-
-- `blocks.auth`: AuthController login, social login, refresh, org switch, logout, signup, recovery, activation, auth config, user codes, client credentials, identity providers.
-- `blocks.auth.idp`: hosted IdP initiate, browser redirect, callback, UI config.
-- `blocks.auth.oidc`: refresh-token and client-credentials token endpoint helpers.
-- `blocks.iam`: current user, users, roles, permissions, resources, organizations, signup settings.
-- `blocks.data`: schema reads, validation reads, GraphQL gateway execution, file/storage helpers, DMS file/folder helpers, runtime collection CRUD.
-- `blocks.localization`: tenant language/module discovery, UILM dictionary loading, selected key lookup, simple `t()` lookup.
-
-Professional class names are exported for advanced typing and adapters: `BlocksAuthenticationClient`, `BlocksIAMClient`, `BlocksDataClient`, and `BlocksLocalizationClient`.
-
-## Boundaries
-
-This package must not contain:
-
-- CLI client secrets
-- impersonation APIs
-- project create/list/use
-- schema/rules deploy
-- release deploy
-- token/session/PKCE storage
-- Node filesystem or OS credential storage
-- framework UI components
-- Localization authoring/admin endpoints
-- Data schema/rules mutation endpoints
-
-## Package Checks
-
-```bash
-npm test
-npm pack --dry-run
-```
+# Blocks Client
+
+Framework-neutral TypeScript SDK for SELISE Blocks frontend and app-runtime code.
+
+`@seliseblocks/client` gives consumer apps a small, typed wrapper around the Blocks APIs they normally call at runtime: Auth/IAM, Data, Localization, and shared HTTP configuration. Detailed `what / why / how` descriptions are kept on the SDK functions themselves so editors and generated typings show the guidance where developers use the API.
+
+Admin/control-plane work belongs in `@seliseblocks/cli-os`: project setup, schema/rules deploy, release deploy, and AI/admin terminal workflows.
+
+For AI agents and automation, see [AI_USAGE_GUIDE.md](AI_USAGE_GUIDE.md).
+
+## Install
+
+```bash
+npm install @seliseblocks/client
+```
+
+Requires Node.js 20+ or a browser/runtime with `fetch`.
+
+## Create A Client
+
+```ts
+import { createBlocksClient } from "@seliseblocks/client";
+
+const blocks = createBlocksClient({
+  apiUrl: "https://api.seliseblocks.com",
+  xBlocksKey: "<blocks-key>",
+  accessToken: () => currentUserSession?.accessToken,
+  oidc: {
+    url: "https://iam.seliseblocks.com",
+    clientId: "<public-browser-client-id>",
+    redirectUri: configuredRedirectUri ?? `${window.location.origin}/login/callback`
+  }
+});
+```
+
+`xBlocksKey` is always sent as the `x-blocks-key` header. Do not send `ProjectKey` or `projectKey` in request query/body payloads.
+
+The SDK does not store tokens. Your app owns login state, refresh scheduling, storage, and logout cleanup.
+
+Use a configured OIDC redirect URI when your app has one. The current-origin `/login/callback` URL is only a browser fallback.
+
+## Auth
+
+Auth has two login flows.
+
+OIDC/hosted IAM login uses `auth.idp`. The SDK relies on Blocks IAM `IdpController`, sends the configured public `clientId`, and does not manually build `oidc/authorize` URLs. Refresh OIDC sessions with `auth.oidc.refreshToken()`, which calls `/iam/v4/oidc/token` and sends `client_id`.
+
+```ts
+await blocks.auth.idp.redirectToProvider();
+
+const result = await blocks.auth.idp.callback(window.location.href);
+
+const refreshed = await blocks.auth.oidc.refreshToken({
+  refreshToken: result.refresh_token,
+  clientId: "<public-browser-client-id>"
+});
+```
+
+Embedded/app-owned login UI uses AuthController methods directly on `auth`: `auth.login()`, `auth.socialInitiate()`, `auth.socialCallback()`, and `auth.refresh()`.
+
+```ts
+const login = await blocks.auth.login({
+  username: "user@example.com",
+  password: "password"
+});
+
+const refreshed = await blocks.auth.refresh({
+  refreshToken: login.refresh_token
+});
+```
+
+Other auth APIs, such as user info, organization switch, logout, signup, recovery, activation, auth config, user codes, client credentials, and identity providers, can be used by either flow when the app has the required token/permission.
+
+`auth.oidc.clientCredentials()` is for trusted non-browser runtimes only because it requires a client secret.
+
+## Common Runtime Calls
+
+```ts
+const me = await blocks.iam.me();
+const orgs = await blocks.iam.organizations.my();
+const features = await blocks.iam.resources.features();
+```
+
+```ts
+const schemas = await blocks.data.schemas.list();
+const schemaInfo = await blocks.data.schemas.infoByName("Student");
+const schemaRules = await blocks.data.validations.bySchemaId("schema-id");
+
+const students = blocks.data.collection("Students");
+const rows = await students.list({ pageNo: 1, pageSize: 20 });
+await students.create({ firstName: "Test" });
+
+const graph = await blocks.data.graphql({
+  query: "{ students { items { itemId firstName } } }"
+});
+```
+
+```ts
+const upload = await blocks.data.files.presignedUploadUrl({
+  name: "avatar.png",
+  configurationName: "default",
+  parentDirectoryId: "root",
+  accessModifier: "Private"
+});
+
+await blocks.data.files.uploadToUrl({
+  url: upload.uploadUrl,
+  body: file,
+  contentType: file.type
+});
+
+const items = await blocks.data.dms.list({
+  configurationName: "default",
+  parentId: "root",
+  skip: 0,
+  take: 20
+});
+```
+
+```ts
+await blocks.localization.load("en-US", ["common", "dashboard"]);
+const label = blocks.localization.t("dashboard.title", "Dashboard");
+
+const tenantLanguages = await blocks.localization.languagesForCurrentTenant();
+const selectedKeys = await blocks.localization.keysByNames({
+  keyNames: ["dashboard.title"]
+});
+```
+
+## API Surface
+
+- `blocks.auth`: AuthController login, social login, refresh, org switch, logout, signup, recovery, activation, auth config, user codes, client credentials, identity providers.
+- `blocks.auth.idp`: hosted IdP initiate, browser redirect, callback, UI config.
+- `blocks.auth.oidc`: refresh-token and client-credentials token endpoint helpers.
+- `blocks.iam`: current user, users, roles, permissions, resources, organizations, signup settings.
+- `blocks.data`: schema reads, validation reads, GraphQL gateway execution, file/storage helpers, DMS file/folder helpers, runtime collection CRUD.
+- `blocks.localization`: tenant language/module discovery, UILM dictionary loading, selected key lookup, simple `t()` lookup.
+
+Professional class names are exported for advanced typing and adapters: `BlocksAuthenticationClient`, `BlocksIAMClient`, `BlocksDataClient`, and `BlocksLocalizationClient`.
+
+## Boundaries
+
+This package must not contain:
+
+- CLI client secrets
+- impersonation APIs
+- project create/list/use
+- schema/rules deploy
+- release deploy
+- token/session/PKCE storage
+- Node filesystem or OS credential storage
+- framework UI components
+- Localization authoring/admin endpoints
+- Data schema/rules mutation endpoints
+
+## Package Checks
+
+```bash
+npm test
+npm pack --dry-run
+```

package/dist/client.d.ts

@@ -3,6 +3,7 @@ import { BlocksDataClient } from "./data/data-client.js";
 import { BlocksHttpClient } from "./http/http-client.js";
 import { BlocksIAMClient } from "./iam/iam-client.js";
 import { BlocksLocalizationClient } from "./localization/localization-client.js";
+import { BlocksMfaClient } from "./mfa/mfa-client.js";
 export type BlocksOidcConfig = {
     /**
      * Public browser OIDC client id used by Blocks IAM IdpController and refresh-token calls.
@@ -55,6 +56,7 @@ export type BlocksClient = {
     http: BlocksHttpClient;
     iam: BlocksIAMClient;
     localization: BlocksLocalizationClient;
+    mfa: BlocksMfaClient;
 };
 export type RequiredConfig = {
     accessToken?: string | (() => Promise<string | undefined> | string | undefined);

package/dist/client.js

@@ -3,6 +3,7 @@ import { BlocksDataClient } from "./data/data-client.js";
 import { BlocksHttpClient } from "./http/http-client.js";
 import { BlocksIAMClient } from "./iam/iam-client.js";
 import { BlocksLocalizationClient } from "./localization/localization-client.js";
+import { BlocksMfaClient } from "./mfa/mfa-client.js";
 /**
  * What: creates a framework-neutral Blocks SDK instance for one tenant/app runtime.
  * Why: frontend code needs a single configured entry point for IAM, Auth, Data, and Localization APIs.
@@ -18,7 +19,8 @@ export function createBlocksClient(config) {
         data: new BlocksDataClient(http),
         http,
         iam: new BlocksIAMClient(http),
-        localization: new BlocksLocalizationClient(http)
+        localization: new BlocksLocalizationClient(http),
+        mfa: new BlocksMfaClient(http)
     };
 }
 function normalizeConfig(config) {

package/dist/data/data-client.d.ts

@@ -85,7 +85,7 @@ export declare class BlocksDataClient {
          */
         delete: (request: BlocksFileDeleteRequest) => Promise<unknown>;
         /**
-         * What: updates file additional properties through `POST /data/v4/Files/updateFileAdditionalInfo`.
+         * What: updates file additional properties through `POST /data/v4/Files/UpdateFileAdditionalInfo`.
          * Why: apps often need to attach searchable metadata such as agent status or business references to a file.
          * How: pass `itemId` and `additionalProperties`; the SDK forwards the request as-is except for not adding project fields.
          */

package/dist/data/data-client.js

@@ -124,11 +124,11 @@ export class BlocksDataClient {
             body: withoutProjectKey(request)
         }),
         /**
-         * What: updates file additional properties through `POST /data/v4/Files/updateFileAdditionalInfo`.
+         * What: updates file additional properties through `POST /data/v4/Files/UpdateFileAdditionalInfo`.
          * Why: apps often need to attach searchable metadata such as agent status or business references to a file.
          * How: pass `itemId` and `additionalProperties`; the SDK forwards the request as-is except for not adding project fields.
          */
-        updateAdditionalInfo: (request) => this.http.request(`${DATA_API}/Files/updateFileAdditionalInfo`, {
+        updateAdditionalInfo: (request) => this.http.request(`${DATA_API}/Files/UpdateFileAdditionalInfo`, {
             body: withoutProjectKey(request)
         }),
         /**
@@ -258,13 +258,13 @@ export class BlocksDataClient {
              */
             create: (payload) => this.graphql({
                 operationName: createField,
-                query: `mutation ${createField}($input: ${schemaName}InsertInput!) {
-  ${createField}(input: $input) {
-    acknowledged
-    itemId
-    message
-    totalImpactedData
-  }
+                query: `mutation ${createField}($input: ${schemaName}InsertInput!) {
+  ${createField}(input: $input) {
+    acknowledged
+    itemId
+    message
+    totalImpactedData
+  }
 }`,
                 variables: { input: payload }
             }),
@@ -275,13 +275,13 @@ export class BlocksDataClient {
              */
             delete: (itemId, deleteOptions = {}) => this.graphql({
                 operationName: deleteField,
-                query: `mutation ${deleteField}($filter: String, $input: ${schemaName}DeleteInput!) {
-  ${deleteField}(filter: $filter, input: $input) {
-    acknowledged
-    itemId
-    message
-    totalImpactedData
-  }
+                query: `mutation ${deleteField}($filter: String, $input: ${schemaName}DeleteInput!) {
+  ${deleteField}(filter: $filter, input: $input) {
+    acknowledged
+    itemId
+    message
+    totalImpactedData
+  }
 }`,
                 variables: {
                     filter: itemIdFilter(itemId),
@@ -323,13 +323,13 @@ export class BlocksDataClient {
              */
             update: (itemId, payload) => this.graphql({
                 operationName: updateField,
-                query: `mutation ${updateField}($filter: String, $input: ${schemaName}UpdateInput!) {
-  ${updateField}(filter: $filter, input: $input) {
-    acknowledged
-    itemId
-    message
-    totalImpactedData
-  }
+                query: `mutation ${updateField}($filter: String, $input: ${schemaName}UpdateInput!) {
+  ${updateField}(filter: $filter, input: $input) {
+    acknowledged
+    itemId
+    message
+    totalImpactedData
+  }
 }`,
                 variables: {
                     filter: itemIdFilter(itemId),
@@ -441,18 +441,18 @@ function dynamicQueryInput(options) {
     };
 }
 function collectionListQuery(fieldName, selection) {
-    return `query ${fieldName}($input: DynamicQueryInput) {
-  ${fieldName}(input: $input) {
-    items {
-${indent(selection, 6)}
-    }
-    totalCount
-    pageNo
-    pageSize
-    totalPages
-    hasNextPage
-    hasPreviousPage
-  }
+    return `query ${fieldName}($input: DynamicQueryInput) {
+  ${fieldName}(input: $input) {
+    items {
+${indent(selection, 6)}
+    }
+    totalCount
+    pageNo
+    pageSize
+    totalPages
+    hasNextPage
+    hasPreviousPage
+  }
 }`;
 }
 function selectionFor(fields) {

package/dist/index.d.ts

@@ -5,8 +5,10 @@ export type { BlocksClient, BlocksClientConfig, BlocksOidcConfig } from "./clien
 export { BlocksApiError } from "./http/errors.js";
 export { BlocksIAMClient } from "./iam/iam-client.js";
 export { BlocksLocalizationClient } from "./localization/localization-client.js";
+export { BlocksMfaClient } from "./mfa/mfa-client.js";
 export type { BlocksAuthPassThroughResponse, BlocksAuthResponse, BlocksClientCredentialsRequest, BlocksAuthLoginRequest, BlocksIdpCallbackRequest, BlocksIdpInitiateRequest, BlocksIdpInitiateResponse, BlocksLoginOption, BlocksLogoutRequest, BlocksOidcRefreshRequest, BlocksOidcUserInfo, BlocksRefreshRequest, BlocksSocialLoginRequest, BlocksSwitchOrganizationRequest } from "./auth/auth-client.js";
 export type { BlocksRequestOptions } from "./types.js";
 export type { BlocksBaseResponse, BlocksGetMyOrganizationsResponse, BlocksGetOrganizationResponse, BlocksGetOrganizationsResponse, BlocksGetPermissionResponse, BlocksGetPermissionsResponse, BlocksGetRoleResponse, BlocksGetRolesResponse, BlocksGetUserResponse, BlocksGetUsersResponse, BlocksIamListRequest, BlocksMeResponse, BlocksOrganization, BlocksPermission, BlocksQueryListResponse, BlocksQueryResponse, BlocksRole, BlocksUser } from "./iam/types.js";
 export type { BlocksDataCollection, BlocksDataListOptions, BlocksDmsCreateFolderRequest, BlocksDmsListRequest, BlocksDmsMetaDataValue, BlocksDmsUploadItem, BlocksDmsUploadRequest, BlocksFileDeleteRequest, BlocksFileGetOptions, BlocksFileInfoListRequest, BlocksFileListRequest, BlocksFileUpdateAdditionalInfoRequest, BlocksFileUploadRequest, BlocksFolderDeleteRequest, BlocksGraphqlRequest, BlocksLocalStorageUploadRequest, BlocksPagedResult, BlocksRegexGenerateRequest, BlocksSchemaFieldValidationOptions, BlocksSchemaListOptions, BlocksSchemaValidationListOptions, BlocksUploadToUrlRequest } from "./data/types.js";
-export type { BlocksLocalizationDictionary, BlocksLocalizationKey, BlocksLocalizationKeysByNamesRequest, BlocksLocalizationKeysByNamesResponse, BlocksLocalizationLanguage, BlocksLocalizationModule, BlocksLocalizationTranslationOptions } from "./localization/types.js";
+export type { BlocksLocalizationDictionary, BlocksLocalizationKey, BlocksLocalizationKeyResource, BlocksLocalizationKeysByNamesRequest, BlocksLocalizationKeysByNamesResponse, BlocksLocalizationLanguage, BlocksLocalizationModule, BlocksLocalizationTranslationOptions } from "./localization/types.js";
+export type { BlocksMfaBackupCodeUseRequest, BlocksMfaConfig, BlocksMfaGenerateRequest, BlocksMfaPassThroughResponse, BlocksMfaResendRequest, BlocksMfaSetMethodRequest, BlocksMfaVerifyRequest, BlocksMfaVerifyTotpSetupRequest } from "./mfa/types.js";

package/dist/index.js

@@ -4,3 +4,4 @@ export { BlocksDataClient } from "./data/data-client.js";
 export { BlocksApiError } from "./http/errors.js";
 export { BlocksIAMClient } from "./iam/iam-client.js";
 export { BlocksLocalizationClient } from "./localization/localization-client.js";
+export { BlocksMfaClient } from "./mfa/mfa-client.js";

package/dist/localization/types.d.ts

@@ -18,12 +18,20 @@ export type BlocksLocalizationTranslationOptions = {
     language: string;
     moduleName: string;
 };
+export type BlocksLocalizationKeyResource = {
+    characterLength?: number;
+    culture?: string;
+    value?: string;
+};
 export type BlocksLocalizationKey = Record<string, unknown> & {
+    context?: string;
+    isNewKey?: boolean;
+    isPartiallyTranslated?: boolean;
     itemId?: string;
     keyName?: string;
     moduleId?: string;
-    moduleName?: string;
-    values?: Record<string, unknown>;
+    resources?: BlocksLocalizationKeyResource[];
+    routes?: string[];
 };
 export type BlocksLocalizationKeysByNamesRequest = {
     keyNames: string[];

package/dist/mfa/mfa-client.d.ts

@@ -0,0 +1,82 @@
+import { BlocksHttpClient } from "../http/http-client.js";
+import { BlocksMfaBackupCodeUseRequest, BlocksMfaConfig, BlocksMfaGenerateRequest, BlocksMfaPassThroughResponse, BlocksMfaResendRequest, BlocksMfaSetMethodRequest, BlocksMfaVerifyRequest, BlocksMfaVerifyTotpSetupRequest } from "./types.js";
+/**
+ * Consumer-facing MFA surface: enroll, verify, switch, or disable the signed-in user's own MFA,
+ * and manage their own backup codes. Tenant-wide MFA policy (`POST /iam/v4/mfa/config`) is
+ * deliberately not exposed here -- that's an admin/tenant-settings action, not a user self-service
+ * flow, the same distinction the SDK already draws for `identityProviders` admin methods.
+ */
+export declare class BlocksMfaClient {
+    private readonly http;
+    constructor(http: BlocksHttpClient);
+    /**
+     * What: reads the tenant's current MFA policy through `GET /iam/v4/mfa/config`.
+     * Why: consumer apps can check whether MFA is enabled/required before prompting enrollment.
+     * How: call with an authorized token; the SDK returns IAM's policy shape as-is.
+     */
+    config(): Promise<BlocksMfaConfig>;
+    readonly totp: {
+        /**
+         * What: starts TOTP enrollment through `POST /iam/v4/mfa/totp/setup`.
+         * Why: authenticator-app enrollment needs a secret/QR payload from IAM before the user can scan it.
+         * How: call for the signed-in user, then render IAM's returned secret/QR data in your enrollment UI.
+         */
+        setup: () => Promise<BlocksMfaPassThroughResponse>;
+        /**
+         * What: confirms TOTP enrollment through `POST /iam/v4/mfa/totp/verify-setup`.
+         * Why: IAM must confirm the user's authenticator app is correctly configured before enabling TOTP.
+         * How: pass the 6-digit `code` the user typed from their authenticator app.
+         */
+        verifySetup: (request: BlocksMfaVerifyTotpSetupRequest) => Promise<BlocksMfaPassThroughResponse>;
+    };
+    /**
+     * What: sends an OTP challenge through `POST /iam/v4/mfa/generate`.
+     * Why: email/SMS-based MFA needs IAM to issue and deliver a one-time code before verification.
+     * How: pass the target `mfaType`; IAM returns an `mfaId` to pass to `verify`/`resend`.
+     */
+    generate(request: BlocksMfaGenerateRequest): Promise<BlocksMfaPassThroughResponse>;
+    /**
+     * What: resends a pending OTP through `POST /iam/v4/mfa/resend`.
+     * Why: users may not receive the first code (SMS delay, spam filtering) and need a retry.
+     * How: pass the `mfaId` returned from `generate`.
+     */
+    resend(request: BlocksMfaResendRequest): Promise<BlocksMfaPassThroughResponse>;
+    /**
+     * What: verifies an OTP or step-up challenge through `POST /iam/v4/mfa/verify`.
+     * Why: login and sensitive in-app actions need this to confirm the code the user entered.
+     * How: pass `mfaId`, `verificationCode`, and `authType`; set `isFromTokenCall` when verifying as part of a token/login exchange rather than a standalone check.
+     */
+    verify(request: BlocksMfaVerifyRequest): Promise<BlocksMfaPassThroughResponse>;
+    /**
+     * What: sets the signed-in user's active MFA method through `PUT /iam/v4/mfa/method`.
+     * Why: users who have enrolled more than one method need to switch which one is active.
+     * How: pass the `mfaType` to activate; enroll it first (e.g. via `totp.setup`/`verifySetup`) if it isn't already.
+     */
+    setMethod(request: BlocksMfaSetMethodRequest): Promise<BlocksMfaPassThroughResponse>;
+    /**
+     * What: disables MFA for the signed-in user through `POST /iam/v4/mfa/disable`.
+     * Why: users need a self-service way to turn MFA off when the tenant's policy allows opt-out.
+     * How: call with an authorized token; IAM enforces whether opt-out is permitted for this tenant/role.
+     */
+    disable(): Promise<BlocksMfaPassThroughResponse>;
+    readonly backupCodes: {
+        /**
+         * What: lists the signed-in user's backup codes through `GET /iam/v4/mfa/backup-codes`.
+         * Why: account-security screens need to show how many unused recovery codes remain.
+         * How: call with an authorized token.
+         */
+        list: () => Promise<BlocksMfaPassThroughResponse>;
+        /**
+         * What: generates a fresh set of backup codes through `POST /iam/v4/mfa/backup-codes/generate`.
+         * Why: users need recovery codes for when their primary MFA method is unavailable.
+         * How: call once TOTP/OTP is enrolled; treat the response as sensitive and show it to the user only once.
+         */
+        generate: () => Promise<BlocksMfaPassThroughResponse>;
+        /**
+         * What: consumes one backup code through `POST /iam/v4/mfa/backup-codes/use`.
+         * Why: lets a user complete login/step-up when their primary MFA method is unavailable.
+         * How: pass the signed-in `userId` and the backup `code` the user entered; each code is single-use.
+         */
+        use: (request: BlocksMfaBackupCodeUseRequest) => Promise<BlocksMfaPassThroughResponse>;
+    };
+}

package/dist/mfa/mfa-client.js

@@ -0,0 +1,98 @@
+const MFA_API = "/iam/v4/mfa";
+/**
+ * Consumer-facing MFA surface: enroll, verify, switch, or disable the signed-in user's own MFA,
+ * and manage their own backup codes. Tenant-wide MFA policy (`POST /iam/v4/mfa/config`) is
+ * deliberately not exposed here -- that's an admin/tenant-settings action, not a user self-service
+ * flow, the same distinction the SDK already draws for `identityProviders` admin methods.
+ */
+export class BlocksMfaClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    /**
+     * What: reads the tenant's current MFA policy through `GET /iam/v4/mfa/config`.
+     * Why: consumer apps can check whether MFA is enabled/required before prompting enrollment.
+     * How: call with an authorized token; the SDK returns IAM's policy shape as-is.
+     */
+    config() {
+        return this.http.request(`${MFA_API}/config`);
+    }
+    totp = {
+        /**
+         * What: starts TOTP enrollment through `POST /iam/v4/mfa/totp/setup`.
+         * Why: authenticator-app enrollment needs a secret/QR payload from IAM before the user can scan it.
+         * How: call for the signed-in user, then render IAM's returned secret/QR data in your enrollment UI.
+         */
+        setup: () => this.http.request(`${MFA_API}/totp/setup`, { method: "POST" }),
+        /**
+         * What: confirms TOTP enrollment through `POST /iam/v4/mfa/totp/verify-setup`.
+         * Why: IAM must confirm the user's authenticator app is correctly configured before enabling TOTP.
+         * How: pass the 6-digit `code` the user typed from their authenticator app.
+         */
+        verifySetup: (request) => this.http.request(`${MFA_API}/totp/verify-setup`, { body: request })
+    };
+    /**
+     * What: sends an OTP challenge through `POST /iam/v4/mfa/generate`.
+     * Why: email/SMS-based MFA needs IAM to issue and deliver a one-time code before verification.
+     * How: pass the target `mfaType`; IAM returns an `mfaId` to pass to `verify`/`resend`.
+     */
+    generate(request) {
+        return this.http.request(`${MFA_API}/generate`, { body: request });
+    }
+    /**
+     * What: resends a pending OTP through `POST /iam/v4/mfa/resend`.
+     * Why: users may not receive the first code (SMS delay, spam filtering) and need a retry.
+     * How: pass the `mfaId` returned from `generate`.
+     */
+    resend(request) {
+        return this.http.request(`${MFA_API}/resend`, { body: request });
+    }
+    /**
+     * What: verifies an OTP or step-up challenge through `POST /iam/v4/mfa/verify`.
+     * Why: login and sensitive in-app actions need this to confirm the code the user entered.
+     * How: pass `mfaId`, `verificationCode`, and `authType`; set `isFromTokenCall` when verifying as part of a token/login exchange rather than a standalone check.
+     */
+    verify(request) {
+        return this.http.request(`${MFA_API}/verify`, { body: request });
+    }
+    /**
+     * What: sets the signed-in user's active MFA method through `PUT /iam/v4/mfa/method`.
+     * Why: users who have enrolled more than one method need to switch which one is active.
+     * How: pass the `mfaType` to activate; enroll it first (e.g. via `totp.setup`/`verifySetup`) if it isn't already.
+     */
+    setMethod(request) {
+        return this.http.request(`${MFA_API}/method`, {
+            body: request,
+            method: "PUT"
+        });
+    }
+    /**
+     * What: disables MFA for the signed-in user through `POST /iam/v4/mfa/disable`.
+     * Why: users need a self-service way to turn MFA off when the tenant's policy allows opt-out.
+     * How: call with an authorized token; IAM enforces whether opt-out is permitted for this tenant/role.
+     */
+    disable() {
+        return this.http.request(`${MFA_API}/disable`, { method: "POST" });
+    }
+    backupCodes = {
+        /**
+         * What: lists the signed-in user's backup codes through `GET /iam/v4/mfa/backup-codes`.
+         * Why: account-security screens need to show how many unused recovery codes remain.
+         * How: call with an authorized token.
+         */
+        list: () => this.http.request(`${MFA_API}/backup-codes`),
+        /**
+         * What: generates a fresh set of backup codes through `POST /iam/v4/mfa/backup-codes/generate`.
+         * Why: users need recovery codes for when their primary MFA method is unavailable.
+         * How: call once TOTP/OTP is enrolled; treat the response as sensitive and show it to the user only once.
+         */
+        generate: () => this.http.request(`${MFA_API}/backup-codes/generate`, { method: "POST" }),
+        /**
+         * What: consumes one backup code through `POST /iam/v4/mfa/backup-codes/use`.
+         * Why: lets a user complete login/step-up when their primary MFA method is unavailable.
+         * How: pass the signed-in `userId` and the backup `code` the user entered; each code is single-use.
+         */
+        use: (request) => this.http.request(`${MFA_API}/backup-codes/use`, { body: request })
+    };
+}

package/dist/mfa/types.d.ts

@@ -0,0 +1,34 @@
+export type BlocksMfaConfig = Record<string, unknown> & {
+    allowBackupCodes?: boolean;
+    allowUserOptOut?: boolean;
+    backupCodesCount?: number;
+    enableMfa?: boolean;
+    requireMfaForAllUsers?: boolean;
+    userMfaType?: number[];
+};
+export type BlocksMfaGenerateRequest = {
+    /** IAM-defined numeric MFA method (its enum names aren't in the swagger contract -- treat as opaque). */
+    mfaType: number;
+    sendPhoneNumberAsEmailDomain?: string;
+};
+export type BlocksMfaResendRequest = {
+    mfaId: string;
+    sendPhoneNumberAsEmailDomain?: string;
+};
+export type BlocksMfaVerifyRequest = {
+    authType: number;
+    isFromTokenCall?: boolean;
+    mfaId: string;
+    verificationCode: string;
+};
+export type BlocksMfaSetMethodRequest = {
+    mfaType: number;
+};
+export type BlocksMfaVerifyTotpSetupRequest = {
+    code: string;
+};
+export type BlocksMfaBackupCodeUseRequest = {
+    code: string;
+    userId: string;
+};
+export type BlocksMfaPassThroughResponse = Record<string, unknown>;

package/dist/mfa/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,48 +1,48 @@
-{
-  "name": "@seliseblocks/client",
-  "version": "0.1.1",
-  "description": "Framework-neutral TypeScript client SDK for SELISE Blocks frontend applications.",
-  "license": "MIT",
-  "type": "module",
-  "keywords": [
-    "selise",
-    "blocks",
-    "sdk",
-    "typescript",
-    "frontend"
-  ],
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "sideEffects": false,
-  "files": [
-    "dist",
-    "README.md",
-    "AI_USAGE_GUIDE.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc -p tsconfig.json",
-    "lint": "tsc -p tsconfig.json --noEmit",
-    "test": "npm run build && node --test test/*.test.mjs",
-    "prepack": "npm run build",
-    "prepublishOnly": "npm test"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.5.0"
-  }
-}
+{
+  "name": "@seliseblocks/client",
+  "version": "0.1.2",
+  "description": "Framework-neutral TypeScript client SDK for SELISE Blocks frontend applications.",
+  "license": "MIT",
+  "type": "module",
+  "keywords": [
+    "selise",
+    "blocks",
+    "sdk",
+    "typescript",
+    "frontend"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md",
+    "AI_USAGE_GUIDE.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.json",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm test"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.5.0"
+  }
+}