@shardflux/sdk 0.8.0 → 0.9.0

package/dist/account.js

@@ -0,0 +1,620 @@
+import { BillingApi, WorkspacesApi } from "./client.js";
+import { ShardfluxProtocolError } from "./errors.js";
+import { HttpClient, SDK_VERSION, defaultFetch, defaultSleep, randomId } from "./http.js";
+import { AuditApi, auditQuery } from "./audit.js";
+import { CaptureRegistry } from "./capture.js";
+import { EgressPolicyApi } from "./egress.js";
+import { sendFeedback } from "./feedback.js";
+import { SecretsApi } from "./secrets.js";
+import { TemplatesApi } from "./templates.js";
+import { UsageApi } from "./usage.js";
+import { VolumesApi } from "./volumes.js";
+import { DEFAULT_BASE_URL, versionCheckHook } from "./version-check.js";
+/** The shape of a CLI session token. */
+export const SESSION_TOKEN_PATTERN = /^sfu_[A-Za-z0-9_-]{43}$/;
+/** True when `value` has the shape of a CLI session token (`sfu_` + 43 base64url characters). */
+export function isSessionToken(value) {
+    return typeof value === 'string' && SESSION_TOKEN_PATTERN.test(value);
+}
+function tokenParam(query, name) {
+    for (const pair of query.split('&')) {
+        const eq = pair.indexOf('=');
+        const key = eq < 0 ? pair : pair.slice(0, eq);
+        if (key !== name)
+            continue;
+        const raw = eq < 0 ? '' : pair.slice(eq + 1);
+        let value;
+        try {
+            value = decodeURIComponent(raw);
+        }
+        catch {
+            value = raw;
+        }
+        return value.trim();
+    }
+    return null;
+}
+/**
+ * The token of an emailed link (`<app>/auth/verify-email#token=...`, `/auth/reset-password#token=...`,
+ * `/auth/confirm-email-change#token=...`, `/invitations/accept#token=...`): the `token` of its `#` fragment, else of
+ * its `?` query, percent-decoded. Input that is not a link is the token itself (trimmed). Throws for an empty input
+ * and for a link without a token.
+ */
+export function parseEmailToken(input) {
+    const s = typeof input === 'string' ? input.trim() : '';
+    if (s.length === 0)
+        throw new Error('parseEmailToken: empty input; pass the link from the email or its token');
+    const hash = s.indexOf('#');
+    const q = s.indexOf('?');
+    const looksLikeLink = hash >= 0 || q >= 0 || /^[a-z][a-z0-9+.-]*:\/\//i.test(s) || s.includes('/');
+    if (!looksLikeLink)
+        return s;
+    const fragment = hash >= 0 ? s.slice(hash + 1) : '';
+    const query = q >= 0 && (hash < 0 || q < hash) ? s.slice(q + 1, hash >= 0 ? hash : undefined) : '';
+    const token = tokenParam(fragment, 'token') || tokenParam(query, 'token');
+    if (!token)
+        throw new Error('parseEmailToken: the link has no token (expected #token=... or ?token=...); pass the whole link from the email or the token itself');
+    return token;
+}
+const enc = encodeURIComponent;
+const iso = (v) => (v instanceof Date ? v.toISOString() : v);
+function json(core, method, path, init = {}) {
+    const c = core.ctx();
+    return c.http.json(method, path, init, c.authorization);
+}
+async function text(core, path, init = {}) {
+    const c = core.ctx();
+    const res = await c.http.raw('GET', path, init, c.authorization);
+    return res.text();
+}
+const pageQuery = (p) => ({ query: { limit: p?.limit, cursor: p?.cursor } });
+/**
+ * Races the sleep against the signal. The default sleep's timer is cleared on abort (so it does not hold the process
+ * open); an injected sleep may not be abortable and is only raced.
+ */
+function abortableSleep(sleep, ms, signal) {
+    if (!signal)
+        return sleep(ms);
+    if (signal.aborted)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        let timer;
+        const done = () => {
+            if (timer !== undefined)
+                clearTimeout(timer);
+            signal.removeEventListener('abort', done);
+            resolve();
+        };
+        signal.addEventListener('abort', done, { once: true });
+        if (sleep === defaultSleep)
+            timer = setTimeout(done, ms);
+        else
+            void sleep(ms).then(done, done);
+    });
+}
+const abortReason = (signal) => (signal.reason instanceof Error ? signal.reason : new Error('aborted'));
+// ---- Namespaces ----
+export class AccountTotpApi {
+    #core;
+    constructor(core) {
+        this.#core = core;
+    }
+    /** Starts TOTP enrollment: the `secret` and `otpauth_uri` for an authenticator app (confirm with a code). */
+    enroll() {
+        return json(this.#core, 'POST', '/v1/auth/mfa/totp/enroll');
+    }
+    /** Confirms enrollment with a current code: returns the recovery codes (shown once). Rotates the session token. */
+    async confirm(code) {
+        return this.#core.adopt(await json(this.#core, 'POST', '/v1/auth/mfa/totp/confirm', { json: { code } }));
+    }
+    /** Turns TOTP off (needs a recent step-up). Rotates the session token. */
+    async disable() {
+        return this.#core.adopt(await json(this.#core, 'POST', '/v1/auth/mfa/totp/disable'));
+    }
+    /** New recovery codes (the old ones stop working; needs a recent step-up). */
+    regenerateRecoveryCodes() {
+        return json(this.#core, 'POST', '/v1/auth/mfa/recovery-codes');
+    }
+}
+export class AccountAuthApi {
+    #core;
+    /** Authenticator-app second factor. */
+    totp;
+    constructor(core) {
+        this.#core = core;
+        this.totp = new AccountTotpApi(core);
+    }
+    /** The session's state (`anonymous`, `mfa_required`, `authenticated`), its user and expiry. */
+    session() {
+        return json(this.#core, 'GET', '/v1/auth/session');
+    }
+    /** Completes a login that answered `mfa_required`, with a TOTP code or a recovery code. Rotates the session token. */
+    async completeMfa(params) {
+        const body = 'code' in params ? { code: params.code } : { recovery_code: params.recoveryCode };
+        return this.#core.adopt(await json(this.#core, 'POST', '/v1/auth/mfa/challenge', { json: body }));
+    }
+    /** Ends this session (the token stops working; `sessionToken` keeps the revoked value). */
+    logout() {
+        return json(this.#core, 'POST', '/v1/auth/logout');
+    }
+    /** Ends every session of the user, this one included. */
+    logoutAll() {
+        return json(this.#core, 'POST', '/v1/auth/logout-all');
+    }
+    /** The user's sessions (browser and CLI; `current` marks this one). */
+    sessions() {
+        return json(this.#core, 'GET', '/v1/auth/sessions');
+    }
+    revokeSession(sessionId) {
+        return json(this.#core, 'DELETE', `/v1/auth/sessions/${enc(sessionId)}`);
+    }
+    /**
+     * Confirms the password (and a code when MFA is on) for the calls that need a recent check (403
+     * `step_up_required`). Rotates the session token.
+     */
+    async stepUp(params) {
+        const body = { password: params.password };
+        if (params.code !== undefined)
+            body.code = params.code;
+        if (params.recoveryCode !== undefined)
+            body.recovery_code = params.recoveryCode;
+        return this.#core.adopt(await json(this.#core, 'POST', '/v1/auth/step-up', { json: body }));
+    }
+    /** Changes the password; every other session is revoked. Rotates the session token. */
+    async changePassword(params) {
+        const body = { current_password: params.currentPassword, new_password: params.newPassword };
+        return this.#core.adopt(await json(this.#core, 'POST', '/v1/auth/password/change', { json: body }));
+    }
+    /** Sends a confirmation link to the new address (confirm with ShardfluxAccount.confirmEmailChange). */
+    changeEmail(newEmail) {
+        return json(this.#core, 'POST', '/v1/auth/email/change', { json: { new_email: newEmail } });
+    }
+    /** Sends the verification email again. */
+    resendVerification() {
+        return json(this.#core, 'POST', '/v1/auth/verify-email/resend');
+    }
+}
+export class OrganizationExportsApi {
+    #core;
+    constructor(core) {
+        this.#core = core;
+    }
+    /** Builds a JSON export of the organization (owners/admins; needs a recent step-up). */
+    create(organizationId) {
+        return json(this.#core, 'POST', `/v1/organizations/${enc(organizationId)}/exports`);
+    }
+    get(organizationId, exportId) {
+        return json(this.#core, 'GET', `/v1/organizations/${enc(organizationId)}/exports/${enc(exportId)}`);
+    }
+    /** The export document (JSON text). */
+    download(organizationId, exportId, opts = {}) {
+        return text(this.#core, `/v1/organizations/${enc(organizationId)}/exports/${enc(exportId)}/download`, opts.signal ? { signal: opts.signal } : {});
+    }
+}
+export class AccountOrganizationsApi {
+    #core;
+    /** Data exports of an organization. */
+    exports;
+    constructor(core) {
+        this.#core = core;
+        this.exports = new OrganizationExportsApi(core);
+    }
+    /** One page of the user's organizations (with the user's `role`). */
+    list(params) {
+        return json(this.#core, 'GET', '/v1/organizations', pageQuery(params));
+    }
+    /** Every organization of the user, following next_cursor. */
+    async *listAll(params = {}) {
+        let cursor;
+        do {
+            const page = await this.list({ ...params, ...(cursor === undefined ? {} : { cursor }) });
+            yield* page.data;
+            cursor = page.next_cursor ?? undefined;
+        } while (cursor !== undefined);
+    }
+    /** Creates an organization; the user becomes its owner. */
+    create(params) {
+        return json(this.#core, 'POST', '/v1/organizations', { json: { name: params.name, ...(params.slug === undefined ? {} : { slug: params.slug }) } });
+    }
+    get(organizationId) {
+        return json(this.#core, 'GET', `/v1/organizations/${enc(organizationId)}`);
+    }
+    /** The organization's plan, allowances and limits. */
+    entitlements(organizationId) {
+        return json(this.#core, 'GET', `/v1/organizations/${enc(organizationId)}/entitlements`);
+    }
+    /** The deletion state: a scheduled request, what blocks it (an active subscription) and what would be removed. */
+    deletion(organizationId) {
+        return json(this.#core, 'GET', `/v1/organizations/${enc(organizationId)}/deletion`);
+    }
+    /** Deletes the organization (owners; needs a recent step-up). `confirmation` is the organization's slug. */
+    delete(organizationId, params) {
+        return json(this.#core, 'POST', `/v1/organizations/${enc(organizationId)}/deletion`, { json: { confirmation: params.confirmation } });
+    }
+    /** One page of the organization's workspaces (views, across its projects unless `projectId`). */
+    workspaces(organizationId, params = {}) {
+        return json(this.#core, 'GET', `/v1/organizations/${enc(organizationId)}/workspaces`, {
+            query: {
+                limit: params.limit,
+                cursor: params.cursor,
+                project_id: params.projectId,
+                state: params.state,
+                desired_state: params.desiredState,
+                key_prefix: params.keyPrefix,
+                include_deleted: params.includeDeleted,
+                lifetime: params.lifetime,
+                purpose: params.purpose,
+            },
+        });
+    }
+}
+export class AccountProjectsApi {
+    #core;
+    constructor(core) {
+        this.#core = core;
+    }
+    list(organizationId, params) {
+        return json(this.#core, 'GET', `/v1/organizations/${enc(organizationId)}/projects`, pageQuery(params));
+    }
+    /** Every project of the organization, following next_cursor. */
+    async *listAll(organizationId, params = {}) {
+        let cursor;
+        do {
+            const page = await this.list(organizationId, { ...params, ...(cursor === undefined ? {} : { cursor }) });
+            yield* page.data;
+            cursor = page.next_cursor ?? undefined;
+        } while (cursor !== undefined);
+    }
+    create(organizationId, params) {
+        return json(this.#core, 'POST', `/v1/organizations/${enc(organizationId)}/projects`, { json: { name: params.name, ...(params.slug === undefined ? {} : { slug: params.slug }) } });
+    }
+    get(projectId) {
+        return json(this.#core, 'GET', `/v1/projects/${enc(projectId)}`);
+    }
+}
+/** Every tool permission an API key can carry (pass it as `toolPermissions` for a key with every tool). */
+export const API_KEY_TOOL_PERMISSIONS = ['exec', 'files', 'pty', 'process', 'git', 'browser'];
+export class AccountApiKeysApi {
+    #core;
+    constructor(core) {
+        this.#core = core;
+    }
+    list(projectId, params) {
+        return json(this.#core, 'GET', `/v1/projects/${enc(projectId)}/api-keys`, pageQuery(params));
+    }
+    /** Creates a project API key: `secret` is the `sfk_...` key, shown once (an Idempotency-Key replay within 24 h returns it again). */
+    create(projectId, params) {
+        const body = { name: params.name, tool_permissions: [...(params.toolPermissions ?? [])] };
+        const expiresAt = iso(params.expiresAt);
+        if (expiresAt !== undefined)
+            body.expires_at = expiresAt;
+        return json(this.#core, 'POST', `/v1/projects/${enc(projectId)}/api-keys`, { json: body, idempotencyKey: params.idempotencyKey ?? randomId('api-key-') });
+    }
+    revoke(projectId, apiKeyId) {
+        return json(this.#core, 'DELETE', `/v1/projects/${enc(projectId)}/api-keys/${enc(apiKeyId)}`);
+    }
+}
+export class AccountMembersApi {
+    #core;
+    constructor(core) {
+        this.#core = core;
+    }
+    list(organizationId, params) {
+        return json(this.#core, 'GET', `/v1/organizations/${enc(organizationId)}/members`, pageQuery(params));
+    }
+    update(organizationId, userId, params) {
+        return json(this.#core, 'PATCH', `/v1/organizations/${enc(organizationId)}/members/${enc(userId)}`, { json: { role: params.role } });
+    }
+    remove(organizationId, userId) {
+        return json(this.#core, 'DELETE', `/v1/organizations/${enc(organizationId)}/members/${enc(userId)}`);
+    }
+}
+export class AccountInvitationsApi {
+    #core;
+    constructor(core) {
+        this.#core = core;
+    }
+    list(organizationId, params) {
+        return json(this.#core, 'GET', `/v1/organizations/${enc(organizationId)}/invitations`, pageQuery(params));
+    }
+    /** Invites an email address (the invitee gets a link; accept with invitations.accept). */
+    create(organizationId, params) {
+        return json(this.#core, 'POST', `/v1/organizations/${enc(organizationId)}/invitations`, { json: { email: params.email, role: params.role } });
+    }
+    revoke(organizationId, invitationId) {
+        return json(this.#core, 'DELETE', `/v1/organizations/${enc(organizationId)}/invitations/${enc(invitationId)}`);
+    }
+    /** Accepts an invitation with the emailed link (or its token): returns the organization joined. */
+    accept(linkOrToken) {
+        return json(this.#core, 'POST', '/v1/invitations/accept', { json: { token: parseEmailToken(linkOrToken) } });
+    }
+}
+/** Checkout statuses after which the checkout will never activate a subscription. */
+const CHECKOUT_TERMINAL = new Set(['expired', 'canceled', 'failed']);
+/**
+ * waitForCheckout gave up (0.9.0): nobody paid within `timeoutMs`, or the payment's webhook has not activated the
+ * subscription yet. The checkout stays usable; `checkout` is its last status.
+ */
+export class CheckoutTimeoutError extends Error {
+    checkout;
+    waitedMs;
+    constructor(checkout, waitedMs) {
+        super(`checkout ${checkout.id} is ${checkout.status} and the subscription is not active after ${Math.round(waitedMs / 1000)} s`);
+        this.name = 'CheckoutTimeoutError';
+        this.checkout = checkout;
+        this.waitedMs = waitedMs;
+    }
+}
+/**
+ * Billing with a user session: the catalog and subscription (as for API keys) plus Checkout, the Stripe portal,
+ * invoices and usage alert thresholds (owner/billing members).
+ */
+export class AccountBillingApi extends BillingApi {
+    #core;
+    constructor(core) {
+        super(core.ctx);
+        this.#core = core;
+    }
+    /**
+     * Starts (or reuses) a Stripe Checkout for `planKey`: a person pays at `url`. 409 `subscription_exists` when the
+     * organization already has a subscription (change plans in the portal).
+     */
+    checkout(organizationId, params) {
+        return json(this.#core, 'POST', `/v1/organizations/${enc(organizationId)}/billing/checkout-sessions`, { json: { plan_key: params.planKey } });
+    }
+    checkoutStatus(organizationId, checkoutId) {
+        return json(this.#core, 'GET', `/v1/organizations/${enc(organizationId)}/billing/checkout-sessions/${enc(checkoutId)}`);
+    }
+    /**
+     * Polls the checkout until the subscription is active (`subscription_active`) or the checkout ended without one
+     * (`expired`, `canceled`, `failed`) and returns that final status. Throws CheckoutTimeoutError after `timeoutMs`,
+     * and the signal's reason when aborted.
+     */
+    async waitForCheckout(organizationId, checkoutId, opts = {}) {
+        const timeoutMs = opts.timeoutMs ?? 900_000;
+        const intervalMs = opts.intervalMs ?? 2_000;
+        const { sleep } = this.#core.ctx();
+        const started = Date.now();
+        for (;;) {
+            if (opts.signal?.aborted)
+                throw abortReason(opts.signal);
+            const status = await json(this.#core, 'GET', `/v1/organizations/${enc(organizationId)}/billing/checkout-sessions/${enc(checkoutId)}`, opts.signal ? { signal: opts.signal } : {});
+            if (status.subscription_active || CHECKOUT_TERMINAL.has(status.status))
+                return status;
+            const waited = Date.now() - started;
+            if (waited >= timeoutMs)
+                throw new CheckoutTimeoutError(status, waited);
+            await abortableSleep(sleep, Math.max(1, Math.min(intervalMs, timeoutMs - waited)), opts.signal);
+        }
+    }
+    /** A Stripe customer portal link (plan changes, payment methods, cancellation). */
+    portal(organizationId) {
+        return json(this.#core, 'POST', `/v1/organizations/${enc(organizationId)}/billing/portal-sessions`);
+    }
+    invoices(organizationId, params) {
+        return json(this.#core, 'GET', `/v1/organizations/${enc(organizationId)}/billing/invoices`, pageQuery(params));
+    }
+    /** Usage alert thresholds. */
+    spendPolicy(organizationId) {
+        return json(this.#core, 'GET', `/v1/organizations/${enc(organizationId)}/spend-policy`);
+    }
+    /** Sets the usage alert thresholds (percent of the allowance, 1..100, at most 5; [] turns alerts off). */
+    setSpendPolicy(organizationId, params) {
+        return json(this.#core, 'PUT', `/v1/organizations/${enc(organizationId)}/spend-policy`, { json: { alert_thresholds_percent: params.alertThresholdsPercent } });
+    }
+}
+export class AccountExportsApi {
+    #core;
+    constructor(core) {
+        this.#core = core;
+    }
+    /** Builds a JSON export of the user's own data (needs a recent step-up). */
+    create() {
+        return json(this.#core, 'POST', '/v1/account/exports');
+    }
+    get(exportId) {
+        return json(this.#core, 'GET', `/v1/account/exports/${enc(exportId)}`);
+    }
+    /** The export document (JSON text; needs a recent step-up). */
+    download(exportId, opts = {}) {
+        return text(this.#core, `/v1/account/exports/${enc(exportId)}/download`, opts.signal ? { signal: opts.signal } : {});
+    }
+}
+/** The signed-in person: account deletion and data export. */
+export class AccountUserApi {
+    #core;
+    exports;
+    constructor(core) {
+        this.#core = core;
+        this.exports = new AccountExportsApi(core);
+    }
+    /** The deletion state: a scheduled request, the organizations that block it, the API keys that survive it. */
+    deletion() {
+        return json(this.#core, 'GET', '/v1/account/deletion');
+    }
+    /** Schedules deletion of the account after the grace period (needs a recent step-up). `confirmation` is the user's email. */
+    scheduleDeletion(params) {
+        return json(this.#core, 'POST', '/v1/account/deletion', { json: { confirmation: params.confirmation } });
+    }
+    cancelDeletion() {
+        return json(this.#core, 'DELETE', '/v1/account/deletion');
+    }
+}
+/** Organization templates with a user session: everything of TemplatesApi (pass `organizationId`) plus publish/archive. */
+export class AccountTemplatesApi extends TemplatesApi {
+    #core;
+    constructor(core) {
+        super(core.ctx);
+        this.#core = core;
+    }
+    /** Publishes a registered version (owners/admins): `open` may use it. */
+    publishVersion(organizationId, slug, version) {
+        return json(this.#core, 'POST', `/v1/organizations/${enc(organizationId)}/templates/${enc(slug)}/versions/${version}/publish`);
+    }
+    /** Archives a version (owners/admins): new opens stop using it; existing workspaces keep it. */
+    archiveVersion(organizationId, slug, version) {
+        return json(this.#core, 'POST', `/v1/organizations/${enc(organizationId)}/templates/${enc(slug)}/versions/${version}/archive`);
+    }
+}
+/** The organization audit log (owners/admins) plus its CSV/NDJSON export. */
+export class AccountAuditApi extends AuditApi {
+    #core;
+    constructor(core) {
+        super(core.ctx);
+        this.#core = core;
+    }
+    /** The export as text: NDJSON (one AuditEvent per line) or CSV with a header row. */
+    export(organizationId, params = {}) {
+        const { format = 'ndjson', signal, timeoutMs, ...filters } = params;
+        return text(this.#core, `/v1/organizations/${enc(organizationId)}/audit-events/export`, {
+            query: { format, ...auditQuery(filters) },
+            accept: `${format === 'csv' ? 'text/csv' : 'application/x-ndjson'}, application/json`,
+            timeoutMs: timeoutMs ?? Math.max(this.#core.ctx().http.opts.timeoutMs, 120_000),
+            ...(signal ? { signal } : {}),
+        });
+    }
+}
+/**
+ * A user (CLI) session on the Shardflux API: accounts, organizations, projects, API keys, members, invitations,
+ * billing, audit, data export and deletion, plus the project namespaces (usage, secrets, egress, volumes) with explicit
+ * organization/project ids. See the module comment for the token lifecycle.
+ */
+export class ShardfluxAccount {
+    auth;
+    organizations;
+    projects;
+    apiKeys;
+    members;
+    invitations;
+    billing;
+    /** The signed-in person (account deletion, data export). */
+    user;
+    templates;
+    audit;
+    usage;
+    secrets;
+    egress;
+    volumes;
+    /** Workspace routes with the session (pass `projectId` where a route needs a project, e.g. open). */
+    workspaces;
+    #token;
+    #onSessionToken;
+    #ctx;
+    constructor(opts = {}) {
+        if (opts.sessionToken !== undefined && !isSessionToken(opts.sessionToken))
+            throw new Error('sessionToken must be a Shardflux CLI session token (sfu_<43 base64url characters>)');
+        this.#token = opts.sessionToken ?? null;
+        this.#onSessionToken = opts.onSessionToken;
+        const f = opts.fetch ?? defaultFetch();
+        const userAgent = opts.userAgent ?? `shardflux-sdk-ts/${SDK_VERSION}`;
+        const sleep = opts.sleep ?? defaultSleep;
+        const baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL;
+        const ctx = () => this.#ctx;
+        const core = { ctx, adopt: (body) => this.#adopt(body) };
+        this.workspaces = new WorkspacesApi(ctx);
+        // eslint-disable-next-line @typescript-eslint/no-this-alias
+        const self = this;
+        this.#ctx = {
+            http: new HttpClient({ baseUrl, fetch: f, userAgent, timeoutMs: opts.timeoutMs ?? 30_000, maxRetries: opts.maxRetries ?? 2, source: 'api', sleep, onSuccess: versionCheckHook(opts.versionCheck, baseUrl, f, userAgent) }),
+            // Read on every request: a rotation applies to the next call of every namespace.
+            get authorization() {
+                return self.#token === null ? '' : `Bearer ${self.#token}`;
+            },
+            fetch: f,
+            userAgent,
+            sleep,
+            workspaces: this.workspaces,
+            onProgress: opts.onProgress,
+            captures: new CaptureRegistry(),
+        };
+        this.auth = new AccountAuthApi(core);
+        this.organizations = new AccountOrganizationsApi(core);
+        this.projects = new AccountProjectsApi(core);
+        this.apiKeys = new AccountApiKeysApi(core);
+        this.members = new AccountMembersApi(core);
+        this.invitations = new AccountInvitationsApi(core);
+        this.billing = new AccountBillingApi(core);
+        this.user = new AccountUserApi(core);
+        this.templates = new AccountTemplatesApi(core);
+        this.audit = new AccountAuditApi(core);
+        this.usage = new UsageApi(ctx);
+        this.secrets = new SecretsApi(ctx);
+        this.egress = new EgressPolicyApi(ctx);
+        this.volumes = new VolumesApi(ctx);
+    }
+    /** The current session token (rotations replace it), or null before login. */
+    get sessionToken() {
+        return this.#token;
+    }
+    async #adopt(body) {
+        const b = body;
+        if (b && typeof b === 'object' && typeof b.session_token === 'string') {
+            if (!isSessionToken(b.session_token))
+                throw new ShardfluxProtocolError('the API returned a session_token that is not a CLI session token (sfu_...)', 200);
+            this.#token = b.session_token;
+            const expiresAt = typeof b.session_expires_at === 'string' ? b.session_expires_at : '';
+            await this.#onSessionToken?.({ token: b.session_token, expiresAt });
+        }
+        return body;
+    }
+    /** The signed-in user and their memberships. */
+    me() {
+        return this.#ctx.http.json('GET', '/v1/me', {}, this.#ctx.authorization);
+    }
+    /**
+     * Send feedback straight to the Shardflux founder as the signed-in user (0.9.0+; POST /v1/feedback), optionally about
+     * one of your organizations (`organizationId`). Otherwise the same as `Shardflux.sendFeedback`: use it while you work,
+     * returns `{ id, receivedAt, duplicate }`, never retried, 429 `rate_limited` per user.
+     */
+    sendFeedback(params) {
+        return sendFeedback(this.#ctx, params);
+    }
+    /** Raw access to any /v1 endpoint with the session's authentication and the SDK's error handling. */
+    request(method, path, init = {}) {
+        // A raw call to a rotating /v1/auth route (step-up, ...) is adopted like the typed one.
+        return this.#ctx.http.json(method, path, init, this.#ctx.authorization).then((b) => this.#adopt(b));
+    }
+    // ---- Before a session exists ----
+    static #client(opts) {
+        return new ShardfluxAccount(opts);
+    }
+    static #post(opts, path, body) {
+        const account = ShardfluxAccount.#client(opts);
+        return account.#ctx.http.json('POST', path, body === undefined ? {} : { json: body });
+    }
+    /** Creates an account; a verification link is emailed (`{ status: 'accepted' }` also when the email is taken). */
+    static register(params) {
+        const { email, password, displayName, ...opts } = params;
+        return ShardfluxAccount.#post(opts, '/v1/auth/register', { email, password, ...(displayName === undefined ? {} : { display_name: displayName }) });
+    }
+    /**
+     * Verifies the email with the emailed link (or its token). `password_reset_required` (with `reset_token`): the
+     * account must set a password first (confirmPasswordReset with that token).
+     */
+    static verifyEmail(linkOrToken, opts = {}) {
+        return ShardfluxAccount.#post(opts, '/v1/auth/verify-email', { token: parseEmailToken(linkOrToken) });
+    }
+    /** Emails a password reset link (`{ status: 'accepted' }` whether or not the account exists). */
+    static requestPasswordReset(email, opts = {}) {
+        return ShardfluxAccount.#post(opts, '/v1/auth/password/reset/request', { email });
+    }
+    /** Sets a new password with the emailed reset link (or its token); every session is revoked. */
+    static confirmPasswordReset(params, opts = {}) {
+        return ShardfluxAccount.#post(opts, '/v1/auth/password/reset/confirm', { token: parseEmailToken(params.token), new_password: params.newPassword });
+    }
+    /** Confirms an email change with the link sent to the new address (or its token). */
+    static confirmEmailChange(linkOrToken, opts = {}) {
+        return ShardfluxAccount.#post(opts, '/v1/auth/email/change/confirm', { token: parseEmailToken(linkOrToken) });
+    }
+    /**
+     * Signs in: `account` holds the new session (onSessionToken is called with it). `result.status` `mfa_required`: the
+     * session is pending until `account.auth.completeMfa({ code })` (which rotates the token).
+     */
+    static async login(params) {
+        const { email, password, ...opts } = params;
+        const account = ShardfluxAccount.#client(opts);
+        const result = await account.#ctx.http.json('POST', '/v1/auth/login', { json: { email, password } });
+        await account.#adopt(result);
+        return { account, result };
+    }
+}