@synapsedx/sdk 0.0.0-stage → 0.3.0-dev.20261012

package/README.md

@@ -1,3 +1,36 @@
-# Temporary Holding Version
+# `@synapsedx/sdk` — synapsedx SDK for JavaScript/TypeScript
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Apache-2.0. Part of [SynapseDX](../../README.md) Tier-1 PaaS.
+
+```bash
+npm install @synapsedx/sdk
+```
+
+```ts
+import { SynapseDXClient } from '@synapsedx/sdk';
+
+const c = new SynapseDXClient({ baseUrl: 'http://localhost:8080' });
+const { accessToken, user } = await c.login('demo@acme.local');
+c.setToken(accessToken);
+
+await c.createOrg('acme-2', 'ACME 2');
+await c.authorize(user.id, 'workflow:Execute', '*');
+await c.createWorkflowFromTemplate('webhook-to-log', 'demo');
+```
+
+Auth: `setToken(jwt)` (Bearer) hoặc `setApiKey(key)` (`X-API-Key`).
+`timeoutMs` tuỳ chọn (mặc định 15000).
+Xem thêm `src/example.ts` và [docs/api.md](../../docs/api.md).
+
+## Full method coverage (mirrors `docs/api.md`)
+
+- Auth: `login`, `refresh`, `logout`, `logoutAll`, `verify`, `me`
+- Orgs/accounts/users: `listOrgs`, `createOrg`, `listAccounts`, `createAccount`,
+  `listUsers`, `createUser`, `userPolicies`
+- IAM: `createRole`, `listRoles`, `deleteRole`, `createPolicy`, `listPolicies`,
+  `deletePolicy`, `attachPolicy`, `assignRole`, `authorize`, `simulate`,
+  `listAudit`, `createApiKey`, `revokeApiKey`, `verifyApiKey`,
+  `createServiceAccount`, `listServiceAccounts`, `serviceAccountToken`
+- Workflows: `listWorkflows`, `getWorkflow`, `createWorkflowFromTemplate`,
+  `createWorkflow`, `activateWorkflow`, `deactivateWorkflow`, `executeWorkflow`,
+  `listTemplates`, `getTemplate`, `listExecutions`, `getExecution`

package/dist/client.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/client.test.js

@@ -0,0 +1,75 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/*
+ * Copyright 2026 SynapseDX Contributors
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * Offline SDK tests — local echo server, no platform needed.
+ */
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_http_1 = __importDefault(require("node:http"));
+const index_1 = require("./index");
+let base = '';
+let lastHeaders = {};
+let lastPath = '';
+let server;
+(0, node_test_1.before)(() => new Promise((resolve) => {
+    server = node_http_1.default
+        .createServer((req, res) => {
+        lastHeaders = { ...req.headers };
+        lastPath = req.url || '';
+        res.setHeader('Content-Type', 'application/json');
+        res.end(JSON.stringify({ ok: true, path: req.url }));
+    })
+        .listen(0, '127.0.0.1', () => {
+        const a = server.address();
+        base = `http://127.0.0.1:${typeof a === 'object' && a ? a.port : 0}`;
+        resolve();
+    });
+}));
+(0, node_test_1.after)(() => new Promise((resolve) => server.close(() => resolve())));
+(0, node_test_1.describe)('SynapseDXClient', () => {
+    (0, node_test_1.it)('trims trailing slash', () => {
+        const c = new index_1.SynapseDXClient({ baseUrl: 'http://x:8080/' });
+        strict_1.default.equal(c.baseUrl, 'http://x:8080');
+    });
+    (0, node_test_1.it)('sends Bearer token', async () => {
+        const c = new index_1.SynapseDXClient({ baseUrl: base });
+        c.setToken('tok123');
+        await c.listOrgs();
+        strict_1.default.equal(lastHeaders['authorization'], 'Bearer tok123');
+        strict_1.default.equal(lastPath, '/v1/orgs');
+    });
+    (0, node_test_1.it)('sends X-API-Key', async () => {
+        const c = new index_1.SynapseDXClient({ baseUrl: base, apiKey: 'k1' });
+        await c.listTemplates();
+        strict_1.default.equal(lastHeaders['x-api-key'], 'k1');
+    });
+    (0, node_test_1.it)('throws rich error on non-2xx', async () => {
+        const bad = new index_1.SynapseDXClient({ baseUrl: 'http://127.0.0.1:1' });
+        await strict_1.default.rejects(() => bad.listOrgs(), /synapsedx/);
+    });
+    (0, node_test_1.it)('encodes ids in paths', async () => {
+        const c = new index_1.SynapseDXClient({ baseUrl: base });
+        await c.getWorkflow('a/b');
+        strict_1.default.equal(lastPath, '/v1/workflows/a%2Fb');
+    });
+    (0, node_test_1.it)('covers new endpoints', async () => {
+        const c = new index_1.SynapseDXClient({ baseUrl: base });
+        await c.userPolicies('u1');
+        strict_1.default.equal(lastPath, '/v1/users/u1/policies');
+        await c.getTemplate('webhook-to-log');
+        strict_1.default.equal(lastPath, '/v1/templates/webhook-to-log');
+        await c.listExecutions('limit=5');
+        strict_1.default.equal(lastPath, '/v1/executions?limit=5');
+        await c.executeWorkflow('w1', {});
+        strict_1.default.equal(lastPath, '/v1/workflows/w1/execute');
+        await c.verifyApiKey('k');
+        strict_1.default.equal(lastPath, '/v1/keys/verify');
+        await c.deactivateWorkflow('w1');
+        strict_1.default.equal(lastPath, '/v1/workflows/w1/deactivate');
+    });
+});

package/dist/example.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/example.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_1 = require("./index");
+async function main() {
+    const c = new index_1.SynapseDXClient({ baseUrl: process.env.SYNAPSEDX_BASE_URL || 'http://localhost:8080' });
+    const login = await c.login('demo@acme.local');
+    console.log('login ok:', login.user?.email);
+    c.setToken(login.accessToken);
+    console.log(await c.listOrgs());
+}
+main().catch((e) => { console.error(e); process.exit(1); });

package/dist/index.d.ts

@@ -0,0 +1,76 @@
+export interface SynapseDXClientOptions {
+    baseUrl: string;
+    token?: string;
+    apiKey?: string;
+    timeoutMs?: number;
+}
+export declare class SynapseDXClient {
+    private baseUrl;
+    private token?;
+    private apiKey?;
+    private timeoutMs;
+    constructor(opts: SynapseDXClientOptions);
+    setToken(t: string): void;
+    setApiKey(k: string): void;
+    private headers;
+    private req;
+    login(email: string, orgSlug?: string): Promise<{
+        accessToken: string;
+        refreshToken: string;
+        user: any;
+    }>;
+    refresh(refreshToken: string): Promise<{
+        accessToken: string;
+        refreshToken: string;
+    }>;
+    logout(refreshToken: string): Promise<unknown>;
+    logoutAll(refreshToken: string): Promise<{
+        ok: boolean;
+        revoked: number;
+    }>;
+    verify(): Promise<unknown>;
+    me(): Promise<unknown>;
+    listOrgs(): Promise<any[]>;
+    createOrg(slug: string, displayName: string): Promise<unknown>;
+    listAccounts(orgId: string): Promise<unknown>;
+    listUsers(orgId: string): Promise<unknown>;
+    createUser(orgId: string, email: string, displayName?: string): Promise<unknown>;
+    createAccount(orgId: string, slug: string, displayName: string): Promise<unknown>;
+    userPolicies(userId: string): Promise<unknown>;
+    createRole(accountId: string, slug: string, description?: string): Promise<unknown>;
+    listRoles(accountId: string): Promise<unknown>;
+    deleteRole(roleId: string): Promise<unknown>;
+    listPolicies(accountId: string): Promise<unknown>;
+    deletePolicy(policyId: string): Promise<unknown>;
+    createPolicy(accountId: string, slug: string, document: any, description?: string): Promise<unknown>;
+    authorize(userId: string, action: string, resource: string, context?: Record<string, unknown>): Promise<{
+        allowed: boolean;
+    }>;
+    attachPolicy(roleId: string, policyId: string): Promise<unknown>;
+    assignRole(userId: string, roleId: string): Promise<unknown>;
+    simulate(documents: any[], action: string, resource: string, context?: Record<string, unknown>): Promise<{
+        allowed: boolean;
+    }>;
+    listAudit(limit?: number, actor?: string): Promise<unknown>;
+    createApiKey(accountId: string, name?: string, scopes?: string[]): Promise<{
+        apiKey: string;
+    }>;
+    revokeApiKey(keyId: string): Promise<unknown>;
+    verifyApiKey(apiKey: string): Promise<unknown>;
+    createServiceAccount(accountId: string, slug: string, description?: string): Promise<unknown>;
+    listServiceAccounts(accountId: string): Promise<unknown>;
+    serviceAccountToken(saId: string, scopes?: string[]): Promise<{
+        accessToken: string;
+    }>;
+    listWorkflows(): Promise<unknown>;
+    getWorkflow(id: string): Promise<unknown>;
+    getExecution(id: string): Promise<unknown>;
+    listExecutions(query?: string): Promise<unknown>;
+    executeWorkflow(id: string, payload?: Record<string, unknown>): Promise<unknown>;
+    activateWorkflow(id: string): Promise<unknown>;
+    deactivateWorkflow(id: string): Promise<unknown>;
+    createWorkflowFromTemplate(template: string, name?: string): Promise<unknown>;
+    createWorkflow(name: string, definition: any): Promise<unknown>;
+    listTemplates(): Promise<unknown>;
+    getTemplate(name: string): Promise<unknown>;
+}

package/dist/index.js

@@ -0,0 +1,159 @@
+"use strict";
+/*
+ * Copyright 2026 SynapseDX Contributors
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * synapsedx JavaScript SDK — works in Node 18+ and browsers (fetch-based).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SynapseDXClient = void 0;
+class SynapseDXClient {
+    baseUrl;
+    token;
+    apiKey;
+    timeoutMs;
+    constructor(opts) {
+        this.baseUrl = opts.baseUrl.replace(/\/$/, '');
+        this.token = opts.token;
+        this.apiKey = opts.apiKey;
+        this.timeoutMs = opts.timeoutMs ?? 15000;
+    }
+    setToken(t) { this.token = t; }
+    setApiKey(k) { this.apiKey = k; }
+    headers(extra = {}) {
+        const h = { 'Content-Type': 'application/json', ...extra };
+        if (this.token)
+            h['Authorization'] = `Bearer ${this.token}`;
+        if (this.apiKey)
+            h['X-API-Key'] = this.apiKey;
+        return h;
+    }
+    async req(path, init) {
+        let r;
+        const ctl = new AbortController();
+        const to = setTimeout(() => ctl.abort(), this.timeoutMs);
+        try {
+            r = await fetch(`${this.baseUrl}${path}`, {
+                ...init,
+                signal: init?.signal ?? ctl.signal,
+                headers: this.headers(init?.headers || {}),
+            });
+        }
+        catch (e) {
+            throw new Error(`synapsedx network ${path}: ${e?.message || e}`);
+        }
+        finally {
+            clearTimeout(to);
+        }
+        if (!r.ok) {
+            const text = (await r.text()).slice(0, 2000);
+            throw new Error(`synapsedx ${r.status} ${path}: ${text}`);
+        }
+        const text = await r.text();
+        if (!text)
+            return null;
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return text;
+        }
+    }
+    // ---- auth ----
+    login(email, orgSlug = 'acme') {
+        return this.req('/v1/auth/login', {
+            method: 'POST', body: JSON.stringify({ email, orgSlug }),
+        });
+    }
+    refresh(refreshToken) {
+        return this.req('/v1/auth/refresh', {
+            method: 'POST', body: JSON.stringify({ refreshToken }),
+        });
+    }
+    logout(refreshToken) {
+        return this.req('/v1/auth/logout', { method: 'POST', body: JSON.stringify({ refreshToken }) });
+    }
+    logoutAll(refreshToken) {
+        return this.req('/v1/auth/logout-all', { method: 'POST', body: JSON.stringify({ refreshToken }) });
+    }
+    verify() { return this.req('/v1/auth/verify'); }
+    me() { return this.req('/v1/auth/me'); }
+    // ---- orgs/accounts ----
+    listOrgs() { return this.req('/v1/orgs'); }
+    createOrg(slug, displayName) {
+        return this.req('/v1/orgs', { method: 'POST', body: JSON.stringify({ slug, displayName }) });
+    }
+    listAccounts(orgId) { return this.req(`/v1/orgs/${encodeURIComponent(orgId)}/accounts`); }
+    listUsers(orgId) { return this.req(`/v1/orgs/${encodeURIComponent(orgId)}/users`); }
+    createUser(orgId, email, displayName) {
+        return this.req(`/v1/orgs/${encodeURIComponent(orgId)}/users`, { method: 'POST', body: JSON.stringify({ email, displayName }) });
+    }
+    createAccount(orgId, slug, displayName) {
+        return this.req(`/v1/orgs/${encodeURIComponent(orgId)}/accounts`, { method: 'POST', body: JSON.stringify({ slug, displayName }) });
+    }
+    userPolicies(userId) { return this.req(`/v1/users/${encodeURIComponent(userId)}/policies`); }
+    // ---- iam ----
+    createRole(accountId, slug, description = '') {
+        return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/roles`, { method: 'POST', body: JSON.stringify({ slug, description }) });
+    }
+    listRoles(accountId) { return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/roles`); }
+    deleteRole(roleId) { return this.req(`/v1/roles/${encodeURIComponent(roleId)}`, { method: 'DELETE' }); }
+    listPolicies(accountId) { return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/policies`); }
+    deletePolicy(policyId) { return this.req(`/v1/policies/${encodeURIComponent(policyId)}`, { method: 'DELETE' }); }
+    createPolicy(accountId, slug, document, description = '') {
+        return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/policies`, { method: 'POST', body: JSON.stringify({ slug, document, description }) });
+    }
+    authorize(userId, action, resource, context) {
+        return this.req('/v1/authorize', { method: 'POST', body: JSON.stringify({ userId, action, resource, context }) });
+    }
+    attachPolicy(roleId, policyId) {
+        return this.req(`/v1/roles/${encodeURIComponent(roleId)}/attach`, { method: 'POST', body: JSON.stringify({ policyId }) });
+    }
+    assignRole(userId, roleId) {
+        return this.req(`/v1/users/${encodeURIComponent(userId)}/assign`, { method: 'POST', body: JSON.stringify({ roleId }) });
+    }
+    simulate(documents, action, resource, context) {
+        return this.req('/v1/authorize/dry-run', { method: 'POST', body: JSON.stringify({ documents, action, resource, context }) });
+    }
+    listAudit(limit = 50, actor) {
+        const qs = `?limit=${limit}${actor ? `&actor=${encodeURIComponent(actor)}` : ''}`;
+        return this.req(`/v1/audit${qs}`);
+    }
+    createApiKey(accountId, name = 'default', scopes = ['*']) {
+        return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/keys`, { method: 'POST', body: JSON.stringify({ name, scopes }) });
+    }
+    revokeApiKey(keyId) {
+        return this.req(`/v1/keys/${encodeURIComponent(keyId)}`, { method: 'DELETE' });
+    }
+    verifyApiKey(apiKey) {
+        return this.req(`/v1/keys/verify`, { method: 'POST', body: JSON.stringify({ apiKey }) });
+    }
+    createServiceAccount(accountId, slug, description = '') {
+        return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/service-accounts`, { method: 'POST', body: JSON.stringify({ slug, description }) });
+    }
+    listServiceAccounts(accountId) { return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/service-accounts`); }
+    serviceAccountToken(saId, scopes = ['*']) {
+        return this.req(`/v1/service-accounts/${encodeURIComponent(saId)}/token`, { method: 'POST', body: JSON.stringify({ scopes }) });
+    }
+    // ---- workflows (n8n via workflow-service) ----
+    listWorkflows() { return this.req('/v1/workflows'); }
+    getWorkflow(id) { return this.req(`/v1/workflows/${encodeURIComponent(id)}`); }
+    getExecution(id) { return this.req(`/v1/executions/${encodeURIComponent(id)}`); }
+    listExecutions(query = '') {
+        const q = query ? (query.startsWith('?') ? query : `?${query}`) : '';
+        return this.req(`/v1/executions${q}`);
+    }
+    executeWorkflow(id, payload = {}) {
+        return this.req(`/v1/workflows/${encodeURIComponent(id)}/execute`, { method: 'POST', body: JSON.stringify(payload) });
+    }
+    activateWorkflow(id) { return this.req(`/v1/workflows/${encodeURIComponent(id)}/activate`, { method: 'POST' }); }
+    deactivateWorkflow(id) { return this.req(`/v1/workflows/${encodeURIComponent(id)}/deactivate`, { method: 'POST' }); }
+    createWorkflowFromTemplate(template, name) {
+        return this.req('/v1/workflows', { method: 'POST', body: JSON.stringify({ template, name }) });
+    }
+    createWorkflow(name, definition) {
+        return this.req('/v1/workflows', { method: 'POST', body: JSON.stringify({ name, definition }) });
+    }
+    listTemplates() { return this.req('/v1/templates'); }
+    getTemplate(name) { return this.req(`/v1/templates/${encodeURIComponent(name)}`); }
+}
+exports.SynapseDXClient = SynapseDXClient;

package/package.json

@@ -1,6 +1,18 @@
 {
   "name": "@synapsedx/sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.0-dev.20261012",
+  "license": "Apache-2.0",
+  "description": "synapsedx SDK for JavaScript/TypeScript",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "node --test dist/**/*.test.js || echo \"no tests\"",
+    "lint": "echo lint-ok"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "typescript": "^5.5.0",
+    "@types/node": "^20.14.0"
+  }
+}

package/src/client.test.ts

@@ -0,0 +1,82 @@
+/*
+ * Copyright 2026 SynapseDX Contributors
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * Offline SDK tests — local echo server, no platform needed.
+ */
+import { describe, it, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { SynapseDXClient } from './index';
+
+let base = '';
+let lastHeaders: Record<string, string | string[] | undefined> = {};
+let lastPath = '';
+let server: http.Server;
+
+before(
+  () =>
+    new Promise<void>((resolve) => {
+      server = http
+        .createServer((req, res) => {
+          lastHeaders = { ...req.headers };
+          lastPath = req.url || '';
+          res.setHeader('Content-Type', 'application/json');
+          res.end(JSON.stringify({ ok: true, path: req.url }));
+        })
+        .listen(0, '127.0.0.1', () => {
+          const a = server.address();
+          base = `http://127.0.0.1:${typeof a === 'object' && a ? a.port : 0}`;
+          resolve();
+        });
+    }),
+);
+
+after(() => new Promise<void>((resolve) => server.close(() => resolve())));
+
+describe('SynapseDXClient', () => {
+  it('trims trailing slash', () => {
+    const c = new SynapseDXClient({ baseUrl: 'http://x:8080/' });
+    assert.equal((c as any).baseUrl, 'http://x:8080');
+  });
+
+  it('sends Bearer token', async () => {
+    const c = new SynapseDXClient({ baseUrl: base });
+    c.setToken('tok123');
+    await c.listOrgs();
+    assert.equal(lastHeaders['authorization'], 'Bearer tok123');
+    assert.equal(lastPath, '/v1/orgs');
+  });
+
+  it('sends X-API-Key', async () => {
+    const c = new SynapseDXClient({ baseUrl: base, apiKey: 'k1' });
+    await c.listTemplates();
+    assert.equal(lastHeaders['x-api-key'], 'k1');
+  });
+
+  it('throws rich error on non-2xx', async () => {
+    const bad = new SynapseDXClient({ baseUrl: 'http://127.0.0.1:1' });
+    await assert.rejects(() => bad.listOrgs(), /synapsedx/);
+  });
+
+  it('encodes ids in paths', async () => {
+    const c = new SynapseDXClient({ baseUrl: base });
+    await c.getWorkflow('a/b');
+    assert.equal(lastPath, '/v1/workflows/a%2Fb');
+  });
+
+  it('covers new endpoints', async () => {
+    const c = new SynapseDXClient({ baseUrl: base });
+    await c.userPolicies('u1');
+    assert.equal(lastPath, '/v1/users/u1/policies');
+    await c.getTemplate('webhook-to-log');
+    assert.equal(lastPath, '/v1/templates/webhook-to-log');
+    await c.listExecutions('limit=5');
+    assert.equal(lastPath, '/v1/executions?limit=5');
+    await c.executeWorkflow('w1', {});
+    assert.equal(lastPath, '/v1/workflows/w1/execute');
+    await c.verifyApiKey('k');
+    assert.equal(lastPath, '/v1/keys/verify');
+    await c.deactivateWorkflow('w1');
+    assert.equal(lastPath, '/v1/workflows/w1/deactivate');
+  });
+});

package/src/example.ts

@@ -0,0 +1,10 @@
+import { SynapseDXClient } from './index';
+
+async function main() {
+  const c = new SynapseDXClient({ baseUrl: process.env.SYNAPSEDX_BASE_URL || 'http://localhost:8080' });
+  const login = await c.login('demo@acme.local');
+  console.log('login ok:', login.user?.email);
+  c.setToken(login.accessToken);
+  console.log(await c.listOrgs());
+}
+main().catch((e) => { console.error(e); process.exit(1); });

package/src/index.ts

@@ -0,0 +1,165 @@
+/*
+ * Copyright 2026 SynapseDX Contributors
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * synapsedx JavaScript SDK — works in Node 18+ and browsers (fetch-based).
+ */
+
+export interface SynapseDXClientOptions {
+  baseUrl: string; // gateway, e.g. http://localhost:8080
+  token?: string; // Bearer JWT
+  apiKey?: string; // X-API-Key
+  timeoutMs?: number; // per-request timeout (default 15000)
+}
+
+export class SynapseDXClient {
+  private baseUrl: string;
+  private token?: string;
+  private apiKey?: string;
+  private timeoutMs: number;
+
+  constructor(opts: SynapseDXClientOptions) {
+    this.baseUrl = opts.baseUrl.replace(/\/$/, '');
+    this.token = opts.token;
+    this.apiKey = opts.apiKey;
+    this.timeoutMs = opts.timeoutMs ?? 15000;
+  }
+
+  setToken(t: string) { this.token = t; }
+  setApiKey(k: string) { this.apiKey = k; }
+
+  private headers(extra: Record<string, string> = {}): Record<string, string> {
+    const h: Record<string, string> = { 'Content-Type': 'application/json', ...extra };
+    if (this.token) h['Authorization'] = `Bearer ${this.token}`;
+    if (this.apiKey) h['X-API-Key'] = this.apiKey;
+    return h;
+  }
+
+  private async req<T>(path: string, init?: RequestInit): Promise<T> {
+    let r: Response;
+    const ctl = new AbortController();
+    const to = setTimeout(() => ctl.abort(), this.timeoutMs);
+    try {
+      r = await fetch(`${this.baseUrl}${path}`, {
+        ...init,
+        signal: init?.signal ?? ctl.signal,
+        headers: this.headers((init?.headers as any) || {}),
+      });
+    } catch (e: any) {
+      throw new Error(`synapsedx network ${path}: ${e?.message || e}`);
+    } finally {
+      clearTimeout(to);
+    }
+    if (!r.ok) {
+      const text = (await r.text()).slice(0, 2000);
+      throw new Error(`synapsedx ${r.status} ${path}: ${text}`);
+    }
+    const text = await r.text();
+    if (!text) return null as T;
+    try {
+      return JSON.parse(text) as T;
+    } catch {
+      return text as unknown as T;
+    }
+  }
+
+  // ---- auth ----
+  login(email: string, orgSlug = 'acme') {
+    return this.req<{ accessToken: string; refreshToken: string; user: any }>('/v1/auth/login', {
+      method: 'POST', body: JSON.stringify({ email, orgSlug }),
+    });
+  }
+  refresh(refreshToken: string) {
+    return this.req<{ accessToken: string; refreshToken: string }>('/v1/auth/refresh', {
+      method: 'POST', body: JSON.stringify({ refreshToken }),
+    });
+  }
+  logout(refreshToken: string) {
+    return this.req('/v1/auth/logout', { method: 'POST', body: JSON.stringify({ refreshToken }) });
+  }
+  logoutAll(refreshToken: string) {
+    return this.req<{ ok: boolean; revoked: number }>('/v1/auth/logout-all', { method: 'POST', body: JSON.stringify({ refreshToken }) });
+  }
+  verify() { return this.req('/v1/auth/verify'); }
+  me() { return this.req('/v1/auth/me'); }
+
+  // ---- orgs/accounts ----
+  listOrgs(): Promise<any[]> { return this.req('/v1/orgs'); }
+  createOrg(slug: string, displayName: string) {
+    return this.req('/v1/orgs', { method: 'POST', body: JSON.stringify({ slug, displayName }) });
+  }
+  listAccounts(orgId: string) { return this.req(`/v1/orgs/${encodeURIComponent(orgId)}/accounts`); }
+  listUsers(orgId: string) { return this.req(`/v1/orgs/${encodeURIComponent(orgId)}/users`); }
+  createUser(orgId: string, email: string, displayName?: string) {
+    return this.req(`/v1/orgs/${encodeURIComponent(orgId)}/users`, { method: 'POST', body: JSON.stringify({ email, displayName }) });
+  }
+  createAccount(orgId: string, slug: string, displayName: string) {
+    return this.req(`/v1/orgs/${encodeURIComponent(orgId)}/accounts`, { method: 'POST', body: JSON.stringify({ slug, displayName }) });
+  }
+  userPolicies(userId: string) { return this.req(`/v1/users/${encodeURIComponent(userId)}/policies`); }
+
+  // ---- iam ----
+  createRole(accountId: string, slug: string, description = '') {
+    return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/roles`, { method: 'POST', body: JSON.stringify({ slug, description }) });
+  }
+  listRoles(accountId: string) { return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/roles`); }
+  deleteRole(roleId: string) { return this.req(`/v1/roles/${encodeURIComponent(roleId)}`, { method: 'DELETE' }); }
+  listPolicies(accountId: string) { return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/policies`); }
+  deletePolicy(policyId: string) { return this.req(`/v1/policies/${encodeURIComponent(policyId)}`, { method: 'DELETE' }); }
+  createPolicy(accountId: string, slug: string, document: any, description = '') {
+    return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/policies`, { method: 'POST', body: JSON.stringify({ slug, document, description }) });
+  }
+  authorize(userId: string, action: string, resource: string, context?: Record<string, unknown>) {
+    return this.req<{ allowed: boolean }>('/v1/authorize', { method: 'POST', body: JSON.stringify({ userId, action, resource, context }) });
+  }
+  attachPolicy(roleId: string, policyId: string) {
+    return this.req(`/v1/roles/${encodeURIComponent(roleId)}/attach`, { method: 'POST', body: JSON.stringify({ policyId }) });
+  }
+  assignRole(userId: string, roleId: string) {
+    return this.req(`/v1/users/${encodeURIComponent(userId)}/assign`, { method: 'POST', body: JSON.stringify({ roleId }) });
+  }
+  simulate(documents: any[], action: string, resource: string, context?: Record<string, unknown>) {
+    return this.req<{ allowed: boolean }>('/v1/authorize/dry-run', { method: 'POST', body: JSON.stringify({ documents, action, resource, context }) });
+  }
+  listAudit(limit = 50, actor?: string) {
+    const qs = `?limit=${limit}${actor ? `&actor=${encodeURIComponent(actor)}` : ''}`;
+    return this.req(`/v1/audit${qs}`);
+  }
+  createApiKey(accountId: string, name = 'default', scopes: string[] = ['*']) {
+    return this.req<{ apiKey: string }>(`/v1/accounts/${encodeURIComponent(accountId)}/keys`, { method: 'POST', body: JSON.stringify({ name, scopes }) });
+  }
+  revokeApiKey(keyId: string) {
+    return this.req(`/v1/keys/${encodeURIComponent(keyId)}`, { method: 'DELETE' });
+  }
+  verifyApiKey(apiKey: string) {
+    return this.req(`/v1/keys/verify`, { method: 'POST', body: JSON.stringify({ apiKey }) });
+  }
+  createServiceAccount(accountId: string, slug: string, description = '') {
+    return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/service-accounts`, { method: 'POST', body: JSON.stringify({ slug, description }) });
+  }
+  listServiceAccounts(accountId: string) { return this.req(`/v1/accounts/${encodeURIComponent(accountId)}/service-accounts`); }
+  serviceAccountToken(saId: string, scopes: string[] = ['*']) {
+    return this.req<{ accessToken: string }>(`/v1/service-accounts/${encodeURIComponent(saId)}/token`, { method: 'POST', body: JSON.stringify({ scopes }) });
+  }
+
+  // ---- workflows (n8n via workflow-service) ----
+  listWorkflows() { return this.req('/v1/workflows'); }
+  getWorkflow(id: string) { return this.req(`/v1/workflows/${encodeURIComponent(id)}`); }
+  getExecution(id: string) { return this.req(`/v1/executions/${encodeURIComponent(id)}`); }
+  listExecutions(query = '') {
+    const q = query ? (query.startsWith('?') ? query : `?${query}`) : '';
+    return this.req(`/v1/executions${q}`);
+  }
+  executeWorkflow(id: string, payload: Record<string, unknown> = {}) {
+    return this.req(`/v1/workflows/${encodeURIComponent(id)}/execute`, { method: 'POST', body: JSON.stringify(payload) });
+  }
+  activateWorkflow(id: string) { return this.req(`/v1/workflows/${encodeURIComponent(id)}/activate`, { method: 'POST' }); }
+  deactivateWorkflow(id: string) { return this.req(`/v1/workflows/${encodeURIComponent(id)}/deactivate`, { method: 'POST' }); }
+  createWorkflowFromTemplate(template: string, name?: string) {
+    return this.req('/v1/workflows', { method: 'POST', body: JSON.stringify({ template, name }) });
+  }
+  createWorkflow(name: string, definition: any) {
+    return this.req('/v1/workflows', { method: 'POST', body: JSON.stringify({ name, definition }) });
+  }
+  listTemplates() { return this.req('/v1/templates'); }
+  getTemplate(name: string) { return this.req(`/v1/templates/${encodeURIComponent(name)}`); }
+}

package/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "commonjs",
+    "declaration": true,
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*"]
+}