@trustgraph/client 1.7.2 → 2.1.0

package/dist/index.esm.js

@@ -8,7 +8,8 @@ const TG_QUERY = TG + "query";
 const TG_EDGE_COUNT = TG + "edgeCount";
 const TG_SELECTED_EDGE = TG + "selectedEdge";
 const TG_EDGE = TG + "edge";
-const TG_REASONING = TG + "reasoning";
+const TG_CONCEPT = TG + "concept";
+const TG_SCORE = TG + "score";
 const TG_CONTENT = TG + "content";
 const TG_REIFIES = TG + "reifies";
 const TG_DOCUMENT = TG + "document";
@@ -74,18 +75,17 @@ class ServiceCallMulti {
         }
     }
     /**
-     * Called when socket connects - immediately retry if we were waiting
+     * Called when socket reconnects. Streaming requests cannot be resumed
+     * after a disconnect — the backend state is gone — so fail immediately.
      */
     retryNow() {
         if (this.complete)
             return;
-        // Clear any pending backoff timer
         clearTimeout(this.timeoutId);
         this.timeoutId = undefined;
-        // Restore retry count since we didn't actually fail
-        this.retries++;
-        // Attempt immediately
-        this.attempt();
+        this.complete = true;
+        delete this.socket.inflight[this.mid];
+        this.error("Connection lost during streaming request");
     }
     onTimeout() {
         if (this.complete == true)
@@ -106,8 +106,11 @@ class ServiceCallMulti {
             this.error("Ran out of retries");
             return; // Exit early - no more attempts
         }
-        // Check if WebSocket connection is available and ready
-        if (this.socket.ws && this.socket.ws.readyState === WebSocket.OPEN) {
+        // Check if WebSocket connection is available, open, and authenticated.
+        const authReady = this.socket.isAuthReady?.() ?? true;
+        if (this.socket.ws &&
+            this.socket.ws.readyState === WebSocket.OPEN &&
+            authReady) {
             try {
                 this.socket.ws.send(JSON.stringify(this.msg));
                 this.timeoutId = setTimeout(this.onTimeout.bind(this), this.timeout);
@@ -289,8 +292,14 @@ class ServiceCall {
             this.error("Ran out of retries");
             return; // Exit early - no more attempts
         }
-        // Check if WebSocket connection is available and ready
-        if (this.socket.ws && this.socket.ws.readyState === WebSocket.OPEN) {
+        // Check if WebSocket connection is available, open, and authenticated.
+        // The IAM gateway rejects all non-auth frames until the first-frame
+        // auth handshake has completed, so sends gated only on readyState
+        // would race the auth response.
+        const authReady = this.socket.isAuthReady?.() ?? true;
+        if (this.socket.ws &&
+            this.socket.ws.readyState === WebSocket.OPEN &&
+            authReady) {
             try {
                 // Attempt to send the message as JSON
                 this.socket.ws.send(JSON.stringify(this.msg));
@@ -319,12 +328,23 @@ class ServiceCall {
 // Configuration constants
 const SOCKET_RECONNECTION_TIMEOUT = 2000; // 2 seconds between reconnection
 // attempts
-const SOCKET_URL = "/api/socket"; // WebSocket endpoint path
+const SOCKET_URL = "/api/v1/socket"; // WebSocket endpoint path
 /**
  * Generates a random message ID using cryptographically secure random values
  * @param length - Number of random characters to generate
  * @returns Random string of specified length
  */
+// Normalise the top-level `error` field from a WebSocket response frame.
+// The gateway may send it as a plain string *or* as an object with a
+// `message` field; callers always want a string.
+function errorToString(err) {
+    if (typeof err === "string")
+        return err;
+    if (err && typeof err === "object" && "message" in err) {
+        return String(err.message);
+    }
+    return String(err);
+}
 function makeid(length) {
     const array = new Uint32Array(length);
     crypto.getRandomValues(array);
@@ -332,23 +352,46 @@ function makeid(length) {
     return array.reduce((acc, current) => acc + characters[current % characters.length], "");
 }
 class BaseApi {
-    constructor(user, token, socketUrl) {
+    constructor(token, socketUrl) {
+        // Legacy honour-system field. The gateway now derives identity from the
+        // authenticated token; this is retained as an empty string so the
+        // existing request-builder code paths that read `api.user` keep
+        // compiling. It will be removed when the request payloads are cleaned
+        // up.
+        this.user = "";
+        // Active workspace for outbound requests. Sent as the envelope
+        // `workspace` field (sibling of `flow`); the gateway reconciles it
+        // against the authenticated identity and, when empty, defaults to
+        // the token's bound workspace. Kept in sync with the active
+        // workspace by the state layer.
+        this.workspace = "";
         this.inflight = {}; // Track active requests by
         // message ID
         this.reconnectAttempts = 0; // Track reconnection attempts
         this.maxReconnectAttempts = 10; // Maximum reconnection attempts
         this.reconnectionState = "idle"; // Connection state
+        // Auth-handshake state for the current socket. Reset on each open.
+        this.authState = "pending";
         // Connection state tracking for UI
         this.connectionStateListeners = [];
         this.tag = makeid(16); // Generate unique client tag
         this.id = 1; // Start message ID counter
-        this.token = token; // Store authentication token
-        this.user = user; // Store user identifier
+        this.token = token;
         this.socketUrl = socketUrl || SOCKET_URL; // Use provided URL or default
-        console.log("SOCKET: opening socket...", token ? "with auth" : "without auth", "user:", user);
+        console.log("SOCKET: opening socket...");
         this.openSocket(); // Establish WebSocket connection
         console.log("SOCKET: socket opened");
     }
+    /**
+     * True once the WebSocket is OPEN and the first-frame auth handshake
+     * has been accepted by the gateway. ServiceCall consults this before
+     * sending request frames.
+     */
+    isAuthReady() {
+        return (!!this.ws &&
+            this.ws.readyState === WebSocket.OPEN &&
+            this.authState === "ok");
+    }
     /**
      * Subscribe to connection state changes for UI updates
      */
@@ -369,7 +412,8 @@ class BaseApi {
      */
     getConnectionState() {
         const hasApiKey = !!this.token;
-        // Determine status based on WebSocket state and reconnection state
+        // Determine status based on WebSocket state, auth handshake state, and
+        // reconnection state.
         let status;
         if (!this.ws || this.ws.readyState === WebSocket.CLOSED) {
             if (this.reconnectionState === "failed") {
@@ -386,7 +430,12 @@ class BaseApi {
             status = "connecting";
         }
         else if (this.ws.readyState === WebSocket.OPEN) {
-            status = hasApiKey ? "authenticated" : "unauthenticated";
+            if (this.authState === "ok")
+                status = "authenticated";
+            else if (this.authState === "failed")
+                status = "auth-failed";
+            else
+                status = "authenticating";
         }
         else {
             status = "connecting";
@@ -435,13 +484,12 @@ class BaseApi {
             this.ws.removeEventListener("error", this.onError);
             this.ws = undefined;
         }
+        // Reset the auth handshake state for the new connection. The token
+        // is sent as the first frame after onOpen, never on the URL.
+        this.authState = "pending";
         try {
-            // Build WebSocket URL with optional token parameter
-            const wsUrl = this.token
-                ? `${this.socketUrl}?token=${this.token}`
-                : this.socketUrl;
-            console.log("SOCKET: connecting to", wsUrl.replace(/token=[^&]*/, "token=***"));
-            this.ws = new WebSocket(wsUrl);
+            console.log("SOCKET: connecting to", this.socketUrl);
+            this.ws = new WebSocket(this.socketUrl);
         }
         catch (e) {
             console.error("[socket creation error]", e);
@@ -465,6 +513,34 @@ class BaseApi {
             return;
         try {
             const obj = JSON.parse(message.data);
+            // Auth handshake frames are addressed by `type`, not by request id.
+            if (obj.type === "auth-ok") {
+                console.log("[socket] auth-ok", obj.default_workspace ?? "");
+                this.authState = "ok";
+                this.lastError = undefined;
+                this.notifyStateChange();
+                // Auth complete — release any requests that were waiting for the
+                // socket to become usable.
+                for (const mid in this.inflight) {
+                    this.inflight[mid].retryNow();
+                }
+                return;
+            }
+            if (obj.type === "auth-failed") {
+                console.warn("[socket] auth-failed", obj.error);
+                this.authState = "failed";
+                this.lastError = obj.error || "auth failure";
+                this.notifyStateChange();
+                // Per the IAM spec the server keeps the socket open so the client
+                // can re-authenticate without reconnecting. Don't auto-close.
+                // Surface the failure to any inflight requests so they don't sit
+                // forever — callers should clear the token and reauth.
+                for (const mid in this.inflight) {
+                    this.inflight[mid].error(new Error("auth failure"));
+                }
+                this.inflight = {};
+                return;
+            }
             // Skip messages without ID (can't route them)
             if (!obj.id)
                 return;
@@ -497,12 +573,19 @@ class BaseApi {
             clearTimeout(this.reconnectTimer);
             this.reconnectTimer = undefined;
         }
-        // Notify UI of successful connection
-        this.notifyStateChange();
-        // Immediately retry any pending requests that were waiting for connection
-        for (const mid in this.inflight) {
-            this.inflight[mid].retryNow();
+        // Send the auth frame as the first message. The server rejects all
+        // non-auth messages until it sends back auth-ok, so we hold off
+        // releasing inflight requests here — that happens in onMessage when
+        // auth-ok arrives.
+        this.authState = "pending";
+        try {
+            this.ws?.send(JSON.stringify({ type: "auth", token: this.token }));
         }
+        catch (e) {
+            console.error("[socket] failed to send auth frame", e);
+        }
+        // Notify UI that we're now in the authenticating phase.
+        this.notifyStateChange();
     }
     // Handle socket errors
     onError(event) {
@@ -605,7 +688,7 @@ class BaseApi {
         const mid = this.getNextId();
         // Set default values
         if (timeout == undefined)
-            timeout = 10000;
+            timeout = 30000;
         if (retries == undefined)
             retries = 3;
         // Construct the request message
@@ -617,6 +700,10 @@ class BaseApi {
         // Add flow identifier if provided
         if (flow)
             msg.flow = flow;
+        // Stamp the active workspace onto the envelope. When empty the
+        // gateway falls back to the token's bound workspace.
+        if (this.workspace)
+            msg.workspace = this.workspace;
         // Return a Promise that will be resolved/rejected by the ServiceCall
         return new Promise((resolve, reject) => {
             const call = new ServiceCall(mid, msg, resolve, reject, timeout, retries, this);
@@ -636,7 +723,7 @@ class BaseApi {
         const mid = this.getNextId();
         // Set defaults
         if (timeout == undefined)
-            timeout = 10000;
+            timeout = 30000;
         if (retries == undefined)
             retries = 3;
         // Construct request message
@@ -647,6 +734,8 @@ class BaseApi {
         };
         if (flow)
             msg.flow = flow;
+        if (this.workspace)
+            msg.workspace = this.workspace;
         return new Promise((resolve, reject) => {
             const call = new ServiceCallMulti(mid, msg, resolve, reject, timeout, retries, this, // eslint-disable-line @typescript-eslint/no-explicit-any
             receiver);
@@ -683,6 +772,166 @@ class BaseApi {
     collectionManagement() {
         return new CollectionManagementApi(this);
     }
+    iam() {
+        return new IamApi(this);
+    }
+}
+/**
+ * IamApi - Identity, user, workspace, and API key management over the
+ * authenticated socket. IAM is the one surface that lives outside
+ * workspace tenancy; these calls run as the `iam` service and the
+ * gateway injects the caller's identity from the connection's token.
+ */
+class IamApi {
+    constructor(api) {
+        this.api = api;
+    }
+    call(req) {
+        return this.api.makeRequest("iam", req);
+    }
+    // --- Identity ---
+    whoami() {
+        return this.call({
+            operation: "whoami",
+        }).then((r) => {
+            const user = r.user ?? {};
+            return {
+                id: String(user.id ?? ""),
+                username: String(user.username ?? ""),
+                name: String(user.name ?? ""),
+                email: String(user.email ?? ""),
+                default_workspace: String(user.default_workspace ?? ""),
+                roles: Array.isArray(user.roles) ? user.roles : [],
+                enabled: !!user.enabled,
+            };
+        });
+    }
+    // --- Users ---
+    listUsers(workspace) {
+        return this.call({
+            operation: "list-users",
+            ...(workspace ? { workspace } : {}),
+        }).then((r) => r.users ?? []);
+    }
+    getUser(userId) {
+        return this.call({
+            operation: "get-user",
+            user_id: userId,
+        }).then((r) => r.user);
+    }
+    createUser(params) {
+        return this.call({
+            operation: "create-user",
+            user: {
+                username: params.username,
+                password: params.password,
+                name: params.name ?? "",
+                email: params.email ?? "",
+                enabled: true,
+                must_change_password: params.must_change_password ?? false,
+                roles: [],
+            },
+            ...(params.workspace ? { workspace: params.workspace } : {}),
+        }).then((r) => r.user);
+    }
+    updateUser(userId, fields) {
+        return this.call({
+            operation: "update-user",
+            user_id: userId,
+            user: fields,
+        }).then((r) => r.user);
+    }
+    enableUser(userId) {
+        return this.call({
+            operation: "enable-user",
+            user_id: userId,
+        }).then(() => { });
+    }
+    disableUser(userId) {
+        return this.call({
+            operation: "disable-user",
+            user_id: userId,
+        }).then(() => { });
+    }
+    deleteUser(userId) {
+        return this.call({
+            operation: "delete-user",
+            user_id: userId,
+        }).then(() => { });
+    }
+    resetPassword(userId) {
+        return this.call({
+            operation: "reset-password",
+            user_id: userId,
+        }).then((r) => r.temporary_password);
+    }
+    changePassword(userId, currentPassword, newPassword) {
+        return this.call({
+            operation: "change-password",
+            user_id: userId,
+            password: currentPassword,
+            new_password: newPassword,
+        }).then(() => { });
+    }
+    // --- Workspaces ---
+    listMyWorkspaces() {
+        return this.call({
+            operation: "list-my-workspaces",
+        }).then((r) => (r.workspaces ?? []).map((w) => ({
+            id: String(w.id ?? ""),
+            name: String(w.name ?? ""),
+            enabled: !!w.enabled,
+            created: String(w.created ?? ""),
+        })));
+    }
+    listWorkspaces() {
+        return this.call({
+            operation: "list-workspaces",
+        }).then((r) => r.workspaces ?? []);
+    }
+    getWorkspace(id) {
+        return this.call({
+            operation: "get-workspace",
+            workspace_record: { id },
+        }).then((r) => r.workspace);
+    }
+    createWorkspace(id, name) {
+        return this.call({
+            operation: "create-workspace",
+            workspace_record: { id, name: name ?? id, enabled: true },
+        }).then((r) => r.workspace);
+    }
+    updateWorkspace(id, fields) {
+        return this.call({
+            operation: "update-workspace",
+            workspace_record: { id, ...fields },
+        }).then((r) => r.workspace);
+    }
+    disableWorkspace(id) {
+        return this.call({
+            operation: "disable-workspace",
+            workspace_record: { id },
+        }).then(() => { });
+    }
+    // --- API Keys ---
+    listApiKeys(userId) {
+        return this.call({
+            operation: "list-api-keys",
+            user_id: userId,
+        }).then((r) => r.api_keys ?? []);
+    }
+    createApiKey(userId, name, expires) {
+        return this.call({
+            operation: "create-api-key",
+            key: { user_id: userId, name, expires: expires ?? "" },
+        }).then((r) => ({ plaintext: r.api_key_plaintext, key: r.api_key }));
+    }
+    revokeApiKey(keyId) {
+        return this.call({
+            operation: "revoke-api-key",
+            key_id: keyId,
+        }).then(() => { });
+    }
 }
 /**
  * LibrarianApi - Manages document storage and retrieval
@@ -921,7 +1170,7 @@ class LibrarianApi {
             const msg = message;
             // Check for top-level error
             if (msg.error) {
-                onError(msg.error);
+                onError(errorToString(msg.error));
                 return true;
             }
             const resp = msg.response;
@@ -1007,17 +1256,30 @@ class FlowsApi {
     deleteConfig(keys) {
         return this.api.makeRequest("config", {
             operation: "delete",
-            keys: keys,
+            keys: [keys],
         }, 30000);
     }
+    /**
+     * Lists available configuration keys for a given type
+     */
+    list(type) {
+        return this.api
+            .makeRequest("config", {
+            operation: "list",
+            type: type,
+        }, 60000)
+            .then((r) => r);
+    }
     // Prompt management - specialized config operations for AI prompts
     /**
-     * Retrieves list of available prompt templates
+     * Retrieves list of available prompt template IDs
      */
     getPrompts() {
-        return this.getConfigAll().then((r) => {
-            const config = r;
-            return JSON.parse(config.config.prompt["template-index"]);
+        return this.list("prompt").then((r) => {
+            const keys = r?.directory || [];
+            return keys
+                .filter((k) => k.startsWith("template."))
+                .map((k) => k.slice("template.".length));
         });
     }
     /**
@@ -1174,17 +1436,19 @@ class FlowApi {
             const msg = message;
             // Check for top-level error
             if (msg.error) {
-                error(msg.error);
+                error(errorToString(msg.error));
                 return true;
             }
             const resp = msg.response || {};
+            // Prefer message_type, fall back to chunk_type for older backends
+            const msgType = resp.message_type || resp.chunk_type;
             // Check for errors in response
-            if (resp.chunk_type === "error" || resp.error) {
+            if (msgType === "error" || resp.error) {
                 error(resp.error?.message || "Unknown agent error");
                 return true; // End streaming on error
             }
-            // Handle explainability events (agent uses chunk_type="explain")
-            if ((resp.chunk_type === "explain" || resp.message_type === "explain") && resp.explain_id && resp.explain_graph) {
+            // Handle explainability events
+            if (msgType === "explain" && resp.explain_id && resp.explain_graph) {
                 onExplain?.({
                     explainId: resp.explain_id,
                     explainGraph: resp.explain_graph,
@@ -1192,7 +1456,7 @@ class FlowApi {
                 });
                 return false;
             }
-            // Handle streaming chunks by chunk_type
+            // Handle streaming chunks by message type
             const content = resp.content || "";
             const messageId = resp.message_id;
             const messageComplete = !!resp.end_of_message;
@@ -1201,7 +1465,7 @@ class FlowApi {
             const metadata = dialogComplete && (resp.in_token || resp.out_token || resp.model)
                 ? { in_token: resp.in_token, out_token: resp.out_token, model: resp.model }
                 : undefined;
-            switch (resp.chunk_type) {
+            switch (msgType) {
                 case "thought":
                     think(content, messageComplete, messageId, metadata);
                     break;
@@ -1225,7 +1489,7 @@ class FlowApi {
             user: this.api.user,
             collection: collection || "default",
             streaming: true, // Always use streaming mode
-        }, receiver, 120000, 2, this.flowId)
+        }, receiver, 180000, 1, this.flowId)
             .catch((err) => {
             const errorMessage = err instanceof Error ? err.message : err?.toString() || "Unknown error";
             error(`Agent request failed: ${errorMessage}`);
@@ -1245,7 +1509,7 @@ class FlowApi {
             const msg = message;
             // Check for top-level error
             if (msg.error) {
-                onError(msg.error);
+                onError(errorToString(msg.error));
                 return true;
             }
             const resp = (msg.response || {});
@@ -1283,7 +1547,7 @@ class FlowApi {
             "max-subgraph-size": options?.maxSubgraphSize,
             "max-path-length": options?.pathLength,
             streaming: true,
-        }, recv, 60000, undefined, this.flowId);
+        }, recv, 180000, 1, this.flowId);
     }
     /**
      * Performs Document RAG query with streaming response
@@ -1298,7 +1562,7 @@ class FlowApi {
             const msg = message;
             // Check for top-level error
             if (msg.error) {
-                onError(msg.error);
+                onError(errorToString(msg.error));
                 return true;
             }
             const resp = (msg.response || {});
@@ -1331,7 +1595,7 @@ class FlowApi {
             collection: collection || "default",
             "doc-limit": docLimit,
             streaming: true,
-        }, recv, 60000, undefined, this.flowId);
+        }, recv, 180000, 1, this.flowId);
     }
     /**
      * Performs text completion with streaming response
@@ -1345,7 +1609,7 @@ class FlowApi {
             const msg = message;
             // Check for top-level error
             if (msg.error) {
-                onError(msg.error);
+                onError(errorToString(msg.error));
                 return true;
             }
             const resp = (msg.response || {});
@@ -1382,7 +1646,7 @@ class FlowApi {
             const msg = message;
             // Check for top-level error
             if (msg.error) {
-                onError(msg.error);
+                onError(errorToString(msg.error));
                 return true;
             }
             const resp = (msg.response || {});
@@ -1403,7 +1667,7 @@ class FlowApi {
         };
         this.api.makeRequestMulti("prompt", {
             id: id,
-            terms: terms,
+            variables: terms,
             streaming: true,
         }, recv, 30000, undefined, this.flowId);
     }
@@ -1448,6 +1712,75 @@ class FlowApi {
         }, 30000, undefined, this.flowId)
             .then((r) => r.response);
     }
+    sparqlQuery(query, collection, limit, batchSize) {
+        const columns = [];
+        const rows = [];
+        let queryType = "select";
+        let askResult;
+        let triples;
+        let sparqlError = null;
+        const termToString = (val) => {
+            if (!val)
+                return "";
+            if (val.t === "i")
+                return val.i;
+            if (val.t === "l")
+                return val.v;
+            return "";
+        };
+        return this.api
+            .makeRequestMulti("sparql", {
+            query,
+            collection: collection || "default",
+            limit: limit ?? 10000,
+            streaming: true,
+            "batch-size": batchSize ?? 50,
+        }, (resp) => {
+            const msg = resp;
+            const batch = msg.response;
+            const isComplete = msg.complete === true;
+            if (!batch)
+                return isComplete;
+            if (batch.error) {
+                sparqlError = typeof batch.error === "string"
+                    ? batch.error
+                    : batch.error.message || "SPARQL query error";
+                return true;
+            }
+            queryType = batch["query-type"] || queryType;
+            if (queryType === "ask") {
+                askResult = batch["ask-result"];
+                return true;
+            }
+            if (queryType === "construct" || queryType === "describe") {
+                triples = batch.triples || [];
+                return true;
+            }
+            if (batch.variables && columns.length === 0) {
+                columns.push(...batch.variables);
+            }
+            if (batch.bindings) {
+                for (const binding of batch.bindings) {
+                    const row = {};
+                    for (let i = 0; i < columns.length; i++) {
+                        row[columns[i]] = termToString(binding.values[i] ?? null);
+                    }
+                    rows.push(row);
+                }
+            }
+            return isComplete;
+        }, 60000, undefined, this.flowId)
+            .then(() => {
+            if (sparqlError)
+                throw new Error(sparqlError);
+            return { queryType, columns, rows, askResult, triples };
+        })
+            .catch((err) => {
+            if (err instanceof Error)
+                throw err;
+            throw new Error(typeof err === "string" ? err : JSON.stringify(err));
+        });
+    }
     /**
      * Loads a document into this flow for processing
      */
@@ -1596,17 +1929,19 @@ class ConfigApi {
     deleteConfig(keys) {
         return this.api.makeRequest("config", {
             operation: "delete",
-            keys: keys,
+            keys: [keys],
         }, 30000);
     }
     // Specialized prompt management methods
     /**
-     * Retrieves available prompt templates
+     * Retrieves available prompt template IDs
      */
     getPrompts() {
-        return this.getConfigAll().then((r) => {
-            const config = r;
-            return JSON.parse(config.config.prompt["template-index"]);
+        return this.list("prompt").then((r) => {
+            const keys = r?.directory || [];
+            return keys
+                .filter((k) => k.startsWith("template."))
+                .map((k) => k.slice("template.".length));
         });
     }
     /**
@@ -1824,15 +2159,73 @@ class CollectionManagementApi {
     }
 }
 /**
- * Factory function to create a new TrustGraph WebSocket connection
- * This is the main entry point for using the TrustGraph API
- * @param user - User identifier for API requests
- * @param token - Optional authentication token for secure connections
- * @param socketUrl - Optional WebSocket URL (defaults to /api/socket for browser, provide full URL for Node.js)
+ * Factory function to create a new TrustGraph WebSocket connection.
+ * The token (JWT or API key) is sent as the first frame after connect;
+ * the gateway derives the user identity and workspace from it.
+ *
+ * @param token - Bearer token (JWT from /auth/login or an API key)
+ * @param socketUrl - Optional WebSocket URL (defaults to /api/v1/socket
+ *   for browser, provide full URL for Node.js)
  */
-const createTrustGraphSocket = (user, token, socketUrl) => {
-    return new BaseApi(user, token, socketUrl);
+const createTrustGraphSocket = (token, socketUrl) => {
+    return new BaseApi(token, socketUrl);
 };
 
-export { BaseApi, CollectionManagementApi, ConfigApi, FlowApi, FlowsApi, KnowledgeApi, LibrarianApi, PROV, PROV_ACTIVITY, PROV_ENTITY, PROV_STARTED_AT_TIME, PROV_WAS_DERIVED_FROM, PROV_WAS_GENERATED_BY, RDF, RDFS, RDFS_LABEL, RDF_TYPE, SCHEMA, SCHEMA_AUTHOR, SCHEMA_DESCRIPTION, SCHEMA_KEYWORDS, SCHEMA_NAME, SKOS, SKOS_DEFINITION, TG, TG_CONTENT, TG_DOCUMENT, TG_EDGE, TG_EDGE_COUNT, TG_QUERY, TG_REASONING, TG_REIFIES, TG_SELECTED_EDGE, createTrustGraphSocket };
+// HTTP auth client for the TrustGraph IAM gateway endpoints.
+//
+// These endpoints run before the WebSocket exists, so they use plain
+// fetch rather than the socket transport.
+const DEFAULT_BOOTSTRAP_STATUS_URL = "/api/v1/auth/bootstrap-status";
+const DEFAULT_LOGIN_URL = "/api/v1/auth/login";
+class AuthError extends Error {
+    constructor(message, status) {
+        super(message);
+        this.name = "AuthError";
+        this.status = status;
+    }
+}
+class AuthApi {
+    constructor(options = {}) {
+        this.bootstrapStatusUrl =
+            options.bootstrapStatusUrl ?? DEFAULT_BOOTSTRAP_STATUS_URL;
+        this.loginUrl = options.loginUrl ?? DEFAULT_LOGIN_URL;
+        this.fetchImpl = options.fetchImpl ?? fetch.bind(globalThis);
+    }
+    async bootstrapStatus() {
+        const resp = await this.fetchImpl(this.bootstrapStatusUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: "{}",
+        });
+        if (!resp.ok) {
+            throw new AuthError(`bootstrap-status failed: ${resp.status}`, resp.status);
+        }
+        const body = await resp.json();
+        return { bootstrapAvailable: !!body.bootstrap_available };
+    }
+    async login(username, password, default_workspace) {
+        const payload = { username, password };
+        if (default_workspace)
+            payload.default_workspace = default_workspace;
+        const resp = await this.fetchImpl(this.loginUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(payload),
+        });
+        if (resp.status === 401) {
+            throw new AuthError("auth failure", 401);
+        }
+        if (!resp.ok) {
+            throw new AuthError(`login failed: ${resp.status}`, resp.status);
+        }
+        const body = await resp.json();
+        if (!body.jwt) {
+            throw new AuthError("login response missing jwt");
+        }
+        return { jwt: body.jwt, jwtExpires: body.jwt_expires ?? "" };
+    }
+}
+const createAuthApi = (options) => new AuthApi(options);
+
+export { AuthApi, AuthError, BaseApi, CollectionManagementApi, ConfigApi, FlowApi, FlowsApi, IamApi, KnowledgeApi, LibrarianApi, PROV, PROV_ACTIVITY, PROV_ENTITY, PROV_STARTED_AT_TIME, PROV_WAS_DERIVED_FROM, PROV_WAS_GENERATED_BY, RDF, RDFS, RDFS_LABEL, RDF_TYPE, SCHEMA, SCHEMA_AUTHOR, SCHEMA_DESCRIPTION, SCHEMA_KEYWORDS, SCHEMA_NAME, SKOS, SKOS_DEFINITION, TG, TG_CONCEPT, TG_CONTENT, TG_DOCUMENT, TG_EDGE, TG_EDGE_COUNT, TG_QUERY, TG_REIFIES, TG_SCORE, TG_SELECTED_EDGE, createAuthApi, createTrustGraphSocket };
 //# sourceMappingURL=index.esm.js.map