@unboundcx/sdk 4.13.110 → 4.13.112-security.0

package/base.js

@@ -13,6 +13,8 @@
  * npm install mime-types
  */
 
+import { handleUnauthorized } from './lib/refreshInterceptor.js';
+
 const requestBySdk = new WeakMap();
 const SDK_REQUEST = Symbol.for('unbound.sdk.request');
 
@@ -49,12 +51,33 @@ export class BaseSDK {
       this.fwRequestId = arguments[3];
     } else {
       // New object-based parameters
-      const { namespace, callId, token, fwRequestId, baseURL } = options;
+      const {
+        namespace,
+        callId,
+        token,
+        fwRequestId,
+        baseURL,
+        autoRefresh,
+        onUnauthorized,
+        refreshToken,
+      } = options;
       this.namespace = namespace || process?.env?.namespace;
       this.callId = callId;
       this.token = token;
       this.fwRequestId = fwRequestId;
       this._constructorBaseURL = baseURL;
+      // api#222 -- opt-in only (default false): existing callers get no
+      // behavior change. When on, a 401 from any non-/login* endpoint
+      // triggers one single-flight refresh + one retry (lib/refreshInterceptor.js).
+      this._autoRefresh = autoRefresh === true;
+      this._onUnauthorized =
+        typeof onUnauthorized === 'function' ? onUnauthorized : null;
+      // Bearer-delivery clients only: the raw refresh token, so autoRefresh
+      // has something to send to POST /login/refresh (cookie clients rely
+      // on the browser's own refreshToken cookie and never need this).
+      // Seeded via this option or setRefreshToken(); updated in place on
+      // every rotation by lib/refreshInterceptor.js.
+      this._refreshToken = refreshToken;
     }
     this.baseURL;
     this.transports = new Map();
@@ -104,6 +127,10 @@ export class BaseSDK {
     this.token = token;
   }
 
+  setRefreshToken(refreshToken) {
+    this._refreshToken = refreshToken;
+  }
+
   setNamespace(namespace) {
     this.namespace = namespace;
     const defaultDomain = 'api.unbound.cx';
@@ -278,6 +305,7 @@ export class BaseSDK {
           params,
           returnRawResponse,
           startTime,
+          forceFetch,
         );
       }
     } else {
@@ -292,6 +320,7 @@ export class BaseSDK {
         params,
         returnRawResponse,
         startTime,
+        forceFetch,
       );
     }
 
@@ -307,6 +336,7 @@ export class BaseSDK {
       method,
       endpoint,
       duration,
+      { originalParams: params, forceFetch },
     );
   }
 
@@ -357,6 +387,7 @@ export class BaseSDK {
     params = {},
     returnRawResponse = false,
     startTime = Date.now(),
+    forceFetch = false,
   ) {
     const { body, query, headers = {} } = params;
 
@@ -438,10 +469,20 @@ export class BaseSDK {
       return response;
     }
 
-    return this._processResponse(response, 'https', method, endpoint, duration);
+    return this._processResponse(response, 'https', method, endpoint, duration, {
+      originalParams: params,
+      forceFetch,
+    });
   }
 
-  async _processResponse(response, transport, method, endpoint, duration = 0) {
+  async _processResponse(
+    response,
+    transport,
+    method,
+    endpoint,
+    duration = 0,
+    retryCtx = {},
+  ) {
     // Check if the response indicates an HTTP error
     // These are API/configuration errors, not transport failures
 
@@ -518,6 +559,27 @@ export class BaseSDK {
         );
       }
 
+      // api#222 -- opt-in single-flight refresh + one retry on 401. Off by
+      // default (this._autoRefresh set only via the `autoRefresh` ctor
+      // option); the retry's own params carry `__skipAutoRefresh` so a 401
+      // on the RETRY itself always falls through to onUnauthorized instead
+      // of looping.
+      if (response.status === 401 && this._autoRefresh) {
+        return handleUnauthorized(this, {
+          status: response.status,
+          endpoint,
+          alreadyRetried: retryCtx?.originalParams?.__skipAutoRefresh === true,
+          originalError: httpError,
+          retry: () =>
+            this.#request(
+              endpoint,
+              method,
+              { ...(retryCtx.originalParams || {}), __skipAutoRefresh: true },
+              retryCtx.forceFetch,
+            ),
+        });
+      }
+
       throw httpError;
     }
 

package/index.js

@@ -38,6 +38,7 @@ import { FaxService } from './services/fax.js';
 import { DocumentsService } from './services/documents.js';
 import { EsignService } from './services/esign.js';
 import { PermissionsService } from './services/permissions.js';
+import { LicensesService } from './services/licenses.js';
 import { UsersService } from './services/users.js';
 import { TriggersService } from './services/triggers.js';
 import { RecentsService } from './services/recents.js';
@@ -138,6 +139,7 @@ class UnboundSDK extends BaseSDK {
     this.documents = new DocumentsService(this);
     this.esign = new EsignService(this);
     this.permissions = new PermissionsService(this);
+    this.licenses = new LicensesService(this);
     this.users = new UsersService(this);
     this.reporting = new ReportingService(this);
     this.triggers = new TriggersService(this);
@@ -344,6 +346,7 @@ export { KnowledgeBaseService } from './services/knowledgeBase.js';
 export { FaxService } from './services/fax.js';
 export { EsignService, EsignPublicService } from './services/esign.js';
 export { PermissionsService } from './services/permissions.js';
+export { LicensesService } from './services/licenses.js';
 export { UsersService } from './services/users.js';
 export { ReportingService } from './services/reporting.js';
 export { RecentsService } from './services/recents.js';

package/lib/refreshInterceptor.js

@@ -0,0 +1,106 @@
+// api#222 client contract -- single-flight 401 -> refresh -> retry-once.
+// base.js's `#request` funnels BOTH the Socket.IO transport and the plain
+// HTTP fallback through the same `_processResponse` (see base.js), so this
+// one hook covers every transport without a per-transport copy.
+//
+// Usage (base.js only -- app code never imports this directly):
+//   handleUnauthorized(sdk, { status, endpoint, retry, originalError })
+//
+// `retry` is a caller-supplied () => Promise that re-issues the ORIGINAL
+// request. It has to come from the caller because #request is a private
+// class field method -- this module can't call it directly.
+
+// Keyed per SDK instance: a shared module-level variable would let one
+// SDK instance's refresh starve a concurrent, unrelated SDK instance's own
+// 401 recovery (a different user/session in the same Node process -- the
+// API itself increasingly consumes this SDK server-side). Each instance
+// still single-flights its own concurrent 401s against itself.
+const inFlightRefreshBySdk = new WeakMap();
+
+function isLoginRoute(endpoint) {
+  return typeof endpoint === 'string' && endpoint.startsWith('/login');
+}
+
+export function shouldAttemptRefresh(sdk, status, endpoint) {
+  return (
+    status === 401 &&
+    sdk?._autoRefresh === true &&
+    !isLoginRoute(endpoint) &&
+    typeof sdk?.login?.refresh === 'function'
+  );
+}
+
+async function runRefresh(sdk) {
+  let inFlight = inFlightRefreshBySdk.get(sdk);
+  if (!inFlight) {
+    // Bearer clients (constructed with a raw token, no browser cookie jar)
+    // have to hand their raw refresh token back on every call -- the SDK
+    // never gets one implicitly the way a cookie client's browser does.
+    // sdk._refreshToken is set from login/refresh's own response below, or
+    // may be seeded via sdk.setRefreshToken() by a caller that obtained it
+    // out of band. Cookie clients simply have no stored value: `undefined`
+    // is fine, refresh() omits body.refreshToken and relies on the cookie.
+    inFlight = sdk.login
+      .refresh(sdk._refreshToken)
+      .then((result) => {
+        // Bearer clients get a new access token AND a new (rotated) refresh
+        // token back in the body; cookie clients rely on the Set-Cookie
+        // pair the refresh response already sent -- there is no token
+        // string to apply to the SDK instance for them.
+        if (result?.token) sdk.setToken(result.token);
+        if (result?.refreshToken) sdk._refreshToken = result.refreshToken;
+        return result;
+      })
+      .finally(() => {
+        inFlightRefreshBySdk.delete(sdk);
+      });
+    inFlightRefreshBySdk.set(sdk, inFlight);
+  }
+  return inFlight;
+}
+
+function notifyUnauthorized(sdk, err) {
+  if (typeof sdk?._onUnauthorized !== 'function') return;
+  try {
+    sdk._onUnauthorized(err);
+  } catch (callbackErr) {
+    console.error(
+      'refreshInterceptor :: onUnauthorized callback threw ::',
+      callbackErr,
+    );
+  }
+}
+
+/**
+ * @param {object} sdk
+ * @param {object} ctx
+ * @param {number} ctx.status
+ * @param {string} ctx.endpoint
+ * @param {() => Promise<any>} ctx.retry
+ * @param {Error} ctx.originalError -- rethrown whenever refresh isn't
+ *   attempted, fails, or the retry itself still comes back 401 (never loop
+ *   past one retry).
+ * @param {boolean} [ctx.alreadyRetried]
+ */
+export async function handleUnauthorized(
+  sdk,
+  { status, endpoint, retry, originalError, alreadyRetried = false },
+) {
+  if (alreadyRetried || !shouldAttemptRefresh(sdk, status, endpoint)) {
+    throw originalError;
+  }
+
+  try {
+    await runRefresh(sdk);
+  } catch (refreshErr) {
+    notifyUnauthorized(sdk, originalError);
+    throw originalError;
+  }
+
+  try {
+    return await retry();
+  } catch (retryErr) {
+    if (retryErr?.status === 401) notifyUnauthorized(sdk, retryErr);
+    throw retryErr;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unboundcx/sdk",
-  "version": "4.13.110",
+  "version": "4.13.112-security.0",
   "description": "Official JavaScript SDK for the Unbound API - A comprehensive toolkit for integrating with Unbound's communication, AI, and data management services",
   "main": "index.js",
   "type": "module",
@@ -40,6 +40,7 @@
     "*.js",
     "services/**/*.js",
     "transports/**/*.js",
+    "lib/**/*.js",
     "types/**/*.d.ts",
     "proto/**/*.proto",
     "schemas/**/*.js",

package/services/licenses.js

@@ -0,0 +1,330 @@
+import { internalRequest } from '../base.js';
+
+/**
+ * Entitlements / license administration (W2, plan §2 frozen contract).
+ * Tenant-admin methods hit `/permissions/*` (admin:license:manage /
+ * admin:user:manage, real guard in the controller). Brand-owner methods
+ * hit `/permissions/brand/*` (requireBrandOwner + brandId ownership
+ * check, 2D). Neither is tenant-writable for seats/overrides/AI --
+ * those live under `/internal/authz/*` for account-builder/billing and
+ * are not exposed here.
+ */
+export class LicensesService {
+  constructor(sdk) {
+    this.sdk = sdk;
+  }
+
+  /**
+   * Get the tenant's license catalog: license types, seat usage, and the
+   * capability catalog.
+   * @returns {Promise<Object>} `{ mode, licenseTypes[], capabilities[] }`
+   * @example
+   * const { licenseTypes } = await sdk.licenses.getCatalog();
+   */
+  async getCatalog() {
+    return internalRequest(this.sdk, '/permissions/licenses', 'GET');
+  }
+
+  /**
+   * List users stuck in `needs_seat` (no free seat at assign time).
+   * @param {string} [licenseTypeCode] - Filter to one license type
+   * @returns {Promise<Object>} `{ results: [{ userId, licenseTypeCode, source, createdAt }] }`
+   * @example
+   * const { results } = await sdk.licenses.listNeedsSeat('license.support');
+   */
+  async listNeedsSeat(licenseTypeCode) {
+    const params = licenseTypeCode ? { query: { licenseTypeCode } } : {};
+    return internalRequest(
+      this.sdk,
+      '/permissions/licenses/needs-seat',
+      'GET',
+      params,
+    );
+  }
+
+  /**
+   * Get one user's licenses and resolved entitlements.
+   * @param {string} userId
+   * @returns {Promise<Object>} `{ licenses[], capabilities[], disabledCapabilities[], licenseGate }`
+   * @example
+   * await sdk.licenses.getUserLicenses('user-123');
+   */
+  async getUserLicenses(userId) {
+    this.sdk.validateParams(
+      { userId },
+      { userId: { type: 'string', required: true } },
+    );
+    return internalRequest(
+      this.sdk,
+      `/permissions/users/${userId}/licenses`,
+      'GET',
+    );
+  }
+
+  /**
+   * Assign a license directly to a user. 409s with
+   * `code:'seat_limit_reached'` at capacity or `code:'license_type_disabled'`
+   * for a disabled type.
+   * @param {string} userId
+   * @param {string} licenseTypeCode
+   * @returns {Promise<Object>} The assigned license row
+   * @example
+   * await sdk.licenses.assignUserLicense('user-123', 'license.core');
+   */
+  async assignUserLicense(userId, licenseTypeCode) {
+    this.sdk.validateParams(
+      { userId, licenseTypeCode },
+      {
+        userId: { type: 'string', required: true },
+        licenseTypeCode: { type: 'string', required: true },
+      },
+    );
+    return internalRequest(
+      this.sdk,
+      `/permissions/users/${userId}/licenses`,
+      'POST',
+      { body: { licenseTypeCode } },
+    );
+  }
+
+  /**
+   * Remove a user's direct license grant (group-sourced grants are
+   * unaffected -- see `recomputeUserLicenses`).
+   * @param {string} userId
+   * @param {string} licenseTypeCode
+   * @returns {Promise<Object>}
+   * @example
+   * await sdk.licenses.removeUserLicense('user-123', 'license.core');
+   */
+  async removeUserLicense(userId, licenseTypeCode) {
+    this.sdk.validateParams(
+      { userId, licenseTypeCode },
+      {
+        userId: { type: 'string', required: true },
+        licenseTypeCode: { type: 'string', required: true },
+      },
+    );
+    return internalRequest(
+      this.sdk,
+      `/permissions/users/${userId}/licenses/${licenseTypeCode}`,
+      'DELETE',
+    );
+  }
+
+  /**
+   * Get a group's license types (group-sourced grants fan out to members).
+   * @param {string} groupId
+   * @returns {Promise<Object>} `{ licenseTypeCodes: [] }`
+   * @example
+   * await sdk.licenses.getGroupLicenses('group-123');
+   */
+  async getGroupLicenses(groupId) {
+    this.sdk.validateParams(
+      { groupId },
+      { groupId: { type: 'string', required: true } },
+    );
+    return internalRequest(
+      this.sdk,
+      `/permissions/groups/${groupId}/licenses`,
+      'GET',
+    );
+  }
+
+  /**
+   * Replace a group's license types. Triggers a `recomputeUserLicenses`
+   * fan-out for every member.
+   * @param {string} groupId
+   * @param {string[]} licenseTypeCodes
+   * @returns {Promise<Object>}
+   * @example
+   * await sdk.licenses.setGroupLicenses('group-123', ['license.core']);
+   */
+  async setGroupLicenses(groupId, licenseTypeCodes) {
+    this.sdk.validateParams(
+      { groupId, licenseTypeCodes },
+      {
+        groupId: { type: 'string', required: true },
+        licenseTypeCodes: { type: 'array', required: true },
+      },
+    );
+    return internalRequest(
+      this.sdk,
+      `/permissions/groups/${groupId}/licenses`,
+      'PUT',
+      { body: { licenseTypeCodes } },
+    );
+  }
+
+  /**
+   * Set a user's active/disabled status (W1-3). Disabling bumps the
+   * user's token_version and logs them out of every queue.
+   * @param {string} userId
+   * @param {'active'|'disabled'} status
+   * @returns {Promise<Object>}
+   * @example
+   * await sdk.licenses.setUserStatus('user-123', 'disabled');
+   */
+  async setUserStatus(userId, status) {
+    this.sdk.validateParams(
+      { userId, status },
+      {
+        userId: { type: 'string', required: true },
+        status: { type: 'string', required: true },
+      },
+    );
+    return internalRequest(
+      this.sdk,
+      `/permissions/users/${userId}/status`,
+      'PUT',
+      { body: { status } },
+    );
+  }
+
+  // -- Brand-owner methods (requireBrandOwner; 2D api routes) --------------
+
+  /**
+   * Brand owner: list the tenant accounts under this brand, with their
+   * seats and overrides.
+   * @returns {Promise<Object>} `{ accounts: [{ id, name, code, aiEnabled, seats[], overrides[] }] }`
+   * @example
+   * const { accounts } = await sdk.licenses.listBrandAccounts();
+   */
+  async listBrandAccounts() {
+    return internalRequest(this.sdk, '/permissions/brand/accounts', 'GET');
+  }
+
+  /**
+   * Brand owner: get one brand account's entitlements.
+   * @param {string} accountId
+   * @returns {Promise<Object>} `{ id, name, code, aiEnabled, seats[], overrides[] }`
+   * @example
+   * await sdk.licenses.getBrandAccountEntitlements('acct-123');
+   */
+  async getBrandAccountEntitlements(accountId) {
+    this.sdk.validateParams(
+      { accountId },
+      { accountId: { type: 'string', required: true } },
+    );
+    return internalRequest(
+      this.sdk,
+      `/permissions/brand/accounts/${accountId}/entitlements`,
+      'GET',
+    );
+  }
+
+  /**
+   * Brand owner: set a brand account's seat pool for one license type.
+   * @param {string} accountId
+   * @param {string} licenseTypeCode
+   * @param {Object} seats
+   * @param {number} seats.seatCount
+   * @param {boolean} [seats.enabled]
+   * @param {boolean} [seats.isDefaultForNewUsers]
+   * @returns {Promise<Object>}
+   * @example
+   * await sdk.licenses.setBrandAccountSeats('acct-123', 'license.core', { seatCount: 25 });
+   */
+  async setBrandAccountSeats(
+    accountId,
+    licenseTypeCode,
+    { seatCount, enabled, isDefaultForNewUsers } = {},
+  ) {
+    this.sdk.validateParams(
+      { accountId, licenseTypeCode, seatCount },
+      {
+        accountId: { type: 'string', required: true },
+        licenseTypeCode: { type: 'string', required: true },
+        seatCount: { type: 'number', required: true },
+      },
+    );
+    const body = { seatCount };
+    if (enabled !== undefined) body.enabled = enabled;
+    if (isDefaultForNewUsers !== undefined)
+      body.isDefaultForNewUsers = isDefaultForNewUsers;
+    return internalRequest(
+      this.sdk,
+      `/permissions/brand/accounts/${accountId}/license-seats/${licenseTypeCode}`,
+      'PUT',
+      { body },
+    );
+  }
+
+  /**
+   * Brand owner: enable or disable a capability override for a brand
+   * account.
+   * @param {string} accountId
+   * @param {string} capabilityCode
+   * @param {Object} override
+   * @param {'enable'|'disable'} override.mode
+   * @param {string} [override.reason]
+   * @returns {Promise<Object>}
+   * @example
+   * await sdk.licenses.setBrandAccountOverride('acct-123', 'capability.chat', { mode: 'disable', reason: 'trial ended' });
+   */
+  async setBrandAccountOverride(accountId, capabilityCode, { mode, reason } = {}) {
+    this.sdk.validateParams(
+      { accountId, capabilityCode, mode },
+      {
+        accountId: { type: 'string', required: true },
+        capabilityCode: { type: 'string', required: true },
+        mode: { type: 'string', required: true },
+      },
+    );
+    const body = { mode };
+    if (reason !== undefined) body.reason = reason;
+    return internalRequest(
+      this.sdk,
+      `/permissions/brand/accounts/${accountId}/capability-overrides/${capabilityCode}`,
+      'PUT',
+      { body },
+    );
+  }
+
+  /**
+   * Brand owner: remove a capability override, reverting to the license
+   * template default.
+   * @param {string} accountId
+   * @param {string} capabilityCode
+   * @returns {Promise<Object>}
+   * @example
+   * await sdk.licenses.deleteBrandAccountOverride('acct-123', 'capability.chat');
+   */
+  async deleteBrandAccountOverride(accountId, capabilityCode) {
+    this.sdk.validateParams(
+      { accountId, capabilityCode },
+      {
+        accountId: { type: 'string', required: true },
+        capabilityCode: { type: 'string', required: true },
+      },
+    );
+    return internalRequest(
+      this.sdk,
+      `/permissions/brand/accounts/${accountId}/capability-overrides/${capabilityCode}`,
+      'DELETE',
+    );
+  }
+
+  /**
+   * Brand owner: turn the account's AI features on/off.
+   * @param {string} accountId
+   * @param {boolean} enabled
+   * @returns {Promise<Object>}
+   * @example
+   * await sdk.licenses.setBrandAccountAiEnabled('acct-123', true);
+   */
+  async setBrandAccountAiEnabled(accountId, enabled) {
+    this.sdk.validateParams(
+      { accountId, enabled },
+      {
+        accountId: { type: 'string', required: true },
+        enabled: { type: 'boolean', required: true },
+      },
+    );
+    return internalRequest(
+      this.sdk,
+      `/permissions/brand/accounts/${accountId}/ai-enabled`,
+      'PUT',
+      { body: { enabled } },
+    );
+  }
+}

package/services/login.js

@@ -29,14 +29,35 @@ export class LoginService {
       }
     }
 
+    // api#222: bearer clients get refreshToken back on /login too (same
+    // contract as /login/refresh) -- seed it onto the sdk instance so
+    // autoRefresh has something to send on the very first refresh, and
+    // also return it for a caller that manages the token itself.
+    if (login?.refreshToken) this.sdk.setRefreshToken(login.refreshToken);
+
     return {
       valid: true,
       userId: login.userId,
       namespace: login.namespace,
       url: login.url,
+      refreshToken: login.refreshToken,
     };
   }
 
+  // api#222. Cookie clients: no args -- the refreshToken cookie is sent
+  // automatically and the new authToken/refreshToken cookies come back on
+  // the response, nothing to apply to the SDK instance. Bearer clients:
+  // pass the refresh token string; the response's `token` is returned so
+  // the caller (or lib/refreshInterceptor.js) can call sdk.setToken(token).
+  // Always forceFetch (true): refresh exists to recover a dead session, so
+  // it must never ride a socket transport that itself depends on that
+  // session still being alive.
+  async refresh(refreshToken) {
+    const options = {};
+    if (refreshToken) options.body = { refreshToken };
+    return internalRequest(this.sdk, '/login/refresh', 'POST', options, true);
+  }
+
   async logout() {
     const logout = await internalRequest(this.sdk, '/login', 'DELETE', {}, true);
 

package/services/objects.js

@@ -1416,44 +1416,4 @@ export class ObjectsService {
       { body: {} },
     );
   }
-
-  /**
-   * P7 (workflows-v2-plan.md W10/W11/W23) -- runs an immediate full
-   * enter+exit sweep for a journey program. Same diff-and-enqueue path a
-   * scheduled tick runs, so this can never 429.
-   * @param {string} programId
-   * @returns {Promise<{queued: true, enterEnqueued: number, exitEnqueued: number}>}
-   */
-  async runMarketingProgramNow(programId) {
-    this.sdk.validateParams(
-      { programId },
-      { programId: { type: 'string', required: true } },
-    );
-    return internalRequest(
-      this.sdk,
-      `/object/marketing-programs/${programId}/run`,
-      'POST',
-      { body: {} },
-    );
-  }
-
-  /**
-   * P7 -- paginated member list for a journey program (joined to people
-   * for display name; never raw peopleId).
-   * @param {string} programId
-   * @param {{nextId?: string, limit?: number}} [opts]
-   * @returns {Promise<{results: object[], pagination: object}>}
-   */
-  async listMarketingProgramMembers(programId, opts = {}) {
-    this.sdk.validateParams(
-      { programId },
-      { programId: { type: 'string', required: true } },
-    );
-    return internalRequest(
-      this.sdk,
-      `/object/marketing-programs/${programId}/members`,
-      'GET',
-      { query: opts },
-    );
-  }
 }

package/services/workflows.js

@@ -1,20 +1,31 @@
 import { internalRequest } from '../base.js';
-import { WorkflowToolsService, WorkflowMcpTokensService } from './workflowTools.js';
-
 export class WorkflowsService {
   constructor(sdk) {
     this.sdk = sdk;
     this.items = new WorkflowItemsService(sdk);
     this.connections = new WorkflowConnectionsService(sdk);
     this.sessions = new WorkflowSessionsService(sdk);
-    // P5: MCP tools/tokens surface (workflows-v2-plan.md "REST twin + SDK" row).
-    this.tools = new WorkflowToolsService(sdk);
-    this.mcpTokens = new WorkflowMcpTokensService(sdk);
   }
 
-  async listModules({ workflowType } = {}) {
+  async getSettings(type) {
+    this.sdk.validateParams(
+      { type },
+      {
+        type: { type: 'string', required: true },
+      },
+    );
+
     const params = {
-      query: workflowType ? { workflowType } : {},
+      query: { type },
+    };
+
+    const result = await internalRequest(this.sdk, '/workflows/settings', 'GET', params);
+    return result;
+  }
+
+  async listModules() {
+    const params = {
+      query: {},
     };
 
     const result = await internalRequest(this.sdk, '/workflows/modules', 'GET', params);
@@ -96,48 +107,6 @@ export class WorkflowsService {
     );
     return result;
   }
-
-  // Delete guard (soft-delete workflows / hard-delete draft versions):
-  // resolves everything a workflow (or a specific draft version) is
-  // referenced by, so the client can block the delete with a named list
-  // instead of a generic FK error. Exactly one of workflowId/
-  // workflowVersionId is expected.
-  async references({ workflowId, workflowVersionId } = {}) {
-    this.sdk.validateParams(
-      { workflowId, workflowVersionId },
-      {
-        workflowId: { type: 'string', required: false },
-        workflowVersionId: { type: 'string', required: false },
-      },
-    );
-
-    const query = {};
-    if (workflowId) query.workflowId = workflowId;
-    if (workflowVersionId) query.workflowVersionId = workflowVersionId;
-
-    const result = await internalRequest(this.sdk, '/workflows/references', 'GET', {
-      query,
-    });
-    return result;
-  }
-
-  // P6 §6 — variable catalogue (inputs/system/context/module outputs) for
-  // the designer's `{{` autocomplete + variables panel.
-  async variables(versionId) {
-    this.sdk.validateParams(
-      { versionId },
-      {
-        versionId: { type: 'string', required: true },
-      },
-    );
-
-    const result = await internalRequest(
-      this.sdk,
-      `/workflows/${versionId}/variables`,
-      'GET',
-    );
-    return result;
-  }
 }
 
 export class WorkflowItemsService {
@@ -434,10 +403,11 @@ export class WorkflowSessionsService {
       },
     );
 
-    return this.sdk.objects.byId({
-      object: 'workflowSessions',
-      id: sessionId,
-    });
+    const result = await internalRequest(this.sdk, 
+      `/workflows/sessions/${sessionId}`,
+      'GET',
+    );
+    return result;
   }
 
   async update(sessionId, updateData) {
@@ -461,25 +431,17 @@ export class WorkflowSessionsService {
     return result;
   }
 
-  /**
-   * @param {string} sessionId
-   * @param {string} [reason] - passed through as body.reason -- the
-   *   sessionComplete.js controller already accepts this (defaults to
-   *   'completed' server-side); P7's exitProgramMember.js passes
-   *   'programExit'. Backward compatible -- omitting it is unchanged.
-   */
-  async complete(sessionId, reason) {
+  async complete(sessionId) {
     this.sdk.validateParams(
-      { sessionId, reason },
+      { sessionId },
       {
         sessionId: { type: 'string', required: true },
-        reason: { type: 'string', required: false },
       },
     );
 
-    const params = reason ? { body: { reason } } : {};
+    const params = {};
 
-    const result = await internalRequest(this.sdk,
+    const result = await internalRequest(this.sdk, 
       `/workflows/session/${sessionId}/complete`,
       'PUT',
       params,
@@ -487,6 +449,21 @@ export class WorkflowSessionsService {
     return result;
   }
 
+  async delete(sessionId) {
+    this.sdk.validateParams(
+      { sessionId },
+      {
+        sessionId: { type: 'string', required: true },
+      },
+    );
+
+    const result = await internalRequest(this.sdk, 
+      `/workflows/sessions/${sessionId}`,
+      'DELETE',
+    );
+    return result;
+  }
+
   async logTranscript(sessionId, transcriptData) {
     this.sdk.validateParams(
       { sessionId },
@@ -536,41 +513,11 @@ export class WorkflowSessionsService {
       query: { startDate, endDate },
     };
 
-    const result = await internalRequest(this.sdk,
+    const result = await internalRequest(this.sdk, 
       `/workflows/${workflowVersionId}/analytics`,
       'GET',
       params,
     );
     return result;
   }
-
-  // P10 click-to-filter: GET /workflows/:workflowVersionId/sessions ->
-  // {sessionIds}. filter is {workflowItemId?, fromItemId?, toItemId?,
-  // startDate?, endDate?} -- workflowItemId alone, or fromItemId+toItemId
-  // together, is required (validated server-side in sessionsByPath.js).
-  async sessionsByPath(workflowVersionId, filter = {}) {
-    this.sdk.validateParams(
-      { workflowVersionId },
-      {
-        workflowVersionId: { type: 'string', required: true },
-      },
-    );
-
-    const { workflowItemId, fromItemId, toItemId, startDate, endDate } =
-      filter || {};
-    const query = {};
-    if (workflowItemId) query.workflowItemId = workflowItemId;
-    if (fromItemId) query.fromItemId = fromItemId;
-    if (toItemId) query.toItemId = toItemId;
-    if (startDate) query.startDate = startDate;
-    if (endDate) query.endDate = endDate;
-
-    const result = await internalRequest(
-      this.sdk,
-      `/workflows/${workflowVersionId}/sessions`,
-      'GET',
-      { query },
-    );
-    return result;
-  }
 }

package/services/workflowTools.js

@@ -1,74 +0,0 @@
-import { internalRequest } from '../base.js';
-
-// P5 "REST twin + SDK" / "Auth" rows: workflows.tools.{list,call} +
-// workflows.mcpTokens.{create,list,revoke}. Kept in its own file (repo
-// file-size convention) rather than growing workflows.js further.
-
-export class WorkflowToolsService {
-  constructor(sdk) {
-    this.sdk = sdk;
-  }
-
-  // GET /workflows/tools -> [{name, description, inputSchema, outputSchema, annotations}]
-  async list() {
-    const result = await internalRequest(this.sdk, '/workflows/tools', 'GET');
-    return result;
-  }
-
-  // POST /workflows/tools/:slug/call -> {completed, outputs, isError, message, sessionId}
-  async call(slug, input) {
-    this.sdk.validateParams(
-      { slug },
-      { slug: { type: 'string', required: true } },
-    );
-
-    const params = { body: { input: input || {} } };
-    const result = await internalRequest(
-      this.sdk,
-      `/workflows/tools/${slug}/call`,
-      'POST',
-      params,
-    );
-    return result;
-  }
-}
-
-export class WorkflowMcpTokensService {
-  constructor(sdk) {
-    this.sdk = sdk;
-  }
-
-  // POST /workflows/mcp/tokens -> {id, token, name} -- `token` (the raw
-  // JWT) is shown exactly once, never retrievable again.
-  async create({ name } = {}) {
-    const params = { body: name ? { name } : {} };
-    const result = await internalRequest(
-      this.sdk,
-      '/workflows/mcp/tokens',
-      'POST',
-      params,
-    );
-    return result;
-  }
-
-  // GET /workflows/mcp/tokens -> {tokens: [{id, name, createdAt, lastUsedAt, revokedAt}]}
-  async list() {
-    const result = await internalRequest(this.sdk, '/workflows/mcp/tokens', 'GET');
-    return result;
-  }
-
-  // DELETE /workflows/mcp/tokens/:id -> {id, revoked:true}
-  async revoke(id) {
-    this.sdk.validateParams(
-      { id },
-      { id: { type: 'string', required: true } },
-    );
-
-    const result = await internalRequest(
-      this.sdk,
-      `/workflows/mcp/tokens/${id}`,
-      'DELETE',
-    );
-    return result;
-  }
-}