@vibesdotdev/kit 0.0.0-stage → 1.0.0-rc.3

package/dist/lib/client/form-action.js

@@ -0,0 +1,87 @@
+import * as z from 'zod/v4';
+import { settleNow } from '../attempt.js';
+import { kitLogger } from '../kit-logger.js';
+const logger = kitLogger('form-action');
+// The values were decoded by the host's deserializer, so only their container is checked here.
+const FormActionDataSchema = z.record(z.string(), z.custom());
+/** The action result envelope SvelteKit's `deserialize` returns. */
+const FormActionEnvelopeSchema = z.discriminatedUnion('type', [
+    z.looseObject({ type: z.literal('success'), data: FormActionDataSchema.optional() }),
+    z.looseObject({ type: z.literal('failure'), data: FormActionDataSchema.optional() }),
+    z.looseObject({ type: z.literal('error'), error: z.unknown().optional() }),
+    z.looseObject({ type: z.literal('redirect') })
+]);
+const ErrorMessageSchema = z
+    .object({ message: z.string().refine((message) => message.trim().length > 0) })
+    .transform((error) => error.message);
+const NonBlankTextSchema = z.string().refine((text) => text.trim().length > 0);
+/**
+ * Submit a SvelteKit form action without navigating and decode its action result.
+ *
+ * This is the client-side equivalent of an enhanced form submission for controls
+ * that cannot use `use:enhance`, such as confirmation dialogs and toolbar buttons.
+ */
+export async function submitSvelteKitFormAction(url, formData, deserialize, options = {}) {
+    const headers = new Headers(options.headers);
+    headers.set('x-sveltekit-action', 'true');
+    const response = await (options.fetch ?? fetch)(url, {
+        method: 'POST',
+        body: formData,
+        headers,
+        signal: options.signal
+    });
+    return {
+        response,
+        data: await readFormActionData(response, deserialize)
+    };
+}
+export async function readFormActionData(response, deserialize) {
+    const text = await response.text();
+    if (!text)
+        return {};
+    const decodedOutcome = settleNow(() => deserialize(text));
+    if (!decodedOutcome.ok) {
+        // The deserializer's error can quote the response it failed on, so only its class is reported.
+        logger.warn('could not deserialize form action response', {
+            failureClass: decodedOutcome.error instanceof Error ? decodedOutcome.error.name : 'unknown failure'
+        });
+        return formActionError('Action response could not be read.');
+    }
+    const envelope = FormActionEnvelopeSchema.safeParse(decodedOutcome.value);
+    if (!envelope.success)
+        return formActionError('Action response could not be read.');
+    switch (envelope.data.type) {
+        case 'success':
+        case 'failure':
+            // SAFETY: `TData` is the data shape the caller declared for this action; the host's
+            // deserializer decoded the values, and the record container was checked above.
+            return (envelope.data.data ?? {});
+        case 'error': {
+            const message = ErrorMessageSchema.safeParse(envelope.data.error);
+            return formActionError(message.success ? message.data : 'Action failed. Please try again.');
+        }
+        case 'redirect':
+            return formActionError('Action redirected before it completed.');
+    }
+}
+export function createFormActionClient(deserialize) {
+    return {
+        submitSvelteKitFormAction: (url, formData, options = {}) => submitSvelteKitFormAction(url, formData, deserialize, options),
+        readFormActionData: (response) => readFormActionData(response, deserialize)
+    };
+}
+function formActionError(message) {
+    // Decoded caller fields are optional. A failed action therefore returns only
+    // the normalized error instead of pretending it produced a success payload.
+    // SAFETY: `error` is the one field the decoded type reserves for a message, and every
+    // other field of `FormActionDecodedData` is optional, so `{ error }` is a valid value.
+    return { error: message };
+}
+export function formActionMessage(data, keys, fallback) {
+    for (const key of keys) {
+        const text = NonBlankTextSchema.safeParse(data[key]);
+        if (text.success)
+            return text.data;
+    }
+    return fallback;
+}

package/dist/lib/client/guard/gate.d.ts

@@ -0,0 +1,13 @@
+import type { GateOptions, QuotaStatus } from '../schemas/gate.ts';
+export type { GateOptions, QuotaStatus } from '../schemas/gate.ts';
+interface PreflightQuotaOptions {
+    accountOrigin?: string | null;
+    endpoint?: string;
+    failOpen?: boolean;
+    timeoutMs?: number;
+}
+export declare function preflightQuota(feature: string, amount?: number, options?: PreflightQuotaOptions): Promise<QuotaStatus>;
+export declare function vibesGuard<T extends unknown[], R>(fn: (...args: T) => R | Promise<R>, options: GateOptions): (...args: T) => Promise<R | undefined>;
+export declare function createVibesGateAction(options: GateOptions): (node: HTMLElement) => {
+    destroy(): void;
+};

package/dist/lib/client/guard/gate.js

@@ -0,0 +1,139 @@
+import * as z from 'zod/v4';
+import { settle } from "../../attempt.js";
+/** What the account's quota endpoint answers; a field of another type reads as absent. */
+const QuotaResponseSchema = z.object({
+    feature: z.string().optional().catch(undefined),
+    requested: z.number().optional().catch(undefined),
+    allowed: z.boolean().optional().catch(undefined),
+    usage: z.number().optional().catch(undefined),
+    limit: z.number().nullable().optional().catch(undefined),
+    remaining: z.number().nullable().optional().catch(undefined)
+});
+/** The failure handed to `onError`: the original Error, or a fixed one for a non-Error throw. */
+function quotaCheckError(failure) {
+    return failure instanceof Error ? failure : new Error('Quota check failed', { cause: failure });
+}
+function resolveAccountOrigin(origin) {
+    if (origin?.trim())
+        return origin.replace(/\/$/, '');
+    // The ambient page origin, where there is a page (none in SSR, workers or node).
+    return globalThis.window?.location.origin ?? '';
+}
+function unavailableStatus(feature, amount, accountOrigin, status, failOpen) {
+    return {
+        allowed: failOpen,
+        feature,
+        requested: amount,
+        usage: 0,
+        limit: null,
+        remaining: null,
+        reason: failOpen ? undefined : 'unavailable',
+        status,
+        accountOrigin
+    };
+}
+export async function preflightQuota(feature, amount = 1, options = {}) {
+    const accountOrigin = resolveAccountOrigin(options.accountOrigin);
+    const endpoint = options.endpoint ?? '/api/billing/quota/check';
+    const failOpen = options.failOpen ?? false;
+    const timeoutMs = options.timeoutMs ?? 5000;
+    if (!accountOrigin) {
+        return unavailableStatus(feature, amount, accountOrigin, undefined, failOpen);
+    }
+    const outcome = await settle(async () => {
+        const url = new URL(endpoint, accountOrigin);
+        url.searchParams.set('feature', feature);
+        url.searchParams.set('amount', String(amount));
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), timeoutMs);
+        let res;
+        try {
+            res = await fetch(url.toString(), {
+                credentials: 'include',
+                signal: controller.signal
+            });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+        if (!res.ok) {
+            return unavailableStatus(feature, amount, accountOrigin, res.status, failOpen);
+        }
+        const body = await res.json();
+        const data = QuotaResponseSchema.parse(body);
+        const allowed = data.allowed === true;
+        return {
+            allowed,
+            feature: data.feature ?? feature,
+            requested: Number(data.requested ?? amount),
+            usage: Number(data.usage ?? 0),
+            limit: data.limit ?? null,
+            remaining: data.remaining ?? null,
+            reason: allowed ? undefined : 'quota',
+            accountOrigin
+        };
+    });
+    if (outcome.ok)
+        return outcome.value;
+    if (!failOpen)
+        throw outcome.error;
+    return unavailableStatus(feature, amount, accountOrigin, undefined, true);
+}
+async function checkQuota(options) {
+    if (!options.quota)
+        return null;
+    const { feature, amount = 1, accountOrigin, endpoint, failOpen } = options.quota;
+    return preflightQuota(feature, amount, {
+        accountOrigin,
+        endpoint,
+        failOpen: failOpen ?? options.failOpen
+    });
+}
+export function vibesGuard(fn, options) {
+    return async (...args) => {
+        const outcome = await settle(async () => {
+            const status = await checkQuota(options);
+            if (status && !status.allowed) {
+                options.onBlocked?.(status);
+                if (options.showCreditsOnQuotaBlocked) {
+                    options.onShowCredits?.(status.feature);
+                }
+                return false;
+            }
+            return true;
+        });
+        if (!outcome.ok) {
+            options.onError?.(quotaCheckError(outcome.error));
+            return;
+        }
+        if (!outcome.value)
+            return;
+        return fn(...args);
+    };
+}
+// Svelte action for declarative gating on elements
+export function createVibesGateAction(options) {
+    return function nodeAction(node) {
+        const handler = async (ev) => {
+            const checked = await settle(() => checkQuota(options));
+            if (!checked.ok)
+                options.onError?.(quotaCheckError(checked.error));
+            const status = checked.ok ? checked.value : null;
+            if (status && !status.allowed) {
+                ev.preventDefault();
+                options.onBlocked?.(status);
+                if (options.showCreditsOnQuotaBlocked) {
+                    options.onShowCredits?.(status.feature);
+                }
+                return false;
+            }
+            return true;
+        };
+        node.addEventListener('click', handler);
+        return {
+            destroy() {
+                node.removeEventListener('click', handler);
+            }
+        };
+    };
+}

package/dist/lib/client/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Client-safe vibeskit exports
+ *
+ * This barrel is safe to import from client-side code (Svelte components, stores, etc.)
+ * It ONLY exports utilities that don't depend on server-only libraries like Redis/ioredis.
+ */
+export { vibesPage } from './page/enhance';
+export { vibesLayoutMount, vibesLayoutInit } from './layout/mount';
+export { vibesGuard, createVibesGateAction, preflightQuota } from './guard/gate';
+export type { QuotaStatus, GateOptions } from './guard/gate';
+export { withStatusRestrictedRedirect, installStatusRestrictedFetchInterceptor } from './status-restricted-fetch';
+export type { StatusRestrictedError, StatusRestrictedOptions } from './status-restricted-fetch';
+export { createFormActionClient, formActionMessage, readFormActionData, submitSvelteKitFormAction } from './form-action';
+export type { FormActionData, FormActionDeserializer, FormActionEnvelope, FormActionResult, FormActionValue, SubmitFormActionOptions } from './form-action';
+export type { ClientUser } from './services/permissions';
+export { hasClientPermission, hasAnyClientPermission, hasAllClientPermissions, hasClientRole, hasAnyClientRole, isClientAdmin, canAccessSystem, canManageUsers, canManageProjects, canManageBilling, getUserRoleDisplay, canAccessOwnResource } from './services/permissions';

package/dist/lib/client/index.js

@@ -0,0 +1,15 @@
+/**
+ * Client-safe vibeskit exports
+ *
+ * This barrel is safe to import from client-side code (Svelte components, stores, etc.)
+ * It ONLY exports utilities that don't depend on server-only libraries like Redis/ioredis.
+ */
+// Client-side Svelte helpers
+export { vibesPage } from './page/enhance';
+export { vibesLayoutMount, vibesLayoutInit } from './layout/mount';
+export { vibesGuard, createVibesGateAction, preflightQuota } from './guard/gate';
+// Client-side handling of the active-user-gate handle's 403 JSON body.
+export { withStatusRestrictedRedirect, installStatusRestrictedFetchInterceptor } from './status-restricted-fetch';
+// Canonical non-navigating SvelteKit form action transport.
+export { createFormActionClient, formActionMessage, readFormActionData, submitSvelteKitFormAction } from './form-action';
+export { hasClientPermission, hasAnyClientPermission, hasAllClientPermissions, hasClientRole, hasAnyClientRole, isClientAdmin, canAccessSystem, canManageUsers, canManageProjects, canManageBilling, getUserRoleDisplay, canAccessOwnResource } from './services/permissions';

package/dist/lib/client/internal/base-client.d.ts

@@ -0,0 +1,22 @@
+import { type BaseAPIConfig, type EndpointOptions, type RequestJson } from './base-types.js';
+import { Endpoint } from './endpoint.js';
+import { type FetchFunction } from './wrap-fetch.js';
+type ResolvedBaseConfig = Required<Omit<BaseAPIConfig, 'auth' | 'fetch'>> & {
+    fetch: FetchFunction;
+    auth: NonNullable<BaseAPIConfig['auth']>;
+};
+export declare abstract class BaseAPIClient {
+    protected config: ResolvedBaseConfig;
+    private abortControllers;
+    constructor(config: BaseAPIConfig);
+    protected endpoint(path: string): Endpoint;
+    request<T = unknown>(request: {
+        method: string;
+        path: string;
+        body?: RequestJson;
+    } & EndpointOptions<T>): Promise<T>;
+    cancelAll(): void;
+    setAuth(auth: BaseAPIConfig['auth']): void;
+    updateConfig(config: Partial<BaseAPIConfig>): void;
+}
+export {};

package/dist/lib/client/internal/base-client.js

@@ -0,0 +1,95 @@
+import { APIError } from './base-types.js';
+import { buildHeaders, buildUrl, createApiError, withoutCredentials } from './base-helpers.js';
+import { Endpoint } from './endpoint.js';
+import { globalFetch } from './wrap-fetch.js';
+export class BaseAPIClient {
+    config;
+    abortControllers = new Set();
+    constructor(config) {
+        const fetchImpl = config.fetch || globalFetch();
+        if (!fetchImpl)
+            throw new Error('Fetch is not available. Please provide a fetch implementation.');
+        this.config = {
+            baseUrl: config.baseUrl,
+            fetch: fetchImpl,
+            headers: config.headers || {},
+            timeout: config.timeout || 30000,
+            debug: config.debug || false,
+            hooks: config.hooks || {},
+            auth: config.auth ?? { type: 'none' }
+        };
+    }
+    endpoint(path) {
+        const cleanPath = path.startsWith('/') ? path : `/${path}`;
+        return new Endpoint(this, cleanPath);
+    }
+    async request(request) {
+        const url = buildUrl(this.config.baseUrl, request.path, request.query);
+        const controller = new AbortController();
+        this.abortControllers.add(controller);
+        try {
+            const headers = await buildHeaders({
+                auth: this.config.auth,
+                headers: { ...this.config.headers, ...request.headers },
+                includeJsonDefaults: request.body !== undefined
+            });
+            const init = { method: request.method, headers };
+            if (request.body !== undefined)
+                init.body = JSON.stringify(request.body);
+            let hooked = new Request(url.toString(), init);
+            if (this.config.hooks?.beforeRequest)
+                hooked = await this.config.hooks.beforeRequest(hooked);
+            // The Request the hook returned is what gets sent: its method, headers and body are
+            // authoritative. Only the client's own cancellation and timeout are added to it.
+            const req = new Request(hooked, {
+                signal: AbortSignal.any([
+                    hooked.signal,
+                    controller.signal,
+                    AbortSignal.timeout(request.timeout ?? this.config.timeout)
+                ])
+            });
+            const response = await this.config.fetch(req);
+            const finalResponse = this.config.hooks?.afterResponse
+                ? await this.config.hooks.afterResponse(response)
+                : response;
+            if (!finalResponse.ok) {
+                const error = await createApiError(finalResponse, req);
+                if (this.config.hooks?.onError)
+                    await this.config.hooks.onError(error);
+                throw error;
+            }
+            let raw;
+            if (finalResponse.status === 204 || finalResponse.headers.get('Content-Length') === '0')
+                raw = undefined;
+            else if (finalResponse.headers.get('Content-Type')?.includes('application/json'))
+                raw = await finalResponse.json();
+            else
+                raw = await finalResponse.text();
+            const data = request.transform ? request.transform(raw) : raw;
+            if (request.schema) {
+                const result = request.schema.safeParse(data);
+                if (!result.success) {
+                    throw new APIError(`Response validation failed: ${result.error.message}`, 422, finalResponse, withoutCredentials(req), raw);
+                }
+                return result.data;
+            }
+            // SAFETY: with no schema, T is the response type the caller declared for this endpoint
+            // (generic erasure at the HTTP boundary); callers needing validation pass `schema`.
+            return data;
+        }
+        finally {
+            this.abortControllers.delete(controller);
+        }
+    }
+    cancelAll() {
+        for (const controller of this.abortControllers)
+            controller.abort();
+        this.abortControllers.clear();
+    }
+    setAuth(auth) {
+        this.config.auth = auth ?? { type: 'none' };
+    }
+    updateConfig(config) {
+        Object.assign(this.config, config);
+    }
+}

package/dist/lib/client/internal/base-helpers.d.ts

@@ -0,0 +1,13 @@
+import { type BaseAPIConfig, type EndpointOptions, APIError } from './base-types.js';
+export declare function buildUrl(baseUrl: string, path: string, query?: EndpointOptions['query']): URL;
+export declare function buildHeaders(args: {
+    auth: NonNullable<BaseAPIConfig['auth']>;
+    headers: Record<string, string>;
+    includeJsonDefaults: boolean;
+}): Promise<Headers>;
+/**
+ * The part of a request a failure may keep: its method and URL. Headers (which carry
+ * the Authorization credential) and the body are dropped.
+ */
+export declare function withoutCredentials(request: Request): Request;
+export declare function createApiError(response: Response, request: Request): Promise<APIError>;

package/dist/lib/client/internal/base-helpers.js

@@ -0,0 +1,101 @@
+import * as z from 'zod/v4';
+import { settle } from '../../attempt.js';
+import { kitLogger } from '../../kit-logger.js';
+import { APIError } from './base-types.js';
+const logger = kitLogger('client');
+export function buildUrl(baseUrl, path, query) {
+    const url = new URL(path, baseUrl);
+    if (query) {
+        for (const [key, value] of Object.entries(query)) {
+            if (value === undefined)
+                continue;
+            if (Array.isArray(value))
+                value.forEach((v) => url.searchParams.append(key, String(v)));
+            else
+                url.searchParams.set(key, String(value));
+        }
+    }
+    return url;
+}
+export async function buildHeaders(args) {
+    const requestHeaders = new Headers(args.headers);
+    if (args.includeJsonDefaults && !requestHeaders.has('Content-Type')) {
+        requestHeaders.set('Content-Type', 'application/json');
+    }
+    if (!requestHeaders.has('Accept'))
+        requestHeaders.set('Accept', 'application/json');
+    const auth = args.auth;
+    if (auth) {
+        const token = auth.credentials || (await auth.provider?.());
+        if (token) {
+            switch (auth.type) {
+                case 'bearer':
+                    requestHeaders.set('Authorization', `Bearer ${token}`);
+                    break;
+                case 'apiKey': {
+                    const headerName = auth.headerName || 'X-API-Key';
+                    requestHeaders.set(headerName, token);
+                    break;
+                }
+                case 'basic':
+                    requestHeaders.set('Authorization', `Basic ${token}`);
+                    break;
+                case 'custom':
+                    if (auth.headerName && auth.prefix) {
+                        requestHeaders.set(auth.headerName, `${auth.prefix} ${token}`);
+                    }
+                    break;
+            }
+        }
+    }
+    return requestHeaders;
+}
+const ErrorBodySchema = z.object({
+    message: z.string().optional().catch(undefined),
+    error: z.unknown().optional()
+});
+/**
+ * The part of a request a failure may keep: its method and URL. Headers (which carry
+ * the Authorization credential) and the body are dropped.
+ */
+export function withoutCredentials(request) {
+    return new Request(request.url, { method: request.method });
+}
+export async function createApiError(response, request) {
+    const statusLine = `${response.status} ${response.statusText}`;
+    const read = await settle(async () => {
+        let message = statusLine;
+        let body;
+        const contentType = response.headers.get('Content-Type');
+        if (contentType?.includes('application/json')) {
+            body = await response.json();
+            const parsed = ErrorBodySchema.safeParse(body);
+            if (parsed.success) {
+                const { message: bodyMessage, error } = parsed.data;
+                const errorText = z.string().safeParse(error);
+                if (bodyMessage !== undefined)
+                    message = bodyMessage;
+                else if (errorText.success)
+                    message = errorText.data;
+                else if (error !== undefined)
+                    message = JSON.stringify(error);
+            }
+        }
+        else {
+            const text = await response.text();
+            if (text) {
+                message = text;
+                body = text;
+            }
+        }
+        return { message, body };
+    });
+    if (!read.ok) {
+        // The parse error can quote the body it failed on, so only its class is reported.
+        logger.warn('unparseable error body; status line stays the message', {
+            failureClass: read.error instanceof Error ? read.error.name : 'unknown failure'
+        });
+        return new APIError(statusLine, response.status, response, withoutCredentials(request), undefined);
+    }
+    return new APIError(read.value.message, response.status, response, withoutCredentials(request), read.value.body);
+}

package/dist/lib/client/internal/base-types.d.ts

@@ -0,0 +1,41 @@
+import type { z } from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+/** A value a response body can carry once read: JSON, text, or nothing. */
+export type ResponseJson = string | number | boolean | null | undefined | ResponseJson[] | {
+    [key: string]: ResponseJson;
+};
+/** A request body the endpoint helpers JSON-encode: an object, array or scalar. */
+export type RequestJson = string | number | boolean | null | object;
+export interface BaseAPIConfig {
+    baseUrl: string;
+    fetch?: typeof fetch;
+    headers?: Record<string, string>;
+    timeout?: number;
+    auth?: {
+        type: 'bearer' | 'apiKey' | 'basic' | 'custom' | 'none';
+        credentials?: string;
+        headerName?: string;
+        prefix?: string;
+        provider?: () => Promise<string | null>;
+    } | null;
+    debug?: boolean;
+    hooks?: {
+        beforeRequest?: (request: Request) => Promise<Request> | Request;
+        afterResponse?: (response: Response) => Promise<Response> | Response;
+        onError?: (error: APIError) => Promise<void> | void;
+    };
+}
+export declare class APIError extends CapabilityError {
+    readonly status: number;
+    readonly response?: Response | undefined;
+    readonly request?: Request | undefined;
+    readonly body?: ResponseJson;
+    constructor(message: string, status: number, response?: Response | undefined, request?: Request | undefined, body?: ResponseJson);
+}
+export interface EndpointOptions<T = unknown> {
+    headers?: Record<string, string>;
+    query?: Record<string, string | number | boolean | string[] | undefined>;
+    timeout?: number;
+    schema?: z.ZodSchema<T>;
+    transform?: (data: ResponseJson) => T;
+}

package/dist/lib/client/internal/base-types.js

@@ -0,0 +1,16 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { clientFailureCode } from '../types.js';
+export class APIError extends CapabilityError {
+    status;
+    response;
+    request;
+    body;
+    constructor(message, status, response, request, body) {
+        super(message, clientFailureCode(status), { reason: 'api-response-failed' });
+        this.status = status;
+        this.response = response;
+        this.request = request;
+        this.body = body;
+        this.name = 'APIError';
+    }
+}

package/dist/lib/client/internal/endpoint.d.ts

@@ -0,0 +1,23 @@
+import type { EndpointOptions, RequestJson } from './base-types.js';
+type RequestExecutor = {
+    request<T = unknown>(options: {
+        method: string;
+        path: string;
+        body?: RequestJson;
+    } & EndpointOptions<T>): Promise<T>;
+};
+/** Functions an endpoint can bind; any return type is accepted (a function returning a value is assignable to one returning void). */
+type MethodMap = Record<string, (...args: never[]) => void>;
+export declare class Endpoint {
+    private client;
+    private path;
+    constructor(client: RequestExecutor, path: string);
+    endpoint(subPath: string): Endpoint;
+    methods<T extends MethodMap>(methods: T): T;
+    get<T = unknown>(path?: string, options?: EndpointOptions<T>): Promise<T>;
+    post<T = unknown>(path?: string, body?: RequestJson, options?: EndpointOptions<T>): Promise<T>;
+    put<T = unknown>(path?: string, body?: RequestJson, options?: EndpointOptions<T>): Promise<T>;
+    patch<T = unknown>(path?: string, body?: RequestJson, options?: EndpointOptions<T>): Promise<T>;
+    delete<T = unknown>(path?: string, options?: EndpointOptions<T>): Promise<T>;
+}
+export {};

package/dist/lib/client/internal/endpoint.js

@@ -0,0 +1,58 @@
+export class Endpoint {
+    client;
+    path;
+    constructor(client, path) {
+        this.client = client;
+        this.path = path;
+    }
+    endpoint(subPath) {
+        const cleanPath = subPath.startsWith('/') ? subPath : `/${subPath}`;
+        return new Endpoint(this.client, `${this.path}${cleanPath}`);
+    }
+    methods(methods) {
+        const bound = {};
+        for (const [key, method] of Object.entries(methods))
+            bound[key] = method.bind(this);
+        // SAFETY: bind keeps each function's signature and `bound` holds exactly the keys of
+        // `methods`, so it has the shape T describes.
+        return bound;
+    }
+    get(path = '', options) {
+        return this.client.request({
+            method: 'GET',
+            path: `${this.path}${path}`,
+            ...options
+        });
+    }
+    post(path = '', body, options) {
+        return this.client.request({
+            method: 'POST',
+            path: `${this.path}${path}`,
+            body,
+            ...options
+        });
+    }
+    put(path = '', body, options) {
+        return this.client.request({
+            method: 'PUT',
+            path: `${this.path}${path}`,
+            body,
+            ...options
+        });
+    }
+    patch(path = '', body, options) {
+        return this.client.request({
+            method: 'PATCH',
+            path: `${this.path}${path}`,
+            body,
+            ...options
+        });
+    }
+    delete(path = '', options) {
+        return this.client.request({
+            method: 'DELETE',
+            path: `${this.path}${path}`,
+            ...options
+        });
+    }
+}