@w6w/sdk 0.5.0 → 0.6.0

package/dist/src/console/mod.js

@@ -17,6 +17,7 @@
  *
  * @module
  */
+import { AliasesApi } from "./aliases.js";
 import { ApiCallsApi } from "./api-calls.js";
 import { AppsApi } from "./apps.js";
 import { AuthApi } from "./auth.js";
@@ -24,6 +25,7 @@ import { ConnectionsApi } from "./connections.js";
 import { DashboardApi } from "./dashboard.js";
 import { EndpointsApi } from "./endpoints.js";
 import { FunctionsApi } from "./functions.js";
+import { PasskeysApi } from "./passkeys.js";
 import { ReliabilityApi } from "./reliability.js";
 import { ProjectsApi } from "./projects.js";
 import { SavedTestsApi } from "./saved-tests.js";
@@ -35,6 +37,7 @@ import { TokensApi } from "./tokens.js";
 import { VaultApi } from "./vault.js";
 import { WorkflowsApi } from "./workflows.js";
 export { AuthApi } from "./auth.js";
+export { PasskeysApi } from "./passkeys.js";
 export { DashboardApi } from "./dashboard.js";
 export { ReliabilityApi } from "./reliability.js";
 export { ProjectsApi } from "./projects.js";
@@ -48,6 +51,7 @@ export { VaultApi } from "./vault.js";
 export { TokensApi } from "./tokens.js";
 export { FunctionsApi } from "./functions.js";
 export { EndpointsApi, SECRET_MASK } from "./endpoints.js";
+export { AliasesApi } from "./aliases.js";
 export { SubscriptionsApi } from "./subscriptions.js";
 export { ApiCallsApi } from "./api-calls.js";
 export { TenantOAuthAppsApi } from "./tenant-oauth-apps.js";
@@ -89,12 +93,16 @@ export class ConsoleApi {
     functions;
     /** `console.endpoints.*`. */
     endpoints;
+    /** `console.aliases.*`. */
+    aliases;
     /** `console.subscriptions.*`. */
     subscriptions;
     /** `console.apiCalls.*`. */
     apiCalls;
     /** `console.tenantOAuthApps.*` — the caller's OWN tenant, never a tenant of its choosing. */
     tenantOAuthApps;
+    /** `console.passkeys.*`. */
+    passkeys;
     /**
      * @param host - The client this namespace group issues requests through.
      */
@@ -113,9 +121,11 @@ export class ConsoleApi {
         this.tokens = new TokensApi(host);
         this.functions = new FunctionsApi(host);
         this.endpoints = new EndpointsApi(host);
+        this.aliases = new AliasesApi(host);
         this.subscriptions = new SubscriptionsApi(host);
         this.apiCalls = new ApiCallsApi(host);
         this.tenantOAuthApps = new TenantOAuthAppsApi(host);
+        this.passkeys = new PasskeysApi(host);
     }
 }
 //# sourceMappingURL=mod.js.map

package/dist/src/console/mod.js.map

@@ -1 +1 @@
-{"version":3,"file":"mod.js","sourceRoot":"","sources":["../../../src/console/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAapC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAUlD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+BpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAS9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAc3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAQtD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAmB5D;;;;;;;;GAQG;AACH,MAAM,OAAO,UAAU;IACrB,+BAA+B;IACtB,WAAW,CAAiB;IACrC,wBAAwB;IACf,IAAI,CAAU;IACvB,6BAA6B;IACpB,SAAS,CAAe;IACjC,4BAA4B;IACnB,QAAQ,CAAc;IAC/B,6BAA6B;IACpB,SAAS,CAAe;IACjC,wBAAwB;IACf,IAAI,CAAU;IACvB,+BAA+B;IACtB,WAAW,CAAiB;IACrC,6BAA6B;IACpB,SAAS,CAAe;IACjC,8BAA8B;IACrB,UAAU,CAAgB;IACnC,6BAA6B;IACpB,SAAS,CAAe;IACjC,yBAAyB;IAChB,KAAK,CAAW;IACzB,0BAA0B;IACjB,MAAM,CAAY;IAC3B,6BAA6B;IACpB,SAAS,CAAe;IACjC,6BAA6B;IACpB,SAAS,CAAe;IACjC,iCAAiC;IACxB,aAAa,CAAmB;IACzC,4BAA4B;IACnB,QAAQ,CAAc;IAC/B,6FAA6F;IACpF,eAAe,CAAqB;IAE7C;;OAEG;IACH,YAAY,IAAiB;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;CACF"}
+{"version":3,"file":"mod.js","sourceRoot":"","sources":["../../../src/console/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqBpC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAU5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAUlD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+BpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAS9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAe3D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAQtD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAmB5D;;;;;;;;GAQG;AACH,MAAM,OAAO,UAAU;IACrB,+BAA+B;IACtB,WAAW,CAAiB;IACrC,wBAAwB;IACf,IAAI,CAAU;IACvB,6BAA6B;IACpB,SAAS,CAAe;IACjC,4BAA4B;IACnB,QAAQ,CAAc;IAC/B,6BAA6B;IACpB,SAAS,CAAe;IACjC,wBAAwB;IACf,IAAI,CAAU;IACvB,+BAA+B;IACtB,WAAW,CAAiB;IACrC,6BAA6B;IACpB,SAAS,CAAe;IACjC,8BAA8B;IACrB,UAAU,CAAgB;IACnC,6BAA6B;IACpB,SAAS,CAAe;IACjC,yBAAyB;IAChB,KAAK,CAAW;IACzB,0BAA0B;IACjB,MAAM,CAAY;IAC3B,6BAA6B;IACpB,SAAS,CAAe;IACjC,6BAA6B;IACpB,SAAS,CAAe;IACjC,2BAA2B;IAClB,OAAO,CAAa;IAC7B,iCAAiC;IACxB,aAAa,CAAmB;IACzC,4BAA4B;IACnB,QAAQ,CAAc;IAC/B,6FAA6F;IACpF,eAAe,CAAqB;IAC7C,4BAA4B;IACnB,QAAQ,CAAc;IAE/B;;OAEG;IACH,YAAY,IAAiB;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/src/console/passkeys.d.ts

@@ -0,0 +1,246 @@
+/**
+ * `client.console.passkeys.*` — WebAuthn passkey management and login for
+ * self-serve Studio users (T1.1.5).
+ *
+ * **Studio-internal, not the published partner contract.** This namespace
+ * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
+ * `endpoints.json` and from the root barrel (`mod.ts`) — see `docs/console.md`
+ * and HITL-1 in this task's contract. `@w6w/sdk`'s instance-state mechanism
+ * pin still applies here exactly as it does to every other namespace
+ * (`docs/implementation.md` §MECHANISM PIN — instance state, never globals):
+ * this class holds no state of its own beyond the injected host, so two
+ * clients in one process never share a credential.
+ *
+ * **Who this is for (HITL-3).** Passkeys belong to self-serve Studio users
+ * only; a partner-tenant user's IdP owns its identity. No eligibility logic
+ * lives here — the server enforces it (`PasskeyNotEligibleError`), and this
+ * module is a plain transport shim over whatever it decides.
+ *
+ * **Two routes, four methods, split by who is authenticated.** The management
+ * quartet (`registrationOptions`, `registrationVerify`, `list`, `revoke`) is
+ * GUARDED, mirroring `packages/server/packages/api/data/passkeys.ts`'s own
+ * doc comment ("Registered BELOW the auth guard"). The login pair
+ * (`authenticationOptions`, `authenticationVerify`) is PUBLIC, mirroring
+ * `packages/server/packages/api/id/passkey-login.ts`'s own doc comment ("BOTH
+ * routes are PUBLIC and UNAUTHENTICATED by construction") — discoverable
+ * credentials, no identifier in the request body (P1). Each of those two
+ * methods passes `requireAuth: false`, the same mechanism
+ * `console.auth.login`/`signup`/`checkAccountSlug` rely on: without it a
+ * tokenless client (the normal case at the login screen, before any session
+ * exists) would hit `requireToken`'s `ConfigError` before `fetch` is ever
+ * called.
+ *
+ * **`authenticationVerify` mints a session, the same way `login` does
+ * (HITL-5).** A verified passkey assertion is a standalone alternative to a
+ * password, not a second factor — so its response is token-bearing, exactly
+ * like `console.auth.login`'s. It is a SEPARATE type from `LoginResponse`
+ * (`./auth.ts`), not a reuse: the server route is byte-shape-identical to
+ * `user-login.ts`'s login body (`id/passkey-login.ts`'s own doc comment) which
+ * carries `role`, `tenant` and `emailVerified` on `user` — fields
+ * `console.auth`'s `LoginResponse.user` does not declare.
+ *
+ * **WebAuthn ceremony payloads (`options`/`response`) are opaque JSON, typed
+ * as `Record<string, unknown>`, never as `@simplewebauthn/*` types.** This
+ * package has no dependency on `@simplewebauthn` (browser or server) and
+ * adding one only to type two pass-through fields would be a new dependency
+ * for zero behavioural gain — `inputs.touch` for this task explicitly
+ * excludes `package.json`. A caller passes the browser's own
+ * `PublicKeyCredentialCreationOptionsJSON`/`...RequestOptionsJSON` (from
+ * `options`) into `navigator.credentials.create()`/`.get()` (or a helper such
+ * as `@simplewebauthn/browser`'s `startRegistration`/`startAuthentication`)
+ * and forwards what comes back as `response` — this module never inspects
+ * either shape, only relays it.
+ *
+ * @module
+ */
+import { type HttpResponse, type RequestOptions } from "../http.ts";
+/**
+ * The slice of `W6WClient` this namespace needs: the transport, and nothing
+ * else. Structural rather than a concrete client type, so the namespace stays
+ * independently constructible in a test and this module never imports the
+ * client back — mirrors `TokensHost` in `./tokens.ts`.
+ */
+export interface PasskeysHost {
+    /** Perform one request. */
+    request<T>(options: RequestOptions): Promise<HttpResponse<T>>;
+}
+/**
+ * A stored passkey, as the server exposes it. **Never the public key or the
+ * counter** — `packages/server/packages/api/data/passkeys.ts`'s own
+ * `WirePasskey`/`toWirePasskey()` state the identical invariant server-side.
+ */
+export interface Passkey {
+    /** Server-issued id. */
+    id: string;
+    /** Caller-chosen label (empty string when none was given at registration). */
+    label: string;
+    /** ISO-8601 timestamp. */
+    createdAt: string;
+    /** ISO-8601 timestamp of the credential's last successful authentication, or `null`. */
+    lastUsedAt: string | null;
+    /** WebAuthn transport hints reported at registration (e.g. `"internal"`, `"hybrid"`). */
+    transports: string[];
+}
+/**
+ * A fresh WebAuthn ceremony challenge — the shared result shape of
+ * `POST /me/passkeys/options` (`data/passkeys.ts:118-130`) and
+ * `POST /auth/passkey/options` (`id/passkey-login.ts:63-71`). Flat, no
+ * envelope key.
+ */
+export interface PasskeyCeremonyOptions {
+    /**
+     * WebAuthn ceremony options, opaque JSON forwarded verbatim to
+     * `navigator.credentials.create()`/`.get()` (or a browser WebAuthn helper).
+     * This package never inspects its shape — see this module's header.
+     */
+    options: Record<string, unknown>;
+    /** Single-use challenge token. Echo it back on the paired verify call. */
+    challengeToken: string;
+}
+/** The body `registrationVerify` sends (`POST /me/passkeys`, `data/passkeys.ts:132-164`). */
+export interface RegistrationVerifyInput {
+    /** The token returned by the paired `registrationOptions()` call. */
+    challengeToken: string;
+    /**
+     * The browser's `RegistrationResponseJSON`, opaque JSON — see this
+     * module's header.
+     */
+    response: Record<string, unknown>;
+    /** Caller-chosen label for the new passkey. */
+    label?: string;
+}
+/** The body `authenticationVerify` sends (`POST /auth/passkey/verify`, `id/passkey-login.ts:73-110`). */
+export interface AuthenticationVerifyInput {
+    /** The token returned by the paired `authenticationOptions()` call. */
+    challengeToken: string;
+    /**
+     * The browser's `AuthenticationResponseJSON`, opaque JSON — see this
+     * module's header.
+     */
+    response: Record<string, unknown>;
+}
+/**
+ * The user identity `authenticationVerify` mints a session for, as
+ * `id/passkey-login.ts` returns it — BYTE-SHAPE IDENTICAL to
+ * `console.auth`'s `LoginResponse.user`'s sibling in `user-login.ts`, but
+ * carrying more fields (`role`, `tenant`, `emailVerified`), which is why this
+ * is a separate type rather than a reuse of `./auth.ts`'s `User`.
+ */
+export interface PasskeyUser {
+    /** The user's email, or its `userId` when no email is on file. */
+    username: string;
+    /** Always `"user"` for a passkey login (`id/passkey-login.ts:100`). */
+    role: string;
+    /** The tenant the session is minted in. */
+    tenant: string;
+    emailVerified: boolean;
+}
+/**
+ * `POST /auth/passkey/verify` → 200 (`id/passkey-login.ts:96-105`). Mints a
+ * session exactly like `console.auth.login` does (HITL-5) — a verified
+ * passkey assertion is a standalone alternative to a password, not a second
+ * factor.
+ */
+export interface PasskeyAuthenticationVerifyResponse {
+    token: string;
+    user: PasskeyUser;
+    expiresIn: number;
+}
+/**
+ * The `console.passkeys` namespace on a `W6WClient`.
+ *
+ * @example
+ * ```ts
+ * // Registration (authenticated).
+ * const { options, challengeToken } = await client.console.passkeys.registrationOptions();
+ * const response = await startRegistration({ optionsJSON: options }); // e.g. @simplewebauthn/browser
+ * const passkey = await client.console.passkeys.registrationVerify({ challengeToken, response });
+ *
+ * // Login (public — works on a tokenless client).
+ * const opts = await client.console.passkeys.authenticationOptions();
+ * const assertion = await startAuthentication({ optionsJSON: opts.options });
+ * const { token } = await client.console.passkeys.authenticationVerify({
+ *   challengeToken: opts.challengeToken,
+ *   response: assertion,
+ * });
+ * ```
+ */
+export declare class PasskeysApi {
+    #private;
+    /**
+     * @param host - The client this namespace issues requests through.
+     */
+    constructor(host: PasskeysHost);
+    /**
+     * A fresh registration challenge, scoped to the caller's own identity.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @returns The ceremony options and a single-use challenge token.
+     * @throws {ApiError} `400 passkey_not_configured`, `403 passkey_not_eligible`.
+     */
+    registrationOptions(): Promise<PasskeyCeremonyOptions>;
+    /**
+     * Verify a registration ceremony and store the credential.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The challenge token from `registrationOptions()`, the browser's ceremony
+     *   response, and an optional caller-chosen label.
+     * @returns The stored passkey's metadata, unwrapped from the `passkey` envelope.
+     * @throws {ApiError} `400 passkey_registration_failed`, `403 passkey_not_eligible`,
+     *   `409 passkey_already_registered`.
+     */
+    registrationVerify(input: RegistrationVerifyInput): Promise<Passkey>;
+    /**
+     * A fresh authentication challenge. No identifier is sent or accepted —
+     * discoverable credentials only (P1): the owner is resolved server-side
+     * from the assertion itself, never from anything this call sends.
+     *
+     * PUBLIC — sends no bearer, even on a client that already holds one
+     * (`requireAuth: false`). Without it, the login screen (the normal case:
+     * no session exists yet) could never call this method at all — a tokenless
+     * client would hit `requireToken`'s `ConfigError` before `fetch` is ever
+     * called.
+     *
+     * @returns The ceremony options and a single-use challenge token.
+     * @throws {ApiError} `400 passkey_not_configured`.
+     */
+    authenticationOptions(): Promise<PasskeyCeremonyOptions>;
+    /**
+     * Verify an authentication (login) ceremony and mint a session — the same
+     * way `console.auth.login` does (HITL-5).
+     *
+     * PUBLIC — sends no bearer, even on a client that already holds one
+     * (`requireAuth: false`). Every failure mode past a malformed body is the
+     * same `401 passkey_rejected` (P9): unknown credential, revoked credential,
+     * wrong kind, bad signature, counter regression, and a spent/invalid
+     * challenge are indistinguishable to the caller.
+     *
+     * @param input - The challenge token from `authenticationOptions()` and the browser's ceremony
+     *   response.
+     * @returns The token, the caller's identity, and the token's lifetime.
+     * @throws {ApiError} `401 passkey_rejected` on any verification failure.
+     */
+    authenticationVerify(input: AuthenticationVerifyInput): Promise<PasskeyAuthenticationVerifyResponse>;
+    /**
+     * List the caller's own passkeys.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @returns The caller's passkeys, unwrapped from the `passkeys` envelope. Never the empty array
+     *   collapsed to `undefined` — an empty account gets `[]`.
+     */
+    list(): Promise<Passkey[]>;
+    /**
+     * Revoke (delete) one of the caller's own passkeys.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param id - The passkey id.
+     * @returns Nothing: the server answers `204` with no body.
+     * @throws {ApiError} `404 passkey_not_found`.
+     */
+    revoke(id: string): Promise<void>;
+}
+//# sourceMappingURL=passkeys.d.ts.map

package/dist/src/console/passkeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.d.ts","sourceRoot":"","sources":["../../../src/console/passkeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,6FAA6F;AAC7F,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,yGAAyG;AACzG,MAAM,WAAW,yBAAyB;IACxC,uEAAuE;IACvE,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,WAAW;;IAGtB;;OAEG;gBACS,IAAI,EAAE,YAAY;IAI9B;;;;;;;OAOG;IACG,mBAAmB,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAS5D;;;;;;;;;;OAUG;IACG,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAS1E;;;;;;;;;;;;;OAaG;IACG,qBAAqB,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAU9D;;;;;;;;;;;;;;OAcG;IACG,oBAAoB,CACxB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,mCAAmC,CAAC;IAU/C;;;;;;;OAOG;IACG,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAKhC;;;;;;;;OAQG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGxC"}

package/dist/src/console/passkeys.js

@@ -0,0 +1,192 @@
+/**
+ * `client.console.passkeys.*` — WebAuthn passkey management and login for
+ * self-serve Studio users (T1.1.5).
+ *
+ * **Studio-internal, not the published partner contract.** This namespace
+ * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
+ * `endpoints.json` and from the root barrel (`mod.ts`) — see `docs/console.md`
+ * and HITL-1 in this task's contract. `@w6w/sdk`'s instance-state mechanism
+ * pin still applies here exactly as it does to every other namespace
+ * (`docs/implementation.md` §MECHANISM PIN — instance state, never globals):
+ * this class holds no state of its own beyond the injected host, so two
+ * clients in one process never share a credential.
+ *
+ * **Who this is for (HITL-3).** Passkeys belong to self-serve Studio users
+ * only; a partner-tenant user's IdP owns its identity. No eligibility logic
+ * lives here — the server enforces it (`PasskeyNotEligibleError`), and this
+ * module is a plain transport shim over whatever it decides.
+ *
+ * **Two routes, four methods, split by who is authenticated.** The management
+ * quartet (`registrationOptions`, `registrationVerify`, `list`, `revoke`) is
+ * GUARDED, mirroring `packages/server/packages/api/data/passkeys.ts`'s own
+ * doc comment ("Registered BELOW the auth guard"). The login pair
+ * (`authenticationOptions`, `authenticationVerify`) is PUBLIC, mirroring
+ * `packages/server/packages/api/id/passkey-login.ts`'s own doc comment ("BOTH
+ * routes are PUBLIC and UNAUTHENTICATED by construction") — discoverable
+ * credentials, no identifier in the request body (P1). Each of those two
+ * methods passes `requireAuth: false`, the same mechanism
+ * `console.auth.login`/`signup`/`checkAccountSlug` rely on: without it a
+ * tokenless client (the normal case at the login screen, before any session
+ * exists) would hit `requireToken`'s `ConfigError` before `fetch` is ever
+ * called.
+ *
+ * **`authenticationVerify` mints a session, the same way `login` does
+ * (HITL-5).** A verified passkey assertion is a standalone alternative to a
+ * password, not a second factor — so its response is token-bearing, exactly
+ * like `console.auth.login`'s. It is a SEPARATE type from `LoginResponse`
+ * (`./auth.ts`), not a reuse: the server route is byte-shape-identical to
+ * `user-login.ts`'s login body (`id/passkey-login.ts`'s own doc comment) which
+ * carries `role`, `tenant` and `emailVerified` on `user` — fields
+ * `console.auth`'s `LoginResponse.user` does not declare.
+ *
+ * **WebAuthn ceremony payloads (`options`/`response`) are opaque JSON, typed
+ * as `Record<string, unknown>`, never as `@simplewebauthn/*` types.** This
+ * package has no dependency on `@simplewebauthn` (browser or server) and
+ * adding one only to type two pass-through fields would be a new dependency
+ * for zero behavioural gain — `inputs.touch` for this task explicitly
+ * excludes `package.json`. A caller passes the browser's own
+ * `PublicKeyCredentialCreationOptionsJSON`/`...RequestOptionsJSON` (from
+ * `options`) into `navigator.credentials.create()`/`.get()` (or a helper such
+ * as `@simplewebauthn/browser`'s `startRegistration`/`startAuthentication`)
+ * and forwards what comes back as `response` — this module never inspects
+ * either shape, only relays it.
+ *
+ * @module
+ */
+import { path } from "../http.js";
+import { unwrap } from "../types.js";
+/**
+ * The `console.passkeys` namespace on a `W6WClient`.
+ *
+ * @example
+ * ```ts
+ * // Registration (authenticated).
+ * const { options, challengeToken } = await client.console.passkeys.registrationOptions();
+ * const response = await startRegistration({ optionsJSON: options }); // e.g. @simplewebauthn/browser
+ * const passkey = await client.console.passkeys.registrationVerify({ challengeToken, response });
+ *
+ * // Login (public — works on a tokenless client).
+ * const opts = await client.console.passkeys.authenticationOptions();
+ * const assertion = await startAuthentication({ optionsJSON: opts.options });
+ * const { token } = await client.console.passkeys.authenticationVerify({
+ *   challengeToken: opts.challengeToken,
+ *   response: assertion,
+ * });
+ * ```
+ */
+export class PasskeysApi {
+    #host;
+    /**
+     * @param host - The client this namespace issues requests through.
+     */
+    constructor(host) {
+        this.#host = host;
+    }
+    /**
+     * A fresh registration challenge, scoped to the caller's own identity.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @returns The ceremony options and a single-use challenge token.
+     * @throws {ApiError} `400 passkey_not_configured`, `403 passkey_not_eligible`.
+     */
+    async registrationOptions() {
+        const res = await this.#host.request({
+            method: "POST",
+            path: "/me/passkeys/options",
+            body: {},
+        });
+        return res.body;
+    }
+    /**
+     * Verify a registration ceremony and store the credential.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param input - The challenge token from `registrationOptions()`, the browser's ceremony
+     *   response, and an optional caller-chosen label.
+     * @returns The stored passkey's metadata, unwrapped from the `passkey` envelope.
+     * @throws {ApiError} `400 passkey_registration_failed`, `403 passkey_not_eligible`,
+     *   `409 passkey_already_registered`.
+     */
+    async registrationVerify(input) {
+        const res = await this.#host.request({
+            method: "POST",
+            path: "/me/passkeys",
+            body: input,
+        });
+        return unwrap(res, "passkey");
+    }
+    /**
+     * A fresh authentication challenge. No identifier is sent or accepted —
+     * discoverable credentials only (P1): the owner is resolved server-side
+     * from the assertion itself, never from anything this call sends.
+     *
+     * PUBLIC — sends no bearer, even on a client that already holds one
+     * (`requireAuth: false`). Without it, the login screen (the normal case:
+     * no session exists yet) could never call this method at all — a tokenless
+     * client would hit `requireToken`'s `ConfigError` before `fetch` is ever
+     * called.
+     *
+     * @returns The ceremony options and a single-use challenge token.
+     * @throws {ApiError} `400 passkey_not_configured`.
+     */
+    async authenticationOptions() {
+        const res = await this.#host.request({
+            method: "POST",
+            path: "/auth/passkey/options",
+            body: {},
+            requireAuth: false,
+        });
+        return res.body;
+    }
+    /**
+     * Verify an authentication (login) ceremony and mint a session — the same
+     * way `console.auth.login` does (HITL-5).
+     *
+     * PUBLIC — sends no bearer, even on a client that already holds one
+     * (`requireAuth: false`). Every failure mode past a malformed body is the
+     * same `401 passkey_rejected` (P9): unknown credential, revoked credential,
+     * wrong kind, bad signature, counter regression, and a spent/invalid
+     * challenge are indistinguishable to the caller.
+     *
+     * @param input - The challenge token from `authenticationOptions()` and the browser's ceremony
+     *   response.
+     * @returns The token, the caller's identity, and the token's lifetime.
+     * @throws {ApiError} `401 passkey_rejected` on any verification failure.
+     */
+    async authenticationVerify(input) {
+        const res = await this.#host.request({
+            method: "POST",
+            path: "/auth/passkey/verify",
+            body: input,
+            requireAuth: false,
+        });
+        return res.body;
+    }
+    /**
+     * List the caller's own passkeys.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @returns The caller's passkeys, unwrapped from the `passkeys` envelope. Never the empty array
+     *   collapsed to `undefined` — an empty account gets `[]`.
+     */
+    async list() {
+        const res = await this.#host.request({ method: "GET", path: "/me/passkeys" });
+        return unwrap(res, "passkeys");
+    }
+    /**
+     * Revoke (delete) one of the caller's own passkeys.
+     *
+     * AUTHENTICATED — the default `requireAuth` applies.
+     *
+     * @param id - The passkey id.
+     * @returns Nothing: the server answers `204` with no body.
+     * @throws {ApiError} `404 passkey_not_found`.
+     */
+    async revoke(id) {
+        await this.#host.request({ method: "DELETE", path: path `/me/passkeys/${id}` });
+    }
+}
+//# sourceMappingURL=passkeys.js.map

package/dist/src/console/passkeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.js","sourceRoot":"","sources":["../../../src/console/passkeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAqGrC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,WAAW;IACb,KAAK,CAAe;IAE7B;;OAEG;IACH,YAAY,IAAkB;QAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAyB;YAC3D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAA8B;QACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,MAAM,CAAU,GAAG,EAAE,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,qBAAqB;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAyB;YAC3D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE;YACR,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,oBAAoB,CACxB,KAAgC;QAEhC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsC;YACxE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,KAAK;YACX,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvF,OAAO,MAAM,CAAY,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAA,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;CACF"}

package/dist/src/endpoints.d.ts

@@ -0,0 +1,75 @@
+/**
+ * `client.endpoints.*` — run an Endpoint by the key you gave it.
+ *
+ * An Endpoint is a callable entry point that dispatches to whatever it targets:
+ * an app action, a Function, or a Workflow. Before this namespace existed,
+ * calling one meant `client.run({ urn: "ep_…" })` — an opaque id, buried inside
+ * an object, for an Endpoint the user named `send-email`. Now:
+ *
+ * ```ts
+ * await client.endpoints.run("send-email", { payload: { to, subject } });
+ * ```
+ *
+ * The name is the FIRST argument, matching `workflows.run` and `functions.run`,
+ * so all three runnable kinds read alike.
+ *
+ * ID OR KEY, one argument: `/endpoints/{idOrKey}/invoke` accepts either, because
+ * an id carries a kind prefix (and so an underscore) while a key is kebab-case
+ * (which forbids one). No flag, no prefix — pass whichever you have.
+ *
+ * UNLIKE `functions.run`, THIS RETURNS AN ENVELOPE, and that asymmetry is the
+ * honest one: a Function's kind is settled by the method name, but an Endpoint
+ * dispatches to one of three things and the caller genuinely does not know which
+ * answered. The `kind` discriminant is information here, not ceremony — and the
+ * Workflow arm is asynchronous (`202`, a `runId`) where the other two are not.
+ */
+import type { ResolvedConfig } from "./config.ts";
+import { type HttpResponse, type RequestOptions } from "./http.ts";
+import type { RunEnvelope } from "./types.ts";
+/**
+ * What this namespace needs from the client — the same narrow seam
+ * `WorkflowsApi` and `FunctionsApi` take.
+ */
+export interface EndpointsHost {
+    /** The resolved configuration. */
+    readonly config: ResolvedConfig;
+    /** Perform one request. */
+    request<T>(options: RequestOptions): Promise<HttpResponse<T>>;
+}
+/** Per-call options for `endpoints.run`. */
+export interface EndpointRunOptions {
+    /**
+     * The Endpoint's input, by input key.
+     *
+     * Named `payload` for the same reason as `functions.run`: one word across
+     * every runnable kind, even though the wire spells this one `input`.
+     */
+    payload?: Record<string, unknown>;
+}
+/**
+ * The `endpoints` namespace on a `W6WClient`.
+ *
+ * @example
+ * ```ts
+ * const envelope = await client.endpoints.run("send-email", { payload: { to } });
+ * if (envelope.kind === "workflow") console.log(envelope.runId); // async arm
+ * ```
+ */
+export declare class EndpointsApi {
+    #private;
+    /**
+     * @param host - The client this namespace issues requests through.
+     */
+    constructor(host: EndpointsHost);
+    /**
+     * Run one Endpoint; the envelope's `kind` says which arm answered.
+     *
+     * @param name - The Endpoint's key (`"send-email"`) or its `ep_…` id. Percent-encoded into the path.
+     * @param options - `payload`, the Endpoint's input.
+     * @returns The `kind`-discriminated envelope, returned exactly as it arrived.
+     * @throws {ApiError} `404 unknown_endpoint` when no Endpoint of that name exists for the caller.
+     * @throws {ApiError} `bad_response` when a success body carries no string `kind`.
+     */
+    run(name: string, options?: EndpointRunOptions): Promise<RunEnvelope>;
+}
+//# sourceMappingURL=endpoints.d.ts.map

package/dist/src/endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../src/endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,qBAAa,YAAY;;IAGvB;;OAEG;gBACS,IAAI,EAAE,aAAa;IAI/B;;;;;;;;OAQG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC;CAyB5E"}

package/dist/src/endpoints.js

@@ -0,0 +1,47 @@
+import { ApiError } from "./errors.js";
+import { path } from "./http.js";
+/**
+ * The `endpoints` namespace on a `W6WClient`.
+ *
+ * @example
+ * ```ts
+ * const envelope = await client.endpoints.run("send-email", { payload: { to } });
+ * if (envelope.kind === "workflow") console.log(envelope.runId); // async arm
+ * ```
+ */
+export class EndpointsApi {
+    #host;
+    /**
+     * @param host - The client this namespace issues requests through.
+     */
+    constructor(host) {
+        this.#host = host;
+    }
+    /**
+     * Run one Endpoint; the envelope's `kind` says which arm answered.
+     *
+     * @param name - The Endpoint's key (`"send-email"`) or its `ep_…` id. Percent-encoded into the path.
+     * @param options - `payload`, the Endpoint's input.
+     * @returns The `kind`-discriminated envelope, returned exactly as it arrived.
+     * @throws {ApiError} `404 unknown_endpoint` when no Endpoint of that name exists for the caller.
+     * @throws {ApiError} `bad_response` when a success body carries no string `kind`.
+     */
+    async run(name, options) {
+        const res = await this.#host.request({
+            method: "POST",
+            path: path `/endpoints/${name}/invoke`,
+            body: { input: options?.payload ?? {} },
+        });
+        const body = res.body;
+        // The same guard `run.ts` applies, for the same reason: an object-only
+        // check lets `{}` and `[]` through and hands back an envelope whose `kind`
+        // is `undefined` at runtime — a lie the compiler cannot catch.
+        if (typeof body !== "object" || body === null ||
+            typeof body.kind !== "string") {
+            throw new ApiError(res.status, "bad_response", `Server returned a ${res.status} with no "kind" in the response body.`, body);
+        }
+        // Returned as it arrived — an unknown `kind` reaches the caller intact.
+        return body;
+    }
+}
+//# sourceMappingURL=endpoints.js.map

package/dist/src/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/endpoints.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAqB,IAAI,EAAuB,MAAM,WAAW,CAAC;AAyBzE;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IACd,KAAK,CAAgB;IAE9B;;OAEG;IACH,YAAY,IAAmB;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,OAA4B;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,cAAc,IAAI,SAAS;YACrC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE;SACxC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,uEAAuE;QACvE,2EAA2E;QAC3E,+DAA+D;QAC/D,IACE,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACzC,OAAQ,IAA2B,CAAC,IAAI,KAAK,QAAQ,EACrD,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,GAAG,CAAC,MAAM,EACV,cAAc,EACd,qBAAqB,GAAG,CAAC,MAAM,uCAAuC,EACtE,IAAI,CACL,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,OAAO,IAAmB,CAAC;IAC7B,CAAC;CACF"}