@w6w/sdk 0.5.0 → 0.9.8

package/dist/src/console/subscriptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscriptions.js","sourceRoot":"","sources":["../../../src/console/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA2DrC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAClB,KAAK,CAAoB;IAElC;;OAEG;IACH,YAAY,IAAuB;QACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QACH,OAAO,MAAM,CAAiB,GAAG,EAAE,eAAe,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,cAAc,UAAU,gBAAgB;SACnD,CAAC,CAAC;QACH,OAAO,MAAM,CAAiB,GAAG,EAAE,eAAe,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,kBAAkB,EAAE,EAAE;SACjC,CAAC,CAAC;QACH,OAAO,MAAM,CAAe,GAAG,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,KAAa,EACb,UAAkB,EAClB,KAA8B;QAE9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,SAAS,KAAK,aAAa,UAAU,gBAAgB;YAC/D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,MAAM,CAAe,GAAG,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,IAAI,CAAA,kBAAkB,EAAE,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,kBAAkB,EAAE,SAAS;SACxC,CAAC,CAAC;QACH,OAAO,MAAM,CAAwB,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,mBAAmB,OAAO,UAAU;SAC/C,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"subscriptions.js","sourceRoot":"","sources":["../../../src/console/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAsFrC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAClB,KAAK,CAAoB;IAElC;;OAEG;IACH,YAAY,IAAuB;QACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QACH,OAAO,MAAM,CAAiB,GAAG,EAAE,eAAe,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,cAAc,UAAU,gBAAgB;SACnD,CAAC,CAAC;QACH,OAAO,MAAM,CAAiB,GAAG,EAAE,eAAe,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,kBAAkB,EAAE,EAAE;SACjC,CAAC,CAAC;QACH,OAAO,MAAM,CAAe,GAAG,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,KAAa,EACb,UAAkB,EAClB,KAA8B;QAE9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,SAAS,KAAK,aAAa,UAAU,gBAAgB;YAC/D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,MAAM,CAAe,GAAG,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,IAAI,CAAA,kBAAkB,EAAE,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,kBAAkB,EAAE,SAAS;SACxC,CAAC,CAAC;QACH,OAAO,MAAM,CAAwB,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,mBAAmB,OAAO,UAAU;SAC/C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/src/console/tenant-login-flags.d.ts

@@ -0,0 +1,106 @@
+/**
+ * `client.console.tenantLoginFlags.*` — a tenant administrator's own
+ * password/OTP sign-in toggles (T2.1.3).
+ *
+ * **Studio-internal, not the published partner contract.** This namespace
+ * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
+ * `endpoints.json` and from the root barrel (`mod.ts`) — see `docs/console.md`.
+ * `@w6w/sdk`'s instance-state mechanism pin still applies here exactly as it
+ * does to every other namespace (`docs/implementation.md` §MECHANISM PIN —
+ * instance state, never globals): this class holds no state of its own beyond
+ * the injected host, so two clients in one process never share a credential.
+ *
+ * **The tenant is never a parameter here** — mirrors `console.tenantOAuthApps`
+ * exactly: both routes are scoped by the caller's own credential (the tenant
+ * claim on the bearer) plus a server-side `requireTenantAdmin` check
+ * (T2.1.1's wire pin), never by an id this client sends.
+ *
+ * **`put`'s body is built by OMISSION, key by key — absence means "leave
+ * whatever is stored alone".** T2.1.1's wire pin states it directly: "absent
+ * means preserve, `null` is refused." Unlike
+ * `console.tenantOAuthApps.SetTenantOAuthAppInput`, neither field here ever
+ * accepts `null` — both are plain optional booleans — so {@linkcode toSetBody}
+ * is the simpler of the two omission builders, but the discipline (never
+ * `JSON.stringify`'s own `undefined`-dropping behaviour, an explicit
+ * allowlist of exactly two keys) is the same one for the same reason: a
+ * caller-widened input type must not be able to smuggle a third key onto the
+ * wire from here.
+ *
+ * **The one refusal this domain can produce, `409 no_fallback_login`, is not
+ * caught here.** Disabling password with OTP off (or vice versa) would leave
+ * the tenant with no way in at all; the server refuses it and this method
+ * propagates the `ApiError` unchanged, exactly like every other write in this
+ * package — the caller (`packages/studio/src/pages/TenantSettingsPage.tsx`)
+ * is what turns the code into a sentence.
+ *
+ * @module
+ */
+import { type HttpResponse, type RequestOptions } from "../http.ts";
+/**
+ * The slice of `W6WClient` this namespace needs: the transport, and nothing
+ * else. Structural rather than a concrete client type, so the namespace stays
+ * independently constructible in a test and this module never imports the
+ * client back — mirrors `TenantOAuthAppsHost` in `./tenant-oauth-apps.ts`.
+ */
+export interface TenantLoginFlagsHost {
+    /** Perform one request. */
+    request<T>(options: RequestOptions): Promise<HttpResponse<T>>;
+}
+/** The tenant's current sign-in configuration — `GET`/`PUT /tenant/login-flags` (T2.1.1's wire pin). */
+export interface TenantLoginFlags {
+    /** Whether email one-time-code sign-in is turned on for this tenant. */
+    otpEnabled: boolean;
+    /** Whether password sign-in is turned OFF for this tenant. */
+    passwordDisabled: boolean;
+}
+/**
+ * The body `put` sends — built by OMISSION, key by key. Both fields are
+ * optional; an omitted field is left untouched server-side. See this
+ * module's header for why neither ever carries `null` (unlike
+ * `console.tenantOAuthApps.SetTenantOAuthAppInput`).
+ */
+export interface SetTenantLoginFlagsInput {
+    otpEnabled?: boolean;
+    passwordDisabled?: boolean;
+}
+/**
+ * The `console.tenantLoginFlags` namespace on a `W6WClient` — the caller's
+ * own tenant, never a tenant of its choosing.
+ *
+ * @example
+ * ```ts
+ * const flags = await client.console.tenantLoginFlags.get();
+ * await client.console.tenantLoginFlags.put({ otpEnabled: true });
+ * ```
+ */
+export declare class TenantLoginFlagsApi {
+    #private;
+    /**
+     * @param host - The client this namespace issues requests through.
+     */
+    constructor(host: TenantLoginFlagsHost);
+    /**
+     * The caller's tenant's current sign-in flags.
+     *
+     * AUTHENTICATED, `requireTenantAdmin` — the default `requireAuth` applies.
+     *
+     * @returns `{ otpEnabled, passwordDisabled }`.
+     * @throws {ApiError} `403` when the caller does not administer its tenant.
+     */
+    get(): Promise<TenantLoginFlags>;
+    /**
+     * Update the caller's tenant's sign-in flags, sending **only the fields
+     * `input` sets**.
+     *
+     * AUTHENTICATED, `requireTenantAdmin` — the default `requireAuth` applies.
+     *
+     * @param input - The flags to set; an omitted field is left untouched server-side.
+     * @returns The stored flags after the update.
+     * @throws {ApiError} `403` when the caller does not administer its tenant;
+     *   `400 invalid_body` for a non-boolean present value; `409
+     *   no_fallback_login` when the change would leave the tenant with no way
+     *   in — NOT caught here, propagated unchanged (see this module's header).
+     */
+    put(input: SetTenantLoginFlagsInput): Promise<TenantLoginFlags>;
+}
+//# sourceMappingURL=tenant-login-flags.d.ts.map

package/dist/src/console/tenant-login-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-login-flags.d.ts","sourceRoot":"","sources":["../../../src/console/tenant-login-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;IACpB,8DAA8D;IAC9D,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAoBD;;;;;;;;;GASG;AACH,qBAAa,mBAAmB;;IAG9B;;OAEG;gBACS,IAAI,EAAE,oBAAoB;IAItC;;;;;;;OAOG;IACG,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAQtC;;;;;;;;;;;;OAYG;IACG,GAAG,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAQtE"}

package/dist/src/console/tenant-login-flags.js

@@ -0,0 +1,113 @@
+/**
+ * `client.console.tenantLoginFlags.*` — a tenant administrator's own
+ * password/OTP sign-in toggles (T2.1.3).
+ *
+ * **Studio-internal, not the published partner contract.** This namespace
+ * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
+ * `endpoints.json` and from the root barrel (`mod.ts`) — see `docs/console.md`.
+ * `@w6w/sdk`'s instance-state mechanism pin still applies here exactly as it
+ * does to every other namespace (`docs/implementation.md` §MECHANISM PIN —
+ * instance state, never globals): this class holds no state of its own beyond
+ * the injected host, so two clients in one process never share a credential.
+ *
+ * **The tenant is never a parameter here** — mirrors `console.tenantOAuthApps`
+ * exactly: both routes are scoped by the caller's own credential (the tenant
+ * claim on the bearer) plus a server-side `requireTenantAdmin` check
+ * (T2.1.1's wire pin), never by an id this client sends.
+ *
+ * **`put`'s body is built by OMISSION, key by key — absence means "leave
+ * whatever is stored alone".** T2.1.1's wire pin states it directly: "absent
+ * means preserve, `null` is refused." Unlike
+ * `console.tenantOAuthApps.SetTenantOAuthAppInput`, neither field here ever
+ * accepts `null` — both are plain optional booleans — so {@linkcode toSetBody}
+ * is the simpler of the two omission builders, but the discipline (never
+ * `JSON.stringify`'s own `undefined`-dropping behaviour, an explicit
+ * allowlist of exactly two keys) is the same one for the same reason: a
+ * caller-widened input type must not be able to smuggle a third key onto the
+ * wire from here.
+ *
+ * **The one refusal this domain can produce, `409 no_fallback_login`, is not
+ * caught here.** Disabling password with OTP off (or vice versa) would leave
+ * the tenant with no way in at all; the server refuses it and this method
+ * propagates the `ApiError` unchanged, exactly like every other write in this
+ * package — the caller (`packages/studio/src/pages/TenantSettingsPage.tsx`)
+ * is what turns the code into a sentence.
+ *
+ * @module
+ */
+import {} from "../http.js";
+/**
+ * Serialise {@linkcode SetTenantLoginFlagsInput} for the wire: **only the
+ * keys actually present.** Written as explicit `!== undefined` tests rather
+ * than a spread, mirroring `./tenant-oauth-apps.ts`'s `toSetBody` — it keeps
+ * `undefined` off the wire without relying on `JSON.stringify` to drop it,
+ * and it is an allowlist: a caller that widens the input type cannot get a
+ * third key onto the wire from here.
+ *
+ * @param input - The caller's partial update.
+ * @returns A body carrying exactly the keys `input` set.
+ */
+function toSetBody(input) {
+    const body = {};
+    if (input.otpEnabled !== undefined)
+        body.otpEnabled = input.otpEnabled;
+    if (input.passwordDisabled !== undefined)
+        body.passwordDisabled = input.passwordDisabled;
+    return body;
+}
+/**
+ * The `console.tenantLoginFlags` namespace on a `W6WClient` — the caller's
+ * own tenant, never a tenant of its choosing.
+ *
+ * @example
+ * ```ts
+ * const flags = await client.console.tenantLoginFlags.get();
+ * await client.console.tenantLoginFlags.put({ otpEnabled: true });
+ * ```
+ */
+export class TenantLoginFlagsApi {
+    #host;
+    /**
+     * @param host - The client this namespace issues requests through.
+     */
+    constructor(host) {
+        this.#host = host;
+    }
+    /**
+     * The caller's tenant's current sign-in flags.
+     *
+     * AUTHENTICATED, `requireTenantAdmin` — the default `requireAuth` applies.
+     *
+     * @returns `{ otpEnabled, passwordDisabled }`.
+     * @throws {ApiError} `403` when the caller does not administer its tenant.
+     */
+    async get() {
+        const res = await this.#host.request({
+            method: "GET",
+            path: "/tenant/login-flags",
+        });
+        return res.body.flags;
+    }
+    /**
+     * Update the caller's tenant's sign-in flags, sending **only the fields
+     * `input` sets**.
+     *
+     * AUTHENTICATED, `requireTenantAdmin` — the default `requireAuth` applies.
+     *
+     * @param input - The flags to set; an omitted field is left untouched server-side.
+     * @returns The stored flags after the update.
+     * @throws {ApiError} `403` when the caller does not administer its tenant;
+     *   `400 invalid_body` for a non-boolean present value; `409
+     *   no_fallback_login` when the change would leave the tenant with no way
+     *   in — NOT caught here, propagated unchanged (see this module's header).
+     */
+    async put(input) {
+        const res = await this.#host.request({
+            method: "PUT",
+            path: "/tenant/login-flags",
+            body: toSetBody(input),
+        });
+        return res.body.flags;
+    }
+}
+//# sourceMappingURL=tenant-login-flags.js.map

package/dist/src/console/tenant-login-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-login-flags.js","sourceRoot":"","sources":["../../../src/console/tenant-login-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAA0C,MAAM,YAAY,CAAC;AAgCpE;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,KAA+B;IAChD,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACvE,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAmB;IACrB,KAAK,CAAuB;IAErC;;OAEG;IACH,YAAY,IAA0B;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG;QACP,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAA8B;YAChE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,qBAAqB;SAC5B,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,GAAG,CAAC,KAA+B;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAA8B;YAChE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC;SACvB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;IACxB,CAAC;CACF"}

package/dist/src/console/tenant-oauth-apps.d.ts

@@ -1,7 +1,7 @@
 /**
  * `client.console.tenantOAuthApps.*` — a tenant administrator's own OAuth
- * client overrides (list, upsert, remove) for the apps their tenant connects
- * to.
+ * client overrides (list, upsert, remove) and the candidate apps they can still
+ * configure (`listCandidates`), for the apps their tenant connects to.
  *
  * **Studio-internal, not the published partner contract.** This namespace
  * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
@@ -11,7 +11,7 @@
  * instance state, never globals): this class holds no state of its own beyond
  * the injected host, so two clients in one process never share a credential.
  *
- * **The tenant is never a parameter here.** These three routes are scoped by
+ * **The tenant is never a parameter here.** These four routes are scoped by
  * the caller's own credential (the tenant claim on the bearer) plus a
  * server-side tenant-admin check — unlike the operator family
  * (`GET/PUT/DELETE /tenants/:id/oauth-app…`, `api/admin/tenants.ts:307-309`),
@@ -29,8 +29,8 @@
  *
  * **Response shapes are flat, no envelope key to peel with `unwrap()`** —
  * mirroring `console/auth.ts:29-32` for this whole family. `list` returns the
- * whole body deliberately, because `callbackUrl` rides beside `configs` and an
- * `unwrap(res, "configs")` would silently drop it; `put` reaches one level in
+ * whole body deliberately, so the response is exactly what the server sent
+ * (each row carries the server-derived `callbackUrl`: the same URL for every app, never assembled client-side); `put` reaches one level in
  * for `body.config`, which is the shape the server answers with (W4).
  *
  * **Wire shapes are planner pins, not reverse-engineered from a merged route.**
@@ -76,6 +76,11 @@ export interface TenantOAuthAppSummary {
      * {@linkcode SetTenantOAuthAppInput} carries no `redirectUri` key.
      */
     redirectUri: string | null;
+    /**
+     * This row's OAuth callback URL, derived SERVER-SIDE and specific to this
+     * app and auth method. Display it; never assemble it. Absent from an older server.
+     */
+    callbackUrl?: string;
     /** Provider-specific extras (scopes, audience, …). `{}` when none. */
     extra: Record<string, unknown>;
     /** Whether a client secret is stored. **Never the secret itself.** */
@@ -87,8 +92,6 @@ export interface TenantOAuthAppSummary {
 export interface TenantOAuthAppsResponse {
     /** Every override this tenant has, in the server's order. */
     configs: TenantOAuthAppSummary[];
-    /** This host's OAuth callback, derived SERVER-SIDE. Display it; never assemble it. */
-    callbackUrl: string;
 }
 /**
  * The body `put` sends (W4) — **built by OMISSION, key by key.**
@@ -111,7 +114,7 @@ export interface TenantOAuthAppsResponse {
  * the user did not touch, never send `""`.
  *
  * **No `redirectUri` and no `force`.** Neither exists on this surface — the
- * callback URL is derived server-side (W3's `callbackUrl`) and the operator's
+ * callback URL is derived server-side (each row's `callbackUrl`) and the operator's
  * `?force` affordance is not offered to a tenant admin (W4). A field the SDK
  * declares is a field a form will fill, so neither is declared, and
  * {@linkcode toSetBody} additionally refuses to forward either at runtime.
@@ -130,14 +133,55 @@ export interface SetTenantOAuthAppInput {
     /** Whether to switch the override off. */
     disabled?: boolean;
 }
+/**
+ * One app a tenant administrator may register an OAuth client for — the picker
+ * subset `GET /tenant/oauth-apps/candidates` answers with. Flat; carries no
+ * OAuth configuration and no secret.
+ */
+export interface TenantOAuthCandidate {
+    id: string;
+    displayName: string;
+    version: string;
+    description: string;
+    categories?: string[];
+    /** Omitted by the server when larger than 8192 UTF-8 bytes. */
+    iconSvg?: string;
+    /** Omitted by the server when larger than 8192 UTF-8 bytes. */
+    iconSvgDark?: string;
+    brandColor?: string;
+    brandColorDark?: string;
+    owner: {
+        tenant: string;
+        subject: string;
+    };
+}
+/** One page of candidates. `nextCursor` is ABSENT (not `null`) on the last page. */
+export interface TenantOAuthCandidatesPage {
+    apps: TenantOAuthCandidate[];
+    nextCursor?: string;
+}
+/**
+ * Options for {@linkcode TenantOAuthAppsApi.listCandidates}. Each member is
+ * sent under its own wire name; an omitted member is absent from the request.
+ */
+export interface ListTenantOAuthCandidatesOptions {
+    /** Case-insensitive substring filter; the server trims it and rejects more than 200 characters. */
+    q?: string;
+    /** Page size, 1..200; the server defaults to 50. */
+    limit?: number;
+    /** Opaque cursor from a previous page's `nextCursor`. */
+    cursor?: string;
+    /** Aborts the request; an abort rejects with `ApiError` `code: "cancelled"`. */
+    signal?: AbortSignal;
+}
 /**
  * The `console.tenantOAuthApps` namespace on a `W6WClient` — the caller's own
  * tenant, never a tenant of its choosing.
  *
  * @example
  * ```ts
- * const { configs, callbackUrl } = await client.console.tenantOAuthApps.list();
- * // Register `callbackUrl` with the provider — never assemble it client-side.
+ * const { configs } = await client.console.tenantOAuthApps.list();
+ * // Register each row's `callbackUrl` with the provider — never assemble it client-side.
  * await client.console.tenantOAuthApps.put("sendgrid", "oauth2", { clientId: "abc" });
  * await client.console.tenantOAuthApps.remove("sendgrid", "oauth2");
  * ```
@@ -149,15 +193,32 @@ export declare class TenantOAuthAppsApi {
      */
     constructor(host: TenantOAuthAppsHost);
     /**
-     * List the caller's tenant's OAuth overrides, plus this host's callback URL.
+     * List the caller's tenant's OAuth overrides; each row carries its own
+     * server-derived `callbackUrl`.
      *
-     * Returns the body VERBATIM rather than unwrapping `configs`: `callbackUrl`
-     * rides beside it and is the one value a caller cannot compute for itself.
+     * Returns the body VERBATIM rather than unwrapping `configs`, so the
+     * response stays exactly what the server sent.
      *
-     * @returns Every override for this tenant, and the server-derived callback URL.
+     * @returns Every override for this tenant.
      * @throws {ApiError} `403` when the caller does not administer its tenant.
      */
     list(): Promise<TenantOAuthAppsResponse>;
+    /**
+     * Page through the apps this tenant could still register an OAuth client
+     * for (`GET /tenant/oauth-apps/candidates`).
+     *
+     * Returns the body VERBATIM. Every app eligible for the whole walk, with an
+     * unchanged display name, appears exactly once; an app whose eligibility or
+     * display name changes mid-walk may be missed or repeated, so restart with
+     * no cursor after a registration or removal.
+     *
+     * @param options - Optional `q`, `limit`, `cursor` and `signal`.
+     * @returns One page: `{apps, nextCursor}`; `nextCursor` is absent on the last page.
+     * @throws {ApiError} `400 invalid_query`/`invalid_cursor` on a bad parameter;
+     * `403` when the caller does not administer its tenant; `code: "cancelled"`
+     * when `options.signal` was aborted.
+     */
+    listCandidates(options?: ListTenantOAuthCandidatesOptions): Promise<TenantOAuthCandidatesPage>;
     /**
      * Create or update one override, sending **only the fields `input` sets**.
      *

package/dist/src/console/tenant-oauth-apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-oauth-apps.d.ts","sourceRoot":"","sources":["../../../src/console/tenant-oauth-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,sEAAsE;IACtE,eAAe,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,sBAAsB;IACrC,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA0BD;;;;;;;;;;;GAWG;AACH,qBAAa,kBAAkB;;IAG7B;;OAEG;gBACS,IAAI,EAAE,mBAAmB;IAIrC;;;;;;;;OAQG;IACG,IAAI,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAQ9C;;;;;;;;;;;OAWG;IACG,GAAG,CACP,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IASjC;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAM5D"}
+{"version":3,"file":"tenant-oauth-apps.d.ts","sourceRoot":"","sources":["../../../src/console/tenant-oauth-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,sEAAsE;IACtE,eAAe,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,sBAAsB;IACrC,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA0BD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,oFAAoF;AACpF,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,oBAAoB,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,gCAAgC;IAC/C,mGAAmG;IACnG,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,kBAAkB;;IAG7B;;OAEG;gBACS,IAAI,EAAE,mBAAmB;IAIrC;;;;;;;;;OASG;IACG,IAAI,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAQ9C;;;;;;;;;;;;;;OAcG;IACG,cAAc,CAClB,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,yBAAyB,CAAC;IAWrC;;;;;;;;;;;OAWG;IACG,GAAG,CACP,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IASjC;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAM5D"}

package/dist/src/console/tenant-oauth-apps.js

@@ -1,7 +1,7 @@
 /**
  * `client.console.tenantOAuthApps.*` — a tenant administrator's own OAuth
- * client overrides (list, upsert, remove) for the apps their tenant connects
- * to.
+ * client overrides (list, upsert, remove) and the candidate apps they can still
+ * configure (`listCandidates`), for the apps their tenant connects to.
  *
  * **Studio-internal, not the published partner contract.** This namespace
  * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
@@ -11,7 +11,7 @@
  * instance state, never globals): this class holds no state of its own beyond
  * the injected host, so two clients in one process never share a credential.
  *
- * **The tenant is never a parameter here.** These three routes are scoped by
+ * **The tenant is never a parameter here.** These four routes are scoped by
  * the caller's own credential (the tenant claim on the bearer) plus a
  * server-side tenant-admin check — unlike the operator family
  * (`GET/PUT/DELETE /tenants/:id/oauth-app…`, `api/admin/tenants.ts:307-309`),
@@ -29,8 +29,8 @@
  *
  * **Response shapes are flat, no envelope key to peel with `unwrap()`** —
  * mirroring `console/auth.ts:29-32` for this whole family. `list` returns the
- * whole body deliberately, because `callbackUrl` rides beside `configs` and an
- * `unwrap(res, "configs")` would silently drop it; `put` reaches one level in
+ * whole body deliberately, so the response is exactly what the server sent
+ * (each row carries the server-derived `callbackUrl`: the same URL for every app, never assembled client-side); `put` reaches one level in
  * for `body.config`, which is the shape the server answers with (W4).
  *
  * **Wire shapes are planner pins, not reverse-engineered from a merged route.**
@@ -80,8 +80,8 @@ function toSetBody(input) {
  *
  * @example
  * ```ts
- * const { configs, callbackUrl } = await client.console.tenantOAuthApps.list();
- * // Register `callbackUrl` with the provider — never assemble it client-side.
+ * const { configs } = await client.console.tenantOAuthApps.list();
+ * // Register each row's `callbackUrl` with the provider — never assemble it client-side.
  * await client.console.tenantOAuthApps.put("sendgrid", "oauth2", { clientId: "abc" });
  * await client.console.tenantOAuthApps.remove("sendgrid", "oauth2");
  * ```
@@ -95,12 +95,13 @@ export class TenantOAuthAppsApi {
         this.#host = host;
     }
     /**
-     * List the caller's tenant's OAuth overrides, plus this host's callback URL.
+     * List the caller's tenant's OAuth overrides; each row carries its own
+     * server-derived `callbackUrl`.
      *
-     * Returns the body VERBATIM rather than unwrapping `configs`: `callbackUrl`
-     * rides beside it and is the one value a caller cannot compute for itself.
+     * Returns the body VERBATIM rather than unwrapping `configs`, so the
+     * response stays exactly what the server sent.
      *
-     * @returns Every override for this tenant, and the server-derived callback URL.
+     * @returns Every override for this tenant.
      * @throws {ApiError} `403` when the caller does not administer its tenant.
      */
     async list() {
@@ -110,6 +111,31 @@ export class TenantOAuthAppsApi {
         });
         return res.body;
     }
+    /**
+     * Page through the apps this tenant could still register an OAuth client
+     * for (`GET /tenant/oauth-apps/candidates`).
+     *
+     * Returns the body VERBATIM. Every app eligible for the whole walk, with an
+     * unchanged display name, appears exactly once; an app whose eligibility or
+     * display name changes mid-walk may be missed or repeated, so restart with
+     * no cursor after a registration or removal.
+     *
+     * @param options - Optional `q`, `limit`, `cursor` and `signal`.
+     * @returns One page: `{apps, nextCursor}`; `nextCursor` is absent on the last page.
+     * @throws {ApiError} `400 invalid_query`/`invalid_cursor` on a bad parameter;
+     * `403` when the caller does not administer its tenant; `code: "cancelled"`
+     * when `options.signal` was aborted.
+     */
+    async listCandidates(options = {}) {
+        const { signal, q, limit, cursor } = options;
+        const res = await this.#host.request({
+            method: "GET",
+            path: "/tenant/oauth-apps/candidates",
+            query: { q, limit, cursor },
+            signal,
+        });
+        return res.body;
+    }
     /**
      * Create or update one override, sending **only the fields `input` sets**.
      *

package/dist/src/console/tenant-oauth-apps.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-oauth-apps.js","sourceRoot":"","sources":["../../../src/console/tenant-oauth-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAyF1E;;;;;;;;;;;;;;GAcG;AACH,SAAS,SAAS,CAAC,KAA6B;IAC9C,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC7E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,kBAAkB;IACpB,KAAK,CAAsB;IAEpC;;OAEG;IACH,YAAY,IAAyB;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAA0B;YAC5D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAG,CACP,KAAa,EACb,OAAe,EACf,KAA6B;QAE7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoC;YACtE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,qBAAqB,KAAK,IAAI,OAAO,EAAE;YACjD,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC;SACvB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAe;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,IAAI,CAAA,qBAAqB,KAAK,IAAI,OAAO,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"tenant-oauth-apps.js","sourceRoot":"","sources":["../../../src/console/tenant-oauth-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AA4F1E;;;;;;;;;;;;;;GAcG;AACH,SAAS,SAAS,CAAC,KAA6B;IAC9C,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC7E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AA2CD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,kBAAkB;IACpB,KAAK,CAAsB;IAEpC;;OAEG;IACH,YAAY,IAAyB;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAA0B;YAC5D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,cAAc,CAClB,UAA4C,EAAE;QAE9C,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B;YAC9D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,+BAA+B;YACrC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE;YAC3B,MAAM;SACP,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,GAAG,CACP,KAAa,EACb,OAAe,EACf,KAA6B;QAE7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoC;YACtE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,qBAAqB,KAAK,IAAI,OAAO,EAAE;YACjD,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC;SACvB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAe;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,IAAI,CAAA,qBAAqB,KAAK,IAAI,OAAO,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/src/console/tokens.d.ts

@@ -72,6 +72,8 @@ export interface ApiToken {
     updatedAt: string;
     /** ISO-8601 timestamp of revocation, or `null` while active/disabled. */
     revokedAt: string | null;
+    /** ISO-8601 timestamp of the token's last authenticated use, or `null` while unused. Optional: absent on a server build that predates this field. */
+    lastUsedAt?: string | null;
 }
 /**
  * `create`'s result — the token's metadata plus its plaintext secret, shown

package/dist/src/console/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/console/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED,yFAAyF;AACzF,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,MAAM,EAAE,cAAc,CAAC;IACvB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,KAAK,EAAE,QAAQ,CAAC;IAChB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,SAAS;;IAGpB;;OAEG;gBACS,IAAI,EAAE,UAAU;IAI5B;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAKjC;;;;;;;;;;;;;;OAcG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IASxD;;;;;;OAMG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAS5C;;;;;;;OAOG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAS3C;;;;;;OAMG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CAQ5C"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/console/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED,yFAAyF;AACzF,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,MAAM,EAAE,cAAc,CAAC;IACvB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qJAAqJ;IACrJ,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,KAAK,EAAE,QAAQ,CAAC;IAChB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,SAAS;;IAGpB;;OAEG;gBACS,IAAI,EAAE,UAAU;IAI5B;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAKjC;;;;;;;;;;;;;;OAcG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IASxD;;;;;;OAMG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAS5C;;;;;;;OAOG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAS3C;;;;;;OAMG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CAQ5C"}

package/dist/src/console/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/console/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAsDrC;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,SAAS;IACX,KAAK,CAAa;IAE3B;;OAEG;IACH,YAAY,IAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,OAAO,MAAM,CAAa,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsB;YACxD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,EAAE,IAAI,EAAE;SACf,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,WAAW,EAAE,UAAU;YACjC,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QACH,OAAO,MAAM,CAAW,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,WAAW,EAAE,SAAS;YAChC,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QACH,OAAO,MAAM,CAAW,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,WAAW,EAAE,SAAS;YAChC,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QACH,OAAO,MAAM,CAAW,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/console/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAwDrC;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,SAAS;IACX,KAAK,CAAa;IAE3B;;OAEG;IACH,YAAY,IAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,OAAO,MAAM,CAAa,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsB;YACxD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,EAAE,IAAI,EAAE;SACf,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,WAAW,EAAE,UAAU;YACjC,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QACH,OAAO,MAAM,CAAW,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,WAAW,EAAE,SAAS;YAChC,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QACH,OAAO,MAAM,CAAW,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,WAAW,EAAE,SAAS;YAChC,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QACH,OAAO,MAAM,CAAW,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/src/console/workflows.d.ts

@@ -25,6 +25,19 @@
  * documented partner story exists yet either) — that promotion, if it ever
  * happens, is a dedicated future project.
  *
+ * **That promotion has since happened, and this namespace deliberately stayed.**
+ * At contract `0.5.0` the definition lifecycle left `outOfScope` and landed on
+ * the BASE namespace in all three lanes — `client.workflows.get`/`create`/
+ * `update`/`archive`/`delete` (`../workflows.ts`). The two surfaces now overlap
+ * on four routes, and the split is by SHAPE, not by capability: the base methods
+ * take a definition and answer the wire's own envelope, while these keep the
+ * shapes studio's components are already written against (`upsert`'s single
+ * definition-plus-precondition argument, `get`'s three-field body). New callers
+ * — and every partner — want `client.workflows.*`. What is still ONLY here is
+ * the run history: `listRuns` and `getRun` stay console-only, and
+ * `endpoints.json` names `workflows.listRuns` in `outOfScope` so that stays
+ * deliberate rather than accidental.
+ *
  * **`list` and `run` are NOT part of this domain.** Both already exist on the
  * BASE namespace (`client.workflows.list()`/`client.workflows.run()`,
  * `../workflows.ts`) and studio reuses them verbatim — adding a duplicate
@@ -184,6 +197,7 @@ export declare class WorkflowsApi {
         workflow: {
             id: string;
             name: string;
+            key: string | null;
         };
         scheduled: boolean;
         updatedAt: string;

package/dist/src/console/workflows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../../src/console/workflows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAU,MAAM,aAAa,CAAC;AAKrE;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,QAAQ;IACvB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,MAAM,EAAE,SAAS,CAAC;IAClB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iHAAiH;IACjH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uDAAuD;IACvD,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,MAAM,EAAE,SAAS,CAAC;IAClB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,YAAY;;IAGvB;;OAEG;gBACS,IAAI,EAAE,aAAa;IAI/B;;;;;;;;;;;;;;;;OAgBG;IACG,GAAG,CACP,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAU9F;;;;;;;;;;;;;;;;;;;OAmBG;IACG,MAAM,CACV,UAAU,EAAE,OAAO,EACnB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAChE,OAAO,CAAC;QAAE,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAe7F;;;;;;;;;;OAUG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAQzE;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC;;;;;;OAMG;IACG,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAQjD;;;;;;;;;;OAUG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CAO/C"}
+{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../../src/console/workflows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAU,MAAM,aAAa,CAAC;AAKrE;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,QAAQ;IACvB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,MAAM,EAAE,SAAS,CAAC;IAClB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iHAAiH;IACjH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uDAAuD;IACvD,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,MAAM,EAAE,SAAS,CAAC;IAClB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,YAAY;;IAGvB;;OAEG;gBACS,IAAI,EAAE,aAAa;IAI/B;;;;;;;;;;;;;;;;OAgBG;IACG,GAAG,CACP,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAU9F;;;;;;;;;;;;;;;;;;;OAmBG;IACG,MAAM,CACV,UAAU,EAAE,OAAO,EACnB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAChE,OAAO,CACR;QACE,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;QAC3D,SAAS,EAAE,OAAO,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KACnB,CACF;IAmBD;;;;;;;;;;OAUG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAQzE;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC;;;;;;OAMG;IACG,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAQjD;;;;;;;;;;OAUG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CAO/C"}

package/dist/src/console/workflows.js

@@ -25,6 +25,19 @@
  * documented partner story exists yet either) — that promotion, if it ever
  * happens, is a dedicated future project.
  *
+ * **That promotion has since happened, and this namespace deliberately stayed.**
+ * At contract `0.5.0` the definition lifecycle left `outOfScope` and landed on
+ * the BASE namespace in all three lanes — `client.workflows.get`/`create`/
+ * `update`/`archive`/`delete` (`../workflows.ts`). The two surfaces now overlap
+ * on four routes, and the split is by SHAPE, not by capability: the base methods
+ * take a definition and answer the wire's own envelope, while these keep the
+ * shapes studio's components are already written against (`upsert`'s single
+ * definition-plus-precondition argument, `get`'s three-field body). New callers
+ * — and every partner — want `client.workflows.*`. What is still ONLY here is
+ * the run history: `listRuns` and `getRun` stay console-only, and
+ * `endpoints.json` names `workflows.listRuns` in `outOfScope` so that stays
+ * deliberate rather than accidental.
+ *
  * **`list` and `run` are NOT part of this domain.** Both already exist on the
  * BASE namespace (`client.workflows.list()`/`client.workflows.run()`,
  * `../workflows.ts`) and studio reuses them verbatim — adding a duplicate

package/dist/src/console/workflows.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../../src/console/workflows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAkC,MAAM,EAAE,MAAM,aAAa,CAAC;AAErE,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAoExD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,YAAY;IACd,KAAK,CAAgB;IAE9B;;OAEG;IACH,YAAY,IAAmB;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,GAAG,CACP,EAAU;QAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAElC;YACA,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,cAAc,EAAE,EAAE;SAC7B,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,MAAM,CACV,UAAmB,EACnB,OAAiE;QAEjE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAElC;YACA,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE;YACpC,IAAI,EAAE,UAAU;YAChB,GAAG,CAAC,OAAO,EAAE,iBAAiB;gBAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE,EAAE;gBACnE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwC;YAC1E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,cAAc,EAAE,UAAU;SACrC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAA,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,cAAc,EAAE,OAAO;SAClC,CAAC,CAAC;QACH,OAAO,MAAM,CAAe,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,SAAS,KAAK,EAAE;SAC3B,CAAC,CAAC;QACH,OAAO,MAAM,CAAW,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;CACF"}
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../../src/console/workflows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAkC,MAAM,EAAE,MAAM,aAAa,CAAC;AAErE,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAoExD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,YAAY;IACd,KAAK,CAAgB;IAE9B;;OAEG;IACH,YAAY,IAAmB;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,GAAG,CACP,EAAU;QAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAElC;YACA,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,cAAc,EAAE,EAAE;SAC7B,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,MAAM,CACV,UAAmB,EACnB,OAAiE;QAQjE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAMlC;YACA,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE;YACpC,IAAI,EAAE,UAAU;YAChB,GAAG,CAAC,OAAO,EAAE,iBAAiB;gBAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE,EAAE;gBACnE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwC;YAC1E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,cAAc,EAAE,UAAU;SACrC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAA,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,cAAc,EAAE,OAAO;SAClC,CAAC,CAAC;QACH,OAAO,MAAM,CAAe,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,SAAS,KAAK,EAAE;SAC3B,CAAC,CAAC;QACH,OAAO,MAAM,CAAW,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;CACF"}