@w6w/sdk 0.6.0 → 0.9.8

package/dist/src/console/step-tests.js.map

@@ -1 +1 @@
-{"version":3,"file":"step-tests.js","sourceRoot":"","sources":["../../../src/console/step-tests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgDrC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,YAAY;IACd,KAAK,CAAgB;IAE9B;;OAEG;IACH,YAAY,IAAmB;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,CACR,UAAkB,EAClB,MAAc,EACd,IAAsF;QAEtF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,cAAc,UAAU,UAAU,MAAM,QAAQ;YAC1D,IAAI;SACL,CAAC,CAAC;QACH,OAAO,MAAM,CAAW,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,MAAc;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,cAAc,UAAU,UAAU,MAAM,QAAQ;SAC3D,CAAC,CAAC;QACH,OAAO,MAAM,CAAa,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,SAAS,CACb,UAAkB,EAClB,MAAc,EACd,IAMC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,cAAc,UAAU,UAAU,MAAM,YAAY;YAC9D,IAAI;SACL,CAAC,CAAC;QACH,OAAO,MAAM,CAAc,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;CACF"}
+{"version":3,"file":"step-tests.js","sourceRoot":"","sources":["../../../src/console/step-tests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAqDrC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,YAAY;IACd,KAAK,CAAgB;IAE9B;;OAEG;IACH,YAAY,IAAmB;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,CACR,UAAkB,EAClB,MAAc,EACd,IAAsF;QAEtF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,cAAc,UAAU,UAAU,MAAM,QAAQ;YAC1D,IAAI;SACL,CAAC,CAAC;QACH,OAAO,MAAM,CAAW,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,MAAc;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,cAAc,UAAU,UAAU,MAAM,QAAQ;SAC3D,CAAC,CAAC;QACH,OAAO,MAAM,CAAa,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,SAAS,CACb,UAAkB,EAClB,MAAc,EACd,IAOC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,cAAc,UAAU,UAAU,MAAM,YAAY;YAC9D,IAAI;SACL,CAAC,CAAC;QACH,OAAO,MAAM,CAAc,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;CACF"}

package/dist/src/console/subscriptions.d.ts

@@ -26,16 +26,13 @@
  * `console.apps`'s/`console.functions`' identical treatment of their own
  * zero-caller methods.
  *
- * **`webhookUrl` is a real server-side field this module deliberately does
- * NOT model.** For a subscription whose `appId === "@w6w/webhook"`, the
- * server enriches the response with a `webhookUrl` field computed from a
- * config value genuinely distinct from studio's own `apiBaseUrl()`
- * (`internal-triggers.ts:123-127`, `config.ts:27,259`). Studio's current
- * `Subscription` type never modeled this and no in-boundary code reads it
- * (`SubscriptionsPage.tsx` computes its own webhook URL client-side
- * independently) — this is a deliberate, verified omission, not an
- * oversight: whatever extra field the server sends is silently ignored,
- * exactly as today.
+ * **`webhookUrl` is modeled.** For a subscription whose `appId ===
+ * "@w6w/webhook"`, the server enriches the response with a `webhookUrl`
+ * field — produced by `withUrl` in `server/packages/api/admin/triggers.ts:74`
+ * — computed from a config value genuinely distinct from studio's own
+ * `apiBaseUrl()` (`internal-triggers.ts:123-127`, `config.ts:27,259`).
+ * Present only for `appId === "@w6w/webhook"`; absent for every other
+ * subscription.
  *
  * Subscriptions are account-level, never scoped by `project` — so
  * `SubscriptionsHost` needs only the transport, mirroring `VarsHost`/
@@ -54,11 +51,18 @@ export interface SubscriptionsHost {
     /** Perform one request. */
     request<T>(options: RequestOptions): Promise<HttpResponse<T>>;
 }
+/** How a trigger's events arrive: pushed to a webhook, or fetched by a poll. */
+export type TriggerType = "webhook" | "poll";
+/**
+ * Where a subscription is in its registration lifecycle. Only `registered`
+ * subscriptions receive events.
+ */
+export type SubscriptionStatus = "pending" | "registered" | "failed" | "destroying";
 /**
  * A (trigger → workflow) binding. Field-for-field per
  * `packages/studio/src/api/types.ts:72-83` — this module does not redesign
- * the shape, only gives it a second home. Deliberately does NOT carry
- * `webhookUrl` — see this module's header.
+ * the shape, only gives it a second home. Also carries `webhookUrl` — see
+ * this module's header.
  */
 export interface Subscription {
     id: string;
@@ -71,6 +75,25 @@ export interface Subscription {
     enabled: boolean;
     createdAt: string;
     updatedAt: string;
+    /** How events arrive. */
+    type: TriggerType;
+    /** Registration lifecycle state. */
+    status: SubscriptionStatus;
+    /** Poll interval in ms; `null` for a webhook subscription. */
+    intervalMs: number | null;
+    /** Principal ids (workflow, connection, …) this subscription depends on. */
+    dependencies: string[];
+    /** When the next poll is due; `null` when not a poll or not yet scheduled. */
+    nextCheckAt: string | null;
+    /** The last registration failure, if any; `null` otherwise. */
+    lastError: {
+        code: string;
+        message: string;
+    } | null;
+    /** When registration last succeeded; `null` if it never has. */
+    registeredAt: string | null;
+    /** Present only for `appId === "@w6w/webhook"` — the server's own computed receive URL. */
+    webhookUrl?: string;
 }
 /**
  * The body of `create`, forwarded verbatim as the whole POST body.
@@ -80,9 +103,11 @@ export interface SubscriptionCreateInput {
     workflowId: string;
     connectionId?: string | null;
     params?: Record<string, unknown>;
+    /** Poll interval in ms (integer). Poll triggers only — the server defaults it to its floor. */
+    intervalMs?: number;
 }
 /** The lifecycle a delivered trigger event can be in. */
-export type TriggerEventStatus = "received" | "dispatching" | "dispatched" | "failed";
+export type TriggerEventStatus = "received" | "dispatching" | "dispatched" | "failed" | "ignored";
 /**
  * Metadata-only view of a delivered trigger event. Field-for-field per
  * `packages/studio/src/api/types.ts:85-96`.
@@ -124,9 +149,6 @@ export declare class SubscriptionsApi {
     /**
      * List the subscriptions bound to one workflow.
      *
-     * **Dead code (HITL-4)** — zero call sites anywhere in studio or
-     * `@w6w/ui`. Built for SDK completeness only; see this module's header.
-     *
      * @param workflowId - The `wf_…` id.
      * @returns The subscriptions, unwrapped from the `subscriptions` envelope.
      * @throws {ApiError} On any non-2xx.

package/dist/src/console/subscriptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscriptions.d.ts","sourceRoot":"","sources":["../../../src/console/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,yDAAyD;AACzD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,aAAa,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEtF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB;;IAG3B;;OAEG;gBACS,IAAI,EAAE,iBAAiB;IAInC;;;;;OAKG;IACG,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAQrC;;;;;;;;;OASG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAQlE;;;;;;;;;;;;OAYG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAQ5C;;;;;;;;OAQG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,YAAY,CAAC;IASxB;;;;;;;;;;OAUG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvC;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAQ5D;;;;;;;;;;;;OAYG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMnD"}
+{"version":3,"file":"subscriptions.d.ts","sourceRoot":"","sources":["../../../src/console/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED,gFAAgF;AAChF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;AAE7C;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,oCAAoC;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,8DAA8D;IAC9D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,4EAA4E;IAC5E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,+DAA+D;IAC/D,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACpD,gEAAgE;IAChE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,aAAa,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElG;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB;;IAG3B;;OAEG;gBACS,IAAI,EAAE,iBAAiB;IAInC;;;;;OAKG;IACG,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAQrC;;;;;;OAMG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAQlE;;;;;;;;;;;;OAYG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAQ5C;;;;;;;;OAQG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,YAAY,CAAC;IASxB;;;;;;;;;;OAUG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvC;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAQ5D;;;;;;;;;;;;OAYG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMnD"}

package/dist/src/console/subscriptions.js

@@ -26,16 +26,13 @@
  * `console.apps`'s/`console.functions`' identical treatment of their own
  * zero-caller methods.
  *
- * **`webhookUrl` is a real server-side field this module deliberately does
- * NOT model.** For a subscription whose `appId === "@w6w/webhook"`, the
- * server enriches the response with a `webhookUrl` field computed from a
- * config value genuinely distinct from studio's own `apiBaseUrl()`
- * (`internal-triggers.ts:123-127`, `config.ts:27,259`). Studio's current
- * `Subscription` type never modeled this and no in-boundary code reads it
- * (`SubscriptionsPage.tsx` computes its own webhook URL client-side
- * independently) — this is a deliberate, verified omission, not an
- * oversight: whatever extra field the server sends is silently ignored,
- * exactly as today.
+ * **`webhookUrl` is modeled.** For a subscription whose `appId ===
+ * "@w6w/webhook"`, the server enriches the response with a `webhookUrl`
+ * field — produced by `withUrl` in `server/packages/api/admin/triggers.ts:74`
+ * — computed from a config value genuinely distinct from studio's own
+ * `apiBaseUrl()` (`internal-triggers.ts:123-127`, `config.ts:27,259`).
+ * Present only for `appId === "@w6w/webhook"`; absent for every other
+ * subscription.
  *
  * Subscriptions are account-level, never scoped by `project` — so
  * `SubscriptionsHost` needs only the transport, mirroring `VarsHost`/
@@ -81,9 +78,6 @@ export class SubscriptionsApi {
     /**
      * List the subscriptions bound to one workflow.
      *
-     * **Dead code (HITL-4)** — zero call sites anywhere in studio or
-     * `@w6w/ui`. Built for SDK completeness only; see this module's header.
-     *
      * @param workflowId - The `wf_…` id.
      * @returns The subscriptions, unwrapped from the `subscriptions` envelope.
      * @throws {ApiError} On any non-2xx.

package/dist/src/console/subscriptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscriptions.js","sourceRoot":"","sources":["../../../src/console/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA2DrC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAClB,KAAK,CAAoB;IAElC;;OAEG;IACH,YAAY,IAAuB;QACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QACH,OAAO,MAAM,CAAiB,GAAG,EAAE,eAAe,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,cAAc,UAAU,gBAAgB;SACnD,CAAC,CAAC;QACH,OAAO,MAAM,CAAiB,GAAG,EAAE,eAAe,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,kBAAkB,EAAE,EAAE;SACjC,CAAC,CAAC;QACH,OAAO,MAAM,CAAe,GAAG,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,KAAa,EACb,UAAkB,EAClB,KAA8B;QAE9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,SAAS,KAAK,aAAa,UAAU,gBAAgB;YAC/D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,MAAM,CAAe,GAAG,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,IAAI,CAAA,kBAAkB,EAAE,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,kBAAkB,EAAE,SAAS;SACxC,CAAC,CAAC;QACH,OAAO,MAAM,CAAwB,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,mBAAmB,OAAO,UAAU;SAC/C,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"subscriptions.js","sourceRoot":"","sources":["../../../src/console/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAqB,IAAI,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAsFrC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAClB,KAAK,CAAoB;IAElC;;OAEG;IACH,YAAY,IAAuB;QACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QACH,OAAO,MAAM,CAAiB,GAAG,EAAE,eAAe,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,cAAc,UAAU,gBAAgB;SACnD,CAAC,CAAC;QACH,OAAO,MAAM,CAAiB,GAAG,EAAE,eAAe,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,kBAAkB,EAAE,EAAE;SACjC,CAAC,CAAC;QACH,OAAO,MAAM,CAAe,GAAG,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,KAAa,EACb,UAAkB,EAClB,KAA8B;QAE9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,SAAS,KAAK,aAAa,UAAU,gBAAgB;YAC/D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO,MAAM,CAAe,GAAG,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,IAAI,CAAA,kBAAkB,EAAE,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAA,kBAAkB,EAAE,SAAS;SACxC,CAAC,CAAC;QACH,OAAO,MAAM,CAAwB,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAU;YAChC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAA,mBAAmB,OAAO,UAAU;SAC/C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/src/console/tenant-login-flags.d.ts

@@ -0,0 +1,106 @@
+/**
+ * `client.console.tenantLoginFlags.*` — a tenant administrator's own
+ * password/OTP sign-in toggles (T2.1.3).
+ *
+ * **Studio-internal, not the published partner contract.** This namespace
+ * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
+ * `endpoints.json` and from the root barrel (`mod.ts`) — see `docs/console.md`.
+ * `@w6w/sdk`'s instance-state mechanism pin still applies here exactly as it
+ * does to every other namespace (`docs/implementation.md` §MECHANISM PIN —
+ * instance state, never globals): this class holds no state of its own beyond
+ * the injected host, so two clients in one process never share a credential.
+ *
+ * **The tenant is never a parameter here** — mirrors `console.tenantOAuthApps`
+ * exactly: both routes are scoped by the caller's own credential (the tenant
+ * claim on the bearer) plus a server-side `requireTenantAdmin` check
+ * (T2.1.1's wire pin), never by an id this client sends.
+ *
+ * **`put`'s body is built by OMISSION, key by key — absence means "leave
+ * whatever is stored alone".** T2.1.1's wire pin states it directly: "absent
+ * means preserve, `null` is refused." Unlike
+ * `console.tenantOAuthApps.SetTenantOAuthAppInput`, neither field here ever
+ * accepts `null` — both are plain optional booleans — so {@linkcode toSetBody}
+ * is the simpler of the two omission builders, but the discipline (never
+ * `JSON.stringify`'s own `undefined`-dropping behaviour, an explicit
+ * allowlist of exactly two keys) is the same one for the same reason: a
+ * caller-widened input type must not be able to smuggle a third key onto the
+ * wire from here.
+ *
+ * **The one refusal this domain can produce, `409 no_fallback_login`, is not
+ * caught here.** Disabling password with OTP off (or vice versa) would leave
+ * the tenant with no way in at all; the server refuses it and this method
+ * propagates the `ApiError` unchanged, exactly like every other write in this
+ * package — the caller (`packages/studio/src/pages/TenantSettingsPage.tsx`)
+ * is what turns the code into a sentence.
+ *
+ * @module
+ */
+import { type HttpResponse, type RequestOptions } from "../http.ts";
+/**
+ * The slice of `W6WClient` this namespace needs: the transport, and nothing
+ * else. Structural rather than a concrete client type, so the namespace stays
+ * independently constructible in a test and this module never imports the
+ * client back — mirrors `TenantOAuthAppsHost` in `./tenant-oauth-apps.ts`.
+ */
+export interface TenantLoginFlagsHost {
+    /** Perform one request. */
+    request<T>(options: RequestOptions): Promise<HttpResponse<T>>;
+}
+/** The tenant's current sign-in configuration — `GET`/`PUT /tenant/login-flags` (T2.1.1's wire pin). */
+export interface TenantLoginFlags {
+    /** Whether email one-time-code sign-in is turned on for this tenant. */
+    otpEnabled: boolean;
+    /** Whether password sign-in is turned OFF for this tenant. */
+    passwordDisabled: boolean;
+}
+/**
+ * The body `put` sends — built by OMISSION, key by key. Both fields are
+ * optional; an omitted field is left untouched server-side. See this
+ * module's header for why neither ever carries `null` (unlike
+ * `console.tenantOAuthApps.SetTenantOAuthAppInput`).
+ */
+export interface SetTenantLoginFlagsInput {
+    otpEnabled?: boolean;
+    passwordDisabled?: boolean;
+}
+/**
+ * The `console.tenantLoginFlags` namespace on a `W6WClient` — the caller's
+ * own tenant, never a tenant of its choosing.
+ *
+ * @example
+ * ```ts
+ * const flags = await client.console.tenantLoginFlags.get();
+ * await client.console.tenantLoginFlags.put({ otpEnabled: true });
+ * ```
+ */
+export declare class TenantLoginFlagsApi {
+    #private;
+    /**
+     * @param host - The client this namespace issues requests through.
+     */
+    constructor(host: TenantLoginFlagsHost);
+    /**
+     * The caller's tenant's current sign-in flags.
+     *
+     * AUTHENTICATED, `requireTenantAdmin` — the default `requireAuth` applies.
+     *
+     * @returns `{ otpEnabled, passwordDisabled }`.
+     * @throws {ApiError} `403` when the caller does not administer its tenant.
+     */
+    get(): Promise<TenantLoginFlags>;
+    /**
+     * Update the caller's tenant's sign-in flags, sending **only the fields
+     * `input` sets**.
+     *
+     * AUTHENTICATED, `requireTenantAdmin` — the default `requireAuth` applies.
+     *
+     * @param input - The flags to set; an omitted field is left untouched server-side.
+     * @returns The stored flags after the update.
+     * @throws {ApiError} `403` when the caller does not administer its tenant;
+     *   `400 invalid_body` for a non-boolean present value; `409
+     *   no_fallback_login` when the change would leave the tenant with no way
+     *   in — NOT caught here, propagated unchanged (see this module's header).
+     */
+    put(input: SetTenantLoginFlagsInput): Promise<TenantLoginFlags>;
+}
+//# sourceMappingURL=tenant-login-flags.d.ts.map

package/dist/src/console/tenant-login-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-login-flags.d.ts","sourceRoot":"","sources":["../../../src/console/tenant-login-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;IACpB,8DAA8D;IAC9D,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAoBD;;;;;;;;;GASG;AACH,qBAAa,mBAAmB;;IAG9B;;OAEG;gBACS,IAAI,EAAE,oBAAoB;IAItC;;;;;;;OAOG;IACG,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAQtC;;;;;;;;;;;;OAYG;IACG,GAAG,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAQtE"}

package/dist/src/console/tenant-login-flags.js

@@ -0,0 +1,113 @@
+/**
+ * `client.console.tenantLoginFlags.*` — a tenant administrator's own
+ * password/OTP sign-in toggles (T2.1.3).
+ *
+ * **Studio-internal, not the published partner contract.** This namespace
+ * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
+ * `endpoints.json` and from the root barrel (`mod.ts`) — see `docs/console.md`.
+ * `@w6w/sdk`'s instance-state mechanism pin still applies here exactly as it
+ * does to every other namespace (`docs/implementation.md` §MECHANISM PIN —
+ * instance state, never globals): this class holds no state of its own beyond
+ * the injected host, so two clients in one process never share a credential.
+ *
+ * **The tenant is never a parameter here** — mirrors `console.tenantOAuthApps`
+ * exactly: both routes are scoped by the caller's own credential (the tenant
+ * claim on the bearer) plus a server-side `requireTenantAdmin` check
+ * (T2.1.1's wire pin), never by an id this client sends.
+ *
+ * **`put`'s body is built by OMISSION, key by key — absence means "leave
+ * whatever is stored alone".** T2.1.1's wire pin states it directly: "absent
+ * means preserve, `null` is refused." Unlike
+ * `console.tenantOAuthApps.SetTenantOAuthAppInput`, neither field here ever
+ * accepts `null` — both are plain optional booleans — so {@linkcode toSetBody}
+ * is the simpler of the two omission builders, but the discipline (never
+ * `JSON.stringify`'s own `undefined`-dropping behaviour, an explicit
+ * allowlist of exactly two keys) is the same one for the same reason: a
+ * caller-widened input type must not be able to smuggle a third key onto the
+ * wire from here.
+ *
+ * **The one refusal this domain can produce, `409 no_fallback_login`, is not
+ * caught here.** Disabling password with OTP off (or vice versa) would leave
+ * the tenant with no way in at all; the server refuses it and this method
+ * propagates the `ApiError` unchanged, exactly like every other write in this
+ * package — the caller (`packages/studio/src/pages/TenantSettingsPage.tsx`)
+ * is what turns the code into a sentence.
+ *
+ * @module
+ */
+import {} from "../http.js";
+/**
+ * Serialise {@linkcode SetTenantLoginFlagsInput} for the wire: **only the
+ * keys actually present.** Written as explicit `!== undefined` tests rather
+ * than a spread, mirroring `./tenant-oauth-apps.ts`'s `toSetBody` — it keeps
+ * `undefined` off the wire without relying on `JSON.stringify` to drop it,
+ * and it is an allowlist: a caller that widens the input type cannot get a
+ * third key onto the wire from here.
+ *
+ * @param input - The caller's partial update.
+ * @returns A body carrying exactly the keys `input` set.
+ */
+function toSetBody(input) {
+    const body = {};
+    if (input.otpEnabled !== undefined)
+        body.otpEnabled = input.otpEnabled;
+    if (input.passwordDisabled !== undefined)
+        body.passwordDisabled = input.passwordDisabled;
+    return body;
+}
+/**
+ * The `console.tenantLoginFlags` namespace on a `W6WClient` — the caller's
+ * own tenant, never a tenant of its choosing.
+ *
+ * @example
+ * ```ts
+ * const flags = await client.console.tenantLoginFlags.get();
+ * await client.console.tenantLoginFlags.put({ otpEnabled: true });
+ * ```
+ */
+export class TenantLoginFlagsApi {
+    #host;
+    /**
+     * @param host - The client this namespace issues requests through.
+     */
+    constructor(host) {
+        this.#host = host;
+    }
+    /**
+     * The caller's tenant's current sign-in flags.
+     *
+     * AUTHENTICATED, `requireTenantAdmin` — the default `requireAuth` applies.
+     *
+     * @returns `{ otpEnabled, passwordDisabled }`.
+     * @throws {ApiError} `403` when the caller does not administer its tenant.
+     */
+    async get() {
+        const res = await this.#host.request({
+            method: "GET",
+            path: "/tenant/login-flags",
+        });
+        return res.body.flags;
+    }
+    /**
+     * Update the caller's tenant's sign-in flags, sending **only the fields
+     * `input` sets**.
+     *
+     * AUTHENTICATED, `requireTenantAdmin` — the default `requireAuth` applies.
+     *
+     * @param input - The flags to set; an omitted field is left untouched server-side.
+     * @returns The stored flags after the update.
+     * @throws {ApiError} `403` when the caller does not administer its tenant;
+     *   `400 invalid_body` for a non-boolean present value; `409
+     *   no_fallback_login` when the change would leave the tenant with no way
+     *   in — NOT caught here, propagated unchanged (see this module's header).
+     */
+    async put(input) {
+        const res = await this.#host.request({
+            method: "PUT",
+            path: "/tenant/login-flags",
+            body: toSetBody(input),
+        });
+        return res.body.flags;
+    }
+}
+//# sourceMappingURL=tenant-login-flags.js.map

package/dist/src/console/tenant-login-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-login-flags.js","sourceRoot":"","sources":["../../../src/console/tenant-login-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAA0C,MAAM,YAAY,CAAC;AAgCpE;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,KAA+B;IAChD,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACvE,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAmB;IACrB,KAAK,CAAuB;IAErC;;OAEG;IACH,YAAY,IAA0B;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG;QACP,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAA8B;YAChE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,qBAAqB;SAC5B,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,GAAG,CAAC,KAA+B;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAA8B;YAChE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC;SACvB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;IACxB,CAAC;CACF"}

package/dist/src/console/tenant-oauth-apps.d.ts

@@ -1,7 +1,7 @@
 /**
  * `client.console.tenantOAuthApps.*` — a tenant administrator's own OAuth
- * client overrides (list, upsert, remove) for the apps their tenant connects
- * to.
+ * client overrides (list, upsert, remove) and the candidate apps they can still
+ * configure (`listCandidates`), for the apps their tenant connects to.
  *
  * **Studio-internal, not the published partner contract.** This namespace
  * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
@@ -11,7 +11,7 @@
  * instance state, never globals): this class holds no state of its own beyond
  * the injected host, so two clients in one process never share a credential.
  *
- * **The tenant is never a parameter here.** These three routes are scoped by
+ * **The tenant is never a parameter here.** These four routes are scoped by
  * the caller's own credential (the tenant claim on the bearer) plus a
  * server-side tenant-admin check — unlike the operator family
  * (`GET/PUT/DELETE /tenants/:id/oauth-app…`, `api/admin/tenants.ts:307-309`),
@@ -29,8 +29,8 @@
  *
  * **Response shapes are flat, no envelope key to peel with `unwrap()`** —
  * mirroring `console/auth.ts:29-32` for this whole family. `list` returns the
- * whole body deliberately, because `callbackUrl` rides beside `configs` and an
- * `unwrap(res, "configs")` would silently drop it; `put` reaches one level in
+ * whole body deliberately, so the response is exactly what the server sent
+ * (each row carries the server-derived `callbackUrl`: the same URL for every app, never assembled client-side); `put` reaches one level in
  * for `body.config`, which is the shape the server answers with (W4).
  *
  * **Wire shapes are planner pins, not reverse-engineered from a merged route.**
@@ -76,6 +76,11 @@ export interface TenantOAuthAppSummary {
      * {@linkcode SetTenantOAuthAppInput} carries no `redirectUri` key.
      */
     redirectUri: string | null;
+    /**
+     * This row's OAuth callback URL, derived SERVER-SIDE and specific to this
+     * app and auth method. Display it; never assemble it. Absent from an older server.
+     */
+    callbackUrl?: string;
     /** Provider-specific extras (scopes, audience, …). `{}` when none. */
     extra: Record<string, unknown>;
     /** Whether a client secret is stored. **Never the secret itself.** */
@@ -87,8 +92,6 @@ export interface TenantOAuthAppSummary {
 export interface TenantOAuthAppsResponse {
     /** Every override this tenant has, in the server's order. */
     configs: TenantOAuthAppSummary[];
-    /** This host's OAuth callback, derived SERVER-SIDE. Display it; never assemble it. */
-    callbackUrl: string;
 }
 /**
  * The body `put` sends (W4) — **built by OMISSION, key by key.**
@@ -111,7 +114,7 @@ export interface TenantOAuthAppsResponse {
  * the user did not touch, never send `""`.
  *
  * **No `redirectUri` and no `force`.** Neither exists on this surface — the
- * callback URL is derived server-side (W3's `callbackUrl`) and the operator's
+ * callback URL is derived server-side (each row's `callbackUrl`) and the operator's
  * `?force` affordance is not offered to a tenant admin (W4). A field the SDK
  * declares is a field a form will fill, so neither is declared, and
  * {@linkcode toSetBody} additionally refuses to forward either at runtime.
@@ -130,14 +133,55 @@ export interface SetTenantOAuthAppInput {
     /** Whether to switch the override off. */
     disabled?: boolean;
 }
+/**
+ * One app a tenant administrator may register an OAuth client for — the picker
+ * subset `GET /tenant/oauth-apps/candidates` answers with. Flat; carries no
+ * OAuth configuration and no secret.
+ */
+export interface TenantOAuthCandidate {
+    id: string;
+    displayName: string;
+    version: string;
+    description: string;
+    categories?: string[];
+    /** Omitted by the server when larger than 8192 UTF-8 bytes. */
+    iconSvg?: string;
+    /** Omitted by the server when larger than 8192 UTF-8 bytes. */
+    iconSvgDark?: string;
+    brandColor?: string;
+    brandColorDark?: string;
+    owner: {
+        tenant: string;
+        subject: string;
+    };
+}
+/** One page of candidates. `nextCursor` is ABSENT (not `null`) on the last page. */
+export interface TenantOAuthCandidatesPage {
+    apps: TenantOAuthCandidate[];
+    nextCursor?: string;
+}
+/**
+ * Options for {@linkcode TenantOAuthAppsApi.listCandidates}. Each member is
+ * sent under its own wire name; an omitted member is absent from the request.
+ */
+export interface ListTenantOAuthCandidatesOptions {
+    /** Case-insensitive substring filter; the server trims it and rejects more than 200 characters. */
+    q?: string;
+    /** Page size, 1..200; the server defaults to 50. */
+    limit?: number;
+    /** Opaque cursor from a previous page's `nextCursor`. */
+    cursor?: string;
+    /** Aborts the request; an abort rejects with `ApiError` `code: "cancelled"`. */
+    signal?: AbortSignal;
+}
 /**
  * The `console.tenantOAuthApps` namespace on a `W6WClient` — the caller's own
  * tenant, never a tenant of its choosing.
  *
  * @example
  * ```ts
- * const { configs, callbackUrl } = await client.console.tenantOAuthApps.list();
- * // Register `callbackUrl` with the provider — never assemble it client-side.
+ * const { configs } = await client.console.tenantOAuthApps.list();
+ * // Register each row's `callbackUrl` with the provider — never assemble it client-side.
  * await client.console.tenantOAuthApps.put("sendgrid", "oauth2", { clientId: "abc" });
  * await client.console.tenantOAuthApps.remove("sendgrid", "oauth2");
  * ```
@@ -149,15 +193,32 @@ export declare class TenantOAuthAppsApi {
      */
     constructor(host: TenantOAuthAppsHost);
     /**
-     * List the caller's tenant's OAuth overrides, plus this host's callback URL.
+     * List the caller's tenant's OAuth overrides; each row carries its own
+     * server-derived `callbackUrl`.
      *
-     * Returns the body VERBATIM rather than unwrapping `configs`: `callbackUrl`
-     * rides beside it and is the one value a caller cannot compute for itself.
+     * Returns the body VERBATIM rather than unwrapping `configs`, so the
+     * response stays exactly what the server sent.
      *
-     * @returns Every override for this tenant, and the server-derived callback URL.
+     * @returns Every override for this tenant.
      * @throws {ApiError} `403` when the caller does not administer its tenant.
      */
     list(): Promise<TenantOAuthAppsResponse>;
+    /**
+     * Page through the apps this tenant could still register an OAuth client
+     * for (`GET /tenant/oauth-apps/candidates`).
+     *
+     * Returns the body VERBATIM. Every app eligible for the whole walk, with an
+     * unchanged display name, appears exactly once; an app whose eligibility or
+     * display name changes mid-walk may be missed or repeated, so restart with
+     * no cursor after a registration or removal.
+     *
+     * @param options - Optional `q`, `limit`, `cursor` and `signal`.
+     * @returns One page: `{apps, nextCursor}`; `nextCursor` is absent on the last page.
+     * @throws {ApiError} `400 invalid_query`/`invalid_cursor` on a bad parameter;
+     * `403` when the caller does not administer its tenant; `code: "cancelled"`
+     * when `options.signal` was aborted.
+     */
+    listCandidates(options?: ListTenantOAuthCandidatesOptions): Promise<TenantOAuthCandidatesPage>;
     /**
      * Create or update one override, sending **only the fields `input` sets**.
      *

package/dist/src/console/tenant-oauth-apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-oauth-apps.d.ts","sourceRoot":"","sources":["../../../src/console/tenant-oauth-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,sEAAsE;IACtE,eAAe,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,sBAAsB;IACrC,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA0BD;;;;;;;;;;;GAWG;AACH,qBAAa,kBAAkB;;IAG7B;;OAEG;gBACS,IAAI,EAAE,mBAAmB;IAIrC;;;;;;;;OAQG;IACG,IAAI,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAQ9C;;;;;;;;;;;OAWG;IACG,GAAG,CACP,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IASjC;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAM5D"}
+{"version":3,"file":"tenant-oauth-apps.d.ts","sourceRoot":"","sources":["../../../src/console/tenant-oauth-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAQ,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,2BAA2B;IAC3B,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,sEAAsE;IACtE,eAAe,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,OAAO,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,sBAAsB;IACrC,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA0BD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,oFAAoF;AACpF,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,oBAAoB,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,gCAAgC;IAC/C,mGAAmG;IACnG,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,kBAAkB;;IAG7B;;OAEG;gBACS,IAAI,EAAE,mBAAmB;IAIrC;;;;;;;;;OASG;IACG,IAAI,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAQ9C;;;;;;;;;;;;;;OAcG;IACG,cAAc,CAClB,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,yBAAyB,CAAC;IAWrC;;;;;;;;;;;OAWG;IACG,GAAG,CACP,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IASjC;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAM5D"}

package/dist/src/console/tenant-oauth-apps.js

@@ -1,7 +1,7 @@
 /**
  * `client.console.tenantOAuthApps.*` — a tenant administrator's own OAuth
- * client overrides (list, upsert, remove) for the apps their tenant connects
- * to.
+ * client overrides (list, upsert, remove) and the candidate apps they can still
+ * configure (`listCandidates`), for the apps their tenant connects to.
  *
  * **Studio-internal, not the published partner contract.** This namespace
  * lives under the `console` subpath export (`@w6w/sdk/console`), excluded from
@@ -11,7 +11,7 @@
  * instance state, never globals): this class holds no state of its own beyond
  * the injected host, so two clients in one process never share a credential.
  *
- * **The tenant is never a parameter here.** These three routes are scoped by
+ * **The tenant is never a parameter here.** These four routes are scoped by
  * the caller's own credential (the tenant claim on the bearer) plus a
  * server-side tenant-admin check — unlike the operator family
  * (`GET/PUT/DELETE /tenants/:id/oauth-app…`, `api/admin/tenants.ts:307-309`),
@@ -29,8 +29,8 @@
  *
  * **Response shapes are flat, no envelope key to peel with `unwrap()`** —
  * mirroring `console/auth.ts:29-32` for this whole family. `list` returns the
- * whole body deliberately, because `callbackUrl` rides beside `configs` and an
- * `unwrap(res, "configs")` would silently drop it; `put` reaches one level in
+ * whole body deliberately, so the response is exactly what the server sent
+ * (each row carries the server-derived `callbackUrl`: the same URL for every app, never assembled client-side); `put` reaches one level in
  * for `body.config`, which is the shape the server answers with (W4).
  *
  * **Wire shapes are planner pins, not reverse-engineered from a merged route.**
@@ -80,8 +80,8 @@ function toSetBody(input) {
  *
  * @example
  * ```ts
- * const { configs, callbackUrl } = await client.console.tenantOAuthApps.list();
- * // Register `callbackUrl` with the provider — never assemble it client-side.
+ * const { configs } = await client.console.tenantOAuthApps.list();
+ * // Register each row's `callbackUrl` with the provider — never assemble it client-side.
  * await client.console.tenantOAuthApps.put("sendgrid", "oauth2", { clientId: "abc" });
  * await client.console.tenantOAuthApps.remove("sendgrid", "oauth2");
  * ```
@@ -95,12 +95,13 @@ export class TenantOAuthAppsApi {
         this.#host = host;
     }
     /**
-     * List the caller's tenant's OAuth overrides, plus this host's callback URL.
+     * List the caller's tenant's OAuth overrides; each row carries its own
+     * server-derived `callbackUrl`.
      *
-     * Returns the body VERBATIM rather than unwrapping `configs`: `callbackUrl`
-     * rides beside it and is the one value a caller cannot compute for itself.
+     * Returns the body VERBATIM rather than unwrapping `configs`, so the
+     * response stays exactly what the server sent.
      *
-     * @returns Every override for this tenant, and the server-derived callback URL.
+     * @returns Every override for this tenant.
      * @throws {ApiError} `403` when the caller does not administer its tenant.
      */
     async list() {
@@ -110,6 +111,31 @@ export class TenantOAuthAppsApi {
         });
         return res.body;
     }
+    /**
+     * Page through the apps this tenant could still register an OAuth client
+     * for (`GET /tenant/oauth-apps/candidates`).
+     *
+     * Returns the body VERBATIM. Every app eligible for the whole walk, with an
+     * unchanged display name, appears exactly once; an app whose eligibility or
+     * display name changes mid-walk may be missed or repeated, so restart with
+     * no cursor after a registration or removal.
+     *
+     * @param options - Optional `q`, `limit`, `cursor` and `signal`.
+     * @returns One page: `{apps, nextCursor}`; `nextCursor` is absent on the last page.
+     * @throws {ApiError} `400 invalid_query`/`invalid_cursor` on a bad parameter;
+     * `403` when the caller does not administer its tenant; `code: "cancelled"`
+     * when `options.signal` was aborted.
+     */
+    async listCandidates(options = {}) {
+        const { signal, q, limit, cursor } = options;
+        const res = await this.#host.request({
+            method: "GET",
+            path: "/tenant/oauth-apps/candidates",
+            query: { q, limit, cursor },
+            signal,
+        });
+        return res.body;
+    }
     /**
      * Create or update one override, sending **only the fields `input` sets**.
      *