@xemahq/app-platform-api-client 0.3.11 → 0.3.13

package/dist/custom-fetch.d.ts

@@ -47,6 +47,28 @@ export interface ClientConfig {
     getAuthToken?: () => Promise<string>;
     /** Optional callback returning headers to inject on every request. Per-call headers take precedence. */
     getHeaders?: () => Record<string, string> | Promise<Record<string, string>>;
+    /**
+     * Optional resolver for the CORRELATION ID of the request being made — the
+     * handle that ties one causal chain together across every service hop.
+     *
+     * WHY IT IS A CALLBACK AND NOT A VALUE. `ClientConfig` is process-global
+     * (`configureClient` is called once at wiring time), and a correlation id is
+     * per-request. This is invoked INSIDE the request, so a server can point it
+     * at whatever carries its ambient request context and get the CURRENT id
+     * rather than the one that happened to be live at boot.
+     *
+     * WHY THE TRANSPORT DOES NOT MINT ONE. Returning `undefined` sends no header,
+     * and the receiving service's `RequestContextMiddleware` mints its own — a
+     * new trace, which is honest. A transport that minted per call would produce
+     * a FRESH id on every hop while looking like propagation, which is strictly
+     * worse than none: every row would carry a correlation id and no two rows
+     * that belong together would share one. That is the exact defect this exists
+     * to fix, so the transport must not reproduce it one layer down.
+     *
+     * A caller-supplied `X-Correlation-Id` header always wins, and so does one
+     * from `getHeaders`.
+     */
+    getCorrelationId?: () => string | undefined | Promise<string | undefined>;
     /**
      * Optional callback invoked on a 401 before ONE re-attempt. Supplying it is
      * what opts this client into that re-attempt; without it a 401 comes back to

package/dist/custom-fetch.js

@@ -89,6 +89,16 @@ function getClientConfig() {
  */
 /** The only statuses that state the request was NOT processed. See above. */
 const RETRYABLE_STATUSES = [429, 503];
+/**
+ * The platform's correlation header, spelled once.
+ *
+ * Value-identical to what `RequestContextMiddleware` reads in
+ * `@xemahq/platform-common`. It is a literal here rather than an import
+ * because this file has ZERO imports on purpose: it ships byte-identical into
+ * browser-target clients as well as server-target ones, and a dependency on a
+ * NestJS-peer package would follow it into every one of them.
+ */
+const CORRELATION_ID_HEADER = 'X-Correlation-Id';
 /** Backoff floor, doubling per attempt up to {@link MAX_BACKOFF_MS}. */
 const BASE_BACKOFF_MS = 1000;
 /** Ceiling on a single backoff, however many attempts have elapsed. */
@@ -104,6 +114,23 @@ async function buildHeaders(config, callerHeaders) {
             }
         }
     }
+    // Correlation id (caller and global headers still take precedence).
+    //
+    // Without this, every server-to-server hop through a generated client started
+    // a NEW trace: the id is read-or-minted per hop by the receiving service's
+    // RequestContextMiddleware, and nothing carried it outbound — so an audit
+    // journal could record a whole causal chain and offer no way to join it back
+    // together.
+    //
+    // Absent resolver, or a resolver that answers `undefined`: NO header. The
+    // receiver mints and a new trace begins, which is the truthful outcome when
+    // there is nothing to continue.
+    if (config.getCorrelationId && !headers.has(CORRELATION_ID_HEADER)) {
+        const correlationId = await Promise.resolve(config.getCorrelationId());
+        if (correlationId) {
+            headers.set(CORRELATION_ID_HEADER, correlationId);
+        }
+    }
     // Auth token (caller or global headers take precedence)
     if (config.getAuthToken && !headers.has('Authorization')) {
         const token = await config.getAuthToken();

package/dist/endpoints/delegated-session-keys/delegated-session-keys.d.ts

@@ -0,0 +1,5 @@
+export declare const getDelegatedSessionJwksControllerJwksUrl: () => string;
+/**
+ * @summary Public signing keys for delegated-session JWTs. Contains the ACTIVE key plus any key rotated out but still inside its publication window.
+ */
+export declare const delegatedSessionJwksControllerJwks: (options?: RequestInit) => Promise<void>;

package/dist/endpoints/delegated-session-keys/delegated-session-keys.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.delegatedSessionJwksControllerJwks = exports.getDelegatedSessionJwksControllerJwksUrl = void 0;
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+const custom_fetch_1 = require("../../custom-fetch");
+const getDelegatedSessionJwksControllerJwksUrl = () => {
+    return `/public/.well-known/delegated-session-jwks.json`;
+};
+exports.getDelegatedSessionJwksControllerJwksUrl = getDelegatedSessionJwksControllerJwksUrl;
+/**
+ * @summary Public signing keys for delegated-session JWTs. Contains the ACTIVE key plus any key rotated out but still inside its publication window.
+ */
+const delegatedSessionJwksControllerJwks = async (options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getDelegatedSessionJwksControllerJwksUrl)(), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.delegatedSessionJwksControllerJwks = delegatedSessionJwksControllerJwks;

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { configureClient, getClientConfig, ClientError, customFetch, type ClientConfig, type RetryNotice } from './custom-fetch';
 export * from './models';
+export * from './endpoints/delegated-session-keys/delegated-session-keys';
 export * from './endpoints/delegated-sessions/delegated-sessions';
 export * from './endpoints/project-apps/project-apps';
 export * from './endpoints/public-ingress/public-ingress';

package/dist/index.js

@@ -22,6 +22,7 @@ Object.defineProperty(exports, "getClientConfig", { enumerable: true, get: funct
 Object.defineProperty(exports, "ClientError", { enumerable: true, get: function () { return custom_fetch_1.ClientError; } });
 Object.defineProperty(exports, "customFetch", { enumerable: true, get: function () { return custom_fetch_1.customFetch; } });
 __exportStar(require("./models"), exports);
+__exportStar(require("./endpoints/delegated-session-keys/delegated-session-keys"), exports);
 __exportStar(require("./endpoints/delegated-sessions/delegated-sessions"), exports);
 __exportStar(require("./endpoints/project-apps/project-apps"), exports);
 __exportStar(require("./endpoints/public-ingress/public-ingress"), exports);

package/dist/models/anonAuthDto.d.ts

@@ -4,8 +4,12 @@
  * OpenAPI spec version: 0.1.2
  */
 export interface AnonAuthDto {
+    /** AppClient public identifier. */
+    clientId: string;
+    /** Plaintext AppClient secret. Required on EVERY external-auth door, the anonymous one included: "anonymous" describes the subject, never the caller — the App owner controls who may open sessions in its name. */
+    clientSecret: string;
     /** Optional client-supplied hint used for logging / debugging purposes. Not used for identity resolution — every call creates a fresh anon subject. */
     sessionHint?: string;
-    /** AppClient id issuing this auth request. */
-    appClientId: string;
+    /** Requested ExecutionEnvironment slug. Defaults to the App’s `defaultZone`, and either way must be in the resolved AudiencePolicy.allowedEnvironments[]. */
+    requestedZone?: string;
 }

package/dist/models/anonAuthResultDto.d.ts

@@ -12,4 +12,6 @@ export interface AnonAuthResultDto {
     sessionId: string;
     /** Subject ref minted into the token. */
     subjectRef: string;
+    /** ExecutionEnvironment slug the session was minted into. */
+    environment: string;
 }

package/dist/models/audiencePolicyDto.d.ts

@@ -4,7 +4,6 @@
  * OpenAPI spec version: 0.1.2
  */
 import type { AudienceKind } from './audienceKind.js';
-import type { AudiencePolicyDtoRateLimitPerHourPerSubject } from './audiencePolicyDtoRateLimitPerHourPerSubject.js';
 import type { AudienceUpstreamDto } from './audienceUpstreamDto.js';
 export interface AudiencePolicyDto {
     id: string;
@@ -12,8 +11,10 @@ export interface AudiencePolicyDto {
     kind: AudienceKind;
     allowedEnvironments: string[];
     authUpstream?: AudienceUpstreamDto | null;
-    /** @nullable */
-    rateLimitPerHourPerSubject?: AudiencePolicyDtoRateLimitPerHourPerSubject;
+    /** Session opens per hour for ONE identified external subject. Never null: a null used to mean "no limit", so an audience created without one was uncapped while reading as configured. */
+    rateLimitPerHourPerSubject: number;
+    /** Session opens per hour for the whole AppClient, across subjects. This is the cap the ANONYMOUS door is measured against — an anon subject is minted fresh on every call, so no per-subject bucket can bound it. */
+    rateLimitPerHourPerClient: number;
     createdAt: string;
     updatedAt: string;
 }

package/dist/models/createAudiencePolicyDto.d.ts

@@ -10,6 +10,8 @@ export interface CreateAudiencePolicyDto {
     /** ExecutionEnvironmentRef slugs this audience may invoke. Required. */
     allowedEnvironments: string[];
     authUpstream?: AudienceUpstreamDto;
-    /** Rate cap (calls/hour/subject). */
+    /** Session opens per hour for ONE identified external subject. Omitted means the column default, NOT "unlimited" — there is no value that means unlimited. */
     rateLimitPerHourPerSubject?: number;
+    /** Session opens per hour for the whole AppClient, across subjects. This is the cap the ANONYMOUS door is measured against — an anon subject is minted fresh on every call, so no per-subject bucket can bound it. Omitted means the column default, NOT "unlimited". */
+    rateLimitPerHourPerClient?: number;
 }

package/dist/models/delegatedSessionActorDto.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+import type { SubjectKind } from './subjectKind.js';
+export interface DelegatedSessionActorDto {
+    /** The acting party’s BARE identifier — an `AppClient.clientId`, never a `"<kind>:<id>"` composite. */
+    sub: string;
+    /** The acting party’s subject kind, stated explicitly by the issuer (wire claim `subject_kind`). Always `app-client` for a delegated session minted by app-platform-api. */
+    subjectKind: SubjectKind;
+}

package/dist/models/delegatedSessionActorDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/index.d.ts

@@ -30,7 +30,6 @@ export * from './audienceKind';
 export * from './audiencePolicyDto';
 export * from './audiencePolicyDtoDataArrayEnvelope';
 export * from './audiencePolicyDtoDataEnvelope';
-export * from './audiencePolicyDtoRateLimitPerHourPerSubject';
 export * from './audienceUpstreamDto';
 export * from './audienceUpstreamDtoMetadata';
 export * from './audienceUpstreamType';
@@ -49,6 +48,7 @@ export * from './createdAppClientDtoDataEnvelope';
 export * from './createdAppClientDtoRevokedAt';
 export * from './createdPublicSessionDto';
 export * from './createdPublicSessionDtoDataEnvelope';
+export * from './delegatedSessionActorDto';
 export * from './delegatedSessionDto';
 export * from './delegatedSessionDtoDataEnvelope';
 export * from './delegatedSessionDtoExternalSubjectId';
@@ -80,7 +80,6 @@ export * from './surfaceKind';
 export * from './tokenClass';
 export * from './unarchivePortalDto';
 export * from './updateAudiencePolicyDto';
-export * from './updateAudiencePolicyDtoRateLimitPerHourPerSubject';
 export * from './updatePortalDto';
 export * from './verifyDelegatedSessionRequestDto';
 export * from './verifyDelegatedSessionResponseDto';

package/dist/models/index.js

@@ -47,7 +47,6 @@ __exportStar(require("./audienceKind"), exports);
 __exportStar(require("./audiencePolicyDto"), exports);
 __exportStar(require("./audiencePolicyDtoDataArrayEnvelope"), exports);
 __exportStar(require("./audiencePolicyDtoDataEnvelope"), exports);
-__exportStar(require("./audiencePolicyDtoRateLimitPerHourPerSubject"), exports);
 __exportStar(require("./audienceUpstreamDto"), exports);
 __exportStar(require("./audienceUpstreamDtoMetadata"), exports);
 __exportStar(require("./audienceUpstreamType"), exports);
@@ -66,6 +65,7 @@ __exportStar(require("./createdAppClientDtoDataEnvelope"), exports);
 __exportStar(require("./createdAppClientDtoRevokedAt"), exports);
 __exportStar(require("./createdPublicSessionDto"), exports);
 __exportStar(require("./createdPublicSessionDtoDataEnvelope"), exports);
+__exportStar(require("./delegatedSessionActorDto"), exports);
 __exportStar(require("./delegatedSessionDto"), exports);
 __exportStar(require("./delegatedSessionDtoDataEnvelope"), exports);
 __exportStar(require("./delegatedSessionDtoExternalSubjectId"), exports);
@@ -97,7 +97,6 @@ __exportStar(require("./surfaceKind"), exports);
 __exportStar(require("./tokenClass"), exports);
 __exportStar(require("./unarchivePortalDto"), exports);
 __exportStar(require("./updateAudiencePolicyDto"), exports);
-__exportStar(require("./updateAudiencePolicyDtoRateLimitPerHourPerSubject"), exports);
 __exportStar(require("./updatePortalDto"), exports);
 __exportStar(require("./verifyDelegatedSessionRequestDto"), exports);
 __exportStar(require("./verifyDelegatedSessionResponseDto"), exports);

package/dist/models/oidcAuthDto.d.ts

@@ -4,8 +4,12 @@
  * OpenAPI spec version: 0.1.2
  */
 export interface OidcAuthDto {
+    /** AppClient public identifier. */
+    clientId: string;
+    /** Plaintext AppClient secret. Required on EVERY external-auth door, the anonymous one included: "anonymous" describes the subject, never the caller — the App owner controls who may open sessions in its name. */
+    clientSecret: string;
     /** OIDC id_token issued by the upstream identity provider configured for this App. */
     idToken: string;
-    /** AppClient id issuing this auth request. */
-    appClientId: string;
+    /** Requested ExecutionEnvironment slug. Defaults to the App’s `defaultZone`, and either way must be in the resolved AudiencePolicy.allowedEnvironments[]. */
+    requestedZone?: string;
 }

package/dist/models/oidcAuthResultDto.d.ts

@@ -12,4 +12,6 @@ export interface OidcAuthResultDto {
     sessionId: string;
     /** Subject ref minted into the token. */
     subjectRef: string;
+    /** ExecutionEnvironment slug the session was minted into. */
+    environment: string;
 }

package/dist/models/requestMagicLinkDto.d.ts

@@ -4,8 +4,10 @@
  * OpenAPI spec version: 0.1.2
  */
 export interface RequestMagicLinkDto {
+    /** AppClient public identifier. */
+    clientId: string;
+    /** Plaintext AppClient secret. Required on EVERY external-auth door, the anonymous one included: "anonymous" describes the subject, never the caller — the App owner controls who may open sessions in its name. */
+    clientSecret: string;
     /** Email address to send the magic-link to. Used as the external subject identifier. */
     email: string;
-    /** AppClient id issuing this auth request. */
-    appClientId: string;
 }

package/dist/models/updateAudiencePolicyDto.d.ts

@@ -4,10 +4,9 @@
  * OpenAPI spec version: 0.1.2
  */
 import type { AudienceUpstreamDto } from './audienceUpstreamDto.js';
-import type { UpdateAudiencePolicyDtoRateLimitPerHourPerSubject } from './updateAudiencePolicyDtoRateLimitPerHourPerSubject.js';
 export interface UpdateAudiencePolicyDto {
     allowedEnvironments?: string[];
     authUpstream?: AudienceUpstreamDto | null;
-    /** @nullable */
-    rateLimitPerHourPerSubject?: UpdateAudiencePolicyDtoRateLimitPerHourPerSubject;
+    rateLimitPerHourPerSubject?: number;
+    rateLimitPerHourPerClient?: number;
 }

package/dist/models/verifyDelegatedSessionResponseDto.d.ts

@@ -3,12 +3,13 @@
  * App Runtime API
  * OpenAPI spec version: 0.1.2
  */
+import type { DelegatedSessionActorDto } from './delegatedSessionActorDto.js';
 import type { TokenClass } from './tokenClass.js';
 export interface VerifyDelegatedSessionResponseDto {
     /** Id of the App this delegated session was minted FOR (the owning `App.id`, resolved from the backing session row). A consumer edge MUST bind the session to exactly this app before serving app data. */
     appId: string;
     sub: string;
-    act: string;
+    act: DelegatedSessionActorDto;
     org: string;
     project: string;
     session: string;

package/dist/models/verifyMagicLinkResultDto.d.ts

@@ -12,4 +12,6 @@ export interface VerifyMagicLinkResultDto {
     sessionId: string;
     /** Subject ref minted into the token. */
     subjectRef: string;
+    /** ExecutionEnvironment slug the session was minted into. */
+    environment: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/app-platform-api-client",
-  "version": "0.3.11",
+  "version": "0.3.13",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
@@ -20,7 +20,7 @@
     "service": "app-platform-api",
     "biome": "app-platform",
     "target": "server",
-    "generator": "@xemahq/api-client-generator@0.12.1",
+    "generator": "@xemahq/api-client-generator@0.14.1",
     "source": "openapi.public.json"
   },
   "license": "LicenseRef-Xema-BSL-1.1",

package/dist/models/audiencePolicyDtoRateLimitPerHourPerSubject.d.ts

@@ -1,11 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * App Runtime API
- * OpenAPI spec version: 0.1.2
- */
-/**
- * @nullable
- */
-export type AudiencePolicyDtoRateLimitPerHourPerSubject = {
-    [key: string]: unknown;
-} | null;

package/dist/models/audiencePolicyDtoRateLimitPerHourPerSubject.js

@@ -1,7 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * App Runtime API
- * OpenAPI spec version: 0.1.2
- */
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/updateAudiencePolicyDtoRateLimitPerHourPerSubject.d.ts

@@ -1,11 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * App Runtime API
- * OpenAPI spec version: 0.1.2
- */
-/**
- * @nullable
- */
-export type UpdateAudiencePolicyDtoRateLimitPerHourPerSubject = {
-    [key: string]: unknown;
-} | null;

package/dist/models/updateAudiencePolicyDtoRateLimitPerHourPerSubject.js

@@ -1,7 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * App Runtime API
- * OpenAPI spec version: 0.1.2
- */
-Object.defineProperty(exports, "__esModule", { value: true });