@xemahq/app-platform-internal-api-client 0.3.9 → 0.3.13

package/dist/custom-fetch.d.ts

@@ -47,6 +47,28 @@ export interface ClientConfig {
     getAuthToken?: () => Promise<string>;
     /** Optional callback returning headers to inject on every request. Per-call headers take precedence. */
     getHeaders?: () => Record<string, string> | Promise<Record<string, string>>;
+    /**
+     * Optional resolver for the CORRELATION ID of the request being made — the
+     * handle that ties one causal chain together across every service hop.
+     *
+     * WHY IT IS A CALLBACK AND NOT A VALUE. `ClientConfig` is process-global
+     * (`configureClient` is called once at wiring time), and a correlation id is
+     * per-request. This is invoked INSIDE the request, so a server can point it
+     * at whatever carries its ambient request context and get the CURRENT id
+     * rather than the one that happened to be live at boot.
+     *
+     * WHY THE TRANSPORT DOES NOT MINT ONE. Returning `undefined` sends no header,
+     * and the receiving service's `RequestContextMiddleware` mints its own — a
+     * new trace, which is honest. A transport that minted per call would produce
+     * a FRESH id on every hop while looking like propagation, which is strictly
+     * worse than none: every row would carry a correlation id and no two rows
+     * that belong together would share one. That is the exact defect this exists
+     * to fix, so the transport must not reproduce it one layer down.
+     *
+     * A caller-supplied `X-Correlation-Id` header always wins, and so does one
+     * from `getHeaders`.
+     */
+    getCorrelationId?: () => string | undefined | Promise<string | undefined>;
     /**
      * Optional callback invoked on a 401 before ONE re-attempt. Supplying it is
      * what opts this client into that re-attempt; without it a 401 comes back to

package/dist/custom-fetch.js

@@ -89,6 +89,16 @@ function getClientConfig() {
  */
 /** The only statuses that state the request was NOT processed. See above. */
 const RETRYABLE_STATUSES = [429, 503];
+/**
+ * The platform's correlation header, spelled once.
+ *
+ * Value-identical to what `RequestContextMiddleware` reads in
+ * `@xemahq/platform-common`. It is a literal here rather than an import
+ * because this file has ZERO imports on purpose: it ships byte-identical into
+ * browser-target clients as well as server-target ones, and a dependency on a
+ * NestJS-peer package would follow it into every one of them.
+ */
+const CORRELATION_ID_HEADER = 'X-Correlation-Id';
 /** Backoff floor, doubling per attempt up to {@link MAX_BACKOFF_MS}. */
 const BASE_BACKOFF_MS = 1000;
 /** Ceiling on a single backoff, however many attempts have elapsed. */
@@ -104,6 +114,23 @@ async function buildHeaders(config, callerHeaders) {
             }
         }
     }
+    // Correlation id (caller and global headers still take precedence).
+    //
+    // Without this, every server-to-server hop through a generated client started
+    // a NEW trace: the id is read-or-minted per hop by the receiving service's
+    // RequestContextMiddleware, and nothing carried it outbound — so an audit
+    // journal could record a whole causal chain and offer no way to join it back
+    // together.
+    //
+    // Absent resolver, or a resolver that answers `undefined`: NO header. The
+    // receiver mints and a new trace begins, which is the truthful outcome when
+    // there is nothing to continue.
+    if (config.getCorrelationId && !headers.has(CORRELATION_ID_HEADER)) {
+        const correlationId = await Promise.resolve(config.getCorrelationId());
+        if (correlationId) {
+            headers.set(CORRELATION_ID_HEADER, correlationId);
+        }
+    }
     // Auth token (caller or global headers take precedence)
     if (config.getAuthToken && !headers.has('Authorization')) {
         const token = await config.getAuthToken();

package/dist/endpoints/apps/apps.d.ts

@@ -11,7 +11,7 @@ export declare const getAppsControllerCreateUrl: () => string;
 export declare const appsControllerCreate: (createAppDto: CreateAppDto, options?: RequestInit) => Promise<AppDtoDataEnvelope>;
 export declare const getAppsControllerListUrl: (params?: AppsControllerListParams) => string;
 /**
- * @summary List Apps (filtered by orgId, projectId, portalOnly, and/or slug).
+ * @summary List Apps (filtered by orgId, projectId, portalOnly, and/or slug). Archived Apps are excluded unless `includeArchived=true`.
  */
 export declare const appsControllerList: (params?: AppsControllerListParams, options?: RequestInit) => Promise<AppDtoDataArrayEnvelope>;
 export declare const getAppsControllerGetByIdUrl: (id: string) => string;

package/dist/endpoints/apps/apps.js

@@ -42,7 +42,7 @@ const getAppsControllerListUrl = (params) => {
 };
 exports.getAppsControllerListUrl = getAppsControllerListUrl;
 /**
- * @summary List Apps (filtered by orgId, projectId, portalOnly, and/or slug).
+ * @summary List Apps (filtered by orgId, projectId, portalOnly, and/or slug). Archived Apps are excluded unless `includeArchived=true`.
  */
 const appsControllerList = async (params, options) => {
     return (0, custom_fetch_1.customFetch)((0, exports.getAppsControllerListUrl)(params), {

package/dist/models/appDto.d.ts

@@ -4,6 +4,7 @@
  * OpenAPI spec version: 0.1.2
  */
 import type { AppLockfileDto } from './appLockfileDto.js';
+import type { AudienceKind } from './audienceKind.js';
 import type { BiomeInstallDto } from './biomeInstallDto.js';
 import type { BrandingConfigDto } from './brandingConfigDto.js';
 import type { CapabilityPolicyOverrideDto } from './capabilityPolicyOverrideDto.js';
@@ -22,13 +23,14 @@ export interface AppDto {
     lockfile: AppLockfileDto;
     installedBiomes: BiomeInstallDto[];
     capabilityPolicy: CapabilityPolicyOverrideDto[];
-    /** @nullable */
-    subdomain: string | null;
+    /** Whether this App is reachable on a public host. The host itself is DERIVED (see `codedAppSubdomain`), never tenant-chosen — this is the switch for WHETHER, not WHERE. */
     subdomainEnabled: boolean;
-    defaultAudience: string;
+    defaultAudience: AudienceKind;
     archived: boolean;
     /** Provisioning ownership marker. `iac` = managed by the declarative control plane (Terraform / xema.yaml); `seeder` = a distribution default; `ui` = hand-managed (or adopted from iac/seeder via a UI edit); `system` = platform-shipped; null = unmanaged/legacy. Lets a console badge an IaC-owned resource and surface an "export as code" affordance. */
     managedBy: ResourceManagedBy | null;
+    /** Whether this App can be handed back to the portal reconciler — the exact precondition of POST /bff/portals/:id/readopt (true iff the row carries the reconciler natural key). Read-only, server-derived. A `ui`-managed App with readoptable=false was hand-created and was never reconciler-owned; with readoptable=true it is an adopted default portal, and readopt restores automatic updates. */
+    readoptable: boolean;
     createdAt: string;
     updatedAt: string;
 }

package/dist/models/appsControllerListParams.d.ts

@@ -7,5 +7,12 @@ export type AppsControllerListParams = {
     orgId?: string;
     projectId?: string;
     slug?: string;
+    /**
+     * Restrict to ORG-scoped Apps (projectId IS NULL).
+     */
     portalOnly?: boolean;
+    /**
+     * Include archived Apps. Default false — an archived App is refused by public ingress and by every external-auth flow, so it is out of the listing unless explicitly asked for.
+     */
+    includeArchived?: boolean;
 };

package/dist/models/audiencePolicyDto.d.ts

@@ -4,7 +4,6 @@
  * OpenAPI spec version: 0.1.2
  */
 import type { AudienceKind } from './audienceKind.js';
-import type { AudiencePolicyDtoRateLimitPerHourPerSubject } from './audiencePolicyDtoRateLimitPerHourPerSubject.js';
 import type { AudienceUpstreamDto } from './audienceUpstreamDto.js';
 export interface AudiencePolicyDto {
     id: string;
@@ -12,8 +11,10 @@ export interface AudiencePolicyDto {
     kind: AudienceKind;
     allowedEnvironments: string[];
     authUpstream?: AudienceUpstreamDto | null;
-    /** @nullable */
-    rateLimitPerHourPerSubject?: AudiencePolicyDtoRateLimitPerHourPerSubject;
+    /** Session opens per hour for ONE identified external subject. Never null: a null used to mean "no limit", so an audience created without one was uncapped while reading as configured. */
+    rateLimitPerHourPerSubject: number;
+    /** Session opens per hour for the whole AppClient, across subjects. This is the cap the ANONYMOUS door is measured against — an anon subject is minted fresh on every call, so no per-subject bucket can bound it. */
+    rateLimitPerHourPerClient: number;
     createdAt: string;
     updatedAt: string;
 }

package/dist/models/createAppDto.d.ts

@@ -4,6 +4,7 @@
  * OpenAPI spec version: 0.1.2
  */
 import type { AppLockfileDto } from './appLockfileDto.js';
+import type { AudienceKind } from './audienceKind.js';
 import type { BiomeInstallDto } from './biomeInstallDto.js';
 import type { BrandingConfigDto } from './brandingConfigDto.js';
 import type { CapabilityPolicyOverrideDto } from './capabilityPolicyOverrideDto.js';
@@ -24,10 +25,9 @@ export interface CreateAppDto {
     lockfile: AppLockfileDto;
     installedBiomes: BiomeInstallDto[];
     capabilityPolicy: CapabilityPolicyOverrideDto[];
-    /** @nullable */
-    subdomain?: string | null;
+    /** Whether this App is reachable on a public host. The host itself is DERIVED, never tenant-chosen — this is the switch for WHETHER, not WHERE. */
     subdomainEnabled?: boolean;
-    defaultAudience?: string;
+    defaultAudience?: AudienceKind;
     archived?: boolean;
     /** Authoring tier. `declared` (the default) and `composed` Apps ARE their JSON definition. A `coded` App is one the platform hosts but does not author — a Webapp Studio session builds a container image from the user's own repo, and every release of it carries that image coordinate. Immutable after creation: the tier decides what a release IS, so changing it would leave existing releases describing the wrong thing. */
     surface?: SurfaceKind;

package/dist/models/createAudiencePolicyDto.d.ts

@@ -10,6 +10,8 @@ export interface CreateAudiencePolicyDto {
     /** ExecutionEnvironmentRef slugs this audience may invoke. Required. */
     allowedEnvironments: string[];
     authUpstream?: AudienceUpstreamDto;
-    /** Rate cap (calls/hour/subject). */
+    /** Session opens per hour for ONE identified external subject. Omitted means the column default, NOT "unlimited" — there is no value that means unlimited. */
     rateLimitPerHourPerSubject?: number;
+    /** Session opens per hour for the whole AppClient, across subjects. This is the cap the ANONYMOUS door is measured against — an anon subject is minted fresh on every call, so no per-subject bucket can bound it. Omitted means the column default, NOT "unlimited". */
+    rateLimitPerHourPerClient?: number;
 }

package/dist/models/index.d.ts

@@ -29,7 +29,6 @@ export * from './audienceKind';
 export * from './audiencePolicyDto';
 export * from './audiencePolicyDtoDataArrayEnvelope';
 export * from './audiencePolicyDtoDataEnvelope';
-export * from './audiencePolicyDtoRateLimitPerHourPerSubject';
 export * from './audienceUpstreamDto';
 export * from './audienceUpstreamDtoMetadata';
 export * from './audienceUpstreamType';
@@ -64,7 +63,6 @@ export * from './spaceKind';
 export * from './surfaceKind';
 export * from './updateAppDto';
 export * from './updateAudiencePolicyDto';
-export * from './updateAudiencePolicyDtoRateLimitPerHourPerSubject';
 export * from './xemaObjectKind';
 export * from './xemaObjectResponseDto';
 export * from './xemaObjectResponseDtoPayload';

package/dist/models/index.js

@@ -46,7 +46,6 @@ __exportStar(require("./audienceKind"), exports);
 __exportStar(require("./audiencePolicyDto"), exports);
 __exportStar(require("./audiencePolicyDtoDataArrayEnvelope"), exports);
 __exportStar(require("./audiencePolicyDtoDataEnvelope"), exports);
-__exportStar(require("./audiencePolicyDtoRateLimitPerHourPerSubject"), exports);
 __exportStar(require("./audienceUpstreamDto"), exports);
 __exportStar(require("./audienceUpstreamDtoMetadata"), exports);
 __exportStar(require("./audienceUpstreamType"), exports);
@@ -81,7 +80,6 @@ __exportStar(require("./spaceKind"), exports);
 __exportStar(require("./surfaceKind"), exports);
 __exportStar(require("./updateAppDto"), exports);
 __exportStar(require("./updateAudiencePolicyDto"), exports);
-__exportStar(require("./updateAudiencePolicyDtoRateLimitPerHourPerSubject"), exports);
 __exportStar(require("./xemaObjectKind"), exports);
 __exportStar(require("./xemaObjectResponseDto"), exports);
 __exportStar(require("./xemaObjectResponseDtoPayload"), exports);

package/dist/models/updateAppDto.d.ts

@@ -4,6 +4,7 @@
  * OpenAPI spec version: 0.1.2
  */
 import type { AppLockfileDto } from './appLockfileDto.js';
+import type { AudienceKind } from './audienceKind.js';
 import type { BiomeInstallDto } from './biomeInstallDto.js';
 import type { BrandingConfigDto } from './brandingConfigDto.js';
 import type { CapabilityPolicyOverrideDto } from './capabilityPolicyOverrideDto.js';
@@ -14,8 +15,7 @@ export interface UpdateAppDto {
     lockfile?: AppLockfileDto;
     installedBiomes?: BiomeInstallDto[];
     capabilityPolicy?: CapabilityPolicyOverrideDto[];
-    /** @nullable */
-    subdomain?: string | null;
+    /** Whether this App is reachable on a public host. The host itself is DERIVED, never tenant-chosen — this is the switch for WHETHER, not WHERE. */
     subdomainEnabled?: boolean;
-    defaultAudience?: string;
+    defaultAudience?: AudienceKind;
 }

package/dist/models/updateAudiencePolicyDto.d.ts

@@ -4,10 +4,9 @@
  * OpenAPI spec version: 0.1.2
  */
 import type { AudienceUpstreamDto } from './audienceUpstreamDto.js';
-import type { UpdateAudiencePolicyDtoRateLimitPerHourPerSubject } from './updateAudiencePolicyDtoRateLimitPerHourPerSubject.js';
 export interface UpdateAudiencePolicyDto {
     allowedEnvironments?: string[];
     authUpstream?: AudienceUpstreamDto | null;
-    /** @nullable */
-    rateLimitPerHourPerSubject?: UpdateAudiencePolicyDtoRateLimitPerHourPerSubject;
+    rateLimitPerHourPerSubject?: number;
+    rateLimitPerHourPerClient?: number;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/app-platform-internal-api-client",
-  "version": "0.3.9",
+  "version": "0.3.13",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -19,7 +19,7 @@
     "service": "app-platform-api",
     "biome": "app-platform",
     "target": "server",
-    "generator": "@xemahq/api-client-generator@0.12.1",
+    "generator": "@xemahq/api-client-generator@0.14.1",
     "source": "openapi.internal.json"
   },
   "license": "LicenseRef-Xema-BSL-1.1",

package/dist/models/audiencePolicyDtoRateLimitPerHourPerSubject.d.ts

@@ -1,11 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * App Runtime API
- * OpenAPI spec version: 0.1.2
- */
-/**
- * @nullable
- */
-export type AudiencePolicyDtoRateLimitPerHourPerSubject = {
-    [key: string]: unknown;
-} | null;

package/dist/models/audiencePolicyDtoRateLimitPerHourPerSubject.js

@@ -1,7 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * App Runtime API
- * OpenAPI spec version: 0.1.2
- */
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/updateAudiencePolicyDtoRateLimitPerHourPerSubject.d.ts

@@ -1,11 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * App Runtime API
- * OpenAPI spec version: 0.1.2
- */
-/**
- * @nullable
- */
-export type UpdateAudiencePolicyDtoRateLimitPerHourPerSubject = {
-    [key: string]: unknown;
-} | null;

package/dist/models/updateAudiencePolicyDtoRateLimitPerHourPerSubject.js

@@ -1,7 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * App Runtime API
- * OpenAPI spec version: 0.1.2
- */
-Object.defineProperty(exports, "__esModule", { value: true });