@xemahq/app-platform-operator-api-client 0.3.13

package/LICENSE

@@ -0,0 +1,175 @@
+Xema Business Source License 1.1
+
+License text copyright (c) 2020 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Parameters
+
+Licensor:  Neuralchowder Inc.
+
+Licensed Work:  Xema. The Licensed Work is (c) 2026 Neuralchowder Inc.
+
+  The Licensed Work includes, without limitation, Xema Core, Xema Runtime,
+  Xema Kernel, Xema control plane, Xema application runtime, Xema biome
+  runtime, Xema biome registry, Xema store services, Xema orchestration
+  services, Xema agents, Xema skills, Xema memory services, Xema APIs, Xema
+  user interfaces, Xema command-line tools, Xema deployment artifacts, Xema
+  templates, Xema specifications, Xema schemas, Xema manifests, Xema
+  documentation, Xema examples, and all source code, object code, binaries,
+  packages, modules, configuration files, manifests, schemas, examples,
+  templates, documentation, and derivative works included in or distributed
+  as part of the Xema software project.
+
+  The Licensed Work does not include any third-party software, libraries,
+  dependencies, packages, assets, or components that are distributed with the
+  Licensed Work but are governed by their own separate license terms. Such
+  third-party materials remain subject to their respective licenses.
+
+  A specific file, package, component, or directory may state that it is
+  governed by a different license. In that case, that specific file, package,
+  component, or directory is governed by the license expressly stated therein.
+
+Additional Use Grant:
+
+  You may make production use of the Licensed Work, provided that your use
+  does not include offering, providing, making available, distributing,
+  hosting, managing, embedding, reselling, white-labeling, sublicensing,
+  commercializing, or otherwise making the Licensed Work, or any modified
+  version or derivative work of the Licensed Work, available to Third Parties
+  as part of a Competitive Offering.
+
+The following definitions and clarifications form part of, and govern
+the interpretation of, the Additional Use Grant set out above.
+
+  1. "Production Use" means any use of the Licensed Work other than for
+     development, testing, evaluation, demonstration, experimentation,
+     benchmarking, or other non-production purposes.
+
+  2. "Affiliate" means any entity that, directly or indirectly,
+     controls, is controlled by, or is under common control with you,
+     where "control" means ownership of more than fifty percent (50%) of
+     the voting interests of the entity, or the power to direct its
+     management.
+
+  3. "Third Party" means any natural person or legal entity other than
+     you and your Affiliates.
+
+  4. "Competitive Offering" means any product or service, made available
+     to one or more Third Parties for a fee or other consideration
+     (including without limitation on a paid, subscription,
+     advertising-supported, hosted, or managed-service basis), that is
+     offered or marketed as, or that competes with, a software platform,
+     runtime, orchestration system, agent or automation system,
+     extension or distribution marketplace, or other software system
+     that provides, in substantial part, the same or substantially
+     similar capabilities as those provided by the Licensed Work. A
+     product or service is a Competitive Offering whether the Licensed
+     Work is provided in whole or in part, alone or bundled with other
+     software, and whether modified or unmodified.
+
+  5. Providing, hosting, or managing the Licensed Work for a Third Party,
+     or otherwise making the Licensed Work available to a Third Party as
+     a hosted or managed service such that the Third Party obtains the
+     principal value or functionality of the Licensed Work, is a
+     Competitive Offering and is not permitted by the Additional Use
+     Grant.
+
+  6. Subject to the foregoing, the Additional Use Grant permits you to
+     make Production Use of the Licensed Work for your own internal
+     business purposes and to build, operate, and provide your own
+     products and services to Third Parties, provided that the Licensed
+     Work itself (whether modified or unmodified) is not the product or
+     service, and is not a Competitive Offering, made available to those
+     Third Parties.
+
+  7. You may modify the Licensed Work and create derivative works for
+     any purpose permitted by this License. Any Production Use of such
+     modified or derivative works remains subject to the same
+     restrictions as the Licensed Work, including the prohibition on
+     Competitive Offerings.
+
+  8. Use of the Licensed Work by your own employees, contractors, and
+     agents, acting on your behalf and for your benefit, is not by
+     itself making the Licensed Work available to a Third Party.
+
+  9. Embedding or distributing the Licensed Work as a component of your
+     own product or service is permitted only where the Licensed Work
+     does not constitute the principal value of that product or service
+     and the product or service is not a Competitive Offering.
+
+  10. Nothing in this Additional Use Grant grants any right to use any
+      name, trademark, service mark, or logo of the Licensor or its
+      Affiliates, except as reasonably required for customary
+      attribution.
+
+  11. The rights stated in this Additional Use Grant are the maximum
+      rights granted for Production Use prior to the Change Date. Any
+      Production Use not expressly permitted requires a separate
+      commercial license from the Licensor.
+
+  12. If any provision of this Additional Use Grant is held invalid or
+      unenforceable, that provision shall be limited or eliminated to
+      the minimum extent necessary so that the remainder of this
+      Additional Use Grant, and of this License, remains in full force
+      and effect. The Licensor reserves all rights not expressly granted
+      by this License.
+
+
+Change Date:  Four years from the date the specific version of the Licensed
+  Work is first publicly released by Licensor.
+
+Change License:  Mozilla Public License, Version 2.0
+
+For information about alternative licensing arrangements, commercial
+licensing, enterprise licensing, OEM licensing, appliance licensing, managed
+service licensing, cloud provider licensing, or other commercial use of the
+Licensed Work, please contact: licensing@neuralchowder.com
+
+-----------------------------------------------------------------------------
+
+Notice
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph above
+terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works of
+the Licensed Work, are subject to this License. This License applies separately
+for each version of the Licensed Work and the Change Date may vary for each
+version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or modified
+form from a third party, the terms and conditions set forth in this License
+apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of Licensor
+or its affiliates, provided that you may use a trademark or logo of Licensor
+as expressly required by this License.
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN
+"AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS
+OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.

package/README.md

@@ -0,0 +1,62 @@
+<!-- Generated by @xemahq/api-client-generator. Do not edit by hand. -->
+<p align="center">
+<svg width="680" height="120" viewBox="0 0 680 120" fill="none" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="@xemahq/app-platform-operator-api-client">
+  <rect width="680" height="120" rx="14" fill="#0B1020"/>
+  <g transform="translate(28,34)">
+    <path d="M26 0 L52 15 L52 45 L26 60 L0 45 L0 15 Z" fill="#14B8A6" opacity="0.18"/>
+    <path d="M26 12 L41 21 L41 39 L26 48 L11 39 L11 21 Z" fill="#14B8A6"/>
+  </g>
+  <text x="92" y="52" font-family="ui-monospace,SFMono-Regular,Menlo,monospace" font-size="22" fill="#F8FAFC" font-weight="700">@xemahq/app-platform-operator-api-client</text>
+  <text x="92" y="80" font-family="ui-sans-serif,system-ui,sans-serif" font-size="15" fill="#94A3B8">Typed, generated operator HTTP client for the App Runtime API.</text>
+  <text x="652" y="105" text-anchor="end" font-family="ui-sans-serif,system-ui,sans-serif" font-size="12" fill="#475569">xema.dev</text>
+</svg>
+</p>
+
+<p align="center">
+  <a href="https://xema.dev">Website</a> &middot;
+  <a href="https://www.npmjs.com/package/@xemahq/app-platform-operator-api-client">npm</a>
+</p>
+
+<p align="center">
+  <img alt="npm" src="https://img.shields.io/npm/v/%40xemahq%2Fapp-platform-operator-api-client?color=2563eb&label=npm">
+  <img alt="license" src="https://img.shields.io/npm/l/%40xemahq%2Fapp-platform-operator-api-client?color=10b981">
+  <img alt="types" src="https://img.shields.io/npm/types/%40xemahq%2Fapp-platform-operator-api-client?color=3178c6">
+</p>
+
+# @xemahq/app-platform-operator-api-client
+
+> Typed, generated operator HTTP client for the App Runtime API.
+
+## Overview
+
+Auto-generated TypeScript client for the **App Runtime API**. It exports typed
+request functions and response models that mirror the service's OpenAPI surface,
+so callers get end-to-end type safety without hand-writing HTTP calls. This
+package is produced by `@xemahq/api-client-generator` and regenerated whenever
+the service's API changes — do not edit it by hand.
+
+## When to use it
+
+- Use it from any TypeScript service or app that calls the App Runtime API over HTTP.
+- You get compile-time types for every endpoint and payload; regenerate to pick
+  up API changes rather than editing the client.
+
+## Installation
+
+```bash
+pnpm add @xemahq/app-platform-operator-api-client
+```
+
+## Usage
+
+```ts
+// Every endpoint function and response model is exported from the package root.
+import * as client from '@xemahq/app-platform-operator-api-client';
+```
+
+Call the typed endpoint functions; request and response shapes are fully typed
+from the service's OpenAPI spec.
+
+## License
+
+Proprietary — &copy; Xema. All rights reserved. — [xema.dev](https://xema.dev)

package/dist/custom-fetch.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Configurable fetch wrapper for Orval-generated clients.
+ *
+ * GENERATED by `@xemahq/api-client-generator` — do not edit. Every client in
+ * the fleet ships this file byte-for-byte; a local edit is erased by the next
+ * `pnpm refresh` and, until then, makes this one client speak to the platform
+ * differently from all of its siblings. Change the template instead:
+ * `api-client-generator/src/lib/custom-fetch-template.ts`.
+ *
+ * Consumers must call `configureClient()` before using any endpoint function.
+ * The baseUrl is prepended to the relative paths generated by Orval.
+ *
+ * By default this transport issues exactly ONE request and adds no delay of its
+ * own, so a slow call is a slow server. Retrying is opt-in, and opting in
+ * requires supplying an observer — see `maxRetries` / `onRetry` below.
+ */
+/** What {@link ClientConfig.onRetry} is told before each re-attempt. */
+export interface RetryNotice {
+    /** 1-based index of the re-attempt about to be made. */
+    attempt: number;
+    /** The configured budget this re-attempt is spending from. */
+    maxRetries: number;
+    /** The response status that made the previous attempt retryable. */
+    status: number;
+    /** Delay before the re-attempt, in ms — from `Retry-After` when the server sent one. */
+    waitMs: number;
+    /** Whether {@link waitMs} came from the server's `Retry-After` header. */
+    retryAfterHonoured: boolean;
+    /** Absolute URL being re-requested. */
+    url: string;
+    /** HTTP method being re-requested. */
+    method: string;
+}
+export interface ClientConfig {
+    /**
+     * Static base URL (e.g. 'http://localhost:3140') — no trailing slash.
+     * Mutually exclusive with `baseUrlResolver`; exactly one MUST be set.
+     */
+    baseUrl?: string;
+    /**
+     * Per-request base-URL resolver. When set, the peer URL is resolved from
+     * the service registry on EVERY request (boot-order-safe). Wired by
+     * `configureOrvalClientResolved` from `@xemahq/platform-common`.
+     */
+    baseUrlResolver?: () => string | Promise<string>;
+    /** Optional async callback to get an auth token. Auto-sets Authorization header on every request. */
+    getAuthToken?: () => Promise<string>;
+    /** Optional callback returning headers to inject on every request. Per-call headers take precedence. */
+    getHeaders?: () => Record<string, string> | Promise<Record<string, string>>;
+    /**
+     * Optional resolver for the CORRELATION ID of the request being made — the
+     * handle that ties one causal chain together across every service hop.
+     *
+     * WHY IT IS A CALLBACK AND NOT A VALUE. `ClientConfig` is process-global
+     * (`configureClient` is called once at wiring time), and a correlation id is
+     * per-request. This is invoked INSIDE the request, so a server can point it
+     * at whatever carries its ambient request context and get the CURRENT id
+     * rather than the one that happened to be live at boot.
+     *
+     * WHY THE TRANSPORT DOES NOT MINT ONE. Returning `undefined` sends no header,
+     * and the receiving service's `RequestContextMiddleware` mints its own — a
+     * new trace, which is honest. A transport that minted per call would produce
+     * a FRESH id on every hop while looking like propagation, which is strictly
+     * worse than none: every row would carry a correlation id and no two rows
+     * that belong together would share one. That is the exact defect this exists
+     * to fix, so the transport must not reproduce it one layer down.
+     *
+     * A caller-supplied `X-Correlation-Id` header always wins, and so does one
+     * from `getHeaders`.
+     */
+    getCorrelationId?: () => string | undefined | Promise<string | undefined>;
+    /**
+     * Optional callback invoked on a 401 before ONE re-attempt. Supplying it is
+     * what opts this client into that re-attempt; without it a 401 comes back to
+     * the caller as a `ClientError` like any other 4xx.
+     */
+    onUnauthorized?: () => Promise<void>;
+    /**
+     * Re-attempts for a retryable status. **Defaults to 0 — no retry.**
+     *
+     * Setting it above 0 REQUIRES `onRetry`; `configureClient` throws otherwise.
+     * See the block above `customFetch` for why the budget is opt-in and why an
+     * observer is mandatory rather than advisory.
+     */
+    maxRetries?: number;
+    /**
+     * Called immediately before every re-attempt, with the reason and the delay.
+     *
+     * Mandatory whenever `maxRetries` is above 0. It is the difference between a
+     * retry and a hidden degradation path: without it a caller cannot tell a slow
+     * server from this transport sleeping between attempts.
+     */
+    onRetry?: (notice: RetryNotice) => void;
+}
+export declare class ClientError extends Error {
+    readonly status: number;
+    readonly url: string;
+    readonly body: unknown;
+    constructor(status: number, url: string, body: unknown);
+}
+export declare function configureClient(config: ClientConfig): void;
+export declare function getClientConfig(): ClientConfig;
+export declare const customFetch: <T>(url: string, options: RequestInit) => Promise<T>;
+export default customFetch;

package/dist/custom-fetch.js

@@ -0,0 +1,253 @@
+"use strict";
+/**
+ * Configurable fetch wrapper for Orval-generated clients.
+ *
+ * GENERATED by `@xemahq/api-client-generator` — do not edit. Every client in
+ * the fleet ships this file byte-for-byte; a local edit is erased by the next
+ * `pnpm refresh` and, until then, makes this one client speak to the platform
+ * differently from all of its siblings. Change the template instead:
+ * `api-client-generator/src/lib/custom-fetch-template.ts`.
+ *
+ * Consumers must call `configureClient()` before using any endpoint function.
+ * The baseUrl is prepended to the relative paths generated by Orval.
+ *
+ * By default this transport issues exactly ONE request and adds no delay of its
+ * own, so a slow call is a slow server. Retrying is opt-in, and opting in
+ * requires supplying an observer — see `maxRetries` / `onRetry` below.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.customFetch = exports.ClientError = void 0;
+exports.configureClient = configureClient;
+exports.getClientConfig = getClientConfig;
+class ClientError extends Error {
+    status;
+    url;
+    body;
+    constructor(status, url, body) {
+        super(`HTTP ${status} from ${url}`);
+        this.status = status;
+        this.url = url;
+        this.body = body;
+        this.name = 'ClientError';
+    }
+}
+exports.ClientError = ClientError;
+let clientConfig = null;
+function configureClient(config) {
+    // Fail at WIRING time, not on the request that happens to be retried. A
+    // client configured to retry without an observer is the exact defect this
+    // transport was rebuilt to remove, so it must not be constructible.
+    if ((config.maxRetries ?? 0) > 0 && !config.onRetry) {
+        throw new Error('configureClient: maxRetries above 0 requires onRetry. A retry nothing ' +
+            'reports is indistinguishable from a slow server, which is how two ' +
+            'silent re-attempts were read as a 3,312ms call.');
+    }
+    clientConfig = config;
+}
+function getClientConfig() {
+    if (!clientConfig) {
+        throw new Error('Client not configured. Call configureClient({ baseUrl }) before using endpoint functions.');
+    }
+    return clientConfig;
+}
+/*
+ * RETRYING IS OPT-IN, OBSERVED, AND NARROW. Do not widen any of the three.
+ *
+ * This transport used to retry up to `maxRetries` (defaulting to THREE) over
+ * 429/502/503/504 AND over any thrown network error, backing off from 1000ms,
+ * with no log line anywhere. Three properties were wrong:
+ *
+ *   1. The DEFAULT was on. ~99% of the fleet's client configurations never
+ *      mention `maxRetries`, so two re-attempts could add ~3s to any call with
+ *      nothing to distinguish that from a slow peer. Every caller that DID set
+ *      it set it LOWER — canopy's control plane to 1, "so a hard outage
+ *      surfaces inside the turn's latency budget rather than after three
+ *      backoffs"; two llm-registry callers to 1; a test to 0. Nobody ever
+ *      raised it. A default three separate call sites work around is not a
+ *      default, and `configureOrvalClientResolved` cannot express the field at
+ *      all, so most callers could not have opted out if they had wanted to.
+ *   2. It retried AMBIGUOUS failures. 502 and 504 mean a gateway did not get a
+ *      timely answer from upstream — the upstream may well have APPLIED the
+ *      request. So did a thrown network error mid-flight. Re-sending a POST in
+ *      either case is a duplicate write, and no amount of logging makes that
+ *      safe. Only 429 and 503 state positively that the request was NOT
+ *      processed, so only those are retried; everything else surfaces at once.
+ *   3. Nothing reported it. Now `onRetry` is mandatory whenever the budget is
+ *      above 0, enforced in `configureClient`.
+ *
+ * Also note `baseUrlResolver` is awaited ONCE, above the loop: a re-attempt
+ * returns to the same resolved instance. In a registry-resolved fleet the cure
+ * for an unhealthy peer is re-resolution, which lives above this file — which
+ * is a further reason not to lean on retrying here.
+ *
+ * Retry policy a caller genuinely wants belongs in `@xemahq/managed-fetch`,
+ * which has backoff, a circuit breaker, a token bucket and health reporting,
+ * and reports what it did.
+ *
+ * Enforced fleet-wide by `check-client-transport-envelope`, which compares
+ * every client's transport to this template.
+ */
+/** The only statuses that state the request was NOT processed. See above. */
+const RETRYABLE_STATUSES = [429, 503];
+/**
+ * The platform's correlation header, spelled once.
+ *
+ * Value-identical to what `RequestContextMiddleware` reads in
+ * `@xemahq/platform-common`. It is a literal here rather than an import
+ * because this file has ZERO imports on purpose: it ships byte-identical into
+ * browser-target clients as well as server-target ones, and a dependency on a
+ * NestJS-peer package would follow it into every one of them.
+ */
+const CORRELATION_ID_HEADER = 'X-Correlation-Id';
+/** Backoff floor, doubling per attempt up to {@link MAX_BACKOFF_MS}. */
+const BASE_BACKOFF_MS = 1000;
+/** Ceiling on a single backoff, however many attempts have elapsed. */
+const MAX_BACKOFF_MS = 30_000;
+async function buildHeaders(config, callerHeaders) {
+    const headers = new Headers(callerHeaders);
+    // Global headers from config (caller-provided headers take precedence)
+    if (config.getHeaders) {
+        const globalHeaders = await Promise.resolve(config.getHeaders());
+        for (const [key, value] of Object.entries(globalHeaders)) {
+            if (!headers.has(key)) {
+                headers.set(key, value);
+            }
+        }
+    }
+    // Correlation id (caller and global headers still take precedence).
+    //
+    // Without this, every server-to-server hop through a generated client started
+    // a NEW trace: the id is read-or-minted per hop by the receiving service's
+    // RequestContextMiddleware, and nothing carried it outbound — so an audit
+    // journal could record a whole causal chain and offer no way to join it back
+    // together.
+    //
+    // Absent resolver, or a resolver that answers `undefined`: NO header. The
+    // receiver mints and a new trace begins, which is the truthful outcome when
+    // there is nothing to continue.
+    if (config.getCorrelationId && !headers.has(CORRELATION_ID_HEADER)) {
+        const correlationId = await Promise.resolve(config.getCorrelationId());
+        if (correlationId) {
+            headers.set(CORRELATION_ID_HEADER, correlationId);
+        }
+    }
+    // Auth token (caller or global headers take precedence)
+    if (config.getAuthToken && !headers.has('Authorization')) {
+        const token = await config.getAuthToken();
+        headers.set('Authorization', `Bearer ${token}`);
+    }
+    return headers;
+}
+/*
+ * THE TRANSPORT RETURNS THE BODY UNCHANGED. Do not reintroduce an unwrap here.
+ *
+ * Xema services wrap every 2xx payload in a { data: T } envelope via the global
+ * ResponseEnvelopeInterceptor (platform-common), and the generator emits types
+ * that describe THAT ENVELOPE — every endpoint returns Promise<XDataEnvelope>
+ * or Promise<XPaginatedEnvelope>, never a bare inner T. Consumers read the data
+ * property themselves.
+ *
+ * This template used to peel data, justified by a comment claiming generated
+ * types describe the inner T. That stopped being true when the generator moved
+ * to envelope-typed returns, and the comment outlived the fact — so the peel
+ * then contradicted every type in every package it seeded. Four clients shipped
+ * that way (resource-governance x3, workload-runtime-api): declared
+ * *DataEnvelope, returned the already-peeled inner object, so .data read
+ * undefined at runtime on every non-paginated endpoint. Paginated calls hid it,
+ * because the old peel deliberately preserved an envelope carrying pagination.
+ *
+ * Four MORE shipped it in repositories the gate could not see — license-api and
+ * license-internal-api in xema-operator, plus their host-web mirrors — because
+ * the gate ran in xema-base only. That is why it now runs in every repository
+ * that ships a client, and why this file is generator-owned rather than seeded.
+ */
+const customFetch = async (url, options) => {
+    const config = getClientConfig();
+    const base = config.baseUrlResolver
+        ? await config.baseUrlResolver()
+        : config.baseUrl;
+    if (base === undefined) {
+        throw new Error('Client not configured: set baseUrl or baseUrlResolver via configureClient().');
+    }
+    const fullUrl = `${base}${url}`;
+    const maxRetries = config.maxRetries ?? 0;
+    // A caller that supplied its own Authorization header owns that credential.
+    // `buildHeaders` lets it win, so refreshing the CLIENT-WIDE token and
+    // re-sending would replay the identical failing request with the identical
+    // credential: one wasted round trip, plus a global refresh nobody asked for.
+    const callerSuppliedAuth = new Headers(options.headers).has('Authorization');
+    const headers = await buildHeaders(config, options.headers);
+    const requestInit = { ...options, headers };
+    let delay = BASE_BACKOFF_MS;
+    for (let attempt = 0;; attempt++) {
+        const response = await fetch(fullUrl, requestInit);
+        if (response.status === 401 &&
+            config.onUnauthorized &&
+            !callerSuppliedAuth &&
+            attempt === 0) {
+            await config.onUnauthorized();
+            const refreshedHeaders = await buildHeaders(config, options.headers);
+            const retryResponse = await fetch(fullUrl, {
+                ...options,
+                headers: refreshedHeaders,
+            });
+            const retryBody = await parseBody(retryResponse);
+            if (retryResponse.status >= 400) {
+                throw new ClientError(retryResponse.status, fullUrl, retryBody);
+            }
+            return retryBody;
+        }
+        if (!RETRYABLE_STATUSES.includes(response.status) ||
+            attempt >= maxRetries) {
+            const body = await parseBody(response);
+            if (response.status >= 400) {
+                throw new ClientError(response.status, fullUrl, body);
+            }
+            return body;
+        }
+        const retryAfter = parseRetryAfter(response.headers.get('Retry-After'));
+        const waitMs = retryAfter ?? addJitter(delay);
+        // Non-null: `configureClient` refuses a budget above 0 without an observer,
+        // and this line is unreachable unless `maxRetries` is above 0.
+        config.onRetry({
+            attempt: attempt + 1,
+            maxRetries,
+            status: response.status,
+            waitMs,
+            retryAfterHonoured: retryAfter !== undefined,
+            url: fullUrl,
+            method: options.method ?? 'GET',
+        });
+        await sleep(waitMs);
+        delay = Math.min(delay * 2, MAX_BACKOFF_MS);
+    }
+};
+exports.customFetch = customFetch;
+async function parseBody(response) {
+    const contentType = response.headers.get('content-type');
+    if (contentType?.includes('application/json')) {
+        return response.json();
+    }
+    if (response.status === 204) {
+        return undefined;
+    }
+    return response.text();
+}
+function parseRetryAfter(value) {
+    if (!value)
+        return undefined;
+    const seconds = Number(value);
+    if (!isNaN(seconds) && seconds >= 0)
+        return seconds * 1000;
+    const date = new Date(value);
+    if (!isNaN(date.getTime()))
+        return Math.max(0, date.getTime() - Date.now());
+    return undefined;
+}
+function addJitter(delay) {
+    return delay + (Math.random() * 2 - 1) * delay * 0.25;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+exports.default = exports.customFetch;

package/dist/endpoints/delegated-session-keys/delegated-session-keys.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+import type { RotateSigningKeyResultDtoDataEnvelope, SigningKeyRingStateDtoDataEnvelope } from '../../models';
+export declare const getOperatorSigningKeysControllerStateUrl: () => string;
+/**
+ * @summary Inspect the delegated-session signing key ring: the active kid and every retired key still being published.
+ */
+export declare const operatorSigningKeysControllerState: (options?: RequestInit) => Promise<SigningKeyRingStateDtoDataEnvelope>;
+export declare const getOperatorSigningKeysControllerRotateUrl: () => string;
+/**
+ * @summary Rotate the delegated-session signing key. The outgoing key keeps being published for its overlap window, so tokens already in flight continue to verify.
+ */
+export declare const operatorSigningKeysControllerRotate: (options?: RequestInit) => Promise<RotateSigningKeyResultDtoDataEnvelope>;

package/dist/endpoints/delegated-session-keys/delegated-session-keys.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.operatorSigningKeysControllerRotate = exports.getOperatorSigningKeysControllerRotateUrl = exports.operatorSigningKeysControllerState = exports.getOperatorSigningKeysControllerStateUrl = void 0;
+const custom_fetch_1 = require("../../custom-fetch");
+const getOperatorSigningKeysControllerStateUrl = () => {
+    return `/operator/delegated-session-keys`;
+};
+exports.getOperatorSigningKeysControllerStateUrl = getOperatorSigningKeysControllerStateUrl;
+/**
+ * @summary Inspect the delegated-session signing key ring: the active kid and every retired key still being published.
+ */
+const operatorSigningKeysControllerState = async (options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getOperatorSigningKeysControllerStateUrl)(), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.operatorSigningKeysControllerState = operatorSigningKeysControllerState;
+const getOperatorSigningKeysControllerRotateUrl = () => {
+    return `/operator/delegated-session-keys/rotate`;
+};
+exports.getOperatorSigningKeysControllerRotateUrl = getOperatorSigningKeysControllerRotateUrl;
+/**
+ * @summary Rotate the delegated-session signing key. The outgoing key keeps being published for its overlap window, so tokens already in flight continue to verify.
+ */
+const operatorSigningKeysControllerRotate = async (options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getOperatorSigningKeysControllerRotateUrl)(), {
+        ...options,
+        method: 'POST'
+    });
+};
+exports.operatorSigningKeysControllerRotate = operatorSigningKeysControllerRotate;

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { configureClient, getClientConfig, ClientError, customFetch, type ClientConfig, type RetryNotice } from './custom-fetch';
+export * from './models';
+export * from './endpoints/delegated-session-keys/delegated-session-keys';

package/dist/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.customFetch = exports.ClientError = exports.getClientConfig = exports.configureClient = void 0;
+// Auto-generated by @xemahq/api-client-generator — do not edit manually.
+var custom_fetch_1 = require("./custom-fetch");
+Object.defineProperty(exports, "configureClient", { enumerable: true, get: function () { return custom_fetch_1.configureClient; } });
+Object.defineProperty(exports, "getClientConfig", { enumerable: true, get: function () { return custom_fetch_1.getClientConfig; } });
+Object.defineProperty(exports, "ClientError", { enumerable: true, get: function () { return custom_fetch_1.ClientError; } });
+Object.defineProperty(exports, "customFetch", { enumerable: true, get: function () { return custom_fetch_1.customFetch; } });
+__exportStar(require("./models"), exports);
+__exportStar(require("./endpoints/delegated-session-keys/delegated-session-keys"), exports);

package/dist/models/index.d.ts

@@ -0,0 +1,5 @@
+export * from './publishedSigningKeyDto';
+export * from './rotateSigningKeyResultDto';
+export * from './rotateSigningKeyResultDtoDataEnvelope';
+export * from './signingKeyRingStateDto';
+export * from './signingKeyRingStateDtoDataEnvelope';

package/dist/models/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Auto-generated by tooling/codegen/regenerate-models-barrel.js — do not edit manually.
+__exportStar(require("./publishedSigningKeyDto"), exports);
+__exportStar(require("./rotateSigningKeyResultDto"), exports);
+__exportStar(require("./rotateSigningKeyResultDtoDataEnvelope"), exports);
+__exportStar(require("./signingKeyRingStateDto"), exports);
+__exportStar(require("./signingKeyRingStateDtoDataEnvelope"), exports);

package/dist/models/publishedSigningKeyDto.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+export interface PublishedSigningKeyDto {
+    /** RFC 7638 JWK thumbprint of the retired key. */
+    kid: string;
+    /** Instant after which the key stops being published (ISO-8601). It is later than the expiry of the longest-lived token the key ever signed. */
+    publishUntil: string;
+}

package/dist/models/publishedSigningKeyDto.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/rotateSigningKeyResultDto.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+export interface RotateSigningKeyResultDto {
+    /** `kid` that is active after this call. */
+    activeKid: string;
+    /** False when this replica lost the compare-and-set and adopted a ring another replica had already rotated — `activeKid` is then the winner’s key. The rotation still happened; it was simply not performed here. */
+    rotated: boolean;
+}

package/dist/models/rotateSigningKeyResultDto.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/rotateSigningKeyResultDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+import type { RotateSigningKeyResultDto } from './rotateSigningKeyResultDto.js';
+export interface RotateSigningKeyResultDtoDataEnvelope {
+    data: RotateSigningKeyResultDto;
+}

package/dist/models/rotateSigningKeyResultDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/signingKeyRingStateDto.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+import type { PublishedSigningKeyDto } from './publishedSigningKeyDto.js';
+export interface SigningKeyRingStateDto {
+    /** `kid` of the key new tokens are signed with. */
+    activeKid: string;
+    /** JWS algorithm of the active key. Always asymmetric — there is no symmetric option. */
+    algorithm: string;
+    /** Keys that no longer sign but are still published, so tokens minted before the rotation keep verifying until they expire. */
+    retired: PublishedSigningKeyDto[];
+}

package/dist/models/signingKeyRingStateDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/signingKeyRingStateDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+import type { SigningKeyRingStateDto } from './signingKeyRingStateDto.js';
+export interface SigningKeyRingStateDtoDataEnvelope {
+    data: SigningKeyRingStateDto;
+}

package/dist/models/signingKeyRingStateDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@xemahq/app-platform-operator-api-client",
+  "version": "0.3.13",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "devDependencies": {
+    "typescript": "5.9.3"
+  },
+  "xema": {
+    "kind": "api-client",
+    "surface": "operator",
+    "service": "app-platform-api",
+    "biome": "app-platform",
+    "target": "server",
+    "generator": "@xemahq/api-client-generator@0.14.1",
+    "source": "openapi.operator.json"
+  },
+  "license": "LicenseRef-Xema-BSL-1.1",
+  "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
+  "homepage": "https://xema.dev",
+  "bugs": "https://github.com/xema-dev/xema-community/issues",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xema-dev/xema-base.git",
+    "directory": "packages/clients/app-platform-operator-api"
+  },
+  "description": "Generated operator API client for the Xema app-platform-api service.",
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  }
+}