langwatch 0.29.0 → 0.30.0

package/dist/chunk-3CPA262Z.mjs

@@ -0,0 +1,124 @@
+import {
+  __spreadValues
+} from "./chunk-BAX4W3AY.mjs";
+
+// src/cli/utils/governance/device-flow.ts
+import * as os from "os";
+import { setTimeout as wait } from "timers/promises";
+var DeviceFlowError = class extends Error {
+  constructor(kind, message) {
+    super(message);
+    this.kind = kind;
+    this.name = "DeviceFlowError";
+  }
+};
+async function startDeviceCode(opts, init = {}) {
+  const body = {};
+  if (init.credentialType) body.credential_type = init.credentialType;
+  const dc = await postJSON(opts, "/api/auth/cli/device-code", body);
+  if (!dc.interval || dc.interval <= 0) dc.interval = 5;
+  return dc;
+}
+function collectClientInfo() {
+  let hostname2 = "";
+  let uname = "";
+  try {
+    hostname2 = os.hostname();
+  } catch (e) {
+  }
+  try {
+    uname = os.userInfo().username;
+  } catch (e) {
+  }
+  return { hostname: hostname2, uname, platform: process.platform };
+}
+async function exchange(opts, deviceCode) {
+  const res = await rawPost(opts, "/api/auth/cli/exchange", {
+    device_code: deviceCode,
+    client_info: collectClientInfo()
+  });
+  switch (res.status) {
+    case 200: {
+      const body = await res.json();
+      if (!("kind" in body) || !body.kind) {
+        return __spreadValues({ kind: "device_session" }, body);
+      }
+      return body;
+    }
+    case 428:
+      throw new DeviceFlowError("pending", "authorization pending");
+    case 410:
+      throw new DeviceFlowError("denied", "authorization denied");
+    case 408:
+      throw new DeviceFlowError("expired", "authorization request expired");
+    case 429:
+      throw new DeviceFlowError("slow_down", "polling too fast");
+    default: {
+      const body = await res.text().catch(() => "");
+      throw new DeviceFlowError("other", `unexpected status ${res.status}: ${body.slice(0, 256)}`);
+    }
+  }
+}
+async function pollUntilDone(opts, dc) {
+  let interval = dc.interval * 1e3;
+  const ceiling = 6e4;
+  const deadline = Date.now() + dc.expires_in * 1e3;
+  for (; ; ) {
+    if (Date.now() > deadline) {
+      throw new DeviceFlowError("expired", "authorization request expired");
+    }
+    await wait(interval);
+    try {
+      return await exchange(opts, dc.device_code);
+    } catch (err) {
+      if (!(err instanceof DeviceFlowError)) throw err;
+      if (err.kind === "pending") continue;
+      if (err.kind === "slow_down") {
+        interval = Math.min(interval * 2, ceiling);
+        continue;
+      }
+      throw err;
+    }
+  }
+}
+async function logout(opts, refreshToken, accessToken) {
+  const body = { refresh_token: refreshToken };
+  if (accessToken) body.access_token = accessToken;
+  const res = await rawPost(opts, "/api/auth/cli/logout", body);
+  if (res.status === 200 || res.status === 401 || res.status === 404) return;
+  const text = await res.text().catch(() => "");
+  throw new DeviceFlowError("other", `logout failed (${res.status}): ${text.slice(0, 256)}`);
+}
+async function postJSON(opts, path, body) {
+  const res = await rawPost(opts, path, body);
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new DeviceFlowError("other", `${path} \u2192 ${res.status}: ${text.slice(0, 256)}`);
+  }
+  return await res.json();
+}
+function rawPost(opts, path, body) {
+  var _a;
+  const url = opts.baseUrl.replace(/\/+$/, "") + path;
+  const f = (_a = opts.fetchImpl) != null ? _a : fetch;
+  return f(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      // Origin enforcement on the server requires this for non-browser
+      // clients. The base URL is the same as the control plane, so
+      // mirroring it as Origin satisfies the same-origin gate.
+      Origin: opts.baseUrl.replace(/\/+$/, "")
+    },
+    body: JSON.stringify(body != null ? body : {})
+  });
+}
+
+export {
+  DeviceFlowError,
+  startDeviceCode,
+  pollUntilDone,
+  logout
+};
+//# sourceMappingURL=chunk-3CPA262Z.mjs.map

package/dist/chunk-3CPA262Z.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/utils/governance/device-flow.ts"],"sourcesContent":["/**\n * RFC 8628 device-code OAuth client for the `langwatch login --device`\n * flow. Targets the control plane's `/api/auth/cli/*` endpoints —\n * the same wire surface a custom CLI client would hit (documented in\n * `docs/ai-gateway/governance/admin-setup.mdx#cli-device-flow-rest-api`).\n *\n * Pure stdlib `fetch`, no axios — matches the rest of the typescript\n * CLI's HTTP style.\n */\n\nimport * as os from \"node:os\";\nimport { setTimeout as wait } from \"node:timers/promises\";\n\nexport interface DeviceCode {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete?: string;\n  expires_in: number;\n  interval: number;\n}\n\nexport interface ExchangeUser {\n  id: string;\n  email: string;\n  name: string;\n}\n\nexport interface ExchangeOrganization {\n  id: string;\n  slug?: string;\n  name: string;\n}\n\nexport interface ExchangePersonalVK {\n  id: string;\n  secret: string;\n  prefix?: string;\n}\n\nexport interface ExchangeProject {\n  id: string;\n  slug: string;\n  name: string;\n}\n\n/**\n * The CLI device-code flow can mint two distinct credential types:\n *   - \"device_session\" — the user-scoped OAuth-style access+refresh\n *     token pair used by `langwatch claude/codex/...` wrappers.\n *   - \"project_api_key\" — the project-scoped SDK key\n *     (`Project.apiKey`) returned verbatim, used by SDK consumers\n *     and `langwatch sync/eval/prompt/...` commands.\n *\n * Caller selects via `startDeviceCode({ credentialType })`. Server\n * stamps the choice on the device-code record + flips the response\n * shape on /exchange. Same browser approval ceremony for both — only\n * the persist target differs (`~/.langwatch/config.json` vs `.env`).\n */\nexport type CredentialType = \"device_session\" | \"project_api_key\";\n\nexport interface ExchangeDeviceSessionResult {\n  kind: \"device_session\";\n  access_token: string;\n  refresh_token: string;\n  expires_in: number;\n  user: ExchangeUser;\n  organization: ExchangeOrganization;\n  default_personal_vk?: ExchangePersonalVK;\n  endpoint?: string;\n}\n\nexport interface ExchangeApiKeyResult {\n  kind: \"api_key\";\n  api_key: string;\n  project: ExchangeProject;\n  user: ExchangeUser;\n  organization: ExchangeOrganization;\n  endpoint?: string;\n}\n\nexport type ExchangeResult =\n  | ExchangeDeviceSessionResult\n  | ExchangeApiKeyResult;\n\n/**\n * Back-compat alias for the device-session shape. Pre-`f9fcc3927` server\n * builds returned the unkinded shape verbatim; the runtime normaliser\n * below maps that to `{ kind: 'device_session', ... }` so callers can\n * always assume the discriminated form.\n */\nexport type LegacyExchangeResult = Omit<\n  ExchangeDeviceSessionResult,\n  \"kind\"\n> & { kind?: \"device_session\" };\n\nexport interface RefreshResult {\n  access_token: string;\n  refresh_token: string;\n  expires_in: number;\n}\n\nexport class DeviceFlowError extends Error {\n  constructor(public readonly kind: \"pending\" | \"denied\" | \"expired\" | \"slow_down\" | \"unauthorized\" | \"other\", message: string) {\n    super(message);\n    this.name = \"DeviceFlowError\";\n  }\n}\n\nexport interface DeviceFlowOptions {\n  /** Control-plane base URL (e.g. https://app.langwatch.ai). */\n  baseUrl: string;\n  /** Optional fetch override for tests. */\n  fetchImpl?: typeof fetch;\n}\n\n/**\n * `POST /api/auth/cli/device-code` — mint a device-code + user-code pair.\n *\n * Optional `credentialType` selects what `/exchange` will return on\n * approval: a user-scoped device session (default) or a project-scoped\n * API key. Older servers ignore the field and stay on the device-session\n * shape — back-compat is the server's responsibility.\n */\nexport async function startDeviceCode(\n  opts: DeviceFlowOptions,\n  init: { credentialType?: CredentialType } = {},\n): Promise<DeviceCode> {\n  const body: Record<string, unknown> = {};\n  if (init.credentialType) body.credential_type = init.credentialType;\n  const dc = await postJSON<DeviceCode>(opts, \"/api/auth/cli/device-code\", body);\n  if (!dc.interval || dc.interval <= 0) dc.interval = 5;\n  return dc;\n}\n\n/**\n * Device fingerprint stamped onto the CLI session at /exchange time.\n * The control plane persists it on the access + refresh token records\n * so /me/sessions can render \"Mac (rchaves.local)\" instead of\n * \"Unknown device\" — multi-device users need this to revoke\n * individual sessions without nuking every device they're logged in\n * on (Ariana QA finding). See\n * `langwatch/src/server/routes/auth-cli.ts#clientInfoSchema` for the\n * server contract.\n */\nfunction collectClientInfo(): {\n  hostname: string;\n  uname: string;\n  platform: string;\n} {\n  let hostname = \"\";\n  let uname = \"\";\n  try {\n    hostname = os.hostname();\n  } catch {\n    // os.hostname() can throw on locked-down sandboxes; carry empty.\n  }\n  try {\n    uname = os.userInfo().username;\n  } catch {\n    // os.userInfo() throws when the uid has no /etc/passwd entry\n    // (some Docker images, CI sandboxes); carry empty.\n  }\n  return { hostname, uname, platform: process.platform };\n}\n\n/**\n * `POST /api/auth/cli/exchange` — single poll. Returns the access+refresh\n * token bundle on success (200), or throws DeviceFlowError with a\n * categorised `kind` so the caller can decide whether to keep polling\n * (`pending`, `slow_down`) or stop (`denied`, `expired`).\n */\nexport async function exchange(\n  opts: DeviceFlowOptions,\n  deviceCode: string,\n): Promise<ExchangeResult> {\n  const res = await rawPost(opts, \"/api/auth/cli/exchange\", {\n    device_code: deviceCode,\n    client_info: collectClientInfo(),\n  });\n  switch (res.status) {\n    case 200: {\n      const body = (await res.json()) as\n        | ExchangeResult\n        | LegacyExchangeResult;\n      // Pre-f9fcc3927 servers returned the device-session shape without\n      // a `kind` field. Normalise so callers can always discriminate.\n      if (!(\"kind\" in body) || !body.kind) {\n        return { kind: \"device_session\", ...(body) };\n      }\n      return body as ExchangeResult;\n    }\n    case 428:\n      throw new DeviceFlowError(\"pending\", \"authorization pending\");\n    case 410:\n      throw new DeviceFlowError(\"denied\", \"authorization denied\");\n    case 408:\n      throw new DeviceFlowError(\"expired\", \"authorization request expired\");\n    case 429:\n      throw new DeviceFlowError(\"slow_down\", \"polling too fast\");\n    default: {\n      const body = await res.text().catch(() => \"\");\n      throw new DeviceFlowError(\"other\", `unexpected status ${res.status}: ${body.slice(0, 256)}`);\n    }\n  }\n}\n\n/**\n * Poll `exchange` at the cadence the server requested until the user\n * approves, denies, or the device-code expires. Honours RFC 8628 §3.5\n * by doubling the polling interval on `slow_down` responses.\n */\nexport async function pollUntilDone(\n  opts: DeviceFlowOptions,\n  dc: DeviceCode,\n): Promise<ExchangeResult> {\n  let interval = dc.interval * 1000;\n  const ceiling = 60_000;\n  const deadline = Date.now() + dc.expires_in * 1000;\n\n  for (;;) {\n    if (Date.now() > deadline) {\n      throw new DeviceFlowError(\"expired\", \"authorization request expired\");\n    }\n    await wait(interval);\n    try {\n      return await exchange(opts, dc.device_code);\n    } catch (err) {\n      if (!(err instanceof DeviceFlowError)) throw err;\n      if (err.kind === \"pending\") continue;\n      if (err.kind === \"slow_down\") {\n        interval = Math.min(interval * 2, ceiling);\n        continue;\n      }\n      throw err;\n    }\n  }\n}\n\n/**\n * `POST /api/auth/cli/refresh` — rotate access and refresh tokens.\n * 401 means the refresh token has been revoked server-side (admin\n * disable / off-boarding); the caller should clear local state.\n */\nexport async function refresh(\n  opts: DeviceFlowOptions,\n  refreshToken: string,\n): Promise<RefreshResult> {\n  const res = await rawPost(opts, \"/api/auth/cli/refresh\", { refresh_token: refreshToken });\n  if (res.status === 401) {\n    throw new DeviceFlowError(\"unauthorized\", \"session revoked — re-authenticate\");\n  }\n  if (!res.ok) {\n    const body = await res.text().catch(() => \"\");\n    throw new DeviceFlowError(\"other\", `refresh failed (${res.status}): ${body.slice(0, 256)}`);\n  }\n  return (await res.json()) as RefreshResult;\n}\n\n/**\n * `POST /api/auth/cli/logout` — server-side revoke a refresh token\n * AND its paired access token (per `e7a042c69`: a stolen access\n * token used to survive logout for up to 1h until expiry; sending\n * both closes the gap). Idempotent — 200 on already-revoked or\n * unknown tokens.\n */\nexport async function logout(\n  opts: DeviceFlowOptions,\n  refreshToken: string,\n  accessToken?: string,\n): Promise<void> {\n  const body: Record<string, string> = { refresh_token: refreshToken };\n  if (accessToken) body.access_token = accessToken;\n  const res = await rawPost(opts, \"/api/auth/cli/logout\", body);\n  // 401/404 mean \"already gone\" — that's success for logout.\n  if (res.status === 200 || res.status === 401 || res.status === 404) return;\n  const text = await res.text().catch(() => \"\");\n  throw new DeviceFlowError(\"other\", `logout failed (${res.status}): ${text.slice(0, 256)}`);\n}\n\nasync function postJSON<T>(opts: DeviceFlowOptions, path: string, body: unknown): Promise<T> {\n  const res = await rawPost(opts, path, body);\n  if (!res.ok) {\n    const text = await res.text().catch(() => \"\");\n    throw new DeviceFlowError(\"other\", `${path} → ${res.status}: ${text.slice(0, 256)}`);\n  }\n  return (await res.json()) as T;\n}\n\nfunction rawPost(opts: DeviceFlowOptions, path: string, body: unknown): Promise<Response> {\n  const url = opts.baseUrl.replace(/\\/+$/, \"\") + path;\n  const f = opts.fetchImpl ?? fetch;\n  return f(url, {\n    method: \"POST\",\n    headers: {\n      \"Content-Type\": \"application/json\",\n      Accept: \"application/json\",\n      // Origin enforcement on the server requires this for non-browser\n      // clients. The base URL is the same as the control plane, so\n      // mirroring it as Origin satisfies the same-origin gate.\n      Origin: opts.baseUrl.replace(/\\/+$/, \"\"),\n    },\n    body: JSON.stringify(body ?? {}),\n  });\n}\n"],"mappings":";;;;;AAUA,YAAY,QAAQ;AACpB,SAAS,cAAc,YAAY;AA2F5B,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACzC,YAA4B,MAAiF,SAAiB;AAC5H,UAAM,OAAO;AADa;AAE1B,SAAK,OAAO;AAAA,EACd;AACF;AAiBA,eAAsB,gBACpB,MACA,OAA4C,CAAC,GACxB;AACrB,QAAM,OAAgC,CAAC;AACvC,MAAI,KAAK,eAAgB,MAAK,kBAAkB,KAAK;AACrD,QAAM,KAAK,MAAM,SAAqB,MAAM,6BAA6B,IAAI;AAC7E,MAAI,CAAC,GAAG,YAAY,GAAG,YAAY,EAAG,IAAG,WAAW;AACpD,SAAO;AACT;AAYA,SAAS,oBAIP;AACA,MAAIA,YAAW;AACf,MAAI,QAAQ;AACZ,MAAI;AACF,IAAAA,YAAc,YAAS;AAAA,EACzB,SAAQ;AAAA,EAER;AACA,MAAI;AACF,YAAW,YAAS,EAAE;AAAA,EACxB,SAAQ;AAAA,EAGR;AACA,SAAO,EAAE,UAAAA,WAAU,OAAO,UAAU,QAAQ,SAAS;AACvD;AAQA,eAAsB,SACpB,MACA,YACyB;AACzB,QAAM,MAAM,MAAM,QAAQ,MAAM,0BAA0B;AAAA,IACxD,aAAa;AAAA,IACb,aAAa,kBAAkB;AAAA,EACjC,CAAC;AACD,UAAQ,IAAI,QAAQ;AAAA,IAClB,KAAK,KAAK;AACR,YAAM,OAAQ,MAAM,IAAI,KAAK;AAK7B,UAAI,EAAE,UAAU,SAAS,CAAC,KAAK,MAAM;AACnC,eAAO,iBAAE,MAAM,oBAAsB;AAAA,MACvC;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AACH,YAAM,IAAI,gBAAgB,WAAW,uBAAuB;AAAA,IAC9D,KAAK;AACH,YAAM,IAAI,gBAAgB,UAAU,sBAAsB;AAAA,IAC5D,KAAK;AACH,YAAM,IAAI,gBAAgB,WAAW,+BAA+B;AAAA,IACtE,KAAK;AACH,YAAM,IAAI,gBAAgB,aAAa,kBAAkB;AAAA,IAC3D,SAAS;AACP,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,YAAM,IAAI,gBAAgB,SAAS,qBAAqB,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,EAAE;AAAA,IAC7F;AAAA,EACF;AACF;AAOA,eAAsB,cACpB,MACA,IACyB;AACzB,MAAI,WAAW,GAAG,WAAW;AAC7B,QAAM,UAAU;AAChB,QAAM,WAAW,KAAK,IAAI,IAAI,GAAG,aAAa;AAE9C,aAAS;AACP,QAAI,KAAK,IAAI,IAAI,UAAU;AACzB,YAAM,IAAI,gBAAgB,WAAW,+BAA+B;AAAA,IACtE;AACA,UAAM,KAAK,QAAQ;AACnB,QAAI;AACF,aAAO,MAAM,SAAS,MAAM,GAAG,WAAW;AAAA,IAC5C,SAAS,KAAK;AACZ,UAAI,EAAE,eAAe,iBAAkB,OAAM;AAC7C,UAAI,IAAI,SAAS,UAAW;AAC5B,UAAI,IAAI,SAAS,aAAa;AAC5B,mBAAW,KAAK,IAAI,WAAW,GAAG,OAAO;AACzC;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AA6BA,eAAsB,OACpB,MACA,cACA,aACe;AACf,QAAM,OAA+B,EAAE,eAAe,aAAa;AACnE,MAAI,YAAa,MAAK,eAAe;AACrC,QAAM,MAAM,MAAM,QAAQ,MAAM,wBAAwB,IAAI;AAE5D,MAAI,IAAI,WAAW,OAAO,IAAI,WAAW,OAAO,IAAI,WAAW,IAAK;AACpE,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,QAAM,IAAI,gBAAgB,SAAS,kBAAkB,IAAI,MAAM,MAAM,KAAK,MAAM,GAAG,GAAG,CAAC,EAAE;AAC3F;AAEA,eAAe,SAAY,MAAyB,MAAc,MAA2B;AAC3F,QAAM,MAAM,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC1C,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,UAAM,IAAI,gBAAgB,SAAS,GAAG,IAAI,WAAM,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,EAAE;AAAA,EACrF;AACA,SAAQ,MAAM,IAAI,KAAK;AACzB;AAEA,SAAS,QAAQ,MAAyB,MAAc,MAAkC;AAjS1F;AAkSE,QAAM,MAAM,KAAK,QAAQ,QAAQ,QAAQ,EAAE,IAAI;AAC/C,QAAM,KAAI,UAAK,cAAL,YAAkB;AAC5B,SAAO,EAAE,KAAK;AAAA,IACZ,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,QAAQ;AAAA;AAAA;AAAA;AAAA,MAIR,QAAQ,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAAA,IACzC;AAAA,IACA,MAAM,KAAK,UAAU,sBAAQ,CAAC,CAAC;AAAA,EACjC,CAAC;AACH;","names":["hostname"]}

package/dist/chunk-5B7IKUNG.js

@@ -0,0 +1,297 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+var _chunkBRPEG3YQjs = require('./chunk-BRPEG3YQ.js');
+
+// src/cli/utils/governance/surface.ts
+var CLI_SURFACE_HEADER = "X-LangWatch-Surface";
+var CLI_SURFACE_VALUE = "cli";
+
+// src/cli/utils/governance/cli-api.ts
+var GovernanceCliError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "GovernanceCliError";
+  }
+};
+async function getJSON(cfg, path, opts = {}) {
+  var _a, _b, _c;
+  if (!cfg.access_token) {
+    throw new GovernanceCliError(
+      401,
+      "not_logged_in",
+      "Not logged in. Run `langwatch login --device` first."
+    );
+  }
+  const url = cfg.control_plane_url.replace(/\/+$/, "") + path;
+  const f = (_a = opts.fetchImpl) != null ? _a : fetch;
+  const res = await f(url, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${cfg.access_token}`,
+      Accept: "application/json"
+    }
+  });
+  if (res.status === 401) {
+    throw new GovernanceCliError(
+      401,
+      "unauthorized",
+      "Session expired \u2014 run `langwatch login --device` again"
+    );
+  }
+  if (res.status === 402) {
+    const body = await res.json().catch(() => ({}));
+    const description = (_b = body.error_description) != null ? _b : "This feature requires an Enterprise plan";
+    const upgrade = body.upgrade_url ? `
+
+  Upgrade your organization at:
+    ${body.upgrade_url}` : "";
+    throw new GovernanceCliError(
+      402,
+      "payment_required",
+      `${description}${upgrade}`
+    );
+  }
+  if (res.status === 404) {
+    const body = await res.json().catch(() => ({}));
+    throw new GovernanceCliError(
+      404,
+      "not_found",
+      (_c = body.error_description) != null ? _c : "Not found"
+    );
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new GovernanceCliError(
+      res.status,
+      "other",
+      `${res.status} ${body.slice(0, 200)}`
+    );
+  }
+  return await res.json();
+}
+async function listIngestionSources(cfg, options = {}) {
+  const qs = options.includeArchived ? "?include_archived=1" : "";
+  const body = await getJSON(
+    cfg,
+    `/api/auth/cli/governance/ingest/sources${qs}`,
+    options
+  );
+  return body.sources;
+}
+async function getEventsForSource(cfg, sourceId, options = {}) {
+  const params = new URLSearchParams();
+  if (options.limit) params.set("limit", String(options.limit));
+  if (options.beforeIso) params.set("before_iso", options.beforeIso);
+  const qs = params.toString() ? `?${params.toString()}` : "";
+  const body = await getJSON(
+    cfg,
+    `/api/auth/cli/governance/ingest/sources/${encodeURIComponent(
+      sourceId
+    )}/events${qs}`,
+    options
+  );
+  return body.events;
+}
+async function getSourceHealth(cfg, sourceId, options = {}) {
+  return getJSON(
+    cfg,
+    `/api/auth/cli/governance/ingest/sources/${encodeURIComponent(
+      sourceId
+    )}/health`,
+    options
+  );
+}
+async function getGovernanceStatus(cfg, options = {}) {
+  return getJSON(cfg, `/api/auth/cli/governance/status`, options);
+}
+async function getCliBootstrap(cfg, options = {}) {
+  try {
+    return await getJSON(
+      cfg,
+      `/api/auth/cli/bootstrap`,
+      options
+    );
+  } catch (err) {
+    if (err instanceof GovernanceCliError && err.status === 404) {
+      return null;
+    }
+    throw err;
+  }
+}
+async function requestREST(cfg, method, path, options = {}) {
+  var _a, _b, _c, _d, _e, _f, _g;
+  if (!cfg.access_token) {
+    throw new GovernanceCliError(
+      401,
+      "not_logged_in",
+      "Not logged in. Run `langwatch login --device` first."
+    );
+  }
+  const url = cfg.control_plane_url.replace(/\/+$/, "") + path;
+  const f = (_a = options.fetchImpl) != null ? _a : fetch;
+  const headers = {
+    Authorization: `Bearer ${cfg.access_token}`,
+    Accept: "application/json"
+  };
+  if (options.mutating) {
+    headers[CLI_SURFACE_HEADER] = CLI_SURFACE_VALUE;
+  }
+  if (options.body !== void 0) {
+    headers["Content-Type"] = "application/json";
+  }
+  const res = await f(url, {
+    method,
+    headers,
+    body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+  });
+  if (res.status === 204) return void 0;
+  if (res.status === 401) {
+    throw new GovernanceCliError(
+      401,
+      "unauthorized",
+      "Session expired \u2014 run `langwatch login --device` again"
+    );
+  }
+  if (res.status === 403) {
+    const body = await res.json().catch(() => ({}));
+    throw new GovernanceCliError(
+      403,
+      (_c = (_b = body.error) == null ? void 0 : _b.code) != null ? _c : "forbidden",
+      (_e = (_d = body.error) == null ? void 0 : _d.message) != null ? _e : "Forbidden"
+    );
+  }
+  if (res.status === 404) {
+    const body = await res.json().catch(() => ({}));
+    throw new GovernanceCliError(
+      404,
+      "not_found",
+      (_g = (_f = body.error) == null ? void 0 : _f.message) != null ? _g : "Not found"
+    );
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new GovernanceCliError(
+      res.status,
+      "other",
+      `${res.status} ${body.slice(0, 200)}`
+    );
+  }
+  return await res.json();
+}
+async function listIngestionTemplates(cfg, options = {}) {
+  const body = await requestREST(
+    cfg,
+    "GET",
+    "/api/governance/ingestion-templates",
+    options
+  );
+  return body.ingestion_templates;
+}
+async function adminListIngestionTemplates(cfg, options = {}) {
+  const body = await requestREST(
+    cfg,
+    "GET",
+    "/api/governance/ingestion-templates/admin",
+    options
+  );
+  return body.ingestion_templates;
+}
+async function getIngestionTemplate(cfg, id, options = {}) {
+  const body = await requestREST(
+    cfg,
+    "GET",
+    `/api/governance/ingestion-templates/${encodeURIComponent(id)}`,
+    options
+  );
+  return body.ingestion_template;
+}
+async function createIngestionTemplate(cfg, input, options = {}) {
+  const body = await requestREST(
+    cfg,
+    "POST",
+    "/api/governance/ingestion-templates",
+    _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, options), { body: input, mutating: true })
+  );
+  return body.ingestion_template;
+}
+async function updateIngestionTemplateOttlRules(cfg, id, ottlRules, options = {}) {
+  const body = await requestREST(
+    cfg,
+    "PATCH",
+    `/api/governance/ingestion-templates/${encodeURIComponent(id)}/ottl-rules`,
+    _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, options), { body: { ottl_rules: ottlRules }, mutating: true })
+  );
+  return body.ingestion_template;
+}
+async function archiveIngestionTemplate(cfg, id, options = {}) {
+  return requestREST(
+    cfg,
+    "DELETE",
+    `/api/governance/ingestion-templates/${encodeURIComponent(id)}`,
+    _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, options), { mutating: true })
+  );
+}
+async function cloneIngestionTemplateFromPlatform(cfg, sourceTemplateId, options = {}) {
+  const body = await requestREST(
+    cfg,
+    "POST",
+    "/api/governance/ingestion-templates/clone-from-platform",
+    _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, options), {
+      body: { source_template_id: sourceTemplateId },
+      mutating: true
+    })
+  );
+  return body.ingestion_template;
+}
+async function listUserIngestionBindings(cfg, options = {}) {
+  const body = await requestREST(cfg, "GET", "/api/governance/user-ingestion-bindings", options);
+  return body.user_ingestion_bindings;
+}
+async function installUserIngestionBinding(cfg, templateId, options = {}) {
+  return requestREST(
+    cfg,
+    "POST",
+    "/api/governance/user-ingestion-bindings",
+    _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, options), { body: { template_id: templateId }, mutating: true })
+  );
+}
+async function uninstallUserIngestionBinding(cfg, bindingId, options = {}) {
+  return requestREST(
+    cfg,
+    "DELETE",
+    `/api/governance/user-ingestion-bindings/${encodeURIComponent(bindingId)}`,
+    _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, options), { mutating: true })
+  );
+}
+async function rotateUserIngestionBindingToken(cfg, bindingId, options = {}) {
+  return requestREST(
+    cfg,
+    "POST",
+    `/api/governance/user-ingestion-bindings/${encodeURIComponent(bindingId)}/rotate`,
+    _chunkBRPEG3YQjs.__spreadProps.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, options), { mutating: true })
+  );
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.GovernanceCliError = GovernanceCliError; exports.listIngestionSources = listIngestionSources; exports.getEventsForSource = getEventsForSource; exports.getSourceHealth = getSourceHealth; exports.getGovernanceStatus = getGovernanceStatus; exports.getCliBootstrap = getCliBootstrap; exports.listIngestionTemplates = listIngestionTemplates; exports.adminListIngestionTemplates = adminListIngestionTemplates; exports.getIngestionTemplate = getIngestionTemplate; exports.createIngestionTemplate = createIngestionTemplate; exports.updateIngestionTemplateOttlRules = updateIngestionTemplateOttlRules; exports.archiveIngestionTemplate = archiveIngestionTemplate; exports.cloneIngestionTemplateFromPlatform = cloneIngestionTemplateFromPlatform; exports.listUserIngestionBindings = listUserIngestionBindings; exports.installUserIngestionBinding = installUserIngestionBinding; exports.uninstallUserIngestionBinding = uninstallUserIngestionBinding; exports.rotateUserIngestionBindingToken = rotateUserIngestionBindingToken;
+//# sourceMappingURL=chunk-5B7IKUNG.js.map

package/dist/chunk-5B7IKUNG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/langwatch/langwatch/typescript-sdk/dist/chunk-5B7IKUNG.js","../src/cli/utils/governance/surface.ts","../src/cli/utils/governance/cli-api.ts"],"names":[],"mappings":"AAAA;AACE;AACA;AACF,sDAA4B;AAC5B;AACA;ACOO,IAAM,mBAAA,EAAqB,qBAAA;AAC3B,IAAM,kBAAA,EAA2C,KAAA;ADLxD;AACA;AEsDO,IAAM,mBAAA,EAAN,MAAA,QAAiC,MAAM;AAAA,EAC5C,WAAA,CACkB,MAAA,EACA,IAAA,EAChB,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAJG,IAAA,IAAA,CAAA,OAAA,EAAA,MAAA;AACA,IAAA,IAAA,CAAA,KAAA,EAAA,IAAA;AAIhB,IAAA,IAAA,CAAK,KAAA,EAAO,oBAAA;AAAA,EACd;AACF,CAAA;AAMA,MAAA,SAAe,OAAA,CACb,GAAA,EACA,IAAA,EACA,KAAA,EAAsB,CAAC,CAAA,EACX;AAlFd,EAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AAmFE,EAAA,GAAA,CAAI,CAAC,GAAA,CAAI,YAAA,EAAc;AACrB,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,GAAA;AAAA,MACA,eAAA;AAAA,MACA;AAAA,IACF,CAAA;AAAA,EACF;AACA,EAAA,MAAM,IAAA,EAAM,GAAA,CAAI,iBAAA,CAAkB,OAAA,CAAQ,MAAA,EAAQ,EAAE,EAAA,EAAI,IAAA;AACxD,EAAA,MAAM,EAAA,EAAA,CAAI,GAAA,EAAA,IAAA,CAAK,SAAA,EAAA,GAAL,KAAA,EAAA,GAAA,EAAkB,KAAA;AAC5B,EAAA,MAAM,IAAA,EAAM,MAAM,CAAA,CAAE,GAAA,EAAK;AAAA,IACvB,MAAA,EAAQ,KAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,CAAA,OAAA,EAAU,GAAA,CAAI,YAAY,CAAA,CAAA;AACjC,MAAA;AACV,IAAA;AACD,EAAA;AACuB,EAAA;AACZ,IAAA;AACR,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AACwB,EAAA;AACuB,IAAA;AAKtC,IAAA;AAEH,IAAA;AAAA;AAAA;AACA,IAAA;AACM,IAAA;AACR,MAAA;AACA,MAAA;AACwB,MAAA;AAC1B,IAAA;AACF,EAAA;AACwB,EAAA;AACuB,IAAA;AAGnC,IAAA;AACR,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AACa,EAAA;AACiC,IAAA;AAClC,IAAA;AACJ,MAAA;AACJ,MAAA;AACmC,MAAA;AACrC,IAAA;AACF,EAAA;AACuB,EAAA;AACzB;AAIE;AAEqC,EAAA;AAClB,EAAA;AACjB,IAAA;AAC4C,IAAA;AAC5C,IAAA;AACF,EAAA;AACY,EAAA;AACd;AAIE;AAGmC,EAAA;AACW,EAAA;AACZ,EAAA;AACQ,EAAA;AACvB,EAAA;AACjB,IAAA;AAC2C,IAAA;AACzC,MAAA;AACW,IAAA;AACb,IAAA;AACF,EAAA;AACY,EAAA;AACd;AAKE;AAKO,EAAA;AACL,IAAA;AAC2C,IAAA;AACzC,MAAA;AACD,IAAA;AACD,IAAA;AACF,EAAA;AACF;AAIE;AAEoB,EAAA;AACtB;AAiD4B;AAEtB,EAAA;AACW,IAAA;AACX,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACY,EAAA;AAC6B,IAAA;AAChC,MAAA;AACT,IAAA;AACM,IAAA;AACR,EAAA;AACF;AAuCE;AA3SF,EAAA;AA6SyB,EAAA;AACX,IAAA;AACR,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAC0C,EAAA;AAChC,EAAA;AAC8B,EAAA;AACG,IAAA;AACjC,IAAA;AACV,EAAA;AACsB,EAAA;AACU,IAAA;AAChC,EAAA;AACgC,EAAA;AACJ,IAAA;AAC5B,EAAA;AACyB,EAAA;AACvB,IAAA;AACA,IAAA;AACwC,IAAA;AACzC,EAAA;AAC8B,EAAA;AACP,EAAA;AACZ,IAAA;AACR,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AACwB,EAAA;AACuB,IAAA;AAGnC,IAAA;AACR,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AACwB,EAAA;AACuB,IAAA;AAGnC,IAAA;AACR,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AACa,EAAA;AACiC,IAAA;AAClC,IAAA;AACJ,MAAA;AACJ,MAAA;AACmC,MAAA;AACrC,IAAA;AACF,EAAA;AACuB,EAAA;AACzB;AAME;AAEmB,EAAA;AACjB,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACY,EAAA;AACd;AAIE;AAEmB,EAAA;AACjB,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACY,EAAA;AACd;AAKE;AAEmB,EAAA;AACjB,IAAA;AACA,IAAA;AACuC,IAAA;AACvC,IAAA;AACF,EAAA;AACY,EAAA;AACd;AAIE;AAUmB,EAAA;AACjB,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACY,EAAA;AACd;AAGE;AAKmB,EAAA;AACjB,IAAA;AACA,IAAA;AACuC,IAAA;AACvC,IAAA;AACF,EAAA;AACY,EAAA;AACd;AAIE;AAGO,EAAA;AACL,IAAA;AACA,IAAA;AACuC,IAAA;AACvC,IAAA;AACF,EAAA;AACF;AAEsB;AAKD,EAAA;AACjB,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AAE8B,MAAA;AAClB,MAAA;AACZ,IAAA;AACF,EAAA;AACY,EAAA;AACd;AAME;AAIe,EAAA;AACH,EAAA;AACd;AAIE;AAMO,EAAA;AACL,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACF,EAAA;AACF;AAGE;AAIO,EAAA;AACL,IAAA;AACA,IAAA;AAC2C,IAAA;AAC3C,IAAA;AACF,EAAA;AACF;AAGE;AAOO,EAAA;AACL,IAAA;AACA,IAAA;AAC2C,IAAA;AAC3C,IAAA;AACF,EAAA;AACF;AF5PgD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/work/langwatch/langwatch/typescript-sdk/dist/chunk-5B7IKUNG.js","sourcesContent":[null,"/**\n * Mirror of `GovernanceCallSurface` from the langwatch app\n * (ee/governance/services/auditSurface.ts). Kept as a hand-written\n * type alias rather than imported because the CLI package doesn't\n * pull from the langwatch source tree.\n *\n * The CLI only ever sends \"cli\" — the other values are documented\n * here so the type stays informational + so any future SDK regen\n * targeting governance audit metadata picks up the canonical set.\n */\nexport type GovernanceCallSurface = \"trpc\" | \"hono\" | \"cli\" | \"mcp\";\n\nexport const CLI_SURFACE_HEADER = \"X-LangWatch-Surface\" as const;\nexport const CLI_SURFACE_VALUE: GovernanceCallSurface = \"cli\";\n","/**\n * Thin REST client for governance endpoints used by the\n * `langwatch governance ...` CLI namespace.\n *\n * Two transports live in this file:\n *\n *   1. `/api/auth/cli/governance/*` — CLI-specific read proxies for\n *      activity monitor + status that pre-date the public REST\n *      surface. Read-only.\n *   2. `/api/governance/*` — the public REST contract Sergey shipped\n *      at 0bb951160 / 5275e7e11. Full CRUD on IngestionTemplate +\n *      UserIngestionBinding. The CLI sends\n *      `X-LangWatch-Surface: cli` so audit rows land with\n *      `metadata.surface = 'cli'` per @audit-uniform.\n */\n\nimport { type GovernanceConfig } from \"./config\";\nimport {\n  CLI_SURFACE_HEADER,\n  CLI_SURFACE_VALUE,\n} from \"./surface\";\n\nexport interface IngestionSourceSummary {\n  id: string;\n  name: string;\n  sourceType: string;\n  description: string | null;\n  status: string;\n  lastEventAt: string | null;\n  createdAt: string;\n  archivedAt: string | null;\n}\n\nexport interface ActivityEventDetailRow {\n  eventId: string;\n  eventType: string;\n  actor: string;\n  action: string;\n  target: string;\n  costUsd: number;\n  tokensInput: number;\n  tokensOutput: number;\n  eventTimestampIso: string;\n  ingestedAtIso: string;\n  rawPayload: string;\n}\n\nexport interface SourceHealthMetrics {\n  events24h: number;\n  events7d: number;\n  events30d: number;\n  lastSuccessIso: string | null;\n}\n\nexport interface GovernanceSetupState {\n  hasPersonalVKs: boolean;\n  hasRoutingPolicies: boolean;\n  hasIngestionSources: boolean;\n  hasAnomalyRules: boolean;\n  hasRecentActivity: boolean;\n  governanceActive: boolean;\n}\n\nexport class GovernanceCliError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: string,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"GovernanceCliError\";\n  }\n}\n\nexport interface CliApiOptions {\n  fetchImpl?: typeof fetch;\n}\n\nasync function getJSON<T>(\n  cfg: GovernanceConfig,\n  path: string,\n  opts: CliApiOptions = {},\n): Promise<T> {\n  if (!cfg.access_token) {\n    throw new GovernanceCliError(\n      401,\n      \"not_logged_in\",\n      \"Not logged in. Run `langwatch login --device` first.\",\n    );\n  }\n  const url = cfg.control_plane_url.replace(/\\/+$/, \"\") + path;\n  const f = opts.fetchImpl ?? fetch;\n  const res = await f(url, {\n    method: \"GET\",\n    headers: {\n      Authorization: `Bearer ${cfg.access_token}`,\n      Accept: \"application/json\",\n    },\n  });\n  if (res.status === 401) {\n    throw new GovernanceCliError(\n      401,\n      \"unauthorized\",\n      \"Session expired — run `langwatch login --device` again\",\n    );\n  }\n  if (res.status === 402) {\n    const body = (await res.json().catch(() => ({}))) as {\n      error_description?: string;\n      upgrade_url?: string;\n    };\n    const description =\n      body.error_description ?? \"This feature requires an Enterprise plan\";\n    const upgrade = body.upgrade_url\n      ? `\\n\\n  Upgrade your organization at:\\n    ${body.upgrade_url}`\n      : \"\";\n    throw new GovernanceCliError(\n      402,\n      \"payment_required\",\n      `${description}${upgrade}`,\n    );\n  }\n  if (res.status === 404) {\n    const body = (await res.json().catch(() => ({}))) as {\n      error_description?: string;\n    };\n    throw new GovernanceCliError(\n      404,\n      \"not_found\",\n      body.error_description ?? \"Not found\",\n    );\n  }\n  if (!res.ok) {\n    const body = await res.text().catch(() => \"\");\n    throw new GovernanceCliError(\n      res.status,\n      \"other\",\n      `${res.status} ${body.slice(0, 200)}`,\n    );\n  }\n  return (await res.json()) as T;\n}\n\nexport async function listIngestionSources(\n  cfg: GovernanceConfig,\n  options: { includeArchived?: boolean } & CliApiOptions = {},\n): Promise<IngestionSourceSummary[]> {\n  const qs = options.includeArchived ? \"?include_archived=1\" : \"\";\n  const body = await getJSON<{ sources: IngestionSourceSummary[] }>(\n    cfg,\n    `/api/auth/cli/governance/ingest/sources${qs}`,\n    options,\n  );\n  return body.sources;\n}\n\nexport async function getEventsForSource(\n  cfg: GovernanceConfig,\n  sourceId: string,\n  options: { limit?: number; beforeIso?: string } & CliApiOptions = {},\n): Promise<ActivityEventDetailRow[]> {\n  const params = new URLSearchParams();\n  if (options.limit) params.set(\"limit\", String(options.limit));\n  if (options.beforeIso) params.set(\"before_iso\", options.beforeIso);\n  const qs = params.toString() ? `?${params.toString()}` : \"\";\n  const body = await getJSON<{ events: ActivityEventDetailRow[] }>(\n    cfg,\n    `/api/auth/cli/governance/ingest/sources/${encodeURIComponent(\n      sourceId,\n    )}/events${qs}`,\n    options,\n  );\n  return body.events;\n}\n\nexport async function getSourceHealth(\n  cfg: GovernanceConfig,\n  sourceId: string,\n  options: CliApiOptions = {},\n): Promise<{\n  source: { id: string; name: string; status: string };\n  health: SourceHealthMetrics;\n}> {\n  return getJSON(\n    cfg,\n    `/api/auth/cli/governance/ingest/sources/${encodeURIComponent(\n      sourceId,\n    )}/health`,\n    options,\n  );\n}\n\nexport async function getGovernanceStatus(\n  cfg: GovernanceConfig,\n  options: CliApiOptions = {},\n): Promise<{ setup: GovernanceSetupState }> {\n  return getJSON(cfg, `/api/auth/cli/governance/status`, options);\n}\n\nexport interface CliBootstrapProvider {\n  name: string;\n  displayName: string;\n  models: string[];\n}\n\nexport interface CliBootstrapBudget {\n  monthlyLimitUsd: number | null;\n  monthlyUsedUsd: number;\n  period: string;\n}\n\nexport interface CliBootstrapResponse {\n  providers: CliBootstrapProvider[];\n  budget: CliBootstrapBudget;\n  /**\n   * Server-authoritative gateway base URL. Sourced from the backend's\n   * `LW_GATEWAY_BASE_URL` (or its self-hosted/SaaS-aware fallback).\n   * Older self-hosted servers without this field fall back to the\n   * CLI's local config default — so undefined is the legacy shape, not\n   * an error.\n   */\n  gatewayUrl?: string;\n  /**\n   * First org admin's email (by createdAt). Rendered as a mailto in\n   * wrapper preflight failure messages so non-admin users get a real\n   * contact path instead of a vague \"ask your admin\". `null` when the\n   * org has no admin yet; `undefined` on legacy servers without the\n   * field (CLI falls back to a generic line).\n   */\n  adminEmail?: string | null;\n}\n\n/**\n * Fetch the Storyboard Screen 4 ceremony enrichment data —\n * inheritable providers + the user's effective monthly budget.\n *\n * Backend tRPC source: `api.user.cliBootstrap` (Sergey 32cad11ae).\n * REST adapter: `/api/auth/cli/bootstrap` (queued backend follow-up).\n *\n * Graceful degrade: returns null on 404 (older self-hosted server\n * without the REST endpoint) so the CLI ceremony falls back to the\n * basic header + try-it block. Other errors still throw so they can\n * be logged at the call site.\n */\nexport async function getCliBootstrap(\n  cfg: GovernanceConfig,\n  options: CliApiOptions = {},\n): Promise<CliBootstrapResponse | null> {\n  try {\n    return await getJSON<CliBootstrapResponse>(\n      cfg,\n      `/api/auth/cli/bootstrap`,\n      options,\n    );\n  } catch (err) {\n    if (err instanceof GovernanceCliError && err.status === 404) {\n      return null;\n    }\n    throw err;\n  }\n}\n\n// ── Public REST: /api/governance/* ─────────────────────────────────────────\n//\n// Sergey's Hono routes at 0bb951160 (templates) + 5275e7e11 (bindings).\n// Wire shape locked at 1839d9f54 + 60f769498 (snake_case in/out).\n// All mutating calls send X-LangWatch-Surface: cli per @audit-uniform.\n\nexport interface IngestionTemplateRow {\n  id: string;\n  organization_id: string | null;\n  slug: string;\n  source_type: string;\n  display_name: string;\n  description: string | null;\n  icon_asset: string | null;\n  credential_schema: string | null;\n  ottl_rules: string;\n  platform_published: boolean;\n  enabled: boolean;\n}\n\nexport interface UserIngestionBindingRow {\n  id: string;\n  template_id: string;\n  user_id: string;\n  organization_id: string;\n  personal_project_id: string;\n  binding_access_token_prefix: string;\n  enabled: boolean;\n  created_at: string;\n}\n\ntype RestMethod = \"GET\" | \"POST\" | \"PATCH\" | \"DELETE\";\n\nasync function requestREST<T>(\n  cfg: GovernanceConfig,\n  method: RestMethod,\n  path: string,\n  options: { body?: unknown; mutating?: boolean } & CliApiOptions = {},\n): Promise<T> {\n  if (!cfg.access_token) {\n    throw new GovernanceCliError(\n      401,\n      \"not_logged_in\",\n      \"Not logged in. Run `langwatch login --device` first.\",\n    );\n  }\n  const url = cfg.control_plane_url.replace(/\\/+$/, \"\") + path;\n  const f = options.fetchImpl ?? fetch;\n  const headers: Record<string, string> = {\n    Authorization: `Bearer ${cfg.access_token}`,\n    Accept: \"application/json\",\n  };\n  if (options.mutating) {\n    headers[CLI_SURFACE_HEADER] = CLI_SURFACE_VALUE;\n  }\n  if (options.body !== undefined) {\n    headers[\"Content-Type\"] = \"application/json\";\n  }\n  const res = await f(url, {\n    method,\n    headers,\n    body: options.body !== undefined ? JSON.stringify(options.body) : undefined,\n  });\n  if (res.status === 204) return undefined as T;\n  if (res.status === 401) {\n    throw new GovernanceCliError(\n      401,\n      \"unauthorized\",\n      \"Session expired — run `langwatch login --device` again\",\n    );\n  }\n  if (res.status === 403) {\n    const body = (await res.json().catch(() => ({}))) as {\n      error?: { message?: string; code?: string };\n    };\n    throw new GovernanceCliError(\n      403,\n      body.error?.code ?? \"forbidden\",\n      body.error?.message ?? \"Forbidden\",\n    );\n  }\n  if (res.status === 404) {\n    const body = (await res.json().catch(() => ({}))) as {\n      error?: { message?: string };\n    };\n    throw new GovernanceCliError(\n      404,\n      \"not_found\",\n      body.error?.message ?? \"Not found\",\n    );\n  }\n  if (!res.ok) {\n    const body = await res.text().catch(() => \"\");\n    throw new GovernanceCliError(\n      res.status,\n      \"other\",\n      `${res.status} ${body.slice(0, 200)}`,\n    );\n  }\n  return (await res.json()) as T;\n}\n\n// IngestionTemplate verbs ----------------------------------------------------\n\nexport async function listIngestionTemplates(\n  cfg: GovernanceConfig,\n  options: CliApiOptions = {},\n): Promise<IngestionTemplateRow[]> {\n  const body = await requestREST<{ ingestion_templates: IngestionTemplateRow[] }>(\n    cfg,\n    \"GET\",\n    \"/api/governance/ingestion-templates\",\n    options,\n  );\n  return body.ingestion_templates;\n}\n\nexport async function adminListIngestionTemplates(\n  cfg: GovernanceConfig,\n  options: CliApiOptions = {},\n): Promise<IngestionTemplateRow[]> {\n  const body = await requestREST<{ ingestion_templates: IngestionTemplateRow[] }>(\n    cfg,\n    \"GET\",\n    \"/api/governance/ingestion-templates/admin\",\n    options,\n  );\n  return body.ingestion_templates;\n}\n\nexport async function getIngestionTemplate(\n  cfg: GovernanceConfig,\n  id: string,\n  options: CliApiOptions = {},\n): Promise<IngestionTemplateRow> {\n  const body = await requestREST<{ ingestion_template: IngestionTemplateRow }>(\n    cfg,\n    \"GET\",\n    `/api/governance/ingestion-templates/${encodeURIComponent(id)}`,\n    options,\n  );\n  return body.ingestion_template;\n}\n\nexport async function createIngestionTemplate(\n  cfg: GovernanceConfig,\n  input: {\n    source_type: string;\n    display_name: string;\n    description?: string;\n    icon_asset?: string;\n    credential_schema?: \"otlp_token\" | \"static_api_key\" | \"agent_id\" | null;\n    ottl_rules?: string;\n  },\n  options: CliApiOptions = {},\n): Promise<IngestionTemplateRow> {\n  const body = await requestREST<{ ingestion_template: IngestionTemplateRow }>(\n    cfg,\n    \"POST\",\n    \"/api/governance/ingestion-templates\",\n    { ...options, body: input, mutating: true },\n  );\n  return body.ingestion_template;\n}\n\nexport async function updateIngestionTemplateOttlRules(\n  cfg: GovernanceConfig,\n  id: string,\n  ottlRules: string,\n  options: CliApiOptions = {},\n): Promise<IngestionTemplateRow> {\n  const body = await requestREST<{ ingestion_template: IngestionTemplateRow }>(\n    cfg,\n    \"PATCH\",\n    `/api/governance/ingestion-templates/${encodeURIComponent(id)}/ottl-rules`,\n    { ...options, body: { ottl_rules: ottlRules }, mutating: true },\n  );\n  return body.ingestion_template;\n}\n\nexport async function archiveIngestionTemplate(\n  cfg: GovernanceConfig,\n  id: string,\n  options: CliApiOptions = {},\n): Promise<{ ok: true }> {\n  return requestREST<{ ok: true }>(\n    cfg,\n    \"DELETE\",\n    `/api/governance/ingestion-templates/${encodeURIComponent(id)}`,\n    { ...options, mutating: true },\n  );\n}\n\nexport async function cloneIngestionTemplateFromPlatform(\n  cfg: GovernanceConfig,\n  sourceTemplateId: string,\n  options: CliApiOptions = {},\n): Promise<IngestionTemplateRow> {\n  const body = await requestREST<{ ingestion_template: IngestionTemplateRow }>(\n    cfg,\n    \"POST\",\n    \"/api/governance/ingestion-templates/clone-from-platform\",\n    {\n      ...options,\n      body: { source_template_id: sourceTemplateId },\n      mutating: true,\n    },\n  );\n  return body.ingestion_template;\n}\n\n// UserIngestionBinding verbs ------------------------------------------------\n\nexport async function listUserIngestionBindings(\n  cfg: GovernanceConfig,\n  options: CliApiOptions = {},\n): Promise<UserIngestionBindingRow[]> {\n  const body = await requestREST<{\n    user_ingestion_bindings: UserIngestionBindingRow[];\n  }>(cfg, \"GET\", \"/api/governance/user-ingestion-bindings\", options);\n  return body.user_ingestion_bindings;\n}\n\nexport async function installUserIngestionBinding(\n  cfg: GovernanceConfig,\n  templateId: string,\n  options: CliApiOptions = {},\n): Promise<{\n  user_ingestion_binding: UserIngestionBindingRow;\n  binding_access_token: string;\n}> {\n  return requestREST(\n    cfg,\n    \"POST\",\n    \"/api/governance/user-ingestion-bindings\",\n    { ...options, body: { template_id: templateId }, mutating: true },\n  );\n}\n\nexport async function uninstallUserIngestionBinding(\n  cfg: GovernanceConfig,\n  bindingId: string,\n  options: CliApiOptions = {},\n): Promise<{ ok: true }> {\n  return requestREST<{ ok: true }>(\n    cfg,\n    \"DELETE\",\n    `/api/governance/user-ingestion-bindings/${encodeURIComponent(bindingId)}`,\n    { ...options, mutating: true },\n  );\n}\n\nexport async function rotateUserIngestionBindingToken(\n  cfg: GovernanceConfig,\n  bindingId: string,\n  options: CliApiOptions = {},\n): Promise<{\n  user_ingestion_binding: UserIngestionBindingRow;\n  binding_access_token: string;\n}> {\n  return requestREST(\n    cfg,\n    \"POST\",\n    `/api/governance/user-ingestion-bindings/${encodeURIComponent(bindingId)}/rotate`,\n    { ...options, mutating: true },\n  );\n}\n"]}

package/dist/chunk-6HB4LUF2.js

@@ -0,0 +1,42 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunk2I6DFG3Tjs = require('./chunk-2I6DFG3T.js');
+
+
+
+var _chunkC5Y772G7js = require('./chunk-C5Y772G7.js');
+
+// src/client-sdk/services/analytics/analytics-api.service.ts
+var AnalyticsApiError = class extends Error {
+  constructor(message, operation, originalError) {
+    super(message);
+    this.operation = operation;
+    this.originalError = originalError;
+    this.name = "AnalyticsApiError";
+  }
+};
+var AnalyticsApiService = class {
+  constructor(config) {
+    var _a;
+    this.apiClient = (_a = config == null ? void 0 : config.langwatchApiClient) != null ? _a : _chunk2I6DFG3Tjs.createLangWatchApiClient.call(void 0, );
+  }
+  handleApiError(operation, error) {
+    const message = _chunkC5Y772G7js.formatApiErrorForOperation.call(void 0, { operation, error, options: {
+      status: _chunkC5Y772G7js.extractStatusFromResponse.call(void 0, error)
+    } });
+    throw new AnalyticsApiError(message, operation, error);
+  }
+  async timeseries(params) {
+    const { data, error } = await this.apiClient.POST(
+      "/api/analytics/timeseries",
+      { body: params }
+    );
+    if (error) this.handleApiError("query analytics", error);
+    return data;
+  }
+};
+
+
+
+exports.AnalyticsApiService = AnalyticsApiService;
+//# sourceMappingURL=chunk-6HB4LUF2.js.map

package/dist/chunk-6HB4LUF2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/langwatch/langwatch/typescript-sdk/dist/chunk-6HB4LUF2.js","../src/client-sdk/services/analytics/analytics-api.service.ts"],"names":[],"mappings":"AAAA;AACE;AACF,sDAA4B;AAC5B;AACE;AACA;AACF,sDAA4B;AAC5B;AACA;ACUO,IAAM,kBAAA,EAAN,MAAA,QAAgC,MAAM;AAAA,EAC3C,WAAA,CACE,OAAA,EACgB,SAAA,EACA,aAAA,EAChB;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAHG,IAAA,IAAA,CAAA,UAAA,EAAA,SAAA;AACA,IAAA,IAAA,CAAA,cAAA,EAAA,aAAA;AAGhB,IAAA,IAAA,CAAK,KAAA,EAAO,mBAAA;AAAA,EACd;AACF,CAAA;AAEO,IAAM,oBAAA,EAAN,MAA0B;AAAA,EAG/B,WAAA,CAAY,MAAA,EAAqD;AAhCnE,IAAA,IAAA,EAAA;AAiCI,IAAA,IAAA,CAAK,UAAA,EAAA,CAAY,GAAA,EAAA,OAAA,GAAA,KAAA,EAAA,KAAA,EAAA,EAAA,MAAA,CAAQ,kBAAA,EAAA,GAAR,KAAA,EAAA,GAAA,EAA8B,uDAAA,CAAyB;AAAA,EAC1E;AAAA,EAEQ,cAAA,CAAe,SAAA,EAAmB,KAAA,EAAuB;AAC/D,IAAA,MAAM,QAAA,EAAU,yDAAA,EAA6B,SAAA,EAAsB,KAAA,EAAc,OAAA,EAAS;AAAA,MACxF,MAAA,EAAQ,wDAAA,KAA+B;AAAA,IACzC,EAAE,CAAC,CAAA;AACH,IAAA,MAAM,IAAI,iBAAA,CAAkB,OAAA,EAAS,SAAA,EAAW,KAAK,CAAA;AAAA,EACvD;AAAA,EAEA,MAAM,UAAA,CAAW,MAAA,EAAuE;AACtF,IAAA,MAAM,EAAE,IAAA,EAAM,MAAM,EAAA,EAAI,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA;AAAA,MAC3C,2BAAA;AAAA,MACA,EAAE,IAAA,EAAM,OAAO;AAAA,IACjB,CAAA;AACA,IAAA,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,cAAA,CAAe,iBAAA,EAAmB,KAAK,CAAA;AACvD,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;ADdA;AACA;AACE;AACF,kDAAC","file":"/home/runner/work/langwatch/langwatch/typescript-sdk/dist/chunk-6HB4LUF2.js","sourcesContent":[null,"import type { paths } from \"@/internal/generated/openapi/api-client\";\nimport {\n  createLangWatchApiClient,\n  type LangwatchApiClient,\n} from \"@/internal/api/client\";\nimport { type InternalConfig } from \"@/client-sdk/types\";\nimport {\n  extractStatusFromResponse,\n  formatApiErrorForOperation,\n} from \"@/client-sdk/services/_shared/format-api-error\";\n\nexport type AnalyticsTimeseriesBody = NonNullable<\n  paths[\"/api/analytics/timeseries\"][\"post\"][\"requestBody\"]\n>[\"content\"][\"application/json\"];\n\nexport type AnalyticsTimeseriesResponse =\n  paths[\"/api/analytics/timeseries\"][\"post\"][\"responses\"][\"200\"][\"content\"][\"application/json\"];\n\nexport class AnalyticsApiError extends Error {\n  constructor(\n    message: string,\n    public readonly operation: string,\n    public readonly originalError?: unknown,\n  ) {\n    super(message);\n    this.name = \"AnalyticsApiError\";\n  }\n}\n\nexport class AnalyticsApiService {\n  private readonly apiClient: LangwatchApiClient;\n\n  constructor(config?: Pick<InternalConfig, \"langwatchApiClient\">) {\n    this.apiClient = config?.langwatchApiClient ?? createLangWatchApiClient();\n  }\n\n  private handleApiError(operation: string, error: unknown): never {\n    const message = formatApiErrorForOperation({ operation: operation, error: error, options: {\n      status: extractStatusFromResponse(error),\n    } });\n    throw new AnalyticsApiError(message, operation, error);\n  }\n\n  async timeseries(params: AnalyticsTimeseriesBody): Promise<AnalyticsTimeseriesResponse> {\n    const { data, error } = await this.apiClient.POST(\n      \"/api/analytics/timeseries\",\n      { body: params },\n    );\n    if (error) this.handleApiError(\"query analytics\", error);\n    return data;\n  }\n}\n"]}