spaps 0.8.2__tar.gz → 0.8.3__tar.gz

{spaps-0.8.2 → spaps-0.8.3}/.gitignore

@@ -1,5 +1,5 @@
 # Dependencies
-node_modules/
+node_modules
 *.log
 npm-debug.log*
 yarn-debug.log*
@@ -13,7 +13,7 @@ sweet-potato-threat-model.md
 *.py[cod]
 *.pyo
 *.pyd
-.venv/
+.venv
 *.egg-info/
 
 # Testing

{spaps-0.8.2 → spaps-0.8.3}/CHANGELOG.md

@@ -8,9 +8,30 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 - No changes yet.
 
+## [0.8.3] - 2026-10-24
+
+**Unpublished source candidate.** This date records candidate preparation, not
+registry publication or downstream deployment.
+
+- Prepare the `0.8.3.dev0` checkout as `0.8.3` alongside server `0.9.1`
+  ([54a0059a](https://github.com/build000r/sweet-potato/commit/54a0059aba568f750da284496c4863a0db695cf4)).
+- Include sync/async purchase-journey and developer-portal helpers, scoped
+  dashboard controls, capability decisions, and authenticated CFO action-journey
+  helpers added since the retained public `0.8.2` baseline.
+
+## [0.8.3.dev0] - 2026-10-22
+
+**Unpublished development checkout.**
+
+- Separate the expanded checkout API from the public `0.8.2` artifact observed
+  on 2026-10-22. The offline surface guard rejects different APIs using the same
+  version and validates retained artifact provenance before comparing them.
+
 ## [0.8.2] - 2026-10-01
 
-**Unpublished source candidate.** Supersedes tagged but unpublished `0.8.1`.
+**Public artifact observed 2026-10-22.** This heading originally described a
+source candidate. Registry observation does not establish its publication date.
+The original candidate superseded tagged but unpublished `0.8.1`.
 
 - Repack the reviewed source cohort with corrected exact-artifact inspection; no Python client API change.
 

{spaps-0.8.2 → spaps-0.8.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: spaps
-Version: 0.8.2
+Version: 0.8.3
 Summary: Python client for the hosted Sweet Potato / SPAPS API
 Project-URL: Homepage, https://sweetpotato.dev
 Project-URL: Documentation, https://docs.sweetpotato.dev
@@ -214,6 +214,28 @@ credential = client.auth.webauthn_register_verify(
 
 The sync and async auth clients also cover passkey-first bootstrap, credential listing/labeling/revocation, application passkey profiles, action-bound step-up, user recovery, and administrator recovery preparation/execution. Pass `origin` on ceremonies so SPAPS can validate the browser origin. Public ceremonies send only `X-API-Key`; lifecycle, profile, step-up, and administrator operations also require a bearer token, using an explicit `access_token` before stored credentials.
 
+Passkey signup's `webauthn_bootstrap_verify` returns a restricted
+`WebAuthnBootstrapPendingResponse`, without account/session creation or token
+storage. Keep its `bootstrap_grant` in attempt memory, obtain a fresh assertion
+from the user's authenticator, then submit that grant, `challenge_id`, and
+credential through `webauthn_bootstrap_assertion_verify`. Only the validated final
+response stores tokens. Preserve the original application, Origin/RP, user
+handle, and expiry; discard the grant when the attempt ends. Ordinary membership
+does not confer a dashboard grant.
+
+Bootstrap also binds configuration identity/version and the security profile
+fingerprint across both ceremonies; security profile changes require fresh
+options, while cosmetic display-name changes remain valid. Signup requests a
+discoverable passkey with `resident_key="required"`; authenticated enrollment
+keeps its configured preference. This changed contract in checkout Python
+`0.8.3` requires coordinated server and matching SDK/types/Python package/channel
+adoption, including the server/keyscope stored-rule contract. Publishable final
+assertion needs an exact singleton POST rule in
+`publishable_key_access.allowed_routes`; declared scopes, legacy defaults, and
+pattern backfill cannot enable it. Compiled browser/dashboard settings contain
+the rule; custom/legacy settings need an explicit adoption upgrade. Checkout
+source does not prove published or deployed compatibility.
+
 Python coordinates the server half of each WebAuthn ceremony. It returns typed registration or assertion options and accepts the credential JSON produced by a browser or another WebAuthn-capable user agent. It does not call `navigator.credentials`, emulate an authenticator, perform CTAP, or sign challenges. Recovery registration rotates the recovery grant; it does not issue login tokens until the new credential completes the recovery assertion.
 
 ## Core Surface
@@ -853,6 +875,9 @@ payload = verify_spaps_webhook(
 print(payload.type)
 ```
 
+The default five-minute verification window allows bounded clock skew in either
+direction. Timestamps farther in the future or past are rejected.
+
 ## Validation
 
 From the repository root:
@@ -920,6 +945,8 @@ The default is `InMemoryTokenStorage`. For persistence, pass
 `FileTokenStorage(path=...)`: it replaces the token file only after a complete
 write, keeps file permissions owner-only on POSIX, and rejects symlinked storage
 directories. Loading ignores symlinked or malformed token files.
+On platforms without directory-relative no-follow I/O, symlink checks are
+best-effort; use a private storage path with trusted ancestors.
 
 ### Does it retry requests automatically?
 
@@ -927,11 +954,17 @@ It can. Pass `RetryConfig` if you want retry and backoff behavior.
 
 ## Metadata
 
+This checkout is the unpublished `0.8.3` source candidate. It includes APIs beyond
+the retained public `0.8.2` artifact and has no publication receipt. After publishing a version,
+advance the checkout to its next development version before changing its API.
+The offline package-surface check compares checkout declarations with retained
+public artifacts; release and consumer adoption still require their own receipts.
+
 The metadata below describes this checkout. `latest_version` is the source
 package version; it does not establish registry publication or availability.
 
 - `package_name`: `spaps`
-- `latest_version`: `0.8.2`
+- `latest_version`: `0.8.3`
 - `minimum_runtime`: `Python >=3.9`
 - `api_base_url`: `https://api.sweetpotato.dev`
 
@@ -983,3 +1016,36 @@ The bridge constructor requires `spaps_origin`, allowed application `origin`, br
 `response_handler(status, cookies, location)` receives ordered raw allowlisted `Set-Cookie` values, including deletions and failure responses. It must apply them at the actual SPAPS browser origin before forwarding an optional validated Intuit navigation. A BFF on an unrelated hostname cannot set SPAPS host-only cookies. The callback URLs and cookies are sensitive trusted bridge inputs: do not serialize them into ordinary application results or logs. A local cookie sink does not provision this deployed bridge.
 
 On refresh-cookie rotation, `invalidate_access` must invalidate the cached bearer. Before another deliberate call, the host must reacquire current access through shared SPAPS auth, apply any further cookie updates, and expose that new bearer. Neither adapter refreshes or replays the operation. `CfoError` exposes only bounded `code`, `status`, and optional `request_id`; it does not retain the raw HTTP error. Deployment still requires the real origin/CSRF/cookie bridge, safe host logging, external CFO executor adoption, and the human retirement gate. These checkout APIs do not establish published package availability.
+# Dashboard (checkout)
+
+`client.dashboard` provides `context()`, `list_applications()`,
+`get_application(id)`, `list_records(kind, **filters)`, and `get_record(kind, id)`.
+`AsyncDashboardClient` has matching asynchronous reads. Each read requires an
+application credential and a current user session. Results contain stored
+records for owned applications, or global-admin scope, with pagination and
+source freshness. Retained email content is detail-only; authentication content
+is restricted. See [dashboard reads](https://github.com/build000r/sweet-potato/blob/main/docs/api/dashboard.md).
+Application dictionaries preserve `entitlement_options` for configured keys,
+sources and enabled flags, independently of `overview.stored_grants`. Missing/null
+catalog data from older servers is unavailable, not an empty catalog.
+Use `list_records('email-templates')` for template definitions and
+`list_records('email-logs')` for individual sends. Sync and async dictionaries
+preserve definition name/key, enabled state, stream, category and dates.
+Package publication and production deployment require separate evidence.
+
+For the dedicated operator console, the sync and async clients also expose
+`management_options(application_id)`, `invite`, `send_recovery`, `grant`, `revoke`,
+`create_entitlement_option`, and `create_application`. These require the console application's session and
+Viewer/Support/Admin entitlement checks; Viewer cannot write. Support handles
+approved ordinary app access, while Admin also manages console access and creates
+applications. See [console roles and setup](https://github.com/build000r/sweet-potato/blob/main/docs/guides/dashboard-access.md).
+Application option creation requires exact-app Admin authority and adds a manual
+key without granting user access. Existing console applications need the new exact
+POST route opt-in; checkout source does not establish production availability.
+
+Application Billing uses `billing_workspace(application_id)` and
+`billing_action(operation, application_id=..., expected_revision=..., data=...)`
+in both clients. Actions use a fixed operation list and retain the caller's
+session; the server rechecks target-app authority. Account attachment requires
+portfolio Admin. An ambiguous provider failure is not retried automatically.
+See [Billing configuration](https://github.com/build000r/sweet-potato/blob/main/docs/demos/spaps-dashboard/BILLING.md).

{spaps-0.8.2 → spaps-0.8.3}/README.md

@@ -146,6 +146,28 @@ credential = client.auth.webauthn_register_verify(
 
 The sync and async auth clients also cover passkey-first bootstrap, credential listing/labeling/revocation, application passkey profiles, action-bound step-up, user recovery, and administrator recovery preparation/execution. Pass `origin` on ceremonies so SPAPS can validate the browser origin. Public ceremonies send only `X-API-Key`; lifecycle, profile, step-up, and administrator operations also require a bearer token, using an explicit `access_token` before stored credentials.
 
+Passkey signup's `webauthn_bootstrap_verify` returns a restricted
+`WebAuthnBootstrapPendingResponse`, without account/session creation or token
+storage. Keep its `bootstrap_grant` in attempt memory, obtain a fresh assertion
+from the user's authenticator, then submit that grant, `challenge_id`, and
+credential through `webauthn_bootstrap_assertion_verify`. Only the validated final
+response stores tokens. Preserve the original application, Origin/RP, user
+handle, and expiry; discard the grant when the attempt ends. Ordinary membership
+does not confer a dashboard grant.
+
+Bootstrap also binds configuration identity/version and the security profile
+fingerprint across both ceremonies; security profile changes require fresh
+options, while cosmetic display-name changes remain valid. Signup requests a
+discoverable passkey with `resident_key="required"`; authenticated enrollment
+keeps its configured preference. This changed contract in checkout Python
+`0.8.3` requires coordinated server and matching SDK/types/Python package/channel
+adoption, including the server/keyscope stored-rule contract. Publishable final
+assertion needs an exact singleton POST rule in
+`publishable_key_access.allowed_routes`; declared scopes, legacy defaults, and
+pattern backfill cannot enable it. Compiled browser/dashboard settings contain
+the rule; custom/legacy settings need an explicit adoption upgrade. Checkout
+source does not prove published or deployed compatibility.
+
 Python coordinates the server half of each WebAuthn ceremony. It returns typed registration or assertion options and accepts the credential JSON produced by a browser or another WebAuthn-capable user agent. It does not call `navigator.credentials`, emulate an authenticator, perform CTAP, or sign challenges. Recovery registration rotates the recovery grant; it does not issue login tokens until the new credential completes the recovery assertion.
 
 ## Core Surface
@@ -785,6 +807,9 @@ payload = verify_spaps_webhook(
 print(payload.type)
 ```
 
+The default five-minute verification window allows bounded clock skew in either
+direction. Timestamps farther in the future or past are rejected.
+
 ## Validation
 
 From the repository root:
@@ -852,6 +877,8 @@ The default is `InMemoryTokenStorage`. For persistence, pass
 `FileTokenStorage(path=...)`: it replaces the token file only after a complete
 write, keeps file permissions owner-only on POSIX, and rejects symlinked storage
 directories. Loading ignores symlinked or malformed token files.
+On platforms without directory-relative no-follow I/O, symlink checks are
+best-effort; use a private storage path with trusted ancestors.
 
 ### Does it retry requests automatically?
 
@@ -859,11 +886,17 @@ It can. Pass `RetryConfig` if you want retry and backoff behavior.
 
 ## Metadata
 
+This checkout is the unpublished `0.8.3` source candidate. It includes APIs beyond
+the retained public `0.8.2` artifact and has no publication receipt. After publishing a version,
+advance the checkout to its next development version before changing its API.
+The offline package-surface check compares checkout declarations with retained
+public artifacts; release and consumer adoption still require their own receipts.
+
 The metadata below describes this checkout. `latest_version` is the source
 package version; it does not establish registry publication or availability.
 
 - `package_name`: `spaps`
-- `latest_version`: `0.8.2`
+- `latest_version`: `0.8.3`
 - `minimum_runtime`: `Python >=3.9`
 - `api_base_url`: `https://api.sweetpotato.dev`
 
@@ -915,3 +948,36 @@ The bridge constructor requires `spaps_origin`, allowed application `origin`, br
 `response_handler(status, cookies, location)` receives ordered raw allowlisted `Set-Cookie` values, including deletions and failure responses. It must apply them at the actual SPAPS browser origin before forwarding an optional validated Intuit navigation. A BFF on an unrelated hostname cannot set SPAPS host-only cookies. The callback URLs and cookies are sensitive trusted bridge inputs: do not serialize them into ordinary application results or logs. A local cookie sink does not provision this deployed bridge.
 
 On refresh-cookie rotation, `invalidate_access` must invalidate the cached bearer. Before another deliberate call, the host must reacquire current access through shared SPAPS auth, apply any further cookie updates, and expose that new bearer. Neither adapter refreshes or replays the operation. `CfoError` exposes only bounded `code`, `status`, and optional `request_id`; it does not retain the raw HTTP error. Deployment still requires the real origin/CSRF/cookie bridge, safe host logging, external CFO executor adoption, and the human retirement gate. These checkout APIs do not establish published package availability.
+# Dashboard (checkout)
+
+`client.dashboard` provides `context()`, `list_applications()`,
+`get_application(id)`, `list_records(kind, **filters)`, and `get_record(kind, id)`.
+`AsyncDashboardClient` has matching asynchronous reads. Each read requires an
+application credential and a current user session. Results contain stored
+records for owned applications, or global-admin scope, with pagination and
+source freshness. Retained email content is detail-only; authentication content
+is restricted. See [dashboard reads](https://github.com/build000r/sweet-potato/blob/main/docs/api/dashboard.md).
+Application dictionaries preserve `entitlement_options` for configured keys,
+sources and enabled flags, independently of `overview.stored_grants`. Missing/null
+catalog data from older servers is unavailable, not an empty catalog.
+Use `list_records('email-templates')` for template definitions and
+`list_records('email-logs')` for individual sends. Sync and async dictionaries
+preserve definition name/key, enabled state, stream, category and dates.
+Package publication and production deployment require separate evidence.
+
+For the dedicated operator console, the sync and async clients also expose
+`management_options(application_id)`, `invite`, `send_recovery`, `grant`, `revoke`,
+`create_entitlement_option`, and `create_application`. These require the console application's session and
+Viewer/Support/Admin entitlement checks; Viewer cannot write. Support handles
+approved ordinary app access, while Admin also manages console access and creates
+applications. See [console roles and setup](https://github.com/build000r/sweet-potato/blob/main/docs/guides/dashboard-access.md).
+Application option creation requires exact-app Admin authority and adds a manual
+key without granting user access. Existing console applications need the new exact
+POST route opt-in; checkout source does not establish production availability.
+
+Application Billing uses `billing_workspace(application_id)` and
+`billing_action(operation, application_id=..., expected_revision=..., data=...)`
+in both clients. Actions use a fixed operation list and retain the caller's
+session; the server rechecks target-app authority. Account attachment requires
+portfolio Admin. An ambiguous provider failure is not retried automatically.
+See [Billing configuration](https://github.com/build000r/sweet-potato/blob/main/docs/demos/spaps-dashboard/BILLING.md).

spaps-0.8.3/docs/account-security.md

@@ -0,0 +1,61 @@
+# Account security and human GitHub OAuth
+
+`client.auth` exposes the same canonical account-security endpoints as the
+TypeScript SDK. `AsyncSpapsClient` exposes the same method names and arguments;
+await each call. Result models are exported from `spaps_client.auth`.
+
+| Python method | Canonical path under `/api/auth` |
+| --- | --- |
+| `get_security_summary()` | `GET /security` |
+| `security_wallet_challenge(wallet_address=..., chain_type=...)` | `POST /security/wallets/challenge` |
+| `security_wallet_link(...)` | `POST /security/wallets/link` |
+| `security_wallet_remove(record_id=...)` | `DELETE /security/wallets/{id}` |
+| `security_provider_nonce(provider=..., client_type=..., redirect_uri=...)` | `POST /security/providers/nonce` |
+| `security_provider_link(...)` | `POST /security/providers/link` |
+| `security_provider_remove(record_id=...)` | `DELETE /security/providers/{id}` |
+| `security_phone_request(phone_number=...)` | `POST /security/phone/request` |
+| `security_phone_verify(phone_number=..., code=..., challenge_id=...)` | `POST /security/phone/verify` |
+| `security_phone_remove()` | `DELETE /security/phone` |
+| `security_email_request(email=...)` | `POST /security/email/request` |
+| `security_email_verify(email=..., code=..., challenge_id=...)` | `POST /security/email/verify` |
+| `github_start(redirect_url=...)` / `github_complete(code=..., state=...)` | `POST /github/start` and `/github/complete` |
+| `security_github_start(redirect_url=...)` / `security_github_complete(code=..., state=...)` | `POST /security/github/start` and `/security/github/complete` |
+| `sign_up(email=..., password=...)` | `POST /signup` |
+| `request_signup_confirmation(email=..., redirect_url=...)` | `POST /signup/confirmation/request` |
+| `verify_signup_confirmation(token=...)` | `POST /signup/confirmation/verify` |
+
+Security methods require the current access token, supplied through token
+storage or `access_token=...`. All methods above accept `origin=...`; send the
+registered application origin where server policy requires it. They retain the
+application API key and use the configured HTTP client's cookie jar.
+
+Linking returns `AuthLinkResult`, never a replacement login session. If a
+successful change reports `session_ended=True`, the client clears stored
+credentials. Removal returns `AuthRemoveResult`; the server decides whether an
+alternative sign-in method remains viable. There is no email-removal endpoint.
+Delivery status may describe a console simulation; it does not prove SMS arrived.
+
+Human GitHub uses `oauth:github`, separate from machine `oidc:github`. The start
+and completion calls require the same app/origin/browser binding. A Python HTTP
+client cannot transfer an HttpOnly browser cookie across clients automatically.
+Browser integrations should use the shared browser SDK popup helper, retaining
+the current bearer session for account linking. Do not retry a failed link as a
+sign-in operation. Provider access tokens are never client results.
+
+`sign_up` returns `SignupPending`, `MfaRequiredChallenge`, or `TokenPair`.
+Pending confirmation and MFA challenges do not replace stored credentials.
+`verify_signup_confirmation` returns a restricted `password_setup_token`; it
+does not authenticate or store that grant as an access token. Continue through
+the existing password setup and normal sign-in flow.
+
+Both clients accept `origin=...` on `oidc_nonce` and `oidc_sign_in`. For Apple
+browser calls, pass the same exact configured origin on nonce and completion;
+the client forwards it as the request's `Origin` header. A redirect URI does not
+set that header. The server rejects a missing or mismatched browser origin.
+
+Apple OIDC methods support `client_type` and `redirect_uri`; completion also
+accepts `authorization_code`. Omit those Apple profile fields for Google.
+Native Apple calls keep their existing profile without requiring browser Origin.
+Wallet
+`request_nonce(..., chain="base")` preserves its existing Python argument name
+and sends the server's canonical `chain_type` field.

{spaps-0.8.2 → spaps-0.8.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "spaps"
-version = "0.8.2"
+version = "0.8.3"
 description = "Python client for the hosted Sweet Potato / SPAPS API"
 readme = "README.md"
 requires-python = ">=3.9"

{spaps-0.8.2 → spaps-0.8.3}/src/spaps_client/__init__.py

@@ -7,6 +7,14 @@ payments, and supporting utilities as implementation progresses.
 
 from .cfo import CfoClient, CfoDecision, CfoDecisionRequest, CfoError, CfoStartRequest
 from .cfo_async import AsyncCfoClient
+from .cfo_actions import (
+    CfoActionsClient, AsyncCfoActionsClient, CfoActionVerifier, AsyncCfoActionVerifier,
+    CfoActionBrowserSession, AsyncCfoActionBrowserSession,
+    Invitation as CfoActionInvitation, Delivery as CfoActionDelivery,
+    Status as CfoActionStatus, Claim as CfoActionClaim,
+    VerificationBinding as CfoActionVerificationBinding,
+    RuntimeEnvelope as CfoActionRuntimeEnvelope,
+)
 from .cfo_browser_session import CfoBrowserCredentials, CfoBrowserSession, AsyncCfoBrowserSession
 from .auth import (
     AuthClient,
@@ -33,6 +41,7 @@ from .auth import (
     WebAuthnAssertionOptionsResponse,
     WebAuthnRegisterVerifyResponse,
     WebAuthnBootstrapVerifyResponse,
+    WebAuthnBootstrapPendingResponse,
     WebAuthnCredentialDescriptor,
     PasskeyTransport,
     WebAuthnRelyingParty,
@@ -76,12 +85,20 @@ from .payments import (
     PaymentsClient,
     PaymentsError,
     CheckoutSession,
+    CheckoutSessionDetails,
+    CheckoutSessionSummary,
+    CheckoutSessionList,
+    ExpireCheckoutSessionResult,
     PaymentIntent,
     WalletDeposit,
     WalletTransaction,
     SubscriptionPlan,
+    SubscriptionItemPriceRecurring,
+    SubscriptionItemPrice,
+    SubscriptionItem,
     SubscriptionDetail,
     SubscriptionCancellation,
+    SubscriptionList,
     BalanceOverview,
     BalanceAmounts,
     UsageSummary,
@@ -89,6 +106,12 @@ from .payments import (
     ProductPrice,
     Product,
     ProductList,
+    GuestCheckoutSession,
+    GuestCheckoutSessionSummary,
+    GuestCheckoutSessionList,
+    GuestCheckoutConversionResult,
+    PaymentRecord,
+    PaymentHistory,
 )
 from .whitelist import (
     WhitelistClient,
@@ -185,9 +208,12 @@ from .developer_projects import (
     ResetProjectPairResponse,
     RotateEnvironmentKeyResponse,
 )
+from .dashboard import DashboardClient, DashboardDetail, DashboardKind, DashboardPage, DashboardSource
+from .dashboard_async import AsyncDashboardClient
 from .dev_portal import (
     DEV_PORTAL_HELPERS,
     DeleteApplicationResponse,
+    DevPortalCheckoutSessionResponse,
     DevPortalClient,
     DevPortalError,
     ListOwnedApplicationsResponse,
@@ -370,7 +396,66 @@ from .storage import (
 )
 from .http import RetryConfig, LoggingHooks, default_logging_hooks
 
+from .purchase_journeys import (
+    SubmittedJourneyIdentity,
+    CanonicalJourneyIdentity,
+    PreparedConsent,
+    ReceiptPaymentView,
+    ReceiptAccessView,
+    ReceiptIdentityView,
+    ConsumerSupportRequest,
+    ConsumerSupportResponse,
+    OnboardingVersion,
+    OnboardingFlow,
+    OnboardingFlowMutation,
+    ApproveOnboardingFlowRequest,
+    WithdrawOnboardingApprovalRequest,
+    RegisterJourneyPolicyRequest,
+    JourneyPolicyResponse,
+    AcceptJourneyConsentRequest,
+    JourneyConsentResponse,
+    PrepareJourneyRequest,
+    PreparedJourneyResponse,
+    ResumeJourneyRequest,
+    ResumeJourneyResponse,
+    ProvisioningInputRequest,
+    ProvisioningInputResponse,
+    IssueReceiptCapabilityRequest,
+    IssuedReceiptCapabilityResponse,
+    ReceiptStatusRequest,
+    ReceiptStatusResponse,
+    IssueAccessChallengeRequest,
+    IssuedAccessChallengeResponse,
+    VerifyAccessChallengeRequest,
+    VerifyAccessChallengeResponse,
+    AppProvisioningReportRequest,
+    AppProvisioningReportResponse,
+    PurchaseJourneysClient,
+    OnboardingDefinition,
+    OnboardingQuestion,
+    QuestionBase,
+    TextQuestion,
+    NumberQuestion,
+    BooleanQuestion,
+    ChoiceOption,
+    ChoiceQuestion,
+    FlowApproval,
+)
+from .purchase_journeys_async import AsyncPurchaseJourneysClient
+from .dashboard import (
+    DashboardOnboardingWorkspace,
+    DashboardOnboardingJourneys,
+    DashboardOnboardingJourney,
+    DashboardOnboardingComparison,
+    OnboardingDraftWrite,
+    OnboardingPublishWrite,
+    OnboardingRollbackWrite,
+    OnboardingFlowWrite,
+    OnboardingCohort,
+)
+
 __all__ = [
+    "DashboardClient", "AsyncDashboardClient", "DashboardDetail", "DashboardKind", "DashboardPage", "DashboardSource",
     "__version__",
     "AuthClient",
     "AuthMethodResult",
@@ -396,6 +481,7 @@ __all__ = [
     "WebAuthnAssertionOptionsResponse",
     "WebAuthnRegisterVerifyResponse",
     "WebAuthnBootstrapVerifyResponse",
+    "WebAuthnBootstrapPendingResponse",
     "WebAuthnCredentialDescriptor",
     "PasskeyTransport",
     "WebAuthnRelyingParty",
@@ -548,6 +634,7 @@ __all__ = [
     "RotateEnvironmentKeyResponse",
     "DEV_PORTAL_HELPERS",
     "DeleteApplicationResponse",
+    "DevPortalCheckoutSessionResponse",
     "DevPortalClient",
     "DevPortalError",
     "ListOwnedApplicationsResponse",
@@ -718,7 +805,20 @@ __all__ = [
 ]
 
 # Temporary development version; replaced during release automation.
-__version__ = "0.8.2"
+__version__ = "0.8.3"
 
 
 __all__ += ["CfoClient", "AsyncCfoClient", "CfoDecision", "CfoDecisionRequest", "CfoError", "CfoStartRequest", "CfoBrowserCredentials", "CfoBrowserSession", "AsyncCfoBrowserSession"]
+
+
+__all__ += ['ConsumerSupportRequest', 'ConsumerSupportResponse', 'OnboardingVersion', 'OnboardingFlow', 'OnboardingFlowMutation', 'ApproveOnboardingFlowRequest', 'WithdrawOnboardingApprovalRequest', 'RegisterJourneyPolicyRequest', 'JourneyPolicyResponse', 'AcceptJourneyConsentRequest', 'JourneyConsentResponse', 'PrepareJourneyRequest', 'PreparedJourneyResponse', 'ResumeJourneyRequest', 'ResumeJourneyResponse', 'ProvisioningInputRequest', 'ProvisioningInputResponse', 'IssueReceiptCapabilityRequest', 'IssuedReceiptCapabilityResponse', 'ReceiptStatusRequest', 'ReceiptStatusResponse', 'IssueAccessChallengeRequest', 'IssuedAccessChallengeResponse', 'VerifyAccessChallengeRequest', 'VerifyAccessChallengeResponse', 'AppProvisioningReportRequest', 'AppProvisioningReportResponse', 'PurchaseJourneysClient', 'OnboardingDefinition', 'OnboardingQuestion', 'QuestionBase', 'TextQuestion', 'NumberQuestion', 'BooleanQuestion', 'ChoiceOption', 'ChoiceQuestion', 'FlowApproval', 'AsyncPurchaseJourneysClient']
+
+__all__ += ['DashboardOnboardingWorkspace', 'DashboardOnboardingJourneys', 'DashboardOnboardingJourney', 'DashboardOnboardingComparison', 'OnboardingDraftWrite', 'OnboardingPublishWrite', 'OnboardingRollbackWrite', 'OnboardingFlowWrite', 'OnboardingCohort']
+
+__all__ += ["SubmittedJourneyIdentity", "CanonicalJourneyIdentity", "PreparedConsent",
+            "ReceiptPaymentView", "ReceiptAccessView", "ReceiptIdentityView"]
+
+__all__ += ["CfoActionsClient", "AsyncCfoActionsClient", "CfoActionVerifier", "AsyncCfoActionVerifier",
+            "CfoActionBrowserSession", "AsyncCfoActionBrowserSession", "CfoActionInvitation",
+            "CfoActionDelivery", "CfoActionStatus", "CfoActionClaim",
+            "CfoActionVerificationBinding", "CfoActionRuntimeEnvelope"]

{spaps-0.8.2 → spaps-0.8.3}/src/spaps_client/async_client.py

@@ -7,6 +7,10 @@ from typing import Optional, TYPE_CHECKING
 
 import httpx
 
+from .cfo_actions import AsyncCfoActionsClient
+from .purchase_journeys_async import AsyncPurchaseJourneysClient
+from .dashboard_async import AsyncDashboardClient
+
 from .cfo_async import AsyncCfoClient
 
 from .app_links_async import AsyncAppLinksClient
@@ -79,6 +83,8 @@ class AsyncSpapsClient:
         self._usage: Optional[AsyncUsageClient] = None
         self._whitelist: Optional[AsyncWhitelistClient] = None
         self._secure_messages: Optional[AsyncSecureMessagesClient] = None
+        self._purchase_journeys: Optional[AsyncPurchaseJourneysClient] = None
+        self._dashboard: Optional[AsyncDashboardClient] = None
         self._dev_portal: Optional[AsyncDevPortalClient] = None
         self._issue_reporting: Optional[AsyncIssueReportingClient] = None
         self._metrics: Optional[AsyncMetricsClient] = None
@@ -92,6 +98,11 @@ class AsyncSpapsClient:
 
     # Factories --------------------------------------------------------
 
+    @property
+    def cfo_actions(self) -> AsyncCfoActionsClient:
+        return AsyncCfoActionsClient(base_url=self.settings.base_url, api_key=self.settings.api_key,
+                                   access_token_provider=self._get_access_token_or_none)
+
     @property
     def cfo(self) -> AsyncCfoClient:
         # Resolve the token at each operation, including on an already-held facade.
@@ -172,6 +183,29 @@ class AsyncSpapsClient:
             self._secure_messages.access_token = access_token
         return self._secure_messages
 
+    @property
+    def purchase_journeys(self) -> AsyncPurchaseJourneysClient:
+        """Backend-only onboarding and receipt contracts; no human JWT required."""
+        if self._purchase_journeys is None:
+            self._purchase_journeys = AsyncPurchaseJourneysClient(
+                base_url=self.settings.base_url, api_key=self.settings.api_key,
+                client=self._client,
+            )
+        return self._purchase_journeys
+
+    @property
+    def dashboard(self) -> AsyncDashboardClient:
+        """Stored application-owner and administrator dashboard records."""
+        access_token = self._require_access_token()
+        if self._dashboard is None:
+            self._dashboard = AsyncDashboardClient(
+                base_url=self.settings.base_url, api_key=self.settings.api_key,
+                access_token=access_token, client=self._client,
+            )
+        else:
+            self._dashboard.access_token = access_token
+        return self._dashboard
+
     @property
     def dev_portal(self) -> AsyncDevPortalClient:
         """Entitlement-gated staging-app minting (server-side only: needs the secret key)."""
@@ -347,6 +381,8 @@ class AsyncSpapsClient:
             self._whitelist,
             self._secure_messages,
             self._dev_portal,
+            self._purchase_journeys,
+            self._dashboard,
             self._issue_reporting,
             self._metrics,
             self._entitlements,