export { C as Configure, F as FileDeleteOptions, a as FileDeleteResult, b as FileEntry, c as FileListOperationOptions, d as FileListOptions, e as FileListResult, f as FileReadOptions, g as FileReadResult, h as FileSearchHit, i as FileSearchOperationOptions, j as FileSearchOptions, k as FileSearchResult, l as FileWriteOperationOptions, m as FileWriteOptions, n as FileWriteResult, v as validateAgentHandle } from './client-BCEb7RmH.js'; import { UserIdentity } from './types.js'; export { ActionName, AddSheetResponse, AppendSheetValuesResponse, ConfigureOptions, ConfigureToolCall, ConfigureToolDefinition, ConfirmConnectorResponse, ConnectApp, ConnectCapability, ConnectConnectorResponse, Connector, ConnectorName, ConnectorType, CreateMessageSignInUrlOptions, CreateMessageSignInUrlResult, CreateSpreadsheetResponse, EmailProvider, ForgetSelector, GetSheetValuesResponse, ImportCaps, ImportConversation, ImportJob, ImportJobStatus, ImportMemoryProvider, ImportMessage, ImportMode, ImportProfileUser, ImportProfilesRequest, ImportQuotaState, ImportedMemory, ImportedSourceData, ListConnectorsResponse, ListMessageLinesResult, McpAuthOptions, McpSessionOptions, McpSessionProvider, McpSessionResponse, MessageIdentity, MessageIdentityResolveOptions, MessageIdentitySource, MessageLine, MessageSignInFallbackReason, MessageSignInReason, MessageSignInUrlMode, OtpStartResponse, OtpVerifyResponse, ProfileCommitInput, ProfileCommitResult, ProfileFormatOptions, ProfileReadOptions, ProfileReadResult, ProfileRuntimeOptions, ProfileSearchDiagnostic, ProfileSearchDiagnosticStatus, ProfileSearchHit, ProfileSearchOptions, ProfileSearchResult, ProfileSearchSourceCount, ProfileSection, ProfileToolsOptions, RegisterMessageLineOptions, RegisterMessageLineResult, RememberOptions, RevokeMessageLineOptions, RevokeMessageLineResult, SearchSpreadsheetsResponse, SheetValuesMutationInput, SignInExchangeResult, SignInPhoneRecognitionResult, SignInReturnDestination, SignInReturnDestinationList, SignInReturnDestinationResult, SignInTokenValidationResult, SignInUrlOptions, SyncConnectorResponse, UIResult, UpdateSheetValuesResponse, UserProfile } from './types.js'; export { getActionTools, getAdvancedTools, getConnectorTools, getDefaultProfileTools, getToolsForOptions, getUITools, toOpenAIFunctions } from './tool-definitions.js'; export { ConfigureAccessRequestOptions, ConfigureConfirmationOptions, ConfigureConnectionsOptions, ConfigureController, ConfigureFrame, ConfigureHostedEvent, ConfigureHostedIntent, ConfigureHostedPresentation, ConfigureHostedSurface, ConfigureHostedTheme, ConfigureLinkOptions, ConfigureMemoryCardOptions, ConfigureMemoryImportOptions, ConfigureMountOptions, ConfigurePersonalizationButtonOptions, ConfigurePersonalizationEntry, ConfigureProfileEditorOptions, ConfigureSignInOptions, ConfigureSingleConnectorOptions, ConfigureToolApprovalOptions, ConfigureWindow } from './window.js'; interface ConfigureBetterAuthOAuthProviderOptions { /** Configure OAuth client id from the developer dashboard. */ clientId: string; /** Configure OAuth client secret from the developer dashboard. */ clientSecret: string; /** Server-side Configure API key used to read the approved profile. */ apiKey: string; /** Configure agent handle resolved for this Better Auth app. */ agent: string; /** Better Auth provider id. Defaults to "configure". */ providerId?: string; /** Configure API origin. Defaults to https://api.configure.dev. */ baseUrl?: string; /** Hosted Configure accounts origin. Defaults to https://accounts.configure.dev. */ accountsOrigin?: string; /** OAuth resource. Defaults to https://api.configure.dev. */ resource?: string; /** OAuth scopes requested from Configure. */ scopes?: string[]; /** Custom fetch implementation. */ fetch?: typeof fetch; } interface ConfigureBetterAuthProfile extends UserIdentity { sub: string; emailVerified?: boolean; } interface ConfigureBetterAuthOAuthProvider { providerId: string; clientId: string; clientSecret: string; authorizationUrl: string; tokenUrl: string; scopes: string[]; pkce: true; authentication: 'basic'; authorizationUrlParams: Record; tokenUrlParams: Record; getUserInfo(tokens: Record): Promise; mapProfileToUser(profile: ConfigureBetterAuthProfile): Record; } declare function configureBetterAuthOAuthProvider(options: ConfigureBetterAuthOAuthProviderOptions): ConfigureBetterAuthOAuthProvider; interface PersonalizeOptions { /** Secret key (sk_). Server-side only. */ apiKey: string; /** Publishable key (pk_). Safe for the browser; only builds the link. */ publishableKey: string; /** Your agent handle in Configure. */ agent: string; /** Where this app runs, e.g. http://localhost:4000. */ baseUrl: string; /** * Called after a user signs in, with their profile, id, and token. Return an * HTML string to render a page, or any JSON-serializable value to send JSON. */ onSignedIn: (user: { profile: unknown; userId: string; token: string; }) => unknown | Promise; /** Folder of static files to serve at the root. Default "public". */ publicDir?: string; /** Route that starts sign-in. Default "/login". */ loginPath?: string; /** Route Configure redirects back to. Default "/callback". */ callbackPath?: string; } interface PersonalizeServer { /** Start listening on a port. Mirrors http.Server.listen. */ listen: (port: number, onReady?: () => void) => void; } declare const personalize: (options: PersonalizeOptions) => PersonalizeServer; /** * Error codes returned by SDK methods. * Use these to programmatically handle specific failure modes. * * @example * ```typescript * import { ConfigureError, ErrorCode } from 'configure'; * * try { * await profile.read(); * } catch (e) { * if (e instanceof ConfigureError && e.code === ErrorCode.AUTH_REQUIRED) { * // Token expired — re-authenticate * } * } * ``` */ declare const ErrorCode: { /** No API key provided to Configure */ readonly API_KEY_MISSING: "API_KEY_MISSING"; /** Token is missing, invalid, or expired (HTTP 401/403) */ readonly AUTH_REQUIRED: "AUTH_REQUIRED"; /** Input failed validation before reaching the API */ readonly INVALID_INPUT: "INVALID_INPUT"; /** The requested tool is not connected for this user (HTTP 400) */ readonly TOOL_NOT_CONNECTED: "TOOL_NOT_CONNECTED"; /** Network request failed (DNS, connection refused, etc.) */ readonly NETWORK_ERROR: "NETWORK_ERROR"; /** Too many requests (HTTP 429) */ readonly RATE_LIMITED: "RATE_LIMITED"; /** Resource not found (HTTP 404) */ readonly NOT_FOUND: "NOT_FOUND"; /** Server error (HTTP 5xx) */ readonly SERVER_ERROR: "SERVER_ERROR"; /** Request timed out */ readonly TIMEOUT: "TIMEOUT"; /** Not authorized for this resource (HTTP 403, distinct from AUTH_REQUIRED) */ readonly ACCESS_DENIED: "ACCESS_DENIED"; /** Tool operation failed (provider error, misconfiguration) */ readonly TOOL_ERROR: "TOOL_ERROR"; /** Billing/quota limit reached (HTTP 402) */ readonly PAYMENT_REQUIRED: "PAYMENT_REQUIRED"; /** A prior portable profile read must be committed before another portable read. */ readonly COMMIT_REQUIRED: "COMMIT_REQUIRED"; }; type ErrorCodeValue = (typeof ErrorCode)[keyof typeof ErrorCode]; /** Optional structured error details from a backend response. */ interface ErrorDetails { type?: string; param?: string | null; retryable?: boolean; suggestedAction?: string | null; docUrl?: string | null; retryAfter?: number | null; requestId?: string; } /** * Typed error thrown by all SDK methods. * Always has a `code` property for programmatic handling. */ declare class ConfigureError extends Error { /** Machine-readable error code (see {@link ErrorCode}) */ readonly code: ErrorCodeValue; /** HTTP status code from the API response, if applicable */ readonly statusCode?: number; /** Backend error type (e.g., "authentication_error", "tool_error") */ readonly type?: string; /** The field or parameter that caused the error, if applicable */ readonly param?: string | null; /** Whether the same request might succeed if retried */ readonly retryable?: boolean; /** Machine-readable suggested next action (e.g., "reauthenticate", "connect_tool") */ readonly suggestedAction?: string | null; /** Link to error documentation */ readonly docUrl?: string | null; /** Seconds to wait before retrying (rate limits) */ readonly retryAfter?: number | null; /** Request ID from the backend response */ readonly requestId?: string; constructor(code: ErrorCodeValue, message: string, statusCode?: number, details?: ErrorDetails); /** * Create a ConfigureError from an HTTP response body. * Parses structured error responses ({ error: { type, code, message, ... } }) * and falls back to status-code mapping for legacy string responses. */ static fromResponse(status: number, body: Record): ConfigureError; /** * Create a ConfigureError from a caught exception (network failures, timeouts). */ static fromCatch(error: unknown, fallbackMessage: string): ConfigureError; } /** * Brand check for a Configure error, safe across module copies. * * `instanceof` compares class identity, so it silently returns false whenever * the thrower and the checker hold DIFFERENT copies of this class. That is not * hypothetical: the `configure/ai-sdk` subpath is built as its own bundle, so * it inlined a second `ConfigureError` and every refusal was rethrown instead * of being handed to the model. The same thing happens whenever npm installs * two copies of `configure`, which no amount of bundling discipline prevents. * * Use this at any boundary where the error may have crossed a module graph. */ declare function isConfigureError(error: unknown): error is ConfigureError; /** * Classify any caught error into a ConfigureError. * Works with SDK errors, Anthropic errors, network errors, or plain strings. * Use in agent catch blocks for errors from any source. */ declare function classifyError(error: unknown): ConfigureError; /** * Best-practice prompt guidelines for agents handling personal data through Configure. * * Use when your app deliberately carries Configure handling guidance in an * app-owned prompt or context path. `profile.format({ guidelines: true })` * includes them automatically after formatted profile context. * * @example * ```typescript * import { Configure, CONFIGURE_GUIDELINES } from 'configure'; * * const configure = new Configure({ apiKey: process.env.CONFIGURE_API_KEY, agent: 'your-agent' }); * const runtime = configure.profile({ token }); * const tools = runtime.tools(); * const read = await runtime.read({ sections: ['identity', 'preferences', 'summary'] }); * const approvedContext = read.profile.format({ guidelines: true }); * ``` */ declare const CONFIGURE_GUIDELINES = "CONFIGURE GUIDELINES \u2014 handling personal data responsibly\n\nGROUNDING:\n- Only state specific facts (dates, names, amounts, locations) if they appear in the user's profile context or tool results.\n- Never fabricate or assume personal information. If you lack data, say so.\n- If the profile context seems incomplete, use profile or connector tools to retrieve data \u2014 do not guess.\n- Resolve relative dates like \"yesterday\", \"last week\", and \"last month\" against the runtime's current date/time before searching profile or connector data.\n\nTRANSPARENCY:\n- When referencing personal data, briefly cite your source: \"from your profile\", \"from another agent\", \"from your Gmail\", \"from your calendar\", etc.\n- If the user asks how you know something, explain clearly \u2014 you found it in their connected data.\n- When using web search results, include source URLs so users can verify.\n\nPROFILE SOURCES:\n- For \"what does know about me?\", use configure_profile_search with query \"*\" and the explicit source handle.\n- For ChatGPT/Claude/Gemini/Grok imported memories, use configure_profile_search with query \"*\" and source \"chatgpt\", \"claude\", \"gemini\", \"grok\", or the explicit \"import:\" handle.\n- For \"what did I talk about last week/month/yesterday?\", search with date filters after resolving the date range.\n- For \"what agents have profile data about me?\", use configure_profile_read with sections [\"agents\"]. For imported memory sources, use sections [\"imports\"].\n- Never speculate about profile data you did not receive. If something is not in the results, treat it as not there rather than as possibly withheld.\n- Do not confuse profile sources with connectors. Profile sources are agents or imports that wrote profile data; connectors are external accounts like Gmail, Calendar, Drive, and Notion.\n\nCONNECTORS:\n- When a connector-backed tool returns a connection error or \"not connected\" status, do not echo the error. Let the user know naturally \u2014 e.g. \"I'd need access to your calendar for that \u2014 would you like to connect it?\"\n- Do not repeatedly prompt the user to connect accounts they have already declined or been asked about.\n\nCONVERSATION EFFICIENCY:\n- Check conversation history before re-searching \u2014 you may have already retrieved the data.\n- If a search didn't find what the user needs, try different queries with synonyms or alternative phrasing."; /** * `npx configure verify` — proves the credentials in .env actually work. * * Setup can only report what the server told it while minting. Everything after * that (is the callback registered byte-for-byte, does the client secret still * authenticate, does a profile read come back) was previously discovered by the * developer in a browser, mid-integration, as an opaque OAuth error. These are * the checks that turn those into one command. * * The logic lives here as pure functions over an injected fetch so the failure * classification — the part that decides what a developer is told to do next — * is testable without a network, a browser, or a live account. */ type FetchLike = (url: string, init?: { method?: string; headers?: Record; body?: string; }) => Promise<{ status: number; ok: boolean; text: () => Promise; }>; /** * Boot-time SSO callback self-registration. * * The recurring SSO failure is not a broken check — it is a manual step: a * developer must remember to register each environment's callback in the * dashboard, and an unregistered (or sibling-client) callback surfaces days * later as an opaque `redirect_uri must exactly match client registration` * at a real user's sign-in. This module deletes the manual step: an app that * knows its own public URL registers its callback on boot, idempotently, * against the client it already has. * * Design constraints, each one load-bearing: * * - The origin comes from EXPLICIT configuration (CONFIGURE_APP_URL or a * passed appUrl). Never a Host header — that is attacker-controlled, and a * spoofed Host must not be able to register an attacker's callback. * - It APPENDS to the existing client, never creates one. Minting clients * from automated paths is how the never-reauth breach happened (a client * per registration); `CONFIGURE_OAUTH_CLIENT_ID` stays stable everywhere. * - Validation mirrors the server's validateRedirectUri exactly, so a value * this module accepts cannot be refused downstream. Registering something * that later never matches is a failure shape this repo has shipped once * already and must not reintroduce. * - It NEVER throws. Registration runs at app startup, and a Configure * hiccup must not be able to take a customer's app down with it. Failures * come back as data for the caller to log loudly. */ /** * FetchLike plus an abort signal. Structurally accepts every FetchLike, so * tests and callers can keep passing plain implementations. */ type SsoFetchLike = (url: string, init?: { method?: string; headers?: Record; body?: string; signal?: unknown; }) => ReturnType; declare const DEFAULT_SSO_CALLBACK_PATH = "/auth/configure/callback"; interface EnsureSsoCallbackInput { /** The app's public origin, e.g. https://app.example.com. Explicit only. */ appUrl?: string; /** Appended to appUrl. Defaults to /auth/configure/callback. */ callbackPath?: string; /** Full callback override; wins over appUrl + callbackPath. */ redirectUri?: string; /** CONFIGURE_OAUTH_CLIENT_ID — the one client this app uses everywhere. */ clientId?: string; /** CONFIGURE_API_KEY — must be a server secret key (sk_). */ apiKey?: string; /** API origin; defaults to https://api.configure.dev. */ baseUrl?: string; /** Injectable for tests. Defaults to global fetch. */ fetchImpl?: SsoFetchLike; } type EnsureSsoCallbackResult = { status: 'registered'; redirectUri: string; registered: string[]; } | { status: 'already-registered'; redirectUri: string; registered: string[]; } | { status: 'skipped'; reason: string; } | { status: 'failed'; reason: string; redirectUri?: string; }; /** * Resolve and validate the callback this app should register. * * The checks are a deliberate mirror of the server's validateRedirectUri * (HTTPS or localhost, no wildcard, no whitespace, no fragment, no embedded * credentials) so every refusal happens HERE, at boot, with a local message — * not later as an API rejection. */ declare function resolveSsoRedirectUri(input: { appUrl?: string; callbackPath?: string; redirectUri?: string; }): { redirectUri: string; } | { error: string; }; /** * Idempotently register this app's SSO callback on its OAuth client. * Safe to call on every boot; never throws. */ declare function ensureSsoCallback(input: EnsureSsoCallbackInput): Promise; /** * Boot helper over the exact env names `npx configure setup --users` writes. * Call it once at startup and log the result; a 'failed' status at deploy * time is the same mismatch that would otherwise appear days later as an * opaque error at a user's sign-in. */ declare function ensureSsoCallbackFromEnv(env: Record, fetchImpl?: SsoFetchLike): Promise; export { CONFIGURE_GUIDELINES, type ConfigureBetterAuthOAuthProvider, type ConfigureBetterAuthOAuthProviderOptions, type ConfigureBetterAuthProfile, ConfigureError, DEFAULT_SSO_CALLBACK_PATH, type EnsureSsoCallbackInput, type EnsureSsoCallbackResult, ErrorCode, type ErrorCodeValue, type PersonalizeOptions, type PersonalizeServer, UserIdentity, classifyError, configureBetterAuthOAuthProvider, ensureSsoCallback, ensureSsoCallbackFromEnv, isConfigureError, personalize, resolveSsoRedirectUri };