v1.0.1

All four SDKs at 1.0.1, targeting txApi API 1.8.0.

	Install
TypeScript	npm install @txapi/sdk@1.0.1
Python	pip install "txapi-sdk[live]==1.0.1"
Java	cloud.txapi:txapi-sdk:1.0.1
FiveM	txapi-fivem-1.0.1.zip below, extract into resources/

typescript

No code changes. First release published from GitHub Actions through npm trusted publishing,
with a provenance statement linking the package to its source commit.

python

Fixed

• scripts/generate.py and its freshness test work in a Windows virtualenv: they find
  Scripts\ruff.exe and pass the source to ruff as UTF-8 (the locale default there is
  cp1252). Only affects development of the SDK; the package itself is unchanged.

java

No code changes; released together with the other SDKs (all four share one version).

fivem

No code changes; released together with the other SDKs (all four share one version).

v1.0.0

All four SDKs at 1.0.0, targeting txApi API 1.8.0.

	Install
TypeScript	npm install @txapi/sdk@1.0.0
Python	pip install "txapi-sdk[live]==1.0.0"
Java	cloud.txapi:txapi-sdk:1.0.0
FiveM	txapi-fivem-1.0.0.zip below, extract into resources/

python

First release, targeting txApi 1.8.0. Published on PyPI as txapi-sdk (the name
txapi there is taken); the import name is txapi.

Added

• TxApi (sync) and AsyncTxApi (async) clients with an identical surface, built on httpx;
  configuration from arguments or TXAPI_KEY / TXAPI_BASE_URL, default server_id,
  per-call server_id= and timeout=, custom http_client=, on_request / on_response hooks.
• One method for each of the 67 endpoints (account, players, history, server,
  server.resources, console, serverlog, events, whitelist, whitelist.approvals,
  admins), fully type-hinted with TypedDict responses (txapi.types), docstrings naming
  the required permission.
• Discord ban/unban flags: players.ban(..., discord_ban=True) and
  history.revoke(..., discord_unban=True) with the discord result.
• Client-side validation (required fields, maximum lengths) before any request.
• Error hierarchy (TxApiError and one subclass per status, RateLimitError.quota_exhausted,
  APIConnectionError, APITimeoutError, ValidationError, WebhookVerificationError,
  CommandError); the API key never appears in repr/str.
• Retries: 429 with Retry-After ≤ 60 s for every method; network errors and 502/503/504 for
  GET only; full-jitter backoff; max_retries=0 disables retries.
• Rate-limit information (client.last_rate_limit, error.rate_limit) and raw responses via
  client.with_raw_response.
• Lazy auto-paging iterators (iter_*, sync and async) for players, history and events.
• verify_webhook with constant-time HMAC-SHA256 check, timestamp tolerance and secret
  rotation; WEBHOOK_EVENTS and the WebhookEventName literal type.
• Live console and server-log streams (txapi[live], websockets): async iteration or
  callbacks, send_command with FIFO ack correlation and timeout, automatic reconnect on
  1001/1006/1011/1012 and network loss, no reconnect on 1008/1009 with the close reason surfaced.

fivem

First release, built against txApi 1.8.0 (spec/endpoints.json).

Added

• Server-only FiveM resource txapi (fx_version cerulean, games gta5 and rdr3,
  Lua 5.4, no client scripts).
• All 67 REST endpoints, grouped by area (api.players.ban(...),
  api.server.status(), api.events.leaderboard(...), ...). lib/endpoints.lua is
  generated from spec/endpoints.json by node scripts/gen-endpoints.mjs.
• Library mode: load @txapi/lib/endpoints.lua + @txapi/lib/txapi.lua into your
  own resource and call TxApi.new({...}). Calls block the current thread
  (promise + Citizen.Await) and return data, err, resp; pass a function as the
  last argument to get a callback instead.
• Exports mode: exports.txapi:call('players.ban', params, cb) plus getRateLimit,
  isConfigured, methods and version, configured from convars.
• Configuration via TxApi.new or the convars txapi_key, txapi_server_id and
  txapi_base_url. The key is never printed, never logged and never sent anywhere but
  the Authorization: Bearer header.
• Request building per the SDK spec: serverId on every server-scoped call, path
  parameters percent-encoded, empty arrays and objects encoded as JSON arrays/objects
  regardless of the runtime's JSON library, client-side validation (required fields,
  types, maxLength, unknown parameter names).
• Error values instead of exceptions (BadRequestError, AuthenticationError,
  PermissionDeniedError, NotFoundError, ConflictError, TxAdminRejectedError,
  RateLimitError, TxAdminUnavailableError, ServerError, ApiError,
  ConnectionError, TimeoutError, ValidationError, plus ConfigurationError in
  exports mode) with status, message, retryAfter, quotaExhausted and the raw
  body.
• Retries: per-minute rate limits are waited out (Retry-After when the runtime exposes
  it, otherwise rateLimitRetryDelay), transient failures of GET requests are retried
  with jittered backoff; writes are never repeated. An exhausted monthly quota is
  reported, not retried.
• Rate-limit information in api.lastRateLimit and resp.rateLimit.
• Pagination helpers for player search, history and the event log
  (api.players.searchAll(...), api.history.searchPages(...), ...).
• Optional Discord ban/unban fields on players.ban and history.revoke.
• Example resource with an ACE-protected /txban command (examples/txapi-example).
• Offline test suite (tests/run.sh) running under plain lua5.4 with a mocked
  FiveM runtime.

Not included

• WebSockets (/ws/console, /ws/serverlog): FiveM has no WebSocket client. Use
  api.console.buffer() / api.serverlog.buffer() for a REST snapshot.
• Webhook signature verification: FiveM's Lua runtime has no HMAC-SHA256. Receive
  webhooks with the Node, Python or Java SDK.