@unitfield/connect

The official, dependency-free JavaScript/TypeScript client for Unitfield Connect. It uses the platform fetch API and works in browsers, server routes, and serverless functions.

This package is ESM-only and covers the documented Connect runtime routes: organization, listings, rental applications, payments, and Checkout Sessions. Connect management routes intentionally remain API-documentation-only because they require a Unitfield user session, tenant context, and RBAC.

npm install @unitfield/connect

Browser or delegated-token usage

import { createConnectClient } from "@unitfield/connect";

const connect = createConnectClient({
  baseUrl: "https://api.unitfield.com",
  accessToken: "issued-access-token",
});

const organization = await connect.getOrganization();
const listings = await connect.listListings({ page: 1, pageSize: 20 });

The main export accepts an access token or a token provider. It never accepts or stores a confidential client credential. Keep client credentials on a trusted server and use the server entry point there:

import { createConnectClient } from "@unitfield/connect";
import { createClientCredentialsTokenProvider } from "@unitfield/connect/server";

const connect = createConnectClient({
  baseUrl: process.env.UNITFIELD_CONNECT_BASE_URL!,
  tokenProvider: createClientCredentialsTokenProvider({
    tokenUrl: process.env.UNITFIELD_AUTH_TOKEN_URL!,
    clientId: process.env.UNITFIELD_CONNECT_CLIENT_ID!,
    clientSecret: process.env.UNITFIELD_CONNECT_CLIENT_SECRET!,
    scopes: ["connect.listings.read", "connect.payments.read"],
  }),
});

Supported helpers

• getOrganization()
• listListings(filters?) and getListing(unitPublicId)
• sendApplicationOtp(...), verifyApplicationOtp(...), and getApplicationDraft(...)
• saveApplicationStep(...), uploadDraftAttachment(...), and submitApplication(...)
• getPaymentReadiness() and getPaymentStatus(paymentPublicId)
• createScreeningCheckoutSession(...) and createLeaseCheckoutSession(...)
• request<T>(path, options?) for lower-level access to other runtime routes

Checkout and application-submit mutations require idempotencyKey in their request options. API failures reject with ConnectError, including the HTTP status, API code, trace/request/correlation/support fields, and available rate-limit and Retry-After metadata. An AbortError is passed through.

The checkout response clientSecret is a provider Payment Element secret for the browser checkout flow; it is not an OAuth client credential.

Licensed under the MIT License. See LICENSE.

Publishing

Authenticate to the @unitfield npm scope and publish an unused version from this directory:

npm whoami
npm publish --dry-run --access public
npm publish --access public

Run the repository-level pnpm audit and pnpm check gates first.