@acosmi/sdk-ts 1.3.0 → 1.3.2

package/docs/compliance.md

@@ -80,6 +80,16 @@ await client.login('Read-only Compliance App', [
 Compliance scopes are independent from `ScopeAI`, `ScopeSkills`, and
 `ScopeAccount`. Holding the general scopes does not grant compliance access.
 
+Report scopes are split by action:
+
+- `ScopeComplianceReportsRead` — `getReport`, `downloadReport`.
+- `ScopeComplianceReportsWrite` — `createReport`. This scope was added after the
+  initial release; tokens issued before it existed do **not** carry it. An app
+  that calls `createReport` must request `ScopeComplianceReportsWrite` at
+  `login()` time, and existing users must re-authorize (run the OAuth flow
+  again) so the new scope is granted.
+- `ScopeComplianceReportsPublish` — `publishReport` (also requires step-up).
+
 ## Base URL
 
 `Client` keeps the existing model gateway path under `/api/v4`. Compliance uses
@@ -174,6 +184,13 @@ The public result includes stable evidence and hash fields only. It excludes PII
 contract originals, storage bucket/key values, subject snapshot IDs, provider raw
 payloads, and timestamp authority internals.
 
+`verifyEvidencePublic` is anonymous-capable. It does not require `login()`: when no
+token is available the SDK sends an anonymous request instead of throwing
+`not authorized, call login() first`. When the client already holds a token the
+request carries the `Authorization` header so the backend can keep audit context.
+Unlike authenticated GET reads, public verification never triggers a token
+refresh/replay on `401`.
+
 ## Signing And Provider Request Polling
 
 Signing envelope methods expose the Acosmi workflow state, not provider-specific
@@ -235,6 +252,25 @@ switch (info.key) {
 `CompliancePollError` is used by polling helpers for terminal failure, timeout,
 abort, and unknown states.
 
+## Method Status
+
+Each `client.compliance.*` method has one of four maturity grades. Treat this
+table as the contract — `gated` methods are expected to fail-closed until the
+backend step-up / gate is opened, and the SDK never retries or fakes success
+for them.
+
+| Status | Methods | Meaning |
+| --- | --- | --- |
+| `production-ready` | `createEvidenceAsset`, `getEvidenceAsset`, `verifyEvidencePublic`, `issueTimestamp`, `issueTimestampForAsset`, `getTimestamp`, `verifyTimestamp`, `waitForTimestampVerified`, `buildEvidencePackage`, `createReport`, `getReport`, `downloadReport`, `createSigningEnvelope`, `getSigningEnvelope`, `syncSigningEnvelopeStatus`, `submitSealApproval`, `rejectSealApproval`, `cancelSealApproval`, `listPendingSealApprovals`, `getSealApproval`, `getProviderRequest`, `waitForProviderRequestTerminal`, `classifyError` | Backend endpoint, scope, DTO contract, SDK tests and docs are all closed. Safe to call in production. |
+| `gated` | `publishReport`, `signEnvelope`, `createH5SigningUrl`, `approveSealApproval` | SDK exposes the method, but the backend fails-closed (`COMPLIANCE_STEP_UP_REQUIRED` / `ENVELOPE_GATE_CLOSED`) until step-up and the W3 gate chain are ready. The SDK does not retry and does not fake success — surface the typed error as "feature not yet open". |
+| `draft contract` | operation views, gate-status views, binary download helpers | Type drafts only — not exposed as callable capability in this release. |
+| `internal-only` | distribution billing (`reserve` / `commit` / `cancel` / `reconcile` / `refund`), provider raw payloads, provider callbacks, CFCA controlled materials | Server-side S2S only. Never part of the SDK call surface; no SDK method exists for these. |
+
+`submitSealApproval` is `production-ready`: the backend enforces
+`Idempotency-Key` + business-fingerprint replay protection, so a repeated submit
+with the same key returns the original approval id instead of creating a
+duplicate. Persist the idempotency key on the caller side.
+
 ## Safety Boundary
 
 Do not place any of the following in SDK code, tests, examples, docs, git

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@acosmi/sdk-ts",
-  "version": "1.3.0",
-  "description": "Acosmi 模型网关与 Agent Run Gateway TypeScript SDK — 双格式 (Anthropic + OpenAI) 多端 (浏览器 / Node ≥18 / Deno / Bun)。",
+  "version": "1.3.2",
+  "description": "Acosmi TypeScript SDK：模型网关、Agent Run Gateway 与 Compliance（电子证据、时间章、报告、签署 envelope）统一客户端，支持浏览器 / Node ≥18 / Deno / Bun。",
   "type": "module",
   "main": "./dist/node/index.cjs",
   "module": "./dist/node/index.mjs",
@@ -55,6 +55,10 @@
     "openai",
     "llm",
     "sdk",
+    "compliance",
+    "evidence",
+    "timestamp",
+    "esignature",
     "claude",
     "crabcode",
     "crabclaw"