@acosmi/sdk-ts 1.3.1 → 1.4.0

package/dist/node/adapters/anthropic.d.cts

@@ -1,4 +1,4 @@
-import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent } from '../index-28x02ITB.cjs';
+import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent } from '../index-CbG9NqE-.cjs';
 
 /** 实现 ProviderAdapter, 用于 Anthropic 原生模型 */
 declare class AnthropicAdapter implements ProviderAdapter {

package/dist/node/adapters/anthropic.d.ts

@@ -1,4 +1,4 @@
-import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent } from '../index-28x02ITB.js';
+import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent } from '../index-CbG9NqE-.js';
 
 /** 实现 ProviderAdapter, 用于 Anthropic 原生模型 */
 declare class AnthropicAdapter implements ProviderAdapter {

package/dist/node/adapters/openai.d.cts

@@ -1,4 +1,4 @@
-import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent, A as AnthropicResponse } from '../index-28x02ITB.cjs';
+import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent, A as AnthropicResponse } from '../index-CbG9NqE-.cjs';
 
 /** 实现 ProviderAdapter, 用于所有非 Anthropic 厂商 */
 declare class OpenAIAdapter implements ProviderAdapter {

package/dist/node/adapters/openai.d.ts

@@ -1,4 +1,4 @@
-import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent, A as AnthropicResponse } from '../index-28x02ITB.js';
+import { P as ProviderAdapter, ak as ProviderFormat, c as ModelCapabilities, d as ChatRequest, e as ChatResponse, f as StreamEvent, A as AnthropicResponse } from '../index-CbG9NqE-.js';
 
 /** 实现 ProviderAdapter, 用于所有非 Anthropic 厂商 */
 declare class OpenAIAdapter implements ProviderAdapter {

package/dist/node/{index-28x02ITB.d.cts → index-CbG9NqE-.d.cts}

@@ -1024,4 +1024,4 @@ declare function getAdapter(provider: string): ProviderAdapter;
  */
 declare function getAdapterForModel(m: ManagedModel): ProviderAdapter;
 
-export { type ChatUsage as $, type AnthropicResponse as A, BusinessError as B, type ClientRegistration as C, type ToolView as D, type EntitlementBalance as E, type DeviceRegistration as F, type GenerateSkillRequest as G, type NotificationPreference as H, type InputModality as I, type WSEvent as J, type APIResponse as K, type AnthropicContentBlock as L, type ManagedModel as M, type NotificationList as N, type Order as O, type ProviderAdapter as P, type QuotaSummary as Q, type AnthropicUsage as R, type ServerMetadata as S, type TokenResponse as T, BucketClassCommercial as U, BucketClassGeneric as V, type WalletStats as W, type BucketInfo as X, type BucketRow as Y, type ChatContentBlock as Z, type ChatMessage as _, type TokenSet as a, type ConsumeRecord as a0, type EffortConfig as a1, type GeoLoc as a2, HTTPError as a3, ModelNotFoundError as a4, NetworkError as a5, type Notification as a6, type NotificationUnreadCount as a7, type OpenAIChatChoice as a8, type OpenAIChatMessage as a9, type YudaoPageResult as aA, anthropicResponseTextContent as aB, anthropicResponseThinkingContent as aC, anthropicResponseToolUseBlocks as aD, apiResponseBusinessError as aE, apiResponseGetMessage as aF, bucketInfoIsCommercial as aG, bucketRowIsCommercial as aH, getAdapter as aI, getAdapterForModel as aJ, newThinkingConfig as aK, newWebSearchTool as aL, parseNotificationEvent as aM, parseSettlement as aN, parseSourcesEvent as aO, tokenSetIsExpired as aP, type OpenAIChatResponse as aa, type OpenAIFunctionCall as ab, type OpenAIStreamChoice as ac, type OpenAIStreamChunk as ad, type OpenAIStreamDelta as ae, type OpenAIStreamToolCall as af, type OpenAIToolCall as ag, type OpenAIUsage as ah, OrderTerminalError as ai, type OutputConfig as aj, ProviderFormat as ak, RateLimitError as al, type ServerTool as am, ServerToolTypeWebSearch as an, type SkillStoreListItem as ao, StreamError as ap, type ThinkingConfig as aq, ThinkingHigh as ar, ThinkingHighMinMaxTokens as as, ThinkingMax as at, ThinkingMaxFallbackMaxTokens as au, ThinkingOff as av, type ToolListResponse as aw, type ToolProvider as ax, type WebSearchConfig as ay, type WebSearchSource as az, type ModelCoefficient as b, type ModelCapabilities as c, type ChatRequest as d, type ChatResponse as e, type StreamEvent as f, type SourcesEvent as g, type StreamSettlement as h, type BalanceDetail as i, type EntitlementItem as j, type ConsumeRecordPage as k, type ModelByQuotaResponse as l, type ModelBucket as m, type TokenPackage as n, type PayPayload as o, type OrderStatus as p, type Transaction as q, type SkillStoreQuery as r, type SkillStoreItem as s, type SkillBrowseResponse as t, type SkillBrowseListResponse as u, type SkillSummary as v, type CertificationStatus as w, type GenerateSkillResult as x, type OptimizeSkillRequest as y, type OptimizeSkillResult as z };
+export { type ChatUsage as $, type AnthropicResponse as A, BusinessError as B, type ClientRegistration as C, type ToolView as D, type EntitlementBalance as E, type DeviceRegistration as F, type GenerateSkillRequest as G, type NotificationPreference as H, type InputModality as I, type WSEvent as J, type APIResponse as K, type AnthropicContentBlock as L, type ManagedModel as M, type NotificationList as N, type Order as O, type ProviderAdapter as P, type QuotaSummary as Q, type AnthropicUsage as R, type ServerMetadata as S, type TokenSet as T, BucketClassCommercial as U, BucketClassGeneric as V, type WalletStats as W, type BucketInfo as X, type BucketRow as Y, type ChatContentBlock as Z, type ChatMessage as _, type TokenResponse as a, type ConsumeRecord as a0, type EffortConfig as a1, type GeoLoc as a2, HTTPError as a3, ModelNotFoundError as a4, NetworkError as a5, type Notification as a6, type NotificationUnreadCount as a7, type OpenAIChatChoice as a8, type OpenAIChatMessage as a9, type YudaoPageResult as aA, anthropicResponseTextContent as aB, anthropicResponseThinkingContent as aC, anthropicResponseToolUseBlocks as aD, apiResponseBusinessError as aE, apiResponseGetMessage as aF, bucketInfoIsCommercial as aG, bucketRowIsCommercial as aH, getAdapter as aI, getAdapterForModel as aJ, newThinkingConfig as aK, newWebSearchTool as aL, parseNotificationEvent as aM, parseSettlement as aN, parseSourcesEvent as aO, tokenSetIsExpired as aP, type OpenAIChatResponse as aa, type OpenAIFunctionCall as ab, type OpenAIStreamChoice as ac, type OpenAIStreamChunk as ad, type OpenAIStreamDelta as ae, type OpenAIStreamToolCall as af, type OpenAIToolCall as ag, type OpenAIUsage as ah, OrderTerminalError as ai, type OutputConfig as aj, ProviderFormat as ak, RateLimitError as al, type ServerTool as am, ServerToolTypeWebSearch as an, type SkillStoreListItem as ao, StreamError as ap, type ThinkingConfig as aq, ThinkingHigh as ar, ThinkingHighMinMaxTokens as as, ThinkingMax as at, ThinkingMaxFallbackMaxTokens as au, ThinkingOff as av, type ToolListResponse as aw, type ToolProvider as ax, type WebSearchConfig as ay, type WebSearchSource as az, type ModelCoefficient as b, type ModelCapabilities as c, type ChatRequest as d, type ChatResponse as e, type StreamEvent as f, type SourcesEvent as g, type StreamSettlement as h, type BalanceDetail as i, type EntitlementItem as j, type ConsumeRecordPage as k, type ModelByQuotaResponse as l, type ModelBucket as m, type TokenPackage as n, type PayPayload as o, type OrderStatus as p, type Transaction as q, type SkillStoreQuery as r, type SkillStoreItem as s, type SkillBrowseResponse as t, type SkillBrowseListResponse as u, type SkillSummary as v, type CertificationStatus as w, type GenerateSkillResult as x, type OptimizeSkillRequest as y, type OptimizeSkillResult as z };

package/dist/node/{index-28x02ITB.d.ts → index-CbG9NqE-.d.ts}

@@ -1024,4 +1024,4 @@ declare function getAdapter(provider: string): ProviderAdapter;
  */
 declare function getAdapterForModel(m: ManagedModel): ProviderAdapter;
 
-export { type ChatUsage as $, type AnthropicResponse as A, BusinessError as B, type ClientRegistration as C, type ToolView as D, type EntitlementBalance as E, type DeviceRegistration as F, type GenerateSkillRequest as G, type NotificationPreference as H, type InputModality as I, type WSEvent as J, type APIResponse as K, type AnthropicContentBlock as L, type ManagedModel as M, type NotificationList as N, type Order as O, type ProviderAdapter as P, type QuotaSummary as Q, type AnthropicUsage as R, type ServerMetadata as S, type TokenResponse as T, BucketClassCommercial as U, BucketClassGeneric as V, type WalletStats as W, type BucketInfo as X, type BucketRow as Y, type ChatContentBlock as Z, type ChatMessage as _, type TokenSet as a, type ConsumeRecord as a0, type EffortConfig as a1, type GeoLoc as a2, HTTPError as a3, ModelNotFoundError as a4, NetworkError as a5, type Notification as a6, type NotificationUnreadCount as a7, type OpenAIChatChoice as a8, type OpenAIChatMessage as a9, type YudaoPageResult as aA, anthropicResponseTextContent as aB, anthropicResponseThinkingContent as aC, anthropicResponseToolUseBlocks as aD, apiResponseBusinessError as aE, apiResponseGetMessage as aF, bucketInfoIsCommercial as aG, bucketRowIsCommercial as aH, getAdapter as aI, getAdapterForModel as aJ, newThinkingConfig as aK, newWebSearchTool as aL, parseNotificationEvent as aM, parseSettlement as aN, parseSourcesEvent as aO, tokenSetIsExpired as aP, type OpenAIChatResponse as aa, type OpenAIFunctionCall as ab, type OpenAIStreamChoice as ac, type OpenAIStreamChunk as ad, type OpenAIStreamDelta as ae, type OpenAIStreamToolCall as af, type OpenAIToolCall as ag, type OpenAIUsage as ah, OrderTerminalError as ai, type OutputConfig as aj, ProviderFormat as ak, RateLimitError as al, type ServerTool as am, ServerToolTypeWebSearch as an, type SkillStoreListItem as ao, StreamError as ap, type ThinkingConfig as aq, ThinkingHigh as ar, ThinkingHighMinMaxTokens as as, ThinkingMax as at, ThinkingMaxFallbackMaxTokens as au, ThinkingOff as av, type ToolListResponse as aw, type ToolProvider as ax, type WebSearchConfig as ay, type WebSearchSource as az, type ModelCoefficient as b, type ModelCapabilities as c, type ChatRequest as d, type ChatResponse as e, type StreamEvent as f, type SourcesEvent as g, type StreamSettlement as h, type BalanceDetail as i, type EntitlementItem as j, type ConsumeRecordPage as k, type ModelByQuotaResponse as l, type ModelBucket as m, type TokenPackage as n, type PayPayload as o, type OrderStatus as p, type Transaction as q, type SkillStoreQuery as r, type SkillStoreItem as s, type SkillBrowseResponse as t, type SkillBrowseListResponse as u, type SkillSummary as v, type CertificationStatus as w, type GenerateSkillResult as x, type OptimizeSkillRequest as y, type OptimizeSkillResult as z };
+export { type ChatUsage as $, type AnthropicResponse as A, BusinessError as B, type ClientRegistration as C, type ToolView as D, type EntitlementBalance as E, type DeviceRegistration as F, type GenerateSkillRequest as G, type NotificationPreference as H, type InputModality as I, type WSEvent as J, type APIResponse as K, type AnthropicContentBlock as L, type ManagedModel as M, type NotificationList as N, type Order as O, type ProviderAdapter as P, type QuotaSummary as Q, type AnthropicUsage as R, type ServerMetadata as S, type TokenSet as T, BucketClassCommercial as U, BucketClassGeneric as V, type WalletStats as W, type BucketInfo as X, type BucketRow as Y, type ChatContentBlock as Z, type ChatMessage as _, type TokenResponse as a, type ConsumeRecord as a0, type EffortConfig as a1, type GeoLoc as a2, HTTPError as a3, ModelNotFoundError as a4, NetworkError as a5, type Notification as a6, type NotificationUnreadCount as a7, type OpenAIChatChoice as a8, type OpenAIChatMessage as a9, type YudaoPageResult as aA, anthropicResponseTextContent as aB, anthropicResponseThinkingContent as aC, anthropicResponseToolUseBlocks as aD, apiResponseBusinessError as aE, apiResponseGetMessage as aF, bucketInfoIsCommercial as aG, bucketRowIsCommercial as aH, getAdapter as aI, getAdapterForModel as aJ, newThinkingConfig as aK, newWebSearchTool as aL, parseNotificationEvent as aM, parseSettlement as aN, parseSourcesEvent as aO, tokenSetIsExpired as aP, type OpenAIChatResponse as aa, type OpenAIFunctionCall as ab, type OpenAIStreamChoice as ac, type OpenAIStreamChunk as ad, type OpenAIStreamDelta as ae, type OpenAIStreamToolCall as af, type OpenAIToolCall as ag, type OpenAIUsage as ah, OrderTerminalError as ai, type OutputConfig as aj, ProviderFormat as ak, RateLimitError as al, type ServerTool as am, ServerToolTypeWebSearch as an, type SkillStoreListItem as ao, StreamError as ap, type ThinkingConfig as aq, ThinkingHigh as ar, ThinkingHighMinMaxTokens as as, ThinkingMax as at, ThinkingMaxFallbackMaxTokens as au, ThinkingOff as av, type ToolListResponse as aw, type ToolProvider as ax, type WebSearchConfig as ay, type WebSearchSource as az, type ModelCoefficient as b, type ModelCapabilities as c, type ChatRequest as d, type ChatResponse as e, type StreamEvent as f, type SourcesEvent as g, type StreamSettlement as h, type BalanceDetail as i, type EntitlementItem as j, type ConsumeRecordPage as k, type ModelByQuotaResponse as l, type ModelBucket as m, type TokenPackage as n, type PayPayload as o, type OrderStatus as p, type Transaction as q, type SkillStoreQuery as r, type SkillStoreItem as s, type SkillBrowseResponse as t, type SkillBrowseListResponse as u, type SkillSummary as v, type CertificationStatus as w, type GenerateSkillResult as x, type OptimizeSkillRequest as y, type OptimizeSkillResult as z };

package/dist/node/index.cjs

@@ -1058,7 +1058,7 @@ init_adapters();
 
 // src/auth.ts
 var authTimeoutMs = 3e4;
-async function discover(serverURL, signal) {
+async function discoverWithProfile(serverURL, profile, signal) {
   let parsed;
   try {
     parsed = new URL(serverURL.replace(/\/+$/, ""));
@@ -1066,7 +1066,7 @@ async function discover(serverURL, signal) {
     throw new Error(`discover: invalid server URL: ${e instanceof Error ? e.message : String(e)}`);
   }
   const origin = `${parsed.protocol}//${parsed.host}`;
-  const endpoint = `${origin}/.well-known/oauth-authorization-server/desktop`;
+  const endpoint = `${origin}/.well-known/oauth-authorization-server/${profile}`;
   const ctl = withTimeout(authTimeoutMs, signal);
   let resp;
   try {
@@ -1092,6 +1092,12 @@ async function discover(serverURL, signal) {
   }
   return meta;
 }
+async function discover(serverURL, signal) {
+  return discoverWithProfile(serverURL, "desktop", signal);
+}
+async function discoverWebOAuthMetadata(serverURL, signal) {
+  return discoverWithProfile(serverURL, "web", signal);
+}
 async function register(meta, appName, signal) {
   const regReq = {
     client_name: appName,
@@ -1123,12 +1129,50 @@ async function register(meta, appName, signal) {
     throw new Error(`register: decode: ${e instanceof Error ? e.message : String(e)}`);
   }
 }
-async function generateCodeVerifier() {
+async function registerWebOAuthClient(meta, opts, signal) {
+  const regReq = {
+    client_name: opts.clientName,
+    token_endpoint_auth_method: "none",
+    grant_types: ["authorization_code", "refresh_token"],
+    redirect_uris: opts.redirectURIs,
+    response_types: ["code"],
+    ...opts.scopes ? { scope: opts.scopes.join(" ") } : {}
+  };
+  const ctl = withTimeout(authTimeoutMs, signal);
+  let resp;
+  try {
+    resp = await fetch(meta.registration_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(regReq),
+      signal: ctl.signal
+    });
+  } catch (e) {
+    throw new Error(`register: ${e instanceof Error ? e.message : String(e)}`);
+  } finally {
+    ctl.dispose();
+  }
+  if (resp.status !== 200 && resp.status !== 201) {
+    throw new Error(`register: HTTP ${resp.status}`);
+  }
+  try {
+    return await resp.json();
+  } catch (e) {
+    throw new Error(`register: decode: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+async function randomBase64Url32() {
   const c = await getCrypto();
   const b = new Uint8Array(32);
   c.getRandomValues(b);
   return base64urlNoPad(b);
 }
+async function generateCodeVerifier() {
+  return randomBase64Url32();
+}
+async function generateState() {
+  return randomBase64Url32();
+}
 async function codeChallenge(verifier) {
   const c = await getCrypto();
   const buf = await c.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
@@ -1162,6 +1206,7 @@ var ErrAuthDenied = "auth_denied";
 var ErrTimeout = "auth_timeout";
 var ErrTokenExchange = "token_exchange_failed";
 var ErrSSLProxy = "ssl_proxy_detected";
+var ErrStateMismatch = "state_mismatch";
 function isSSLError(err) {
   const msg = err instanceof Error ? err.message : String(err);
   return msg.includes("tls:") || msg.includes("x509:") || msg.includes("certificate");
@@ -1275,6 +1320,51 @@ async function authorize(meta, clientID, scopes, opts = {}) {
 function htmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+async function createWebAuthorizationRequest(meta, opts) {
+  const verifier = await generateCodeVerifier();
+  const challenge = await codeChallenge(verifier);
+  const state = await generateState();
+  const authURL = new URL(meta.authorization_endpoint);
+  authURL.searchParams.set("response_type", "code");
+  authURL.searchParams.set("client_id", opts.clientID);
+  authURL.searchParams.set("redirect_uri", opts.redirectURI);
+  authURL.searchParams.set("code_challenge", challenge);
+  authURL.searchParams.set("code_challenge_method", "S256");
+  authURL.searchParams.set("state", state);
+  authURL.searchParams.set("scope", opts.scopes.join(" "));
+  if (opts.loginHint) {
+    authURL.searchParams.set("login_hint", opts.loginHint);
+  }
+  return {
+    authUrl: authURL.toString(),
+    state,
+    verifier,
+    clientID: opts.clientID,
+    redirectURI: opts.redirectURI,
+    serverURL: opts.serverURL,
+    createdAt: Date.now()
+  };
+}
+async function completeWebAuthorizationRequest(pending, params, signal) {
+  if (!params.code) {
+    throw new Error("completeWebAuthorizationRequest: missing authorization code");
+  }
+  if (params.state !== pending.state) {
+    throw new Error(
+      `completeWebAuthorizationRequest: ${ErrStateMismatch}: callback state does not match pending state (possible CSRF)`
+    );
+  }
+  const meta = await discoverWebOAuthMetadata(pending.serverURL, signal);
+  const resp = await exchangeCode(
+    meta,
+    pending.clientID,
+    params.code,
+    pending.redirectURI,
+    pending.verifier,
+    signal
+  );
+  return newTokenSet(resp, pending.clientID, pending.serverURL);
+}
 async function exchangeCode(meta, clientID, code, redirectURI, codeVerifier, signal) {
   const data = new URLSearchParams({
     grant_type: "authorization_code",
@@ -1441,6 +1531,7 @@ var ScopeComplianceSealApprovalRequest = "compliance:seal_approval:request";
 var ScopeComplianceSealApprovalApprove = "compliance:seal_approval:approve";
 var ScopeComplianceSealUseExecute = "compliance:seal_use:execute";
 var ScopeComplianceReportsRead = "compliance:reports:read";
+var ScopeComplianceReportsWrite = "compliance:reports:write";
 var ScopeComplianceReportsPublish = "compliance:reports:publish";
 function allScopes() {
   return [ScopeAI, ScopeSkills, ScopeAccount];
@@ -1458,6 +1549,7 @@ function complianceScopes() {
     ScopeComplianceSealApprovalApprove,
     ScopeComplianceSealUseExecute,
     ScopeComplianceReportsRead,
+    ScopeComplianceReportsWrite,
     ScopeComplianceReportsPublish
   ];
 }
@@ -2165,6 +2257,8 @@ var Client = class _Client {
   serverURL;
   /** Compliance API 根地址 (已 trim 尾随 /); null = 走默认 ${serverURL}/admin-api */
   complianceBaseURL;
+  /** OAuth metadata profile — 刷新 token 时发现 metadata 用 (默认 'desktop') */
+  oauthMetadataProfile;
   /** OAuth metadata (lazy loaded) */
   meta = null;
   /** 当前 token (内存) */
@@ -2199,6 +2293,7 @@ var Client = class _Client {
   constructor(cfg = {}) {
     this.serverURL = (cfg.serverURL ?? "https://acosmi.com").replace(/\/+$/, "");
     this.complianceBaseURL = cfg.complianceBaseURL ? cfg.complianceBaseURL.replace(/\/+$/, "") : null;
+    this.oauthMetadataProfile = cfg.oauthMetadataProfile ?? "desktop";
     this.store = cfg.store ?? defaultTokenStore();
     this.fetchImpl = cfg.fetchImpl ?? globalThis.fetch.bind(globalThis);
     this.retryPolicy = effectivePolicy(cfg.retryPolicy ?? null);
@@ -2373,7 +2468,7 @@ var Client = class _Client {
     if (tokens) {
       if (!meta) {
         try {
-          meta = await discover(this.serverURL, signal);
+          meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
         } catch (e) {
           console.warn(`[acosmi-sdk] warning: discover for revocation failed: ${e instanceof Error ? e.message : String(e)}`);
         }
@@ -2444,7 +2539,7 @@ var Client = class _Client {
         }
         if (this.meta == null) {
           try {
-            this.meta = await discover(this.serverURL, signal);
+            this.meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
           } catch (e) {
             throw new Error(
               `discover for refresh: ${e instanceof Error ? e.message : String(e)}`
@@ -2476,7 +2571,7 @@ var Client = class _Client {
           throw new Error("no tokens to refresh");
         }
         if (this.meta == null) {
-          this.meta = await discover(this.serverURL, signal);
+          this.meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
         }
         const tokenResp = await refreshToken(
           this.meta,
@@ -3328,17 +3423,20 @@ var ComplianceClient = class {
   }
   /**
    * 公开 verify。隐私边界：返回字段不含 PII / 合同原文 / storage / provider raw。
-   * 服务端不要求 compliance scope（公开端点）；但 SDK 仍带上 token 以便审计。
+   *
+   * 匿名可调用：未 login 时走匿名请求，不会抛 `not authorized, call login() first`。
+   * 已 login / 已持有 token 时附带 `Authorization` 以保留审计上下文。public 端点不
+   * 应要求认证 — 收到 401 直接抛 HTTPError，不触发 `forceRefresh`，也不做 refresh
+   * replay。
    */
   verifyEvidencePublic(params, signal) {
     const q = new URLSearchParams();
     if (params.evidenceNo) q.set("evidenceNo", params.evidenceNo);
     if (params.publicVerifyCode) q.set("publicVerifyCode", params.publicVerifyCode);
     const qs = q.toString();
-    return this.read(
+    return this.publicRead(
       "GET",
       `/compliance/evidence/verify${qs ? "?" + qs : ""}`,
-      null,
       signal
     );
   }
@@ -3422,9 +3520,10 @@ var ComplianceClient = class {
   /**
    * 发布报告（写，step-up 必须）。
    *
-   * 缺少 step-up 时服务端会返回 `COMPLIANCE_STEP_UP_REQUIRED`（数值码
-   * 1031000013）。SDK 不会自动重试；调用方需要引导用户重新做 OAuth introspection 或
-   * 重新登录后再次调用本方法（使用同一 idempotency-key）。
+   * `@status gated` — step-up 闸门未闭合前服务端会一致返回
+   * `COMPLIANCE_STEP_UP_REQUIRED`（数值码 1031000013）。SDK 不会自动重试、不伪成功；
+   * 调用方需要引导用户重新做 OAuth introspection 或重新登录后再次调用本方法
+   *（使用同一 idempotency-key）。方法状态分级见 `docs/compliance.md` Method Status。
    */
   publishReport(id, opts = {}) {
     return this.write(
@@ -3471,7 +3570,7 @@ var ComplianceClient = class {
   /**
    * 正式签署（写，step-up 必须）。
    *
-   * 服务端闸门关闭时会一致返回 `ENVELOPE_GATE_CLOSED` (1031004004)。
+   * `@status gated` — 服务端闸门关闭时会一致返回 `ENVELOPE_GATE_CLOSED` (1031004004)。
    * SDK 不重试、不伪成功；调用方应该将该错误展示为"功能未开放"。
    */
   signEnvelope(envelopeId, req, opts = {}) {
@@ -3485,7 +3584,7 @@ var ComplianceClient = class {
   /**
    * 创建 H5 签署短链（写，step-up 必须）。
    *
-   * 同上：服务端闸门关闭时 SDK 不重试。
+   * `@status gated` — 同 {@link signEnvelope}：服务端闸门关闭时 SDK 不重试、不伪成功。
    */
   createH5SigningUrl(envelopeId, req, opts = {}) {
     return this.write(
@@ -3507,6 +3606,13 @@ var ComplianceClient = class {
   // =========================================================================
   // Seal Approval
   // =========================================================================
+  /**
+   * 提交用印审批申请（写）。
+   *
+   * `@status production-ready` — 服务端以 `Idempotency-Key` + 业务请求指纹做重放保护：
+   * 同 key + 同请求 → 返回原审批 id；同 key + 不同请求 → 拒绝复用幂等键。强烈建议调用方
+   * 持久化 `idempotencyKey`，网络重试 / 任务恢复时复用，避免重复创建审批单。
+   */
   submitSealApproval(req, opts = {}) {
     return this.write(
       "POST",
@@ -3515,6 +3621,12 @@ var ComplianceClient = class {
       writeCtx(opts)
     );
   }
+  /**
+   * 审批通过用印申请（写，step-up 必须）。
+   *
+   * `@status gated` — step-up 未闭合前服务端会返回 `COMPLIANCE_STEP_UP_REQUIRED`。
+   * SDK 不重试、不伪成功。方法状态分级见 `docs/compliance.md` Method Status。
+   */
   approveSealApproval(id, query, opts = {}) {
     const q = new URLSearchParams();
     if (query.expiresAt) q.set("expiresAt", query.expiresAt);
@@ -3612,6 +3724,38 @@ var ComplianceClient = class {
       extraHeaders
     });
   }
+  /**
+   * 公开读路径：public verify。
+   *
+   * 与 {@link read} 的区别 — public 端点不应要求认证：
+   *   - 无 token 时匿名请求：ensureToken 抛 `not authorized` 会被吞掉，继续匿名发送。
+   *   - 有 token 时附带 `Authorization`，保留后端审计上下文。
+   *   - 不做 401 refresh replay：401 直接抛 HTTPError，不触发 `forceRefresh`。
+   *
+   * URL 仍走 `client.complianceURL(path)`，不复用 `/api/v4`；底层复用
+   * `client.doRequest`，不新增 fetch/axios 直连。
+   */
+  async publicRead(method, path, signal) {
+    let token = "";
+    try {
+      token = await this.client.ensureToken(signal);
+    } catch {
+    }
+    const url = this.client.complianceURL(path);
+    const headers = { Accept: "application/json" };
+    if (token) headers.Authorization = `Bearer ${token}`;
+    const resp = await this.client.doRequest({ method, url, headers }, signal);
+    if (resp.status < 200 || resp.status >= 300) {
+      const bodyBytes = resp.body ? await readLimited(resp.body, maxErrorBodySize) : new Uint8Array();
+      throw parseHTTPErrorWithHeader(resp.status, bodyBytes, resp.headers);
+    }
+    const text = await resp.text();
+    if (!text) return void 0;
+    const parsed = JSON.parse(text);
+    const bizErr = apiResponseBusinessError(parsed);
+    if (bizErr) throw bizErr;
+    return parsed.data;
+  }
   /**
    * 写路径：POST。
    * - 发送前 ensureToken 一次确保 token fresh。
@@ -5346,6 +5490,7 @@ exports.ErrSealApprovalNotApproved = ErrSealApprovalNotApproved;
 exports.ErrSealApprovalSealMismatch = ErrSealApprovalSealMismatch;
 exports.ErrSealApprovalTransactorMismatch = ErrSealApprovalTransactorMismatch;
 exports.ErrSealUseAlreadyConsumed = ErrSealUseAlreadyConsumed;
+exports.ErrStateMismatch = ErrStateMismatch;
 exports.ErrTimeout = ErrTimeout;
 exports.ErrTokenExchange = ErrTokenExchange;
 exports.EventAuthURL = EventAuthURL;
@@ -5371,6 +5516,7 @@ exports.ScopeComplianceEvidenceRead = ScopeComplianceEvidenceRead;
 exports.ScopeComplianceEvidenceWrite = ScopeComplianceEvidenceWrite;
 exports.ScopeComplianceReportsPublish = ScopeComplianceReportsPublish;
 exports.ScopeComplianceReportsRead = ScopeComplianceReportsRead;
+exports.ScopeComplianceReportsWrite = ScopeComplianceReportsWrite;
 exports.ScopeComplianceSealApprovalApprove = ScopeComplianceSealApprovalApprove;
 exports.ScopeComplianceSealApprovalRequest = ScopeComplianceSealApprovalRequest;
 exports.ScopeComplianceSealManage = ScopeComplianceSealManage;
@@ -5400,17 +5546,22 @@ exports.bucketRowIsCommercial = bucketRowIsCommercial;
 exports.buildBetas = buildBetas;
 exports.classifyComplianceError = classifyComplianceError;
 exports.commerceScopes = commerceScopes;
+exports.completeWebAuthorizationRequest = completeWebAuthorizationRequest;
 exports.complianceScopes = complianceScopes;
 exports.computeBackoff = computeBackoff;
+exports.createWebAuthorizationRequest = createWebAuthorizationRequest;
 exports.defaultRetryable = defaultRetryable;
 exports.defaultSafeToRetry = defaultSafeToRetry;
 exports.discover = discover;
+exports.discoverWebOAuthMetadata = discoverWebOAuthMetadata;
+exports.discoverWithProfile = discoverWithProfile;
 exports.effectivePolicy = effectivePolicy;
 exports.exchangeCode = exchangeCode;
 exports.extractAnthropicBlockMeta = extractAnthropicBlockMeta;
 exports.fileLockDefaults = fileLockDefaults;
 exports.findDesktopVisualUnderstandingModel = findDesktopVisualUnderstandingModel;
 exports.findFirstModelByInputModality = findFirstModelByInputModality;
+exports.generateState = generateState;
 exports.getAdapter = getAdapter;
 exports.getAdapterForModel = getAdapterForModel;
 exports.isBillingConfirmable = isBillingConfirmable;
@@ -5429,6 +5580,7 @@ exports.parseSettlement = parseSettlement;
 exports.parseSourcesEvent = parseSourcesEvent;
 exports.refreshToken = refreshToken;
 exports.register = register;
+exports.registerWebOAuthClient = registerWebOAuthClient;
 exports.revokeToken = revokeToken;
 exports.sanitize = sanitize_exports;
 exports.skillScopes = skillScopes;