@acosmi/sdk-ts 1.4.1 → 1.5.0

package/dist/browser/index.mjs

@@ -8,11 +8,7 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/types.ts
-function tokenSetIsExpired(t) {
-  const expiresAt = new Date(t.expires_at).getTime();
-  return Date.now() > expiresAt - 3e4;
-}
+// src/models/types.ts
 function bucketInfoIsCommercial(b) {
   if (!b) return false;
   return b.bucketClass.toLowerCase() === BucketClassCommercial.toLowerCase();
@@ -60,23 +56,6 @@ function parseSourcesEvent(ev) {
   }
   return { sources: wrapper.sources, session_id: wrapper.session_id };
 }
-function anthropicResponseTextContent(r) {
-  const parts = [];
-  for (const b of r.content) {
-    if (b.type === "text" && b.text) parts.push(b.text);
-  }
-  return parts.join("");
-}
-function anthropicResponseThinkingContent(r) {
-  const parts = [];
-  for (const b of r.content) {
-    if (b.type === "thinking" && b.thinking) parts.push(b.thinking);
-  }
-  return parts.join("");
-}
-function anthropicResponseToolUseBlocks(r) {
-  return r.content.filter((b) => b.type === "tool_use");
-}
 function parseSettlement(ev) {
   if (ev.event !== "settled" && ev.event !== "pending_settle") {
     return null;
@@ -97,36 +76,9 @@ function parseSettlement(ev) {
     callRemaining: s.callRemaining ?? -1
   };
 }
-function apiResponseGetMessage(r) {
-  return r.message ?? r.msg ?? "";
-}
-function apiResponseBusinessError(r) {
-  if (r.code !== 0) {
-    return new BusinessError(r.code, apiResponseGetMessage(r));
-  }
-  return null;
-}
-function parseNotificationEvent(ev) {
-  if (ev.type !== "event" || ev.topic !== "system") {
-    return null;
-  }
-  if (ev.data == null) return null;
-  let n;
-  try {
-    if (typeof ev.data === "string") {
-      n = JSON.parse(ev.data);
-    } else {
-      n = ev.data;
-    }
-  } catch {
-    return null;
-  }
-  if (!n.id) return null;
-  return n;
-}
-var BucketClassCommercial, BucketClassGeneric, ThinkingOff, ThinkingHigh, ThinkingMax, ThinkingHighMinMaxTokens, ThinkingMaxFallbackMaxTokens, ServerToolTypeWebSearch, RateLimitError, BusinessError, OrderTerminalError, ModelNotFoundError, HTTPError, NetworkError, StreamError;
+var BucketClassCommercial, BucketClassGeneric, ThinkingOff, ThinkingHigh, ThinkingMax, ThinkingHighMinMaxTokens, ThinkingMaxFallbackMaxTokens, ServerToolTypeWebSearch;
 var init_types = __esm({
-  "src/types.ts"() {
+  "src/models/types.ts"() {
     BucketClassCommercial = "COMMERCIAL";
     BucketClassGeneric = "GENERIC";
     ThinkingOff = "off";
@@ -135,6 +87,13 @@ var init_types = __esm({
     ThinkingHighMinMaxTokens = 32e3;
     ThinkingMaxFallbackMaxTokens = 128e3;
     ServerToolTypeWebSearch = "web_search_20250305";
+  }
+});
+
+// src/shared/errors.ts
+var RateLimitError, BusinessError, OrderTerminalError, ModelNotFoundError, HTTPError, NetworkError, StreamError;
+var init_errors = __esm({
+  "src/shared/errors.ts"() {
     RateLimitError = class extends Error {
       retryAfter;
       raw;
@@ -254,7 +213,7 @@ var init_types = __esm({
   }
 });
 
-// src/betas.ts
+// src/models/betas.ts
 function buildBetas(caps, req) {
   const betas = [];
   if (caps.supports_isp) {
@@ -301,7 +260,7 @@ function uniqueMerge(base, extra) {
 }
 var betaInterleavedThinking, betaContext1M, betaContextManagement, betaStructuredOutputs, betaAdvancedToolUse, betaEffort, betaPromptCachingScope, betaFastMode, betaRedactThinking, betaTokenEfficientTools;
 var init_betas = __esm({
-  "src/betas.ts"() {
+  "src/models/betas.ts"() {
     init_types();
     betaInterleavedThinking = "interleaved-thinking-2025-05-14";
     betaContext1M = "context-1m-2025-08-07";
@@ -316,7 +275,7 @@ var init_betas = __esm({
   }
 });
 
-// src/adapters/anthropic.ts
+// src/models/adapters/anthropic.ts
 function resolveThinkingLevel(body, req, caps) {
   const level = req.thinking?.level ?? "";
   if (level === ThinkingOff) {
@@ -363,8 +322,9 @@ function resolveThinkingLevel(body, req, caps) {
 }
 var AnthropicAdapter;
 var init_anthropic = __esm({
-  "src/adapters/anthropic.ts"() {
+  "src/models/adapters/anthropic.ts"() {
     init_types();
+    init_errors();
     init_betas();
     init_adapters();
     AnthropicAdapter = class {
@@ -498,7 +458,7 @@ var init_anthropic = __esm({
   }
 });
 
-// src/adapters/openai.ts
+// src/models/adapters/openai.ts
 var openai_exports = {};
 __export(openai_exports, {
   OpenAIAdapter: () => OpenAIAdapter,
@@ -693,8 +653,9 @@ function newOpenAIStreamConverter() {
 }
 var OpenAIAdapter, OpenAIStreamConverter;
 var init_openai = __esm({
-  "src/adapters/openai.ts"() {
+  "src/models/adapters/openai.ts"() {
     init_types();
+    init_errors();
     init_adapters();
     OpenAIAdapter = class {
       format() {
@@ -962,7 +923,7 @@ var init_openai = __esm({
   }
 });
 
-// src/adapters/index.ts
+// src/models/adapters/index.ts
 function getAdapter(provider) {
   const a = adapterRegistry[provider.toLowerCase()];
   if (a) return a;
@@ -994,7 +955,7 @@ function getAdapterForModel(m) {
 }
 var ProviderFormat, adapterRegistry, defaultOpenAIAdapter;
 var init_adapters = __esm({
-  "src/adapters/index.ts"() {
+  "src/models/adapters/index.ts"() {
     init_anthropic();
     init_openai();
     ProviderFormat = /* @__PURE__ */ ((ProviderFormat2) => {
@@ -1011,50 +972,31 @@ var init_adapters = __esm({
   }
 });
 
-// src/index.ts
+// src/core/client.ts
 init_types();
 
-// src/model-helpers.ts
-function modelSupportsInputModality(model, modality) {
-  if (!model) return false;
-  const mods = model.inputModalities;
-  if (!Array.isArray(mods)) return false;
-  return mods.includes(modality);
+// src/auth/types.ts
+function tokenSetIsExpired(t) {
+  const expiresAt = new Date(t.expires_at).getTime();
+  return Date.now() > expiresAt - 3e4;
 }
-function modelSupportsImageInput(model) {
-  return modelSupportsInputModality(model, "image");
+
+// src/core/client.ts
+init_errors();
+
+// src/shared/api-response.ts
+init_errors();
+function apiResponseGetMessage(r) {
+  return r.message ?? r.msg ?? "";
 }
-function findFirstModelByInputModality(models, modality) {
-  if (!Array.isArray(models)) return null;
-  for (const m of models) {
-    if (!m) continue;
-    if (m.isEnabled === false) continue;
-    if (!modelSupportsInputModality(m, modality)) continue;
-    return m;
+function apiResponseBusinessError(r) {
+  if (r.code !== 0) {
+    return new BusinessError(r.code, apiResponseGetMessage(r));
   }
   return null;
 }
-function findDesktopVisualUnderstandingModel(models) {
-  if (!Array.isArray(models)) return null;
-  const candidates = [];
-  for (const m of models) {
-    if (!m) continue;
-    if (m.isEnabled === false) continue;
-    if (m.capabilities?.supports_desktop_visual_understanding !== true) continue;
-    if (!modelSupportsInputModality(m, "image")) continue;
-    candidates.push(m);
-  }
-  if (candidates.length === 0) return null;
-  for (const m of candidates) {
-    if (m.isDefault === true) return m;
-  }
-  return candidates[0];
-}
-
-// src/index.ts
-init_adapters();
 
-// src/auth.ts
+// src/auth/auth.ts
 var authTimeoutMs = 3e4;
 async function discoverWithProfile(serverURL, profile, signal) {
   let parsed;
@@ -1504,251 +1446,29 @@ function withTimeout(ms, parent) {
   };
 }
 
-// src/scopes.ts
-var ScopeAI = "ai";
-var ScopeSkills = "skills";
-var ScopeAccount = "account";
-var ScopeModels = "models";
-var ScopeModelsChat = "models:chat";
-var ScopeEntitlements = "entitlements";
-var ScopeTokenPackages = "token-packages";
-var ScopeSkillStore = "skill_store";
-var ScopeTools = "tools";
-var ScopeToolsExecute = "tools:execute";
-var ScopeWallet = "wallet";
-var ScopeWalletReadonly = "wallet:readonly";
-var ScopeProfile = "profile";
-var ScopeComplianceEvidenceRead = "compliance:evidence:read";
-var ScopeComplianceEvidenceWrite = "compliance:evidence:write";
-var ScopeComplianceTimestampIssue = "compliance:timestamp:issue";
-var ScopeComplianceTimestampVerify = "compliance:timestamp:verify";
-var ScopeComplianceContractSigningRead = "compliance:contract_signing:read";
-var ScopeComplianceContractSigningWrite = "compliance:contract_signing:write";
-var ScopeComplianceSealManage = "compliance:seal:manage";
-var ScopeComplianceSealApprovalRequest = "compliance:seal_approval:request";
-var ScopeComplianceSealApprovalApprove = "compliance:seal_approval:approve";
-var ScopeComplianceSealUseExecute = "compliance:seal_use:execute";
-var ScopeComplianceReportsRead = "compliance:reports:read";
-var ScopeComplianceReportsWrite = "compliance:reports:write";
-var ScopeComplianceReportsPublish = "compliance:reports:publish";
-function allScopes() {
-  return [ScopeAI, ScopeSkills, ScopeAccount];
-}
-function complianceScopes() {
-  return [
-    ScopeComplianceEvidenceRead,
-    ScopeComplianceEvidenceWrite,
-    ScopeComplianceTimestampIssue,
-    ScopeComplianceTimestampVerify,
-    ScopeComplianceContractSigningRead,
-    ScopeComplianceContractSigningWrite,
-    ScopeComplianceSealManage,
-    ScopeComplianceSealApprovalRequest,
-    ScopeComplianceSealApprovalApprove,
-    ScopeComplianceSealUseExecute,
-    ScopeComplianceReportsRead,
-    ScopeComplianceReportsWrite,
-    ScopeComplianceReportsPublish
-  ];
-}
-function modelScopes() {
-  return [ScopeAI];
-}
-function commerceScopes() {
-  return [ScopeAI, ScopeAccount];
-}
-function skillScopes() {
-  return [ScopeSkills];
-}
-
-// src/compliance-status.ts
-var ErrComplianceStepUpRequired = "COMPLIANCE_STEP_UP_REQUIRED";
-var ErrEnvelopeGateClosed = "ENVELOPE_GATE_CLOSED";
-var ErrProviderNotConfigured = "PROVIDER_NOT_CONFIGURED";
-var ErrProviderUnknownNoRetry = "PROVIDER_REQUEST_UNKNOWN_NO_RETRY";
-var ErrBillingCallbackCannotCommit = "BILLING_CALLBACK_CANNOT_COMMIT";
-var ErrBillingCommitRequiresLocalVerify = "BILLING_COMMIT_REQUIRES_LOCAL_VERIFY";
-var ErrBillingS2sForbidden = "BILLING_S2S_FORBIDDEN";
-var ErrSealApprovalNotApproved = "SEAL_APPROVAL_STATE_NOT_APPROVED";
-var ErrSealApprovalExpired = "SEAL_APPROVAL_EXPIRED";
-var ErrSealApprovalNonceUsed = "SEAL_APPROVAL_NONCE_USED";
-var ErrSealApprovalContractHashMismatch = "SEAL_APPROVAL_CONTRACT_HASH_MISMATCH";
-var ErrSealApprovalSealMismatch = "SEAL_APPROVAL_SEAL_MISMATCH";
-var ErrSealApprovalLocationMismatch = "SEAL_APPROVAL_LOCATION_MISMATCH";
-var ErrSealApprovalTransactorMismatch = "SEAL_APPROVAL_TRANSACTOR_MISMATCH";
-var ErrSealUseAlreadyConsumed = "SEAL_USE_ALREADY_CONSUMED";
-function isComplianceTerminalError(code) {
-  switch (code) {
-    case ErrEnvelopeGateClosed:
-    case ErrProviderNotConfigured:
-    case ErrProviderUnknownNoRetry:
-    case ErrBillingCallbackCannotCommit:
-    case ErrBillingCommitRequiresLocalVerify:
-    case ErrBillingS2sForbidden:
-    case ErrSealApprovalNonceUsed:
-    case ErrSealApprovalExpired:
-    case ErrSealApprovalContractHashMismatch:
-    case ErrSealApprovalSealMismatch:
-    case ErrSealApprovalLocationMismatch:
-    case ErrSealApprovalTransactorMismatch:
-    case ErrSealUseAlreadyConsumed:
-      return true;
-    default:
-      return false;
-  }
-}
-function isBillingConfirmable(providerStatus, billingStatus) {
-  return providerStatus === "success" && billingStatus === "committed";
-}
-
-// src/compliance-errors.ts
-var CODE_TO_KEY = {
-  // 通用 / token / scope (1-031-000-xxx)
-  1031000001: "COMPLIANCE_UNAUTHORIZED",
-  1031000002: "COMPLIANCE_TOKEN_INVALID",
-  1031000003: "COMPLIANCE_TOKEN_INVALID",
-  1031000004: "COMPLIANCE_TOKEN_INVALID",
-  1031000005: "COMPLIANCE_TOKEN_INVALID",
-  1031000006: "COMPLIANCE_TOKEN_INVALID",
-  1031000007: "COMPLIANCE_TOKEN_INVALID",
-  1031000008: "COMPLIANCE_TOKEN_INVALID",
-  1031000009: "COMPLIANCE_TOKEN_INVALID",
-  1031000010: "COMPLIANCE_TOKEN_INVALID",
-  1031000011: "COMPLIANCE_TOKEN_INVALID",
-  1031000012: "COMPLIANCE_INSUFFICIENT_SCOPE",
-  1031000013: "COMPLIANCE_STEP_UP_REQUIRED",
-  // Subject snapshot (1-031-001-xxx)
-  1031001001: "SUBJECT_SNAPSHOT_NOT_FOUND",
-  1031001002: "SUBJECT_SNAPSHOT_TENANT_MISMATCH",
-  1031001003: "SUBJECT_SNAPSHOT_REQUIRED",
-  // Evidence / Timestamp / Package / Report (1-031-002-xxx)
-  1031002001: "EVIDENCE_ASSET_NOT_FOUND",
-  1031002002: "SUBJECT_SNAPSHOT_TENANT_MISMATCH",
-  1031002003: "EVIDENCE_ASSET_HASH_MISMATCH",
-  1031002004: "EVIDENCE_ASSET_PAYLOAD_REQUIRED",
-  1031002005: "EVIDENCE_ASSET_PAYLOAD_REQUIRED",
-  1031002006: "TIMESTAMP_TOKEN_NOT_FOUND",
-  1031002007: "TIMESTAMP_PROVIDER_FAILED",
-  1031002008: "TIMESTAMP_PROVIDER_UNKNOWN",
-  1031002009: "TIMESTAMP_LOCAL_VERIFY_FAILED",
-  1031002010: "TIMESTAMP_PROVIDER_NOT_AVAILABLE",
-  1031002011: "EVIDENCE_PACKAGE_NOT_FOUND",
-  1031002012: "EVIDENCE_PACKAGE_TIMESTAMP_REQUIRED",
-  1031002013: "EVIDENCE_PACKAGE_MANIFEST_HASH_MISMATCH",
-  1031002014: "REPORT_NOT_FOUND",
-  1031002015: "REPORT_ALREADY_PUBLISHED",
-  1031002016: "REPORT_DRAFT_REQUIRED",
-  1031002017: "EVIDENCE_VERIFY_TARGET_REQUIRED",
-  1031002018: "EVIDENCE_VERIFY_TARGET_NOT_FOUND",
-  // Provider request (1-031-003-xxx)
-  1031003001: "PROVIDER_REQUEST_UNKNOWN_NO_RETRY",
-  1031003002: "PROVIDER_CALLBACK_SOURCE_INVALID",
-  1031003003: "PROVIDER_NOT_CONFIGURED",
-  1031003010: "PROVIDER_REQUEST_NOT_FOUND",
-  1031003011: "PROVIDER_REQUEST_IDEMPOTENCY_REQUIRED",
-  1031003012: "PROVIDER_REQUEST_STATUS_NOT_TERMINAL",
-  // Envelope (1-031-004-xxx)
-  1031004001: "ENVELOPE_NOT_FOUND",
-  1031004002: "ENVELOPE_TENANT_MISMATCH",
-  1031004003: "ENVELOPE_STATE_NOT_ALLOWED",
-  1031004004: "ENVELOPE_GATE_CLOSED",
-  1031004005: "CONTRACT_NOT_FOUND",
-  1031004006: "CONTRACT_HASH_MISMATCH",
-  1031004007: "CONTRACT_NOT_FOUND",
-  1031004008: "PROVIDER_AUTHORIZATION_NOT_CONFIRMED",
-  1031004009: "PROVIDER_AUTHORIZATION_NOT_CONFIRMED",
-  1031004010: "ENVELOPE_EVIDENCE_NOT_READY",
-  // Seal approval / use (1-031-005-xxx)
-  1031005001: "SEAL_ASSET_NOT_FOUND",
-  1031005010: "SEAL_APPROVAL_NOT_FOUND",
-  1031005011: "SEAL_APPROVAL_NOT_FOUND",
-  1031005012: "SEAL_APPROVAL_STATE_NOT_APPROVED",
-  1031005013: "SEAL_APPROVAL_EXPIRED",
-  1031005014: "SEAL_APPROVAL_ALREADY_USED",
-  1031005015: "SEAL_APPROVAL_NONCE_USED",
-  1031005016: "SEAL_APPROVAL_SEAL_MISMATCH",
-  1031005017: "SEAL_APPROVAL_LOCATION_MISMATCH",
-  1031005018: "SEAL_APPROVAL_TRANSACTOR_MISMATCH",
-  1031005019: "SEAL_APPROVAL_CONTRACT_HASH_MISMATCH",
-  1031005020: "SEAL_APPROVAL_INVALID_TRANSITION",
-  1031005030: "SEAL_USE_ALREADY_CONSUMED",
-  // Billing (1-031-006-xxx)
-  1031006004: "BILLING_COMMIT_REQUIRES_LOCAL_VERIFY",
-  1031006005: "BILLING_COMMIT_REQUIRES_PROVIDER_SUCCESS",
-  1031006007: "BILLING_CALLBACK_CANNOT_COMMIT",
-  1031006008: "BILLING_PROVIDER_UNKNOWN_NOT_COMMITTABLE",
-  1031006009: "BILLING_S2S_FORBIDDEN",
-  // Audit (1-031-007-xxx)
-  1031007011: "AUDIT_CHAIN_TAMPER_DETECTED"
-};
-var STEP_UP_KEYS = /* @__PURE__ */ new Set(["COMPLIANCE_STEP_UP_REQUIRED"]);
-var TERMINAL_KEYS = /* @__PURE__ */ new Set([
-  "ENVELOPE_GATE_CLOSED",
-  "PROVIDER_NOT_CONFIGURED",
-  "PROVIDER_REQUEST_UNKNOWN_NO_RETRY",
-  "BILLING_CALLBACK_CANNOT_COMMIT",
-  "BILLING_COMMIT_REQUIRES_LOCAL_VERIFY",
-  "BILLING_COMMIT_REQUIRES_PROVIDER_SUCCESS",
-  "BILLING_PROVIDER_UNKNOWN_NOT_COMMITTABLE",
-  "BILLING_S2S_FORBIDDEN",
-  "SEAL_APPROVAL_NONCE_USED",
-  "SEAL_APPROVAL_EXPIRED",
-  "SEAL_APPROVAL_CONTRACT_HASH_MISMATCH",
-  "SEAL_APPROVAL_SEAL_MISMATCH",
-  "SEAL_APPROVAL_LOCATION_MISMATCH",
-  "SEAL_APPROVAL_TRANSACTOR_MISMATCH",
-  "SEAL_USE_ALREADY_CONSUMED",
-  "CONTRACT_HASH_MISMATCH",
-  "TIMESTAMP_LOCAL_VERIFY_FAILED",
-  "EVIDENCE_PACKAGE_MANIFEST_HASH_MISMATCH",
-  "AUDIT_CHAIN_TAMPER_DETECTED",
-  "PROVIDER_REQUEST_NOT_FOUND",
-  "EVIDENCE_ASSET_HASH_MISMATCH",
-  "EVIDENCE_VERIFY_TARGET_NOT_FOUND",
-  "REPORT_ALREADY_PUBLISHED"
-]);
-var RETRYABLE_KEYS = /* @__PURE__ */ new Set([]);
-function classifyComplianceError(err) {
-  const key = CODE_TO_KEY[err.code] ?? "UNKNOWN_COMPLIANCE_ERROR";
-  return {
-    code: err.code,
-    message: err.message,
-    key,
-    retryable: RETRYABLE_KEYS.has(key),
-    terminal: TERMINAL_KEYS.has(key),
-    stepUpRequired: STEP_UP_KEYS.has(key)
-  };
-}
-function isComplianceBusinessError(err) {
-  return err.code >= 1031e6 && err.code <= 1031999999;
-}
-
-// src/client.ts
-init_types();
-
-// src/store.ts
-var fileLockDefaults = {
-  /** 获取锁的超时上限 (毫秒). refresh 流程含网络 < 30s, 30s 已远超正常完成时间. */
-  acquireTimeoutMs: 3e4,
-  /** 旧锁判定阈值 (毫秒). 锁文件 mtime 早于此值视为 stale 进程崩溃残留, 自动 break. */
-  staleMs: 6e4,
-  /** 重试间隔基数 (毫秒). 真实间隔 = base + random(0, jitter). */
-  retryBaseMs: 30,
-  retryJitterMs: 70
-};
-var FileTokenStore = class {
-  path;
-  /** 进程内串行化 (Promise chain) — 与跨进程 flock 配合, 避免单进程内并发持锁产生死锁式互等. */
-  chain = Promise.resolve();
-  constructor(path) {
-    if (typeof process === "undefined" || !process.versions || !process.versions.node) {
-      throw new Error("FileTokenStore requires Node.js environment; use LocalStorageTokenStore or InMemoryTokenStore in browser");
-    }
-    if (path && path !== "") {
-      this.path = path;
-    } else {
-      this.path = "";
-    }
+// src/core/store.ts
+var fileLockDefaults = {
+  /** 获取锁的超时上限 (毫秒). refresh 流程含网络 < 30s, 30s 已远超正常完成时间. */
+  acquireTimeoutMs: 3e4,
+  /** 旧锁判定阈值 (毫秒). 锁文件 mtime 早于此值视为 stale 进程崩溃残留, 自动 break. */
+  staleMs: 6e4,
+  /** 重试间隔基数 (毫秒). 真实间隔 = base + random(0, jitter). */
+  retryBaseMs: 30,
+  retryJitterMs: 70
+};
+var FileTokenStore = class {
+  path;
+  /** 进程内串行化 (Promise chain) — 与跨进程 flock 配合, 避免单进程内并发持锁产生死锁式互等. */
+  chain = Promise.resolve();
+  constructor(path) {
+    if (typeof process === "undefined" || !process.versions || !process.versions.node) {
+      throw new Error("FileTokenStore requires Node.js environment; use LocalStorageTokenStore or InMemoryTokenStore in browser");
+    }
+    if (path && path !== "") {
+      this.path = path;
+    } else {
+      this.path = "";
+    }
   }
   async resolvePath() {
     if (this.path && this.path !== "") return this.path;
@@ -1945,8 +1665,8 @@ var InMemoryTokenStore = class {
   }
 };
 
-// src/retry.ts
-init_types();
+// src/core/retry.ts
+init_errors();
 var DefaultRetryPolicy = {
   maxAttempts: 2,
   backoffMs: 200,
@@ -2001,10 +1721,10 @@ function computeBackoff(p, attempt, err) {
   return d;
 }
 
-// src/client.ts
+// src/core/client.ts
 init_adapters();
 
-// src/stream-meta.ts
+// src/models/stream-meta.ts
 function extractAnthropicBlockMeta(eventType, data, blockTypeMap) {
   switch (eventType) {
     case "content_block_start": {
@@ -2050,11 +1770,11 @@ function extractAnthropicBlockMeta(eventType, data, blockTypeMap) {
   }
 }
 
-// src/client.ts
+// src/core/client.ts
 init_openai();
 
-// src/client-helpers.ts
-init_types();
+// src/core/http.ts
+init_errors();
 var maxDownloadSize = 50 * 1024 * 1024;
 var maxErrorBodySize = 1 * 1024 * 1024;
 var maxSSELineSize = 1 * 1024 * 1024;
@@ -2230,7 +1950,7 @@ async function readLimitedText(body, maxBytes) {
   return new TextDecoder("utf-8").decode(buf);
 }
 
-// src/client.ts
+// src/core/client.ts
 var FilterStatusOK = "ok";
 var FilterStatusAdminBypass = "admin-bypass";
 var FilterStatusInternalBypass = "internal-bypass";
@@ -3445,850 +3165,1334 @@ async function sleep(ms, signal) {
   });
 }
 
-// src/client/compliance.ts
-init_types();
-var cache = /* @__PURE__ */ new WeakMap();
-Object.defineProperty(Client.prototype, "compliance", {
-  configurable: true,
-  enumerable: false,
-  get() {
-    let existing = cache.get(this);
-    if (!existing) {
-      existing = new ComplianceClient(this);
-      cache.set(this, existing);
-    }
-    return existing;
-  }
+// src/sanitize/index.ts
+var sanitize_exports = {};
+__export(sanitize_exports, {
+  BlockCodeExecutionToolResult: () => BlockCodeExecutionToolResult,
+  BlockContainerUpload: () => BlockContainerUpload,
+  BlockDeniedError: () => BlockDeniedError,
+  BlockDocument: () => BlockDocument,
+  BlockImage: () => BlockImage,
+  BlockMCPToolResult: () => BlockMCPToolResult,
+  BlockMCPToolUse: () => BlockMCPToolUse,
+  BlockRedactedThinking: () => BlockRedactedThinking,
+  BlockSearchResult: () => BlockSearchResult,
+  BlockServerToolUse: () => BlockServerToolUse,
+  BlockText: () => BlockText,
+  BlockThinking: () => BlockThinking,
+  BlockToolReference: () => BlockToolReference,
+  BlockToolResult: () => BlockToolResult,
+  BlockToolUse: () => BlockToolUse,
+  BlockVideo: () => BlockVideo,
+  BlockWebSearchToolResult: () => BlockWebSearchToolResult,
+  DeltaCitations: () => DeltaCitations,
+  DeltaInputJSON: () => DeltaInputJSON,
+  DeltaSignature: () => DeltaSignature,
+  DeltaText: () => DeltaText,
+  DeltaThinking: () => DeltaThinking,
+  EphemeralMarkerField: () => EphemeralMarkerField,
+  ErrBlockDenied: () => ErrBlockDenied,
+  ErrHistoryTooDeep: () => ErrHistoryTooDeep,
+  HistoryTooDeepError: () => HistoryTooDeepError,
+  SizeError: () => SizeError,
+  dropBlocks: () => dropBlocks,
+  sanitize: () => sanitize,
+  stripEphemeral: () => stripEphemeral
 });
-var DEFAULT_POLL = {
-  timeoutMs: 6e4,
-  initialIntervalMs: 1e3,
-  maxIntervalMs: 5e3,
-  multiplier: 1.5
+
+// src/sanitize/types.ts
+var BlockText = "text";
+var BlockImage = "image";
+var BlockVideo = "video";
+var BlockDocument = "document";
+var BlockSearchResult = "search_result";
+var BlockThinking = "thinking";
+var BlockRedactedThinking = "redacted_thinking";
+var BlockToolUse = "tool_use";
+var BlockToolResult = "tool_result";
+var BlockToolReference = "tool_reference";
+var BlockServerToolUse = "server_tool_use";
+var BlockWebSearchToolResult = "web_search_tool_result";
+var BlockCodeExecutionToolResult = "code_execution_tool_result";
+var BlockMCPToolUse = "mcp_tool_use";
+var BlockMCPToolResult = "mcp_tool_result";
+var BlockContainerUpload = "container_upload";
+var DeltaText = "text_delta";
+var DeltaInputJSON = "input_json_delta";
+var DeltaThinking = "thinking_delta";
+var DeltaSignature = "signature_delta";
+var DeltaCitations = "citations_delta";
+var EphemeralMarkerField = "acosmi_ephemeral";
+
+// src/sanitize/config.ts
+var HistoryTooDeepError = class extends Error {
+  constructor() {
+    super("sanitize: messages history exceeds configured depth");
+    this.name = "HistoryTooDeepError";
+  }
 };
-var CompliancePollError = class extends Error {
-  kind;
-  lastInfo;
-  constructor(message, kind, lastInfo) {
-    super(message);
-    this.name = "CompliancePollError";
-    this.kind = kind;
-    this.lastInfo = lastInfo;
+var BlockDeniedError = class extends Error {
+  constructor() {
+    super("sanitize: block type permanently denied");
+    this.name = "BlockDeniedError";
   }
 };
-var ComplianceClient = class {
-  constructor(client) {
-    this.client = client;
+var SizeError = class extends Error {
+  blockType;
+  actual;
+  limit;
+  constructor(blockType, actual, limit) {
+    super(`sanitize: ${blockType} base64 size ${actual} exceeds limit ${limit}`);
+    this.name = "SizeError";
+    this.blockType = blockType;
+    this.actual = actual;
+    this.limit = limit;
   }
-  client;
-  // =========================================================================
-  // Evidence Asset
-  // =========================================================================
-  /** 创建证据资产（写）。 */
-  createEvidenceAsset(req, opts = {}) {
-    return this.write(
-      "POST",
-      "/compliance/evidence/assets",
-      req,
-      writeCtx(opts)
-    );
+};
+var ErrHistoryTooDeep = new HistoryTooDeepError();
+var ErrBlockDenied = new BlockDeniedError();
+
+// src/sanitize/history.ts
+function dropBlocks(messages, pred) {
+  const droppedToolUseIDs = collectDroppedToolUseIDs(messages, pred);
+  const out = [];
+  for (const msg of messages) {
+    if (!isPlainObject(msg)) {
+      out.push(msg);
+      continue;
+    }
+    const content = msg["content"];
+    if (!Array.isArray(content)) {
+      out.push(msg);
+      continue;
+    }
+    const { kept, changed } = filterBlocks(content, pred, droppedToolUseIDs);
+    if (!changed) {
+      out.push(msg);
+      continue;
+    }
+    if (kept.length === 0) {
+      continue;
+    }
+    const newMsg = { ...msg };
+    newMsg["content"] = kept;
+    out.push(newMsg);
   }
-  /** 读 — 证据资产详情。 */
-  getEvidenceAsset(id, signal) {
-    return this.read(
-      "GET",
-      `/compliance/evidence/assets/${encodeURIComponent(id)}`,
-      null,
-      signal
-    );
+  return out;
+}
+function collectDroppedToolUseIDs(messages, pred) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const msg of messages) {
+    if (!isPlainObject(msg)) continue;
+    const content = msg["content"];
+    if (!Array.isArray(content)) continue;
+    for (const raw of content) {
+      if (!isPlainObject(raw)) continue;
+      if (!pred(raw)) continue;
+      const t = raw["type"];
+      if (typeof t !== "string") continue;
+      if (t === "tool_use" || t === "server_tool_use" || t === "mcp_tool_use") {
+        const id = raw["id"];
+        if (typeof id === "string" && id !== "") ids.add(id);
+      }
+    }
   }
-  /**
-   * 公开 verify。隐私边界：返回字段不含 PII / 合同原文 / storage / provider raw。
-   *
-   * 匿名可调用：未 login 时走匿名请求，不会抛 `not authorized, call login() first`。
-   * 已 login / 已持有 token 时附带 `Authorization` 以保留审计上下文。public 端点不
-   * 应要求认证 — 收到 401 直接抛 HTTPError，不触发 `forceRefresh`，也不做 refresh
-   * replay。
-   */
-  verifyEvidencePublic(params, signal) {
-    const q = new URLSearchParams();
-    if (params.evidenceNo) q.set("evidenceNo", params.evidenceNo);
-    if (params.publicVerifyCode) q.set("publicVerifyCode", params.publicVerifyCode);
-    const qs = q.toString();
-    return this.publicRead(
-      "GET",
-      `/compliance/evidence/verify${qs ? "?" + qs : ""}`,
-      signal
-    );
+  return ids;
+}
+function filterBlocks(content, pred, droppedToolUseIDs) {
+  const kept = [];
+  let changed = false;
+  for (const raw of content) {
+    if (!isPlainObject(raw)) {
+      kept.push(raw);
+      continue;
+    }
+    if (pred(raw)) {
+      changed = true;
+      continue;
+    }
+    if (droppedToolUseIDs.size > 0) {
+      const t = raw["type"];
+      if (t === "tool_result" || t === "mcp_tool_result") {
+        const id = raw["tool_use_id"];
+        if (typeof id === "string" && id !== "" && droppedToolUseIDs.has(id)) {
+          changed = true;
+          continue;
+        }
+      }
+    }
+    kept.push(raw);
   }
-  // =========================================================================
-  // Timestamp
-  // =========================================================================
-  /** 申请时间章（写）。SDK 永远不传 provider 字段。 */
-  issueTimestamp(req, opts = {}) {
-    return this.write("POST", "/compliance/timestamps", req, writeCtx(opts));
+  return { kept, changed };
+}
+function stripEphemeral(messages) {
+  return dropBlocks(messages, (b) => {
+    const t = b["type"];
+    if (t === "thinking" || t === "redacted_thinking") {
+      return false;
+    }
+    const v = b[EphemeralMarkerField];
+    return v === true;
+  });
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+// src/sanitize/defensive.ts
+function sanitize(messages, cfg) {
+  if ((cfg.maxMessagesTurns ?? 0) > 0 && messages.length > cfg.maxMessagesTurns) {
+    throw ErrHistoryTooDeep;
   }
-  /** 给已有资产申请时间章。SDK 永远不传 provider 字段。 */
-  issueTimestampForAsset(assetId, opts = {}) {
-    return this.write(
-      "POST",
-      `/compliance/evidence/assets/${encodeURIComponent(assetId)}/timestamp`,
-      null,
-      writeCtx(opts)
-    );
+  if ((cfg.maxImageBytes ?? 0) > 0 || (cfg.maxVideoBytes ?? 0) > 0 || (cfg.maxPDFBytes ?? 0) > 0) {
+    checkMediaSizes(messages, cfg);
   }
-  /** 读 — 时间章 token 详情。 */
-  getTimestamp(id, signal) {
-    return this.read(
-      "GET",
-      `/compliance/timestamps/${encodeURIComponent(id)}`,
-      null,
-      signal
-    );
+  if (cfg.permanentDenyBlocks && cfg.permanentDenyBlocks.length > 0) {
+    const denySet = /* @__PURE__ */ new Set();
+    for (const bt of cfg.permanentDenyBlocks) denySet.add(bt);
+    messages = dropBlocks(messages, (b) => {
+      const t = b["type"];
+      return typeof t === "string" && denySet.has(t);
+    });
   }
-  /** verify — 本地离线校验已申请的时间章。 */
-  verifyTimestamp(req, opts = {}) {
-    return this.write(
-      "POST",
-      "/compliance/timestamps/verify",
-      req,
-      writeCtx(opts)
-    );
+  return messages;
+}
+function checkMediaSizes(messages, cfg) {
+  for (const msg of messages) {
+    if (!isPlainObject2(msg)) continue;
+    const content = msg["content"];
+    if (!Array.isArray(content)) continue;
+    for (const raw of content) {
+      if (!isPlainObject2(raw)) continue;
+      const bt = raw["type"];
+      if (typeof bt !== "string") continue;
+      let limit = 0;
+      switch (bt) {
+        case "image":
+          limit = cfg.maxImageBytes ?? 0;
+          break;
+        case "video":
+          limit = cfg.maxVideoBytes ?? 0;
+          break;
+        case "document":
+          limit = cfg.maxPDFBytes ?? 0;
+          break;
+        default:
+          continue;
+      }
+      if (limit <= 0) continue;
+      const data = extractBase64Data(raw);
+      if (data === "") continue;
+      const actual = base64DecodedLen(data);
+      if (actual > limit) {
+        throw new SizeError(bt, actual, limit);
+      }
+    }
   }
-  /**
-   * 轮询到 VERIFIED 终态。
-   * - VERIFIED → 返回 token；
-   * - FAILED / LOCAL_VERIFY_FAILED → 抛 {@link CompliancePollError} kind='terminal_failure'；
-   * - UNKNOWN / RETRYING / PENDING → 继续轮询直到 timeout；
-   * - timeout → 抛 {@link CompliancePollError} kind='timeout'。
-   */
-  async waitForTimestampVerified(id, opts = {}) {
-    return this.poll(
-      () => this.getTimestamp(id, opts.signal),
-      (t) => classifyTimestamp(t.verificationStatus),
-      opts
-    );
+}
+function extractBase64Data(block) {
+  const src = block["source"];
+  if (!isPlainObject2(src)) return "";
+  if (src["type"] !== "base64") return "";
+  const dataRaw = src["data"];
+  if (typeof dataRaw !== "string") return "";
+  let data = dataRaw;
+  const i = data.indexOf("base64,");
+  if (i >= 0) {
+    data = data.slice(i + "base64,".length);
   }
-  // =========================================================================
-  // Evidence Package
-  // =========================================================================
-  /** 构建证据包（写）。 */
-  buildEvidencePackage(assetId, timestampTokenId, opts = {}) {
-    const tsParam = timestampTokenId == null ? "" : "?timestampTokenId=" + encodeURIComponent(timestampTokenId);
-    return this.write(
-      "POST",
-      `/compliance/evidence/assets/${encodeURIComponent(assetId)}/packages${tsParam}`,
-      null,
-      writeCtx(opts)
-    );
+  return data;
+}
+function base64DecodedLen(b64) {
+  const n = b64.length;
+  let pad = 0;
+  if (n >= 1 && b64[n - 1] === "=") pad++;
+  if (n >= 2 && b64[n - 2] === "=") pad++;
+  return Math.floor(n * 3 / 4) - pad;
+}
+function isPlainObject2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+// src/core/sanitize-bridge.ts
+Client.prototype.setDefensiveSanitize = function(cfg) {
+  this.defensiveCfg = cfg;
+};
+Client.prototype.setAutoStripEphemeralHistory = function(on) {
+  this.autoStripEphemeral = on;
+};
+Client.prototype.applyRequestSanitizers = function(req) {
+  const cfg = this.defensiveCfg;
+  const strip = this.autoStripEphemeral;
+  if (cfg == null && !strip) return;
+  if (req.rawMessages != null) {
+    let msgs;
+    try {
+      msgs = normalizeRawMessages(req.rawMessages);
+    } catch (e) {
+      throw new Error(
+        `sanitize: normalize raw messages: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+    if (cfg) {
+      msgs = sanitize(msgs, cfg);
+    }
+    if (strip) {
+      msgs = stripEphemeral(msgs);
+    }
+    req.rawMessages = msgs;
+    return;
   }
-  // =========================================================================
-  // Report
-  // =========================================================================
-  /** 创建证据报告（写）。 */
-  createReport(req, opts = {}) {
-    return this.write("POST", "/compliance/reports", req, writeCtx(opts));
+  if (cfg && (cfg.maxMessagesTurns ?? 0) > 0 && (req.messages?.length ?? 0) > cfg.maxMessagesTurns) {
+    throw ErrHistoryTooDeep;
   }
-  /** 读 — 报告详情。 */
-  getReport(id, signal) {
-    return this.read(
-      "GET",
-      `/compliance/reports/${encodeURIComponent(id)}`,
-      null,
-      signal
-    );
+};
+function normalizeRawMessages(rm) {
+  if (Array.isArray(rm)) return rm;
+  let s;
+  try {
+    s = JSON.parse(JSON.stringify(rm));
+  } catch (e) {
+    throw new Error(`raw messages: ${e instanceof Error ? e.message : String(e)}`);
   }
-  /**
-   * 发布报告（写，step-up 必须）。
-   *
-   * `@status gated` — step-up 闸门未闭合前服务端会一致返回
-   * `COMPLIANCE_STEP_UP_REQUIRED`（数值码 1031000013）。SDK 不会自动重试、不伪成功；
-   * 调用方需要引导用户重新做 OAuth introspection 或重新登录后再次调用本方法
-   *（使用同一 idempotency-key）。方法状态分级见 `docs/compliance.md` Method Status。
-   */
-  publishReport(id, opts = {}) {
-    return this.write(
-      "POST",
-      `/compliance/reports/${encodeURIComponent(id)}/publish`,
-      null,
-      writeCtx(opts)
-    );
+  if (!Array.isArray(s)) {
+    throw new Error("raw messages must be a JSON array");
   }
-  /**
-   * 下载报告（读）。返回 {@link ReportDownload}：报告 hash + 资产 hash + 证据包 hash +
-   * 时间章 serial/genTime，足以离线复核。
-   * 不返回 bodyCanonicalJson / storage key / subject snapshot id。
-   */
-  downloadReport(id, signal) {
-    return this.read(
-      "GET",
-      `/compliance/reports/${encodeURIComponent(id)}/download`,
-      null,
-      signal
-    );
+  return s;
+}
+
+// src/shared/index.ts
+init_errors();
+
+// src/shared/operation.ts
+var IdempotencyKeyHeader = "Idempotency-Key";
+
+// src/shared/retry-advice.ts
+var RETRY_ADVICE_REASONS = [
+  "unknown",
+  "retrying",
+  "failed",
+  "gate_closed",
+  "step_up_required",
+  "tenant_mismatch",
+  "insufficient_scope",
+  "quota_exceeded",
+  "provider_timeout",
+  "local_verify_failed",
+  "billing_preflight_failed"
+];
+var COMPLIANCE_KEY_TO_RETRY_REASON = {
+  // 通用 / token / scope
+  COMPLIANCE_UNAUTHORIZED: "failed",
+  COMPLIANCE_INSUFFICIENT_SCOPE: "insufficient_scope",
+  COMPLIANCE_STEP_UP_REQUIRED: "step_up_required",
+  COMPLIANCE_TOKEN_INVALID: "failed",
+  // 主体快照
+  SUBJECT_SNAPSHOT_REQUIRED: "failed",
+  SUBJECT_SNAPSHOT_NOT_FOUND: "failed",
+  SUBJECT_SNAPSHOT_TENANT_MISMATCH: "tenant_mismatch",
+  // Evidence / Timestamp / Package / Report
+  EVIDENCE_ASSET_NOT_FOUND: "failed",
+  EVIDENCE_ASSET_HASH_MISMATCH: "local_verify_failed",
+  EVIDENCE_ASSET_PAYLOAD_REQUIRED: "failed",
+  TIMESTAMP_TOKEN_NOT_FOUND: "failed",
+  TIMESTAMP_PROVIDER_FAILED: "failed",
+  TIMESTAMP_PROVIDER_UNKNOWN: "unknown",
+  TIMESTAMP_LOCAL_VERIFY_FAILED: "local_verify_failed",
+  TIMESTAMP_PROVIDER_NOT_AVAILABLE: "provider_timeout",
+  EVIDENCE_PACKAGE_NOT_FOUND: "failed",
+  EVIDENCE_PACKAGE_TIMESTAMP_REQUIRED: "failed",
+  EVIDENCE_PACKAGE_MANIFEST_HASH_MISMATCH: "local_verify_failed",
+  REPORT_NOT_FOUND: "failed",
+  REPORT_ALREADY_PUBLISHED: "failed",
+  REPORT_DRAFT_REQUIRED: "failed",
+  EVIDENCE_VERIFY_TARGET_REQUIRED: "failed",
+  EVIDENCE_VERIFY_TARGET_NOT_FOUND: "failed",
+  // Provider request
+  PROVIDER_REQUEST_UNKNOWN_NO_RETRY: "unknown",
+  PROVIDER_CALLBACK_SOURCE_INVALID: "failed",
+  PROVIDER_NOT_CONFIGURED: "gate_closed",
+  PROVIDER_REQUEST_NOT_FOUND: "failed",
+  PROVIDER_REQUEST_IDEMPOTENCY_REQUIRED: "failed",
+  PROVIDER_REQUEST_STATUS_NOT_TERMINAL: "retrying",
+  // Envelope
+  ENVELOPE_NOT_FOUND: "failed",
+  ENVELOPE_TENANT_MISMATCH: "tenant_mismatch",
+  ENVELOPE_STATE_NOT_ALLOWED: "failed",
+  ENVELOPE_GATE_CLOSED: "gate_closed",
+  CONTRACT_NOT_FOUND: "failed",
+  CONTRACT_HASH_MISMATCH: "local_verify_failed",
+  PROVIDER_AUTHORIZATION_NOT_CONFIRMED: "failed",
+  ENVELOPE_EVIDENCE_NOT_READY: "retrying",
+  // Seal approval / use
+  SEAL_ASSET_NOT_FOUND: "failed",
+  SEAL_APPROVAL_NOT_FOUND: "failed",
+  SEAL_APPROVAL_STATE_NOT_APPROVED: "failed",
+  SEAL_APPROVAL_EXPIRED: "failed",
+  SEAL_APPROVAL_ALREADY_USED: "failed",
+  SEAL_APPROVAL_NONCE_USED: "failed",
+  SEAL_APPROVAL_SEAL_MISMATCH: "failed",
+  SEAL_APPROVAL_LOCATION_MISMATCH: "failed",
+  SEAL_APPROVAL_TRANSACTOR_MISMATCH: "failed",
+  SEAL_APPROVAL_CONTRACT_HASH_MISMATCH: "local_verify_failed",
+  SEAL_APPROVAL_INVALID_TRANSITION: "failed",
+  SEAL_USE_ALREADY_CONSUMED: "failed",
+  // Audit chain
+  AUDIT_CHAIN_TAMPER_DETECTED: "local_verify_failed",
+  // Billing
+  BILLING_COMMIT_REQUIRES_LOCAL_VERIFY: "local_verify_failed",
+  BILLING_COMMIT_REQUIRES_PROVIDER_SUCCESS: "billing_preflight_failed",
+  BILLING_CALLBACK_CANNOT_COMMIT: "billing_preflight_failed",
+  BILLING_PROVIDER_UNKNOWN_NOT_COMMITTABLE: "billing_preflight_failed",
+  BILLING_S2S_FORBIDDEN: "failed",
+  // SDK fallback
+  UNKNOWN_COMPLIANCE_ERROR: "unknown"
+};
+function retryReasonForComplianceKey(key) {
+  return COMPLIANCE_KEY_TO_RETRY_REASON[key] ?? "unknown";
+}
+var OAUTH_ERROR_TO_RETRY_REASON = {
+  insufficient_scope: "insufficient_scope",
+  invalid_token: "failed",
+  invalid_grant: "failed",
+  invalid_request: "failed",
+  access_denied: "failed",
+  unsupported_grant_type: "failed"
+};
+function retryReasonForOAuthError(oauthError) {
+  return OAUTH_ERROR_TO_RETRY_REASON[oauthError] ?? "unknown";
+}
+function complianceErrorToRetryAdvice(info) {
+  return {
+    retryable: info.retryable,
+    sameIdempotencyKeyRequired: !info.terminal,
+    manualActionRequired: info.terminal || info.stepUpRequired,
+    reason: retryReasonForComplianceKey(info.key),
+    developerMessage: info.message,
+    supportCode: `compliance:${info.code}`
+  };
+}
+
+// src/auth/scopes.ts
+var ScopeAI = "ai";
+var ScopeSkills = "skills";
+var ScopeAccount = "account";
+var ScopeModels = "models";
+var ScopeModelsChat = "models:chat";
+var ScopeEntitlements = "entitlements";
+var ScopeTokenPackages = "token-packages";
+var ScopeSkillStore = "skill_store";
+var ScopeTools = "tools";
+var ScopeToolsExecute = "tools:execute";
+var ScopeWallet = "wallet";
+var ScopeWalletReadonly = "wallet:readonly";
+var ScopeProfile = "profile";
+function allScopes() {
+  return [ScopeAI, ScopeSkills, ScopeAccount];
+}
+function modelScopes() {
+  return [ScopeAI];
+}
+function commerceScopes() {
+  return [ScopeAI, ScopeAccount];
+}
+function skillScopes() {
+  return [ScopeSkills];
+}
+
+// src/models/index.ts
+init_types();
+
+// src/models/wire-anthropic.ts
+function anthropicResponseTextContent(r) {
+  const parts = [];
+  for (const b of r.content) {
+    if (b.type === "text" && b.text) parts.push(b.text);
   }
-  // =========================================================================
-  // Signing Envelope
-  // =========================================================================
-  /** 创建 envelope（写）。返回 envelope id。 */
-  createSigningEnvelope(req, opts = {}) {
-    return this.write(
-      "POST",
-      "/compliance/signing-envelopes",
-      req,
-      writeCtx(opts)
-    );
+  return parts.join("");
+}
+function anthropicResponseThinkingContent(r) {
+  const parts = [];
+  for (const b of r.content) {
+    if (b.type === "thinking" && b.thinking) parts.push(b.thinking);
   }
-  /** 读 — envelope 详情。租户由服务端从 compliance token principal 推导。 */
-  getSigningEnvelope(envelopeId, signal) {
-    return this.read(
-      "GET",
-      `/compliance/signing-envelopes/${encodeURIComponent(envelopeId)}`,
-      null,
-      signal
-    );
+  return parts.join("");
+}
+function anthropicResponseToolUseBlocks(r) {
+  return r.content.filter((b) => b.type === "tool_use");
+}
+
+// src/models/model-helpers.ts
+function modelSupportsInputModality(model, modality) {
+  if (!model) return false;
+  const mods = model.inputModalities;
+  if (!Array.isArray(mods)) return false;
+  return mods.includes(modality);
+}
+function modelSupportsImageInput(model) {
+  return modelSupportsInputModality(model, "image");
+}
+function findFirstModelByInputModality(models, modality) {
+  if (!Array.isArray(models)) return null;
+  for (const m of models) {
+    if (!m) continue;
+    if (m.isEnabled === false) continue;
+    if (!modelSupportsInputModality(m, modality)) continue;
+    return m;
   }
-  /**
-   * 正式签署（写，step-up 必须）。
-   *
-   * `@status gated` — 服务端闸门关闭时会一致返回 `ENVELOPE_GATE_CLOSED` (1031004004)。
-   * SDK 不重试、不伪成功；调用方应该将该错误展示为"功能未开放"。
-   */
-  signEnvelope(envelopeId, req, opts = {}) {
-    return this.write(
-      "POST",
-      `/compliance/signing-envelopes/${encodeURIComponent(envelopeId)}/sign`,
-      req,
-      writeCtx(opts)
-    );
+  return null;
+}
+function findDesktopVisualUnderstandingModel(models) {
+  if (!Array.isArray(models)) return null;
+  const candidates = [];
+  for (const m of models) {
+    if (!m) continue;
+    if (m.isEnabled === false) continue;
+    if (m.capabilities?.supports_desktop_visual_understanding !== true) continue;
+    if (!modelSupportsInputModality(m, "image")) continue;
+    candidates.push(m);
   }
-  /**
-   * 创建 H5 签署短链（写，step-up 必须）。
-   *
-   * `@status gated` — 同 {@link signEnvelope}：服务端闸门关闭时 SDK 不重试、不伪成功。
-   */
-  createH5SigningUrl(envelopeId, req, opts = {}) {
-    return this.write(
-      "POST",
-      `/compliance/signing-envelopes/${encodeURIComponent(envelopeId)}/h5-url`,
-      req,
-      writeCtx(opts)
-    );
+  if (candidates.length === 0) return null;
+  for (const m of candidates) {
+    if (m.isDefault === true) return m;
   }
-  /** 同步 provider 状态（写但只读对账，不创建新 provider 请求）。 */
-  syncSigningEnvelopeStatus(envelopeId, opts = {}) {
-    return this.write(
-      "POST",
-      `/compliance/signing-envelopes/${encodeURIComponent(envelopeId)}/sync-provider-status`,
-      null,
-      writeCtx(opts)
-    );
+  return candidates[0];
+}
+
+// src/models/index.ts
+init_adapters();
+init_betas();
+
+// src/billing/entitlements.ts
+Client.prototype.getBalance = async function(signal) {
+  const resp = await this.doJSON(
+    "GET",
+    "/entitlements/balance",
+    null,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.getBalanceDetail = async function(signal) {
+  const resp = await this.doJSON(
+    "GET",
+    "/entitlements/balance-detail",
+    null,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.listEntitlements = async function(status, signal) {
+  let path = "/entitlements";
+  if (status !== "") {
+    path += `?status=${encodeURIComponent(status)}`;
   }
-  // =========================================================================
-  // Seal Approval
-  // =========================================================================
-  /**
-   * 提交用印审批申请（写）。
-   *
-   * `@status production-ready` — 服务端以 `Idempotency-Key` + 业务请求指纹做重放保护：
-   * 同 key + 同请求 → 返回原审批 id；同 key + 不同请求 → 拒绝复用幂等键。强烈建议调用方
-   * 持久化 `idempotencyKey`，网络重试 / 任务恢复时复用，避免重复创建审批单。
-   */
-  submitSealApproval(req, opts = {}) {
-    return this.write(
-      "POST",
-      "/compliance/seal-approvals",
-      req,
-      writeCtx(opts)
-    );
+  const resp = await this.doJSON("GET", path, null, signal);
+  return resp.data;
+};
+Client.prototype.listConsumeRecords = async function(page, pageSize, signal) {
+  const path = `/entitlements/consume-records?page=${page}&pageSize=${pageSize}`;
+  const resp = await this.doJSON("GET", path, null, signal);
+  return resp.data;
+};
+Client.prototype.claimMonthlyFree = async function(signal) {
+  const resp = await this.doJSON(
+    "POST",
+    "/entitlements/claim-monthly",
+    null,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.getByModel = async function(modelID, signal) {
+  if (modelID === "") throw new Error("modelID required");
+  const path = `/entitlements/by-model?modelId=${encodeURIComponent(modelID)}`;
+  const resp = await this.doJSON("GET", path, null, signal);
+  return resp.data;
+};
+Client.prototype.listBuckets = async function(signal) {
+  const resp = await this.doJSON(
+    "GET",
+    "/entitlements/buckets",
+    null,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.listCoefficients = async function(signal) {
+  if (this.coefCacheData && Date.now() - this.coefCacheTimeMs < coefCacheTTLMs) {
+    return [...this.coefCacheData];
   }
-  /**
-   * 审批通过用印申请（写，step-up 必须）。
-   *
-   * `@status gated` — step-up 未闭合前服务端会返回 `COMPLIANCE_STEP_UP_REQUIRED`。
-   * SDK 不重试、不伪成功。方法状态分级见 `docs/compliance.md` Method Status。
-   */
-  approveSealApproval(id, query, opts = {}) {
-    const q = new URLSearchParams();
-    if (query.expiresAt) q.set("expiresAt", query.expiresAt);
-    if (query.note) q.set("note", query.note);
-    const qs = q.toString();
-    return this.write(
-      "POST",
-      `/compliance/seal-approvals/${encodeURIComponent(id)}/approve${qs ? "?" + qs : ""}`,
-      null,
-      writeCtx(opts)
-    );
-  }
-  rejectSealApproval(id, query, opts = {}) {
-    const q = new URLSearchParams();
-    if (query.reason) q.set("reason", query.reason);
-    const qs = q.toString();
-    return this.write(
-      "POST",
-      `/compliance/seal-approvals/${encodeURIComponent(id)}/reject${qs ? "?" + qs : ""}`,
-      null,
-      writeCtx(opts)
-    );
-  }
-  cancelSealApproval(id, query, opts = {}) {
-    const q = new URLSearchParams();
-    if (query.reason) q.set("reason", query.reason);
-    const qs = q.toString();
-    return this.write(
-      "POST",
-      `/compliance/seal-approvals/${encodeURIComponent(id)}/cancel${qs ? "?" + qs : ""}`,
-      null,
-      writeCtx(opts)
-    );
-  }
-  listPendingSealApprovals(signal) {
-    return this.read(
-      "GET",
-      "/compliance/seal-approvals/pending",
-      null,
-      signal
-    );
-  }
-  getSealApproval(id, signal) {
-    return this.read(
-      "GET",
-      `/compliance/seal-approvals/${encodeURIComponent(id)}`,
-      null,
-      signal
-    );
-  }
-  // =========================================================================
-  // Provider Request (read-only)
-  // =========================================================================
-  getProviderRequest(id, signal) {
-    return this.read(
-      "GET",
-      `/compliance/provider-requests/${encodeURIComponent(id)}`,
-      null,
-      signal
-    );
-  }
-  /**
-   * 轮询 provider request 到 SUCCESS / FAILED 终态。
-   * - SUCCESS / FAILED → 返回最后视图；
-   * - UNKNOWN / RETRYING / PENDING → 继续轮询；
-   * - timeout → 抛 {@link CompliancePollError} kind='timeout'，不自动重发原 provider 请求。
-   *
-   * SUCCESS 不代表 billing 已 commit；调用方仍需通过业务侧 envelope / asset 终态判断。
-   */
-  async waitForProviderRequestTerminal(id, opts = {}) {
-    return this.poll(
-      () => this.getProviderRequest(id, opts.signal),
-      (v) => classifyProviderStatus(v.status),
-      opts
-    );
-  }
-  // =========================================================================
-  // Error classification (re-export for convenience)
-  // =========================================================================
-  classifyError(err) {
-    if (!isBusinessErrorLike(err)) return null;
-    if (!isComplianceBusinessError(err)) return null;
-    return classifyComplianceError(err);
+  const resp = await this.doJSON(
+    "GET",
+    "/entitlements/coefficients",
+    null,
+    signal
+  );
+  this.coefCacheData = [...resp.data];
+  this.coefCacheTimeMs = Date.now();
+  return resp.data;
+};
+Client.prototype.invalidateCoefficientCache = function() {
+  this.coefCacheData = null;
+  this.coefCacheTimeMs = 0;
+};
+
+// src/billing/packages.ts
+init_errors();
+Client.prototype.listTokenPackages = async function(signal) {
+  const raw = await this.doJSON("GET", "/token-packages", null, signal);
+  if (raw.data && typeof raw.data === "object" && "list" in raw.data) {
+    const page = raw.data;
+    if (Array.isArray(page.list)) return page.list;
   }
-  // =========================================================================
-  // Internal helpers
-  // =========================================================================
-  /**
-   * 读路径：GET / 公开 verify。允许 401 单次刷新后重放（GET 幂等安全）。
-   * 与 client.doJSONFullInternal 行为一致；不复用其代码因为 base URL 不同。
-   */
-  async read(method, path, body, signal, extraHeaders = {}) {
-    return this.executeJson(method, path, body, signal, {
-      retryOn401: true,
-      extraHeaders
-    });
+  if (Array.isArray(raw.data)) return raw.data;
+  throw new Error("decode token packages: unexpected shape");
+};
+Client.prototype.getTokenPackageDetail = async function(packageID, signal) {
+  const resp = await this.doJSON(
+    "GET",
+    `/token-packages/${encodeURIComponent(packageID)}`,
+    null,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.buyTokenPackage = async function(packageID, payload, signal) {
+  const body = payload ?? null;
+  const resp = await this.doJSON(
+    "POST",
+    `/token-packages/${encodeURIComponent(packageID)}/buy`,
+    body,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.getOrderStatus = async function(orderID, signal) {
+  const resp = await this.doJSON(
+    "GET",
+    `/token-packages/orders/${encodeURIComponent(orderID)}/status`,
+    null,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.listMyOrders = async function(signal) {
+  const raw = await this.doJSON("GET", "/token-packages/my", null, signal);
+  if (raw.data && typeof raw.data === "object" && "list" in raw.data) {
+    const page = raw.data;
+    if (Array.isArray(page.list)) return page.list;
   }
-  /**
-   * 公开读路径：public verify。
-   *
-   * 与 {@link read} 的区别 — public 端点不应要求认证：
-   *   - 无 token 时匿名请求：ensureToken 抛 `not authorized` 会被吞掉，继续匿名发送。
-   *   - 有 token 时附带 `Authorization`，保留后端审计上下文。
-   *   - 不做 401 refresh replay：401 直接抛 HTTPError，不触发 `forceRefresh`。
-   *
-   * URL 仍走 `client.complianceURL(path)`，不复用 `/api/v4`；底层复用
-   * `client.doRequest`，不新增 fetch/axios 直连。
-   */
-  async publicRead(method, path, signal) {
-    let token = "";
-    try {
-      token = await this.client.ensureToken(signal);
-    } catch {
-    }
-    const url = this.client.complianceURL(path);
-    const headers = { Accept: "application/json" };
-    if (token) headers.Authorization = `Bearer ${token}`;
-    const resp = await this.client.doRequest({ method, url, headers }, signal);
-    if (resp.status < 200 || resp.status >= 300) {
-      const bodyBytes = resp.body ? await readLimited(resp.body, maxErrorBodySize) : new Uint8Array();
-      throw parseHTTPErrorWithHeader(resp.status, bodyBytes, resp.headers);
+  if (Array.isArray(raw.data)) return raw.data;
+  throw new Error("decode orders: unexpected shape");
+};
+Client.prototype.waitForPayment = async function(orderID, pollIntervalMs, signal) {
+  if (pollIntervalMs <= 0) pollIntervalMs = 2e3;
+  while (true) {
+    const status = await this.getOrderStatus(orderID, signal);
+    if (isOrderTerminal(status.status)) {
+      if (isOrderSuccess(status.status)) return status;
+      throw new OrderTerminalError(orderID, status.status);
     }
-    const text = await resp.text();
-    if (!text) return void 0;
-    const parsed = JSON.parse(text);
-    const bizErr = apiResponseBusinessError(parsed);
-    if (bizErr) throw bizErr;
-    return parsed.data;
-  }
-  /**
-   * 写路径：POST。
-   * - 发送前 ensureToken 一次确保 token fresh。
-   * - 不自动 401 重放：401 → 抛 HTTPError；调用方必须自己刷新 token 后用同一
-   *   idempotency-key 重新发起，避免 provider 侧重复请求。
-   * - 不走 doRequestWithRetry：写操作不允许 5xx/timeout 自动重试。
-   */
-  async write(method, path, body, ctx) {
-    const headers = { ...ctx.extraHeaders ?? {} };
-    if (ctx.idempotencyKey) headers["Idempotency-Key"] = ctx.idempotencyKey;
-    return this.executeJson(method, path, body, ctx.signal, {
-      retryOn401: false,
-      extraHeaders: headers
-    });
+    await sleepWithSignal(pollIntervalMs, signal);
   }
-  async executeJson(method, path, body, signal, opts, retried = false) {
-    const token = await this.client.ensureToken(signal);
-    const url = this.client.complianceURL(path);
-    const headers = {
-      Authorization: `Bearer ${token}`,
-      Accept: "application/json",
-      ...opts.extraHeaders
-    };
-    let bodyStr;
-    if (body != null) {
-      bodyStr = typeof body === "string" ? body : JSON.stringify(body);
-      headers["Content-Type"] = "application/json";
-    }
-    const resp = await this.client.doRequest({ method, url, headers, body: bodyStr }, signal);
-    if (resp.status === 401 && opts.retryOn401 && !retried) {
-      try {
-        await resp.body?.cancel();
-      } catch {
-      }
-      await this.client.forceRefresh(signal);
-      return this.executeJson(method, path, body, signal, opts, true);
-    }
-    if (resp.status < 200 || resp.status >= 300) {
-      const bodyBytes = resp.body ? await readLimited(resp.body, maxErrorBodySize) : new Uint8Array();
-      throw parseHTTPErrorWithHeader(resp.status, bodyBytes, resp.headers);
+};
+async function sleepWithSignal(ms, signal) {
+  if (ms <= 0) return;
+  if (signal && signal.aborted) throw new Error("aborted");
+  return new Promise((resolve, reject) => {
+    const t = setTimeout(() => {
+      if (signal && abortHandler) signal.removeEventListener("abort", abortHandler);
+      resolve();
+    }, ms);
+    let abortHandler;
+    if (signal) {
+      abortHandler = () => {
+        clearTimeout(t);
+        signal.removeEventListener("abort", abortHandler);
+        reject(new Error("aborted"));
+      };
+      signal.addEventListener("abort", abortHandler);
     }
-    const text = await resp.text();
-    if (!text) return void 0;
-    const parsed = JSON.parse(text);
-    const bizErr = apiResponseBusinessError(parsed);
-    if (bizErr) throw bizErr;
-    return parsed.data;
-  }
-  async poll(fetcher, classify, opts) {
-    const cfg = {
-      timeoutMs: opts.timeoutMs ?? DEFAULT_POLL.timeoutMs,
-      initialIntervalMs: opts.initialIntervalMs ?? DEFAULT_POLL.initialIntervalMs,
-      maxIntervalMs: opts.maxIntervalMs ?? DEFAULT_POLL.maxIntervalMs,
-      multiplier: opts.multiplier ?? DEFAULT_POLL.multiplier
-    };
-    const deadline = Date.now() + cfg.timeoutMs;
-    let interval = cfg.initialIntervalMs;
-    let lastValue;
-    while (Date.now() < deadline) {
-      if (opts.signal?.aborted) {
-        throw new CompliancePollError("compliance poll aborted", "unknown");
-      }
-      lastValue = await fetcher();
-      const decision = classify(lastValue);
-      if (decision === "done") return lastValue;
-      if (decision === "failed") {
-        throw new CompliancePollError(
-          "compliance poll observed terminal failure",
-          "terminal_failure"
-        );
-      }
-      const sleepMs = Math.min(interval, deadline - Date.now());
-      if (sleepMs <= 0) break;
-      await sleep2(sleepMs, opts.signal);
-      interval = Math.min(Math.floor(interval * cfg.multiplier), cfg.maxIntervalMs);
-    }
-    throw new CompliancePollError("compliance poll timed out", "timeout");
-  }
-};
-function classifyTimestamp(status) {
-  switch (status) {
-    case "VERIFIED":
-      return "done";
-    case "FAILED":
-    case "LOCAL_VERIFY_FAILED":
-      return "failed";
-    case "PENDING":
-    case "UNKNOWN":
-    case "RETRYING":
-    default:
-      return "continue";
-  }
-}
-function classifyProviderStatus(status) {
-  switch (status) {
-    case "SUCCESS":
-      return "done";
-    case "FAILED":
-      return "failed";
-    case "PENDING":
-    case "UNKNOWN":
-    case "RETRYING":
-    default:
-      return "continue";
-  }
-}
-function writeCtx(opts, extraHeaders = {}) {
-  return {
-    idempotencyKey: opts.idempotencyKey,
-    signal: opts.signal,
-    extraHeaders
-  };
-}
-function isBusinessErrorLike(err) {
-  if (err == null || typeof err !== "object") return false;
-  return typeof err.code === "number";
-}
-function sleep2(ms, signal) {
-  return new Promise((resolve, reject) => {
-    if (signal?.aborted) {
-      reject(new CompliancePollError("compliance poll aborted", "unknown"));
-      return;
-    }
-    const timer = setTimeout(() => {
-      signal?.removeEventListener("abort", onAbort);
-      resolve();
-    }, ms);
-    const onAbort = () => {
-      clearTimeout(timer);
-      signal?.removeEventListener("abort", onAbort);
-      reject(new CompliancePollError("compliance poll aborted", "unknown"));
-    };
-    signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
 
-// src/sanitize/index.ts
-var sanitize_exports = {};
-__export(sanitize_exports, {
-  BlockCodeExecutionToolResult: () => BlockCodeExecutionToolResult,
-  BlockContainerUpload: () => BlockContainerUpload,
-  BlockDeniedError: () => BlockDeniedError,
-  BlockDocument: () => BlockDocument,
-  BlockImage: () => BlockImage,
-  BlockMCPToolResult: () => BlockMCPToolResult,
-  BlockMCPToolUse: () => BlockMCPToolUse,
-  BlockRedactedThinking: () => BlockRedactedThinking,
-  BlockSearchResult: () => BlockSearchResult,
-  BlockServerToolUse: () => BlockServerToolUse,
-  BlockText: () => BlockText,
-  BlockThinking: () => BlockThinking,
-  BlockToolReference: () => BlockToolReference,
-  BlockToolResult: () => BlockToolResult,
-  BlockToolUse: () => BlockToolUse,
-  BlockVideo: () => BlockVideo,
-  BlockWebSearchToolResult: () => BlockWebSearchToolResult,
-  DeltaCitations: () => DeltaCitations,
-  DeltaInputJSON: () => DeltaInputJSON,
-  DeltaSignature: () => DeltaSignature,
-  DeltaText: () => DeltaText,
-  DeltaThinking: () => DeltaThinking,
-  EphemeralMarkerField: () => EphemeralMarkerField,
-  ErrBlockDenied: () => ErrBlockDenied,
-  ErrHistoryTooDeep: () => ErrHistoryTooDeep,
-  HistoryTooDeepError: () => HistoryTooDeepError,
-  SizeError: () => SizeError,
-  dropBlocks: () => dropBlocks,
-  sanitize: () => sanitize,
-  stripEphemeral: () => stripEphemeral
-});
-
-// src/sanitize/types.ts
-var BlockText = "text";
-var BlockImage = "image";
-var BlockVideo = "video";
-var BlockDocument = "document";
-var BlockSearchResult = "search_result";
-var BlockThinking = "thinking";
-var BlockRedactedThinking = "redacted_thinking";
-var BlockToolUse = "tool_use";
-var BlockToolResult = "tool_result";
-var BlockToolReference = "tool_reference";
-var BlockServerToolUse = "server_tool_use";
-var BlockWebSearchToolResult = "web_search_tool_result";
-var BlockCodeExecutionToolResult = "code_execution_tool_result";
-var BlockMCPToolUse = "mcp_tool_use";
-var BlockMCPToolResult = "mcp_tool_result";
-var BlockContainerUpload = "container_upload";
-var DeltaText = "text_delta";
-var DeltaInputJSON = "input_json_delta";
-var DeltaThinking = "thinking_delta";
-var DeltaSignature = "signature_delta";
-var DeltaCitations = "citations_delta";
-var EphemeralMarkerField = "acosmi_ephemeral";
+// src/billing/wallet.ts
+Client.prototype.getWalletStats = async function(signal) {
+  const resp = await this.doJSON("GET", "/wallet/stats", null, signal);
+  return resp.data;
+};
+Client.prototype.getWalletTransactions = async function(signal) {
+  const resp = await this.doJSON(
+    "GET",
+    "/wallet/transactions",
+    null,
+    signal
+  );
+  return resp.data;
+};
 
-// src/sanitize/config.ts
-var HistoryTooDeepError = class extends Error {
-  constructor() {
-    super("sanitize: messages history exceeds configured depth");
-    this.name = "HistoryTooDeepError";
-  }
+// src/skills/skills.ts
+init_errors();
+Client.prototype.browseSkillStore = async function(query, signal) {
+  const resp = await this.browseSkills(
+    1,
+    50,
+    query.category ?? "",
+    query.keyword ?? "",
+    query.tag ?? "",
+    "",
+    signal
+  );
+  return resp.items;
 };
-var BlockDeniedError = class extends Error {
-  constructor() {
-    super("sanitize: block type permanently denied");
-    this.name = "BlockDeniedError";
-  }
+Client.prototype.browseSkills = async function(page, pageSize, category, keyword, tag, source, signal) {
+  const qv = new URLSearchParams();
+  qv.set("page", String(page));
+  qv.set("pageSize", String(pageSize));
+  if (category) qv.set("category", category);
+  if (keyword) qv.set("keyword", keyword);
+  if (tag) qv.set("tag", tag);
+  if (source) qv.set("source", source);
+  const resp = await this.doPublicJSON(
+    "GET",
+    `/skill-store?${qv.toString()}`,
+    null,
+    signal
+  );
+  return resp.data;
 };
-var SizeError = class extends Error {
-  blockType;
-  actual;
-  limit;
-  constructor(blockType, actual, limit) {
-    super(`sanitize: ${blockType} base64 size ${actual} exceeds limit ${limit}`);
-    this.name = "SizeError";
-    this.blockType = blockType;
-    this.actual = actual;
-    this.limit = limit;
-  }
+Client.prototype.browseSkillsList = async function(page, pageSize, category, keyword, tag, source, signal) {
+  const qv = new URLSearchParams();
+  qv.set("page", String(page));
+  qv.set("pageSize", String(pageSize));
+  qv.set("fields", "minimal");
+  if (category) qv.set("category", category);
+  if (keyword) qv.set("keyword", keyword);
+  if (tag) qv.set("tag", tag);
+  if (source) qv.set("source", source);
+  const resp = await this.doPublicJSON(
+    "GET",
+    `/skill-store?${qv.toString()}`,
+    null,
+    signal
+  );
+  return resp.data;
 };
-var ErrHistoryTooDeep = new HistoryTooDeepError();
-var ErrBlockDenied = new BlockDeniedError();
-
-// src/sanitize/history.ts
-function dropBlocks(messages, pred) {
-  const droppedToolUseIDs = collectDroppedToolUseIDs(messages, pred);
-  const out = [];
-  for (const msg of messages) {
-    if (!isPlainObject(msg)) {
-      out.push(msg);
-      continue;
-    }
-    const content = msg["content"];
-    if (!Array.isArray(content)) {
-      out.push(msg);
-      continue;
-    }
-    const { kept, changed } = filterBlocks(content, pred, droppedToolUseIDs);
-    if (!changed) {
-      out.push(msg);
-      continue;
-    }
-    if (kept.length === 0) {
-      continue;
-    }
-    const newMsg = { ...msg };
-    newMsg["content"] = kept;
-    out.push(newMsg);
-  }
-  return out;
-}
-function collectDroppedToolUseIDs(messages, pred) {
-  const ids = /* @__PURE__ */ new Set();
-  for (const msg of messages) {
-    if (!isPlainObject(msg)) continue;
-    const content = msg["content"];
-    if (!Array.isArray(content)) continue;
-    for (const raw of content) {
-      if (!isPlainObject(raw)) continue;
-      if (!pred(raw)) continue;
-      const t = raw["type"];
-      if (typeof t !== "string") continue;
-      if (t === "tool_use" || t === "server_tool_use" || t === "mcp_tool_use") {
-        const id = raw["id"];
-        if (typeof id === "string" && id !== "") ids.add(id);
-      }
+Client.prototype.getSkillDetail = async function(skillID, signal) {
+  const resp = await this.doPublicJSON(
+    "GET",
+    `/skill-store/${encodeURIComponent(skillID)}`,
+    null,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.resolveSkill = async function(key, signal) {
+  const resp = await this.doPublicJSON(
+    "GET",
+    `/skill-store/resolve/${encodeURIComponent(key)}`,
+    null,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.installSkill = async function(skillID, signal) {
+  const resp = await this.doJSON(
+    "POST",
+    `/skill-store/${encodeURIComponent(skillID)}/install`,
+    null,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.downloadSkill = async function(skillID, signal) {
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), 5 * 60 * 1e3);
+  let parentHandler;
+  if (signal) {
+    if (signal.aborted) ctl.abort();
+    else {
+      parentHandler = () => ctl.abort();
+      signal.addEventListener("abort", parentHandler);
     }
   }
-  return ids;
-}
-function filterBlocks(content, pred, droppedToolUseIDs) {
-  const kept = [];
-  let changed = false;
-  for (const raw of content) {
-    if (!isPlainObject(raw)) {
-      kept.push(raw);
-      continue;
+  try {
+    const url = this.apiURL(`/skill-store/${encodeURIComponent(skillID)}/download`);
+    const headers = {};
+    let token = "";
+    try {
+      token = await this.ensureToken(ctl.signal);
+    } catch {
     }
-    if (pred(raw)) {
-      changed = true;
-      continue;
+    if (token) headers["Authorization"] = `Bearer ${token}`;
+    let resp;
+    try {
+      resp = await this.fetchImpl(url, { method: "GET", headers, signal: ctl.signal });
+    } catch (e) {
+      throw classifyTransport(`GET /skill-store/${skillID}/download`, url, e);
     }
-    if (droppedToolUseIDs.size > 0) {
-      const t = raw["type"];
-      if (t === "tool_result" || t === "mcp_tool_result") {
-        const id = raw["tool_use_id"];
-        if (typeof id === "string" && id !== "" && droppedToolUseIDs.has(id)) {
-          changed = true;
-          continue;
+    if (resp.status === 429) {
+      const bodyText = await readLimitedText(resp.body, maxErrorBodySize);
+      throw new RateLimitError("\u533F\u540D\u4E0B\u8F7D\u5DF2\u8FBE\u9650\u5236", resp.headers.get("Retry-After") ?? "", bodyText);
+    }
+    if (!resp.ok) {
+      const bodyBytes = await readLimited(resp.body, maxErrorBodySize);
+      throw new Error(
+        `download skill: ${parseHTTPErrorWithHeader(resp.status, bodyBytes, resp.headers).message}`
+      );
+    }
+    const data = await readLimited(resp.body, maxDownloadSize + 1);
+    if (data.byteLength > maxDownloadSize) {
+      throw new Error(`download skill: response exceeds ${maxDownloadSize >> 20}MB limit`);
+    }
+    let filename = "skill.zip";
+    const cd = resp.headers.get("Content-Disposition");
+    if (cd) {
+      const idx = cd.indexOf("filename");
+      if (idx !== -1) {
+        const parts = cd.slice(idx).split("=", 2);
+        if (parts.length === 2) {
+          filename = parts[1].trim().replace(/^["' ]+|["' ]+$/g, "");
         }
       }
     }
-    kept.push(raw);
+    return { data, filename };
+  } finally {
+    clearTimeout(timer);
+    if (parentHandler && signal) signal.removeEventListener("abort", parentHandler);
   }
-  return { kept, changed };
-}
-function stripEphemeral(messages) {
-  return dropBlocks(messages, (b) => {
-    const t = b["type"];
-    if (t === "thinking" || t === "redacted_thinking") {
-      return false;
+};
+Client.prototype.uploadSkill = async function(zipData, scope, intent, signal) {
+  return uploadSkillInternal(this, zipData, scope, intent, false, signal);
+};
+async function uploadSkillInternal(c, zipData, scope, intent, retried, signal) {
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), 5 * 60 * 1e3);
+  let parentHandler;
+  if (signal) {
+    if (signal.aborted) ctl.abort();
+    else {
+      parentHandler = () => ctl.abort();
+      signal.addEventListener("abort", parentHandler);
     }
-    const v = b[EphemeralMarkerField];
-    return v === true;
-  });
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-
-// src/sanitize/defensive.ts
-function sanitize(messages, cfg) {
-  if ((cfg.maxMessagesTurns ?? 0) > 0 && messages.length > cfg.maxMessagesTurns) {
-    throw ErrHistoryTooDeep;
-  }
-  if ((cfg.maxImageBytes ?? 0) > 0 || (cfg.maxVideoBytes ?? 0) > 0 || (cfg.maxPDFBytes ?? 0) > 0) {
-    checkMediaSizes(messages, cfg);
-  }
-  if (cfg.permanentDenyBlocks && cfg.permanentDenyBlocks.length > 0) {
-    const denySet = /* @__PURE__ */ new Set();
-    for (const bt of cfg.permanentDenyBlocks) denySet.add(bt);
-    messages = dropBlocks(messages, (b) => {
-      const t = b["type"];
-      return typeof t === "string" && denySet.has(t);
-    });
   }
-  return messages;
-}
-function checkMediaSizes(messages, cfg) {
-  for (const msg of messages) {
-    if (!isPlainObject2(msg)) continue;
-    const content = msg["content"];
-    if (!Array.isArray(content)) continue;
-    for (const raw of content) {
-      if (!isPlainObject2(raw)) continue;
-      const bt = raw["type"];
-      if (typeof bt !== "string") continue;
-      let limit = 0;
-      switch (bt) {
-        case "image":
-          limit = cfg.maxImageBytes ?? 0;
-          break;
-        case "video":
-          limit = cfg.maxVideoBytes ?? 0;
-          break;
-        case "document":
-          limit = cfg.maxPDFBytes ?? 0;
-          break;
-        default:
-          continue;
+  try {
+    const token = await c.ensureToken(ctl.signal);
+    const form = new FormData();
+    form.append("scope", scope);
+    form.append("intent", intent);
+    const blob = new Blob([zipData], { type: "application/zip" });
+    form.append("file", blob, "skill.zip");
+    const url = c.apiURL("/skill-store/upload");
+    let resp;
+    try {
+      resp = await c.fetchImpl(url, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}` },
+        body: form,
+        signal: ctl.signal
+      });
+    } catch (e) {
+      throw classifyTransport("POST /skill-store/upload", url, e);
+    }
+    if (resp.status === 401 && !retried) {
+      try {
+        await resp.body?.cancel();
+      } catch {
       }
-      if (limit <= 0) continue;
-      const data = extractBase64Data(raw);
-      if (data === "") continue;
-      const actual = base64DecodedLen(data);
-      if (actual > limit) {
-        throw new SizeError(bt, actual, limit);
+      try {
+        await c.forceRefresh(ctl.signal);
+      } catch (refreshErr) {
+        throw new Error(
+          `upload: unauthorized and refresh failed: ${refreshErr instanceof Error ? refreshErr.message : String(refreshErr)}`
+        );
       }
+      return uploadSkillInternal(c, zipData, scope, intent, true, signal);
     }
+    if (resp.status < 200 || resp.status >= 300) {
+      const bodyBytes = await readLimited(resp.body, maxErrorBodySize);
+      throw new Error(
+        `upload: ${parseHTTPErrorWithHeader(resp.status, bodyBytes, resp.headers).message}`
+      );
+    }
+    const text = await resp.text();
+    const result = JSON.parse(text);
+    return result.data.skill;
+  } finally {
+    clearTimeout(timer);
+    if (parentHandler && signal) signal.removeEventListener("abort", parentHandler);
   }
 }
-function extractBase64Data(block) {
-  const src = block["source"];
-  if (!isPlainObject2(src)) return "";
-  if (src["type"] !== "base64") return "";
-  const dataRaw = src["data"];
-  if (typeof dataRaw !== "string") return "";
-  let data = dataRaw;
-  const i = data.indexOf("base64,");
-  if (i >= 0) {
-    data = data.slice(i + "base64,".length);
-  }
-  return data;
-}
-function base64DecodedLen(b64) {
-  const n = b64.length;
-  let pad = 0;
-  if (n >= 1 && b64[n - 1] === "=") pad++;
-  if (n >= 2 && b64[n - 2] === "=") pad++;
-  return Math.floor(n * 3 / 4) - pad;
-}
-function isPlainObject2(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-
-// src/agent-runs-types.ts
-var AgentRunStreamError = class extends Error {
-  event;
-  code;
-  stage;
-  retryable;
-  constructor(event) {
-    const err = event.error;
-    super(err.stage ? `agent run failed: ${err.stage}: ${err.message}` : `agent run failed: ${err.message}`);
-    this.name = "AgentRunStreamError";
-    this.event = event;
-    this.code = err.code ?? "";
-    this.stage = err.stage ?? "";
-    this.retryable = err.retryable ?? false;
-  }
+Client.prototype.getSkillSummary = async function(signal) {
+  const resp = await this.doJSON("GET", "/skills/summary", null, signal);
+  return resp.data;
+};
+Client.prototype.certifySkill = async function(skillID, signal) {
+  await this.doJSON(
+    "POST",
+    `/skill-store/${encodeURIComponent(skillID)}/certify`,
+    null,
+    signal
+  );
+};
+Client.prototype.getCertificationStatus = async function(skillID, signal) {
+  const resp = await this.doJSON(
+    "GET",
+    `/skill-store/${encodeURIComponent(skillID)}/certification`,
+    null,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.generateSkill = async function(req, signal) {
+  const resp = await this.doJSON(
+    "POST",
+    "/skill-generator/generate",
+    req,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.optimizeSkill = async function(req, signal) {
+  const resp = await this.doJSON(
+    "POST",
+    "/skill-generator/optimize",
+    req,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.validateSkill = async function(skillName, signal) {
+  await this.doJSON(
+    "POST",
+    "/skill-generator/validate",
+    { skillName },
+    signal
+  );
 };
 
-// src/client/agent-runs.ts
-init_types();
-var agentRunsByClient = /* @__PURE__ */ new WeakMap();
-Object.defineProperty(Client.prototype, "agentRuns", {
-  configurable: true,
-  enumerable: false,
-  get() {
-    let existing = agentRunsByClient.get(this);
-    if (!existing) {
-      existing = new AgentRunsClient(this);
-      agentRunsByClient.set(this, existing);
+// src/skills/tools.ts
+Client.prototype.listTools = async function(signal) {
+  const resp = await this.doJSON("GET", "/tools", null, signal);
+  return resp.data.skills;
+};
+Client.prototype.getTool = async function(toolID, signal) {
+  const resp = await this.doJSON(
+    "GET",
+    `/tools/${encodeURIComponent(toolID)}`,
+    null,
+    signal
+  );
+  return resp.data;
+};
+
+// src/notifications/types.ts
+function parseNotificationEvent(ev) {
+  if (ev.type !== "event" || ev.topic !== "system") {
+    return null;
+  }
+  if (ev.data == null) return null;
+  let n;
+  try {
+    if (typeof ev.data === "string") {
+      n = JSON.parse(ev.data);
+    } else {
+      n = ev.data;
     }
-    return existing;
+  } catch {
+    return null;
   }
-});
-var AgentRunsClient = class {
-  constructor(client) {
-    this.client = client;
+  if (!n.id) return null;
+  return n;
+}
+
+// src/notifications/notifications.ts
+Client.prototype.listNotifications = async function(page, pageSize, typeFilter, signal) {
+  let path = `/notifications?page=${page}&pageSize=${pageSize}`;
+  if (typeFilter) path += `&type=${encodeURIComponent(typeFilter)}`;
+  const resp = await this.doJSON("GET", path, null, signal);
+  return resp.data;
+};
+Client.prototype.getUnreadCount = async function(signal) {
+  const resp = await this.doJSON(
+    "GET",
+    "/notifications/unread-count",
+    null,
+    signal
+  );
+  return resp.data.unreadCount;
+};
+Client.prototype.markNotificationRead = async function(id, signal) {
+  await this.doJSON(
+    "PUT",
+    `/notifications/${encodeURIComponent(id)}/read`,
+    null,
+    signal
+  );
+};
+Client.prototype.markAllNotificationsRead = async function(signal) {
+  await this.doJSON("PUT", "/notifications/read-all", null, signal);
+};
+Client.prototype.deleteNotification = async function(id, signal) {
+  await this.doJSON(
+    "DELETE",
+    `/notifications/${encodeURIComponent(id)}`,
+    null,
+    signal
+  );
+};
+Client.prototype.registerDevice = async function(reg, signal) {
+  await this.doJSON("POST", "/devices/register", reg, signal);
+};
+Client.prototype.unregisterDevice = async function(token, signal) {
+  await this.doJSON(
+    "DELETE",
+    `/devices/${encodeURIComponent(token)}`,
+    null,
+    signal
+  );
+};
+Client.prototype.listNotificationPreferences = async function(signal) {
+  const resp = await this.doJSON(
+    "GET",
+    "/notification-preferences",
+    null,
+    signal
+  );
+  return resp.data;
+};
+Client.prototype.updateNotificationPreference = async function(typeCode, pref, signal) {
+  await this.doJSON(
+    "PUT",
+    `/notification-preferences/${encodeURIComponent(typeCode)}`,
+    pref,
+    signal
+  );
+};
+
+// src/notifications/ws.ts
+Client.prototype.connect = async function(cfg, signal) {
+  const noop = () => {
+  };
+  const filledCfg = {
+    onEvent: cfg.onEvent ?? noop,
+    onConnect: cfg.onConnect ?? noop,
+    onDisconnect: cfg.onDisconnect ?? noop,
+    topics: cfg.topics ?? [],
+    reconnectMinMs: cfg.reconnectMinMs ?? 2e3,
+    reconnectMaxMs: cfg.reconnectMaxMs ?? 6e4,
+    autoReconnect: cfg.autoReconnect ?? true
+  };
+  let resolveDone;
+  const done = new Promise((r) => {
+    resolveDone = r;
+  });
+  const abort = new AbortController();
+  if (signal) {
+    if (signal.aborted) abort.abort();
+    else signal.addEventListener("abort", () => abort.abort());
   }
-  client;
-  async create(req, signal) {
-    const resp = await this.requestAPI(
-      "POST",
-      "/agent-runs",
-      toWireCreateRequest(req),
-      signal,
-      { retryOn401: false }
-    );
-    return fromWireCreateResponse(resp);
+  const ws = {
+    conn: null,
+    cfg: filledCfg,
+    abort,
+    done,
+    doneResolve: resolveDone,
+    connected: false
+  };
+  await wsConnectOnce(this, ws);
+  this.ws = ws;
+  void wsLoop(this, ws);
+};
+Client.prototype.disconnect = async function() {
+  const ws = this.ws;
+  this.ws = null;
+  if (!ws) return;
+  ws.abort.abort();
+  ws.connected = false;
+  if (ws.conn) {
+    try {
+      ws.conn.close(1e3, "");
+    } catch {
+    }
   }
-  get(runId, signal) {
-    return this.requestAPI(
-      "GET",
-      `/agent-runs/${encodeURIComponent(runId)}`,
-      null,
-      signal,
-      { retryOn401: true }
-    ).then(fromWireRun);
+  await Promise.race([
+    ws.done,
+    new Promise((resolve) => setTimeout(resolve, 5e3))
+  ]);
+};
+Client.prototype.isConnected = function() {
+  const ws = this.ws;
+  if (!ws) return false;
+  return ws.connected;
+};
+function wsURL(c) {
+  const base = c.apiURL("/ws");
+  return base.replace(/^http:\/\//, "ws://").replace(/^https:\/\//, "wss://");
+}
+function getWebSocketCtor() {
+  const WSCtor = globalThis.WebSocket;
+  if (!WSCtor) {
+    throw new Error(
+      'WebSocket not available \u2014 on Node \u226421 set globalThis.WebSocket = require("ws") before connect'
+    );
   }
-  stream(runId, opts = {}, signal) {
-    return {
-      [Symbol.asyncIterator]: () => this.streamGen(runId, opts, signal)
-    };
+  return WSCtor;
+}
+async function wsConnectOnce(c, ws) {
+  const token = await c.ensureToken(ws.abort.signal);
+  const url = wsURL(c);
+  const WSCtor = getWebSocketCtor();
+  const u = new URL(url);
+  u.searchParams.set("token", token);
+  let conn;
+  try {
+    conn = new WSCtor(u.toString());
+  } catch (e) {
+    throw new Error(`dial: ${e instanceof Error ? e.message : String(e)}`);
   }
-  cancel(runId, signal) {
-    return this.requestAPI(
-      "POST",
-      `/agent-runs/${encodeURIComponent(runId)}/cancel`,
-      {},
-      signal,
+  await new Promise((resolve, reject) => {
+    let opened = false;
+    const handshakeTimer = setTimeout(() => {
+      if (!opened) {
+        try {
+          conn.close();
+        } catch {
+        }
+        reject(new Error("dial: handshake timeout"));
+      }
+    }, 3e4);
+    conn.addEventListener("open", () => {
+      opened = true;
+    });
+    conn.addEventListener("error", (e) => {
+      clearTimeout(handshakeTimer);
+      reject(new Error(`dial: ${e.message ?? "connection error"}`));
+    });
+    conn.addEventListener("message", (e) => {
+      try {
+        const msg = e.data;
+        const welcome = JSON.parse(msg);
+        if (welcome.type !== "welcome") {
+          clearTimeout(handshakeTimer);
+          try {
+            conn.close();
+          } catch {
+          }
+          reject(new Error(`unexpected first message: ${welcome.type}`));
+          return;
+        }
+        clearTimeout(handshakeTimer);
+        ws.conn = conn;
+        ws.connected = true;
+        if (ws.cfg.topics.length > 0) {
+          try {
+            conn.send(
+              JSON.stringify({
+                type: "subscribe",
+                topics: ws.cfg.topics
+              })
+            );
+          } catch (sendErr) {
+            ws.conn = null;
+            ws.connected = false;
+            try {
+              conn.close();
+            } catch {
+            }
+            reject(new Error(`send subscribe: ${sendErr instanceof Error ? sendErr.message : String(sendErr)}`));
+            return;
+          }
+        }
+        ws.cfg.onConnect();
+        console.log(`[acosmi-sdk] websocket connected, connId=${welcome.connId ?? ""}`);
+        resolve();
+      } catch (parseErr) {
+        clearTimeout(handshakeTimer);
+        try {
+          conn.close();
+        } catch {
+        }
+        reject(new Error(`parse welcome: ${parseErr instanceof Error ? parseErr.message : String(parseErr)}`));
+      }
+    }, { once: true });
+  });
+}
+async function wsLoop(c, ws) {
+  try {
+    while (true) {
+      await wsReadLoop(ws);
+      if (ws.abort.signal.aborted) return;
+      if (ws.conn) {
+        try {
+          ws.conn.close();
+        } catch {
+        }
+        ws.conn = null;
+      }
+      ws.connected = false;
+      if (!ws.cfg.autoReconnect) return;
+      let delay = ws.cfg.reconnectMinMs;
+      while (true) {
+        if (ws.abort.signal.aborted) return;
+        await sleepWithSignal2(delay, ws.abort.signal).catch(() => {
+        });
+        if (ws.abort.signal.aborted) return;
+        console.log(`[acosmi-sdk] websocket reconnecting (delay=${delay}ms)...`);
+        try {
+          await wsConnectOnce(c, ws);
+          break;
+        } catch (err) {
+          console.log(`[acosmi-sdk] websocket reconnect failed: ${err instanceof Error ? err.message : String(err)}`);
+          delay = Math.min(delay * 2, ws.cfg.reconnectMaxMs);
+        }
+      }
+    }
+  } finally {
+    ws.doneResolve();
+  }
+}
+async function wsReadLoop(ws) {
+  const conn = ws.conn;
+  if (!conn) return;
+  return new Promise((resolve) => {
+    const handleMessage = (e) => {
+      try {
+        const data = e.data;
+        const event = JSON.parse(data);
+        try {
+          ws.cfg.onEvent(event);
+        } catch {
+        }
+      } catch {
+      }
+    };
+    const handleClose = (e) => {
+      conn.removeEventListener("message", handleMessage);
+      conn.removeEventListener("close", handleClose);
+      conn.removeEventListener("error", handleError);
+      try {
+        ws.cfg.onDisconnect(new Error(`closed: code=${e.code} reason=${e.reason}`));
+      } catch {
+      }
+      resolve();
+    };
+    const handleError = (e) => {
+      conn.removeEventListener("message", handleMessage);
+      conn.removeEventListener("close", handleClose);
+      conn.removeEventListener("error", handleError);
+      try {
+        ws.cfg.onDisconnect(e);
+      } catch {
+      }
+      resolve();
+    };
+    conn.addEventListener("message", handleMessage);
+    conn.addEventListener("close", handleClose);
+    conn.addEventListener("error", handleError);
+    if (ws.abort.signal.aborted) {
+      try {
+        conn.close();
+      } catch {
+      }
+    } else {
+      ws.abort.signal.addEventListener(
+        "abort",
+        () => {
+          try {
+            conn.close();
+          } catch {
+          }
+        },
+        { once: true }
+      );
+    }
+  });
+}
+async function sleepWithSignal2(ms, signal) {
+  if (ms <= 0) return;
+  if (signal.aborted) throw new Error("aborted");
+  return new Promise((resolve, reject) => {
+    const t = setTimeout(() => {
+      signal.removeEventListener("abort", abortHandler);
+      resolve();
+    }, ms);
+    const abortHandler = () => {
+      clearTimeout(t);
+      signal.removeEventListener("abort", abortHandler);
+      reject(new Error("aborted"));
+    };
+    signal.addEventListener("abort", abortHandler);
+  });
+}
+
+// src/agent-runs/types.ts
+var AgentRunStreamError = class extends Error {
+  event;
+  code;
+  stage;
+  retryable;
+  constructor(event) {
+    const err = event.error;
+    super(err.stage ? `agent run failed: ${err.stage}: ${err.message}` : `agent run failed: ${err.message}`);
+    this.name = "AgentRunStreamError";
+    this.event = event;
+    this.code = err.code ?? "";
+    this.stage = err.stage ?? "";
+    this.retryable = err.retryable ?? false;
+  }
+};
+
+// src/agent-runs/client.ts
+var agentRunsByClient = /* @__PURE__ */ new WeakMap();
+Object.defineProperty(Client.prototype, "agentRuns", {
+  configurable: true,
+  enumerable: false,
+  get() {
+    let existing = agentRunsByClient.get(this);
+    if (!existing) {
+      existing = new AgentRunsClient(this);
+      agentRunsByClient.set(this, existing);
+    }
+    return existing;
+  }
+});
+var AgentRunsClient = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async create(req, signal) {
+    const resp = await this.requestAPI(
+      "POST",
+      "/agent-runs",
+      toWireCreateRequest(req),
+      signal,
+      { retryOn401: false }
+    );
+    return fromWireCreateResponse(resp);
+  }
+  get(runId, signal) {
+    return this.requestAPI(
+      "GET",
+      `/agent-runs/${encodeURIComponent(runId)}`,
+      null,
+      signal,
+      { retryOn401: true }
+    ).then(fromWireRun);
+  }
+  stream(runId, opts = {}, signal) {
+    return {
+      [Symbol.asyncIterator]: () => this.streamGen(runId, opts, signal)
+    };
+  }
+  cancel(runId, signal) {
+    return this.requestAPI(
+      "POST",
+      `/agent-runs/${encodeURIComponent(runId)}/cancel`,
+      {},
+      signal,
       { retryOn401: false }
     ).then(fromWireRun);
   }
@@ -4718,801 +4922,1138 @@ function errorMessage(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
-// src/index.ts
-init_betas();
-
-// src/client/entitlements.ts
-Client.prototype.getBalance = async function(signal) {
-  const resp = await this.doJSON(
-    "GET",
-    "/entitlements/balance",
-    null,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.getBalanceDetail = async function(signal) {
-  const resp = await this.doJSON(
-    "GET",
-    "/entitlements/balance-detail",
-    null,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.listEntitlements = async function(status, signal) {
-  let path = "/entitlements";
-  if (status !== "") {
-    path += `?status=${encodeURIComponent(status)}`;
-  }
-  const resp = await this.doJSON("GET", path, null, signal);
-  return resp.data;
-};
-Client.prototype.listConsumeRecords = async function(page, pageSize, signal) {
-  const path = `/entitlements/consume-records?page=${page}&pageSize=${pageSize}`;
-  const resp = await this.doJSON("GET", path, null, signal);
-  return resp.data;
-};
-Client.prototype.claimMonthlyFree = async function(signal) {
-  const resp = await this.doJSON(
-    "POST",
-    "/entitlements/claim-monthly",
-    null,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.getByModel = async function(modelID, signal) {
-  if (modelID === "") throw new Error("modelID required");
-  const path = `/entitlements/by-model?modelId=${encodeURIComponent(modelID)}`;
-  const resp = await this.doJSON("GET", path, null, signal);
-  return resp.data;
-};
-Client.prototype.listBuckets = async function(signal) {
-  const resp = await this.doJSON(
-    "GET",
-    "/entitlements/buckets",
-    null,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.listCoefficients = async function(signal) {
-  if (this.coefCacheData && Date.now() - this.coefCacheTimeMs < coefCacheTTLMs) {
-    return [...this.coefCacheData];
-  }
-  const resp = await this.doJSON(
-    "GET",
-    "/entitlements/coefficients",
-    null,
-    signal
-  );
-  this.coefCacheData = [...resp.data];
-  this.coefCacheTimeMs = Date.now();
-  return resp.data;
-};
-Client.prototype.invalidateCoefficientCache = function() {
-  this.coefCacheData = null;
-  this.coefCacheTimeMs = 0;
-};
+// src/compliance/scopes.ts
+var ScopeComplianceEvidenceRead = "compliance:evidence:read";
+var ScopeComplianceEvidenceWrite = "compliance:evidence:write";
+var ScopeComplianceTimestampIssue = "compliance:timestamp:issue";
+var ScopeComplianceTimestampVerify = "compliance:timestamp:verify";
+var ScopeComplianceContractSigningRead = "compliance:contract_signing:read";
+var ScopeComplianceContractSigningWrite = "compliance:contract_signing:write";
+var ScopeComplianceSealManage = "compliance:seal:manage";
+var ScopeComplianceSealApprovalRequest = "compliance:seal_approval:request";
+var ScopeComplianceSealApprovalApprove = "compliance:seal_approval:approve";
+var ScopeComplianceSealUseExecute = "compliance:seal_use:execute";
+var ScopeComplianceReportsRead = "compliance:reports:read";
+var ScopeComplianceReportsWrite = "compliance:reports:write";
+var ScopeComplianceReportsPublish = "compliance:reports:publish";
+var ScopeComplianceContractTemplateRead = "compliance:contract_template:read";
+var ScopeComplianceContractTemplateWrite = "compliance:contract_template:write";
+function complianceScopes() {
+  return [
+    ScopeComplianceEvidenceRead,
+    ScopeComplianceEvidenceWrite,
+    ScopeComplianceTimestampIssue,
+    ScopeComplianceTimestampVerify,
+    ScopeComplianceContractSigningRead,
+    ScopeComplianceContractSigningWrite,
+    ScopeComplianceSealManage,
+    ScopeComplianceSealApprovalRequest,
+    ScopeComplianceSealApprovalApprove,
+    ScopeComplianceSealUseExecute,
+    ScopeComplianceReportsRead,
+    ScopeComplianceReportsWrite,
+    ScopeComplianceReportsPublish,
+    ScopeComplianceContractTemplateRead,
+    ScopeComplianceContractTemplateWrite
+  ];
+}
 
-// src/client/packages.ts
-init_types();
-Client.prototype.listTokenPackages = async function(signal) {
-  const raw = await this.doJSON("GET", "/token-packages", null, signal);
-  if (raw.data && typeof raw.data === "object" && "list" in raw.data) {
-    const page = raw.data;
-    if (Array.isArray(page.list)) return page.list;
-  }
-  if (Array.isArray(raw.data)) return raw.data;
-  throw new Error("decode token packages: unexpected shape");
-};
-Client.prototype.getTokenPackageDetail = async function(packageID, signal) {
-  const resp = await this.doJSON(
-    "GET",
-    `/token-packages/${encodeURIComponent(packageID)}`,
-    null,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.buyTokenPackage = async function(packageID, payload, signal) {
-  const body = payload ?? null;
-  const resp = await this.doJSON(
-    "POST",
-    `/token-packages/${encodeURIComponent(packageID)}/buy`,
-    body,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.getOrderStatus = async function(orderID, signal) {
-  const resp = await this.doJSON(
-    "GET",
-    `/token-packages/orders/${encodeURIComponent(orderID)}/status`,
-    null,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.listMyOrders = async function(signal) {
-  const raw = await this.doJSON("GET", "/token-packages/my", null, signal);
-  if (raw.data && typeof raw.data === "object" && "list" in raw.data) {
-    const page = raw.data;
-    if (Array.isArray(page.list)) return page.list;
-  }
-  if (Array.isArray(raw.data)) return raw.data;
-  throw new Error("decode orders: unexpected shape");
-};
-Client.prototype.waitForPayment = async function(orderID, pollIntervalMs, signal) {
-  if (pollIntervalMs <= 0) pollIntervalMs = 2e3;
-  while (true) {
-    const status = await this.getOrderStatus(orderID, signal);
-    if (isOrderTerminal(status.status)) {
-      if (isOrderSuccess(status.status)) return status;
-      throw new OrderTerminalError(orderID, status.status);
-    }
-    await sleepWithSignal(pollIntervalMs, signal);
+// src/compliance/status.ts
+var ErrComplianceStepUpRequired = "COMPLIANCE_STEP_UP_REQUIRED";
+var ErrEnvelopeGateClosed = "ENVELOPE_GATE_CLOSED";
+var ErrProviderNotConfigured = "PROVIDER_NOT_CONFIGURED";
+var ErrProviderUnknownNoRetry = "PROVIDER_REQUEST_UNKNOWN_NO_RETRY";
+var ErrBillingCallbackCannotCommit = "BILLING_CALLBACK_CANNOT_COMMIT";
+var ErrBillingCommitRequiresLocalVerify = "BILLING_COMMIT_REQUIRES_LOCAL_VERIFY";
+var ErrBillingS2sForbidden = "BILLING_S2S_FORBIDDEN";
+var ErrSealApprovalNotApproved = "SEAL_APPROVAL_STATE_NOT_APPROVED";
+var ErrSealApprovalExpired = "SEAL_APPROVAL_EXPIRED";
+var ErrSealApprovalNonceUsed = "SEAL_APPROVAL_NONCE_USED";
+var ErrSealApprovalContractHashMismatch = "SEAL_APPROVAL_CONTRACT_HASH_MISMATCH";
+var ErrSealApprovalSealMismatch = "SEAL_APPROVAL_SEAL_MISMATCH";
+var ErrSealApprovalLocationMismatch = "SEAL_APPROVAL_LOCATION_MISMATCH";
+var ErrSealApprovalTransactorMismatch = "SEAL_APPROVAL_TRANSACTOR_MISMATCH";
+var ErrSealUseAlreadyConsumed = "SEAL_USE_ALREADY_CONSUMED";
+function isComplianceTerminalError(code) {
+  switch (code) {
+    case ErrEnvelopeGateClosed:
+    case ErrProviderNotConfigured:
+    case ErrProviderUnknownNoRetry:
+    case ErrBillingCallbackCannotCommit:
+    case ErrBillingCommitRequiresLocalVerify:
+    case ErrBillingS2sForbidden:
+    case ErrSealApprovalNonceUsed:
+    case ErrSealApprovalExpired:
+    case ErrSealApprovalContractHashMismatch:
+    case ErrSealApprovalSealMismatch:
+    case ErrSealApprovalLocationMismatch:
+    case ErrSealApprovalTransactorMismatch:
+    case ErrSealUseAlreadyConsumed:
+      return true;
+    default:
+      return false;
   }
-};
-async function sleepWithSignal(ms, signal) {
-  if (ms <= 0) return;
-  if (signal && signal.aborted) throw new Error("aborted");
-  return new Promise((resolve, reject) => {
-    const t = setTimeout(() => {
-      if (signal && abortHandler) signal.removeEventListener("abort", abortHandler);
-      resolve();
-    }, ms);
-    let abortHandler;
-    if (signal) {
-      abortHandler = () => {
-        clearTimeout(t);
-        signal.removeEventListener("abort", abortHandler);
-        reject(new Error("aborted"));
-      };
-      signal.addEventListener("abort", abortHandler);
-    }
-  });
+}
+function isBillingConfirmable(providerStatus, billingStatus) {
+  return providerStatus === "success" && billingStatus === "committed";
 }
 
-// src/client/wallet.ts
-Client.prototype.getWalletStats = async function(signal) {
-  const resp = await this.doJSON("GET", "/wallet/stats", null, signal);
-  return resp.data;
-};
-Client.prototype.getWalletTransactions = async function(signal) {
-  const resp = await this.doJSON(
-    "GET",
-    "/wallet/transactions",
-    null,
-    signal
-  );
-  return resp.data;
-};
-
-// src/client/skills.ts
-init_types();
-Client.prototype.browseSkillStore = async function(query, signal) {
-  const resp = await this.browseSkills(
-    1,
-    50,
-    query.category ?? "",
-    query.keyword ?? "",
-    query.tag ?? "",
-    "",
-    signal
-  );
-  return resp.items;
-};
-Client.prototype.browseSkills = async function(page, pageSize, category, keyword, tag, source, signal) {
-  const qv = new URLSearchParams();
-  qv.set("page", String(page));
-  qv.set("pageSize", String(pageSize));
-  if (category) qv.set("category", category);
-  if (keyword) qv.set("keyword", keyword);
-  if (tag) qv.set("tag", tag);
-  if (source) qv.set("source", source);
-  const resp = await this.doPublicJSON(
-    "GET",
-    `/skill-store?${qv.toString()}`,
-    null,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.browseSkillsList = async function(page, pageSize, category, keyword, tag, source, signal) {
-  const qv = new URLSearchParams();
-  qv.set("page", String(page));
-  qv.set("pageSize", String(pageSize));
-  qv.set("fields", "minimal");
-  if (category) qv.set("category", category);
-  if (keyword) qv.set("keyword", keyword);
-  if (tag) qv.set("tag", tag);
-  if (source) qv.set("source", source);
-  const resp = await this.doPublicJSON(
-    "GET",
-    `/skill-store?${qv.toString()}`,
-    null,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.getSkillDetail = async function(skillID, signal) {
-  const resp = await this.doPublicJSON(
-    "GET",
-    `/skill-store/${encodeURIComponent(skillID)}`,
-    null,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.resolveSkill = async function(key, signal) {
-  const resp = await this.doPublicJSON(
-    "GET",
-    `/skill-store/resolve/${encodeURIComponent(key)}`,
-    null,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.installSkill = async function(skillID, signal) {
-  const resp = await this.doJSON(
-    "POST",
-    `/skill-store/${encodeURIComponent(skillID)}/install`,
-    null,
-    signal
-  );
-  return resp.data;
+// src/compliance/errors.ts
+var CODE_TO_KEY = {
+  // 通用 / token / scope (1-031-000-xxx)
+  1031000001: "COMPLIANCE_UNAUTHORIZED",
+  1031000002: "COMPLIANCE_TOKEN_INVALID",
+  1031000003: "COMPLIANCE_TOKEN_INVALID",
+  1031000004: "COMPLIANCE_TOKEN_INVALID",
+  1031000005: "COMPLIANCE_TOKEN_INVALID",
+  1031000006: "COMPLIANCE_TOKEN_INVALID",
+  1031000007: "COMPLIANCE_TOKEN_INVALID",
+  1031000008: "COMPLIANCE_TOKEN_INVALID",
+  1031000009: "COMPLIANCE_TOKEN_INVALID",
+  1031000010: "COMPLIANCE_TOKEN_INVALID",
+  1031000011: "COMPLIANCE_TOKEN_INVALID",
+  1031000012: "COMPLIANCE_INSUFFICIENT_SCOPE",
+  1031000013: "COMPLIANCE_STEP_UP_REQUIRED",
+  // Subject snapshot (1-031-001-xxx)
+  1031001001: "SUBJECT_SNAPSHOT_NOT_FOUND",
+  1031001002: "SUBJECT_SNAPSHOT_TENANT_MISMATCH",
+  1031001003: "SUBJECT_SNAPSHOT_REQUIRED",
+  // Evidence / Timestamp / Package / Report (1-031-002-xxx)
+  1031002001: "EVIDENCE_ASSET_NOT_FOUND",
+  1031002002: "SUBJECT_SNAPSHOT_TENANT_MISMATCH",
+  1031002003: "EVIDENCE_ASSET_HASH_MISMATCH",
+  1031002004: "EVIDENCE_ASSET_PAYLOAD_REQUIRED",
+  1031002005: "EVIDENCE_ASSET_PAYLOAD_REQUIRED",
+  1031002006: "TIMESTAMP_TOKEN_NOT_FOUND",
+  1031002007: "TIMESTAMP_PROVIDER_FAILED",
+  1031002008: "TIMESTAMP_PROVIDER_UNKNOWN",
+  1031002009: "TIMESTAMP_LOCAL_VERIFY_FAILED",
+  1031002010: "TIMESTAMP_PROVIDER_NOT_AVAILABLE",
+  1031002011: "EVIDENCE_PACKAGE_NOT_FOUND",
+  1031002012: "EVIDENCE_PACKAGE_TIMESTAMP_REQUIRED",
+  1031002013: "EVIDENCE_PACKAGE_MANIFEST_HASH_MISMATCH",
+  1031002014: "REPORT_NOT_FOUND",
+  1031002015: "REPORT_ALREADY_PUBLISHED",
+  1031002016: "REPORT_DRAFT_REQUIRED",
+  1031002017: "EVIDENCE_VERIFY_TARGET_REQUIRED",
+  1031002018: "EVIDENCE_VERIFY_TARGET_NOT_FOUND",
+  // Provider request (1-031-003-xxx)
+  1031003001: "PROVIDER_REQUEST_UNKNOWN_NO_RETRY",
+  1031003002: "PROVIDER_CALLBACK_SOURCE_INVALID",
+  1031003003: "PROVIDER_NOT_CONFIGURED",
+  1031003010: "PROVIDER_REQUEST_NOT_FOUND",
+  1031003011: "PROVIDER_REQUEST_IDEMPOTENCY_REQUIRED",
+  1031003012: "PROVIDER_REQUEST_STATUS_NOT_TERMINAL",
+  // Envelope (1-031-004-xxx)
+  1031004001: "ENVELOPE_NOT_FOUND",
+  1031004002: "ENVELOPE_TENANT_MISMATCH",
+  1031004003: "ENVELOPE_STATE_NOT_ALLOWED",
+  1031004004: "ENVELOPE_GATE_CLOSED",
+  1031004005: "CONTRACT_NOT_FOUND",
+  1031004006: "CONTRACT_HASH_MISMATCH",
+  1031004007: "CONTRACT_NOT_FOUND",
+  1031004008: "PROVIDER_AUTHORIZATION_NOT_CONFIRMED",
+  1031004009: "PROVIDER_AUTHORIZATION_NOT_CONFIRMED",
+  1031004010: "ENVELOPE_EVIDENCE_NOT_READY",
+  // Seal approval / use (1-031-005-xxx)
+  1031005001: "SEAL_ASSET_NOT_FOUND",
+  1031005010: "SEAL_APPROVAL_NOT_FOUND",
+  1031005011: "SEAL_APPROVAL_NOT_FOUND",
+  1031005012: "SEAL_APPROVAL_STATE_NOT_APPROVED",
+  1031005013: "SEAL_APPROVAL_EXPIRED",
+  1031005014: "SEAL_APPROVAL_ALREADY_USED",
+  1031005015: "SEAL_APPROVAL_NONCE_USED",
+  1031005016: "SEAL_APPROVAL_SEAL_MISMATCH",
+  1031005017: "SEAL_APPROVAL_LOCATION_MISMATCH",
+  1031005018: "SEAL_APPROVAL_TRANSACTOR_MISMATCH",
+  1031005019: "SEAL_APPROVAL_CONTRACT_HASH_MISMATCH",
+  1031005020: "SEAL_APPROVAL_INVALID_TRANSITION",
+  1031005030: "SEAL_USE_ALREADY_CONSUMED",
+  // Billing (1-031-006-xxx)
+  1031006004: "BILLING_COMMIT_REQUIRES_LOCAL_VERIFY",
+  1031006005: "BILLING_COMMIT_REQUIRES_PROVIDER_SUCCESS",
+  1031006007: "BILLING_CALLBACK_CANNOT_COMMIT",
+  1031006008: "BILLING_PROVIDER_UNKNOWN_NOT_COMMITTABLE",
+  1031006009: "BILLING_S2S_FORBIDDEN",
+  // Audit (1-031-007-xxx)
+  1031007011: "AUDIT_CHAIN_TAMPER_DETECTED"
 };
-Client.prototype.downloadSkill = async function(skillID, signal) {
-  const ctl = new AbortController();
-  const timer = setTimeout(() => ctl.abort(), 5 * 60 * 1e3);
-  let parentHandler;
-  if (signal) {
-    if (signal.aborted) ctl.abort();
-    else {
-      parentHandler = () => ctl.abort();
-      signal.addEventListener("abort", parentHandler);
-    }
-  }
-  try {
-    const url = this.apiURL(`/skill-store/${encodeURIComponent(skillID)}/download`);
-    const headers = {};
-    let token = "";
-    try {
-      token = await this.ensureToken(ctl.signal);
-    } catch {
-    }
-    if (token) headers["Authorization"] = `Bearer ${token}`;
-    let resp;
-    try {
-      resp = await this.fetchImpl(url, { method: "GET", headers, signal: ctl.signal });
-    } catch (e) {
-      throw classifyTransport(`GET /skill-store/${skillID}/download`, url, e);
-    }
-    if (resp.status === 429) {
-      const bodyText = await readLimitedText(resp.body, maxErrorBodySize);
-      throw new RateLimitError("\u533F\u540D\u4E0B\u8F7D\u5DF2\u8FBE\u9650\u5236", resp.headers.get("Retry-After") ?? "", bodyText);
-    }
-    if (!resp.ok) {
-      const bodyBytes = await readLimited(resp.body, maxErrorBodySize);
-      throw new Error(
-        `download skill: ${parseHTTPErrorWithHeader(resp.status, bodyBytes, resp.headers).message}`
-      );
-    }
-    const data = await readLimited(resp.body, maxDownloadSize + 1);
-    if (data.byteLength > maxDownloadSize) {
-      throw new Error(`download skill: response exceeds ${maxDownloadSize >> 20}MB limit`);
-    }
-    let filename = "skill.zip";
-    const cd = resp.headers.get("Content-Disposition");
-    if (cd) {
-      const idx = cd.indexOf("filename");
-      if (idx !== -1) {
-        const parts = cd.slice(idx).split("=", 2);
-        if (parts.length === 2) {
-          filename = parts[1].trim().replace(/^["' ]+|["' ]+$/g, "");
-        }
-      }
+var STEP_UP_KEYS = /* @__PURE__ */ new Set(["COMPLIANCE_STEP_UP_REQUIRED"]);
+var TERMINAL_KEYS = /* @__PURE__ */ new Set([
+  "ENVELOPE_GATE_CLOSED",
+  "PROVIDER_NOT_CONFIGURED",
+  "PROVIDER_REQUEST_UNKNOWN_NO_RETRY",
+  "BILLING_CALLBACK_CANNOT_COMMIT",
+  "BILLING_COMMIT_REQUIRES_LOCAL_VERIFY",
+  "BILLING_COMMIT_REQUIRES_PROVIDER_SUCCESS",
+  "BILLING_PROVIDER_UNKNOWN_NOT_COMMITTABLE",
+  "BILLING_S2S_FORBIDDEN",
+  "SEAL_APPROVAL_NONCE_USED",
+  "SEAL_APPROVAL_EXPIRED",
+  "SEAL_APPROVAL_CONTRACT_HASH_MISMATCH",
+  "SEAL_APPROVAL_SEAL_MISMATCH",
+  "SEAL_APPROVAL_LOCATION_MISMATCH",
+  "SEAL_APPROVAL_TRANSACTOR_MISMATCH",
+  "SEAL_USE_ALREADY_CONSUMED",
+  "CONTRACT_HASH_MISMATCH",
+  "TIMESTAMP_LOCAL_VERIFY_FAILED",
+  "EVIDENCE_PACKAGE_MANIFEST_HASH_MISMATCH",
+  "AUDIT_CHAIN_TAMPER_DETECTED",
+  "PROVIDER_REQUEST_NOT_FOUND",
+  "EVIDENCE_ASSET_HASH_MISMATCH",
+  "EVIDENCE_VERIFY_TARGET_NOT_FOUND",
+  "REPORT_ALREADY_PUBLISHED"
+]);
+var RETRYABLE_KEYS = /* @__PURE__ */ new Set([]);
+function classifyComplianceError(err) {
+  const key = CODE_TO_KEY[err.code] ?? "UNKNOWN_COMPLIANCE_ERROR";
+  return {
+    code: err.code,
+    message: err.message,
+    key,
+    retryable: RETRYABLE_KEYS.has(key),
+    terminal: TERMINAL_KEYS.has(key),
+    stepUpRequired: STEP_UP_KEYS.has(key)
+  };
+}
+function isComplianceBusinessError(err) {
+  return err.code >= 1031e6 && err.code <= 1031999999;
+}
+
+// src/compliance/client.ts
+var cache = /* @__PURE__ */ new WeakMap();
+Object.defineProperty(Client.prototype, "compliance", {
+  configurable: true,
+  enumerable: false,
+  get() {
+    let existing = cache.get(this);
+    if (!existing) {
+      existing = new ComplianceClient(this);
+      cache.set(this, existing);
     }
-    return { data, filename };
-  } finally {
-    clearTimeout(timer);
-    if (parentHandler && signal) signal.removeEventListener("abort", parentHandler);
+    return existing;
   }
+});
+var DEFAULT_POLL = {
+  timeoutMs: 6e4,
+  initialIntervalMs: 1e3,
+  maxIntervalMs: 5e3,
+  multiplier: 1.5
 };
-Client.prototype.uploadSkill = async function(zipData, scope, intent, signal) {
-  return uploadSkillInternal(this, zipData, scope, intent, false, signal);
+var CompliancePollError = class extends Error {
+  kind;
+  lastInfo;
+  constructor(message, kind, lastInfo) {
+    super(message);
+    this.name = "CompliancePollError";
+    this.kind = kind;
+    this.lastInfo = lastInfo;
+  }
 };
-async function uploadSkillInternal(c, zipData, scope, intent, retried, signal) {
-  const ctl = new AbortController();
-  const timer = setTimeout(() => ctl.abort(), 5 * 60 * 1e3);
-  let parentHandler;
-  if (signal) {
-    if (signal.aborted) ctl.abort();
-    else {
-      parentHandler = () => ctl.abort();
-      signal.addEventListener("abort", parentHandler);
-    }
+var ComplianceClient = class {
+  constructor(client) {
+    this.client = client;
   }
-  try {
-    const token = await c.ensureToken(ctl.signal);
-    const form = new FormData();
-    form.append("scope", scope);
-    form.append("intent", intent);
-    const blob = new Blob([zipData], { type: "application/zip" });
-    form.append("file", blob, "skill.zip");
-    const url = c.apiURL("/skill-store/upload");
-    let resp;
-    try {
-      resp = await c.fetchImpl(url, {
-        method: "POST",
-        headers: { Authorization: `Bearer ${token}` },
-        body: form,
-        signal: ctl.signal
-      });
-    } catch (e) {
-      throw classifyTransport("POST /skill-store/upload", url, e);
-    }
-    if (resp.status === 401 && !retried) {
-      try {
-        await resp.body?.cancel();
-      } catch {
-      }
-      try {
-        await c.forceRefresh(ctl.signal);
-      } catch (refreshErr) {
-        throw new Error(
-          `upload: unauthorized and refresh failed: ${refreshErr instanceof Error ? refreshErr.message : String(refreshErr)}`
-        );
-      }
-      return uploadSkillInternal(c, zipData, scope, intent, true, signal);
-    }
-    if (resp.status < 200 || resp.status >= 300) {
-      const bodyBytes = await readLimited(resp.body, maxErrorBodySize);
-      throw new Error(
-        `upload: ${parseHTTPErrorWithHeader(resp.status, bodyBytes, resp.headers).message}`
-      );
-    }
-    const text = await resp.text();
-    const result = JSON.parse(text);
-    return result.data.skill;
-  } finally {
-    clearTimeout(timer);
-    if (parentHandler && signal) signal.removeEventListener("abort", parentHandler);
+  client;
+  // =========================================================================
+  // Evidence Asset
+  // =========================================================================
+  /** 创建证据资产（写）。 */
+  createEvidenceAsset(req, opts = {}) {
+    return this.write(
+      "POST",
+      "/compliance/evidence/assets",
+      req,
+      writeCtx(opts)
+    );
+  }
+  /** 读 — 证据资产详情。 */
+  getEvidenceAsset(id, signal) {
+    return this.read(
+      "GET",
+      `/compliance/evidence/assets/${encodeURIComponent(id)}`,
+      null,
+      signal
+    );
+  }
+  /**
+   * 读 — 证据资产分页列表（compliance gateway S1）。
+   *
+   * 走 GET 读路径（允许 401 单次刷新重放）。返回 yudao `PageResult<T>`
+   * （`{ total, list }`）。所有过滤项可选；`createTimeStart` / `createTimeEnd`
+   * 由调用方按 `yyyy-MM-dd HH:mm:ss` 提供，SDK 原样透传。
+   */
+  listEvidenceAssets(req = {}, signal) {
+    return this.read(
+      "GET",
+      `/compliance/evidence/assets/page${pageQuery(req, ["assetType", "status", "createTimeStart", "createTimeEnd"])}`,
+      null,
+      signal
+    );
+  }
+  /**
+   * 公开 verify。隐私边界：返回字段不含 PII / 合同原文 / storage / provider raw。
+   *
+   * 匿名可调用：未 login 时走匿名请求，不会抛 `not authorized, call login() first`。
+   * 已 login / 已持有 token 时附带 `Authorization` 以保留审计上下文。public 端点不
+   * 应要求认证 — 收到 401 直接抛 HTTPError，不触发 `forceRefresh`，也不做 refresh
+   * replay。
+   */
+  verifyEvidencePublic(params, signal) {
+    const q = new URLSearchParams();
+    if (params.evidenceNo) q.set("evidenceNo", params.evidenceNo);
+    if (params.publicVerifyCode) q.set("publicVerifyCode", params.publicVerifyCode);
+    const qs = q.toString();
+    return this.publicRead(
+      "GET",
+      `/compliance/evidence/verify${qs ? "?" + qs : ""}`,
+      signal
+    );
+  }
+  // =========================================================================
+  // Timestamp
+  // =========================================================================
+  /** 申请时间章（写）。SDK 永远不传 provider 字段。 */
+  issueTimestamp(req, opts = {}) {
+    return this.write("POST", "/compliance/timestamps", req, writeCtx(opts));
+  }
+  /** 给已有资产申请时间章。SDK 永远不传 provider 字段。 */
+  issueTimestampForAsset(assetId, opts = {}) {
+    return this.write(
+      "POST",
+      `/compliance/evidence/assets/${encodeURIComponent(assetId)}/timestamp`,
+      null,
+      writeCtx(opts)
+    );
+  }
+  /** 读 — 时间章 token 详情。 */
+  getTimestamp(id, signal) {
+    return this.read(
+      "GET",
+      `/compliance/timestamps/${encodeURIComponent(id)}`,
+      null,
+      signal
+    );
+  }
+  /**
+   * 读 — 时间章分页列表（compliance gateway S1）。
+   *
+   * 走 GET 读路径。返回 yudao `PageResult<T>`。所有过滤项可选；`createTimeStart` /
+   * `createTimeEnd` 由调用方按 `yyyy-MM-dd HH:mm:ss` 提供，SDK 原样透传。
+   */
+  listTimestamps(req = {}, signal) {
+    return this.read(
+      "GET",
+      `/compliance/timestamps/page${pageQuery(req, ["provider", "verificationStatus", "createTimeStart", "createTimeEnd"])}`,
+      null,
+      signal
+    );
+  }
+  /** verify — 本地离线校验已申请的时间章。 */
+  verifyTimestamp(req, opts = {}) {
+    return this.write(
+      "POST",
+      "/compliance/timestamps/verify",
+      req,
+      writeCtx(opts)
+    );
+  }
+  /**
+   * 轮询到 VERIFIED 终态。
+   * - VERIFIED → 返回 token；
+   * - FAILED / LOCAL_VERIFY_FAILED → 抛 {@link CompliancePollError} kind='terminal_failure'；
+   * - UNKNOWN / RETRYING / PENDING → 继续轮询直到 timeout；
+   * - timeout → 抛 {@link CompliancePollError} kind='timeout'。
+   */
+  async waitForTimestampVerified(id, opts = {}) {
+    return this.poll(
+      () => this.getTimestamp(id, opts.signal),
+      (t) => classifyTimestamp(t.verificationStatus),
+      opts
+    );
+  }
+  // =========================================================================
+  // TSA readonly views (read-only — compliance gateway S3 / gap-register U-7)
+  // =========================================================================
+  /**
+   * 读 — 时间章授权机构（TSA）provider 列表（compliance gateway S3）。
+   *
+   * 走 GET 读路径（允许 401 单次刷新重放）。后端 G3 为每个 TSA provider 返回
+   * 一条 {@link TsaProvider}：名称、所处环境、当前是否可用。只读视图，不含
+   * provider 端点 / 凭证 / 证书等内部接入材料。
+   */
+  listTsaProviders(signal) {
+    return this.read(
+      "GET",
+      "/compliance/timestamps/providers",
+      null,
+      signal
+    );
+  }
+  /**
+   * 读 — 时间章统计视图（compliance gateway S3）。
+   *
+   * 走 GET 读路径（允许 401 单次刷新重放）。返回 {@link TsaStats}：时间章总数
+   * + 按校验状态分桶的计数。只读聚合视图。
+   */
+  getTsaStats(signal) {
+    return this.read(
+      "GET",
+      "/compliance/timestamps/stats",
+      null,
+      signal
+    );
+  }
+  // =========================================================================
+  // Evidence Package
+  // =========================================================================
+  /** 构建证据包（写）。 */
+  buildEvidencePackage(assetId, timestampTokenId, opts = {}) {
+    const tsParam = timestampTokenId == null ? "" : "?timestampTokenId=" + encodeURIComponent(timestampTokenId);
+    return this.write(
+      "POST",
+      `/compliance/evidence/assets/${encodeURIComponent(assetId)}/packages${tsParam}`,
+      null,
+      writeCtx(opts)
+    );
+  }
+  /**
+   * 读 — 证据包分页列表（compliance gateway S1）。
+   *
+   * 走 GET 读路径。返回 yudao `PageResult<T>`。所有过滤项可选；`createTimeStart` /
+   * `createTimeEnd` 由调用方按 `yyyy-MM-dd HH:mm:ss` 提供，SDK 原样透传。
+   */
+  listEvidencePackages(req = {}, signal) {
+    return this.read(
+      "GET",
+      `/compliance/evidence/packages/page${pageQuery(req, ["status", "createTimeStart", "createTimeEnd"])}`,
+      null,
+      signal
+    );
+  }
+  // =========================================================================
+  // Report
+  // =========================================================================
+  /** 创建证据报告（写）。 */
+  createReport(req, opts = {}) {
+    return this.write("POST", "/compliance/reports", req, writeCtx(opts));
+  }
+  /** 读 — 报告详情。 */
+  getReport(id, signal) {
+    return this.read(
+      "GET",
+      `/compliance/reports/${encodeURIComponent(id)}`,
+      null,
+      signal
+    );
+  }
+  /**
+   * 读 — 证据报告分页列表（compliance gateway S1）。
+   *
+   * 走 GET 读路径。返回 yudao `PageResult<T>`。所有过滤项可选；`createTimeStart` /
+   * `createTimeEnd` 由调用方按 `yyyy-MM-dd HH:mm:ss` 提供，SDK 原样透传。
+   */
+  listReports(req = {}, signal) {
+    return this.read(
+      "GET",
+      `/compliance/reports/page${pageQuery(req, ["status", "createTimeStart", "createTimeEnd"])}`,
+      null,
+      signal
+    );
+  }
+  /**
+   * 发布报告（写，step-up 必须）。
+   *
+   * `@status gated` — step-up 闸门未闭合前服务端会一致返回
+   * `COMPLIANCE_STEP_UP_REQUIRED`（数值码 1031000013）。SDK 不会自动重试、不伪成功；
+   * 调用方需要引导用户重新做 OAuth introspection 或重新登录后再次调用本方法
+   *（使用同一 idempotency-key）。方法状态分级见 `docs/compliance.md` Method Status。
+   */
+  publishReport(id, opts = {}) {
+    return this.write(
+      "POST",
+      `/compliance/reports/${encodeURIComponent(id)}/publish`,
+      null,
+      writeCtx(opts)
+    );
+  }
+  /**
+   * 下载报告（读）。返回 {@link ReportDownload}：报告 hash + 资产 hash + 证据包 hash +
+   * 时间章 serial/genTime，足以离线复核。
+   * 不返回 bodyCanonicalJson / storage key / subject snapshot id。
+   */
+  downloadReport(id, signal) {
+    return this.read(
+      "GET",
+      `/compliance/reports/${encodeURIComponent(id)}/download`,
+      null,
+      signal
+    );
+  }
+  // =========================================================================
+  // Signing Envelope
+  // =========================================================================
+  /** 创建 envelope（写）。返回 envelope id。 */
+  createSigningEnvelope(req, opts = {}) {
+    return this.write(
+      "POST",
+      "/compliance/signing-envelopes",
+      req,
+      writeCtx(opts)
+    );
+  }
+  /** 读 — envelope 详情。租户由服务端从 compliance token principal 推导。 */
+  getSigningEnvelope(envelopeId, signal) {
+    return this.read(
+      "GET",
+      `/compliance/signing-envelopes/${encodeURIComponent(envelopeId)}`,
+      null,
+      signal
+    );
+  }
+  /**
+   * 读 — 签署 envelope 分页列表（compliance gateway S1）。
+   *
+   * 走 GET 读路径。返回 yudao `PageResult<T>`。所有过滤项可选；`createTimeStart` /
+   * `createTimeEnd` 由调用方按 `yyyy-MM-dd HH:mm:ss` 提供，SDK 原样透传。
+   */
+  listSigningEnvelopes(req = {}, signal) {
+    return this.read(
+      "GET",
+      `/compliance/signing-envelopes/page${pageQuery(req, ["status", "createTimeStart", "createTimeEnd"])}`,
+      null,
+      signal
+    );
+  }
+  /**
+   * 正式签署（写，step-up 必须）。
+   *
+   * `@status gated` — 服务端闸门关闭时会一致返回 `ENVELOPE_GATE_CLOSED` (1031004004)。
+   * SDK 不重试、不伪成功；调用方应该将该错误展示为"功能未开放"。
+   */
+  signEnvelope(envelopeId, req, opts = {}) {
+    return this.write(
+      "POST",
+      `/compliance/signing-envelopes/${encodeURIComponent(envelopeId)}/sign`,
+      req,
+      writeCtx(opts)
+    );
+  }
+  /**
+   * 创建 H5 签署短链（写，step-up 必须）。
+   *
+   * `@status gated` — 同 {@link signEnvelope}：服务端闸门关闭时 SDK 不重试、不伪成功。
+   */
+  createH5SigningUrl(envelopeId, req, opts = {}) {
+    return this.write(
+      "POST",
+      `/compliance/signing-envelopes/${encodeURIComponent(envelopeId)}/h5-url`,
+      req,
+      writeCtx(opts)
+    );
+  }
+  /** 同步 provider 状态（写但只读对账，不创建新 provider 请求）。 */
+  syncSigningEnvelopeStatus(envelopeId, opts = {}) {
+    return this.write(
+      "POST",
+      `/compliance/signing-envelopes/${encodeURIComponent(envelopeId)}/sync-provider-status`,
+      null,
+      writeCtx(opts)
+    );
+  }
+  /**
+   * 读 — envelope 下挂的合同列表（compliance gateway S4）。
+   *
+   * 走 GET 读路径（允许 401 单次刷新重放）。后端 G4 为每份挂在该 envelope 上的
+   * 合同返回一条 {@link EnvelopeContractItem}：编号 / 标题 / MIME / 大小 / 哈希
+   * 指纹 / 状态。返回普通数组（非 `PageResult`）。SDK-safe 视图——不含合同原文 /
+   * storage key / provider raw payload。
+   */
+  listEnvelopeContracts(envelopeId, signal) {
+    return this.read(
+      "GET",
+      `/compliance/signing-envelopes/${encodeURIComponent(envelopeId)}/contracts`,
+      null,
+      signal
+    );
+  }
+  /**
+   * 读 — envelope 关联的 provider 请求列表（compliance gateway S4）。
+   *
+   * 走 GET 读路径（允许 401 单次刷新重放）。后端 G4 复用操作投影
+   * {@link OperationPageItem}：描述每次 provider 请求本身的执行进度，与 envelope
+   * 领域状态正交。返回普通数组（非 `PageResult`）。
+   */
+  listEnvelopeProviderRequests(envelopeId, signal) {
+    return this.read(
+      "GET",
+      `/compliance/signing-envelopes/${encodeURIComponent(envelopeId)}/provider-requests`,
+      null,
+      signal
+    );
+  }
+  /**
+   * 作废 envelope（写，compliance gateway S4）。
+   *
+   * 走 compliance 写路径——发送前 `ensureToken` 一次、不自动重试、`401` 不刷新
+   * 重放；支持 `Idempotency-Key` header（强烈建议调用方持久化幂等键，重试 / 恢复
+   * 时复用，避免重复作废）。`req.reason` 为必填的作废原因，随 JSON body 提交。
+   */
+  voidEnvelope(envelopeId, req, opts = {}) {
+    return this.write(
+      "POST",
+      `/compliance/signing-envelopes/${encodeURIComponent(envelopeId)}/void`,
+      req,
+      writeCtx(opts)
+    );
+  }
+  // =========================================================================
+  // Seal Approval
+  // =========================================================================
+  /**
+   * 提交用印审批申请（写）。
+   *
+   * `@status production-ready` — 服务端以 `Idempotency-Key` + 业务请求指纹做重放保护：
+   * 同 key + 同请求 → 返回原审批 id；同 key + 不同请求 → 拒绝复用幂等键。强烈建议调用方
+   * 持久化 `idempotencyKey`，网络重试 / 任务恢复时复用，避免重复创建审批单。
+   */
+  submitSealApproval(req, opts = {}) {
+    return this.write(
+      "POST",
+      "/compliance/seal-approvals",
+      req,
+      writeCtx(opts)
+    );
+  }
+  /**
+   * 审批通过用印申请（写，step-up 必须）。
+   *
+   * `@status gated` — step-up 未闭合前服务端会返回 `COMPLIANCE_STEP_UP_REQUIRED`。
+   * SDK 不重试、不伪成功。方法状态分级见 `docs/compliance.md` Method Status。
+   */
+  approveSealApproval(id, query, opts = {}) {
+    const q = new URLSearchParams();
+    if (query.expiresAt) q.set("expiresAt", query.expiresAt);
+    if (query.note) q.set("note", query.note);
+    const qs = q.toString();
+    return this.write(
+      "POST",
+      `/compliance/seal-approvals/${encodeURIComponent(id)}/approve${qs ? "?" + qs : ""}`,
+      null,
+      writeCtx(opts)
+    );
   }
-}
-Client.prototype.getSkillSummary = async function(signal) {
-  const resp = await this.doJSON("GET", "/skills/summary", null, signal);
-  return resp.data;
-};
-Client.prototype.certifySkill = async function(skillID, signal) {
-  await this.doJSON(
-    "POST",
-    `/skill-store/${encodeURIComponent(skillID)}/certify`,
-    null,
-    signal
-  );
-};
-Client.prototype.getCertificationStatus = async function(skillID, signal) {
-  const resp = await this.doJSON(
-    "GET",
-    `/skill-store/${encodeURIComponent(skillID)}/certification`,
-    null,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.generateSkill = async function(req, signal) {
-  const resp = await this.doJSON(
-    "POST",
-    "/skill-generator/generate",
-    req,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.optimizeSkill = async function(req, signal) {
-  const resp = await this.doJSON(
-    "POST",
-    "/skill-generator/optimize",
-    req,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.validateSkill = async function(skillName, signal) {
-  await this.doJSON(
-    "POST",
-    "/skill-generator/validate",
-    { skillName },
-    signal
-  );
-};
-
-// src/client/tools.ts
-Client.prototype.listTools = async function(signal) {
-  const resp = await this.doJSON("GET", "/tools", null, signal);
-  return resp.data.skills;
-};
-Client.prototype.getTool = async function(toolID, signal) {
-  const resp = await this.doJSON(
-    "GET",
-    `/tools/${encodeURIComponent(toolID)}`,
-    null,
-    signal
-  );
-  return resp.data;
-};
-
-// src/client/notifications.ts
-Client.prototype.listNotifications = async function(page, pageSize, typeFilter, signal) {
-  let path = `/notifications?page=${page}&pageSize=${pageSize}`;
-  if (typeFilter) path += `&type=${encodeURIComponent(typeFilter)}`;
-  const resp = await this.doJSON("GET", path, null, signal);
-  return resp.data;
-};
-Client.prototype.getUnreadCount = async function(signal) {
-  const resp = await this.doJSON(
-    "GET",
-    "/notifications/unread-count",
-    null,
-    signal
-  );
-  return resp.data.unreadCount;
-};
-Client.prototype.markNotificationRead = async function(id, signal) {
-  await this.doJSON(
-    "PUT",
-    `/notifications/${encodeURIComponent(id)}/read`,
-    null,
-    signal
-  );
-};
-Client.prototype.markAllNotificationsRead = async function(signal) {
-  await this.doJSON("PUT", "/notifications/read-all", null, signal);
-};
-Client.prototype.deleteNotification = async function(id, signal) {
-  await this.doJSON(
-    "DELETE",
-    `/notifications/${encodeURIComponent(id)}`,
-    null,
-    signal
-  );
-};
-Client.prototype.registerDevice = async function(reg, signal) {
-  await this.doJSON("POST", "/devices/register", reg, signal);
-};
-Client.prototype.unregisterDevice = async function(token, signal) {
-  await this.doJSON(
-    "DELETE",
-    `/devices/${encodeURIComponent(token)}`,
-    null,
-    signal
-  );
-};
-Client.prototype.listNotificationPreferences = async function(signal) {
-  const resp = await this.doJSON(
-    "GET",
-    "/notification-preferences",
-    null,
-    signal
-  );
-  return resp.data;
-};
-Client.prototype.updateNotificationPreference = async function(typeCode, pref, signal) {
-  await this.doJSON(
-    "PUT",
-    `/notification-preferences/${encodeURIComponent(typeCode)}`,
-    pref,
-    signal
-  );
-};
-
-// src/sanitize-bridge.ts
-Client.prototype.setDefensiveSanitize = function(cfg) {
-  this.defensiveCfg = cfg;
-};
-Client.prototype.setAutoStripEphemeralHistory = function(on) {
-  this.autoStripEphemeral = on;
-};
-Client.prototype.applyRequestSanitizers = function(req) {
-  const cfg = this.defensiveCfg;
-  const strip = this.autoStripEphemeral;
-  if (cfg == null && !strip) return;
-  if (req.rawMessages != null) {
-    let msgs;
-    try {
-      msgs = normalizeRawMessages(req.rawMessages);
-    } catch (e) {
-      throw new Error(
-        `sanitize: normalize raw messages: ${e instanceof Error ? e.message : String(e)}`
-      );
-    }
-    if (cfg) {
-      msgs = sanitize(msgs, cfg);
-    }
-    if (strip) {
-      msgs = stripEphemeral(msgs);
-    }
-    req.rawMessages = msgs;
-    return;
+  rejectSealApproval(id, query, opts = {}) {
+    const q = new URLSearchParams();
+    if (query.reason) q.set("reason", query.reason);
+    const qs = q.toString();
+    return this.write(
+      "POST",
+      `/compliance/seal-approvals/${encodeURIComponent(id)}/reject${qs ? "?" + qs : ""}`,
+      null,
+      writeCtx(opts)
+    );
+  }
+  cancelSealApproval(id, query, opts = {}) {
+    const q = new URLSearchParams();
+    if (query.reason) q.set("reason", query.reason);
+    const qs = q.toString();
+    return this.write(
+      "POST",
+      `/compliance/seal-approvals/${encodeURIComponent(id)}/cancel${qs ? "?" + qs : ""}`,
+      null,
+      writeCtx(opts)
+    );
+  }
+  listPendingSealApprovals(signal) {
+    return this.read(
+      "GET",
+      "/compliance/seal-approvals/pending",
+      null,
+      signal
+    );
+  }
+  getSealApproval(id, signal) {
+    return this.read(
+      "GET",
+      `/compliance/seal-approvals/${encodeURIComponent(id)}`,
+      null,
+      signal
+    );
+  }
+  /**
+   * 读 — 用印审批分页列表（compliance gateway S1）。
+   *
+   * 与 {@link listPendingSealApprovals}（仅 pending、不分页）不同，本方法支持分页与
+   * 状态 / 时间过滤。走 GET 读路径。返回 yudao `PageResult<T>`。所有过滤项可选；
+   * `createTimeStart` / `createTimeEnd` 由调用方按 `yyyy-MM-dd HH:mm:ss` 提供，
+   * SDK 原样透传。
+   */
+  listSealApprovals(req = {}, signal) {
+    return this.read(
+      "GET",
+      `/compliance/seal-approvals/page${pageQuery(req, ["status", "createTimeStart", "createTimeEnd"])}`,
+      null,
+      signal
+    );
+  }
+  // =========================================================================
+  // Seal Use (read-only — compliance gateway S6 / gap-register U-4)
+  // =========================================================================
+  /**
+   * 读 — 用印执行记录分页列表（compliance gateway S6）。
+   *
+   * 走 GET 读路径（允许 401 单次刷新重放）。返回 yudao `PageResult<T>`
+   * （`{ total, list }`）。一次用印执行（seal use）描述 envelope / contract /
+   * seal / 审批联动后【真正调用 provider 落章】的那一笔记录，与 envelope
+   * 领域状态正交。所有过滤项可选；`createTimeStart` / `createTimeEnd` 由调用方
+   * 按 `yyyy-MM-dd HH:mm:ss` 提供，SDK 原样透传。
+   *
+   * 与后端复用同一只读 scope `CONTRACT_SIGNING_READ`
+   *（{@link ScopeComplianceContractSigningRead}）——不引入新 scope。
+   */
+  listSealUses(req = {}, signal) {
+    return this.read(
+      "GET",
+      `/compliance/seal-uses/page${pageQuery(req, ["sealId", "envelopeId", "usageStatus", "createTimeStart", "createTimeEnd"])}`,
+      null,
+      signal
+    );
+  }
+  // =========================================================================
+  // Provider Request (read-only)
+  // =========================================================================
+  getProviderRequest(id, signal) {
+    return this.read(
+      "GET",
+      `/compliance/provider-requests/${encodeURIComponent(id)}`,
+      null,
+      signal
+    );
+  }
+  /**
+   * 轮询 provider request 到 SUCCESS / FAILED 终态。
+   * - SUCCESS / FAILED → 返回最后视图；
+   * - UNKNOWN / RETRYING / PENDING → 继续轮询；
+   * - timeout → 抛 {@link CompliancePollError} kind='timeout'，不自动重发原 provider 请求。
+   *
+   * SUCCESS 不代表 billing 已 commit；调用方仍需通过业务侧 envelope / asset 终态判断。
+   */
+  async waitForProviderRequestTerminal(id, opts = {}) {
+    return this.poll(
+      () => this.getProviderRequest(id, opts.signal),
+      (v) => classifyProviderStatus(v.status),
+      opts
+    );
+  }
+  // =========================================================================
+  // Capabilities (read-only — compliance gateway S2 / gap-register U-6)
+  // =========================================================================
+  /**
+   * 读 — compliance 能力闸门列表（compliance gateway S2）。
+   *
+   * 走 GET 读路径（允许 401 单次刷新重放）。后端 G2 为每个高风险 / 收费动作
+   * （`signEnvelope` / `createH5SigningUrl` / `publishReport` /
+   * `approveSealApproval` / `executeSealUse` / `createSeal`）返回一条
+   * {@link ComplianceCapability}：是否可执行、所处状态、所需 scope / step-up。
+   *
+   * 调用方在高风险动作执行【前】查询本结果做门控；拿不到能力时必须 fail-closed
+   *（按 `executable=false` 处理）。
+   */
+  getCapabilities(signal) {
+    return this.read(
+      "GET",
+      "/compliance/capabilities",
+      null,
+      signal
+    );
+  }
+  /**
+   * 读 — 单个动作的能力闸门视图（便捷方法）。
+   *
+   * 拉取完整 {@link getCapabilities} 列表并返回 `action` 匹配的那一条，无匹配时
+   * 返回 `undefined`。**每次调用产生一次网络请求**——需要门控多个动作时应改用
+   * {@link getCapabilities} 一次性取回再本地查表，避免重复请求。
+   *
+   * 与 {@link getCapabilities} 一致走 GET 读路径（允许 401 单次刷新重放）。
+   */
+  async getFeatureGate(action, signal) {
+    const caps = await this.getCapabilities(signal);
+    return caps.find((c) => c.action === action);
+  }
+  // =========================================================================
+  // Operation projection (read-only — compliance gateway S2 / gap-register U-5)
+  // =========================================================================
+  /**
+   * 读 — compliance 操作投影分页列表（compliance gateway S2）。
+   *
+   * 走 GET 读路径。返回 yudao `PageResult<T>`（`{ total, list }`）。所有过滤项
+   * 可选；`createTimeStart` / `createTimeEnd` 由调用方按 `yyyy-MM-dd HH:mm:ss`
+   * 提供，SDK 原样透传，不做格式校验或时区转换。
+   *
+   * 操作投影描述【一次操作】本身的执行进度，与履约对象的领域状态正交。
+   */
+  listOperations(req = {}, signal) {
+    return this.read(
+      "GET",
+      `/compliance/operations/page${pageQuery(req, ["status", "createTimeStart", "createTimeEnd"])}`,
+      null,
+      signal
+    );
   }
-  if (cfg && (cfg.maxMessagesTurns ?? 0) > 0 && (req.messages?.length ?? 0) > cfg.maxMessagesTurns) {
-    throw ErrHistoryTooDeep;
+  /**
+   * 读 — compliance 操作投影详情（compliance gateway S2）。
+   *
+   * `id` 为数值行主键（非 `operationId` 幂等键）。走 GET 读路径（允许 401 单次
+   * 刷新重放）。
+   */
+  getOperation(id, signal) {
+    return this.read(
+      "GET",
+      `/compliance/operations/${encodeURIComponent(id)}`,
+      null,
+      signal
+    );
   }
-};
-function normalizeRawMessages(rm) {
-  if (Array.isArray(rm)) return rm;
-  let s;
-  try {
-    s = JSON.parse(JSON.stringify(rm));
-  } catch (e) {
-    throw new Error(`raw messages: ${e instanceof Error ? e.message : String(e)}`);
+  // =========================================================================
+  // Contract Template (compliance gateway S5 — gap-register U-2)
+  // =========================================================================
+  /**
+   * 创建合同模板（写）。
+   *
+   * 走 compliance 写路径——发送前 `ensureToken` 一次、不自动重试、`401` 不刷新
+   * 重放；支持 `Idempotency-Key` header（强烈建议调用方持久化幂等键，重试 / 恢复
+   * 时复用，避免重复创建模板）。模板创建后初始状态为 `DRAFT`。
+   */
+  createContractTemplate(req, opts = {}) {
+    return this.write(
+      "POST",
+      "/compliance/contract-templates",
+      req,
+      writeCtx(opts)
+    );
   }
-  if (!Array.isArray(s)) {
-    throw new Error("raw messages must be a JSON array");
+  /**
+   * 更新合同模板（写，仅 DRAFT 状态）。
+   *
+   * 走 compliance 写路径——`Idempotency-Key`、不重试、`401` 不刷新重放。所有字段
+   * 可选，缺省字段视为不修改。服务端在 PUBLISHED / ARCHIVED 状态下会拒绝更新。
+   */
+  updateContractTemplate(id, req, opts = {}) {
+    return this.write(
+      "POST",
+      `/compliance/contract-templates/${encodeURIComponent(id)}`,
+      req,
+      writeCtx(opts)
+    );
   }
-  return s;
-}
-
-// src/ws.ts
-Client.prototype.connect = async function(cfg, signal) {
-  const noop = () => {
-  };
-  const filledCfg = {
-    onEvent: cfg.onEvent ?? noop,
-    onConnect: cfg.onConnect ?? noop,
-    onDisconnect: cfg.onDisconnect ?? noop,
-    topics: cfg.topics ?? [],
-    reconnectMinMs: cfg.reconnectMinMs ?? 2e3,
-    reconnectMaxMs: cfg.reconnectMaxMs ?? 6e4,
-    autoReconnect: cfg.autoReconnect ?? true
-  };
-  let resolveDone;
-  const done = new Promise((r) => {
-    resolveDone = r;
-  });
-  const abort = new AbortController();
-  if (signal) {
-    if (signal.aborted) abort.abort();
-    else signal.addEventListener("abort", () => abort.abort());
+  /**
+   * 删除合同模板（写，仅 DRAFT 状态）。
+   *
+   * 走 compliance 写路径——`Idempotency-Key`、不重试、`401` 不刷新重放。服务端
+   * 在 PUBLISHED / ARCHIVED 状态下会拒绝删除——已发布的模板应改走 `archive`。
+   */
+  deleteContractTemplate(id, opts = {}) {
+    return this.write(
+      "POST",
+      `/compliance/contract-templates/${encodeURIComponent(id)}/delete`,
+      null,
+      writeCtx(opts)
+    );
   }
-  const ws = {
-    conn: null,
-    cfg: filledCfg,
-    abort,
-    done,
-    doneResolve: resolveDone,
-    connected: false
-  };
-  await wsConnectOnce(this, ws);
-  this.ws = ws;
-  void wsLoop(this, ws);
-};
-Client.prototype.disconnect = async function() {
-  const ws = this.ws;
-  this.ws = null;
-  if (!ws) return;
-  ws.abort.abort();
-  ws.connected = false;
-  if (ws.conn) {
-    try {
-      ws.conn.close(1e3, "");
-    } catch {
-    }
+  /** 读 — 合同模板详情。 */
+  getContractTemplate(id, signal) {
+    return this.read(
+      "GET",
+      `/compliance/contract-templates/${encodeURIComponent(id)}`,
+      null,
+      signal
+    );
   }
-  await Promise.race([
-    ws.done,
-    new Promise((resolve) => setTimeout(resolve, 5e3))
-  ]);
-};
-Client.prototype.isConnected = function() {
-  const ws = this.ws;
-  if (!ws) return false;
-  return ws.connected;
-};
-function wsURL(c) {
-  const base = c.apiURL("/ws");
-  return base.replace(/^http:\/\//, "ws://").replace(/^https:\/\//, "wss://");
-}
-function getWebSocketCtor() {
-  const WSCtor = globalThis.WebSocket;
-  if (!WSCtor) {
-    throw new Error(
-      'WebSocket not available \u2014 on Node \u226421 set globalThis.WebSocket = require("ws") before connect'
+  /**
+   * 读 — 合同模板分页列表（compliance gateway S5）。
+   *
+   * 走 GET 读路径（允许 401 单次刷新重放）。返回 yudao `PageResult<T>`
+   * （`{ total, list }`）。所有过滤项可选；`createTimeStart` / `createTimeEnd`
+   * 由调用方按 `yyyy-MM-dd HH:mm:ss` 提供，SDK 原样透传。列表项视图
+   * {@link ContractTemplatePageItem} 不含 `fields`——字段叠加只在详情 / 版本
+   * 快照里返回。
+   */
+  listContractTemplates(req = {}, signal) {
+    return this.read(
+      "GET",
+      `/compliance/contract-templates/page${pageQuery(req, ["status", "createTimeStart", "createTimeEnd"])}`,
+      null,
+      signal
     );
   }
-  return WSCtor;
-}
-async function wsConnectOnce(c, ws) {
-  const token = await c.ensureToken(ws.abort.signal);
-  const url = wsURL(c);
-  const WSCtor = getWebSocketCtor();
-  const u = new URL(url);
-  u.searchParams.set("token", token);
-  let conn;
-  try {
-    conn = new WSCtor(u.toString());
-  } catch (e) {
-    throw new Error(`dial: ${e instanceof Error ? e.message : String(e)}`);
+  /**
+   * 上传合同模板 PDF（写）。
+   *
+   * 走 compliance 写路径——`Idempotency-Key`、不重试、`401` 不刷新重放。请求体
+   * 为 `{ pdfBase64 }`；SDK 不在客户端做 PDF 解析 / 几何校验，原样透传给后端。
+   * 返回上传后的最新模板视图（含 `pdfHash` / `pdfPageCount`）。
+   */
+  uploadContractTemplatePdf(id, req, opts = {}) {
+    return this.write(
+      "POST",
+      `/compliance/contract-templates/${encodeURIComponent(id)}/pdf`,
+      req,
+      writeCtx(opts)
+    );
   }
-  await new Promise((resolve, reject) => {
-    let opened = false;
-    const handshakeTimer = setTimeout(() => {
-      if (!opened) {
-        try {
-          conn.close();
-        } catch {
-        }
-        reject(new Error("dial: handshake timeout"));
-      }
-    }, 3e4);
-    conn.addEventListener("open", () => {
-      opened = true;
-    });
-    conn.addEventListener("error", (e) => {
-      clearTimeout(handshakeTimer);
-      reject(new Error(`dial: ${e.message ?? "connection error"}`));
-    });
-    conn.addEventListener("message", (e) => {
-      try {
-        const msg = e.data;
-        const welcome = JSON.parse(msg);
-        if (welcome.type !== "welcome") {
-          clearTimeout(handshakeTimer);
-          try {
-            conn.close();
-          } catch {
-          }
-          reject(new Error(`unexpected first message: ${welcome.type}`));
-          return;
-        }
-        clearTimeout(handshakeTimer);
-        ws.conn = conn;
-        ws.connected = true;
-        if (ws.cfg.topics.length > 0) {
-          try {
-            conn.send(
-              JSON.stringify({
-                type: "subscribe",
-                topics: ws.cfg.topics
-              })
-            );
-          } catch (sendErr) {
-            ws.conn = null;
-            ws.connected = false;
-            try {
-              conn.close();
-            } catch {
-            }
-            reject(new Error(`send subscribe: ${sendErr instanceof Error ? sendErr.message : String(sendErr)}`));
-            return;
-          }
-        }
-        ws.cfg.onConnect();
-        console.log(`[acosmi-sdk] websocket connected, connId=${welcome.connId ?? ""}`);
-        resolve();
-      } catch (parseErr) {
-        clearTimeout(handshakeTimer);
-        try {
-          conn.close();
-        } catch {
-        }
-        reject(new Error(`parse welcome: ${parseErr instanceof Error ? parseErr.message : String(parseErr)}`));
-      }
-    }, { once: true });
-  });
-}
-async function wsLoop(c, ws) {
-  try {
-    while (true) {
-      await wsReadLoop(ws);
-      if (ws.abort.signal.aborted) return;
-      if (ws.conn) {
-        try {
-          ws.conn.close();
-        } catch {
-        }
-        ws.conn = null;
-      }
-      ws.connected = false;
-      if (!ws.cfg.autoReconnect) return;
-      let delay = ws.cfg.reconnectMinMs;
-      while (true) {
-        if (ws.abort.signal.aborted) return;
-        await sleepWithSignal2(delay, ws.abort.signal).catch(() => {
-        });
-        if (ws.abort.signal.aborted) return;
-        console.log(`[acosmi-sdk] websocket reconnecting (delay=${delay}ms)...`);
-        try {
-          await wsConnectOnce(c, ws);
-          break;
-        } catch (err) {
-          console.log(`[acosmi-sdk] websocket reconnect failed: ${err instanceof Error ? err.message : String(err)}`);
-          delay = Math.min(delay * 2, ws.cfg.reconnectMaxMs);
-        }
-      }
+  /**
+   * 发布合同模板（写）。DRAFT → PUBLISHED，落版本快照。
+   *
+   * 走 compliance 写路径——`Idempotency-Key`、不重试、`401` 不刷新重放。
+   * publish 后 `currentVersion` 递增，`fields` 与 `pdfHash` 同步固化进版本表。
+   */
+  publishContractTemplate(id, opts = {}) {
+    return this.write(
+      "POST",
+      `/compliance/contract-templates/${encodeURIComponent(id)}/publish`,
+      null,
+      writeCtx(opts)
+    );
+  }
+  /**
+   * 归档合同模板（写）。PUBLISHED → ARCHIVED。
+   *
+   * 走 compliance 写路径——`Idempotency-Key`、不重试、`401` 不刷新重放。
+   * 已归档模板只读，不再允许 publish / 编辑 / 删除。
+   */
+  archiveContractTemplate(id, opts = {}) {
+    return this.write(
+      "POST",
+      `/compliance/contract-templates/${encodeURIComponent(id)}/archive`,
+      null,
+      writeCtx(opts)
+    );
+  }
+  /**
+   * 读 — 合同模板版本快照列表。
+   *
+   * 走 GET 读路径（允许 401 单次刷新重放）。返回 {@link ContractTemplateVersion}
+   * 普通数组（非 `PageResult`）——每次 publish 落一个不可变快照，记录当时的
+   * `name` / `pdfHash` / `fields` / `statusAtSnapshot`，是离线复核 / 版本对账
+   * 的依据。
+   */
+  listContractTemplateVersions(id, signal) {
+    return this.read(
+      "GET",
+      `/compliance/contract-templates/${encodeURIComponent(id)}/versions`,
+      null,
+      signal
+    );
+  }
+  // =========================================================================
+  // Error classification (re-export for convenience)
+  // =========================================================================
+  classifyError(err) {
+    if (!isBusinessErrorLike(err)) return null;
+    if (!isComplianceBusinessError(err)) return null;
+    return classifyComplianceError(err);
+  }
+  // =========================================================================
+  // Internal helpers
+  // =========================================================================
+  /**
+   * 读路径：GET / 公开 verify。允许 401 单次刷新后重放（GET 幂等安全）。
+   * 与 client.doJSONFullInternal 行为一致；不复用其代码因为 base URL 不同。
+   */
+  async read(method, path, body, signal, extraHeaders = {}) {
+    return this.executeJson(method, path, body, signal, {
+      retryOn401: true,
+      extraHeaders
+    });
+  }
+  /**
+   * 公开读路径：public verify。
+   *
+   * 与 {@link read} 的区别 — public 端点不应要求认证：
+   *   - 无 token 时匿名请求：ensureToken 抛 `not authorized` 会被吞掉，继续匿名发送。
+   *   - 有 token 时附带 `Authorization`，保留后端审计上下文。
+   *   - 不做 401 refresh replay：401 直接抛 HTTPError，不触发 `forceRefresh`。
+   *
+   * URL 仍走 `client.complianceURL(path)`，不复用 `/api/v4`；底层复用
+   * `client.doRequest`，不新增 fetch/axios 直连。
+   */
+  async publicRead(method, path, signal) {
+    let token = "";
+    try {
+      token = await this.client.ensureToken(signal);
+    } catch {
     }
-  } finally {
-    ws.doneResolve();
+    const url = this.client.complianceURL(path);
+    const headers = { Accept: "application/json" };
+    if (token) headers.Authorization = `Bearer ${token}`;
+    const resp = await this.client.doRequest({ method, url, headers }, signal);
+    if (resp.status < 200 || resp.status >= 300) {
+      const bodyBytes = resp.body ? await readLimited(resp.body, maxErrorBodySize) : new Uint8Array();
+      throw parseHTTPErrorWithHeader(resp.status, bodyBytes, resp.headers);
+    }
+    const text = await resp.text();
+    if (!text) return void 0;
+    const parsed = JSON.parse(text);
+    const bizErr = apiResponseBusinessError(parsed);
+    if (bizErr) throw bizErr;
+    return parsed.data;
   }
-}
-async function wsReadLoop(ws) {
-  const conn = ws.conn;
-  if (!conn) return;
-  return new Promise((resolve) => {
-    const handleMessage = (e) => {
-      try {
-        const data = e.data;
-        const event = JSON.parse(data);
-        try {
-          ws.cfg.onEvent(event);
-        } catch {
-        }
-      } catch {
-      }
+  /**
+   * 写路径：POST。
+   * - 发送前 ensureToken 一次确保 token fresh。
+   * - 不自动 401 重放：401 → 抛 HTTPError；调用方必须自己刷新 token 后用同一
+   *   idempotency-key 重新发起，避免 provider 侧重复请求。
+   * - 不走 doRequestWithRetry：写操作不允许 5xx/timeout 自动重试。
+   */
+  async write(method, path, body, ctx) {
+    const headers = { ...ctx.extraHeaders ?? {} };
+    if (ctx.idempotencyKey) headers["Idempotency-Key"] = ctx.idempotencyKey;
+    return this.executeJson(method, path, body, ctx.signal, {
+      retryOn401: false,
+      extraHeaders: headers
+    });
+  }
+  async executeJson(method, path, body, signal, opts, retried = false) {
+    const token = await this.client.ensureToken(signal);
+    const url = this.client.complianceURL(path);
+    const headers = {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json",
+      ...opts.extraHeaders
     };
-    const handleClose = (e) => {
-      conn.removeEventListener("message", handleMessage);
-      conn.removeEventListener("close", handleClose);
-      conn.removeEventListener("error", handleError);
+    let bodyStr;
+    if (body != null) {
+      bodyStr = typeof body === "string" ? body : JSON.stringify(body);
+      headers["Content-Type"] = "application/json";
+    }
+    const resp = await this.client.doRequest({ method, url, headers, body: bodyStr }, signal);
+    if (resp.status === 401 && opts.retryOn401 && !retried) {
       try {
-        ws.cfg.onDisconnect(new Error(`closed: code=${e.code} reason=${e.reason}`));
+        await resp.body?.cancel();
       } catch {
       }
-      resolve();
+      await this.client.forceRefresh(signal);
+      return this.executeJson(method, path, body, signal, opts, true);
+    }
+    if (resp.status < 200 || resp.status >= 300) {
+      const bodyBytes = resp.body ? await readLimited(resp.body, maxErrorBodySize) : new Uint8Array();
+      throw parseHTTPErrorWithHeader(resp.status, bodyBytes, resp.headers);
+    }
+    const text = await resp.text();
+    if (!text) return void 0;
+    const parsed = JSON.parse(text);
+    const bizErr = apiResponseBusinessError(parsed);
+    if (bizErr) throw bizErr;
+    return parsed.data;
+  }
+  async poll(fetcher, classify, opts) {
+    const cfg = {
+      timeoutMs: opts.timeoutMs ?? DEFAULT_POLL.timeoutMs,
+      initialIntervalMs: opts.initialIntervalMs ?? DEFAULT_POLL.initialIntervalMs,
+      maxIntervalMs: opts.maxIntervalMs ?? DEFAULT_POLL.maxIntervalMs,
+      multiplier: opts.multiplier ?? DEFAULT_POLL.multiplier
     };
-    const handleError = (e) => {
-      conn.removeEventListener("message", handleMessage);
-      conn.removeEventListener("close", handleClose);
-      conn.removeEventListener("error", handleError);
-      try {
-        ws.cfg.onDisconnect(e);
-      } catch {
+    const deadline = Date.now() + cfg.timeoutMs;
+    let interval = cfg.initialIntervalMs;
+    let lastValue;
+    while (Date.now() < deadline) {
+      if (opts.signal?.aborted) {
+        throw new CompliancePollError("compliance poll aborted", "unknown");
       }
-      resolve();
-    };
-    conn.addEventListener("message", handleMessage);
-    conn.addEventListener("close", handleClose);
-    conn.addEventListener("error", handleError);
-    if (ws.abort.signal.aborted) {
-      try {
-        conn.close();
-      } catch {
+      lastValue = await fetcher();
+      const decision = classify(lastValue);
+      if (decision === "done") return lastValue;
+      if (decision === "failed") {
+        throw new CompliancePollError(
+          "compliance poll observed terminal failure",
+          "terminal_failure"
+        );
       }
-    } else {
-      ws.abort.signal.addEventListener(
-        "abort",
-        () => {
-          try {
-            conn.close();
-          } catch {
-          }
-        },
-        { once: true }
-      );
+      const sleepMs = Math.min(interval, deadline - Date.now());
+      if (sleepMs <= 0) break;
+      await sleep2(sleepMs, opts.signal);
+      interval = Math.min(Math.floor(interval * cfg.multiplier), cfg.maxIntervalMs);
     }
-  });
+    throw new CompliancePollError("compliance poll timed out", "timeout");
+  }
+};
+function classifyTimestamp(status) {
+  switch (status) {
+    case "VERIFIED":
+      return "done";
+    case "FAILED":
+    case "LOCAL_VERIFY_FAILED":
+      return "failed";
+    case "PENDING":
+    case "UNKNOWN":
+    case "RETRYING":
+    default:
+      return "continue";
+  }
 }
-async function sleepWithSignal2(ms, signal) {
-  if (ms <= 0) return;
-  if (signal.aborted) throw new Error("aborted");
+function classifyProviderStatus(status) {
+  switch (status) {
+    case "SUCCESS":
+      return "done";
+    case "FAILED":
+      return "failed";
+    case "PENDING":
+    case "UNKNOWN":
+    case "RETRYING":
+    default:
+      return "continue";
+  }
+}
+function pageQuery(req, filterKeys) {
+  const q = new URLSearchParams();
+  const append = (key, value) => {
+    if (value == null) return;
+    const s = typeof value === "string" ? value : String(value);
+    if (s === "") return;
+    q.set(key, s);
+  };
+  append("pageNo", req.pageNo);
+  append("pageSize", req.pageSize);
+  append("sortBy", req.sortBy);
+  append("sortDirection", req.sortDirection);
+  for (const key of filterKeys) {
+    append(String(key), req[key]);
+  }
+  const qs = q.toString();
+  return qs ? "?" + qs : "";
+}
+function writeCtx(opts, extraHeaders = {}) {
+  return {
+    idempotencyKey: opts.idempotencyKey,
+    signal: opts.signal,
+    extraHeaders
+  };
+}
+function isBusinessErrorLike(err) {
+  if (err == null || typeof err !== "object") return false;
+  return typeof err.code === "number";
+}
+function sleep2(ms, signal) {
   return new Promise((resolve, reject) => {
-    const t = setTimeout(() => {
-      signal.removeEventListener("abort", abortHandler);
+    if (signal?.aborted) {
+      reject(new CompliancePollError("compliance poll aborted", "unknown"));
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
       resolve();
     }, ms);
-    const abortHandler = () => {
-      clearTimeout(t);
-      signal.removeEventListener("abort", abortHandler);
-      reject(new Error("aborted"));
+    const onAbort = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      reject(new CompliancePollError("compliance poll aborted", "unknown"));
     };
-    signal.addEventListener("abort", abortHandler);
+    signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
 
-// src/bug-report.ts
+// src/support/bug-report.ts
 Client.prototype.submitBugReport = async function(reportData, signal) {
   if (reportData == null) {
     throw new Error("acosmi: reportData required");
@@ -5545,6 +6086,6 @@ Client.prototype.getBugReport = async function(bugID, signal) {
   return resp.data;
 };
 
-export { AgentRunStreamError, AgentRunsClient, AnthropicAdapter, BucketClassCommercial, BucketClassGeneric, BusinessError, Client, ComplianceClient, CompliancePollError, LocalStorageTokenStore as DefaultBrowserTokenStore, DefaultRetryPolicy, ErrAuthDenied, ErrBillingCallbackCannotCommit, ErrBillingCommitRequiresLocalVerify, ErrBillingS2sForbidden, ErrBrowserOpen, ErrComplianceStepUpRequired, ErrDiscovery, ErrEnvelopeGateClosed, ErrOAuthCORSBlocked, ErrProviderNotConfigured, ErrProviderUnknownNoRetry, ErrRefreshProxyFailed, ErrRegistration, ErrSSLProxy, ErrSealApprovalContractHashMismatch, ErrSealApprovalExpired, ErrSealApprovalLocationMismatch, ErrSealApprovalNonceUsed, ErrSealApprovalNotApproved, ErrSealApprovalSealMismatch, ErrSealApprovalTransactorMismatch, ErrSealUseAlreadyConsumed, ErrStateMismatch, ErrTimeout, ErrTokenExchange, ErrTokenExpired, EventAuthURL, EventComplete, EventError, FileTokenStore, FilterStatusAdminBypass, FilterStatusDisabledByFlag, FilterStatusFallbackMissingUser, FilterStatusFallbackNoBuckets, FilterStatusFallbackTkdistError, FilterStatusFallbackTkdistSkew, FilterStatusInternalBypass, FilterStatusOK, FilterStatusUnknown, HTTPError, InMemoryTokenStore, LocalStorageTokenStore, ModelNotFoundError, NetworkError, OpenAIAdapter, OrderTerminalError, ProviderFormat, RateLimitError, ScopeAI, ScopeAccount, ScopeComplianceContractSigningRead, ScopeComplianceContractSigningWrite, ScopeComplianceEvidenceRead, ScopeComplianceEvidenceWrite, ScopeComplianceReportsPublish, ScopeComplianceReportsRead, ScopeComplianceReportsWrite, ScopeComplianceSealApprovalApprove, ScopeComplianceSealApprovalRequest, ScopeComplianceSealManage, ScopeComplianceSealUseExecute, ScopeComplianceTimestampIssue, ScopeComplianceTimestampVerify, ScopeEntitlements, ScopeModels, ScopeModelsChat, ScopeProfile, ScopeSkillStore, ScopeSkills, ScopeTokenPackages, ScopeTools, ScopeToolsExecute, ScopeWallet, ScopeWalletReadonly, ServerToolTypeWebSearch, StreamError, ThinkingHigh, ThinkingHighMinMaxTokens, ThinkingMax, ThinkingMaxFallbackMaxTokens, ThinkingOff, allScopes, anthropicResponseTextContent, anthropicResponseThinkingContent, anthropicResponseToolUseBlocks, apiResponseBusinessError, apiResponseGetMessage, authorize, bucketInfoIsCommercial, bucketRowIsCommercial, buildBetas, classifyComplianceError, commerceScopes, completeWebAuthorizationRequest, complianceScopes, computeBackoff, createWebAuthorizationRequest, defaultRetryable, defaultSafeToRetry, discover, discoverWebOAuthMetadata, discoverWithProfile, effectivePolicy, exchangeCode, extractAnthropicBlockMeta, fileLockDefaults, findDesktopVisualUnderstandingModel, findFirstModelByInputModality, generateState, getAdapter, getAdapterForModel, isBillingConfirmable, isComplianceBusinessError, isComplianceTerminalError, isSSLError, modelScopes, modelSupportsImageInput, modelSupportsInputModality, newFileTokenStore, newThinkingConfig, newTokenSet, newWebSearchTool, parseNotificationEvent, parseSettlement, parseSourcesEvent, refreshToken, register, registerWebOAuthClient, revokeToken, sanitize_exports as sanitize, skillScopes, tokenSetIsExpired, uniqueMerge };
+export { AgentRunStreamError, AgentRunsClient, AnthropicAdapter, BucketClassCommercial, BucketClassGeneric, BusinessError, Client, ComplianceClient, CompliancePollError, LocalStorageTokenStore as DefaultBrowserTokenStore, DefaultRetryPolicy, ErrAuthDenied, ErrBillingCallbackCannotCommit, ErrBillingCommitRequiresLocalVerify, ErrBillingS2sForbidden, ErrBrowserOpen, ErrComplianceStepUpRequired, ErrDiscovery, ErrEnvelopeGateClosed, ErrOAuthCORSBlocked, ErrProviderNotConfigured, ErrProviderUnknownNoRetry, ErrRefreshProxyFailed, ErrRegistration, ErrSSLProxy, ErrSealApprovalContractHashMismatch, ErrSealApprovalExpired, ErrSealApprovalLocationMismatch, ErrSealApprovalNonceUsed, ErrSealApprovalNotApproved, ErrSealApprovalSealMismatch, ErrSealApprovalTransactorMismatch, ErrSealUseAlreadyConsumed, ErrStateMismatch, ErrTimeout, ErrTokenExchange, ErrTokenExpired, EventAuthURL, EventComplete, EventError, FileTokenStore, FilterStatusAdminBypass, FilterStatusDisabledByFlag, FilterStatusFallbackMissingUser, FilterStatusFallbackNoBuckets, FilterStatusFallbackTkdistError, FilterStatusFallbackTkdistSkew, FilterStatusInternalBypass, FilterStatusOK, FilterStatusUnknown, HTTPError, IdempotencyKeyHeader, InMemoryTokenStore, LocalStorageTokenStore, ModelNotFoundError, NetworkError, OpenAIAdapter, OrderTerminalError, ProviderFormat, RETRY_ADVICE_REASONS, RateLimitError, ScopeAI, ScopeAccount, ScopeComplianceContractSigningRead, ScopeComplianceContractSigningWrite, ScopeComplianceContractTemplateRead, ScopeComplianceContractTemplateWrite, ScopeComplianceEvidenceRead, ScopeComplianceEvidenceWrite, ScopeComplianceReportsPublish, ScopeComplianceReportsRead, ScopeComplianceReportsWrite, ScopeComplianceSealApprovalApprove, ScopeComplianceSealApprovalRequest, ScopeComplianceSealManage, ScopeComplianceSealUseExecute, ScopeComplianceTimestampIssue, ScopeComplianceTimestampVerify, ScopeEntitlements, ScopeModels, ScopeModelsChat, ScopeProfile, ScopeSkillStore, ScopeSkills, ScopeTokenPackages, ScopeTools, ScopeToolsExecute, ScopeWallet, ScopeWalletReadonly, ServerToolTypeWebSearch, StreamError, ThinkingHigh, ThinkingHighMinMaxTokens, ThinkingMax, ThinkingMaxFallbackMaxTokens, ThinkingOff, allScopes, anthropicResponseTextContent, anthropicResponseThinkingContent, anthropicResponseToolUseBlocks, apiResponseBusinessError, apiResponseGetMessage, authorize, bucketInfoIsCommercial, bucketRowIsCommercial, buildBetas, classifyComplianceError, commerceScopes, completeWebAuthorizationRequest, complianceErrorToRetryAdvice, complianceScopes, computeBackoff, createWebAuthorizationRequest, defaultRetryable, defaultSafeToRetry, discover, discoverWebOAuthMetadata, discoverWithProfile, effectivePolicy, exchangeCode, extractAnthropicBlockMeta, fileLockDefaults, findDesktopVisualUnderstandingModel, findFirstModelByInputModality, generateState, getAdapter, getAdapterForModel, isBillingConfirmable, isComplianceBusinessError, isComplianceTerminalError, isSSLError, modelScopes, modelSupportsImageInput, modelSupportsInputModality, newFileTokenStore, newThinkingConfig, newTokenSet, newWebSearchTool, parseNotificationEvent, parseSettlement, parseSourcesEvent, refreshToken, register, registerWebOAuthClient, retryReasonForComplianceKey, retryReasonForOAuthError, revokeToken, sanitize_exports as sanitize, skillScopes, tokenSetIsExpired, uniqueMerge };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map