npm - @acosmi/sdk-ts - Versions diffs - 2.15.0 → 2.17.0 - Mend

@acosmi/sdk-ts 2.15.0 → 2.17.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/CHANGELOG.md +35 -0
package/README.md +27 -2
package/dist/browser/index.mjs +103 -19
package/dist/browser/index.mjs.map +1 -1
package/dist/index.mjs +103 -19
package/dist/index.mjs.map +1 -1
package/dist/node/index.cjs +105 -18
package/dist/node/index.cjs.map +1 -1
package/dist/node/index.d.cts +63 -6
package/dist/node/index.d.ts +63 -6
package/dist/node/index.mjs +103 -19
package/dist/node/index.mjs.map +1 -1
package/package.json +4 -1

package/dist/node/index.cjs CHANGED Viewed

@@ -2,8 +2,13 @@
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -1324,6 +1329,7 @@ async function authorize(meta, clientID, scopes, opts = {}) {
   };
   const verifier = await generateCodeVerifier();
   const challenge = await codeChallenge(verifier);
+  const state = await generateState();
   const http = await import('http');
   const server = http.createServer();
   await new Promise((resolve, reject) => {
@@ -1339,6 +1345,8 @@ async function authorize(meta, clientID, scopes, opts = {}) {
     codeResolver = resolve;
     codeRejecter = reject;
   });
+  codePromise.catch(() => {
+  });
   server.on("request", (req, res) => {
     const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
     if (url.pathname !== "/callback") {
@@ -1346,6 +1354,16 @@ async function authorize(meta, clientID, scopes, opts = {}) {
       res.end();
       return;
     }
+    const states = url.searchParams.getAll("state");
+    const stateFailure = states.length === 0 ? "callback missing state" : states.length > 1 ? "callback carried multiple state values" : states[0] !== state ? "callback state does not match pending state" : null;
+    if (stateFailure !== null) {
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      res.end(
+        `<!DOCTYPE html><html><head><meta charset="utf-8"><title>\u6388\u6743\u5931\u8D25</title></head><body style="font-family:system-ui,sans-serif;text-align:center;padding:60px 20px"><h2>\u6388\u6743\u5931\u8D25</h2><p>\u56DE\u8C03\u6821\u9A8C\u672A\u901A\u8FC7, \u5DF2\u4E2D\u6B62\u767B\u5F55\u3002</p><p style="color:#888;font-size:14px">\u53EF\u4EE5\u5173\u95ED\u6B64\u7A97\u53E3\u3002</p></body></html>`
+      );
+      codeRejecter(new Error(`authorize: ${ErrStateMismatch}: ${stateFailure} (possible CSRF)`));
+      return;
+    }
     const code = url.searchParams.get("code");
     if (!code) {
       const errMsg = url.searchParams.get("error_description") || url.searchParams.get("error") || "";
@@ -1376,6 +1394,7 @@ async function authorize(meta, clientID, scopes, opts = {}) {
   authURL.searchParams.set("response_type", "code");
   authURL.searchParams.set("code_challenge", challenge);
   authURL.searchParams.set("code_challenge_method", "S256");
+  authURL.searchParams.set("state", state);
   if (scopes.length > 0) {
     authURL.searchParams.set("scope", scopes.join(" "));
   }
@@ -1413,7 +1432,9 @@ async function authorize(meta, clientID, scopes, opts = {}) {
     return { result: { code, redirectURI }, verifier };
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    if (msg.includes("denied")) {
+    if (msg.includes(ErrStateMismatch)) {
+      emit({ type: EventError, err_code: ErrStateMismatch, error: msg });
+    } else if (msg.includes("denied")) {
       emit({ type: EventError, err_code: ErrAuthDenied, error: msg });
     } else if (msg.includes("timed out")) {
       emit({ type: EventError, err_code: ErrTimeout, error: msg });
@@ -1424,6 +1445,7 @@ async function authorize(meta, clientID, scopes, opts = {}) {
   } finally {
     if (abortHandler && signal) signal.removeEventListener("abort", abortHandler);
     server.close();
+    server.closeIdleConnections?.();
   }
 }
 function htmlEscape(s) {
@@ -2290,6 +2312,13 @@ var ErrOAuthCORSBlocked = "oauth_cors_blocked";
 var ErrRefreshProxyFailed = "refresh_proxy_failed";
 var ErrTokenExpired = "token_expired";
 var CHAT_REQUEST_TIMEOUT_MS = 11 * 60 * 1e3;
+function notifyUpstreamActivity(cb) {
+  if (!cb) return;
+  try {
+    cb();
+  } catch {
+  }
+}
 var DEFAULT_API_TIMEOUT_MS = 6e4;
 function newDeferred() {
   let resolve;
@@ -3003,7 +3032,13 @@ var Client = class _Client {
     try {
       const { body, adapter } = await this.buildChatRequest(modelID, r, ctl.signal);
       const endpoint = `/managed-models/${encodeURIComponent(modelID)}${adapter.endpointSuffix()}`;
-      const { result, headers } = await this.doJSONFullRaw("POST", endpoint, body, ctl.signal);
+      const { result, headers } = await this.doJSONFullRaw(
+        "POST",
+        endpoint,
+        body,
+        ctl.signal,
+        CHAT_REQUEST_TIMEOUT_MS
+      );
       const resp = adapter.parseResponse(result);
       const v1 = headers.get("X-Token-Remaining");
       if (v1) {
@@ -3068,7 +3103,13 @@ var Client = class _Client {
    */
   async generateVideo(modelID, req, signal) {
     const endpoint = `/managed-models/${encodeURIComponent(modelID)}/videos/generations`;
-    const { result } = await this.doJSONFullRaw("POST", endpoint, req, signal);
+    const { result } = await this.doJSONFullRaw(
+      "POST",
+      endpoint,
+      req,
+      signal,
+      CHAT_REQUEST_TIMEOUT_MS
+    );
     return this.unwrapAPIResponse(result);
   }
   /**
@@ -3137,7 +3178,8 @@ var Client = class _Client {
         "POST",
         `/managed-models/${encodeURIComponent(modelID)}/anthropic`,
         data,
-        ctl.signal
+        ctl.signal,
+        CHAT_REQUEST_TIMEOUT_MS
       );
       const rawStr = new TextDecoder().decode(result);
       try {
@@ -3171,7 +3213,13 @@ var Client = class _Client {
       const body = adapter.buildRequestBody(caps, r);
       const data = JSON.stringify(body);
       const endpoint = `/managed-models/${encodeURIComponent(modelID)}${adapter.endpointSuffix()}`;
-      const { result } = await this.doJSONFullRaw("POST", endpoint, data, ctl.signal);
+      const { result } = await this.doJSONFullRaw(
+        "POST",
+        endpoint,
+        data,
+        ctl.signal,
+        CHAT_REQUEST_TIMEOUT_MS
+      );
       const { parseOpenAIResponseToAnthropic: parseOpenAIResponseToAnthropic2 } = await Promise.resolve().then(() => (init_openai(), openai_exports));
       return parseOpenAIResponseToAnthropic2(result);
     } finally {
@@ -3181,23 +3229,27 @@ var Client = class _Client {
   /**
    * 流式聊天 (SSE), 通过 async generator 返回事件
    * v0.5.0: 根据 adapter 路由端点
+   *
+   * @param onUpstreamActivity 见 {@link UpstreamActivityCallback}
    */
-  chatStream(modelID, req, signal) {
+  chatStream(modelID, req, signal, onUpstreamActivity) {
     return {
-      [Symbol.asyncIterator]: () => this.chatStreamGen(modelID, req, signal, false)
+      [Symbol.asyncIterator]: () => this.chatStreamGen(modelID, req, signal, false, onUpstreamActivity)
     };
   }
   /**
    * Anthropic 原生格式流式聊天 (SSE)
    * 调用 POST /managed-models/:id/anthropic, SSE 事件为 Anthropic 协议格式
    * 无 started/settled/failed 自定义事件, 无 data: [DONE], message_stop 为自然结束
+   *
+   * @param onUpstreamActivity 见 {@link UpstreamActivityCallback}
    */
-  chatMessagesStream(modelID, req, signal) {
+  chatMessagesStream(modelID, req, signal, onUpstreamActivity) {
     return {
-      [Symbol.asyncIterator]: () => this.chatMessagesStreamGen(modelID, req, signal, false)
+      [Symbol.asyncIterator]: () => this.chatMessagesStreamGen(modelID, req, signal, false, onUpstreamActivity)
     };
   }
-  async *chatStreamGen(modelID, req, signal, retried) {
+  async *chatStreamGen(modelID, req, signal, retried, onUpstreamActivity) {
     const r = { ...req, stream: true };
     const { body, adapter } = await this.buildChatRequest(modelID, r, signal);
     const token = await this.ensureToken(signal);
@@ -3230,7 +3282,7 @@ var Client = class _Client {
           `stream: unauthorized and refresh failed: ${refreshErr instanceof Error ? refreshErr.message : String(refreshErr)}`
         );
       }
-      yield* this.chatStreamGen(modelID, req, signal, true);
+      yield* this.chatStreamGen(modelID, req, signal, true, onUpstreamActivity);
       return;
     }
     if (!resp.ok) {
@@ -3246,6 +3298,7 @@ var Client = class _Client {
     }
     let currentEvent = "";
     for await (const line of iterSSELines(resp.body)) {
+      notifyUpstreamActivity(onUpstreamActivity);
       if (isSSECommentLine(line)) continue;
       if (line.startsWith("event:")) {
         currentEvent = line.slice("event:".length).trim();
@@ -3266,7 +3319,7 @@ var Client = class _Client {
       }
     }
   }
-  async *chatMessagesStreamGen(modelID, req, signal, retried) {
+  async *chatMessagesStreamGen(modelID, req, signal, retried, onUpstreamActivity) {
     const r = { ...req, stream: true };
     const { body, adapter } = await this.buildChatRequest(modelID, r, signal);
     const token = await this.ensureToken(signal);
@@ -3299,7 +3352,7 @@ var Client = class _Client {
           `messages stream: unauthorized and refresh failed: ${refreshErr instanceof Error ? refreshErr.message : String(refreshErr)}`
         );
       }
-      yield* this.chatMessagesStreamGen(modelID, req, signal, true);
+      yield* this.chatMessagesStreamGen(modelID, req, signal, true, onUpstreamActivity);
       return;
     }
     if (!resp.ok) {
@@ -3312,6 +3365,7 @@ var Client = class _Client {
     if (adapter.format() === 1 /* OpenAI */) {
       const converter = newOpenAIStreamConverter();
       for await (const line of iterSSELines(resp.body)) {
+        notifyUpstreamActivity(onUpstreamActivity);
         if (isSSECommentLine(line)) continue;
         if (line.startsWith("event:")) {
           line.slice("event:".length).trim();
@@ -3326,6 +3380,7 @@ var Client = class _Client {
       const blockTypeMap = /* @__PURE__ */ new Map();
       let currentEvent = "";
       for await (const line of iterSSELines(resp.body)) {
+        notifyUpstreamActivity(onUpstreamActivity);
         if (isSSECommentLine(line)) continue;
         if (line.startsWith("event:")) {
           currentEvent = line.slice("event:".length).trim();
@@ -3458,7 +3513,19 @@ var Client = class _Client {
       ctl.dispose();
     }
   }
-  /** doJSONFull 的 raw bytes 变体 (chat 用, 不立即 JSON.parse) */
+  /**
+   * doJSONFull 的 raw bytes 变体 (chat 用, 不立即 JSON.parse)
+   *
+   * ⚠️ 契约 (2026-08-06): `timeoutMs` 的 30s 默认值只适用于**控制面**端点 (列目录 /
+   * 查配额 / 取任务状态)。凡走**模型推理或生成**的端点 —— chat / anthropic /
+   * embeddings / rerank / images / videos —— 一律必须显式传入 `CHAT_REQUEST_TIMEOUT_MS`,
+   * 哪怕调用方已经用 `withRequestTimeout` 建了外层预算: 外层只约束 `signal`, 内层
+   * 会**另建**一个 `timeoutMs` 计时器, 30s 恒先于任何更长的外层预算触发。
+   *
+   * 这不是假设 —— 2026-08-06 事故里 chat 路径正因漏传本参数而被恒定钉死在 30s,
+   * 且上方 v1.6.0 的注释还声称它已是 11min。回归闸门见
+   * `tests/chat-timeout-budget.test.ts`。
+   */
   async doJSONFullRaw(method, path, body, signal, timeoutMs = 3e4) {
     return this.doJSONFullRawInternal(method, path, body, signal, false, timeoutMs);
   }
@@ -4126,6 +4193,7 @@ var ScopeChatBridge = "chat_bridge";
 var ScopeChatBridgeRead = "chat_bridge:read";
 var ScopeChatBridgeWrite = "chat_bridge:write";
 var ScopeChatBridgeRotate = "chat_bridge:rotate";
+var ScopeAgentAccessManage = "agent_access:manage";
 var ScopeModels = "models";
 var ScopeModelsChat = "models:chat";
 var ScopeEntitlements = "entitlements";
@@ -4154,6 +4222,9 @@ function remoteControlScopes() {
 function chatBridgeScopes() {
   return [ScopeChatBridge];
 }
+function agentAccessScopes() {
+  return [ScopeAgentAccessManage];
+}
 // src/models/index.ts
 init_types();
@@ -7119,6 +7190,15 @@ function sleep2(ms, signal) {
 }
 // src/support/bug-report.ts
+function unwrapBugReport(raw, op, isComplete) {
+  if (raw && isComplete(raw)) return raw;
+  const inner = raw?.data;
+  if (inner && isComplete(inner)) return inner;
+  const keys = raw && typeof raw === "object" ? Object.keys(raw) : [];
+  throw new Error(
+    `acosmi: ${op}: gateway accepted the request but the response is missing required fields (observed keys: ${keys.length > 0 ? keys.join(",") : "<none>"})`
+  );
+}
 Client.prototype.submitBugReport = async function(reportData, signal) {
   if (reportData == null) {
     throw new Error("acosmi: reportData required");
@@ -7135,7 +7215,11 @@ Client.prototype.submitBugReport = async function(reportData, signal) {
     { content: contentStr },
     signal
   );
-  return result.data;
+  return unwrapBugReport(
+    result,
+    "submitBugReport",
+    (r) => typeof r.feedback_id === "string" && r.feedback_id.length > 0
+  );
 };
 Client.prototype.getBugReport = async function(bugID, signal) {
   const trimmed = bugID.trim();
@@ -7148,7 +7232,7 @@ Client.prototype.getBugReport = async function(bugID, signal) {
     null,
     signal
   );
-  return resp.data;
+  return unwrapBugReport(resp, "getBugReport", (r) => typeof r.id === "string");
 };
 // src/subscription/client.ts
@@ -7739,6 +7823,7 @@ exports.AgentRunStreamError = AgentRunStreamError;
 exports.AgentRunsClient = AgentRunsClient;
 exports.AudienceEnum = AudienceEnum;
 exports.BillingModeEnum = BillingModeEnum;
+exports.CHAT_REQUEST_TIMEOUT_MS = CHAT_REQUEST_TIMEOUT_MS;
 exports.ChatBridgeClient = ChatBridgeClient;
 exports.Client = Client;
 exports.ComplianceClient = ComplianceClient;
@@ -7795,6 +7880,7 @@ exports.RETRY_ADVICE_REASONS = RETRY_ADVICE_REASONS;
 exports.RegionScopeEnum = RegionScopeEnum;
 exports.ScopeAI = ScopeAI;
 exports.ScopeAccount = ScopeAccount;
+exports.ScopeAgentAccessManage = ScopeAgentAccessManage;
 exports.ScopeChatBridge = ScopeChatBridge;
 exports.ScopeChatBridgeRead = ScopeChatBridgeRead;
 exports.ScopeChatBridgeRotate = ScopeChatBridgeRotate;
@@ -7829,6 +7915,7 @@ exports.ScopeTools = ScopeTools;
 exports.ScopeToolsExecute = ScopeToolsExecute;
 exports.ScopeWallet = ScopeWallet;
 exports.ScopeWalletReadonly = ScopeWalletReadonly;
+exports.agentAccessScopes = agentAccessScopes;
 exports.allScopes = allScopes;
 exports.anthropicResponseTextContent = anthropicResponseTextContent;
 exports.anthropicResponseThinkingContent = anthropicResponseThinkingContent;