@acosmi/sdk-ts 2.19.0 → 2.19.2

package/dist/node/index.d.cts

@@ -1,11 +1,248 @@
-import { a as AnthropicResponse } from './openai-DR_KhEdM.cjs';
-export { A as AnthropicContentBlock, b as AnthropicUsage, O as OpenAIAdapter, d as anthropicResponseTextContent, e as anthropicResponseThinkingContent, f as anthropicResponseToolUseBlocks } from './openai-DR_KhEdM.cjs';
-import { M as ManagedModel, Q as QuotaSummary, U as WindowResetSummary, n as ModelCapabilities, e as ChatRequest, P as ProviderAdapter, f as ChatResponse, I as ImageGenerationRequest, k as ImageGenerationResponse, V as VideoGenerationRequest, K as VideoTaskResponse, i as EmbeddingRequest, j as EmbeddingResponse, r as RerankRequest, s as RerankResponse, y as StreamEvent, v as SourcesEvent, z as StreamSettlement, l as InputModality } from './index-C2oh157O.cjs';
-export { B as BucketClassCommercial, a as BucketClassGeneric, b as BucketInfo, c as BucketRow, C as ChatContentBlock, d as ChatMessage, g as ChatUsage, E as EffortConfig, h as EmbeddingData, G as GeoLoc, m as InputModalityTag, o as MultimodalContent, O as OutputConfig, p as ProviderFormat, R as RerankDocument, q as RerankQuery, t as RerankResult, S as ServerTool, u as ServerToolTypeWebSearch, w as SourcesEventIssueCode, x as SourcesEventParseResult, T as ThinkingConfig, A as ThinkingHigh, D as ThinkingHighMinMaxTokens, F as ThinkingMax, H as ThinkingMaxFallbackMaxTokens, J as ThinkingOff, W as WebSearchConfig, L as WebSearchSource, N as WindowLimitStatus, X as bucketInfoIsCommercial, Y as bucketRowIsCommercial, Z as classifySourcesEvent, _ as getAdapter, $ as getAdapterForModel, a0 as newThinkingConfig, a1 as newWebSearchTool, a2 as parseSettlement, a3 as parseSourcesEvent } from './index-C2oh157O.cjs';
+import { a as AnthropicResponse } from './openai-Ce85qh14.cjs';
+export { A as AnthropicContentBlock, b as AnthropicUsage, O as OpenAIAdapter, d as anthropicResponseTextContent, e as anthropicResponseThinkingContent, f as anthropicResponseToolUseBlocks } from './openai-Ce85qh14.cjs';
+import { M as ManagedModel, Q as QuotaSummary, X as WindowResetSummary, n as ModelCapabilities, e as ChatRequest, P as ProviderAdapter, f as ChatResponse, I as ImageGenerationRequest, k as ImageGenerationResponse, V as VideoGenerationRequest, L as VideoTaskResponse, i as EmbeddingRequest, j as EmbeddingResponse, r as RerankRequest, s as RerankResponse, y as StreamEvent, v as SourcesEvent, z as StreamSettlement, l as InputModality } from './index-CqxPqbsl.cjs';
+export { B as BucketClassCommercial, a as BucketClassGeneric, b as BucketInfo, c as BucketRow, C as ChatContentBlock, d as ChatMessage, g as ChatUsage, E as EffortConfig, h as EmbeddingData, G as GeoLoc, m as InputModalityTag, o as MultimodalContent, O as OutputConfig, p as ProviderFormat, R as RerankDocument, q as RerankQuery, t as RerankResult, S as ServerTool, u as ServerToolTypeWebSearch, w as SourcesEventIssueCode, x as SourcesEventParseResult, T as ThinkingConfig, A as ThinkingHigh, D as ThinkingHighMinMaxTokens, F as ThinkingLow, H as ThinkingMax, J as ThinkingMaxFallbackMaxTokens, K as ThinkingOff, W as WebSearchConfig, N as WebSearchSource, U as WindowLimitStatus, Y as bucketInfoIsCommercial, Z as bucketRowIsCommercial, _ as classifySourcesEvent, $ as getAdapter, a0 as getAdapterForModel, a1 as newThinkingConfig, a2 as newWebSearchTool, a3 as parseSettlement, a4 as parseSourcesEvent } from './index-CqxPqbsl.cjs';
 import { M as MinimalSanitizeConfig } from './index-Bah9A83R.cjs';
 export { A as sanitize } from './index-Bah9A83R.cjs';
 export { AnthropicAdapter } from './adapters/anthropic.cjs';
 
+/** OAuth Authorization Server 元数据 (RFC 8414) */
+interface ServerMetadata {
+    crabcode_auth_contract_version?: number;
+    gateway_error_contract_version?: number;
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    revocation_endpoint: string;
+    registration_endpoint: string;
+    scopes_supported: string[];
+}
+/** OAuth token 响应 */
+interface TokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token?: string;
+    scope?: string;
+}
+/** 持久化 token 对 */
+interface TokenSet {
+    access_token: string;
+    refresh_token: string;
+    /** ISO 8601 格式 */
+    expires_at: string;
+    scope: string;
+    client_id: string;
+    server_url: string;
+}
+/** token 是否已过期 (提前 30 秒视为过期) */
+declare function tokenSetIsExpired(t: TokenSet): boolean;
+/**
+ * 运行时校验任意值是否为合法 TokenSet 形状 (所有字段都是 string)。
+ *
+ * store 反序列化磁盘 / localStorage 的 JSON 后必须经此校验:
+ * 损坏文件、旧版本残留、缺字段都会被判为无效, 由 caller 当作"无 token"重新登录,
+ * 而不是把 `{}` / 缺字段对象直接 cast 成 TokenSet 后在 refresh 阶段炸出难懂的错误。
+ */
+declare function isValidTokenSet(x: unknown): x is TokenSet;
+/** 动态注册响应 */
+interface ClientRegistration {
+    client_id: string;
+    client_secret?: string;
+}
+
+type CredentialState = 'signed_out' | 'pending_identity' | 'ready' | 'refresh_reserved' | 'refresh_dispatched' | 'reauth_required' | 'configuration_error';
+type CredentialReason = 'invalid_grant' | 'refresh_outcome_unknown' | 'migration_required' | 'identity_unavailable' | 'invalid_client' | 'invalid_scope' | 'unsupported_grant_type' | 'auth_contract_unsupported';
+interface CredentialAuthorityConfig {
+    serverURL: string;
+    issuer: string;
+    oauthProfile: 'desktop';
+    authContractVersion: 2;
+    errorContractVersion: 1;
+}
+interface CredentialPrincipal {
+    issuer: string;
+    subject: string;
+    organizationId: string | null;
+}
+interface CredentialRefreshOperation {
+    operationId: string;
+    sessionId: string;
+    baseRevision: string;
+    phase: 'reserved' | 'dispatched';
+    returnState: 'ready' | 'pending_identity';
+    startedAt: string;
+    dispatchedAt: string | null;
+    deadlineAt: string | null;
+}
+interface CredentialLoginAttempt {
+    attemptId: string;
+    baseSessionId: string | null;
+    startedAt: string;
+}
+interface VerifiedCredentialIdentity {
+    authSessionId: string;
+    principal: CredentialPrincipal;
+    displayName?: string;
+    avatarUrl?: string;
+    email?: string;
+    imageUrl?: string;
+    accountCreatedAt?: string;
+    requiresPhoneBinding?: boolean;
+    hasExtraUsageEnabled?: boolean;
+    billingType?: string;
+    subscriptionCreatedAt?: string;
+    rateLimitTier?: string;
+    organizationName?: string;
+    verifiedAt: string;
+}
+interface CredentialMutationReceipt {
+    mutationId: string;
+    operationId: string | null;
+    resultRevision: string;
+}
+/** Durable authoritative snapshot. Revisions are decimal strings to avoid JS truncation. */
+interface CredentialSnapshot {
+    storeInstanceId: string;
+    authorityConfig: CredentialAuthorityConfig | null;
+    revision: string;
+    authSessionId: string | null;
+    principal: CredentialPrincipal | null;
+    credentialState: CredentialState;
+    tokenSet: TokenSet | null;
+    refreshOperation: CredentialRefreshOperation | null;
+    loginAttempt: CredentialLoginAttempt | null;
+    reason: CredentialReason | null;
+    lastMutation: CredentialMutationReceipt | null;
+    lastLoginAttemptId: string | null;
+    verifiedIdentity: VerifiedCredentialIdentity | null;
+}
+type CredentialRequestOwner = Pick<CredentialSnapshot, 'storeInstanceId' | 'authSessionId' | 'principal'>;
+interface CredentialCASExpected {
+    storeInstanceId: string;
+    revision: string;
+    authSessionId: string | null;
+    state: CredentialState;
+    operationId: string | null;
+}
+type CredentialCASResult = {
+    status: 'committed';
+    snapshot: CredentialSnapshot;
+} | {
+    status: 'superseded';
+    snapshot: CredentialSnapshot;
+} | {
+    status: 'storage_error';
+    error: unknown;
+};
+/** Explicit opt-in store; versioned mode never calls TokenStore.save/load/clear. */
+interface VersionedCredentialStore {
+    readSnapshot(signal?: AbortSignal): Promise<CredentialSnapshot>;
+    compareAndSwap(expected: CredentialCASExpected, nextState: CredentialSnapshot, mutationId: string, signal?: AbortSignal): Promise<CredentialCASResult>;
+}
+/**
+ * Token 持久化接口
+ * 桌面智能体可自行实现 (如 macOS Keychain / Windows Credential Manager)
+ *
+ * 跨端约定:
+ *   - Save: 写入持久化, 失败抛 Error
+ *   - Load: 读取, 不存在返回 null (与 Go IsNotExist 行为一致)
+ *   - Clear: 删除, 不存在不抛错 (Logout 后 Clear 不应报错, [RC-11])
+ *   - withLock (v1.0.2 新增, 可选): 跨进程临界区. Client 在 refresh token rotation
+ *     场景下用此包裹 "load → check → refresh → save" 整段, 防多进程共享同一 store
+ *     (典型: FileTokenStore 默认 ~/.acosmi/tokens.json) 撞 HTTP 400 refresh token
+ *     not found. 不实现时 Client 自动回退到仅进程内串行 (LocalStorage / InMemory
+ *     单进程语义无需此方法).
+ */
+interface TokenStore {
+    save(tokens: TokenSet): Promise<void>;
+    load(): Promise<TokenSet | null>;
+    clear(): Promise<void>;
+    withLock?<T>(fn: () => Promise<T>): Promise<T>;
+}
+/**
+ * 基于文件的 token 存储 (开发/测试用)
+ * 生产环境建议替换为系统钥匙串实现
+ *
+ * 默认路径: ~/.acosmi/tokens.json
+ *
+ * 浏览器环境调用 new FileTokenStore() 会抛错 — 浏览器请用 LocalStorageTokenStore 或 InMemoryTokenStore.
+ */
+/** 跨进程文件锁配置 (v1.0.2). 公开常量是为了让 caller / 测试可观察, 不建议生产代码改. */
+declare const fileLockDefaults: {
+    /** 获取锁的超时上限 (毫秒). refresh 流程含网络 < 30s, 30s 已远超正常完成时间. */
+    readonly acquireTimeoutMs: 30000;
+    /** 旧锁判定阈值 (毫秒). 锁文件 mtime 早于此值视为 stale 进程崩溃残留, 自动 break. */
+    readonly staleMs: 60000;
+    /** 重试间隔基数 (毫秒). 真实间隔 = base + random(0, jitter). */
+    readonly retryBaseMs: 30;
+    readonly retryJitterMs: 70;
+};
+declare class FileTokenStore implements TokenStore {
+    private path;
+    /** 进程内串行化 (Promise chain) — 与跨进程 flock 配合, 避免单进程内并发持锁产生死锁式互等. */
+    private chain;
+    constructor(path?: string);
+    private resolvePath;
+    /** 进程内串行 (维持 v1.0.1 单进程语义). flock 之外另一层防御: 如果用户自己就是单进程
+     *  并发场景, 不必每次都进 flock 旁路文件 IO. */
+    private withChain;
+    /**
+     * 跨进程临界区. 用 sidecar `<path>.lock` 文件 + O_EXCL 创建语义实现互斥:
+     *   - 创建成功 = 持有锁; 写入 pid+timestamp 便于诊断
+     *   - 创建失败 (EEXIST) = 别的进程持锁, backoff 重试
+     *   - 锁文件 mtime > staleMs = 进程崩溃残留, unlink 后重试
+     *   - acquireTimeoutMs 超时 = 抛错 (caller 应作为 transient error 处理, 上层 retry)
+     *
+     * 注意: O_EXCL 在 NFS 上不保证原子; FileTokenStore 适用于本地文件系统 (典型用户家目录).
+     * 真要跨机共享 token, 应实现自定义 Keychain / 数据库 store, 不要用 FileTokenStore.
+     */
+    withLock<T>(fn: () => Promise<T>): Promise<T>;
+    /**
+     * 写入 token. 流程:
+     *   1. mkdir -p (默认路径目录)
+     *   2. 写入 `<path>.tmp.<pid>`
+     *   3. fsync 后 rename 到正式路径 (POSIX 上 rename(2) 同分区原子, Windows 上 ReplaceFile)
+     *
+     * 选择 atomic rename 而非直接 writeFile: 多进程并发或本进程崩溃时, 读端永远看到的是
+     * 完整的旧/新 JSON, 不会读到截断半文件 (Client.create.store.load 可能在另一进程
+     * 写入中间触发, atomic rename 避免它解析失败).
+     */
+    save(tokens: TokenSet): Promise<void>;
+    load(): Promise<TokenSet | null>;
+    clear(): Promise<void>;
+}
+/**
+ * 创建文件 token 存储 (与 Go NewFileTokenStore 等价)
+ * @param path 自定义路径; 空则使用默认 ~/.acosmi/tokens.json
+ */
+declare function newFileTokenStore(path?: string): FileTokenStore;
+/**
+ * 基于 LocalStorage 的 token 存储 (浏览器)
+ *
+ * 仅在浏览器环境可用 (检测 globalThis.localStorage)。
+ * 不持久化跨设备同步, 适合单机 SPA 使用。
+ */
+declare class LocalStorageTokenStore implements TokenStore {
+    private key;
+    constructor(key?: string);
+    save(tokens: TokenSet): Promise<void>;
+    load(): Promise<TokenSet | null>;
+    clear(): Promise<void>;
+}
+/**
+ * 内存 token 存储 (不持久化, 进程重启即丢失)
+ * 适合: 测试 / Deno script / 短期 SDK 调用 / 不希望落盘的安全场景
+ */
+declare class InMemoryTokenStore implements TokenStore {
+    private tokens;
+    save(tokens: TokenSet): Promise<void>;
+    load(): Promise<TokenSet | null>;
+    clear(): Promise<void>;
+}
+
+type CredentialStateNotification = Omit<CredentialSnapshot, 'tokenSet'>;
+
 /** 权益余额 (聚合)。token* 单位双体系: 免费=Token / 付费(TOKEN_PACKAGE,SUBSCRIPTION)=微Credits(÷1000=Credits)。 */
 interface EntitlementBalance {
     totalTokenQuota: number;
@@ -201,49 +438,6 @@ interface Transaction {
     createdAt: string;
 }
 
-/** OAuth Authorization Server 元数据 (RFC 8414) */
-interface ServerMetadata {
-    issuer: string;
-    authorization_endpoint: string;
-    token_endpoint: string;
-    revocation_endpoint: string;
-    registration_endpoint: string;
-    scopes_supported: string[];
-}
-/** OAuth token 响应 */
-interface TokenResponse {
-    access_token: string;
-    token_type: string;
-    expires_in: number;
-    refresh_token?: string;
-    scope?: string;
-}
-/** 持久化 token 对 */
-interface TokenSet {
-    access_token: string;
-    refresh_token: string;
-    /** ISO 8601 格式 */
-    expires_at: string;
-    scope: string;
-    client_id: string;
-    server_url: string;
-}
-/** token 是否已过期 (提前 30 秒视为过期) */
-declare function tokenSetIsExpired(t: TokenSet): boolean;
-/**
- * 运行时校验任意值是否为合法 TokenSet 形状 (所有字段都是 string)。
- *
- * store 反序列化磁盘 / localStorage 的 JSON 后必须经此校验:
- * 损坏文件、旧版本残留、缺字段都会被判为无效, 由 caller 当作"无 token"重新登录,
- * 而不是把 `{}` / 缺字段对象直接 cast 成 TokenSet 后在 refresh 阶段炸出难懂的错误。
- */
-declare function isValidTokenSet(x: unknown): x is TokenSet;
-/** 动态注册响应 */
-interface ClientRegistration {
-    client_id: string;
-    client_secret?: string;
-}
-
 declare class OAuthTokenEndpointError extends Error {
     readonly status: number;
     readonly oauthError: string;
@@ -313,7 +507,7 @@ type LoginEventType = 'auth_url' | 'complete' | 'error';
 declare const EventAuthURL: "auth_url";
 declare const EventComplete: "complete";
 declare const EventError: "error";
-type LoginErrCode = 'discovery_failed' | 'registration_failed' | 'browser_open_failed' | 'auth_denied' | 'auth_timeout' | 'token_exchange_failed' | 'ssl_proxy_detected' | 'state_mismatch';
+type LoginErrCode = 'discovery_failed' | 'registration_failed' | 'browser_open_failed' | 'auth_denied' | 'auth_timeout' | 'token_exchange_failed' | 'ssl_proxy_detected' | 'state_mismatch' | 'credential_install_rejected';
 declare const ErrDiscovery: "discovery_failed";
 declare const ErrRegistration: "registration_failed";
 declare const ErrBrowserOpen: "browser_open_failed";
@@ -325,6 +519,7 @@ declare const ErrSSLProxy: "ssl_proxy_detected";
 declare const ErrStateMismatch: "state_mismatch";
 /** 登录流程事件 */
 interface LoginEvent {
+    attemptId?: string;
     type: LoginEventType;
     url?: string;
     error?: string;
@@ -466,107 +661,6 @@ declare function revokeToken(meta: ServerMetadata, token: string, signal?: Abort
  */
 declare function newTokenSet(resp: TokenResponse, clientID: string, serverURL: string): TokenSet;
 
-/**
- * Token 持久化接口
- * 桌面智能体可自行实现 (如 macOS Keychain / Windows Credential Manager)
- *
- * 跨端约定:
- *   - Save: 写入持久化, 失败抛 Error
- *   - Load: 读取, 不存在返回 null (与 Go IsNotExist 行为一致)
- *   - Clear: 删除, 不存在不抛错 (Logout 后 Clear 不应报错, [RC-11])
- *   - withLock (v1.0.2 新增, 可选): 跨进程临界区. Client 在 refresh token rotation
- *     场景下用此包裹 "load → check → refresh → save" 整段, 防多进程共享同一 store
- *     (典型: FileTokenStore 默认 ~/.acosmi/tokens.json) 撞 HTTP 400 refresh token
- *     not found. 不实现时 Client 自动回退到仅进程内串行 (LocalStorage / InMemory
- *     单进程语义无需此方法).
- */
-interface TokenStore {
-    save(tokens: TokenSet): Promise<void>;
-    load(): Promise<TokenSet | null>;
-    clear(): Promise<void>;
-    withLock?<T>(fn: () => Promise<T>): Promise<T>;
-}
-/**
- * 基于文件的 token 存储 (开发/测试用)
- * 生产环境建议替换为系统钥匙串实现
- *
- * 默认路径: ~/.acosmi/tokens.json
- *
- * 浏览器环境调用 new FileTokenStore() 会抛错 — 浏览器请用 LocalStorageTokenStore 或 InMemoryTokenStore.
- */
-/** 跨进程文件锁配置 (v1.0.2). 公开常量是为了让 caller / 测试可观察, 不建议生产代码改. */
-declare const fileLockDefaults: {
-    /** 获取锁的超时上限 (毫秒). refresh 流程含网络 < 30s, 30s 已远超正常完成时间. */
-    readonly acquireTimeoutMs: 30000;
-    /** 旧锁判定阈值 (毫秒). 锁文件 mtime 早于此值视为 stale 进程崩溃残留, 自动 break. */
-    readonly staleMs: 60000;
-    /** 重试间隔基数 (毫秒). 真实间隔 = base + random(0, jitter). */
-    readonly retryBaseMs: 30;
-    readonly retryJitterMs: 70;
-};
-declare class FileTokenStore implements TokenStore {
-    private path;
-    /** 进程内串行化 (Promise chain) — 与跨进程 flock 配合, 避免单进程内并发持锁产生死锁式互等. */
-    private chain;
-    constructor(path?: string);
-    private resolvePath;
-    /** 进程内串行 (维持 v1.0.1 单进程语义). flock 之外另一层防御: 如果用户自己就是单进程
-     *  并发场景, 不必每次都进 flock 旁路文件 IO. */
-    private withChain;
-    /**
-     * 跨进程临界区. 用 sidecar `<path>.lock` 文件 + O_EXCL 创建语义实现互斥:
-     *   - 创建成功 = 持有锁; 写入 pid+timestamp 便于诊断
-     *   - 创建失败 (EEXIST) = 别的进程持锁, backoff 重试
-     *   - 锁文件 mtime > staleMs = 进程崩溃残留, unlink 后重试
-     *   - acquireTimeoutMs 超时 = 抛错 (caller 应作为 transient error 处理, 上层 retry)
-     *
-     * 注意: O_EXCL 在 NFS 上不保证原子; FileTokenStore 适用于本地文件系统 (典型用户家目录).
-     * 真要跨机共享 token, 应实现自定义 Keychain / 数据库 store, 不要用 FileTokenStore.
-     */
-    withLock<T>(fn: () => Promise<T>): Promise<T>;
-    /**
-     * 写入 token. 流程:
-     *   1. mkdir -p (默认路径目录)
-     *   2. 写入 `<path>.tmp.<pid>`
-     *   3. fsync 后 rename 到正式路径 (POSIX 上 rename(2) 同分区原子, Windows 上 ReplaceFile)
-     *
-     * 选择 atomic rename 而非直接 writeFile: 多进程并发或本进程崩溃时, 读端永远看到的是
-     * 完整的旧/新 JSON, 不会读到截断半文件 (Client.create.store.load 可能在另一进程
-     * 写入中间触发, atomic rename 避免它解析失败).
-     */
-    save(tokens: TokenSet): Promise<void>;
-    load(): Promise<TokenSet | null>;
-    clear(): Promise<void>;
-}
-/**
- * 创建文件 token 存储 (与 Go NewFileTokenStore 等价)
- * @param path 自定义路径; 空则使用默认 ~/.acosmi/tokens.json
- */
-declare function newFileTokenStore(path?: string): FileTokenStore;
-/**
- * 基于 LocalStorage 的 token 存储 (浏览器)
- *
- * 仅在浏览器环境可用 (检测 globalThis.localStorage)。
- * 不持久化跨设备同步, 适合单机 SPA 使用。
- */
-declare class LocalStorageTokenStore implements TokenStore {
-    private key;
-    constructor(key?: string);
-    save(tokens: TokenSet): Promise<void>;
-    load(): Promise<TokenSet | null>;
-    clear(): Promise<void>;
-}
-/**
- * 内存 token 存储 (不持久化, 进程重启即丢失)
- * 适合: 测试 / Deno script / 短期 SDK 调用 / 不希望落盘的安全场景
- */
-declare class InMemoryTokenStore implements TokenStore {
-    private tokens;
-    save(tokens: TokenSet): Promise<void>;
-    load(): Promise<TokenSet | null>;
-    clear(): Promise<void>;
-}
-
 /** 表示一次 retry 评估的请求快照 — 仅供 SafeToRetry 闸门使用 */
 interface RetryRequestInfo {
     method: string;
@@ -707,6 +801,21 @@ interface Config {
     baseUrl?: string;
     /** token 持久化实现, 缺省时按平台选 (Node File / Browser LocalStorage / Memory) */
     store?: TokenStore;
+    /** Opt-in durable CAS credential lifecycle. Legacy callers omit this field. */
+    credentialMode?: 'legacy' | 'versioned' | 'external';
+    /** Required exactly when credentialMode is versioned. */
+    versionedCredentialStore?: VersionedCredentialStore;
+    /** Optional owner fence for requests issued by this versioned Client. */
+    credentialRequestOwner?: CredentialRequestOwner;
+    /** Supplies a source-owned access token for each request in external mode. */
+    accessTokenProvider?: (signal?: AbortSignal) => Promise<string> | string;
+    /** Runs after a new authorization-code exchange and before durable install. */
+    beforeCredentialInstall?: (input: {
+        accessToken: string;
+        attemptId: string;
+        serverURL: string;
+        clientId: string;
+    }, signal?: AbortSignal) => Promise<void> | void;
     /** 自定义 fetch 实现 (默认 globalThis.fetch) */
     fetchImpl?: typeof fetch;
     /**
@@ -877,6 +986,13 @@ declare class Client {
     tokens: TokenSet | null;
     /** token 持久化 */
     store: TokenStore;
+    readonly credentialMode: 'legacy' | 'versioned' | 'external';
+    private readonly versionedCredentialStore;
+    private readonly accessTokenProvider;
+    private readonly beforeCredentialInstall;
+    private readonly credentialAuthority;
+    private readonly credentialRequestOwner;
+    private lifecycle;
     /** fetch 实现 (默认 globalThis.fetch) */
     fetchImpl: typeof fetch;
     /** 互斥锁 (TS 用 Promise chain 替代 sync.Mutex) */
@@ -907,6 +1023,7 @@ declare class Client {
     /** V29 系数缓存 (TTL 8s, listCoefficients 内部用) */
     coefCacheData: ModelCoefficient[] | null;
     coefCacheTimeMs: number;
+    private credentialOwnerKey;
     /** 串行化锁 (替代 Go sync.Mutex) */
     private coefMu;
     constructor(cfg?: Config);
@@ -915,6 +1032,38 @@ declare class Client {
      * 替代 Go NewClient (Go 同步 IO, TS 必须 async)
      */
     static create(cfg?: Config): Promise<Client>;
+    /** Read the durable authority. Available only in explicit versioned mode. */
+    getCredentialSnapshot(signal?: AbortSignal): Promise<CredentialSnapshot>;
+    /** Reconcile memory from durable state; storage errors never clear confirmed memory. */
+    reconcileCredentials(signal?: AbortSignal): Promise<CredentialSnapshot>;
+    private ownerKey;
+    private adoptCredentialOwner;
+    ensureCredential(signal?: AbortSignal): Promise<string>;
+    subscribeCredentialState(listener: (snapshot: CredentialStateNotification) => void): () => void;
+    retryCredentialIdentity(signal?: AbortSignal): Promise<CredentialSnapshot>;
+    logoutCredential(signal?: AbortSignal, expected?: {
+        storeInstanceId: string;
+        authSessionId: string | null;
+    }): Promise<{
+        logoutOperationId: `${string}-${string}-${string}-${string}-${string}`;
+        expectedAuthSessionId: string | null;
+        storeInstanceId: string;
+        revision: string;
+        status: "superseded";
+    } | {
+        status: "already_signed_out";
+        logoutOperationId: `${string}-${string}-${string}-${string}-${string}`;
+        expectedAuthSessionId: string | null;
+        storeInstanceId: string;
+        revision: string;
+    } | {
+        revision: string;
+        status: "committed";
+        revocation: Promise<"confirmed" | "failed" | "unsupported">;
+        logoutOperationId: `${string}-${string}-${string}-${string}-${string}`;
+        expectedAuthSessionId: string | null;
+        storeInstanceId: string;
+    }>;
     /** 是否已授权 (有可用 token) */
     isAuthorized(): boolean;
     /**
@@ -958,7 +1107,7 @@ declare class Client {
      */
     ensureToken(signal?: AbortSignal): Promise<string>;
     /** 强制刷新 token (用于 401 重试) */
-    forceRefresh(signal?: AbortSignal): Promise<void>;
+    forceRefresh(signal?: AbortSignal, rejectedToken?: string): Promise<void>;
     private refreshCurrentToken;
     private refreshCurrentTokenDirect;
     private refreshCurrentTokenViaProxy;
@@ -1184,6 +1333,7 @@ declare class Client {
      * 不复用 `apiURL`：apiURL 强制追加 `/api/v4`，与 compliance 路径不同。
      */
     complianceURL(path: string): string;
+    private assertCredentialURL;
     /** GET/POST/... 通用 JSON 调用 (返回 result 已 typed) */
     doJSON<T>(method: string, path: string, body: unknown | null, signal?: AbortSignal): Promise<T>;
     /** 与 doJSON 相同, 但返回响应 Headers (用于提取 X-Token-Remaining 等) */
@@ -1346,6 +1496,13 @@ declare class HTTPError extends Error {
      * false/缺失 = 周窗/显式禁止/灰度关 (硬等待, 无豁免路径, 老网关不返回时为 undefined)。
      */
     windowOverridable?: boolean;
+    errorContractVersion?: number;
+    faultDomain?: FaultDomain;
+    requestDisposition?: RequestDisposition;
+    transportRequestId?: string | null;
+    consumeRequestId?: string | null;
+    providerRequestId?: string | null;
+    retryable: boolean;
     constructor(statusCode: number, opts?: {
         type?: string;
         message?: string;
@@ -1355,6 +1512,13 @@ declare class HTTPError extends Error {
         windowKind?: 'FIVE_HOUR' | 'WEEKLY';
         windowResetAt?: string;
         windowOverridable?: boolean;
+        errorContractVersion?: number;
+        faultDomain?: FaultDomain;
+        requestDisposition?: RequestDisposition;
+        transportRequestId?: string | null;
+        consumeRequestId?: string | null;
+        providerRequestId?: string | null;
+        retryable?: boolean;
     });
 }
 /**
@@ -1371,6 +1535,7 @@ declare class NetworkError extends Error {
     cause?: unknown;
     timeout: boolean;
     eof: boolean;
+    requestDisposition: RequestDisposition;
     constructor(op: string, url: string, cause: unknown, opts?: {
         timeout?: boolean;
         eof?: boolean;
@@ -1387,6 +1552,8 @@ declare class NetworkError extends Error {
 declare class StreamError extends Error {
     /** 例: "empty_response" / "rate_limit" / "overloaded" / "" */
     code: string;
+    /** D23 gateway machine code; mirrors the legacy `code` field. */
+    errorCode: string;
     /** 例: "provider" / "settlement" */
     stage: string;
     /** 用户友好提示 (中文); 历史字段, 与 rawError 区分 */
@@ -1395,14 +1562,42 @@ declare class StreamError extends Error {
     rawError: string;
     /** 客户端是否值得重试 */
     retryable: boolean;
+    errorContractVersion?: number;
+    faultDomain?: FaultDomain;
+    requestDisposition?: RequestDisposition;
+    transportRequestId?: string | null;
+    consumeRequestId?: string | null;
+    providerRequestId?: string | null;
     constructor(opts?: {
         code?: string;
         stage?: string;
         message?: string;
         rawError?: string;
         retryable?: boolean;
+        errorContractVersion?: number;
+        faultDomain?: FaultDomain;
+        requestDisposition?: RequestDisposition;
+        transportRequestId?: string | null;
+        consumeRequestId?: string | null;
+        providerRequestId?: string | null;
     });
 }
+type RequestDisposition = 'not_accepted' | 'accepted' | 'unknown';
+type FaultDomain = 'user_auth' | 'caller_credentials' | 'account_quota' | 'account_permission' | 'provider' | 'gateway' | 'transport' | 'stream_ticket' | 'protocol';
+interface GatewayErrorContract {
+    errorContractVersion: 1;
+    faultDomain: FaultDomain;
+    errorCode: string;
+    transportRequestId: string | null;
+    consumeRequestId: string | null;
+    providerRequestId: string | null;
+    requestDisposition: RequestDisposition;
+    retryable: boolean;
+}
+/** Read the closed v1 gateway error contract without exposing the raw response body. */
+declare function readGatewayErrorContract(error: unknown): GatewayErrorContract | null;
+/** True only for an HTTP 401 carrying the exact v1 rejected user-token contract. */
+declare function isUserAccessTokenRejected(error: unknown): boolean;
 /**
  * 判断错误是否为窗口限额拒绝 (5 小时 / 7 天滚动窗口 credit 用量达上限)。
  * 结构化 errorCode 优先, message/body 子串防御兜底 (后端部署版本错位期:
@@ -5271,4 +5466,4 @@ declare class ChatBridgeClient {
     revokeCredential(credentialRef: string, signal?: AbortSignal): Promise<void>;
 }
 
-export { AGENT_RUN_META_TITLE, AGENT_RUN_META_WORKSPACE, ALL_INTEGRATION_STATUS, ALL_PLATFORMS, ALL_REGIONS, type APIResponse, type AdapterKind, type AgentRun, type AgentRunArtifact, type AgentRunArtifactList, type AgentRunArtifactPolicy, type AgentRunCreateRequest, type AgentRunCreateResponse, type AgentRunDownload, type AgentRunErrorPayload, type AgentRunListOptions, type AgentRunListResult, type AgentRunLocalContextPolicy, type AgentRunLocalToolHandler, type AgentRunLocalToolHandlerContext, type AgentRunLocalToolResult, type AgentRunRemoteCreateRequest, type AgentRunRunOptions, type AgentRunRuntime, type AgentRunSettlement, type AgentRunStatus, AgentRunStreamError, type AgentRunStreamEvent, type AgentRunStreamOptions, type AgentRunUsage, type AgentRunWithLocalToolsOptions, AgentRunsClient, AnthropicResponse, type ApiClientRef, type ApproveSealApprovalQuery, type AssignSeatRequest, type Audience, AudienceEnum, type AuthorizeResult, type BalanceDetail, type BalanceDetailEntitlement, type BillingMode, BillingModeEnum, type BillingPreflightResult, type BlockMeta, type BookConsultationRequest, type BridgeThreadRef, type BrowserRefreshMode, type BugReportResult, type BugView, BusinessError, type BuyResponse, type ByokCreateRequest, type ByokCredential, type ByokCredentialStatus, type ByokProvider, CHAT_REQUEST_TIMEOUT_MS, type CancelSealApprovalQuery, type CaseLead, type CaseMatter, type CertificationStatus, type ChannelAttachment, type ChannelCard, type ChannelCardAction, type ChannelInboundEvent, type ChannelOutboundEvent, ChatBridgeClient, type ChatBridgeSession, type ChatCredentialPublic, type ChatIntegration, ChatRequest, ChatResponse, type ChatThread, Client, type ClientRegistration, type ComplianceAssetType, type ComplianceBenefitType, type ComplianceBillingDisplayStatus, type ComplianceCapability, ComplianceClient, type ComplianceClientErrorCode, type ComplianceDigestSource, type ComplianceEnvelopeStatus, type ComplianceErrorInfo, type ComplianceErrorKey, type ComplianceHashAlgorithm, CompliancePollError, type CompliancePollOptions, type CompliancePrivacyLevel, type ComplianceProviderRequestStatus, type ComplianceProviderStatus, type ComplianceQuoteResponse, type ComplianceReport, type ComplianceScope, type ComplianceSealApprovalStatus, type ComplianceSku, type ComplianceTimestampVerificationStatus, type ComplianceWriteOptions, type Config, type ConsumeRecord, type ConsumeRecordPage, type ContractTemplateField, type ContractTemplateFieldType, type ContractTemplatePageItem, type ContractTemplateResp, type ContractTemplateStatus, type ContractTemplateVersion, type CorporateTransfer, CrabCodeByokClient, type CreateContractTemplateRequest, type CreateEvidenceAssetRequest, type CreateH5SigningUrlRequest, type CreateIntegrationRequest, type CreateReportRequest, type CreateSigningEnvelopeRequest, type CreateWebAuthorizationRequestOptions, type CredentialRef, DEFAULT_API_TIMEOUT_MS, DEFAULT_GATEWAY_BASE_URL, DefaultRetryPolicy, type DeviceRegistration, EmbeddingRequest, EmbeddingResponse, type EnterpriseKycMyStatusView, type EnterpriseMember, type EnterpriseSummary, type EntitlementBalance, type EntitlementItem, type EnvelopeContractItem, ErrAuthDenied, ErrBillingCallbackCannotCommit, ErrBillingCommitRequiresLocalVerify, ErrBillingS2sForbidden, ErrBrowserOpen, ErrComplianceStepUpRequired, ErrDiscovery, ErrEnvelopeGateClosed, ErrOAuthCORSBlocked, ErrProviderNotConfigured, ErrProviderUnknownNoRetry, ErrRefreshProxyFailed, ErrRegistration, ErrSSLProxy, ErrSealApprovalContractHashMismatch, ErrSealApprovalExpired, ErrSealApprovalLocationMismatch, ErrSealApprovalNonceUsed, ErrSealApprovalNotApproved, ErrSealApprovalSealMismatch, ErrSealApprovalTransactorMismatch, ErrSealUseAlreadyConsumed, ErrStateMismatch, ErrTimeout, ErrTokenExchange, ErrTokenExpired, EventAuthURL, EventComplete, EventError, type EvidenceAsset, type EvidenceAssetPageItem, type EvidencePackage, type EvidencePackagePageItem, type FeatureGateState, type FeatureGateStatus, FileTokenStore, type FilterStatus, FilterStatusAdminBypass, FilterStatusDisabledByFlag, FilterStatusFallbackMissingUser, FilterStatusFallbackNoBuckets, FilterStatusFallbackTkdistError, FilterStatusFallbackTkdistSkew, FilterStatusInternalBypass, FilterStatusOK, FilterStatusUnknown, GATEWAY_REQUEST_ID_HEADER, type GateQuota, type GatewayRequestIDCallback, type GenerateSkillRequest, type GenerateSkillResult, HTTPError, type IdempotencyKey, IdempotencyKeyHeader, ImageGenerationRequest, ImageGenerationResponse, InMemoryTokenStore, type InitiateCorporateTransferInput, type InitiateCorporateTransferResult, InputModality, type IntegrationStatus, type InviteMemberRequest, type Invoice, type IssueTimestampRequest, type LawyerCredentialMyView, type LawyerSummary, type LegalConsultation, type LegalServiceOrder, type LegalServiceSku, type LegalSkuCode, type ListContractTemplatesRequest, type ListEvidenceAssetsRequest, type ListEvidencePackagesRequest, type ListOperationsRequest, type ListReportsRequest, type ListSealApprovalsRequest, type ListSealUsesRequest, type ListSigningEnvelopesRequest, type ListTimestampsRequest, LocalStorageTokenStore, type LoginErrCode, type LoginEvent, type LoginEventType, type LoginOptions, ManagedModel, type Membership, type ModelBucket, type ModelByQuotaResponse, ModelCapabilities, type ModelCoefficient, ModelNotFoundError, NetworkError, type Notification, type NotificationList, type NotificationPreference, type NotificationUnreadCount, type OAuthMetadataProfile, OAuthTokenEndpointError, type OpenAIChatChoice, type OpenAIChatMessage, type OpenAIChatResponse, type OpenAIFunctionCall, type OpenAIStreamChoice, type OpenAIStreamChunk, type OpenAIStreamDelta, type OpenAIStreamToolCall, type OpenAIToolCall, type OpenAIUsage, type OperationDetail, type OperationId, type OperationPageItem, type OperationSource, type OperationStatus, type OptimizeSkillRequest, type OptimizeSkillResult, type Order, type OrderListItem, type OrderStatus, OrderTerminalError, type OrgConsumeReport, type OrgSeat, type OrgSubscription, type PageRequest, type PageResult, type PayPayload, type PaymentMethod, type PermissionPolicy, type Platform, type PricingConfig, type PrincipalRef, type Product, type ProductFamily, ProductFamilyEnum, ProviderAdapter, type ProviderRequestStatus, type ProviderRequestStatusView, type PublicEvidenceVerifyResult, type PublicModelSummary, QuotaSummary, RETRY_ADVICE_REASONS, RateLimitError, type RefundPolicy, type RefundRecord, type Region, type RegionScope, RegionScopeEnum, type RegisterWebOAuthClientOptions, type RejectSealApprovalQuery, type RemoteControlDone, type RemoteControlError, type RemoteControlEvent, type RemoteControlEventType, type RemoteControlPermissionRequest, type RemoteControlPermissionResult, type RemoteControlReasoningDelta, type RemoteControlSettle, type RemoteControlStatus, type RemoteControlTextDelta, type RemoteControlToolCall, type RemoteControlToolResult, type RemoteControlUsage, type RemotePermissionDecision, type RemotePermissionResultRequest, type RemoteSessionPlacement, type RemoteSessionRef, type RemoteSessionTokenGrant, type RemoteUserMessageAck, type RemoteUserMessageRequest, type ReportDownload, type ReportPageItem, type ReqTimeoutCtl, type RequestInvoiceInput, type RequestRefundInput, RerankRequest, RerankResponse, type RetryAdvice, type RetryAdviceReason, type RetryPolicy, type RetryRequestInfo, type RolloverPolicy, type RunnerKind, ScopeAI, ScopeAccount, ScopeAgentAccessManage, ScopeChatBridge, ScopeChatBridgeRead, ScopeChatBridgeRotate, ScopeChatBridgeWrite, ScopeComplianceContractSigningRead, ScopeComplianceContractSigningWrite, ScopeComplianceContractTemplateRead, ScopeComplianceContractTemplateWrite, ScopeComplianceEvidenceRead, ScopeComplianceEvidenceWrite, ScopeComplianceReportsPublish, ScopeComplianceReportsRead, ScopeComplianceReportsWrite, ScopeComplianceSealApprovalApprove, ScopeComplianceSealApprovalRequest, ScopeComplianceSealManage, ScopeComplianceSealUseExecute, ScopeComplianceTimestampIssue, ScopeComplianceTimestampVerify, ScopeEntitlements, ScopeModels, ScopeModelsChat, ScopeProfile, ScopeRemoteControl, ScopeRemoteControlAgentRun, ScopeRemoteControlPermissionResponse, ScopeRemoteControlSessionControl, ScopeSkillStore, ScopeSkills, ScopeTokenPackages, ScopeTools, ScopeToolsExecute, ScopeWallet, ScopeWalletReadonly, type SealApproval, type SealApprovalPageItem, type SealUsePageItem, type ServerMetadata, type SignEnvelopeRequest, type SigningEnvelope, type SigningEnvelopePageItem, type SkillBrowseListResponse, type SkillBrowseResponse, type SkillStoreItem, type SkillStoreListItem, type SkillStoreQuery, type SkillSummary, type SortDirection, SourcesEvent, type StepUpStatus, type StoreCredentialRequest, StreamError, StreamEvent, StreamSettlement, type SubmitCaseLeadRequest, type SubmitSealApprovalRequest, type SubscriptionAudience, type SubscriptionPlan, type SubscriptionTier, type TenantRef, type TimestampPageItem, type TimestampToken, type TimestampVerifyResult, type TokenPackage, type TokenResponse, type TokenSet, type TokenStore, type ToolListResponse, type ToolProvider, type ToolView, type Transaction, type TsaProvider, type TsaStats, type UpdateContractTemplateRequest, type UploadContractTemplatePdfRequest, type UpstreamActivityCallback, type UserSubscription, type VerifyStatus, type VerifyTimestampRequest, VideoGenerationRequest, VideoTaskResponse, type VoidEnvelopeRequest, type WSConfig, type WSEvent, type WalletStats, type WebAuthorizationCallbackParams, type WebAuthorizationPending, type WebAuthorizationRequest, WindowResetSummary, type WorkspacePolicy, type YudaoPageResult, agentAccessScopes, allScopes, apiResponseBusinessError, apiResponseGetMessage, asCredentialRef, authorize, buildBetas, chatBridgeScopes, classifyComplianceError, commerceScopes, completeWebAuthorizationRequest, complianceErrorToRetryAdvice, complianceScopes, computeBackoff, createWebAuthorizationRequest, defaultRetryable, defaultSafeToRetry, discover, discoverWebOAuthMetadata, discoverWithProfile, effectivePolicy, exchangeCode, extractAnthropicBlockMeta, fileLockDefaults, findDesktopVisualUnderstandingModel, findFirstModelByInputModality, generateState, getWindowLimitStreamDetails, isBillingConfirmable, isChannelInboundEvent, isComplianceBusinessError, isComplianceTerminalError, isContinuableWindowLimitError, isIntegrationStatus, isInvalidGrantError, isPlatform, isRegion, isSSECommentLine, isSSLError, isTerminalRemoteEvent, isValidTokenSet, isWindowLimitError, isWindowLimitStreamError, maxEndUserIdLength, modelScopes, modelSupportsImageInput, modelSupportsInputModality, newFileTokenStore, newTokenSet, normalizeGatewayBaseURL, normalizeOverrideBaseURL, parseNotificationEvent, parseRemoteControlEvent, refreshToken, register, registerWebOAuthClient, remoteControlScopes, retryReasonForComplianceKey, retryReasonForOAuthError, revokeToken, skillScopes, tokenSetIsExpired, uniqueMerge, validateEndUserId };
+export { AGENT_RUN_META_TITLE, AGENT_RUN_META_WORKSPACE, ALL_INTEGRATION_STATUS, ALL_PLATFORMS, ALL_REGIONS, type APIResponse, type AdapterKind, type AgentRun, type AgentRunArtifact, type AgentRunArtifactList, type AgentRunArtifactPolicy, type AgentRunCreateRequest, type AgentRunCreateResponse, type AgentRunDownload, type AgentRunErrorPayload, type AgentRunListOptions, type AgentRunListResult, type AgentRunLocalContextPolicy, type AgentRunLocalToolHandler, type AgentRunLocalToolHandlerContext, type AgentRunLocalToolResult, type AgentRunRemoteCreateRequest, type AgentRunRunOptions, type AgentRunRuntime, type AgentRunSettlement, type AgentRunStatus, AgentRunStreamError, type AgentRunStreamEvent, type AgentRunStreamOptions, type AgentRunUsage, type AgentRunWithLocalToolsOptions, AgentRunsClient, AnthropicResponse, type ApiClientRef, type ApproveSealApprovalQuery, type AssignSeatRequest, type Audience, AudienceEnum, type AuthorizeResult, type BalanceDetail, type BalanceDetailEntitlement, type BillingMode, BillingModeEnum, type BillingPreflightResult, type BlockMeta, type BookConsultationRequest, type BridgeThreadRef, type BrowserRefreshMode, type BugReportResult, type BugView, BusinessError, type BuyResponse, type ByokCreateRequest, type ByokCredential, type ByokCredentialStatus, type ByokProvider, CHAT_REQUEST_TIMEOUT_MS, type CancelSealApprovalQuery, type CaseLead, type CaseMatter, type CertificationStatus, type ChannelAttachment, type ChannelCard, type ChannelCardAction, type ChannelInboundEvent, type ChannelOutboundEvent, ChatBridgeClient, type ChatBridgeSession, type ChatCredentialPublic, type ChatIntegration, ChatRequest, ChatResponse, type ChatThread, Client, type ClientRegistration, type ComplianceAssetType, type ComplianceBenefitType, type ComplianceBillingDisplayStatus, type ComplianceCapability, ComplianceClient, type ComplianceClientErrorCode, type ComplianceDigestSource, type ComplianceEnvelopeStatus, type ComplianceErrorInfo, type ComplianceErrorKey, type ComplianceHashAlgorithm, CompliancePollError, type CompliancePollOptions, type CompliancePrivacyLevel, type ComplianceProviderRequestStatus, type ComplianceProviderStatus, type ComplianceQuoteResponse, type ComplianceReport, type ComplianceScope, type ComplianceSealApprovalStatus, type ComplianceSku, type ComplianceTimestampVerificationStatus, type ComplianceWriteOptions, type Config, type ConsumeRecord, type ConsumeRecordPage, type ContractTemplateField, type ContractTemplateFieldType, type ContractTemplatePageItem, type ContractTemplateResp, type ContractTemplateStatus, type ContractTemplateVersion, type CorporateTransfer, CrabCodeByokClient, type CreateContractTemplateRequest, type CreateEvidenceAssetRequest, type CreateH5SigningUrlRequest, type CreateIntegrationRequest, type CreateReportRequest, type CreateSigningEnvelopeRequest, type CreateWebAuthorizationRequestOptions, type CredentialAuthorityConfig, type CredentialCASExpected, type CredentialCASResult, type CredentialLoginAttempt, type CredentialMutationReceipt, type CredentialPrincipal, type CredentialReason, type CredentialRef, type CredentialRefreshOperation, type CredentialRequestOwner, type CredentialSnapshot, type CredentialState, type CredentialStateNotification, DEFAULT_API_TIMEOUT_MS, DEFAULT_GATEWAY_BASE_URL, DefaultRetryPolicy, type DeviceRegistration, EmbeddingRequest, EmbeddingResponse, type EnterpriseKycMyStatusView, type EnterpriseMember, type EnterpriseSummary, type EntitlementBalance, type EntitlementItem, type EnvelopeContractItem, ErrAuthDenied, ErrBillingCallbackCannotCommit, ErrBillingCommitRequiresLocalVerify, ErrBillingS2sForbidden, ErrBrowserOpen, ErrComplianceStepUpRequired, ErrDiscovery, ErrEnvelopeGateClosed, ErrOAuthCORSBlocked, ErrProviderNotConfigured, ErrProviderUnknownNoRetry, ErrRefreshProxyFailed, ErrRegistration, ErrSSLProxy, ErrSealApprovalContractHashMismatch, ErrSealApprovalExpired, ErrSealApprovalLocationMismatch, ErrSealApprovalNonceUsed, ErrSealApprovalNotApproved, ErrSealApprovalSealMismatch, ErrSealApprovalTransactorMismatch, ErrSealUseAlreadyConsumed, ErrStateMismatch, ErrTimeout, ErrTokenExchange, ErrTokenExpired, EventAuthURL, EventComplete, EventError, type EvidenceAsset, type EvidenceAssetPageItem, type EvidencePackage, type EvidencePackagePageItem, type FaultDomain, type FeatureGateState, type FeatureGateStatus, FileTokenStore, type FilterStatus, FilterStatusAdminBypass, FilterStatusDisabledByFlag, FilterStatusFallbackMissingUser, FilterStatusFallbackNoBuckets, FilterStatusFallbackTkdistError, FilterStatusFallbackTkdistSkew, FilterStatusInternalBypass, FilterStatusOK, FilterStatusUnknown, GATEWAY_REQUEST_ID_HEADER, type GateQuota, type GatewayErrorContract, type GatewayRequestIDCallback, type GenerateSkillRequest, type GenerateSkillResult, HTTPError, type IdempotencyKey, IdempotencyKeyHeader, ImageGenerationRequest, ImageGenerationResponse, InMemoryTokenStore, type InitiateCorporateTransferInput, type InitiateCorporateTransferResult, InputModality, type IntegrationStatus, type InviteMemberRequest, type Invoice, type IssueTimestampRequest, type LawyerCredentialMyView, type LawyerSummary, type LegalConsultation, type LegalServiceOrder, type LegalServiceSku, type LegalSkuCode, type ListContractTemplatesRequest, type ListEvidenceAssetsRequest, type ListEvidencePackagesRequest, type ListOperationsRequest, type ListReportsRequest, type ListSealApprovalsRequest, type ListSealUsesRequest, type ListSigningEnvelopesRequest, type ListTimestampsRequest, LocalStorageTokenStore, type LoginErrCode, type LoginEvent, type LoginEventType, type LoginOptions, ManagedModel, type Membership, type ModelBucket, type ModelByQuotaResponse, ModelCapabilities, type ModelCoefficient, ModelNotFoundError, NetworkError, type Notification, type NotificationList, type NotificationPreference, type NotificationUnreadCount, type OAuthMetadataProfile, OAuthTokenEndpointError, type OpenAIChatChoice, type OpenAIChatMessage, type OpenAIChatResponse, type OpenAIFunctionCall, type OpenAIStreamChoice, type OpenAIStreamChunk, type OpenAIStreamDelta, type OpenAIStreamToolCall, type OpenAIToolCall, type OpenAIUsage, type OperationDetail, type OperationId, type OperationPageItem, type OperationSource, type OperationStatus, type OptimizeSkillRequest, type OptimizeSkillResult, type Order, type OrderListItem, type OrderStatus, OrderTerminalError, type OrgConsumeReport, type OrgSeat, type OrgSubscription, type PageRequest, type PageResult, type PayPayload, type PaymentMethod, type PermissionPolicy, type Platform, type PricingConfig, type PrincipalRef, type Product, type ProductFamily, ProductFamilyEnum, ProviderAdapter, type ProviderRequestStatus, type ProviderRequestStatusView, type PublicEvidenceVerifyResult, type PublicModelSummary, QuotaSummary, RETRY_ADVICE_REASONS, RateLimitError, type RefundPolicy, type RefundRecord, type Region, type RegionScope, RegionScopeEnum, type RegisterWebOAuthClientOptions, type RejectSealApprovalQuery, type RemoteControlDone, type RemoteControlError, type RemoteControlEvent, type RemoteControlEventType, type RemoteControlPermissionRequest, type RemoteControlPermissionResult, type RemoteControlReasoningDelta, type RemoteControlSettle, type RemoteControlStatus, type RemoteControlTextDelta, type RemoteControlToolCall, type RemoteControlToolResult, type RemoteControlUsage, type RemotePermissionDecision, type RemotePermissionResultRequest, type RemoteSessionPlacement, type RemoteSessionRef, type RemoteSessionTokenGrant, type RemoteUserMessageAck, type RemoteUserMessageRequest, type ReportDownload, type ReportPageItem, type ReqTimeoutCtl, type RequestDisposition, type RequestInvoiceInput, type RequestRefundInput, RerankRequest, RerankResponse, type RetryAdvice, type RetryAdviceReason, type RetryPolicy, type RetryRequestInfo, type RolloverPolicy, type RunnerKind, ScopeAI, ScopeAccount, ScopeAgentAccessManage, ScopeChatBridge, ScopeChatBridgeRead, ScopeChatBridgeRotate, ScopeChatBridgeWrite, ScopeComplianceContractSigningRead, ScopeComplianceContractSigningWrite, ScopeComplianceContractTemplateRead, ScopeComplianceContractTemplateWrite, ScopeComplianceEvidenceRead, ScopeComplianceEvidenceWrite, ScopeComplianceReportsPublish, ScopeComplianceReportsRead, ScopeComplianceReportsWrite, ScopeComplianceSealApprovalApprove, ScopeComplianceSealApprovalRequest, ScopeComplianceSealManage, ScopeComplianceSealUseExecute, ScopeComplianceTimestampIssue, ScopeComplianceTimestampVerify, ScopeEntitlements, ScopeModels, ScopeModelsChat, ScopeProfile, ScopeRemoteControl, ScopeRemoteControlAgentRun, ScopeRemoteControlPermissionResponse, ScopeRemoteControlSessionControl, ScopeSkillStore, ScopeSkills, ScopeTokenPackages, ScopeTools, ScopeToolsExecute, ScopeWallet, ScopeWalletReadonly, type SealApproval, type SealApprovalPageItem, type SealUsePageItem, type ServerMetadata, type SignEnvelopeRequest, type SigningEnvelope, type SigningEnvelopePageItem, type SkillBrowseListResponse, type SkillBrowseResponse, type SkillStoreItem, type SkillStoreListItem, type SkillStoreQuery, type SkillSummary, type SortDirection, SourcesEvent, type StepUpStatus, type StoreCredentialRequest, StreamError, StreamEvent, StreamSettlement, type SubmitCaseLeadRequest, type SubmitSealApprovalRequest, type SubscriptionAudience, type SubscriptionPlan, type SubscriptionTier, type TenantRef, type TimestampPageItem, type TimestampToken, type TimestampVerifyResult, type TokenPackage, type TokenResponse, type TokenSet, type TokenStore, type ToolListResponse, type ToolProvider, type ToolView, type Transaction, type TsaProvider, type TsaStats, type UpdateContractTemplateRequest, type UploadContractTemplatePdfRequest, type UpstreamActivityCallback, type UserSubscription, type VerifiedCredentialIdentity, type VerifyStatus, type VerifyTimestampRequest, type VersionedCredentialStore, VideoGenerationRequest, VideoTaskResponse, type VoidEnvelopeRequest, type WSConfig, type WSEvent, type WalletStats, type WebAuthorizationCallbackParams, type WebAuthorizationPending, type WebAuthorizationRequest, WindowResetSummary, type WorkspacePolicy, type YudaoPageResult, agentAccessScopes, allScopes, apiResponseBusinessError, apiResponseGetMessage, asCredentialRef, authorize, buildBetas, chatBridgeScopes, classifyComplianceError, commerceScopes, completeWebAuthorizationRequest, complianceErrorToRetryAdvice, complianceScopes, computeBackoff, createWebAuthorizationRequest, defaultRetryable, defaultSafeToRetry, discover, discoverWebOAuthMetadata, discoverWithProfile, effectivePolicy, exchangeCode, extractAnthropicBlockMeta, fileLockDefaults, findDesktopVisualUnderstandingModel, findFirstModelByInputModality, generateState, getWindowLimitStreamDetails, isBillingConfirmable, isChannelInboundEvent, isComplianceBusinessError, isComplianceTerminalError, isContinuableWindowLimitError, isIntegrationStatus, isInvalidGrantError, isPlatform, isRegion, isSSECommentLine, isSSLError, isTerminalRemoteEvent, isUserAccessTokenRejected, isValidTokenSet, isWindowLimitError, isWindowLimitStreamError, maxEndUserIdLength, modelScopes, modelSupportsImageInput, modelSupportsInputModality, newFileTokenStore, newTokenSet, normalizeGatewayBaseURL, normalizeOverrideBaseURL, parseNotificationEvent, parseRemoteControlEvent, readGatewayErrorContract, refreshToken, register, registerWebOAuthClient, remoteControlScopes, retryReasonForComplianceKey, retryReasonForOAuthError, revokeToken, skillScopes, tokenSetIsExpired, uniqueMerge, validateEndUserId };