@acosmi/sdk-ts 2.6.0 → 2.7.0

package/dist/node/index.mjs

@@ -4763,6 +4763,8 @@ async function sleepWithSignal2(ms, signal) {
 }
 
 // src/agent-runs/types.ts
+var AGENT_RUN_META_TITLE = "title";
+var AGENT_RUN_META_WORKSPACE = "workspace";
 var AgentRunStreamError = class extends Error {
   event;
   code;
@@ -4938,6 +4940,33 @@ var AgentRunsClient = class {
     );
     return fromWireCreateResponse(resp);
   }
+  /**
+   * List the caller's own agent runs, newest first (GET /agent-runs, Phase 5C
+   * console). Returns view metadata only — never session tokens, policies or
+   * messages (contract §6). Filter remote-control runs with
+   * `{ runtime: 'crabcode_remote' }`.
+   */
+  async list(opts = {}, signal) {
+    const params = new URLSearchParams();
+    if (opts.runtime) params.set("runtime", opts.runtime);
+    if (opts.status) params.set("status", opts.status);
+    if (opts.page != null) params.set("page", String(opts.page));
+    if (opts.pageSize != null) params.set("page_size", String(opts.pageSize));
+    const qs = params.toString();
+    const resp = await this.requestAPI(
+      "GET",
+      `/agent-runs${qs ? `?${qs}` : ""}`,
+      null,
+      signal,
+      { retryOn401: true }
+    );
+    return {
+      records: (resp.records ?? []).map(fromWireRun),
+      total: typeof resp.total === "number" ? resp.total : 0,
+      page: typeof resp.page === "number" ? resp.page : 1,
+      pageSize: typeof resp.pageSize === "number" ? resp.pageSize : 20
+    };
+  }
   get(runId, signal) {
     return this.requestAPI(
       "GET",
@@ -4999,6 +5028,73 @@ var AgentRunsClient = class {
       [Symbol.asyncIterator]: () => this.streamRemoteControlGen(runId, signal)
     };
   }
+  /**
+   * Submit a permission decision for a pending `permission_request` event
+   * (POST /agent-runs/:runId/permission-results, contract §4/§9/§14).
+   *
+   * Only `approved` | `rejected` may be submitted by clients — `timeout` /
+   * `cancelled` are produced server-side. Requires an OAuth token with the
+   * explicit `remote_control` scope (or a web JWT). 409 means the remote
+   * session is gone (e.g. already terminated).
+   */
+  async submitPermissionResult(runId, result, signal) {
+    await this.requestAPI(
+      "POST",
+      `/agent-runs/${encodeURIComponent(runId)}/permission-results`,
+      {
+        request_id: result.requestId,
+        decision: result.decision,
+        reason: result.reason
+      },
+      signal,
+      { retryOn401: false }
+    );
+  }
+  /**
+   * Append a mid-session user message to a remote run
+   * (POST /agent-runs/:runId/messages, Phase 5C). The message role is
+   * hard-coded to 'user' server-side (contract §6 #5 prompt-injection
+   * defence); content is limited to 64KB. Requires the explicit
+   * `remote_control` scope (or a web JWT).
+   */
+  async submitUserMessage(runId, message, signal) {
+    const resp = await this.requestAPI(
+      "POST",
+      `/agent-runs/${encodeURIComponent(runId)}/messages`,
+      { request_id: message.requestId, content: message.content },
+      signal,
+      { retryOn401: false }
+    );
+    return {
+      ok: resp?.ok === true,
+      requestId: resp?.request_id ?? message.requestId ?? ""
+    };
+  }
+  /**
+   * Reveal the one-shot remote session token for a desktop-runner run
+   * (POST /agent-runs/:runId/remote-token, Phase 5B; contract §18.1).
+   *
+   * Desktop launcher only: the token is single-consumption (a second call
+   * returns 409) and must never touch browser storage — receive it in the
+   * native layer and inject it into the CrabCode child-process env only
+   * (contract §6). Cloud / local_embedded runners never expose tokens over
+   * HTTP (403). Requires the explicit `remote_control` scope.
+   */
+  async revealRemoteToken(runId, signal) {
+    const resp = await this.requestAPI(
+      "POST",
+      `/agent-runs/${encodeURIComponent(runId)}/remote-token`,
+      {},
+      signal,
+      { retryOn401: false }
+    );
+    return {
+      accessToken: resp?.access_token ?? "",
+      sessionUrl: resp?.session_url ?? "",
+      tenantId: resp?.tenant_id ?? "",
+      workspace: resp?.workspace || void 0
+    };
+  }
   async *streamRemoteControlGen(runId, signal) {
     const resp = await this.requestRaw(
       "GET",
@@ -5249,6 +5345,7 @@ function toWireCreateRequest(req) {
     adapter: req.adapter,
     permission_policy: req.permissionPolicy ? toWirePermissionPolicy(req.permissionPolicy) : void 0,
     workspace_policy: req.workspacePolicy ? toWireWorkspacePolicy(req.workspacePolicy) : void 0,
+    byok_credential_ref: req.byokCredentialRef,
     artifact_policy: req.artifactPolicy ? {
       enabled: req.artifactPolicy.enabled,
       max_files: req.artifactPolicy.maxFiles
@@ -5281,7 +5378,10 @@ function fromWireRun(resp) {
     startedAt: resp.started_at,
     completedAt: resp.completed_at,
     error: normalizeError(resp.error),
-    metadata: resp.metadata
+    metadata: resp.metadata,
+    runtime: resp.runtime,
+    runner: resp.runner,
+    adapter: resp.adapter
   };
 }
 function fromWireArtifact(resp) {
@@ -5539,6 +5639,87 @@ function errorMessage(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
+// src/agent-runs/byok.ts
+function fromWireByok(v) {
+  return {
+    credentialRef: v.credential_ref ?? "",
+    provider: v.provider ?? "",
+    name: v.name || void 0,
+    baseUrl: v.base_url || void 0,
+    fingerprint: v.fingerprint || void 0,
+    status: v.status ?? "",
+    createdAt: v.created_at || void 0,
+    lastUsedAt: v.last_used_at || void 0
+  };
+}
+var byokByClient = /* @__PURE__ */ new WeakMap();
+Object.defineProperty(Client.prototype, "crabcodeByok", {
+  configurable: true,
+  enumerable: false,
+  get() {
+    let existing = byokByClient.get(this);
+    if (!existing) {
+      existing = new CrabCodeByokClient(this);
+      byokByClient.set(this, existing);
+    }
+    return existing;
+  }
+});
+var CrabCodeByokClient = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** 列出调用者自己的密钥 (masked; 新→旧, 服务端上限 100 条)。 */
+  async list(signal) {
+    const resp = await this.client.doJSON(
+      "GET",
+      "/crabcode/byok-credentials",
+      null,
+      signal
+    );
+    return (resp.data?.items ?? []).map(fromWireByok);
+  }
+  /**
+   * 创建密钥 — 明文一次性提交, 返回 masked 视图。
+   * 单用户上限 20 把; provider='custom' 必须带 https:// baseUrl。
+   */
+  async create(req, signal) {
+    const resp = await this.client.doJSON(
+      "POST",
+      "/crabcode/byok-credentials",
+      {
+        provider: req.provider,
+        name: req.name,
+        base_url: req.baseUrl,
+        plaintext: req.plaintext
+      },
+      signal
+    );
+    return fromWireByok(resp.data ?? {});
+  }
+  /** 轮换密钥明文 — credentialRef 不变, fingerprint 更新。已吊销的密钥不可轮换 (400)。 */
+  async rotate(credentialRef, newPlaintext, signal) {
+    const resp = await this.client.doJSON(
+      "POST",
+      `/crabcode/byok-credentials/${encodeURIComponent(credentialRef)}/rotate`,
+      { new_plaintext: newPlaintext },
+      signal
+    );
+    return fromWireByok(resp.data ?? {});
+  }
+  /** 吊销密钥 (软状态 + 服务端抹密文, 不可恢复; 幂等 — 重复吊销返回当前视图)。 */
+  async revoke(credentialRef, signal) {
+    const resp = await this.client.doJSON(
+      "POST",
+      `/crabcode/byok-credentials/${encodeURIComponent(credentialRef)}/revoke`,
+      {},
+      signal
+    );
+    return fromWireByok(resp.data ?? {});
+  }
+};
+
 // src/compliance/scopes.ts
 var ScopeComplianceEvidenceRead = "compliance:evidence:read";
 var ScopeComplianceEvidenceWrite = "compliance:evidence:write";
@@ -7192,6 +7373,130 @@ function asCredentialRef(s) {
   return s;
 }
 
-export { ALL_INTEGRATION_STATUS, ALL_PLATFORMS, ALL_REGIONS, AgentRunStreamError, AgentRunsClient, AnthropicAdapter, AudienceEnum, BillingModeEnum, BucketClassCommercial, BucketClassGeneric, BusinessError, Client, ComplianceClient, CompliancePollError, DEFAULT_API_TIMEOUT_MS, DEFAULT_GATEWAY_BASE_URL, DefaultRetryPolicy, ErrAuthDenied, ErrBillingCallbackCannotCommit, ErrBillingCommitRequiresLocalVerify, ErrBillingS2sForbidden, ErrBrowserOpen, ErrComplianceStepUpRequired, ErrDiscovery, ErrEnvelopeGateClosed, ErrOAuthCORSBlocked, ErrProviderNotConfigured, ErrProviderUnknownNoRetry, ErrRefreshProxyFailed, ErrRegistration, ErrSSLProxy, ErrSealApprovalContractHashMismatch, ErrSealApprovalExpired, ErrSealApprovalLocationMismatch, ErrSealApprovalNonceUsed, ErrSealApprovalNotApproved, ErrSealApprovalSealMismatch, ErrSealApprovalTransactorMismatch, ErrSealUseAlreadyConsumed, ErrStateMismatch, ErrTimeout, ErrTokenExchange, ErrTokenExpired, EventAuthURL, EventComplete, EventError, FileTokenStore, FilterStatusAdminBypass, FilterStatusDisabledByFlag, FilterStatusFallbackMissingUser, FilterStatusFallbackNoBuckets, FilterStatusFallbackTkdistError, FilterStatusFallbackTkdistSkew, FilterStatusInternalBypass, FilterStatusOK, FilterStatusUnknown, HTTPError, IdempotencyKeyHeader, InMemoryTokenStore, LocalStorageTokenStore, ModelNotFoundError, NetworkError, OAuthTokenEndpointError, OpenAIAdapter, OrderTerminalError, ProductFamilyEnum, ProviderFormat, RETRY_ADVICE_REASONS, RateLimitError, RegionScopeEnum, ScopeAI, ScopeAccount, ScopeChatBridge, ScopeChatBridgeRead, ScopeChatBridgeRotate, ScopeChatBridgeWrite, ScopeComplianceContractSigningRead, ScopeComplianceContractSigningWrite, ScopeComplianceContractTemplateRead, ScopeComplianceContractTemplateWrite, ScopeComplianceEvidenceRead, ScopeComplianceEvidenceWrite, ScopeComplianceReportsPublish, ScopeComplianceReportsRead, ScopeComplianceReportsWrite, ScopeComplianceSealApprovalApprove, ScopeComplianceSealApprovalRequest, ScopeComplianceSealManage, ScopeComplianceSealUseExecute, ScopeComplianceTimestampIssue, ScopeComplianceTimestampVerify, ScopeEntitlements, ScopeModels, ScopeModelsChat, ScopeProfile, ScopeRemoteControl, ScopeRemoteControlAgentRun, ScopeRemoteControlPermissionResponse, ScopeRemoteControlSessionControl, ScopeSkillStore, ScopeSkills, ScopeTokenPackages, ScopeTools, ScopeToolsExecute, ScopeWallet, ScopeWalletReadonly, ServerToolTypeWebSearch, StreamError, ThinkingHigh, ThinkingHighMinMaxTokens, ThinkingMax, ThinkingMaxFallbackMaxTokens, ThinkingOff, allScopes, anthropicResponseTextContent, anthropicResponseThinkingContent, anthropicResponseToolUseBlocks, apiResponseBusinessError, apiResponseGetMessage, asCredentialRef, authorize, bucketInfoIsCommercial, bucketRowIsCommercial, buildBetas, chatBridgeScopes, classifyComplianceError, commerceScopes, completeWebAuthorizationRequest, complianceErrorToRetryAdvice, complianceScopes, computeBackoff, createWebAuthorizationRequest, defaultRetryable, defaultSafeToRetry, discover, discoverWebOAuthMetadata, discoverWithProfile, effectivePolicy, exchangeCode, extractAnthropicBlockMeta, fileLockDefaults, findDesktopVisualUnderstandingModel, findFirstModelByInputModality, generateState, getAdapter, getAdapterForModel, isBillingConfirmable, isChannelInboundEvent, isComplianceBusinessError, isComplianceTerminalError, isIntegrationStatus, isInvalidGrantError, isPlatform, isRegion, isSSECommentLine, isSSLError, isTerminalRemoteEvent, isValidTokenSet, maxEndUserIdLength, modelScopes, modelSupportsImageInput, modelSupportsInputModality, newFileTokenStore, newThinkingConfig, newTokenSet, newWebSearchTool, normalizeGatewayBaseURL, normalizeOverrideBaseURL, parseNotificationEvent, parseRemoteControlEvent, parseSettlement, parseSourcesEvent, refreshToken, register, registerWebOAuthClient, remoteControlScopes, retryReasonForComplianceKey, retryReasonForOAuthError, revokeToken, sanitize_exports as sanitize, skillScopes, tokenSetIsExpired, uniqueMerge, validateEndUserId };
+// src/chatbridge/client.ts
+var chatBridgeByClient = /* @__PURE__ */ new WeakMap();
+Object.defineProperty(Client.prototype, "chatBridge", {
+  configurable: true,
+  enumerable: false,
+  get() {
+    let existing = chatBridgeByClient.get(this);
+    if (!existing) {
+      existing = new ChatBridgeClient(this);
+      chatBridgeByClient.set(this, existing);
+    }
+    return existing;
+  }
+});
+var ChatBridgeClient = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  // ---------------------------------------------------------------------------
+  // Integration 管理面
+  // ---------------------------------------------------------------------------
+  /** 创建平台集成 (chat_bridge:write)。云端控制台与下游 (CrabCode) 调的是同一端点/同一份数据。 */
+  async createIntegration(req, signal) {
+    const resp = await this.client.doJSON(
+      "POST",
+      "/chat-bridge/integrations",
+      {
+        app_id: req.appId,
+        platform: req.platform,
+        region: req.region,
+        workspace_id: req.workspaceId,
+        bot_id: req.botId,
+        config_json: req.configJson
+      },
+      signal
+    );
+    return resp.data;
+  }
+  /** 列出本租户集成 (chat_bridge:read; masked 视图)。可按 appId 过滤。 */
+  async listIntegrations(appId, signal) {
+    const qs = appId ? `?app_id=${encodeURIComponent(appId)}` : "";
+    const resp = await this.client.doJSON(
+      "GET",
+      `/chat-bridge/integrations${qs}`,
+      null,
+      signal
+    );
+    return resp.data?.items ?? [];
+  }
+  /** 取单个集成 (chat_bridge:read)。不存在/跨租户一律 404。 */
+  async getIntegration(id, signal) {
+    const resp = await this.client.doJSON(
+      "GET",
+      `/chat-bridge/integrations/${encodeURIComponent(id)}`,
+      null,
+      signal
+    );
+    return resp.data;
+  }
+  /** 更新集成状态 (chat_bridge:write): pending | active | suspended | revoked。 */
+  async updateIntegrationStatus(id, status, signal) {
+    await this.client.doJSON(
+      "PATCH",
+      `/chat-bridge/integrations/${encodeURIComponent(id)}/status`,
+      { status },
+      signal
+    );
+  }
+  // ---------------------------------------------------------------------------
+  // Credential 管理面 (vault)
+  // ---------------------------------------------------------------------------
+  /** 存凭证 (chat_bridge:write) — 明文一次性提交, 返回 masked 记录 (ref+fingerprint)。 */
+  async storeCredential(integrationId, req, signal) {
+    const resp = await this.client.doJSON(
+      "POST",
+      `/chat-bridge/integrations/${encodeURIComponent(integrationId)}/credentials`,
+      {
+        secret_kind: req.secretKind,
+        plaintext: req.plaintext,
+        region: req.region,
+        platform: req.platform
+      },
+      signal
+    );
+    return brandCredential(resp.data);
+  }
+  /** 列出集成的凭证 (chat_bridge:read; masked, 永不含明文/密文)。 */
+  async listCredentials(integrationId, signal) {
+    const resp = await this.client.doJSON(
+      "GET",
+      `/chat-bridge/integrations/${encodeURIComponent(integrationId)}/credentials`,
+      null,
+      signal
+    );
+    return (resp.data?.items ?? []).map(brandCredential);
+  }
+  /** 轮换凭证 (chat_bridge:rotate, 高风险) — ref 不变, fingerprint 更新。 */
+  async rotateCredential(integrationId, secretKind, newPlaintext, signal) {
+    const resp = await this.client.doJSON(
+      "POST",
+      `/chat-bridge/integrations/${encodeURIComponent(integrationId)}/credentials/rotate`,
+      { secret_kind: secretKind, new_plaintext: newPlaintext },
+      signal
+    );
+    return brandCredential(resp.data);
+  }
+  /** 吊销凭证 (chat_bridge:rotate) — 软吊销 + 服务端抹密文。 */
+  async revokeCredential(credentialRef, signal) {
+    await this.client.doJSON(
+      "POST",
+      `/chat-bridge/credentials/${encodeURIComponent(credentialRef)}/revoke`,
+      {},
+      signal
+    );
+  }
+};
+function brandCredential(c) {
+  if (c && typeof c.credentialRef === "string") {
+    return { ...c, credentialRef: asCredentialRef(c.credentialRef) };
+  }
+  return c;
+}
+
+export { AGENT_RUN_META_TITLE, AGENT_RUN_META_WORKSPACE, ALL_INTEGRATION_STATUS, ALL_PLATFORMS, ALL_REGIONS, AgentRunStreamError, AgentRunsClient, AnthropicAdapter, AudienceEnum, BillingModeEnum, BucketClassCommercial, BucketClassGeneric, BusinessError, ChatBridgeClient, Client, ComplianceClient, CompliancePollError, CrabCodeByokClient, DEFAULT_API_TIMEOUT_MS, DEFAULT_GATEWAY_BASE_URL, DefaultRetryPolicy, ErrAuthDenied, ErrBillingCallbackCannotCommit, ErrBillingCommitRequiresLocalVerify, ErrBillingS2sForbidden, ErrBrowserOpen, ErrComplianceStepUpRequired, ErrDiscovery, ErrEnvelopeGateClosed, ErrOAuthCORSBlocked, ErrProviderNotConfigured, ErrProviderUnknownNoRetry, ErrRefreshProxyFailed, ErrRegistration, ErrSSLProxy, ErrSealApprovalContractHashMismatch, ErrSealApprovalExpired, ErrSealApprovalLocationMismatch, ErrSealApprovalNonceUsed, ErrSealApprovalNotApproved, ErrSealApprovalSealMismatch, ErrSealApprovalTransactorMismatch, ErrSealUseAlreadyConsumed, ErrStateMismatch, ErrTimeout, ErrTokenExchange, ErrTokenExpired, EventAuthURL, EventComplete, EventError, FileTokenStore, FilterStatusAdminBypass, FilterStatusDisabledByFlag, FilterStatusFallbackMissingUser, FilterStatusFallbackNoBuckets, FilterStatusFallbackTkdistError, FilterStatusFallbackTkdistSkew, FilterStatusInternalBypass, FilterStatusOK, FilterStatusUnknown, HTTPError, IdempotencyKeyHeader, InMemoryTokenStore, LocalStorageTokenStore, ModelNotFoundError, NetworkError, OAuthTokenEndpointError, OpenAIAdapter, OrderTerminalError, ProductFamilyEnum, ProviderFormat, RETRY_ADVICE_REASONS, RateLimitError, RegionScopeEnum, ScopeAI, ScopeAccount, ScopeChatBridge, ScopeChatBridgeRead, ScopeChatBridgeRotate, ScopeChatBridgeWrite, ScopeComplianceContractSigningRead, ScopeComplianceContractSigningWrite, ScopeComplianceContractTemplateRead, ScopeComplianceContractTemplateWrite, ScopeComplianceEvidenceRead, ScopeComplianceEvidenceWrite, ScopeComplianceReportsPublish, ScopeComplianceReportsRead, ScopeComplianceReportsWrite, ScopeComplianceSealApprovalApprove, ScopeComplianceSealApprovalRequest, ScopeComplianceSealManage, ScopeComplianceSealUseExecute, ScopeComplianceTimestampIssue, ScopeComplianceTimestampVerify, ScopeEntitlements, ScopeModels, ScopeModelsChat, ScopeProfile, ScopeRemoteControl, ScopeRemoteControlAgentRun, ScopeRemoteControlPermissionResponse, ScopeRemoteControlSessionControl, ScopeSkillStore, ScopeSkills, ScopeTokenPackages, ScopeTools, ScopeToolsExecute, ScopeWallet, ScopeWalletReadonly, ServerToolTypeWebSearch, StreamError, ThinkingHigh, ThinkingHighMinMaxTokens, ThinkingMax, ThinkingMaxFallbackMaxTokens, ThinkingOff, allScopes, anthropicResponseTextContent, anthropicResponseThinkingContent, anthropicResponseToolUseBlocks, apiResponseBusinessError, apiResponseGetMessage, asCredentialRef, authorize, bucketInfoIsCommercial, bucketRowIsCommercial, buildBetas, chatBridgeScopes, classifyComplianceError, commerceScopes, completeWebAuthorizationRequest, complianceErrorToRetryAdvice, complianceScopes, computeBackoff, createWebAuthorizationRequest, defaultRetryable, defaultSafeToRetry, discover, discoverWebOAuthMetadata, discoverWithProfile, effectivePolicy, exchangeCode, extractAnthropicBlockMeta, fileLockDefaults, findDesktopVisualUnderstandingModel, findFirstModelByInputModality, generateState, getAdapter, getAdapterForModel, isBillingConfirmable, isChannelInboundEvent, isComplianceBusinessError, isComplianceTerminalError, isIntegrationStatus, isInvalidGrantError, isPlatform, isRegion, isSSECommentLine, isSSLError, isTerminalRemoteEvent, isValidTokenSet, maxEndUserIdLength, modelScopes, modelSupportsImageInput, modelSupportsInputModality, newFileTokenStore, newThinkingConfig, newTokenSet, newWebSearchTool, normalizeGatewayBaseURL, normalizeOverrideBaseURL, parseNotificationEvent, parseRemoteControlEvent, parseSettlement, parseSourcesEvent, refreshToken, register, registerWebOAuthClient, remoteControlScopes, retryReasonForComplianceKey, retryReasonForOAuthError, revokeToken, sanitize_exports as sanitize, skillScopes, tokenSetIsExpired, uniqueMerge, validateEndUserId };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map