npm - @acosmi/sdk-ts - Versions diffs - 2.6.0 → 2.8.0 - Mend

@acosmi/sdk-ts 2.6.0 → 2.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (14) hide show

package/CHANGELOG.md +20 -0
package/README.md +74 -11
package/dist/browser/index.mjs +328 -6
package/dist/browser/index.mjs.map +1 -1
package/dist/index.mjs +328 -6
package/dist/index.mjs.map +1 -1
package/dist/node/index.cjs +331 -5
package/dist/node/index.cjs.map +1 -1
package/dist/node/index.d.cts +243 -3
package/dist/node/index.d.ts +243 -3
package/dist/node/index.mjs +328 -6
package/dist/node/index.mjs.map +1 -1
package/docs//345/274/200/345/217/221/344/270/216/345/217/221/345/270/203/346/211/213/345/206/214.md +6 -4
package/package.json +1 -1

package/dist/node/index.cjs CHANGED Viewed

@@ -1261,10 +1261,17 @@ async function authorize(meta, clientID, scopes, opts = {}) {
       codeRejecter(new Error(`authorization denied: ${errMsg}`));
       return;
     }
-    res.setHeader("Content-Type", "text/html; charset=utf-8");
-    res.end(
-      `<!DOCTYPE html><html><head><meta charset="utf-8"><title>\u6388\u6743\u6210\u529F</title></head><body style="font-family:system-ui,sans-serif;text-align:center;padding:60px 20px"><h2>\u6388\u6743\u6210\u529F</h2><p>\u5DF2\u5B8C\u6210\u8EAB\u4EFD\u8BA4\u8BC1, \u8BF7\u8FD4\u56DE\u5E94\u7528\u7EE7\u7EED\u4F7F\u7528\u3002</p><p style="color:#888;font-size:14px">\u6B64\u7A97\u53E3\u5C06\u5728 3 \u79D2\u540E\u81EA\u52A8\u5173\u95ED\u2026</p><script>setTimeout(function(){window.close()},3000)</script></body></html>`
-    );
+    const successRedirect = resolveSuccessRedirect(opts.successRedirectURL);
+    if (successRedirect) {
+      res.statusCode = 302;
+      res.setHeader("Location", successRedirect);
+      res.end();
+    } else {
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      res.end(
+        `<!DOCTYPE html><html><head><meta charset="utf-8"><title>\u6388\u6743\u6210\u529F</title></head><body style="font-family:system-ui,sans-serif;text-align:center;padding:60px 20px"><h2>\u6388\u6743\u6210\u529F</h2><p>\u5DF2\u5B8C\u6210\u8EAB\u4EFD\u8BA4\u8BC1, \u8BF7\u8FD4\u56DE\u5E94\u7528\u7EE7\u7EED\u4F7F\u7528\u3002</p><p style="color:#888;font-size:14px">\u6B64\u7A97\u53E3\u5C06\u5728 3 \u79D2\u540E\u81EA\u52A8\u5173\u95ED\u2026</p><script>setTimeout(function(){window.close()},3000)</script></body></html>`
+      );
+    }
     codeResolver(code);
   });
   const authURL = new URL(meta.authorization_endpoint);
@@ -1326,6 +1333,16 @@ async function authorize(meta, clientID, scopes, opts = {}) {
 function htmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+function resolveSuccessRedirect(raw) {
+  if (!raw) return null;
+  try {
+    const u = new URL(raw);
+    if (u.protocol !== "http:" && u.protocol !== "https:") return null;
+    return u.toString();
+  } catch {
+    return null;
+  }
+}
 async function createWebAuthorizationRequest(meta, opts) {
   const verifier = await generateCodeVerifier();
   const challenge = await codeChallenge(verifier);
@@ -4765,6 +4782,8 @@ async function sleepWithSignal2(ms, signal) {
 }
 // src/agent-runs/types.ts
+var AGENT_RUN_META_TITLE = "title";
+var AGENT_RUN_META_WORKSPACE = "workspace";
 var AgentRunStreamError = class extends Error {
   event;
   code;
@@ -4940,6 +4959,33 @@ var AgentRunsClient = class {
     );
     return fromWireCreateResponse(resp);
   }
+  /**
+   * List the caller's own agent runs, newest first (GET /agent-runs, Phase 5C
+   * console). Returns view metadata only — never session tokens, policies or
+   * messages (contract §6). Filter remote-control runs with
+   * `{ runtime: 'crabcode_remote' }`.
+   */
+  async list(opts = {}, signal) {
+    const params = new URLSearchParams();
+    if (opts.runtime) params.set("runtime", opts.runtime);
+    if (opts.status) params.set("status", opts.status);
+    if (opts.page != null) params.set("page", String(opts.page));
+    if (opts.pageSize != null) params.set("page_size", String(opts.pageSize));
+    const qs = params.toString();
+    const resp = await this.requestAPI(
+      "GET",
+      `/agent-runs${qs ? `?${qs}` : ""}`,
+      null,
+      signal,
+      { retryOn401: true }
+    );
+    return {
+      records: (resp.records ?? []).map(fromWireRun),
+      total: typeof resp.total === "number" ? resp.total : 0,
+      page: typeof resp.page === "number" ? resp.page : 1,
+      pageSize: typeof resp.pageSize === "number" ? resp.pageSize : 20
+    };
+  }
   get(runId, signal) {
     return this.requestAPI(
       "GET",
@@ -5001,6 +5047,73 @@ var AgentRunsClient = class {
       [Symbol.asyncIterator]: () => this.streamRemoteControlGen(runId, signal)
     };
   }
+  /**
+   * Submit a permission decision for a pending `permission_request` event
+   * (POST /agent-runs/:runId/permission-results, contract §4/§9/§14).
+   *
+   * Only `approved` | `rejected` may be submitted by clients — `timeout` /
+   * `cancelled` are produced server-side. Requires an OAuth token with the
+   * explicit `remote_control` scope (or a web JWT). 409 means the remote
+   * session is gone (e.g. already terminated).
+   */
+  async submitPermissionResult(runId, result, signal) {
+    await this.requestAPI(
+      "POST",
+      `/agent-runs/${encodeURIComponent(runId)}/permission-results`,
+      {
+        request_id: result.requestId,
+        decision: result.decision,
+        reason: result.reason
+      },
+      signal,
+      { retryOn401: false }
+    );
+  }
+  /**
+   * Append a mid-session user message to a remote run
+   * (POST /agent-runs/:runId/messages, Phase 5C). The message role is
+   * hard-coded to 'user' server-side (contract §6 #5 prompt-injection
+   * defence); content is limited to 64KB. Requires the explicit
+   * `remote_control` scope (or a web JWT).
+   */
+  async submitUserMessage(runId, message, signal) {
+    const resp = await this.requestAPI(
+      "POST",
+      `/agent-runs/${encodeURIComponent(runId)}/messages`,
+      { request_id: message.requestId, content: message.content },
+      signal,
+      { retryOn401: false }
+    );
+    return {
+      ok: resp?.ok === true,
+      requestId: resp?.request_id ?? message.requestId ?? ""
+    };
+  }
+  /**
+   * Reveal the one-shot remote session token for a desktop-runner run
+   * (POST /agent-runs/:runId/remote-token, Phase 5B; contract §18.1).
+   *
+   * Desktop launcher only: the token is single-consumption (a second call
+   * returns 409) and must never touch browser storage — receive it in the
+   * native layer and inject it into the CrabCode child-process env only
+   * (contract §6). Cloud / local_embedded runners never expose tokens over
+   * HTTP (403). Requires the explicit `remote_control` scope.
+   */
+  async revealRemoteToken(runId, signal) {
+    const resp = await this.requestAPI(
+      "POST",
+      `/agent-runs/${encodeURIComponent(runId)}/remote-token`,
+      {},
+      signal,
+      { retryOn401: false }
+    );
+    return {
+      accessToken: resp?.access_token ?? "",
+      sessionUrl: resp?.session_url ?? "",
+      tenantId: resp?.tenant_id ?? "",
+      workspace: resp?.workspace || void 0
+    };
+  }
   async *streamRemoteControlGen(runId, signal) {
     const resp = await this.requestRaw(
       "GET",
@@ -5251,6 +5364,7 @@ function toWireCreateRequest(req) {
     adapter: req.adapter,
     permission_policy: req.permissionPolicy ? toWirePermissionPolicy(req.permissionPolicy) : void 0,
     workspace_policy: req.workspacePolicy ? toWireWorkspacePolicy(req.workspacePolicy) : void 0,
+    byok_credential_ref: req.byokCredentialRef,
     artifact_policy: req.artifactPolicy ? {
       enabled: req.artifactPolicy.enabled,
       max_files: req.artifactPolicy.maxFiles
@@ -5283,7 +5397,10 @@ function fromWireRun(resp) {
     startedAt: resp.started_at,
     completedAt: resp.completed_at,
     error: normalizeError(resp.error),
-    metadata: resp.metadata
+    metadata: resp.metadata,
+    runtime: resp.runtime,
+    runner: resp.runner,
+    adapter: resp.adapter
   };
 }
 function fromWireArtifact(resp) {
@@ -5541,6 +5658,87 @@ function errorMessage(e) {
   return e instanceof Error ? e.message : String(e);
 }
+// src/agent-runs/byok.ts
+function fromWireByok(v) {
+  return {
+    credentialRef: v.credential_ref ?? "",
+    provider: v.provider ?? "",
+    name: v.name || void 0,
+    baseUrl: v.base_url || void 0,
+    fingerprint: v.fingerprint || void 0,
+    status: v.status ?? "",
+    createdAt: v.created_at || void 0,
+    lastUsedAt: v.last_used_at || void 0
+  };
+}
+var byokByClient = /* @__PURE__ */ new WeakMap();
+Object.defineProperty(Client.prototype, "crabcodeByok", {
+  configurable: true,
+  enumerable: false,
+  get() {
+    let existing = byokByClient.get(this);
+    if (!existing) {
+      existing = new CrabCodeByokClient(this);
+      byokByClient.set(this, existing);
+    }
+    return existing;
+  }
+});
+var CrabCodeByokClient = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** 列出调用者自己的密钥 (masked; 新→旧, 服务端上限 100 条)。 */
+  async list(signal) {
+    const resp = await this.client.doJSON(
+      "GET",
+      "/crabcode/byok-credentials",
+      null,
+      signal
+    );
+    return (resp.data?.items ?? []).map(fromWireByok);
+  }
+  /**
+   * 创建密钥 — 明文一次性提交, 返回 masked 视图。
+   * 单用户上限 20 把; provider='custom' 必须带 https:// baseUrl。
+   */
+  async create(req, signal) {
+    const resp = await this.client.doJSON(
+      "POST",
+      "/crabcode/byok-credentials",
+      {
+        provider: req.provider,
+        name: req.name,
+        base_url: req.baseUrl,
+        plaintext: req.plaintext
+      },
+      signal
+    );
+    return fromWireByok(resp.data ?? {});
+  }
+  /** 轮换密钥明文 — credentialRef 不变, fingerprint 更新。已吊销的密钥不可轮换 (400)。 */
+  async rotate(credentialRef, newPlaintext, signal) {
+    const resp = await this.client.doJSON(
+      "POST",
+      `/crabcode/byok-credentials/${encodeURIComponent(credentialRef)}/rotate`,
+      { new_plaintext: newPlaintext },
+      signal
+    );
+    return fromWireByok(resp.data ?? {});
+  }
+  /** 吊销密钥 (软状态 + 服务端抹密文, 不可恢复; 幂等 — 重复吊销返回当前视图)。 */
+  async revoke(credentialRef, signal) {
+    const resp = await this.client.doJSON(
+      "POST",
+      `/crabcode/byok-credentials/${encodeURIComponent(credentialRef)}/revoke`,
+      {},
+      signal
+    );
+    return fromWireByok(resp.data ?? {});
+  }
+};
 // src/compliance/scopes.ts
 var ScopeComplianceEvidenceRead = "compliance:evidence:read";
 var ScopeComplianceEvidenceWrite = "compliance:evidence:write";
@@ -7194,6 +7392,132 @@ function asCredentialRef(s) {
   return s;
 }
+// src/chatbridge/client.ts
+var chatBridgeByClient = /* @__PURE__ */ new WeakMap();
+Object.defineProperty(Client.prototype, "chatBridge", {
+  configurable: true,
+  enumerable: false,
+  get() {
+    let existing = chatBridgeByClient.get(this);
+    if (!existing) {
+      existing = new ChatBridgeClient(this);
+      chatBridgeByClient.set(this, existing);
+    }
+    return existing;
+  }
+});
+var ChatBridgeClient = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  // ---------------------------------------------------------------------------
+  // Integration 管理面
+  // ---------------------------------------------------------------------------
+  /** 创建平台集成 (chat_bridge:write)。云端控制台与下游 (CrabCode) 调的是同一端点/同一份数据。 */
+  async createIntegration(req, signal) {
+    const resp = await this.client.doJSON(
+      "POST",
+      "/chat-bridge/integrations",
+      {
+        app_id: req.appId,
+        platform: req.platform,
+        region: req.region,
+        workspace_id: req.workspaceId,
+        bot_id: req.botId,
+        config_json: req.configJson
+      },
+      signal
+    );
+    return resp.data;
+  }
+  /** 列出本租户集成 (chat_bridge:read; masked 视图)。可按 appId 过滤。 */
+  async listIntegrations(appId, signal) {
+    const qs = appId ? `?app_id=${encodeURIComponent(appId)}` : "";
+    const resp = await this.client.doJSON(
+      "GET",
+      `/chat-bridge/integrations${qs}`,
+      null,
+      signal
+    );
+    return resp.data?.items ?? [];
+  }
+  /** 取单个集成 (chat_bridge:read)。不存在/跨租户一律 404。 */
+  async getIntegration(id, signal) {
+    const resp = await this.client.doJSON(
+      "GET",
+      `/chat-bridge/integrations/${encodeURIComponent(id)}`,
+      null,
+      signal
+    );
+    return resp.data;
+  }
+  /** 更新集成状态 (chat_bridge:write): pending | active | suspended | revoked。 */
+  async updateIntegrationStatus(id, status, signal) {
+    await this.client.doJSON(
+      "PATCH",
+      `/chat-bridge/integrations/${encodeURIComponent(id)}/status`,
+      { status },
+      signal
+    );
+  }
+  // ---------------------------------------------------------------------------
+  // Credential 管理面 (vault)
+  // ---------------------------------------------------------------------------
+  /** 存凭证 (chat_bridge:write) — 明文一次性提交, 返回 masked 记录 (ref+fingerprint)。 */
+  async storeCredential(integrationId, req, signal) {
+    const resp = await this.client.doJSON(
+      "POST",
+      `/chat-bridge/integrations/${encodeURIComponent(integrationId)}/credentials`,
+      {
+        secret_kind: req.secretKind,
+        plaintext: req.plaintext,
+        region: req.region,
+        platform: req.platform
+      },
+      signal
+    );
+    return brandCredential(resp.data);
+  }
+  /** 列出集成的凭证 (chat_bridge:read; masked, 永不含明文/密文)。 */
+  async listCredentials(integrationId, signal) {
+    const resp = await this.client.doJSON(
+      "GET",
+      `/chat-bridge/integrations/${encodeURIComponent(integrationId)}/credentials`,
+      null,
+      signal
+    );
+    return (resp.data?.items ?? []).map(brandCredential);
+  }
+  /** 轮换凭证 (chat_bridge:rotate, 高风险) — ref 不变, fingerprint 更新。 */
+  async rotateCredential(integrationId, secretKind, newPlaintext, signal) {
+    const resp = await this.client.doJSON(
+      "POST",
+      `/chat-bridge/integrations/${encodeURIComponent(integrationId)}/credentials/rotate`,
+      { secret_kind: secretKind, new_plaintext: newPlaintext },
+      signal
+    );
+    return brandCredential(resp.data);
+  }
+  /** 吊销凭证 (chat_bridge:rotate) — 软吊销 + 服务端抹密文。 */
+  async revokeCredential(credentialRef, signal) {
+    await this.client.doJSON(
+      "POST",
+      `/chat-bridge/credentials/${encodeURIComponent(credentialRef)}/revoke`,
+      {},
+      signal
+    );
+  }
+};
+function brandCredential(c) {
+  if (c && typeof c.credentialRef === "string") {
+    return { ...c, credentialRef: asCredentialRef(c.credentialRef) };
+  }
+  return c;
+}
+exports.AGENT_RUN_META_TITLE = AGENT_RUN_META_TITLE;
+exports.AGENT_RUN_META_WORKSPACE = AGENT_RUN_META_WORKSPACE;
 exports.ALL_INTEGRATION_STATUS = ALL_INTEGRATION_STATUS;
 exports.ALL_PLATFORMS = ALL_PLATFORMS;
 exports.ALL_REGIONS = ALL_REGIONS;
@@ -7201,9 +7525,11 @@ exports.AgentRunStreamError = AgentRunStreamError;
 exports.AgentRunsClient = AgentRunsClient;
 exports.AudienceEnum = AudienceEnum;
 exports.BillingModeEnum = BillingModeEnum;
+exports.ChatBridgeClient = ChatBridgeClient;
 exports.Client = Client;
 exports.ComplianceClient = ComplianceClient;
 exports.CompliancePollError = CompliancePollError;
+exports.CrabCodeByokClient = CrabCodeByokClient;
 exports.DEFAULT_API_TIMEOUT_MS = DEFAULT_API_TIMEOUT_MS;
 exports.DEFAULT_GATEWAY_BASE_URL = DEFAULT_GATEWAY_BASE_URL;
 exports.DefaultRetryPolicy = DefaultRetryPolicy;