@agent-compose/sdk 0.8.5 → 0.8.7

package/dist/types/api-factory.d.ts

@@ -96,6 +96,18 @@ export interface RegisterWorkflowInput {
     factoryDrive?: "required" | "none";
     /** Factory slug. Defaults to `"default"`. */
     factorySlug?: string;
+    /** Register INTO a project (`agentc register --project`, ADR-0087): the
+     *  workflow, its schedules and its runs are visible to the project's
+     *  members alone, read live, so leaving the project loses them — the
+     *  registrant included (the workflow belongs to the project, with no
+     *  personal owner). Any member with a write or owner seat in the project
+     *  may register into it on a key that holds `invoke`; the `manage` scope
+     *  is not needed. A read seat is refused (403 `role_read_only`); a
+     *  project the registrant cannot see answers 404 exactly as one that does
+     *  not exist. Omitted, a registration from a terminal or an API key is
+     *  the whole space's and takes `manage` (403 `manage_required`
+     *  otherwise). */
+    projectId?: string;
 }
 export interface TemplateRow {
     name: string;
@@ -128,9 +140,10 @@ export interface TemplateDetail {
 export interface ListTemplatesOptions {
     factorySlug?: string;
 }
-/** One team connector grant, as `GET /api/v1/connectors` returns it (wire
- *  shape verbatim — snake_case). The typed subset the SDK pins; additional
- *  fields flow through untyped. */
+/** One connector grant, as `GET /api/v1/connectors` returns it (wire shape
+ *  verbatim — snake_case): the caller's own grants and the workspace's
+ *  GitHub installations, never a teammate's other accounts. The typed
+ *  subset the SDK pins; additional fields flow through untyped. */
 export interface ConnectorGrantSummary {
     id: string;
     provider: string;
@@ -304,6 +317,8 @@ export interface UpdateFactoryInput {
 }
 export interface ScheduleRow {
     id: string;
+    /** The factory the schedule (and the workflow it fires) lives in. */
+    factoryId: string;
     name: string;
     workflowName: string;
     cron: string;
@@ -366,18 +381,68 @@ export type SessionSecretInput = {
  *  single-use page a session writer opens to provide the named values. */
 export interface SessionSecretRequestCreated {
     requestId: string;
-    url: string;
+    /** The single-use link, the owner's to tap. Null on a DEDUPED answer: the
+     *  open ask's link already went out and nothing new exists to send. */
+    url: string | null;
     expiresAt: string;
-    /** True = a standing auto-approve set already filled the request at the
-     *  mint — nothing is pending; source the session env now. */
+    /** True = a standing auto-approve set or this work's grant already filled
+     *  the request at the mint — nothing is pending. */
     autoApproved?: boolean;
+    /** With autoApproved: true = the values are on the session's RUNNING
+     *  machine now (its env file, and its egress ruleset for a brokered key),
+     *  so re-sourcing the session env loads them; false = no machine is
+     *  running or the push failed, and they land when the next turn starts. */
+    loaded?: boolean;
+    /** Set with autoApproved when the grant came from this work's earlier
+     *  worker (the same person's grant, carried with no card): who gave it. */
+    carried?: {
+        grantedByName: string | null;
+    };
+    /** True = an OPEN request of the same kind (or the same key set) already
+     *  stood on this session, and this answer IS that request: no new row, no
+     *  new card, nobody asked again. `keys` are the open request's key names,
+     *  the names the values land under; `note` says what to do. */
+    deduped?: boolean;
+    keys?: string[];
+    kind?: VaultRequestKind | null;
+    note?: string;
+    /** Who holds the ask: the thread's agent (it raises the card once), the
+     *  owner's assistant, or nobody (no owner, no agent). */
+    routedTo?: "agent" | "owner" | null;
+    /** A chat's worker: its card is in the chat, where the work was asked for. */
+    card?: "in the chat";
 }
 /** What KIND of credential a vault request asks for (advisory): the vault
  *  page leads with the user's MATCHING standing entries. */
 export type VaultRequestKind = "login" | "password" | "api_key" | "payment_card" | "env_file" | "note" | "other";
+/** How one requested key is delivered to the session: BROKERED — the egress
+ *  edge adds `headerName: [scheme ]<value>` on requests to `host`, and the
+ *  value never enters the machine; INJECTED — the value lands in the session
+ *  env file. An `api_key` request declares one per key. */
+export type VaultKeyShape = {
+    mode: "brokered";
+    host: string;
+    headerName: string;
+    scheme?: string;
+} | {
+    mode: "injected";
+};
+/** The STANDING entry a request is for, named by its label and/or (a card)
+ *  its last four digits — at least one. The card and the vault page lead
+ *  with that entry, so the person sees which saved credential is meant. */
+export interface RequestedVaultEntry {
+    label?: string;
+    last4?: string;
+}
+/** A saved payment card's receipts: its network (from the number's issuer
+ *  prefix; null when unknown) and its last four. Never more. */
+export interface VaultCardHint {
+    brand: string | null;
+    last4: string;
+}
 /** One STANDING vault entry usable for a session (the catalog read,
- *  2026-08-31) — labels, kinds, and field NAMES only; values are write-only
- *  and never on this wire. */
+ *  2026-08-31) — labels, kinds, identifiers and field NAMES only; values
+ *  are write-only and never on this wire. */
 export interface VaultCatalogEntry {
     label: string;
     kind: string;
@@ -386,6 +451,12 @@ export interface VaultCatalogEntry {
     ownerName: string | null;
     projectName: string | null;
     lastUsedAt: string | null;
+    /** The account the entry belongs to, or a card's network and last four
+     *  ("Amex •••• 1002") — how look-alike labels are told apart. Absent on
+     *  an older server. */
+    identifier?: string | null;
+    /** The card's receipts when the entry is a card; null otherwise. */
+    card?: VaultCardHint | null;
 }
 /** A vault link's polled status. */
 export interface SessionSecretRequestStatus {
@@ -395,7 +466,7 @@ export interface SessionSecretRequestStatus {
     expiresAt: string;
     /** Cancellation attribution (task #111) — present on cancelled rows:
      *  who ended the ask ('human' = denied; 'agent' = withdrawn) and why. */
-    cancelledVia?: "human" | "agent";
+    cancelledVia?: "human" | "agent" | "thread_agent";
     cancelReason?: string | null;
     /** The denying human's display name (best-effort; 'human' via only). */
     deniedByName?: string | null;
@@ -409,12 +480,18 @@ export interface SessionSecretRequestStatus {
 export interface SessionSecretRequestSummary {
     requestId: string;
     keys: string[];
+    /** What kind of credential the ask is for; null when the requester did not say. */
+    kind: VaultRequestKind | null;
     reason: string | null;
     expiresAt: string;
     createdAt: string;
 }
 export interface CreateApiKeyInput {
     name?: string;
+    /** Omitted → `read` alone (the read-only default). Anything more —
+     *  `invoke`, `manage`, `admin` — is chosen explicitly, and the server
+     *  refuses any scope the minter does not hold (403 `scope_not_held`).
+     *  `events:read` / `events:write` are deprecated but still accepted. */
     scopes?: string[];
     expiresAt?: string;
     factorySlug?: string;
@@ -480,6 +557,9 @@ export interface UsageResponse {
  *  app-level (the platform GitHub App's own webhook) or polling — there
  *  is no per-repo webhook setup (retired 2026-08-18). */
 export interface DriveRepoLink {
+    /** Last successful API head read; a deferred attempt does not advance it. */
+    lastHeadObservedAt: string | null;
+    headCheckDeferredUntil: string | null;
     id: string;
     factoryId: string;
     /** Linked directory prefix under the drive root (relative, no slashes
@@ -517,7 +597,16 @@ export interface DriveRepoLink {
     }>;
     lastSyncedGitSha: string | null;
     lastSyncedAcgCommit: string | null;
-    syncState: "idle" | "syncing" | "pushing" | "error" | "conflict" | "diverged" | "reauth_required";
+    /** 'queued': the branch's first sync (or a full re-ingest) is waiting in
+     *  the ingest queue; `ingestPriority` / `ingestQueueAhead` say where. */
+    syncState: "idle" | "queued" | "syncing" | "pushing" | "error" | "conflict" | "diverged" | "reauth_required";
+    /** Drain tier while queued (0 foreground, 1 active, 2 background). */
+    ingestPriority: number | null;
+    ingestQueuedAt: string | null;
+    /** When a runner started this branch's ingest; null when none runs. */
+    ingestClaimedAt: string | null;
+    /** Queued branches of the same repo ahead of this one (list only). */
+    ingestQueueAhead?: number | null;
     /** Human-readable detail when syncState is 'error' or 'conflict'. */
     syncError: string | null;
     createdBy: string | null;