@agentstep/agent-sdk 0.5.35 → 0.5.37

package/dist/{chunk-75US4UAE.js → chunk-2E43SH4Y.js}

@@ -15,7 +15,7 @@ import {
   jsonOk,
   paginatedOk,
   routeWrap
-} from "./chunk-4EKHW6VS.js";
+} from "./chunk-RMCBO7K7.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-QZE37OGX.js → chunk-2HTAIROL.js}

@@ -1,7 +1,7 @@
 import {
   jsonOk,
   routeWrap
-} from "./chunk-4EKHW6VS.js";
+} from "./chunk-RMCBO7K7.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-SAI6LBXW.js → chunk-2HVY2WZL.js}

@@ -127,6 +127,10 @@ var AgentSchema = registry.register(
     skills: z.array(AgentSkillSchema).openapi({
       description: "Skills injected into the container at session start. For Claude backend, written to .claude/skills/<name>/SKILL.md. For all backends, also written to .agents/skills/<name>/SKILL.md. Non-Claude backends also receive skills prepended to the system prompt."
     }),
+    permission_policy: z.object({
+      always_allow: z.array(z.string()).optional(),
+      always_ask: z.array(z.string()).optional()
+    }).nullable().optional().openapi({ description: "Per-tool permission control." }),
     model_config: ModelConfigSchema.openapi({
       description: "Model configuration options. 'fast' speed enables fast mode on Claude (claude engine only)."
     }),
@@ -139,7 +143,10 @@ var CreateAgentRequestSchema = registry.register(
   "CreateAgentRequest",
   z.object({
     name: z.string().min(1).openapi({ example: "my-agent" }),
-    model: z.object({ id: z.string().min(1), speed: z.enum(["standard", "fast"]).optional() }).openapi({ description: "Model configuration. `id` is the bare model identifier (e.g. `gemini-2.5-flash`, `claude-sonnet-4-6`, `gpt-5.4`). Do not include provider prefixes.", example: { id: "claude-sonnet-4-6" } }),
+    model: z.union([
+      z.string().openapi({ example: "claude-sonnet-4-6" }),
+      z.object({ id: z.string().min(1), speed: z.enum(["standard", "fast"]).optional() }).openapi({ example: { id: "claude-sonnet-4-6" } })
+    ]).openapi({ description: 'Model identifier \u2014 either a bare string (`"claude-sonnet-4-6"`) or an object (`{id, speed?}`). Do not include provider prefixes.' }),
     description: z.string().max(2048).optional().openapi({
       description: "Human-readable description of the agent."
     }),
@@ -362,6 +369,7 @@ var SessionSchema = registry.register(
     vault_ids: z.array(z.string()).nullable().openapi({
       description: "Vault IDs whose entries are injected as environment variables."
     }),
+    user_profile_id: z.string().nullable().optional().openapi({ description: "User profile ID for credential scoping." }),
     parent_session_id: z.string().nullable().openapi({
       description: "Parent session ID if this is a child thread session."
     }),
@@ -397,7 +405,17 @@ var CreateSessionRequestSchema = registry.register(
       uri: z.string().optional(),
       content: z.string().optional()
     })).optional(),
-    vault_ids: z.array(z.string()).optional()
+    vault_ids: z.array(z.string()).optional(),
+    user_profile_id: z.string().optional().openapi({ description: "Links session to a user profile for per-user credential scoping." }),
+    outcomes: z.object({
+      description: z.string(),
+      rubric: z.array(z.object({
+        name: z.string(),
+        description: z.string(),
+        weight: z.number().optional()
+      })).optional(),
+      max_iterations: z.number().int().optional()
+    }).optional().openapi({ description: "Success criteria with optional rubric for self-evaluation." })
   }).openapi({
     example: {
       agent: "agent_01ABCDEFG...",
@@ -583,7 +601,9 @@ var BatchResponseSchema = registry.register(
 function listEnvelope(name, item) {
   const schema = z.object({
     data: z.array(item),
-    next_page: z.string().nullable()
+    has_more: z.boolean(),
+    first_id: z.string().nullable(),
+    last_id: z.string().nullable()
   });
   return registry.register(name, schema);
 }
@@ -602,6 +622,49 @@ var VaultEntryListResponseSchema = registry.register(
   "VaultEntryListResponse",
   z.object({ data: z.array(VaultEntrySchema) })
 );
+var TrustGrantSchema = registry.register("TrustGrant", z.object({
+  type: z.literal("vault_credential"),
+  vault_id: z.string(),
+  credential_id: z.string()
+}));
+var UserProfileSchema = registry.register("UserProfile", z.object({
+  type: z.literal("user_profile"),
+  id: z.string(),
+  external_id: z.string().nullable(),
+  display_name: z.string().nullable(),
+  trust_grants: z.array(TrustGrantSchema),
+  created_at: z.string(),
+  updated_at: z.string()
+}));
+var UserProfileCreateSchema = registry.register("UserProfileCreate", z.object({
+  external_id: z.string().optional(),
+  display_name: z.string().optional(),
+  trust_grants: z.array(TrustGrantSchema).optional()
+}));
+var UserProfileUpdateSchema = registry.register("UserProfileUpdate", z.object({
+  external_id: z.string().nullish(),
+  display_name: z.string().nullish(),
+  trust_grants: z.array(TrustGrantSchema).optional()
+}));
+var UserProfileListSchema = listEnvelope("UserProfileList", UserProfileSchema);
+var EnrollmentUrlRequestSchema = registry.register("EnrollmentUrlRequest", z.object({
+  vault_id: z.string(),
+  credential_id: z.string().optional(),
+  display_name: z.string().optional(),
+  authorize_url: z.string(),
+  token_endpoint: z.string(),
+  client_id: z.string(),
+  client_secret: z.string().optional(),
+  scope: z.string().optional(),
+  redirect_uri: z.string().optional()
+}));
+var EnrollmentUrlResponseSchema = registry.register("EnrollmentUrlResponse", z.object({
+  type: z.literal("enrollment_url"),
+  url: z.string(),
+  state: z.string(),
+  redirect_uri: z.string(),
+  expires_in: z.number()
+}));
 var AgentDeletedResponseSchema = registry.register(
   "AgentDeletedResponse",
   z.object({ id: UlidId, type: z.literal("agent_deleted") })
@@ -641,7 +704,9 @@ var FileListResponseSchema = registry.register(
   "FileListResponse",
   z.object({
     data: z.array(FileRecordSchema),
-    next_page: z.string().nullable().openapi({ description: "Opaque cursor for the next page, or null if no more results." })
+    has_more: z.boolean().openapi({ description: "Whether more results exist beyond this page." }),
+    first_id: z.string().nullable().openapi({ description: "ID of the first item in this page." }),
+    last_id: z.string().nullable().openapi({ description: "ID of the last item in this page. Pass as after_id for the next page." })
   })
 );
 var FileDeletedResponseSchema = registry.register(
@@ -954,7 +1019,9 @@ var AuditListResponseSchema = registry.register(
   "AuditListResponse",
   z.object({
     data: z.array(AuditEntrySchema),
-    next_page: z.string().nullable()
+    has_more: z.boolean(),
+    first_id: z.string().nullable(),
+    last_id: z.string().nullable()
   })
 );
 var TraceListItemSchema = registry.register(
@@ -1191,6 +1258,13 @@ export {
   EventListResponseSchema,
   VaultListResponseSchema,
   VaultEntryListResponseSchema,
+  TrustGrantSchema,
+  UserProfileSchema,
+  UserProfileCreateSchema,
+  UserProfileUpdateSchema,
+  UserProfileListSchema,
+  EnrollmentUrlRequestSchema,
+  EnrollmentUrlResponseSchema,
   AgentDeletedResponseSchema,
   SessionDeletedResponseSchema,
   EnvironmentDeletedResponseSchema,

package/dist/{chunk-ZHEE6UTX.js → chunk-2YZUXJAN.js}

@@ -6,7 +6,7 @@ import {
   jsonOk,
   paginatedOk,
   routeWrap
-} from "./chunk-4EKHW6VS.js";
+} from "./chunk-RMCBO7K7.js";
 import {
   createUserProfile,
   getUserProfile,

package/dist/{chunk-GABMXDZZ.js → chunk-2Z4T32WO.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-JF777FWD.js";
 import {
   runTurn
-} from "./chunk-KYKVHH7I.js";
+} from "./chunk-YAJJ7KHX.js";
 
 // src/workers/runner.ts
 async function startWorker(opts) {

package/dist/{chunk-SUEPFZN2.js → chunk-3CDJ2VQN.js}

@@ -1,7 +1,7 @@
 import {
   jsonOk,
   routeWrap
-} from "./chunk-4EKHW6VS.js";
+} from "./chunk-RMCBO7K7.js";
 
 // src/handlers/whoami.ts
 function handleWhoami(request) {

package/dist/{chunk-XXAO5YYL.js → chunk-3IO3EGWP.js}

@@ -10,7 +10,7 @@ import {
 import {
   jsonOk,
   routeWrap
-} from "./chunk-4EKHW6VS.js";
+} from "./chunk-RMCBO7K7.js";
 import {
   archiveTenant,
   createTenant,

package/dist/{chunk-HHLVVJGT.js → chunk-3RK6EX7J.js}

@@ -5,7 +5,7 @@ import {
 import {
   jsonOk,
   routeWrap
-} from "./chunk-4EKHW6VS.js";
+} from "./chunk-RMCBO7K7.js";
 import {
   badRequest
 } from "./chunk-EZYKRG4W.js";

package/dist/{chunk-3LYNN5VT.js → chunk-3WPVSQGI.js}

@@ -15,7 +15,7 @@ import {
 import {
   jsonOk,
   routeWrap
-} from "./chunk-4EKHW6VS.js";
+} from "./chunk-RMCBO7K7.js";
 import {
   createApiKey,
   getApiKeyById,