@anthropic-ai/sdk 0.93.0 → 0.95.0

package/src/internal/qs/types.ts

@@ -0,0 +1,71 @@
+export type Format = 'RFC1738' | 'RFC3986';
+
+export type DefaultEncoder = (str: any, defaultEncoder?: any, charset?: string) => string;
+export type DefaultDecoder = (str: string, decoder?: any, charset?: string) => string;
+
+export type BooleanOptional = boolean | undefined;
+
+export type StringifyBaseOptions = {
+  delimiter?: string;
+  allowDots?: boolean;
+  encodeDotInKeys?: boolean;
+  strictNullHandling?: boolean;
+  skipNulls?: boolean;
+  encode?: boolean;
+  encoder?: (
+    str: any,
+    defaultEncoder: DefaultEncoder,
+    charset: string,
+    type: 'key' | 'value',
+    format?: Format,
+  ) => string;
+  filter?: Array<PropertyKey> | ((prefix: PropertyKey, value: any) => any);
+  arrayFormat?: 'indices' | 'brackets' | 'repeat' | 'comma';
+  indices?: boolean;
+  sort?: ((a: PropertyKey, b: PropertyKey) => number) | null;
+  serializeDate?: (d: Date) => string;
+  format?: 'RFC1738' | 'RFC3986';
+  formatter?: (str: PropertyKey) => string;
+  encodeValuesOnly?: boolean;
+  addQueryPrefix?: boolean;
+  charset?: 'utf-8' | 'iso-8859-1';
+  charsetSentinel?: boolean;
+  allowEmptyArrays?: boolean;
+  commaRoundTrip?: boolean;
+};
+
+export type StringifyOptions = StringifyBaseOptions;
+
+export type ParseBaseOptions = {
+  comma?: boolean;
+  delimiter?: string | RegExp;
+  depth?: number | false;
+  decoder?: (str: string, defaultDecoder: DefaultDecoder, charset: string, type: 'key' | 'value') => any;
+  arrayLimit?: number;
+  parseArrays?: boolean;
+  plainObjects?: boolean;
+  allowPrototypes?: boolean;
+  allowSparse?: boolean;
+  parameterLimit?: number;
+  strictDepth?: boolean;
+  strictNullHandling?: boolean;
+  ignoreQueryPrefix?: boolean;
+  charset?: 'utf-8' | 'iso-8859-1';
+  charsetSentinel?: boolean;
+  interpretNumericEntities?: boolean;
+  allowEmptyArrays?: boolean;
+  duplicates?: 'combine' | 'first' | 'last';
+  allowDots?: boolean;
+  decodeDotInKeys?: boolean;
+};
+
+export type ParseOptions = ParseBaseOptions;
+
+export type ParsedQs = {
+  [key: string]: undefined | string | string[] | ParsedQs | ParsedQs[];
+};
+
+// Type to remove null or undefined union from each property
+export type NonNullableProperties<T> = {
+  [K in keyof T]-?: Exclude<T[K], undefined | null>;
+};

package/src/internal/qs/utils.ts

@@ -0,0 +1,265 @@
+import { RFC1738 } from './formats';
+import type { DefaultEncoder, Format } from './types';
+import { isArray } from '../utils/values';
+
+export let has = (obj: object, key: PropertyKey): boolean => (
+  (has = (Object as any).hasOwn ?? Function.prototype.call.bind(Object.prototype.hasOwnProperty)),
+  has(obj, key)
+);
+
+const hex_table = /* @__PURE__ */ (() => {
+  const array = [];
+  for (let i = 0; i < 256; ++i) {
+    array.push('%' + ((i < 16 ? '0' : '') + i.toString(16)).toUpperCase());
+  }
+
+  return array;
+})();
+
+function compact_queue<T extends Record<string, any>>(queue: Array<{ obj: T; prop: string }>) {
+  while (queue.length > 1) {
+    const item = queue.pop();
+    if (!item) continue;
+
+    const obj = item.obj[item.prop];
+
+    if (isArray(obj)) {
+      const compacted: unknown[] = [];
+
+      for (let j = 0; j < obj.length; ++j) {
+        if (typeof obj[j] !== 'undefined') {
+          compacted.push(obj[j]);
+        }
+      }
+
+      // @ts-ignore
+      item.obj[item.prop] = compacted;
+    }
+  }
+}
+
+function array_to_object(source: any[], options: { plainObjects: boolean }) {
+  const obj = options && options.plainObjects ? Object.create(null) : {};
+  for (let i = 0; i < source.length; ++i) {
+    if (typeof source[i] !== 'undefined') {
+      obj[i] = source[i];
+    }
+  }
+
+  return obj;
+}
+
+export function merge(
+  target: any,
+  source: any,
+  options: { plainObjects?: boolean; allowPrototypes?: boolean } = {},
+) {
+  if (!source) {
+    return target;
+  }
+
+  if (typeof source !== 'object') {
+    if (isArray(target)) {
+      target.push(source);
+    } else if (target && typeof target === 'object') {
+      if ((options && (options.plainObjects || options.allowPrototypes)) || !has(Object.prototype, source)) {
+        target[source] = true;
+      }
+    } else {
+      return [target, source];
+    }
+
+    return target;
+  }
+
+  if (!target || typeof target !== 'object') {
+    return [target].concat(source);
+  }
+
+  let mergeTarget = target;
+  if (isArray(target) && !isArray(source)) {
+    // @ts-ignore
+    mergeTarget = array_to_object(target, options);
+  }
+
+  if (isArray(target) && isArray(source)) {
+    source.forEach(function (item, i) {
+      if (has(target, i)) {
+        const targetItem = target[i];
+        if (targetItem && typeof targetItem === 'object' && item && typeof item === 'object') {
+          target[i] = merge(targetItem, item, options);
+        } else {
+          target.push(item);
+        }
+      } else {
+        target[i] = item;
+      }
+    });
+    return target;
+  }
+
+  return Object.keys(source).reduce(function (acc, key) {
+    const value = source[key];
+
+    if (has(acc, key)) {
+      acc[key] = merge(acc[key], value, options);
+    } else {
+      acc[key] = value;
+    }
+    return acc;
+  }, mergeTarget);
+}
+
+export function assign_single_source(target: any, source: any) {
+  return Object.keys(source).reduce(function (acc, key) {
+    acc[key] = source[key];
+    return acc;
+  }, target);
+}
+
+export function decode(str: string, _: any, charset: string) {
+  const strWithoutPlus = str.replace(/\+/g, ' ');
+  if (charset === 'iso-8859-1') {
+    // unescape never throws, no try...catch needed:
+    return strWithoutPlus.replace(/%[0-9a-f]{2}/gi, unescape);
+  }
+  // utf-8
+  try {
+    return decodeURIComponent(strWithoutPlus);
+  } catch (e) {
+    return strWithoutPlus;
+  }
+}
+
+const limit = 1024;
+
+export const encode: (
+  str: any,
+  defaultEncoder: DefaultEncoder,
+  charset: string,
+  type: 'key' | 'value',
+  format: Format,
+) => string = (str, _defaultEncoder, charset, _kind, format: Format) => {
+  // This code was originally written by Brian White for the io.js core querystring library.
+  // It has been adapted here for stricter adherence to RFC 3986
+  if (str.length === 0) {
+    return str;
+  }
+
+  let string = str;
+  if (typeof str === 'symbol') {
+    string = Symbol.prototype.toString.call(str);
+  } else if (typeof str !== 'string') {
+    string = String(str);
+  }
+
+  if (charset === 'iso-8859-1') {
+    return escape(string).replace(/%u[0-9a-f]{4}/gi, function ($0) {
+      return '%26%23' + parseInt($0.slice(2), 16) + '%3B';
+    });
+  }
+
+  let out = '';
+  for (let j = 0; j < string.length; j += limit) {
+    const segment = string.length >= limit ? string.slice(j, j + limit) : string;
+    const arr = [];
+
+    for (let i = 0; i < segment.length; ++i) {
+      let c = segment.charCodeAt(i);
+      if (
+        c === 0x2d || // -
+        c === 0x2e || // .
+        c === 0x5f || // _
+        c === 0x7e || // ~
+        (c >= 0x30 && c <= 0x39) || // 0-9
+        (c >= 0x41 && c <= 0x5a) || // a-z
+        (c >= 0x61 && c <= 0x7a) || // A-Z
+        (format === RFC1738 && (c === 0x28 || c === 0x29)) // ( )
+      ) {
+        arr[arr.length] = segment.charAt(i);
+        continue;
+      }
+
+      if (c < 0x80) {
+        arr[arr.length] = hex_table[c];
+        continue;
+      }
+
+      if (c < 0x800) {
+        arr[arr.length] = hex_table[0xc0 | (c >> 6)]! + hex_table[0x80 | (c & 0x3f)];
+        continue;
+      }
+
+      if (c < 0xd800 || c >= 0xe000) {
+        arr[arr.length] =
+          hex_table[0xe0 | (c >> 12)]! + hex_table[0x80 | ((c >> 6) & 0x3f)] + hex_table[0x80 | (c & 0x3f)];
+        continue;
+      }
+
+      i += 1;
+      c = 0x10000 + (((c & 0x3ff) << 10) | (segment.charCodeAt(i) & 0x3ff));
+
+      arr[arr.length] =
+        hex_table[0xf0 | (c >> 18)]! +
+        hex_table[0x80 | ((c >> 12) & 0x3f)] +
+        hex_table[0x80 | ((c >> 6) & 0x3f)] +
+        hex_table[0x80 | (c & 0x3f)];
+    }
+
+    out += arr.join('');
+  }
+
+  return out;
+};
+
+export function compact(value: any) {
+  const queue = [{ obj: { o: value }, prop: 'o' }];
+  const refs = [];
+
+  for (let i = 0; i < queue.length; ++i) {
+    const item = queue[i];
+    // @ts-ignore
+    const obj = item.obj[item.prop];
+
+    const keys = Object.keys(obj);
+    for (let j = 0; j < keys.length; ++j) {
+      const key = keys[j]!;
+      const val = obj[key];
+      if (typeof val === 'object' && val !== null && refs.indexOf(val) === -1) {
+        queue.push({ obj: obj, prop: key });
+        refs.push(val);
+      }
+    }
+  }
+
+  compact_queue(queue);
+
+  return value;
+}
+
+export function is_regexp(obj: any) {
+  return Object.prototype.toString.call(obj) === '[object RegExp]';
+}
+
+export function is_buffer(obj: any) {
+  if (!obj || typeof obj !== 'object') {
+    return false;
+  }
+
+  return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));
+}
+
+export function combine(a: any, b: any) {
+  return [].concat(a, b);
+}
+
+export function maybe_map<T>(val: T[], fn: (v: T) => T) {
+  if (isArray(val)) {
+    const mapped = [];
+    for (let i = 0; i < val.length; i += 1) {
+      mapped.push(fn(val[i]!));
+    }
+    return mapped;
+  }
+  return fn(val);
+}

package/src/internal/utils/query.ts

@@ -1,23 +1,7 @@
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
-import { AnthropicError } from '../../core/error';
+import * as qs from '../qs/stringify';
 
-/**
- * Basic re-implementation of `qs.stringify` for primitive types.
- */
 export function stringifyQuery(query: object | Record<string, unknown>) {
-  return Object.entries(query)
-    .filter(([_, value]) => typeof value !== 'undefined')
-    .map(([key, value]) => {
-      if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
-        return `${encodeURIComponent(key)}=${encodeURIComponent(value)}`;
-      }
-      if (value === null) {
-        return `${encodeURIComponent(key)}=`;
-      }
-      throw new AnthropicError(
-        `Cannot stringify type ${typeof value}; Expected string, number, boolean, or null. If you need to pass nested query parameters, you can manually encode them, e.g. { query: { 'foo[key1]': value1, 'foo[key2]': value2 } }, and please open a GitHub issue requesting better support for your use case.`,
-      );
-    })
-    .join('&');
+  return qs.stringify(query, { arrayFormat: 'brackets' });
 }

package/src/lib/credentials/credential-chain.ts

@@ -2,7 +2,7 @@ import type { Fetch } from '../../internal/builtin-types';
 import { readEnv } from '../../internal/utils/env';
 import {
   CREDENTIALS_FILE_VERSION,
-  loadConfig,
+  loadConfigWithSource,
   getCredentialsPath,
   type AnthropicConfig,
 } from '../../core/credentials';
@@ -47,9 +47,9 @@ export function resolveCredentialsFromConfig(
   const provider = buildProvider(config, credentialsPath, effectiveBaseURL, options);
 
   const extraHeaders: Record<string, string> = {};
-  // Workspace scoping for oidc_federation is server-side (the federation rule
-  // encodes the workspace and the minted token is workspace-scoped), so the
-  // header is only meaningful for user_oauth.
+  // For federation profiles workspace_id is sent in the jwt-bearer exchange
+  // body, not as a request header (the minted token is already
+  // workspace-scoped, so the header would be ignored).
   if (config.workspace_id && config.authentication.type === 'user_oauth') {
     extraHeaders['anthropic-workspace-id'] = config.workspace_id;
   }
@@ -79,17 +79,24 @@ export async function defaultCredentials(
   options: ResolverOptions,
   profile?: string,
 ): Promise<CredentialResult | null> {
-  const config = await loadConfig(profile);
-  if (!config) {
+  const loaded = await loadConfigWithSource(profile);
+  if (!loaded) {
     return null;
   }
+  const { config, fromFile } = loaded;
 
-  // For env/file-loaded configs, default credentials_path to the
-  // per-profile location so user_oauth and federation caching work.
-  // Shallow-clone first so callers that retain a reference to the loaded
-  // config don't observe the patched-in default.
+  // For file-loaded configs, default credentials_path to the per-profile
+  // location so user_oauth and federation caching work. Shallow-clone first
+  // so callers that retain a reference to the loaded config don't observe the
+  // patched-in default.
+  //
+  // Env-only credentials (no profile file on disk) skip the disk cache —
+  // matching the other SDKs. A disk cache keyed by profile path would
+  // re-serve a stale token after a change to ANTHROPIC_WORKSPACE_ID (or
+  // ANTHROPIC_ORGANIZATION_ID / ANTHROPIC_FEDERATION_RULE_ID) until the
+  // cached token expired, so the env-only chain stays in-memory only.
   const withPath: AnthropicConfig =
-    config.authentication.credentials_path ?
+    config.authentication.credentials_path || !fromFile ?
       config
     : {
         ...config,
@@ -134,6 +141,7 @@ function buildProvider(
         federationRuleId: auth.federation_rule_id,
         organizationId: config.organization_id,
         serviceAccountId: auth.service_account_id,
+        workspaceId: config.workspace_id,
         baseURL,
         fetch: options.fetch,
         userAgent: options.userAgent,

package/src/lib/credentials/oidc-federation.ts

@@ -18,6 +18,18 @@ export type OIDCFederationConfig = {
   federationRuleId: string;
   organizationId: string;
   serviceAccountId?: string | undefined;
+  /**
+   * Optional `wrkspc_*` tagged ID, or the literal `"default"` to scope the
+   * token to the organization's default workspace. When omitted the server
+   * picks the rule's sole enabled workspace, else the org default if the rule
+   * covers it. Required when the rule enables more than one non-default
+   * workspace, or to target a specific workspace other than the one the
+   * server would pick. The minted token is workspace-scoped: per-request
+   * workspace selection (the `anthropic-workspace-id` header) is not supported
+   * for federation tokens — switching workspaces requires a new token exchange
+   * with a different `workspaceId`.
+   */
+  workspaceId?: string | undefined;
   baseURL: string;
   fetch: Fetch;
   /**
@@ -61,6 +73,9 @@ export function oidcFederationProvider(config: OIDCFederationConfig): AccessToke
     if (config.serviceAccountId) {
       body['service_account_id'] = config.serviceAccountId;
     }
+    if (config.workspaceId) {
+      body['workspace_id'] = config.workspaceId;
+    }
 
     const url = `${config.baseURL}${TOKEN_ENDPOINT}`;
     let resp: Response;
@@ -83,10 +98,23 @@ export function oidcFederationProvider(config: OIDCFederationConfig): AccessToke
     if (!resp.ok) {
       const text = await resp.text().catch(() => '');
       const redacted = redactSensitive(text);
+      // A 401 is hard to debug from the status code alone, so surface
+      // guidance: check the federation rule, optionally set a workspace ID
+      // (the most common fix when no workspaceId is configured), and point at
+      // the Workload identity page in Claude Console for the server-side
+      // authentication event log. Other statuses (5xx, 400, ...) get no hint.
+      let hint = '';
+      if (resp.status === 401) {
+        const hintMiddle =
+          config.workspaceId ? '' : (
+            "If your federation rule is scoped to multiple workspaces, set the ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' config key, or the `workspaceId` option. "
+          );
+        hint = ` Ensure your federation rule matches your identity token. ${hintMiddle}View your authentication events in the Workload identity page of Claude Console for more details.`;
+      }
       throw new WorkloadIdentityError(
         `Token exchange failed with status ${resp.status}${
           requestId ? ` (request-id ${requestId})` : ''
-        }: ${redacted}`,
+        }: ${redacted}${hint}`,
         resp.status,
         redacted,
         requestId,

package/src/resources/beta/agents/agents.ts

@@ -4,6 +4,7 @@ import { APIResource } from '../../../core/resource';
 import * as BetaAPI from '../beta';
 import * as VersionsAPI from './versions';
 import { VersionListParams, Versions } from './versions';
+import * as SessionsAPI from '../sessions/sessions';
 import { APIPromise } from '../../../core/api-promise';
 import { PageCursor, type PageCursorParams, PagePromise } from '../../../core/pagination';
 import { buildHeaders } from '../../../internal/headers';
@@ -174,6 +175,11 @@ export interface BetaManagedAgentsAgent {
    */
   model: BetaManagedAgentsModelConfig;
 
+  /**
+   * Resolved coordinator topology with a concrete agent roster.
+   */
+  multiagent: SessionsAPI.BetaManagedAgentsMultiagent | null;
+
   name: string;
 
   skills: Array<BetaManagedAgentsAnthropicSkill | BetaManagedAgentsCustomSkill>;
@@ -198,6 +204,17 @@ export interface BetaManagedAgentsAgent {
   version: number;
 }
 
+/**
+ * A resolved agent reference with a concrete version.
+ */
+export interface BetaManagedAgentsAgentReference {
+  id: string;
+
+  type: 'agent';
+
+  version: number;
+}
+
 /**
  * Configuration for a specific agent tool.
  */
@@ -589,6 +606,45 @@ export interface BetaManagedAgentsModelConfigParams {
   speed?: 'standard' | 'fast' | null;
 }
 
+/**
+ * Resolved coordinator topology with a concrete agent roster.
+ */
+export interface BetaManagedAgentsMultiagentCoordinator {
+  /**
+   * Agents the coordinator may spawn as session threads, each resolved to a specific
+   * version.
+   */
+  agents: Array<BetaManagedAgentsAgentReference>;
+
+  type: 'coordinator';
+}
+
+/**
+ * A coordinator topology: the session's primary thread orchestrates work by
+ * spawning session threads, each running an agent drawn from the `agents` roster.
+ */
+export interface BetaManagedAgentsMultiagentCoordinatorParams {
+  /**
+   * Agents the coordinator may spawn as session threads. 1–20 entries. Each entry is
+   * an agent ID string, a versioned `{"type":"agent","id","version"}` reference, or
+   * `{"type":"self"}` to allow recursive self-invocation. Entries must reference
+   * distinct agents (after resolving `self` and string forms); at most one `self`.
+   * Referenced agents must exist, must not be archived, and must not themselves have
+   * `multiagent` set (depth limit 1).
+   */
+  agents: Array<SessionsAPI.BetaManagedAgentsMultiagentRosterEntryParams>;
+
+  type: 'coordinator';
+}
+
+/**
+ * Sentinel roster entry meaning "the agent that owns this configuration". Resolved
+ * server-side to a concrete agent reference.
+ */
+export interface BetaManagedAgentsMultiagentSelfParams {
+  type: 'self';
+}
+
 /**
  * Skill to load in the session container.
  */
@@ -645,6 +701,13 @@ export interface AgentCreateParams {
    */
   metadata?: { [key: string]: string };
 
+  /**
+   * Body param: A coordinator topology: the session's primary thread orchestrates
+   * work by spawning session threads, each running an agent drawn from the `agents`
+   * roster.
+   */
+  multiagent?: SessionsAPI.BetaManagedAgentsMultiagentParams | null;
+
   /**
    * Body param: Skills available to the agent. Maximum 20.
    */
@@ -719,6 +782,13 @@ export interface AgentUpdateParams {
    */
   model?: BetaManagedAgentsModel | BetaManagedAgentsModelConfigParams;
 
+  /**
+   * Body param: A coordinator topology: the session's primary thread orchestrates
+   * work by spawning session threads, each running an agent drawn from the `agents`
+   * roster.
+   */
+  multiagent?: SessionsAPI.BetaManagedAgentsMultiagentParams | null;
+
   /**
    * Body param: Human-readable name. 1-256 characters. Omit to preserve. Cannot be
    * cleared.
@@ -788,6 +858,7 @@ Agents.Versions = Versions;
 export declare namespace Agents {
   export {
     type BetaManagedAgentsAgent as BetaManagedAgentsAgent,
+    type BetaManagedAgentsAgentReference as BetaManagedAgentsAgentReference,
     type BetaManagedAgentsAgentToolConfig as BetaManagedAgentsAgentToolConfig,
     type BetaManagedAgentsAgentToolConfigParams as BetaManagedAgentsAgentToolConfigParams,
     type BetaManagedAgentsAgentToolsetDefaultConfig as BetaManagedAgentsAgentToolsetDefaultConfig,
@@ -813,6 +884,9 @@ export declare namespace Agents {
     type BetaManagedAgentsModel as BetaManagedAgentsModel,
     type BetaManagedAgentsModelConfig as BetaManagedAgentsModelConfig,
     type BetaManagedAgentsModelConfigParams as BetaManagedAgentsModelConfigParams,
+    type BetaManagedAgentsMultiagentCoordinator as BetaManagedAgentsMultiagentCoordinator,
+    type BetaManagedAgentsMultiagentCoordinatorParams as BetaManagedAgentsMultiagentCoordinatorParams,
+    type BetaManagedAgentsMultiagentSelfParams as BetaManagedAgentsMultiagentSelfParams,
     type BetaManagedAgentsSkillParams as BetaManagedAgentsSkillParams,
     type BetaManagedAgentsURLMCPServerParams as BetaManagedAgentsURLMCPServerParams,
     type BetaManagedAgentsAgentsPageCursor as BetaManagedAgentsAgentsPageCursor,

package/src/resources/beta/agents/index.ts

@@ -3,6 +3,7 @@
 export {
   Agents,
   type BetaManagedAgentsAgent,
+  type BetaManagedAgentsAgentReference,
   type BetaManagedAgentsAgentToolConfig,
   type BetaManagedAgentsAgentToolConfigParams,
   type BetaManagedAgentsAgentToolsetDefaultConfig,
@@ -28,6 +29,9 @@ export {
   type BetaManagedAgentsModel,
   type BetaManagedAgentsModelConfig,
   type BetaManagedAgentsModelConfigParams,
+  type BetaManagedAgentsMultiagentCoordinator,
+  type BetaManagedAgentsMultiagentCoordinatorParams,
+  type BetaManagedAgentsMultiagentSelfParams,
   type BetaManagedAgentsSkillParams,
   type BetaManagedAgentsURLMCPServerParams,
   type AgentCreateParams,