@belonguniverseai/react-sdk 0.6.25 → 0.6.27

package/README.md

@@ -195,3 +195,10 @@ the WebRTC handshake (SDP offer/answer) relays through the Belong backend —
 already in your `connect-src` if the dock works at all — and the call audio
 itself is a direct browser↔OpenAI WebRTC media stream, which `connect-src`
 does not govern (audio never relays through the Belong backend).
+
+## Interactive HTML artifacts
+
+Registered HTML reports receive the versioned `window.belongArtifact` helper.
+The parent SDK owns authentication and approval; the opaque iframe submits named
+actions and observes durable operation results without a sandbox port or tokens.
+See [the authoring contract and demo](../../docs/guides/022-interactive-artifact-actions.md).

package/dist/api/account-connectors.d.ts

@@ -4,9 +4,9 @@ declare const accountConnectorSchema: z.ZodObject<{
     catalogEntryId: z.ZodString;
     status: z.ZodEnum<{
         error: "error";
-        needs_auth: "needs_auth";
         connected: "connected";
         disconnected: "disconnected";
+        needs_auth: "needs_auth";
     }>;
     account: z.ZodNullable<z.ZodObject<{
         displayName: z.ZodString;
@@ -17,8 +17,8 @@ declare const accountConnectorSchema: z.ZodObject<{
         label: z.ZodString;
         status: z.ZodEnum<{
             error: "error";
-            needs_auth: "needs_auth";
             ready: "ready";
+            needs_auth: "needs_auth";
             disabled: "disabled";
             needs_admin_consent: "needs_admin_consent";
         }>;

package/dist/api/artifact-actions.d.ts

@@ -0,0 +1,29 @@
+import { ArtifactCapabilities, ArtifactOperation, ArtifactSelection, ArtifactReview } from '@belong/codec/artifact-actions';
+export declare class ArtifactActionError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export type ArtifactActionApi = {
+    capabilities: (signal: AbortSignal) => Promise<ArtifactCapabilities>;
+    execute: (actionId: string, scriptVersion: string, params: ArtifactSelection, requestId: string, signal: AbortSignal) => Promise<ArtifactOperation>;
+    get: (operationId: string, signal: AbortSignal) => Promise<ArtifactOperation>;
+    list: (signal: AbortSignal) => Promise<{
+        operations: ArtifactOperation[];
+    }>;
+    cancel: (operationId: string, signal: AbortSignal) => Promise<ArtifactOperation>;
+    approve: (operationId: string, decision: "approved" | "rejected", signal: AbortSignal) => Promise<ArtifactOperation>;
+    review: (operationId: string, signal: AbortSignal) => Promise<ArtifactReview>;
+    /**
+     * Trusted-parent only: ask the backend to stop an invocation that may still hold the user's
+     * sandbox. Never reachable from the report bridge (see `ArtifactBridgeApi`). Resolves with the
+     * current snapshot, which may still be `stopEvidence: "pending"` when this round found no stop
+     * evidence. Rejects with the backend's `{ error: { type } }` code `not_settleable` (409: nothing
+     * left to stop) or `sandbox_unreachable` (503); any other refusal keeps its generic code.
+     */
+    settle: (operationId: string, signal: AbortSignal) => Promise<ArtifactOperation>;
+};
+/** What the report bridge may call: everything except the parent-only stop control. */
+export type ArtifactBridgeApi = Omit<ArtifactActionApi, "settle">;
+export declare const ARTIFACT_API_REQUEST_TIMEOUT_MS = 20000;
+/** Parent-only authenticated adapter. Generated HTML cannot select the target or auth source. */
+export declare const createArtifactActionApi: (apiBaseUrl: string, artifactId: string, workspaceExternalId: string | null) => ArtifactActionApi;