@blazingagents/sdk 0.1.0

package/dist/contracts/entities/workspaces.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+import { cursorSchema, paginatedResponseSchema } from "../api.js";
+import { tenantIdSchema, workspaceIdSchema } from "../ids.js";
+import { DEFAULT_WORKSPACES_LIST_LIMIT, MAX_WORKSPACE_NAME_LENGTH, MAX_WORKSPACES_LIST_LIMIT, } from "../limitations.js";
+import { hasObjectKeys } from "../utils.js";
+import { metadataSchema, userIdSchema } from "./attribution.js";
+export const workspaceNameSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(MAX_WORKSPACE_NAME_LENGTH);
+export const workspaceBackupSchema = z
+    .object({
+    dir: z.literal("/workspace"),
+    id: z.uuid(),
+    localBucket: z.boolean().optional(),
+})
+    .strict();
+export const workspaceNetworkPolicySchema = z.discriminatedUnion("mode", [
+    z.object({ mode: z.literal("unrestricted") }).strict(),
+    z
+        .object({
+        allowedHosts: z.array(z.string().trim().min(1)).min(1),
+        mode: z.literal("allowlist"),
+    })
+        .strict(),
+    z.object({ mode: z.literal("offline") }).strict(),
+]);
+export const workspaceSchema = z
+    .object({
+    id: workspaceIdSchema,
+    tenantId: tenantIdSchema,
+    name: workspaceNameSchema.nullable(),
+    userId: userIdSchema,
+    metadata: metadataSchema,
+    networkPolicy: workspaceNetworkPolicySchema,
+    createdAt: z.iso.datetime({ offset: true }),
+    updatedAt: z.iso.datetime({ offset: true }),
+})
+    .strict();
+export const createWorkspaceBodySchema = z
+    .object({
+    name: workspaceNameSchema.optional(),
+    userId: userIdSchema.default(""),
+    metadata: metadataSchema.default({}),
+    networkPolicy: workspaceNetworkPolicySchema.default({
+        mode: "unrestricted",
+    }),
+})
+    .strict();
+export const updateWorkspaceBodySchema = z
+    .object({
+    name: workspaceNameSchema.nullable().optional(),
+    metadata: metadataSchema.optional(),
+    networkPolicy: workspaceNetworkPolicySchema.optional(),
+})
+    .strict()
+    .refine(hasObjectKeys, { message: "At least one field is required." });
+export const workspaceListQuerySchema = z
+    .object({
+    cursor: cursorSchema.optional(),
+    limit: z.coerce
+        .number()
+        .int()
+        .min(1)
+        .max(MAX_WORKSPACES_LIST_LIMIT)
+        .default(DEFAULT_WORKSPACES_LIST_LIMIT),
+    userId: userIdSchema.optional(),
+})
+    .strict();
+export const workspacesListResponseSchema = paginatedResponseSchema(workspaceSchema);

package/dist/contracts/ids.d.ts

@@ -0,0 +1,57 @@
+import { z } from "zod";
+export declare const ADMIN_AGENT_ID_PREFIX = "ag_adm";
+export declare const createTenantId: () => string;
+export declare const createAgentId: () => string;
+export declare const mintAdminAgentId: () => string;
+export declare const createSessionId: () => string;
+export declare const createApiKeyId: () => string;
+export declare const createProviderId: () => string;
+export declare const createMcpConnectionId: () => string;
+export declare const createWorkspaceId: () => string;
+export declare const createArtifactId: () => string;
+export declare const createTaskId: () => string;
+export declare const createTaskRunId: () => string;
+export declare const createMemoryId: () => string;
+export declare const createPromptId: () => string;
+export declare const createRequestId: () => string;
+export declare const createCheckoutAttemptId: () => string;
+export declare const createSkillId: () => string;
+/**
+ * API keys — `ba_` + 40 base62 chars (~230 bits entropy). The full token is
+ * shown once at creation; only the sha256 hash and a 2-char display fragment
+ * are stored. (docs/adr/0004-unified-v1-dual-credential-auth.md)
+ */
+export declare const API_KEY_TOKEN_PREFIX = "ba_";
+export declare function createApiKeyToken(): string;
+/**
+ * The display fragment is `ba_` + the first 2 chars of the random body —
+ * safe to store (~12 of ~230 bits revealed).
+ */
+export declare function apiKeyFragmentFromToken(token: string): string;
+export declare const tenantIdSchema: z.ZodString;
+export declare const agentIdSchema: z.ZodString;
+export declare const isAdminAgentId: (id: string) => boolean;
+export declare const sessionIdSchema: z.ZodString;
+export declare const apiKeyIdSchema: z.ZodString;
+export declare const providerIdSchema: z.ZodString;
+export declare const mcpConnectionIdSchema: z.ZodString;
+export declare const workspaceIdSchema: z.ZodString;
+export declare const artifactIdSchema: z.ZodString;
+export declare const taskIdSchema: z.ZodString;
+export declare const taskRunIdSchema: z.ZodString;
+export declare const memoryIdSchema: z.ZodString;
+export declare const promptIdSchema: z.ZodString;
+export declare const requestIdSchema: z.ZodString;
+export declare const checkoutAttemptIdSchema: z.ZodString;
+export declare const turnIdSchema: z.ZodString;
+export declare const skillIdSchema: z.ZodString;
+/**
+ * API key token + digest helpers. The digest is sha256 hex (64 chars); the
+ * fragment is `ba_` + 2 base62 chars. Both stored columns are format-checked
+ * in the migration.
+ */
+export declare const apiKeyTokenSchema: z.ZodString;
+export declare const apiKeyDigestSchema: z.ZodString;
+export declare const apiKeyFragmentSchema: z.ZodString;
+export declare const providerKeyFragmentSchema: z.ZodString;
+export type TurnId = z.infer<typeof turnIdSchema>;

package/dist/contracts/ids.js

@@ -0,0 +1,79 @@
+import { customAlphabet } from "nanoid";
+import { z } from "zod";
+/**
+ * Base62 — the alphabet every platform id body uses (16 chars for ids,
+ * 40 chars for API key bodies). Matches the regex check constraints in every
+ * migration: `^<prefix>_[0-9A-Za-z]{16}$`.
+ */
+const BASE62 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+export const ADMIN_AGENT_ID_PREFIX = "ag_adm";
+const createNanoId16 = customAlphabet(BASE62, 16);
+const createNanoId13 = customAlphabet(BASE62, 13);
+const createAgentIdFirstChar = customAlphabet(BASE62.replace("a", ""), 1);
+const createNanoId15 = customAlphabet(BASE62, 15);
+const createNanoId40 = customAlphabet(BASE62, 40);
+const platformId = (prefix) => () => `${prefix}_${createNanoId16()}`;
+export const createTenantId = platformId("ten");
+export const createAgentId = () => `ag_${createAgentIdFirstChar()}${createNanoId15()}`;
+export const mintAdminAgentId = () => `${ADMIN_AGENT_ID_PREFIX}${createNanoId13()}`;
+export const createSessionId = platformId("ss");
+export const createApiKeyId = platformId("ak");
+export const createProviderId = platformId("prv");
+export const createMcpConnectionId = platformId("mcp");
+export const createWorkspaceId = platformId("ws");
+export const createArtifactId = platformId("at");
+export const createTaskId = platformId("tk");
+export const createTaskRunId = platformId("tr");
+export const createMemoryId = platformId("mem");
+export const createPromptId = platformId("prompt");
+export const createRequestId = platformId("req");
+export const createCheckoutAttemptId = platformId("ca");
+export const createSkillId = () => `skill_${createNanoId16()}`;
+/**
+ * API keys — `ba_` + 40 base62 chars (~230 bits entropy). The full token is
+ * shown once at creation; only the sha256 hash and a 2-char display fragment
+ * are stored. (docs/adr/0004-unified-v1-dual-credential-auth.md)
+ */
+export const API_KEY_TOKEN_PREFIX = "ba_";
+export function createApiKeyToken() {
+    return `${API_KEY_TOKEN_PREFIX}${createNanoId40()}`;
+}
+/**
+ * The display fragment is `ba_` + the first 2 chars of the random body —
+ * safe to store (~12 of ~230 bits revealed).
+ */
+export function apiKeyFragmentFromToken(token) {
+    if (!token.startsWith(API_KEY_TOKEN_PREFIX)) {
+        throw new Error(`API key token must start with ${API_KEY_TOKEN_PREFIX}.`);
+    }
+    const body = token.slice(API_KEY_TOKEN_PREFIX.length);
+    return `${API_KEY_TOKEN_PREFIX}${body.slice(0, 2)}`;
+}
+// Schemas — one per id prefix, mirroring the migration check constraints.
+export const tenantIdSchema = z.string().regex(/^ten_[0-9A-Za-z]{16}$/);
+export const agentIdSchema = z.string().regex(/^ag_[0-9A-Za-z]{16}$/);
+export const isAdminAgentId = (id) => id.startsWith(ADMIN_AGENT_ID_PREFIX) && z.validate(agentIdSchema, id);
+export const sessionIdSchema = z.string().regex(/^ss_[0-9A-Za-z]{16}$/);
+export const apiKeyIdSchema = z.string().regex(/^ak_[0-9A-Za-z]{16}$/);
+export const providerIdSchema = z.string().regex(/^prv_[0-9A-Za-z]{16}$/);
+export const mcpConnectionIdSchema = z.string().regex(/^mcp_[0-9A-Za-z]{16}$/);
+export const workspaceIdSchema = z.string().regex(/^ws_[0-9A-Za-z]{16}$/);
+export const artifactIdSchema = z.string().regex(/^at_[0-9A-Za-z]{16}$/);
+export const taskIdSchema = z.string().regex(/^tk_[0-9A-Za-z]{16}$/);
+export const taskRunIdSchema = z.string().regex(/^tr_[0-9A-Za-z]{16}$/);
+export const memoryIdSchema = z.string().regex(/^mem_[0-9A-Za-z]{16}$/);
+export const promptIdSchema = z.string().regex(/^prompt_[0-9A-Za-z]{16}$/);
+export const requestIdSchema = z.string().regex(/^req_[0-9A-Za-z]{16}$/);
+export const checkoutAttemptIdSchema = z.string().regex(/^ca_[0-9A-Za-z]{16}$/);
+export const turnIdSchema = z.string().regex(/^turn_[0-9A-Za-z]{16}$/);
+export const skillIdSchema = z.string().regex(/^skill_[0-9A-Za-z]{16}$/);
+/**
+ * API key token + digest helpers. The digest is sha256 hex (64 chars); the
+ * fragment is `ba_` + 2 base62 chars. Both stored columns are format-checked
+ * in the migration.
+ */
+export const apiKeyTokenSchema = z.string().regex(/^ba_[0-9A-Za-z]{40}$/);
+export const apiKeyDigestSchema = z.string().regex(/^[0-9a-f]{64}$/);
+export const apiKeyFragmentSchema = z.string().regex(/^ba_[0-9A-Za-z]{2}$/);
+// Provider key fragment — last 4 chars of the secret, display-only.
+export const providerKeyFragmentSchema = z.string().min(1).max(4);

package/dist/contracts/index.d.ts

@@ -0,0 +1,15 @@
+/** Public runtime schemas for the Blazing Agents HTTP API. */
+export { receivedApiErrorResponseSchema } from "./api.ts";
+export { agentResponseSchema, agentsResponseSchema, agentVersionSchema, agentVersionsResponseSchema, } from "./entities/agents.ts";
+export { artifactDownloadUrlResponseSchema, artifactListItemSchema, artifactsListResponseSchema, } from "./entities/artifacts.ts";
+export { mcpAttachmentResponseSchema, mcpAttachmentsResponseSchema, mcpConnectionOauthConnectResponseSchema, mcpConnectionResponseSchema, mcpConnectionsResponseSchema, mcpConnectionTestResponseSchema, } from "./entities/mcp-connections.ts";
+export { memoriesListResponseSchema, memoryResponseSchema, } from "./entities/memories.ts";
+export { promptResponseSchema, promptsResponseSchema, } from "./entities/prompts.ts";
+export { providerModelsResponseSchema, providerResponseSchema, providersResponseSchema, } from "./entities/providers.ts";
+export { sessionMessagesResponseSchema, sessionsListResponseSchema, toolApprovalDecisionResponseSchema, toolApprovalsResponseSchema, } from "./entities/sessions.ts";
+export { skillCopyResultsSchema, skillDetailSchema, skillsListResponseSchema, } from "./entities/skills.ts";
+export { createTaskResponseSchema, createTaskRunResponseSchema, taskResponseSchema, taskRunMessagesResponseSchema, taskRunResponseSchema, taskRunsListResponseSchema, tasksListResponseSchema, } from "./entities/tasks.ts";
+export { tenantSettingsResponseSchema } from "./entities/tenants.ts";
+export { usageResponseSchema } from "./entities/usage.ts";
+export { workspaceSchema, workspacesListResponseSchema, } from "./entities/workspaces.ts";
+export { sessionIdSchema } from "./ids.ts";

package/dist/contracts/index.js

@@ -0,0 +1,16 @@
+/** Public runtime schemas for the Blazing Agents HTTP API. */
+// biome-ignore lint/performance/noBarrelFile: public contract entry point
+export { receivedApiErrorResponseSchema } from "./api.js";
+export { agentResponseSchema, agentsResponseSchema, agentVersionSchema, agentVersionsResponseSchema, } from "./entities/agents.js";
+export { artifactDownloadUrlResponseSchema, artifactListItemSchema, artifactsListResponseSchema, } from "./entities/artifacts.js";
+export { mcpAttachmentResponseSchema, mcpAttachmentsResponseSchema, mcpConnectionOauthConnectResponseSchema, mcpConnectionResponseSchema, mcpConnectionsResponseSchema, mcpConnectionTestResponseSchema, } from "./entities/mcp-connections.js";
+export { memoriesListResponseSchema, memoryResponseSchema, } from "./entities/memories.js";
+export { promptResponseSchema, promptsResponseSchema, } from "./entities/prompts.js";
+export { providerModelsResponseSchema, providerResponseSchema, providersResponseSchema, } from "./entities/providers.js";
+export { sessionMessagesResponseSchema, sessionsListResponseSchema, toolApprovalDecisionResponseSchema, toolApprovalsResponseSchema, } from "./entities/sessions.js";
+export { skillCopyResultsSchema, skillDetailSchema, skillsListResponseSchema, } from "./entities/skills.js";
+export { createTaskResponseSchema, createTaskRunResponseSchema, taskResponseSchema, taskRunMessagesResponseSchema, taskRunResponseSchema, taskRunsListResponseSchema, tasksListResponseSchema, } from "./entities/tasks.js";
+export { tenantSettingsResponseSchema } from "./entities/tenants.js";
+export { usageResponseSchema } from "./entities/usage.js";
+export { workspaceSchema, workspacesListResponseSchema, } from "./entities/workspaces.js";
+export { sessionIdSchema } from "./ids.js";

package/dist/contracts/limitations.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Effort-wide convention: every coded limit lives here as an UPPER_SNAKE_CASE
+ * constant. No scattered magic numbers.
+ */
+/**
+ * API keys — max 5 per tenant, name ≤ 80 (docs/adr/0004).
+ */
+export declare const MAX_API_KEYS_PER_TENANT = 5;
+export declare const MAX_API_KEY_NAME_LENGTH = 80;
+/**
+ * API key token shape — `ba_` + 40 base62 chars (~230 bits entropy).
+ * The prefix and body/fragment lengths live in `ids.ts` alongside the
+ * generators and schemas.
+ */
+export declare const API_KEY_BODY_LENGTH = 40;
+export declare const API_KEY_FRAGMENT_BODY_LENGTH = 2;
+/** Workspaces. */
+export declare const MAX_WORKSPACE_NAME_LENGTH = 80;
+export declare const MAX_WORKSPACE_ARCHIVE_ENTRIES = 16384;
+export declare const DEFAULT_WORKSPACES_LIST_LIMIT = 50;
+export declare const MAX_WORKSPACES_LIST_LIMIT = 200;
+/**
+ * Agent Skills — at most 100 per Agent, 10 MiB per upload/archive and stored
+ * namespace, and 100 regular files. Frontmatter follows the Agent Skills
+ * specification accepted in ADR-0028.
+ */
+export declare const MAX_SKILLS_PER_AGENT = 100;
+export declare const MAX_SKILL_UPLOAD_BYTES: number;
+export declare const MAX_SKILL_UNCOMPRESSED_BYTES: number;
+export declare const MAX_SKILL_FILES = 100;
+export declare const MAX_SKILL_NAME_LENGTH = 64;
+export declare const MAX_SKILL_DESCRIPTION_LENGTH = 1024;
+export declare const MAX_SKILL_COMPATIBILITY_LENGTH = 500;
+export declare const MAX_SKILL_COPY_DESTINATIONS = 30;
+export declare const DEFAULT_SKILLS_LIST_LIMIT = 50;
+export declare const MAX_SKILLS_LIST_LIMIT = 100;
+/**
+ * Prompts — max 100 per tenant, ~10 KB template cap, name ≤ 80.
+ */
+export declare const MAX_PROMPTS_PER_TENANT = 100;
+export declare const MAX_PROMPT_TEMPLATE_BYTES: number;
+export declare const MAX_PROMPT_VARIABLES = 10;
+export declare const MAX_PROMPT_NAME_LENGTH = 80;
+/** Tasks — name ≤ 80, prompt ≤ 6000, interval ≥ 60s. */
+export declare const MAX_TASK_NAME_LENGTH = 80;
+export declare const MAX_TASK_PROMPT_LENGTH = 6000;
+export declare const MIN_TASK_INTERVAL_MS = 60000;
+/**
+ * Providers — max 20 per tenant, name ≤ 80.
+ */
+export declare const MAX_PROVIDERS_PER_TENANT = 20;
+export declare const MAX_PROVIDER_NAME_LENGTH = 80;
+export declare const PROVIDER_KEY_FRAGMENT_LENGTH = 4;
+/**
+ * MCP Connections — max 50 per tenant, name ≤ 80, URL ≤ 2048.
+ */
+export declare const MAX_MCP_CONNECTIONS_PER_TENANT = 50;
+export declare const MAX_MCP_CONNECTIONS_PER_AGENT = 10;
+export declare const MAX_MCP_CONNECTION_NAME_LENGTH = 80;
+export declare const MAX_MCP_CONNECTION_URL_LENGTH = 2048;
+export declare const MAX_MCP_BEARER_TOKEN_LENGTH = 8192;
+export declare const MAX_MCP_OAUTH_CLIENT_ID_LENGTH = 2048;
+export declare const MAX_MCP_OAUTH_CLIENT_SECRET_LENGTH = 8192;
+export declare const MAX_MCP_OAUTH_SCOPE_LENGTH = 2048;
+export declare const MAX_MCP_CONNECTION_TEST_LATENCY_MS = 60000;
+export declare const MAX_MCP_SERVER_NAME_LENGTH = 200;
+export declare const MAX_MCP_SERVER_VERSION_LENGTH = 100;
+export declare const MAX_MCP_TOOL_NAME_LENGTH = 256;
+export declare const MAX_MCP_TOOLS_PER_CONNECTION = 128;
+export declare const MAX_MCP_TOOLS_PER_TURN = 256;
+export declare const MAX_MCP_CONNECTION_SETUP_CONCURRENCY = 4;
+export declare const MAX_MCP_TOOL_KEY_LENGTH = 63;
+export declare const MAX_MCP_TOOL_DEFINITION_BYTES: number;
+export declare const MAX_MCP_CONNECTION_TOOL_DEFINITIONS_BYTES: number;
+export declare const MAX_MCP_TOOL_RESULT_BYTES: number;
+export declare const MAX_MCP_ATTACHMENT_METADATA_KEYS = 32;
+export declare const MAX_MCP_ATTACHMENT_METADATA_KEY_LENGTH = 64;
+export declare const MAX_MCP_REQUEST_CONTEXT_BYTES: number;
+/** Agents — name ≤ 80, instructions ≤ 3000. */
+export declare const MAX_AGENT_NAME_LENGTH = 80;
+export declare const MAX_AGENT_INSTRUCTIONS_LENGTH = 3000;
+export declare const DEFAULT_AGENT_VERSIONS_LIST_LIMIT = 50;
+export declare const MAX_AGENT_VERSIONS_LIST_LIMIT = 200;
+/**
+ * Artifacts — 10 MiB per file, 10 publications per Tool call, and 100
+ * Artifacts per Session.
+ */
+export declare const MAX_ARTIFACT_BYTES: number;
+export declare const MAX_ARTIFACT_PUBLICATIONS_PER_CALL = 10;
+export declare const MAX_ARTIFACTS_PER_SESSION = 100;
+/**
+ * Sandbox operations — 30-second native Cloudflare commands under a bounded
+ * private HTTP caller budget that includes cold Container startup. File
+ * transfers are 10 MiB decoded under a 15 MiB authenticated internal JSON
+ * request.
+ */
+export declare const CLOUDFLARE_SANDBOX_EXEC_MS = 30000;
+export declare const MAX_SANDBOX_OPERATION_HTTP_MS = 160000;
+export declare const MAX_SANDBOX_FILE_TRANSFER_BYTES: number;
+export declare const MAX_SANDBOX_FILE_CHUNK_BYTES: number;
+export declare const MAX_SANDBOX_REQUEST_BODY_BYTES: number;
+/**
+ * Memories — one pool per Agent spanning all `userId` partitions, capped
+ * globally at 500 rows (LRU eviction on create), 10 KiB of text per memory
+ * (zod byte refine + DB `octet_length` check).
+ */
+export declare const MAX_MEMORIES_PER_AGENT = 500;
+export declare const MAX_MEMORY_TEXT_BYTES: number;
+export declare const DEFAULT_MEMORIES_LIST_LIMIT = 50;
+export declare const MAX_MEMORIES_LIST_LIMIT = 100;
+export declare const DEFAULT_MEMORY_TOOL_SEARCH_LIMIT = 10;
+export declare const MAX_MEMORY_TOOL_SEARCH_LIMIT = 20;
+/**
+ * Sessions — messages endpoint default limit 50, max 200.
+ */
+export declare const DEFAULT_SESSION_MESSAGES_LIMIT = 50;
+export declare const MAX_SESSION_MESSAGES_LIMIT = 200;
+/**
+ * Usage — range cap 31 days, default 30 days; top-N sessions default 50, max 200.
+ */
+export declare const MAX_USAGE_RANGE_DAYS = 31;
+export declare const DEFAULT_USAGE_RANGE_DAYS = 30;
+export declare const DEFAULT_USAGE_SESSION_TOP_N = 50;
+export declare const MAX_USAGE_SESSION_TOP_N = 200;
+export declare const MIN_QUOTA_RESET_DAY = 1;
+export declare const MAX_QUOTA_RESET_DAY = 28;
+/**
+ * Tenant (workspace) — display name ≤ 80, set via `PATCH /v1/tenant`.
+ */
+export declare const MAX_TENANT_NAME_LENGTH = 80;
+/**
+ * Tenant resource creation — provisional abuse-protection throughput, applied
+ * independently to Agent, Task, and Workspace creation.
+ */
+export declare const TENANT_CREATION_BURST_LIMIT = 60;
+export declare const TENANT_CREATION_BURST_WINDOW_MS = 60000;
+export declare const TENANT_CREATION_SUSTAINED_LIMIT = 1000;
+export declare const TENANT_CREATION_SUSTAINED_WINDOW_MS = 86400000;

package/dist/contracts/limitations.js

@@ -0,0 +1,140 @@
+/**
+ * Effort-wide convention: every coded limit lives here as an UPPER_SNAKE_CASE
+ * constant. No scattered magic numbers.
+ */
+/**
+ * API keys — max 5 per tenant, name ≤ 80 (docs/adr/0004).
+ */
+export const MAX_API_KEYS_PER_TENANT = 5;
+export const MAX_API_KEY_NAME_LENGTH = 80;
+/**
+ * API key token shape — `ba_` + 40 base62 chars (~230 bits entropy).
+ * The prefix and body/fragment lengths live in `ids.ts` alongside the
+ * generators and schemas.
+ */
+export const API_KEY_BODY_LENGTH = 40;
+// Display fragment — `ba_` + first 2 chars of the random body.
+export const API_KEY_FRAGMENT_BODY_LENGTH = 2;
+/** Workspaces. */
+export const MAX_WORKSPACE_NAME_LENGTH = 80;
+export const MAX_WORKSPACE_ARCHIVE_ENTRIES = 16_384;
+export const DEFAULT_WORKSPACES_LIST_LIMIT = 50;
+export const MAX_WORKSPACES_LIST_LIMIT = 200;
+/**
+ * Agent Skills — at most 100 per Agent, 10 MiB per upload/archive and stored
+ * namespace, and 100 regular files. Frontmatter follows the Agent Skills
+ * specification accepted in ADR-0028.
+ */
+export const MAX_SKILLS_PER_AGENT = 100;
+export const MAX_SKILL_UPLOAD_BYTES = 10 * 1024 * 1024;
+export const MAX_SKILL_UNCOMPRESSED_BYTES = 10 * 1024 * 1024;
+export const MAX_SKILL_FILES = 100;
+export const MAX_SKILL_NAME_LENGTH = 64;
+export const MAX_SKILL_DESCRIPTION_LENGTH = 1024;
+export const MAX_SKILL_COMPATIBILITY_LENGTH = 500;
+export const MAX_SKILL_COPY_DESTINATIONS = 30;
+export const DEFAULT_SKILLS_LIST_LIMIT = 50;
+export const MAX_SKILLS_LIST_LIMIT = 100;
+/**
+ * Prompts — max 100 per tenant, ~10 KB template cap, name ≤ 80.
+ */
+export const MAX_PROMPTS_PER_TENANT = 100;
+export const MAX_PROMPT_TEMPLATE_BYTES = 10 * 1024;
+export const MAX_PROMPT_VARIABLES = 10;
+export const MAX_PROMPT_NAME_LENGTH = 80;
+/** Tasks — name ≤ 80, prompt ≤ 6000, interval ≥ 60s. */
+export const MAX_TASK_NAME_LENGTH = 80;
+export const MAX_TASK_PROMPT_LENGTH = 6000;
+export const MIN_TASK_INTERVAL_MS = 60_000;
+/**
+ * Providers — max 20 per tenant, name ≤ 80.
+ */
+export const MAX_PROVIDERS_PER_TENANT = 20;
+export const MAX_PROVIDER_NAME_LENGTH = 80;
+export const PROVIDER_KEY_FRAGMENT_LENGTH = 4;
+/**
+ * MCP Connections — max 50 per tenant, name ≤ 80, URL ≤ 2048.
+ */
+export const MAX_MCP_CONNECTIONS_PER_TENANT = 50;
+export const MAX_MCP_CONNECTIONS_PER_AGENT = 10;
+export const MAX_MCP_CONNECTION_NAME_LENGTH = 80;
+export const MAX_MCP_CONNECTION_URL_LENGTH = 2048;
+export const MAX_MCP_BEARER_TOKEN_LENGTH = 8192;
+export const MAX_MCP_OAUTH_CLIENT_ID_LENGTH = 2048;
+export const MAX_MCP_OAUTH_CLIENT_SECRET_LENGTH = 8192;
+export const MAX_MCP_OAUTH_SCOPE_LENGTH = 2048;
+export const MAX_MCP_CONNECTION_TEST_LATENCY_MS = 60_000;
+export const MAX_MCP_SERVER_NAME_LENGTH = 200;
+export const MAX_MCP_SERVER_VERSION_LENGTH = 100;
+export const MAX_MCP_TOOL_NAME_LENGTH = 256;
+export const MAX_MCP_TOOLS_PER_CONNECTION = 128;
+export const MAX_MCP_TOOLS_PER_TURN = 256;
+export const MAX_MCP_CONNECTION_SETUP_CONCURRENCY = 4;
+export const MAX_MCP_TOOL_KEY_LENGTH = 63;
+export const MAX_MCP_TOOL_DEFINITION_BYTES = 256 * 1024;
+export const MAX_MCP_CONNECTION_TOOL_DEFINITIONS_BYTES = 1024 * 1024;
+export const MAX_MCP_TOOL_RESULT_BYTES = 1024 * 1024;
+export const MAX_MCP_ATTACHMENT_METADATA_KEYS = 32;
+export const MAX_MCP_ATTACHMENT_METADATA_KEY_LENGTH = 64;
+export const MAX_MCP_REQUEST_CONTEXT_BYTES = 16 * 1024;
+/** Agents — name ≤ 80, instructions ≤ 3000. */
+export const MAX_AGENT_NAME_LENGTH = 80;
+export const MAX_AGENT_INSTRUCTIONS_LENGTH = 3000;
+export const DEFAULT_AGENT_VERSIONS_LIST_LIMIT = 50;
+export const MAX_AGENT_VERSIONS_LIST_LIMIT = 200;
+/**
+ * Artifacts — 10 MiB per file, 10 publications per Tool call, and 100
+ * Artifacts per Session.
+ */
+export const MAX_ARTIFACT_BYTES = 10 * 1024 * 1024;
+export const MAX_ARTIFACT_PUBLICATIONS_PER_CALL = 10;
+export const MAX_ARTIFACTS_PER_SESSION = 100;
+/**
+ * Sandbox operations — 30-second native Cloudflare commands under a bounded
+ * private HTTP caller budget that includes cold Container startup. File
+ * transfers are 10 MiB decoded under a 15 MiB authenticated internal JSON
+ * request.
+ */
+export const CLOUDFLARE_SANDBOX_EXEC_MS = 30_000;
+export const MAX_SANDBOX_OPERATION_HTTP_MS = 160_000;
+export const MAX_SANDBOX_FILE_TRANSFER_BYTES = 10 * 1024 * 1024;
+export const MAX_SANDBOX_FILE_CHUNK_BYTES = 1024 * 1024;
+export const MAX_SANDBOX_REQUEST_BODY_BYTES = 15 * 1024 * 1024;
+/**
+ * Memories — one pool per Agent spanning all `userId` partitions, capped
+ * globally at 500 rows (LRU eviction on create), 10 KiB of text per memory
+ * (zod byte refine + DB `octet_length` check).
+ */
+export const MAX_MEMORIES_PER_AGENT = 500;
+export const MAX_MEMORY_TEXT_BYTES = 10 * 1024;
+export const DEFAULT_MEMORIES_LIST_LIMIT = 50;
+export const MAX_MEMORIES_LIST_LIMIT = 100;
+export const DEFAULT_MEMORY_TOOL_SEARCH_LIMIT = 10;
+export const MAX_MEMORY_TOOL_SEARCH_LIMIT = 20;
+/**
+ * Sessions — messages endpoint default limit 50, max 200.
+ */
+export const DEFAULT_SESSION_MESSAGES_LIMIT = 50;
+export const MAX_SESSION_MESSAGES_LIMIT = 200;
+/**
+ * Usage — range cap 31 days, default 30 days; top-N sessions default 50, max 200.
+ */
+export const MAX_USAGE_RANGE_DAYS = 31;
+export const DEFAULT_USAGE_RANGE_DAYS = 30;
+export const DEFAULT_USAGE_SESSION_TOP_N = 50;
+export const MAX_USAGE_SESSION_TOP_N = 200;
+// Quota — reset day between 1 and 28.
+export const MIN_QUOTA_RESET_DAY = 1;
+export const MAX_QUOTA_RESET_DAY = 28;
+/**
+ * Tenant (workspace) — display name ≤ 80, set via `PATCH /v1/tenant`.
+ */
+export const MAX_TENANT_NAME_LENGTH = 80;
+/**
+ * Tenant resource creation — provisional abuse-protection throughput, applied
+ * independently to Agent, Task, and Workspace creation.
+ */
+export const TENANT_CREATION_BURST_LIMIT = 60;
+export const TENANT_CREATION_BURST_WINDOW_MS = 60_000;
+export const TENANT_CREATION_SUSTAINED_LIMIT = 1000;
+export const TENANT_CREATION_SUSTAINED_WINDOW_MS = 86_400_000;

package/dist/contracts/utils.d.ts

@@ -0,0 +1,3 @@
+export declare const atLeastOneFieldMessage = "At least one field must be provided.";
+export declare function hasObjectKeys(value: object): boolean;
+export declare function hasUniqueValues(values: string[]): boolean;

package/dist/contracts/utils.js

@@ -0,0 +1,7 @@
+export const atLeastOneFieldMessage = "At least one field must be provided.";
+export function hasObjectKeys(value) {
+    return Object.keys(value).length > 0;
+}
+export function hasUniqueValues(values) {
+    return new Set(values).size === values.length;
+}

package/dist/errors.d.ts

@@ -0,0 +1,33 @@
+import type { BlazingAgentsErrorCode } from "./types.ts";
+declare const BLAZING_AGENTS_ERROR_SYMBOL: unique symbol;
+export declare class BlazingAgentsError extends Error {
+    readonly cause?: unknown;
+    readonly code: BlazingAgentsErrorCode;
+    readonly details?: Record<string, unknown>;
+    readonly headers?: Headers;
+    readonly param?: string;
+    readonly requestId?: string;
+    readonly responseBody?: string;
+    readonly responseBodyTruncated?: boolean;
+    readonly status?: number;
+    /**
+     * Marker property used by `isInstance` for cross-realm `instanceof`
+     * checks — the symbol is checked via `in`, not direct property access,
+     * so the linter can't see the read.
+     * biome-ignore lint/correctness/noUnusedPrivateClassMembers: marker pattern
+     */
+    private readonly [BLAZING_AGENTS_ERROR_SYMBOL];
+    constructor({ code, details, headers, message, param, requestId, responseBody, responseBodyTruncated, status, }: {
+        code: BlazingAgentsErrorCode;
+        details?: Record<string, unknown>;
+        headers?: Headers;
+        message: string;
+        param?: string;
+        requestId?: string;
+        responseBody?: string;
+        responseBodyTruncated?: boolean;
+        status?: number;
+    }, options?: ErrorOptions);
+    static isInstance(error: unknown): error is BlazingAgentsError;
+}
+export {};

package/dist/errors.js

@@ -0,0 +1,48 @@
+/**
+ * The SDK's single error class. Server codes remain open for forward
+ * compatibility; SDK-local codes distinguish transport, response, abort, and
+ * streaming failures.
+ *
+ * `isInstance` uses the AI SDK's `Symbol.for` marker pattern so it
+ * survives duplicated package copies across realms/bundlers.
+ */
+const BLAZING_AGENTS_ERROR_NAME = "BlazingAgentsError";
+const BLAZING_AGENTS_ERROR_MARKER = "blazing-agents.error.BlazingAgentsError";
+const BLAZING_AGENTS_ERROR_SYMBOL = Symbol.for(BLAZING_AGENTS_ERROR_MARKER);
+export class BlazingAgentsError extends Error {
+    code;
+    details;
+    headers;
+    param;
+    requestId;
+    responseBody;
+    responseBodyTruncated;
+    status;
+    // Stryker disable BooleanLiteral: cross-realm identity depends on marker presence, not its value.
+    /**
+     * Marker property used by `isInstance` for cross-realm `instanceof`
+     * checks — the symbol is checked via `in`, not direct property access,
+     * so the linter can't see the read.
+     * biome-ignore lint/correctness/noUnusedPrivateClassMembers: marker pattern
+     */
+    [BLAZING_AGENTS_ERROR_SYMBOL] = true;
+    // Stryker restore BooleanLiteral
+    constructor({ code, details, headers, message, param, requestId, responseBody, responseBodyTruncated, status, }, options) {
+        super(message, options);
+        this.name = BLAZING_AGENTS_ERROR_NAME;
+        this.code = code;
+        this.details = details;
+        this.headers = headers;
+        this.param = param;
+        this.requestId = requestId;
+        this.responseBody = responseBody;
+        this.responseBodyTruncated = responseBodyTruncated;
+        this.status = status;
+    }
+    static isInstance(error) {
+        if (error === null || typeof error !== "object") {
+            return false;
+        }
+        return BLAZING_AGENTS_ERROR_SYMBOL in error;
+    }
+}

package/dist/generation.d.ts

@@ -0,0 +1,5 @@
+import type { ChatInput, ChatResult, CompletionInput, CompletionResult, HttpConfig, ObjectInput, ObjectResult, TerminalStreamResult } from "./types.ts";
+export declare function chat(config: HttpConfig, input: ChatInput): Promise<ChatResult>;
+export declare function buildTerminalStreamResult(response: Response, resourceName: string): TerminalStreamResult;
+export declare function completion(config: HttpConfig, input: CompletionInput): Promise<CompletionResult>;
+export declare function objectGeneration(config: HttpConfig, input: ObjectInput): Promise<ObjectResult>;