@blazingagents/sdk 0.35.0 → 0.36.0

package/dist/http.js

@@ -4,6 +4,22 @@ const DIAGNOSTIC_BODY_LIMIT_BYTES = 64 * 1024;
 const INVALID_RESPONSE_MESSAGE = "The server returned an invalid response.";
 const NETWORK_ERROR_MESSAGE = "Network request failed (fetch threw before any HTTP exchange).";
 const REQUEST_ABORTED_MESSAGE = "The request was aborted before any HTTP response.";
+/** Fields no credential-bearing operation's response may contain. */
+const CREDENTIAL_KEYS = new Set([
+    "apiKey",
+    "api_key",
+    "botToken",
+    "bot_token",
+    "signingSecret",
+    "signing_secret",
+    "webhookSecret",
+    "webhook_secret",
+    "bearerToken",
+    "bearer_token",
+    "clientSecret",
+    "client_secret",
+    "credential",
+]);
 const DOT_OR_EMPTY_SEGMENTS = new Set(["", ".", ".."]);
 /**
  * Builds an endpoint path, encoding each interpolated value so it stays inside
@@ -70,14 +86,59 @@ export async function requestJson(config, path, options = {}, schema) {
         }
         throw invalidResponseError(headers, response.status, read.diagnosticBody, true, read.cause);
     }
+    let json;
+    try {
+        json = JSON.parse(read.bodyText);
+    }
+    catch (cause) {
+        throw invalidResponseError(headers, response.status, read.diagnosticBody, read.diagnosticBodyTruncated, cause);
+    }
+    const echoed = options.credentialBearing
+        ? findCredentialKey(json)
+        : undefined;
+    if (echoed !== undefined) {
+        throw new BlazingAgentsError({
+            code: "credential_echo",
+            details: { field: echoed },
+            headers,
+            message: `The server echoed credential field ${JSON.stringify(echoed)}; the response body was discarded.`,
+            requestId: headers.get("x-request-id") ?? undefined,
+            status: response.status,
+        });
+    }
     try {
-        const json = JSON.parse(read.bodyText);
         return schema === undefined ? json : schema.parse(json);
     }
     catch (cause) {
         throw invalidResponseError(headers, response.status, read.diagnosticBody, read.diagnosticBodyTruncated, cause);
     }
 }
+/**
+ * Returns the first credential field found anywhere in a decoded JSON value.
+ */
+function findCredentialKey(value) {
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            const key = findCredentialKey(item);
+            if (key !== undefined) {
+                return key;
+            }
+        }
+        return;
+    }
+    if (value === null || typeof value !== "object") {
+        return;
+    }
+    for (const [key, item] of Object.entries(value)) {
+        if (CREDENTIAL_KEYS.has(key)) {
+            return key;
+        }
+        const nested = findCredentialKey(item);
+        if (nested !== undefined) {
+            return nested;
+        }
+    }
+}
 /**
  * Performs a request and returns the raw `Response` for streaming paths.
  * Non-2xx bodies are decoded before a caller can observe a streaming body.

package/dist/resources/chat-connections.js

@@ -8,37 +8,57 @@ import { apiPath, requestJson } from "../http.js";
 export function createChatConnectionsResource(config) {
     return {
         async list({ abortSignal } = {}) {
-            return await requestJson(config, "/v1/chat-connections", { signal: abortSignal }, chatConnectionsResponseSchema);
+            return await requestJson(config, "/v1/chat-connections", { credentialBearing: true, signal: abortSignal }, chatConnectionsResponseSchema);
         },
         async create({ abortSignal, ...body }) {
-            return await requestJson(config, "/v1/chat-connections", { signal: abortSignal, method: "POST", json: body }, chatConnectionSchema);
+            return await requestJson(config, "/v1/chat-connections", {
+                credentialBearing: true,
+                signal: abortSignal,
+                method: "POST",
+                json: body,
+            }, chatConnectionSchema);
         },
         async get({ chatConnectionId, abortSignal }) {
-            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}`, { signal: abortSignal, method: "GET" }, chatConnectionSchema);
+            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}`, { credentialBearing: true, signal: abortSignal, method: "GET" }, chatConnectionSchema);
         },
         async update({ chatConnectionId, abortSignal, ...body }) {
-            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}`, { signal: abortSignal, method: "PATCH", json: body }, chatConnectionSchema);
+            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}`, {
+                credentialBearing: true,
+                signal: abortSignal,
+                method: "PATCH",
+                json: body,
+            }, chatConnectionSchema);
         },
         async rotateCredentials({ chatConnectionId, abortSignal, ...body }) {
-            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}/credentials`, { signal: abortSignal, method: "POST", json: body }, chatConnectionSchema);
+            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}/credentials`, {
+                credentialBearing: true,
+                signal: abortSignal,
+                method: "POST",
+                json: body,
+            }, chatConnectionSchema);
         },
         async checkHealth({ chatConnectionId, abortSignal }) {
-            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}/health`, { signal: abortSignal, method: "POST" }, chatConnectionSchema);
+            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}/health`, { credentialBearing: true, signal: abortSignal, method: "POST" }, chatConnectionSchema);
         },
         async listDeliveries({ chatConnectionId, abortSignal, ...query }) {
-            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}/deliveries`, { signal: abortSignal, query }, chatDeliveryListSchema);
+            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}/deliveries`, { credentialBearing: true, signal: abortSignal, query }, chatDeliveryListSchema);
         },
         async repairDelivery({ chatConnectionId, deliveryId, abortSignal, ...body }) {
-            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}/deliveries/${deliveryId}/repair`, { signal: abortSignal, method: "POST", json: body }, chatDeliveryResultSchema);
+            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}/deliveries/${deliveryId}/repair`, {
+                credentialBearing: true,
+                signal: abortSignal,
+                method: "POST",
+                json: body,
+            }, chatDeliveryResultSchema);
         },
         async enable({ chatConnectionId, abortSignal }) {
-            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}/enable`, { signal: abortSignal, method: "POST" }, chatConnectionSchema);
+            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}/enable`, { credentialBearing: true, signal: abortSignal, method: "POST" }, chatConnectionSchema);
         },
         async disable({ chatConnectionId, abortSignal }) {
-            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}/disable`, { signal: abortSignal, method: "POST" }, chatConnectionSchema);
+            return await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}/disable`, { credentialBearing: true, signal: abortSignal, method: "POST" }, chatConnectionSchema);
         },
         async delete({ chatConnectionId, abortSignal }) {
-            await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}`, { signal: abortSignal, method: "DELETE" });
+            await requestJson(config, apiPath `/v1/chat-connections/${chatConnectionId}`, { credentialBearing: true, signal: abortSignal, method: "DELETE" });
         },
     };
 }

package/dist/resources/chat-deliveries.js

@@ -15,6 +15,7 @@ export function createChatDeliveriesResource(config) {
                     // Multi-value filters serialize as one comma-separated parameter.
                     status: status?.length ? status.join(",") : undefined,
                 },
+                credentialBearing: true,
                 signal: abortSignal,
             }, chatDeliveriesResponseSchema);
         },

package/dist/resources/mcp-connections.js

@@ -8,20 +8,22 @@ import { apiPath, requestJson } from "../http.js";
 export function createMcpConnectionsResource(config) {
     const create = (async ({ abortSignal, ...body }) => requestJson(config, "/v1/mcp-connections", {
         json: body,
+        credentialBearing: true,
         signal: abortSignal,
         method: "POST",
     }, mcpConnectionResponseSchema));
     return {
         create,
         async list({ abortSignal } = {}) {
-            return await requestJson(config, "/v1/mcp-connections", { signal: abortSignal }, mcpConnectionsResponseSchema);
+            return await requestJson(config, "/v1/mcp-connections", { credentialBearing: true, signal: abortSignal }, mcpConnectionsResponseSchema);
         },
         async get({ mcpConnectionId, abortSignal }) {
-            return await requestJson(config, apiPath `/v1/mcp-connections/${mcpConnectionId}`, { signal: abortSignal }, mcpConnectionResponseSchema);
+            return await requestJson(config, apiPath `/v1/mcp-connections/${mcpConnectionId}`, { credentialBearing: true, signal: abortSignal }, mcpConnectionResponseSchema);
         },
         async update({ mcpConnectionId, abortSignal, ...body }) {
             return await requestJson(config, apiPath `/v1/mcp-connections/${mcpConnectionId}`, {
                 json: body,
+                credentialBearing: true,
                 signal: abortSignal,
                 method: "PATCH",
             }, mcpConnectionResponseSchema);
@@ -29,15 +31,17 @@ export function createMcpConnectionsResource(config) {
         async delete({ mcpConnectionId, abortSignal }) {
             await requestJson(config, apiPath `/v1/mcp-connections/${mcpConnectionId}`, {
                 method: "DELETE",
+                credentialBearing: true,
                 signal: abortSignal,
             });
         },
         async test({ mcpConnectionId, abortSignal }) {
-            return await requestJson(config, apiPath `/v1/mcp-connections/${mcpConnectionId}/test`, { method: "POST", signal: abortSignal }, mcpConnectionTestResponseSchema);
+            return await requestJson(config, apiPath `/v1/mcp-connections/${mcpConnectionId}/test`, { method: "POST", credentialBearing: true, signal: abortSignal }, mcpConnectionTestResponseSchema);
         },
         async reconnect({ mcpConnectionId, abortSignal, ...body }) {
             return await requestJson(config, apiPath `/v1/mcp-connections/${mcpConnectionId}/reconnect`, {
                 json: body,
+                credentialBearing: true,
                 signal: abortSignal,
                 method: "POST",
             }, mcpConnectionReconnectResultSchema);

package/dist/resources/merchant-connection.js

@@ -10,17 +10,28 @@ import { requestJson } from "../http.js";
 export function createMerchantConnectionResource(config) {
     return {
         async get({ abortSignal } = {}) {
-            return await requestJson(config, "/v1/merchant-connection", { signal: abortSignal }, merchantConnectionResponseSchema);
+            return await requestJson(config, "/v1/merchant-connection", { credentialBearing: true, signal: abortSignal }, merchantConnectionResponseSchema);
         },
         async create({ abortSignal, ...body }) {
-            return await requestJson(config, "/v1/merchant-connection", { json: body, method: "POST", signal: abortSignal }, merchantConnectionResponseSchema);
+            return await requestJson(config, "/v1/merchant-connection", {
+                json: body,
+                method: "POST",
+                credentialBearing: true,
+                signal: abortSignal,
+            }, merchantConnectionResponseSchema);
         },
         async update({ abortSignal, ...body }) {
-            return await requestJson(config, "/v1/merchant-connection", { json: body, method: "PATCH", signal: abortSignal }, merchantConnectionResponseSchema);
+            return await requestJson(config, "/v1/merchant-connection", {
+                json: body,
+                method: "PATCH",
+                credentialBearing: true,
+                signal: abortSignal,
+            }, merchantConnectionResponseSchema);
         },
         async retire({ abortSignal } = {}) {
             await requestJson(config, "/v1/merchant-connection", {
                 method: "DELETE",
+                credentialBearing: true,
                 signal: abortSignal,
             });
         },

package/dist/resources/providers.js

@@ -10,25 +10,27 @@ export function createProvidersResource(config) {
         async create({ abortSignal, ...body }) {
             return await requestJson(config, "/v1/providers", {
                 json: body,
+                credentialBearing: true,
                 signal: abortSignal,
                 method: "POST",
             }, providerResponseSchema);
         },
         async list({ abortSignal } = {}) {
-            return await requestJson(config, "/v1/providers", { signal: abortSignal }, providersResponseSchema);
+            return await requestJson(config, "/v1/providers", { credentialBearing: true, signal: abortSignal }, providersResponseSchema);
         },
         async get({ providerId, abortSignal }) {
-            return await requestJson(config, apiPath `/v1/providers/${providerId}`, { signal: abortSignal }, providerResponseSchema);
+            return await requestJson(config, apiPath `/v1/providers/${providerId}`, { credentialBearing: true, signal: abortSignal }, providerResponseSchema);
         },
         async listModels({ providerId, abortSignal }) {
-            return await requestJson(config, apiPath `/v1/providers/${providerId}/models`, { signal: abortSignal }, providerModelsResponseSchema);
+            return await requestJson(config, apiPath `/v1/providers/${providerId}/models`, { credentialBearing: true, signal: abortSignal }, providerModelsResponseSchema);
         },
         async getThinkingLevels({ providerId, model, abortSignal }) {
-            return await requestJson(config, apiPath `/v1/providers/${providerId}/thinking-levels`, { signal: abortSignal, query: { model } }, thinkingLevelsResponseSchema);
+            return await requestJson(config, apiPath `/v1/providers/${providerId}/thinking-levels`, { credentialBearing: true, signal: abortSignal, query: { model } }, thinkingLevelsResponseSchema);
         },
         async update({ providerId, abortSignal, ...body }) {
             return await requestJson(config, apiPath `/v1/providers/${providerId}`, {
                 json: body,
+                credentialBearing: true,
                 signal: abortSignal,
                 method: "PATCH",
             }, providerResponseSchema);
@@ -36,6 +38,7 @@ export function createProvidersResource(config) {
         async delete({ providerId, abortSignal, ...options }) {
             await requestJson(config, apiPath `/v1/providers/${providerId}`, {
                 method: "DELETE",
+                credentialBearing: true,
                 signal: abortSignal,
                 query: {
                     confirmSnapshotInvalidation: options.confirmSnapshotInvalidation,

package/dist/types.d.ts

@@ -13,7 +13,7 @@ import type { AgentSkillsResource } from "./resources/skills.ts";
 import type { TasksResource } from "./resources/tasks.ts";
 import type { UsageResource } from "./resources/usage.ts";
 import type { WorkspacesResource } from "./resources/workspaces.ts";
-export type KnownBlazingAgentsErrorCode = ApiErrorCode | "invalid_response" | "network_error" | "request_aborted" | "stream_error";
+export type KnownBlazingAgentsErrorCode = ApiErrorCode | "credential_echo" | "invalid_response" | "network_error" | "request_aborted" | "stream_error";
 export type BlazingAgentsErrorCode = KnownBlazingAgentsErrorCode | (string & {});
 export type BlazingAgentsFetch = (input: string, init?: BlazingAgentsRequestInit) => Promise<Response>;
 export interface BlazingAgentsRequestInit extends RequestInit {
@@ -23,6 +23,11 @@ export interface BlazingAgentsRequestInit extends RequestInit {
 export interface RequestOptions {
     body?: BodyInit | FormData | null;
     clientRequestId?: string | undefined;
+    /**
+     * Set on operations the contract marks `x-credential-bearing`: a 2xx JSON
+     * body that contains a credential field is discarded and rejected.
+     */
+    credentialBearing?: true;
     /**
      * Extra headers (e.g. `Content-Type: multipart/form-data` is set
      * automatically by `fetch` when given a `FormData` body).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blazingagents/sdk",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "description": "TypeScript SDK for the Blazing Agents API",
   "homepage": "https://docs.blazingagents.com",
   "bugs": {
@@ -29,7 +29,6 @@
     "README.md"
   ],
   "scripts": {
-    "agent-tools:json": "node scripts/write-agent-tools-json.ts",
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
     "check": "npm run typecheck && npm run test && npm run lint && npm run unused",
     "fix": "ultracite fix",