@boxrouter/sdk 0.0.0-stage → 0.12.190

package/dist/namespace-provider_accounts.mjs

@@ -0,0 +1,241 @@
+import { HeyApiClient } from './namespace-base.mjs';
+export class ProviderAccounts extends HeyApiClient {
+    /**
+     * List connected accounts
+     *
+     * Requires `provider-accounts:manage` on API keys; dashboard browser sessions are also
+     * authorized. Returns your workspace's account metadata and the list of providers enabled for you;
+     * it never returns stored credentials.
+     *
+     */
+    list(options) {
+        return (options?.client ?? this.client).get({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/provider-accounts',
+            ...options
+        });
+    }
+    /**
+     * Connect a provider account
+     *
+     * Saves your own provider credentials so BoxRouter can run sandboxes on that account. Needs
+     * the `provider-accounts:manage` permission on the API key; a signed-in dashboard session also
+     * works. This permission is separate from the access that creates sandboxes.
+     *
+     * BoxRouter first makes one read-only request to the provider with the credentials. A clear
+     * rejection fails with `422 credentials_rejected`; an unreachable provider or an inconclusive
+     * answer does not block the save. The credentials are then stored encrypted and never
+     * returned. The account is enabled at once. Connecting starts no sandbox and prepares
+     * nothing in your provider account: the first sandbox that needs the standard image
+     * prepares it, or run the standard image setup to prepare it now.
+     *
+     * If the key matches one you already connected (same provider, settings and last four
+     * characters), the account is still connected and the response carries a
+     * `duplicate_credential` warning naming the other account. Connecting or testing an account
+     * whose provider is not enabled for you fails with `409 provider_not_enabled`.
+     *
+     * Provider connection settings, such as a custom URL or proxy, and credentials that run your
+     * code need extra authority on the key. Submitting a URL or proxy does not by itself give
+     * BoxRouter network access to that host. For credentials that run your code, send the ID of an
+     * artifact you uploaded; an unknown or expired artifact fails with `404`. The response
+     * returns account metadata only, never the code, configuration or tokens. Sending the same
+     * request again reuses the recorded outcome, and a request still waiting on the provider
+     * fails with `409` instead of running your code a second time.
+     *
+     * If the provider later answers with `401` or `403`, the account's status becomes
+     * `credentials_rejected`; the status carries a safe cause and the action that restores access.
+     *
+     */
+    connect(options) {
+        return (options.client ?? this.client).post({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/provider-accounts',
+            ...options,
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers
+            }
+        });
+    }
+    /**
+     * Test provider credentials without saving them
+     *
+     * Checks credentials without saving them. Needs the `provider-accounts:manage` permission on
+     * the API key; a signed-in dashboard session also works. BoxRouter makes the same read-only
+     * request to the provider as when it tests a saved account, using the credentials in the body.
+     * Nothing is stored and no account is created or changed, so no idempotency key is needed.
+     *
+     * Credentials that run your code are not accepted here. Connection settings, such as a custom
+     * URL, are accepted and choose where the request goes; they need extra authority on the key,
+     * and submitting a URL or proxy does not by itself give BoxRouter network access to that host.
+     * The response returns the provider's own status and body, up to 4096 characters, without
+     * adding a validation message.
+     *
+     * Fails with `409 provider_not_enabled` when this provider is not enabled for you.
+     *
+     */
+    testCredentials(options) {
+        return (options.client ?? this.client).post({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/provider-accounts/test',
+            ...options,
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers
+            }
+        });
+    }
+    /**
+     * Remove a connected account
+     *
+     * Requires `provider-accounts:manage` on API keys; dashboard browser sessions are also
+     * authorized. Reject with 409 while owned
+     * resources, pending mutations or unresolved cleanup still depend on this
+     * credential. Never orphan sandboxes silently or transfer them to managed
+     * billing. Removes the stored secret; does not revoke the upstream token.
+     * For callable credentials, close all unreferenced factory workers and remove
+     * their retained code/configuration and acquired secrets. Pending acquisitions
+     * and retained credential-version dependencies also prevent disconnection.
+     *
+     * Removal waits for work already running on the account (standard-image setup,
+     * Actions runner-image checks), which can take minutes. With `wait=false` the
+     * request returns 202 at once with the account and `disconnect.state:
+     * disconnecting`, and finishes in the background: read the account until it
+     * returns 404 (removed) or `disconnect.state: failed`, whose `error` is the
+     * refusal this request would otherwise have returned, with the account still
+     * connected. Repeating the request while a removal runs returns the same 202 and
+     * starts nothing new.
+     *
+     */
+    disconnect(options) {
+        return (options.client ?? this.client).delete({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/provider-accounts/{account_id}',
+            ...options
+        });
+    }
+    /**
+     * Get connected-account metadata
+     *
+     * Requires `provider-accounts:manage` on API keys; dashboard browser sessions are also
+     * authorized. The account must be visible within the caller's workspace. Never reveals
+     * key material.
+     *
+     */
+    get(options) {
+        return (options.client ?? this.client).get({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/provider-accounts/{account_id}',
+            ...options
+        });
+    }
+    /**
+     * Rotate a connected account's credentials
+     *
+     * Replaces a connected account's credentials, for example to rotate a key. Needs the
+     * `provider-accounts:manage` permission on the API key (a signed-in dashboard session also
+     * works) and the account's current `expected_version`.
+     *
+     * The new credentials must belong to the same provider. BoxRouter makes one read-only request
+     * to the provider and refuses a clear rejection with `422 credentials_rejected`; it does not
+     * check which account the key belongs to. Requests already running keep the old credentials,
+     * and requests that start afterward use the new ones. A provider that is not enabled for you
+     * fails with `409 provider_not_enabled`.
+     *
+     * Leave out the connection settings to keep the existing ones. Settings you send must match the
+     * existing route; changing the endpoint, proxy or header identity needs a new connected
+     * account, not a key rotation. Credentials that run your code need extra authority on the key
+     * and an artifact you uploaded. If the new credentials fail to activate, the old version stays
+     * in use. A token refresh that already happened with the provider is not undone.
+     *
+     */
+    replaceCredentials(options) {
+        return (options.client ?? this.client).put({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/provider-accounts/{account_id}/credentials',
+            ...options,
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers
+            }
+        });
+    }
+    /**
+     * Test a saved provider account
+     *
+     * Requires `provider-accounts:manage` on API keys; dashboard browser sessions are also
+     * authorized. The credential check makes one read-only provider request using the saved
+     * credentials and returns the provider's native status and body, limited to 4096 characters.
+     * A successful test can update account health and register provider event webhooks. It
+     * starts no sandbox and prepares no image; run the standard image setup to prepare the
+     * standard image before the first sandbox needs it. The response reports the credential
+     * check.
+     * Fails with `409 provider_not_enabled` when this provider is not enabled for you.
+     *
+     */
+    test(options) {
+        return (options.client ?? this.client).post({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/provider-accounts/{account_id}/test',
+            ...options
+        });
+    }
+    /**
+     * Run the standard image setup proof
+     *
+     * Requires `provider-accounts:manage` on API keys; dashboard browser sessions are also
+     * authorized. This explicit action first tests the saved key, then boots the provider's
+     * standard image, runs a bounded command, and destroys the proof sandbox. The provider
+     * may charge for that short sandbox. Readiness is recorded only after boot, command and
+     * cleanup succeed; failure returns the unavailable state and its setup fix. Requests are
+     * idempotent and must include an idempotency key.
+     *
+     */
+    setupStandardImage(options) {
+        return (options.client ?? this.client).post({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/provider-accounts/{account_id}/standard-image/setup',
+            ...options
+        });
+    }
+}

package/dist/namespace-providers.d.mts

@@ -0,0 +1,28 @@
+import type { Client, ClientMeta, Options as Options2, RequestResult, TDataShape } from './client/index.js';
+import { HeyApiClient } from './namespace-base.mjs';
+import type { ProvidersListData, ProvidersListErrors, ProvidersListResponses } from './types.gen.js';
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
+    /**
+     * You can provide a client instance returned by `createClient()` instead of
+     * individual options. This might be also useful if you want to implement a
+     * custom client.
+     */
+    client?: Client;
+    /**
+     * You can pass arbitrary values through the `meta` object. This can be
+     * used to access values that aren't defined as part of the SDK function.
+     */
+    meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;
+};
+export declare class Providers extends HeyApiClient {
+    /**
+     * List available provider routes
+     *
+     * Returns only supply visible to the caller, including account-specific
+     * entitlements and limits. This is a point-in-time eligibility view, not a
+     * capacity reservation. Unknown or unverified capability guarantees are not
+     * advertised as supported. Server-side eligibility is rechecked at creation.
+     *
+     */
+    list<ThrowOnError extends boolean = true>(options?: Options<ProvidersListData, ThrowOnError>): RequestResult<ProvidersListResponses, ProvidersListErrors, ThrowOnError, 'data'>;
+}

package/dist/namespace-providers.mjs

@@ -0,0 +1,24 @@
+import { HeyApiClient } from './namespace-base.mjs';
+export class Providers extends HeyApiClient {
+    /**
+     * List available provider routes
+     *
+     * Returns only supply visible to the caller, including account-specific
+     * entitlements and limits. This is a point-in-time eligibility view, not a
+     * capacity reservation. Unknown or unverified capability guarantees are not
+     * advertised as supported. Server-side eligibility is rechecked at creation.
+     *
+     */
+    list(options) {
+        return (options?.client ?? this.client).get({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/providers',
+            ...options
+        });
+    }
+}

package/dist/namespace-routing.d.mts

@@ -0,0 +1,64 @@
+import type { Client, ClientMeta, Options as Options2, RequestResult, TDataShape } from './client/index.js';
+import { HeyApiClient } from './namespace-base.mjs';
+import type { RoutingPreviewData, RoutingPreviewErrors, RoutingPreviewResponses, RoutingSettingsData, RoutingSettingsErrors, RoutingSettingsResponses, RoutingUpdateSettingsData, RoutingUpdateSettingsErrors, RoutingUpdateSettingsResponses } from './types.gen.js';
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
+    /**
+     * You can provide a client instance returned by `createClient()` instead of
+     * individual options. This might be also useful if you want to implement a
+     * custom client.
+     */
+    client?: Client;
+    /**
+     * You can pass arbitrary values through the `meta` object. This can be
+     * used to access values that aren't defined as part of the SDK function.
+     */
+    meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;
+};
+export declare class Routing extends HeyApiClient {
+    /**
+     * Read workspace routing and provider funding
+     *
+     * Workspace read authority required. Returns each independently versioned section
+     * and its opaque ETag in section_etags. Never returns credentials. The GET itself
+     * has no whole-document validator; send a chosen section's token in If-Match to
+     * guard a write to that section.
+     * On a workspace's first read, the server atomically creates sections from its
+     * legacy funding state. Concurrent first reads return the same persisted sections
+     * and ETags. Later reads do not change settings unless a supported provider,
+     * managed offer or connected account changed and needs reconciliation; only a
+     * section that actually changes advances its ETag. The saved Prevent Overrides
+     * switch is retained across reads.
+     *
+     */
+    settings<ThrowOnError extends boolean = true>(options?: Options<RoutingSettingsData, ThrowOnError>): RequestResult<RoutingSettingsResponses, RoutingSettingsErrors, ThrowOnError, 'data'>;
+    /**
+     * Update one workspace routing section
+     *
+     * Workspace admin (or provider-accounts:manage for provider funding) required;
+     * browser mutations also require Origin and X-CSRF-Token. The body names exactly
+     * one section: routing fields or one provider funding section. Send only the fields
+     * to change; every omitted field keeps its stored value, and the merged section is
+     * validated as a complete section before it is written. If-Match is optional. When
+     * sent, it must be the opaque token returned for THAT section by GET or the call
+     * fails 412 with no write; when omitted, the named fields are written to the
+     * current section. Atomically update only the named section and advance only its
+     * ETag. A stale token for that same section returns 412 with no write; a concurrent
+     * Routing edit cannot conflict with provider funding, and edits to distinct
+     * providers cannot conflict with one another. Reject duplicate account IDs,
+     * foreign/wrong-provider accounts and newly enabled Credits on unavailable managed
+     * providers before writing. Adding a key does not change provider exclusion.
+     * Identical idempotency replay returns the previously recorded response, not a
+     * second write.
+     *
+     */
+    updateSettings<ThrowOnError extends boolean = true>(options: Options<RoutingUpdateSettingsData, ThrowOnError>): RequestResult<RoutingUpdateSettingsResponses, RoutingUpdateSettingsErrors, ThrowOnError, 'data'>;
+    /**
+     * Preview workspace route availability without dispatch
+     *
+     * Workspace read authority required. Side-effect-free current eligibility and
+     * versioned hold quotes from admission. No next-job prediction, workspace spend
+     * cap or promise that a later create can start. No secret or foreign balance.
+     *
+     */
+    preview<ThrowOnError extends boolean = true>(options?: Options<RoutingPreviewData, ThrowOnError>): RequestResult<RoutingPreviewResponses, RoutingPreviewErrors, ThrowOnError, 'data'>;
+}

package/dist/namespace-routing.mjs

@@ -0,0 +1,86 @@
+import { HeyApiClient } from './namespace-base.mjs';
+export class Routing extends HeyApiClient {
+    /**
+     * Read workspace routing and provider funding
+     *
+     * Workspace read authority required. Returns each independently versioned section
+     * and its opaque ETag in section_etags. Never returns credentials. The GET itself
+     * has no whole-document validator; send a chosen section's token in If-Match to
+     * guard a write to that section.
+     * On a workspace's first read, the server atomically creates sections from its
+     * legacy funding state. Concurrent first reads return the same persisted sections
+     * and ETags. Later reads do not change settings unless a supported provider,
+     * managed offer or connected account changed and needs reconciliation; only a
+     * section that actually changes advances its ETag. The saved Prevent Overrides
+     * switch is retained across reads.
+     *
+     */
+    settings(options) {
+        return (options?.client ?? this.client).get({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/routing/settings',
+            ...options
+        });
+    }
+    /**
+     * Update one workspace routing section
+     *
+     * Workspace admin (or provider-accounts:manage for provider funding) required;
+     * browser mutations also require Origin and X-CSRF-Token. The body names exactly
+     * one section: routing fields or one provider funding section. Send only the fields
+     * to change; every omitted field keeps its stored value, and the merged section is
+     * validated as a complete section before it is written. If-Match is optional. When
+     * sent, it must be the opaque token returned for THAT section by GET or the call
+     * fails 412 with no write; when omitted, the named fields are written to the
+     * current section. Atomically update only the named section and advance only its
+     * ETag. A stale token for that same section returns 412 with no write; a concurrent
+     * Routing edit cannot conflict with provider funding, and edits to distinct
+     * providers cannot conflict with one another. Reject duplicate account IDs,
+     * foreign/wrong-provider accounts and newly enabled Credits on unavailable managed
+     * providers before writing. Adding a key does not change provider exclusion.
+     * Identical idempotency replay returns the previously recorded response, not a
+     * second write.
+     *
+     */
+    updateSettings(options) {
+        return (options.client ?? this.client).put({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/routing/settings',
+            ...options,
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers
+            }
+        });
+    }
+    /**
+     * Preview workspace route availability without dispatch
+     *
+     * Workspace read authority required. Side-effect-free current eligibility and
+     * versioned hold quotes from admission. No next-job prediction, workspace spend
+     * cap or promise that a later create can start. No secret or foreign balance.
+     *
+     */
+    preview(options) {
+        return (options?.client ?? this.client).get({
+            responseStyle: 'data',
+            security: [{ scheme: 'bearer', type: 'http' }, {
+                    in: 'cookie',
+                    name: '__Host-boxrouter_session',
+                    type: 'apiKey'
+                }],
+            url: '/routing/preview',
+            ...options
+        });
+    }
+}