@cadraos/sdk 0.1.7 → 0.1.9

package/dist/chat/index.d.cts

@@ -1114,14 +1114,62 @@ interface ChatAdapter {
     /**
      * Get the SSE stream URL for an execution.
      *
-     * @deprecated Prefer implementing `createStream` which provides
-     * fetch-based SSE with auth headers. This is kept for backward
-     * compatibility with EventSource-based streaming.
+     * @deprecated Use `subscribeToStream` instead which provides secure
+     * header-based auth. This method exposes API keys in URLs which are
+     * logged by browsers, proxies, and servers.
      *
      * @param executionId - Execution UUID
      * @returns Full URL for SSE connection
      */
     getStreamUrl?(executionId: string): string;
+    /**
+     * Subscribe to SSE stream for an execution using header-based auth.
+     *
+     * Uses @microsoft/fetch-event-source for SSE with Authorization header.
+     * This is the secure alternative to getStreamUrl() which exposed API keys
+     * in URLs.
+     *
+     * @param executionId - Execution UUID to stream
+     * @param callbacks - Event callbacks
+     * @returns Cleanup function to unsubscribe
+     *
+     * @example
+     * ```typescript
+     * const unsubscribe = adapter.subscribeToStream(executionId, {
+     *   onEvent: (event) => console.log(event),
+     *   onError: (error) => console.error(error),
+     *   onComplete: () => console.log('Done'),
+     * });
+     *
+     * // Later, to stop streaming:
+     * unsubscribe();
+     * ```
+     */
+    subscribeToStream?(executionId: string, callbacks: StreamSubscriptionCallbacks): () => void;
+}
+/**
+ * SSE event received from the stream
+ */
+interface StreamEvent {
+    /** Event type (progress, tool_call, complete, failed, etc.) */
+    type: string;
+    /** Event ID for reconnection */
+    id?: string;
+    /** Event data payload */
+    data: unknown;
+}
+/**
+ * Callbacks for subscribeToStream
+ */
+interface StreamSubscriptionCallbacks {
+    /** Called for each SSE event received */
+    onEvent: (event: StreamEvent) => void;
+    /** Called when an error occurs */
+    onError?: (error: Error) => void;
+    /** Called when the stream completes (terminal event received) */
+    onComplete?: () => void;
+    /** Called when connection state changes */
+    onConnectionChange?: (connected: boolean) => void;
 }
 
 interface AgentChatProps {
@@ -2725,9 +2773,9 @@ declare class AISaaSClient {
 }
 
 /**
- * Default adapter for ChatAdapter — thin wrapper around AISaaSClient
+ * Default adapter for ChatAdapter — thin wrapper around CadraClient
  *
- * Uses the AISaaSClient for all operations, providing proper auth,
+ * Uses the CadraClient for all operations, providing proper auth,
  * retries, and streaming support out of the box.
  *
  * @module @cadraos/sdk/chat
@@ -2738,7 +2786,7 @@ declare class AISaaSClient {
  */
 interface DefaultAdapterConfig {
     /**
-     * Pre-constructed AISaaSClient (takes priority over individual options)
+     * Pre-constructed CadraClient (takes priority over individual options)
      */
     client?: AISaaSClient;
     /**
@@ -2764,10 +2812,10 @@ interface DefaultAdapterConfig {
     orgId?: number;
 }
 /**
- * Create a default adapter that wraps AISaaSClient
+ * Create a default adapter that wraps CadraClient
  *
  * @param config - Adapter configuration
- * @returns ChatAdapter implementation backed by AISaaSClient
+ * @returns ChatAdapter implementation backed by CadraClient
  *
  * @example
  * ```typescript

package/dist/chat/index.d.ts

@@ -1114,14 +1114,62 @@ interface ChatAdapter {
     /**
      * Get the SSE stream URL for an execution.
      *
-     * @deprecated Prefer implementing `createStream` which provides
-     * fetch-based SSE with auth headers. This is kept for backward
-     * compatibility with EventSource-based streaming.
+     * @deprecated Use `subscribeToStream` instead which provides secure
+     * header-based auth. This method exposes API keys in URLs which are
+     * logged by browsers, proxies, and servers.
      *
      * @param executionId - Execution UUID
      * @returns Full URL for SSE connection
      */
     getStreamUrl?(executionId: string): string;
+    /**
+     * Subscribe to SSE stream for an execution using header-based auth.
+     *
+     * Uses @microsoft/fetch-event-source for SSE with Authorization header.
+     * This is the secure alternative to getStreamUrl() which exposed API keys
+     * in URLs.
+     *
+     * @param executionId - Execution UUID to stream
+     * @param callbacks - Event callbacks
+     * @returns Cleanup function to unsubscribe
+     *
+     * @example
+     * ```typescript
+     * const unsubscribe = adapter.subscribeToStream(executionId, {
+     *   onEvent: (event) => console.log(event),
+     *   onError: (error) => console.error(error),
+     *   onComplete: () => console.log('Done'),
+     * });
+     *
+     * // Later, to stop streaming:
+     * unsubscribe();
+     * ```
+     */
+    subscribeToStream?(executionId: string, callbacks: StreamSubscriptionCallbacks): () => void;
+}
+/**
+ * SSE event received from the stream
+ */
+interface StreamEvent {
+    /** Event type (progress, tool_call, complete, failed, etc.) */
+    type: string;
+    /** Event ID for reconnection */
+    id?: string;
+    /** Event data payload */
+    data: unknown;
+}
+/**
+ * Callbacks for subscribeToStream
+ */
+interface StreamSubscriptionCallbacks {
+    /** Called for each SSE event received */
+    onEvent: (event: StreamEvent) => void;
+    /** Called when an error occurs */
+    onError?: (error: Error) => void;
+    /** Called when the stream completes (terminal event received) */
+    onComplete?: () => void;
+    /** Called when connection state changes */
+    onConnectionChange?: (connected: boolean) => void;
 }
 
 interface AgentChatProps {
@@ -2725,9 +2773,9 @@ declare class AISaaSClient {
 }
 
 /**
- * Default adapter for ChatAdapter — thin wrapper around AISaaSClient
+ * Default adapter for ChatAdapter — thin wrapper around CadraClient
  *
- * Uses the AISaaSClient for all operations, providing proper auth,
+ * Uses the CadraClient for all operations, providing proper auth,
  * retries, and streaming support out of the box.
  *
  * @module @cadraos/sdk/chat
@@ -2738,7 +2786,7 @@ declare class AISaaSClient {
  */
 interface DefaultAdapterConfig {
     /**
-     * Pre-constructed AISaaSClient (takes priority over individual options)
+     * Pre-constructed CadraClient (takes priority over individual options)
      */
     client?: AISaaSClient;
     /**
@@ -2764,10 +2812,10 @@ interface DefaultAdapterConfig {
     orgId?: number;
 }
 /**
- * Create a default adapter that wraps AISaaSClient
+ * Create a default adapter that wraps CadraClient
  *
  * @param config - Adapter configuration
- * @returns ChatAdapter implementation backed by AISaaSClient
+ * @returns ChatAdapter implementation backed by CadraClient
  *
  * @example
  * ```typescript

package/dist/chat/index.js

@@ -1,4 +1,5 @@
 import { createContext, forwardRef, useState, useRef, useImperativeHandle, useCallback, useEffect, useMemo, useContext } from 'react';
+import { fetchEventSource } from '@microsoft/fetch-event-source';
 import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
 import ReactMarkdown from 'react-markdown';
 import remarkGfm from 'remark-gfm';
@@ -2203,7 +2204,7 @@ function resolveClient(config) {
 }
 function resolveBaseUrl(config) {
   if (config.baseUrl) return config.baseUrl;
-  return "https://api.aisaas.com/v1";
+  return "https://api.cadra.io/v1";
 }
 async function getAuthHeaders(config) {
   const headers = {
@@ -2309,7 +2310,7 @@ function createDefaultAdapter(config) {
       };
     },
     // -------------------------------------------------------------------------
-    // Attachment Methods (raw fetch — AISaaSClient has no AttachmentsAPI yet)
+    // Attachment Methods (raw fetch — CadraClient has no AttachmentsAPI yet)
     // -------------------------------------------------------------------------
     async getUploadUrl(input) {
       return rawRequest(config, "POST", "/attachments/upload-url", {
@@ -2389,8 +2390,106 @@ function createDefaultAdapter(config) {
     // -------------------------------------------------------------------------
     // SSE Stream URL (legacy backward compat)
     // -------------------------------------------------------------------------
+    /**
+     * @deprecated Use subscribeToStream() instead. getStreamUrl() exposes
+     * API keys in URLs which are logged by browsers, proxies, and servers.
+     */
     getStreamUrl(executionId) {
+      if (typeof window !== "undefined" && process.env.NODE_ENV !== "production") {
+        const warnKey = "__cadra_getStreamUrl_deprecated__";
+        const win = window;
+        if (!win[warnKey]) {
+          win[warnKey] = true;
+          console.warn(
+            "[CadraOS SDK] getStreamUrl() is deprecated. Use subscribeToStream() instead which provides secure header-based auth. API keys in URLs are a security risk."
+          );
+        }
+      }
       return `${baseUrl}/agents/runs/${executionId}/stream`;
+    },
+    // -------------------------------------------------------------------------
+    // Secure SSE Streaming (Recommended)
+    // -------------------------------------------------------------------------
+    subscribeToStream(executionId, callbacks) {
+      const abortController = new AbortController();
+      const url = `${baseUrl}/api/v1/agents/runs/${executionId}/stream`;
+      const getHeaders = async () => {
+        const headers = {
+          Accept: "text/event-stream",
+          "Cache-Control": "no-cache"
+        };
+        if (config.apiKey) {
+          headers["Authorization"] = `Bearer ${config.apiKey}`;
+        } else if (config.token) {
+          headers["Authorization"] = `Bearer ${config.token}`;
+        } else if (config.tokenProvider) {
+          const token = await config.tokenProvider();
+          headers["Authorization"] = `Bearer ${token}`;
+        }
+        if (config.orgId !== void 0) {
+          headers["X-Org-Id"] = String(config.orgId);
+        }
+        return headers;
+      };
+      const terminalEvents = /* @__PURE__ */ new Set(["complete", "failed", "error"]);
+      (async () => {
+        try {
+          const headers = await getHeaders();
+          callbacks.onConnectionChange?.(true);
+          await fetchEventSource(url, {
+            method: "GET",
+            headers,
+            signal: abortController.signal,
+            openWhenHidden: true,
+            // Keep connection open even when tab is hidden
+            onopen: async (response) => {
+              if (!response.ok) {
+                const errorText = await response.text();
+                throw new Error(`SSE connection failed: ${response.status} - ${errorText}`);
+              }
+            },
+            onmessage: (ev) => {
+              if (!ev.event || ev.event === "") {
+                return;
+              }
+              let data;
+              try {
+                data = ev.data ? JSON.parse(ev.data) : {};
+              } catch {
+                data = ev.data;
+              }
+              const event = {
+                type: ev.event,
+                id: ev.id,
+                data
+              };
+              callbacks.onEvent(event);
+              if (terminalEvents.has(ev.event)) {
+                callbacks.onComplete?.();
+                abortController.abort();
+              }
+            },
+            onerror: (err) => {
+              callbacks.onConnectionChange?.(false);
+              callbacks.onError?.(err instanceof Error ? err : new Error(String(err)));
+              throw err;
+            },
+            onclose: () => {
+              callbacks.onConnectionChange?.(false);
+            }
+          });
+        } catch (err) {
+          if (err instanceof Error && err.name === "AbortError") {
+            return;
+          }
+          callbacks.onConnectionChange?.(false);
+          callbacks.onError?.(err instanceof Error ? err : new Error(String(err)));
+        }
+      })();
+      return () => {
+        abortController.abort();
+        callbacks.onConnectionChange?.(false);
+      };
     }
   };
 }
@@ -6076,6 +6175,39 @@ function TodoList({
   );
 }
 
+// src/chat/index.ts
+var DEPRECATION_WARNING = `
+[@cadraos/sdk/chat] DEPRECATION WARNING
+
+This module is deprecated and will be removed in a future version.
+Please migrate to @cadraos/react for:
+- Simpler setup with CadraCopilot
+- Better security (header-based SSE auth)
+- Scoped CSS that won't conflict with your app
+
+Migration steps:
+1. npm install @cadraos/react
+2. import '@cadraos/react/styles.css'
+3. Replace <AgentChat> with <CadraCopilot> or <CadraChat>
+
+See: https://github.com/cadraos/cadra-sdk/blob/main/packages/react/MIGRATION.md
+`;
+var hasWarned = false;
+function showDeprecationWarning() {
+  if (hasWarned) return;
+  hasWarned = true;
+  if (typeof process !== "undefined" && process.env?.NODE_ENV === "production") {
+    return;
+  }
+  if (typeof window === "undefined") {
+    return;
+  }
+  console.warn(DEPRECATION_WARNING);
+}
+if (typeof window !== "undefined") {
+  setTimeout(showDeprecationWarning, 0);
+}
+
 export { AgentChat, AlertCircleIcon, AskUserPrompt, BotIcon, ChatConfigProvider, ChatContainer, ChatInput, ChatMessage, CheckCircleIcon, CheckIcon, ChevronDownIcon, ChevronLeftIcon, ChevronRightIcon, CircleIcon, ClockIcon, CodeIcon, CopyIcon, DatabaseIcon, DownloadIcon, ExternalLinkIcon, FileDropZone, FileIcon, FileTextIcon, HelpCircleIcon, ImageIcon, ImagesIcon, ListTodoIcon, LoadingSpinner, MarkdownContent, Maximize2Icon, MessageCircleIcon, MessageList, Minimize2Icon, PaperclipIcon, SendIcon, SparklesIcon, StopCircleIcon, TodoList, ToolCallEntry, UserIcon, XIcon, ZoomInIcon, ZoomOutIcon, compressImage, createDefaultAdapter, useAgentChat, useChatConfig, useChatConfigOptional, useExecutionStream, useFileAttachments };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map