@cerebro-labs/agentnava-sdk 0.53.2 → 0.75.0

package/workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,6DAA6D;AAE7D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,OAAO,EAAE,IAAI,EAAsB,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAmBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,SAAS;IACZ,KAAK,CAAO;IAErB,YAAY,UAAyB,EAAE;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,GAAG;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,eAAe,CAAC,CAAC;IACvD,CAAC;IAEQ,MAAM,GAAG;QACjB;;;;;;;WAOG;QACH,MAAM,EAAE,KAAK,EAAE,MAAmB,EAAkB,EAAE;YACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,YAAY,EAAE,MAAM,CAAC,CAAC;YACpE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,EAAE,KAAK,IAAsB,EAAE;YAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,YAAY,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;KACD,CAAC;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACM,OAAO,GAAG;QAClB;+EACuE;QACvE,MAAM,EAAE,KAAK,EAAE,KAmBd,EAAmB,EAAE;YACrB,iDAAiD;YACjD,EAAE;YACF,uEAAuE;YACvE,qEAAqE;YACrE,mEAAmE;YACnE,iEAAiE;YACjE,sEAAsE;YACtE,4DAA4D;YAC5D,EAAE;YACF,qEAAqE;YACrE,6CAA6C;YAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuC,aAAa,EAAE;gBACtF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC1E,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC9D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;aACpE,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC;YAC/B,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD;;;;;;0DAMkD;QAClD,IAAI,EAAE,KAAK,EAAE,OAAgB,EAAqB,EAAE;YACnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAC/B,aAAa,EACb,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CACjC,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,qCAAqC;KACrC,CAAC;IAEF;;;;;;;;;;;;;;;OAeG;IACM,QAAQ,GAAG;QACnB;;;;;;;;WAQG;QACH,OAAO,EAAE,KAAK,EAAE,KAAwC,EAA8C,EAAE;YACvG,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyC,sBAAsB,EAAE;gBACjG,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;aACjE,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAChF,CAAC;QAED;kEAC0D;QAC1D,IAAI,EAAE,KAAK,EAAE,QAAyB,EAAE,EAAsB,EAAE;YAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAC/B,cAAc,EACd,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAC1C,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;KACD,CAAC;IAEF;;;;;;;OAOG;IACM,cAAc,GAAG;QACzB;;;;;;WAMG;QACH,MAAM,EAAE,KAAK,EAAE,MAId,EAA0B,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAChC,qBAAqB,EACrB,MAAM,CACN,CAAC;YACF,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC;QAED;;0BAEkB;QAClB,IAAI,EAAE,KAAK,IAA8B,EAAE;YAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiC,qBAAqB,CAAC,CAAC;YACxF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9E,CAAC;QAED;iDACyC;QACzC,GAAG,EAAE,KAAK,EAAE,GAAW,EAA0B,EAAE;YAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAC/B,uBAAuB,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAChD,CAAC;YACF,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC;KACD,CAAC;IAEF;;;;;;;OAOG;IACM,SAAS,GAAG;QACpB;;;;;;;WAOG;QACH,MAAM,EAAE,KAAK,EAAE,MAAsB,EAAqB,EAAE;YAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,eAAe,EAAE,MAAM,CAAC,CAAC;YACvF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjE,CAAC;QAED;mEAC2D;QAC3D,IAAI,EAAE,KAAK,EAAE,KAAoB,EAA+B,EAAE,CACjE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,oBAAoB,EAAE,KAAK,CAAC;QAEjE,iEAAiE;QACjE,IAAI,EAAE,KAAK,IAAyB,EAAE;YACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgC,eAAe,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED;6BACqB;QACrB,GAAG,EAAE,KAAK,EAAE,GAAW,EAAqB,EAAE;YAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,iBAAiB,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzG,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjE,CAAC;KACD,CAAC;IAEO,QAAQ,GAAG;QACnB,MAAM,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACzD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,EAAE,KAAK,IAAwB,EAAE;YACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,cAAc,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;iBACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAU,CAAC,CAAC;iBACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;KACD,CAAC;IAEF,yEAAyE;IACzE,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,YAAY;IACZ,EAAE;IACF,6EAA6E;IAC7E,uEAAuE;IACvE,iEAAiE;IAEjE;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiC,mBAAmB,CAAC,CAAC;QACtF,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,aAAa,CAAC,CAAC;QAClE,OAAO;YACN,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC;YACzB,sBAAsB,EAAE,GAAG,CAAC,sBAAsB,IAAI,CAAC;YACvD,qBAAqB,EAAE,GAAG,CAAC,qBAAqB,IAAI,CAAC;SACrD,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI;QACT,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAG7B,gBAAgB,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;IAC5E,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,OAAe;QACpB,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,+CAA+C;IAC/C,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,qEAAqE;IACrE,EAAE;IACF,4EAA4E;IAC5E,2EAA2E;IAC3E,wDAAwD;IAExD,gEAAgE;IAChE,OAAO,CAAC,SAAiB;QACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,OAAO,CAAC,SAAiB;QACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;8CAM0C;IAC1C,OAAO,CAAC,SAAiB;QACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED,+DAA+D;IAC/D,MAAM,CAAC,QAAgB;QACtB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;;;;mFAK+E;IAC/E,aAAa,CAAC,GAAW;QACxB,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,kEAAkE;IAClE,QAAQ,CAAC,GAAW;QACnB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACxB,YAAY,CAAC,UAAkC,EAAE;QAChD,OAAO,IAAI,SAAS,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnF,CAAC;CACD,CAAC","sourcesContent":["// The entry point. `AgentNava.getWorkspace()` is a workspace, because an API key already\n// names one: there is nothing to select and nothing to pass.\n\nimport { Account, accountIn } from './account.ts';\nimport { Agent } from './agent.ts';\nimport type { AppId } from './apps.generated.ts';\nimport { Http, type ClientOptions } from './http.ts';\nimport { Secret } from './secret.ts';\nimport { EndUser } from './end-user.ts';\nimport { Database } from './database.ts';\nimport { KnowledgeBase } from './knowledge-base.ts';\nimport { Project, toProjectData } from './project.ts';\nimport type {\n\tAccountData,\n\tAgentData,\n\tAgentFields,\n\tCredits,\n\tDatabaseData,\n\tDatabaseFields,\n\tDatabaseLogin,\n\tDatabaseTestResult,\n\tKnowledgeBaseData,\n\tProjectData,\n\tProjectFields,\n\tSeatPlan,\n\tSecretMeta,\n\tWorkspaceInfo,\n\tWorkspaceMember,\n} from './types.ts';\n\n/**\n * Your workspace: the account an API key names.\n *\n * ```ts\n * const ws = AgentNava.getWorkspace();             // reads AGENTNAVA_API_KEY\n * const agent = await ws.agents.create({ … });\n * const conversation = await agent.start({ endUserId: 'u_ananya' });\n * console.log(await conversation.ask('Hello'));\n * ```\n *\n * Constructing it makes no request. So do `ws.agent(id)`\n * and `ws.project(id)`: they hand you something you can call methods on, and the\n * first request happens when you call one. Fetching an object just to send it a\n * message would be a round trip for nothing.\n *\n * A returned object is not plain JSON. Store the `id`, not the object, and use\n * `ws.agent(id)` to come back in.\n */\nexport class Workspace {\n\treadonly #http: Http;\n\n\tconstructor(options: ClientOptions = {}) {\n\t\tthis.#http = new Http(options);\n\t}\n\n\t/** The workspace itself: name, credits. */\n\tasync get(): Promise<WorkspaceInfo> {\n\t\treturn this.#http.get<WorkspaceInfo>('/v1/workspace');\n\t}\n\n\treadonly agents = {\n\t\t/**\n\t\t * Create an agent.\n\t\t *\n\t\t * Supplying an `id` is optional; without one the server mints it. An id\n\t\t * that already exists is a 409 rather than a quiet new version of the\n\t\t * existing agent, so a typo cannot silently rewrite something else. Use\n\t\t * `agent.update()` to publish a version.\n\t\t */\n\t\tcreate: async (fields: AgentFields): Promise<Agent> => {\n\t\t\tconst data = await this.#http.post<AgentData>('/v1/agents', fields);\n\t\t\treturn new Agent(this.#http, data.id, data);\n\t\t},\n\t\tlist: async (): Promise<Agent[]> => {\n\t\t\tconst res = await this.#http.get<{ agents: AgentData[] }>('/v1/agents');\n\t\t\treturn (res.agents ?? []).map((a) => new Agent(this.#http, a.id, a));\n\t\t},\n\t};\n\n\t/**\n\t * Secrets: values your agents USE and never see.\n\t *\n\t * The one way to give an agent an API key. A secret is written once, stored\n\t * encrypted, and substituted into an HTTP tool's url, headers or body on the\n\t * server at the moment the call goes out, so the key is never in a prompt,\n\t * never in a transcript, and never in anything the model could repeat back.\n\t * Reference it from a tool as `{{secrets.NAME}}`.\n\t *\n\t * Scope is the `agentId` argument. Left out, every agent in the workspace can\n\t * use it; supplied, only that agent can, and it takes precedence over a\n\t * workspace secret of the same name. Prefer the narrow one for anything that\n\t * moves money.\n\t *\n\t * NOTHING READS A VALUE BACK, including you. `list` returns names and\n\t * metadata. That is deliberate rather than an omission: a value you can read\n\t * is a value that can end up in a log.\n\t */\n\treadonly secrets = {\n\t\t/** Store a secret. A name that already exists at the same scope is a 409,\n\t\t *  rather than a silent overwrite of a key something else is using. */\n\t\tcreate: async (input: {\n\t\t\tname: string;\n\t\t\tvalue: string;\n\t\t\tdescription?: string;\n\t\t\tagentId?: string;\n\t\t\t/** One of YOUR end users, stored verbatim. Prefer\n\t\t\t *  `ws.endUser(id).secrets.create(...)`, which fills this in for you.\n\t\t\t *\n\t\t\t *  THIS PARAMETER WAS REMOVED AND IS BACK, and the difference is that\n\t\t\t *  it now does something. It used to be accepted, written to the\n\t\t\t *  column, and read by nothing: a credential reached a turn only by\n\t\t\t *  being ATTACHED, and a secret could not be, because binding one took\n\t\t\t *  its VALUE and not an id. A parameter that accepts a write, reports\n\t\t\t *  success and changes nothing an agent can use is a decoy, so it was\n\t\t\t *  deleted rather than left to teach somebody that per-person secrets\n\t\t\t *  worked.\n\t\t\t *\n\t\t\t *  `conversation.attach(secret)` is the route that was missing. */\n\t\t\tendUserId?: string;\n\t\t}): Promise<Secret> => {\n\t\t\t// FIELDS PICKED, not the input object forwarded.\n\t\t\t//\n\t\t\t// Removing `endUserId` from the type above did not stop it being SENT.\n\t\t\t// This forwarded `input` wholesale, so a JavaScript caller still put\n\t\t\t// the field on the wire and TypeScript was the only thing that had\n\t\t\t// changed. Caught by running the PUBLISHED 0.19.0 in a throwaway\n\t\t\t// project rather than by reading the source, which is the only way it\n\t\t\t// could have been caught: the types agreed with themselves.\n\t\t\t//\n\t\t\t// Picking is what makes a removal real, and it also means an unknown\n\t\t\t// field can never reach the API by accident.\n\t\t\tconst res = await this.#http.post<{ secret?: SecretMeta } & SecretMeta>('/v1/secrets', {\n\t\t\t\tname: input.name,\n\t\t\t\tvalue: input.value,\n\t\t\t\t...(input.description !== undefined && { description: input.description }),\n\t\t\t\t...(input.agentId !== undefined && { agentId: input.agentId }),\n\t\t\t\t...(input.endUserId !== undefined && { endUserId: input.endUserId }),\n\t\t\t});\n\t\t\tconst meta = res.secret ?? res;\n\t\t\treturn new Secret(this.#http, meta.id, meta);\n\t\t},\n\t\t/** Every secret this WORKSPACE holds, values excluded. Pass `agentId` to\n\t\t *  include that agent's own secrets alongside the workspace ones.\n\t\t *\n\t\t *  One of your end users' secrets is NOT in here, deliberately: ask for\n\t\t *  those with `ws.endUser(id).secrets.list()`. A listing that mixed them\n\t\t *  would be a listing you could not act on, since deleting from it would\n\t\t *  reach into somebody's personal credentials. */\n\t\tlist: async (agentId?: string): Promise<Secret[]> => {\n\t\t\tconst res = await this.#http.get<{ secrets: SecretMeta[] }>(\n\t\t\t\t'/v1/secrets',\n\t\t\t\tagentId ? { agentId } : undefined,\n\t\t\t);\n\t\t\treturn (res.secrets ?? []).map((m) => new Secret(this.#http, m.id, m));\n\t\t},\n\t\t// `update` and `delete` are GONE from here. They live on the Secret you\n\t\t// are holding: `secret.update(value)`, `secret.delete()`. Two ways to do\n\t\t// one thing is how a surface becomes hard to learn, and the object is\n\t\t// the one that reads at a call site.\n\t};\n\n\t/**\n\t * Agent creators' accounts: apps signed in to ONCE, in the workspace, for\n\t * any agent here to use.\n\t *\n\t * An ACCOUNT is one saved sign-in to one app (Gmail, signed in as\n\t * support@example.com). An agent reaches one only through a CONNECTION in its\n\t * setup that names it: `agent.connections.add({ app, account })`. Connecting\n\t * an account grants no agent anything on its own.\n\t *\n\t * The person signs in on the app's own page, so YOU NEVER HANDLE A TOKEN.\n\t * `connect` hands you a url to send them to.\n\t *\n\t * Your end users' own accounts are not here: they belong to each person, and\n\t * live under `ws.endUser(id).accounts`. An agent uses those through a\n\t * connection built with `Connection.endUserAccount(app)`.\n\t */\n\treadonly accounts = {\n\t\t/**\n\t\t * Begin connecting an account. Returns it, still `pending`, and the url\n\t\t * to send the person to; they sign in there, and\n\t\t * `account.waitUntilConnected()` tells you when they are done.\n\t\t *\n\t\t * `nickname` is your own name for it, such as `'Support inbox'`, shown\n\t\t * beside the email it is signed in as. Connecting grants nothing by\n\t\t * itself: only an agent whose setup names the account uses it.\n\t\t */\n\t\tconnect: async (input: { app: AppId; nickname?: string }): Promise<{ account: Account; url: string }> => {\n\t\t\t// FIELDS PICKED, never the input object forwarded: an undeclared field\n\t\t\t// must never reach the API because a JavaScript caller passed it.\n\t\t\tconst res = await this.#http.post<{ account?: AccountData; url: string }>('/v1/accounts/connect', {\n\t\t\t\tapp: input.app,\n\t\t\t\t...(input.nickname !== undefined && { nickname: input.nickname }),\n\t\t\t});\n\t\t\tconst account = accountIn(res, '/v1/accounts/connect');\n\t\t\treturn { account: new Account(this.#http, account.id, account), url: res.url };\n\t\t},\n\n\t\t/** Every agent creator's account in this workspace, each with the agents\n\t\t *  that use it (`usedBy`). `app` narrows to one app's. */\n\t\tlist: async (input: { app?: AppId } = {}): Promise<Account[]> => {\n\t\t\tconst res = await this.#http.get<{ accounts: AccountData[] }>(\n\t\t\t\t'/v1/accounts',\n\t\t\t\tinput.app ? { app: input.app } : undefined,\n\t\t\t);\n\t\t\treturn (res.accounts ?? []).map((a) => new Account(this.#http, a.id, a));\n\t\t},\n\t};\n\n\t/**\n\t * Knowledge bases: named folders of files your agents read.\n\t *\n\t * Called `knowledgeBases`, not `knowledge`, on purpose. `agent.knowledge`\n\t * already means one agent's FILES, and a `ws.knowledge.list()` returning\n\t * bases rather than files would be the same word meaning two different things\n\t * one level apart. The longer name is worth it.\n\t */\n\treadonly knowledgeBases = {\n\t\t/**\n\t\t * Create a base. The KEY is what agent configurations store, so pick\n\t\t * something readable: `product-docs`, not `kb1`.\n\t\t *\n\t\t * A key already in use is an error rather than a silent overwrite, because\n\t\t * the base it would replace may be one several agents already read from.\n\t\t */\n\t\tcreate: async (fields: {\n\t\t\tkey: string;\n\t\t\tname?: string;\n\t\t\tdescription?: string;\n\t\t}): Promise<KnowledgeBase> => {\n\t\t\tconst res = await this.#http.post<{ base: KnowledgeBaseData }>(\n\t\t\t\t'/v1/knowledge/bases',\n\t\t\t\tfields,\n\t\t\t);\n\t\t\treturn new KnowledgeBase(this.#http, res.base.key, res.base);\n\t\t},\n\n\t\t/** Every base in this workspace. No pagination: bases are few, and a\n\t\t *  workspace with hundreds of them has a naming problem rather than a\n\t\t *  paging one. */\n\t\tlist: async (): Promise<KnowledgeBase[]> => {\n\t\t\tconst res = await this.#http.get<{ bases: KnowledgeBaseData[] }>('/v1/knowledge/bases');\n\t\t\treturn (res.bases ?? []).map((b) => new KnowledgeBase(this.#http, b.key, b));\n\t\t},\n\n\t\t/** One base, by key. Returns a HANDLE you act through: `kb.files.put(...)`,\n\t\t *  `kb.attachments()`, `kb.delete()`. */\n\t\tget: async (key: string): Promise<KnowledgeBase> => {\n\t\t\tconst res = await this.#http.get<{ base: KnowledgeBaseData }>(\n\t\t\t\t`/v1/knowledge/bases/${encodeURIComponent(key)}`,\n\t\t\t);\n\t\t\treturn new KnowledgeBase(this.#http, res.base.key, res.base);\n\t\t},\n\t};\n\n\t/**\n\t * Databases your agents can query, each registered once under a key.\n\t *\n\t * Register first, then name the key in an agent's `databases`. Registering\n\t * logs in before saving, so a wrong login fails here instead of in a\n\t * conversation, and nothing is saved when it does. A database answers only\n\t * the agents whose configuration names its key.\n\t */\n\treadonly databases = {\n\t\t/**\n\t\t * Register a database under a key. Pass a connection string as `url`, or\n\t\t * the same login as `engine`, `host`, `port`, `database`, `username` and\n\t\t * `password`. Read-only unless `writable: true`.\n\t\t *\n\t\t * A key already in use is refused rather than overwritten, because agents\n\t\t * may already be querying the database it names.\n\t\t */\n\t\tcreate: async (fields: DatabaseFields): Promise<Database> => {\n\t\t\tconst res = await this.#http.post<{ database: DatabaseData }>('/v1/databases', fields);\n\t\t\treturn new Database(this.#http, res.database.key, res.database);\n\t\t},\n\n\t\t/** Check a login and see its tables, saving nothing. A refused login comes\n\t\t *  back as `{ ok: false, error }`, not as an exception. */\n\t\ttest: async (login: DatabaseLogin): Promise<DatabaseTestResult> =>\n\t\t\tthis.#http.post<DatabaseTestResult>('/v1/databases/test', login),\n\n\t\t/** Every database registered in this workspace, oldest first. */\n\t\tlist: async (): Promise<Database[]> => {\n\t\t\tconst res = await this.#http.get<{ databases: DatabaseData[] }>('/v1/databases');\n\t\t\treturn (res.databases ?? []).map((d) => new Database(this.#http, d.key, d));\n\t\t},\n\n\t\t/** One database, by key. Returns a HANDLE: `db.tables()`, `db.describe()`,\n\t\t *  `db.delete()`. */\n\t\tget: async (key: string): Promise<Database> => {\n\t\t\tconst res = await this.#http.get<{ database: DatabaseData }>(`/v1/databases/${encodeURIComponent(key)}`);\n\t\t\treturn new Database(this.#http, res.database.key, res.database);\n\t\t},\n\t};\n\n\treadonly projects = {\n\t\tcreate: async (fields: ProjectFields): Promise<Project> => {\n\t\t\tconst data = toProjectData(await this.#http.post('/v1/projects', fields));\n\t\t\treturn new Project(this.#http, data.id, data);\n\t\t},\n\t\tlist: async (): Promise<Project[]> => {\n\t\t\tconst res = await this.#http.get<{ projects: unknown[] }>('/v1/projects');\n\t\t\treturn (res.projects ?? [])\n\t\t\t\t.map((p) => toProjectData(p as never))\n\t\t\t\t.map((p) => new Project(this.#http, p.id, p));\n\t\t},\n\t};\n\n\t// ---- The account, read-only ------------------------------------------\n\t//\n\t// Everything below reads. There is no create-a-key, no invite, no change of\n\t// plan and no payment method, deliberately and not for want of an endpoint.\n\t// A key is a long-lived credential that ends up in CI, in a container image\n\t// and in somebody's shell history; the blast radius of one that leaks should\n\t// be \"they could read our balance\", not \"they added themselves to the\n\t// account\".\n\t//\n\t// Each of these is scoped to the key's OWN workspace by the server, from the\n\t// key's row rather than from anything the caller sends, so there is no\n\t// workspace argument to pass and no way to point them elsewhere.\n\n\t/**\n\t * Who is on this workspace, and what each of them may do.\n\t *\n\t * ```ts\n\t * for (const m of await ws.members()) {\n\t *   console.log(m.email, m.role);\n\t * }\n\t * ```\n\t */\n\tasync members(): Promise<WorkspaceMember[]> {\n\t\tconst res = await this.#http.get<{ members: WorkspaceMember[] }>('/v1/teams/members');\n\t\treturn res.members ?? [];\n\t}\n\n\t/**\n\t * What credit is left, and roughly how many turns that buys.\n\t *\n\t * The turn counts are the useful half: a balance in credits is not something\n\t * anybody can act on without knowing what a turn costs.\n\t *\n\t * ```ts\n\t * const { credits, standardTurnsRemaining } = await ws.credits();\n\t * if (standardTurnsRemaining < 100) await topUpSomehow();\n\t * ```\n\t */\n\tasync credits(): Promise<Credits> {\n\t\tconst res = await this.#http.get<Partial<Credits>>('/v1/credits');\n\t\treturn {\n\t\t\tcredits: res.credits ?? 0,\n\t\t\tstandardTurnsRemaining: res.standardTurnsRemaining ?? 0,\n\t\t\tpremiumTurnsRemaining: res.premiumTurnsRemaining ?? 0,\n\t\t};\n\t}\n\n\t/**\n\t * Which seat plan this workspace is on.\n\t *\n\t * Seats and credits are separate purchases: this says how many people may\n\t * share the account, not how much work they may do. Returns null when the\n\t * server cannot say, rather than guessing at the free plan, because \"we do\n\t * not know\" and \"you are on the cheapest one\" are different answers.\n\t */\n\tasync plan(): Promise<SeatPlan | null> {\n\t\tconst res = await this.#http.get<{\n\t\t\tplans?: SeatPlan[];\n\t\t\tcurrentPlanKey?: string | null;\n\t\t}>('/v1/seat-plans');\n\t\tif (!res.currentPlanKey) return null;\n\t\treturn (res.plans ?? []).find((p) => p.key === res.currentPlanKey) ?? null;\n\t}\n\n\t/** Address an agent you already have the id of. No request. */\n\tagent(agentId: string): Agent {\n\t\treturn new Agent(this.#http, agentId);\n\t}\n\n\t// `ws.conversation(id)` IS GONE, deliberately.\n\t//\n\t// A conversation belongs to an agent, or to a project, and is now addressed\n\t// from whichever one owns it: `ws.agent(a).conversation(id)`. Addressing it\n\t// from the workspace made the parent look optional, which is how this SDK\n\t// came to describe conversations as parentless in its own reference.\n\t//\n\t// The objection to moving it was that a caller would have to store two ids.\n\t// In practice the agent id is a constant in the caller's own code, because\n\t// they configured the agent; it is not a per-row value.\n\n\t/** Address a project you already have the id of. No request. */\n\tproject(projectId: string): Project {\n\t\treturn new Project(this.#http, projectId);\n\t}\n\n\t/**\n\t * One of YOUR end users. No request.\n\t *\n\t * The object everything about a person hangs off: their accounts, their\n\t * secrets, their conversations across every agent. You say who once, here,\n\t * instead of threading an `endUserId` through each call and forgetting it in\n\t * one of them.\n\t *\n\t * ```ts\n\t * const ananya = ws.endUser(row.userId);\n\t * const { url } = await ananya.accounts.connect({ app: App.GMAIL });\n\t * await ananya.conversations();\n\t * ```\n\t *\n\t * A SCOPE, NOT A RECORD. Every other addresser here points at a row we\n\t * store and can list back: `ws.agent(id)`, `ws.project(id)`,\n\t * `ws.account(id)`, `ws.secret(id)`, each with its own\n\t * `ws.<plural>.create/list` (or `connect/list`). This one points at nothing.\n\t * We do not create your end users, we cannot list them, and there is no\n\t * `ws.endUsers` collection anywhere in this SDK. We only write the id you\n\t * give us onto rows we already own.\n\t *\n\t * So this does not fetch a person. It hands you the same workspace,\n\t * narrowed to one of your people. If a `ws.endUsers` ever appears here,\n\t * something has started claiming to own them.\n\t *\n\t * It hangs off the workspace because a an end-user id is MEANINGLESS WITHOUT\n\t * ONE: uniqueness is (workspace_id, end_user_id, provider), so two of our\n\t * own customers can each have a person called `user_1` without colliding.\n\t *\n\t * NOT `ws.user()`, and not a workspace member. `ws.members()` lists the\n\t * colleagues who share this account, with ids we issued and authenticate.\n\t * This takes an id from YOUR database that we store verbatim and never\n\t * check. Passing one where the other belongs used to be a call that could\n\t * not fail, because there is nothing for an end-user id to fail against.\n\t */\n\tendUser(endUserId: string): EndUser {\n\t\treturn new EndUser(this.#http, endUserId);\n\t}\n\n\t/** Address an account you already have the id of. No request.\n\t *\n\t *  The sibling of `ws.agent(id)`. ANY account in this workspace: the agent\n\t *  creator's, or one of your end users' (`data.owner` says which, after a\n\t *  read). An account never belongs to one agent: many agents can name it,\n\t *  which is why reconnecting it once fixes all of them. `account.get()`\n\t *  reads it, and a missing one throws. */\n\taccount(accountId: string): Account {\n\t\treturn new Account(this.#http, accountId);\n\t}\n\n\t/** Address a secret you already have the id of. No request. */\n\tsecret(secretId: string): Secret {\n\t\treturn new Secret(this.#http, secretId);\n\t}\n\n\t/** Address a knowledge base you already know the key of. No request.\n\t *\n\t *  The sibling of `agent()` and `project()`, and it was the\n\t *  one missing: reaching a base meant `knowledgeBases.get(key)`, which costs a\n\t *  round trip to learn something the caller already knew. Use `get()` when you\n\t *  want the base's RECORD; use this when you only want to put a file in it. */\n\tknowledgeBase(key: string): KnowledgeBase {\n\t\treturn new KnowledgeBase(this.#http, key);\n\t}\n\n\t/** Address a database you already know the key of. No request. */\n\tdatabase(key: string): Database {\n\t\treturn new Database(this.#http, key);\n\t}\n}\n\n/**\n * The way in.\n *\n * ```ts\n * import { AgentNava } from '@cerebro-labs/agentnava-sdk';\n *\n * const ws = AgentNava.getWorkspace();          // reads AGENTNAVA_API_KEY\n * const ws = AgentNava.getWorkspace('ank_...'); // or pass the key\n * ```\n *\n * IT MAKES NO REQUEST. `get` here means \"hand me the workspace this key names\",\n * not \"go and fetch it\"; the first round trip happens on the first method you\n * call. `ws.get()` is the one that actually reads the record.\n *\n * An API key belongs to exactly one workspace, so there is nothing to select\n * and no workspace argument anywhere in this SDK. This does not CREATE a\n * workspace either: the key already names one, and creating them is not\n * something an API key may do (see \"the account is read-only\").\n */\nexport const AgentNava = {\n\tgetWorkspace(options: string | ClientOptions = {}): Workspace {\n\t\treturn new Workspace(typeof options === 'string' ? { apiKey: options } : options);\n\t},\n};\n"]}
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,6DAA6D;AAE7D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,UAAU,EAA0B,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,OAAO,EAAE,IAAI,EAAsB,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAoBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,SAAS;IACZ,KAAK,CAAO;IAErB,YAAY,UAAyB,EAAE;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,GAAG;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,eAAe,CAAC,CAAC;IACvD,CAAC;IAEQ,MAAM,GAAG;QACjB;;;;;;;WAOG;QACH,MAAM,EAAE,KAAK,EAAE,MAAmB,EAAkB,EAAE;YACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,YAAY,EAAE,MAAM,CAAC,CAAC;YACpE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,EAAE,KAAK,IAAsB,EAAE;YAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,YAAY,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;KACD,CAAC;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACM,OAAO,GAAG;QAClB;+EACuE;QACvE,MAAM,EAAE,KAAK,EAAE,KAwBd,EAAmB,EAAE;YACrB,iDAAiD;YACjD,EAAE;YACF,uEAAuE;YACvE,qEAAqE;YACrE,mEAAmE;YACnE,iEAAiE;YACjE,sEAAsE;YACtE,4DAA4D;YAC5D,EAAE;YACF,qEAAqE;YACrE,6CAA6C;YAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuC,aAAa,EAAE;gBACtF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC1E,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC9D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpE,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;aAC7E,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC;YAC/B,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD;;;;;;0DAMkD;QAClD,IAAI,EAAE,KAAK,EAAE,OAAgB,EAAqB,EAAE;YACnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAC/B,aAAa,EACb,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CACjC,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,qCAAqC;KACrC,CAAC;IAEF;;;;;;;;;;;;;;;OAeG;IACM,QAAQ,GAAG;QACnB;;;;;;;;WAQG;QACH,OAAO,EAAE,KAAK,EAAE,KAAwC,EAA8C,EAAE;YACvG,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyC,sBAAsB,EAAE;gBACjG,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;aACjE,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAChF,CAAC;QAED;kEAC0D;QAC1D,IAAI,EAAE,KAAK,EAAE,QAAyB,EAAE,EAAsB,EAAE;YAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAC/B,cAAc,EACd,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAC1C,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;KACD,CAAC;IAEF;;;;;;;;;OASG;IACM,IAAI,GAAG;QACf;8EACsE;QACtE,KAAK,EAAE,KAAK,EAAE,GAAU,EAAsB,EAAE;YAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,wBAAwB,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjH,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACxB,CAAC;KACD,CAAC;IAEF;;;;;;;OAOG;IACM,cAAc,GAAG;QACzB;;;;;;WAMG;QACH,MAAM,EAAE,KAAK,EAAE,MAId,EAA0B,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAChC,qBAAqB,EACrB,MAAM,CACN,CAAC;YACF,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC;QAED;;0BAEkB;QAClB,IAAI,EAAE,KAAK,IAA8B,EAAE;YAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiC,qBAAqB,CAAC,CAAC;YACxF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9E,CAAC;QAED;iDACyC;QACzC,GAAG,EAAE,KAAK,EAAE,GAAW,EAA0B,EAAE;YAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAC/B,uBAAuB,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAChD,CAAC;YACF,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC;KACD,CAAC;IAEF;;;;;;;OAOG;IACM,SAAS,GAAG;QACpB;;;;;;;WAOG;QACH,MAAM,EAAE,KAAK,EAAE,MAAsB,EAAqB,EAAE;YAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,eAAe,EAAE,MAAM,CAAC,CAAC;YACvF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjE,CAAC;QAED;mEAC2D;QAC3D,IAAI,EAAE,KAAK,EAAE,KAAoB,EAA+B,EAAE,CACjE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,oBAAoB,EAAE,KAAK,CAAC;QAEjE,iEAAiE;QACjE,IAAI,EAAE,KAAK,IAAyB,EAAE;YACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgC,eAAe,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED;6BACqB;QACrB,GAAG,EAAE,KAAK,EAAE,GAAW,EAAqB,EAAE;YAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,iBAAiB,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzG,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjE,CAAC;KACD,CAAC;IAEF;;;;;;OAMG;IACM,YAAY,GAAG;QACvB,GAAG,EAAE,KAAK,IAA2B,EAAE,CACtC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiC,6BAA6B,CAAC,CAAC,CAAC,YAAY;QACnG,GAAG,EAAE,KAAK,EAAE,KAAmB,EAAyB,EAAE,CACzD,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiC,6BAA6B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY;KAC5H,CAAC;IAEO,QAAQ,GAAG;QACnB,MAAM,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACzD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,EAAE,KAAK,IAAwB,EAAE;YACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,cAAc,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;iBACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAU,CAAC,CAAC;iBACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;KACD,CAAC;IAEF,yEAAyE;IACzE,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,YAAY;IACZ,EAAE;IACF,6EAA6E;IAC7E,uEAAuE;IACvE,iEAAiE;IAEjE;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiC,mBAAmB,CAAC,CAAC;QACtF,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,aAAa,CAAC,CAAC;QAClE,OAAO;YACN,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC;YACzB,sBAAsB,EAAE,GAAG,CAAC,sBAAsB,IAAI,CAAC;YACvD,qBAAqB,EAAE,GAAG,CAAC,qBAAqB,IAAI,CAAC;SACrD,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI;QACT,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAG7B,gBAAgB,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;IAC5E,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,OAAe;QACpB,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,+CAA+C;IAC/C,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,qEAAqE;IACrE,EAAE;IACF,4EAA4E;IAC5E,2EAA2E;IAC3E,wDAAwD;IAExD,gEAAgE;IAChE,OAAO,CAAC,SAAiB;QACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,OAAO,CAAC,SAAiB;QACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;8CAM0C;IAC1C,OAAO,CAAC,SAAiB;QACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED,+DAA+D;IAC/D,MAAM,CAAC,QAAgB;QACtB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;;;;mFAK+E;IAC/E,aAAa,CAAC,GAAW;QACxB,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,kEAAkE;IAClE,QAAQ,CAAC,GAAW;QACnB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACxB,YAAY,CAAC,UAAkC,EAAE;QAChD,OAAO,IAAI,SAAS,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnF,CAAC;IACD,iGAAiG;IACjG,UAAU,CAAC,OAA0B;QACpC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;CACD,CAAC","sourcesContent":["// The entry point. `AgentNava.getWorkspace()` is a workspace, because an API key already\n// names one: there is nothing to select and nothing to pass.\n\nimport { Account, accountIn } from './account.ts';\nimport { PartnerApp, type PartnerAppOptions } from './partner-app.ts';\nimport { Agent } from './agent.ts';\nimport type { AppId } from './apps.generated.ts';\nimport { Http, type ClientOptions } from './http.ts';\nimport { Secret } from './secret.ts';\nimport { EndUser } from './end-user.ts';\nimport { Database } from './database.ts';\nimport { KnowledgeBase } from './knowledge-base.ts';\nimport { Project, toProjectData } from './project.ts';\nimport type {\n\tAccountData,\n\tAppTool,\n\tAgentData,\n\tAgentFields,\n\tCredits,\n\tDatabaseData,\n\tDatabaseFields,\n\tDatabaseLogin,\n\tDatabaseTestResult,\n\tKnowledgeBaseData,\n\tProjectData,\n\tProjectFields,\n\tSeatPlan,\n\tSecretMeta,\n\tWorkspaceInfo,\n\tWorkspaceMember,\n} from './types.ts';\n\n/**\n * Your workspace: the account an API key names.\n *\n * ```ts\n * const ws = AgentNava.getWorkspace();             // reads AGENTNAVA_API_KEY\n * const agent = await ws.agents.create({ … });\n * const conversation = await agent.start({ endUserId: 'u_ananya' });\n * console.log(await conversation.ask('Hello'));\n * ```\n *\n * Constructing it makes no request. So do `ws.agent(id)`\n * and `ws.project(id)`: they hand you something you can call methods on, and the\n * first request happens when you call one. Fetching an object just to send it a\n * message would be a round trip for nothing.\n *\n * A returned object is not plain JSON. Store the `id`, not the object, and use\n * `ws.agent(id)` to come back in.\n */\nexport class Workspace {\n\treadonly #http: Http;\n\n\tconstructor(options: ClientOptions = {}) {\n\t\tthis.#http = new Http(options);\n\t}\n\n\t/** The workspace itself: name, credits. */\n\tasync get(): Promise<WorkspaceInfo> {\n\t\treturn this.#http.get<WorkspaceInfo>('/v1/workspace');\n\t}\n\n\treadonly agents = {\n\t\t/**\n\t\t * Create an agent.\n\t\t *\n\t\t * Supplying an `id` is optional; without one the server mints it. An id\n\t\t * that already exists is a 409 rather than a quiet new version of the\n\t\t * existing agent, so a typo cannot silently rewrite something else. Use\n\t\t * `agent.update()` to publish a version.\n\t\t */\n\t\tcreate: async (fields: AgentFields): Promise<Agent> => {\n\t\t\tconst data = await this.#http.post<AgentData>('/v1/agents', fields);\n\t\t\treturn new Agent(this.#http, data.id, data);\n\t\t},\n\t\tlist: async (): Promise<Agent[]> => {\n\t\t\tconst res = await this.#http.get<{ agents: AgentData[] }>('/v1/agents');\n\t\t\treturn (res.agents ?? []).map((a) => new Agent(this.#http, a.id, a));\n\t\t},\n\t};\n\n\t/**\n\t * Secrets: values your agents USE and never see.\n\t *\n\t * The one way to give an agent an API key. A secret is written once, stored\n\t * encrypted, and substituted into an HTTP tool's url, headers or body on the\n\t * server at the moment the call goes out, so the key is never in a prompt,\n\t * never in a transcript, and never in anything the model could repeat back.\n\t * Reference it from a tool as `{{secrets.NAME}}`.\n\t *\n\t * Scope is the `agentId` argument. Left out, every agent in the workspace can\n\t * use it; supplied, only that agent can, and it takes precedence over a\n\t * workspace secret of the same name. Prefer the narrow one for anything that\n\t * moves money.\n\t *\n\t * NOTHING READS A VALUE BACK, including you. `list` returns names and\n\t * metadata. That is deliberate rather than an omission: a value you can read\n\t * is a value that can end up in a log.\n\t */\n\treadonly secrets = {\n\t\t/** Store a secret. A name that already exists at the same scope is a 409,\n\t\t *  rather than a silent overwrite of a key something else is using. */\n\t\tcreate: async (input: {\n\t\t\tname: string;\n\t\t\tvalue: string;\n\t\t\tdescription?: string;\n\t\t\tagentId?: string;\n\t\t\t/** One of YOUR end users, stored verbatim. Prefer\n\t\t\t *  `ws.endUser(id).secrets.create(...)`, which fills this in for you.\n\t\t\t *\n\t\t\t *  THIS PARAMETER WAS REMOVED AND IS BACK, and the difference is that\n\t\t\t *  it now does something. It used to be accepted, written to the\n\t\t\t *  column, and read by nothing: a credential reached a turn only by\n\t\t\t *  being ATTACHED, and a secret could not be, because binding one took\n\t\t\t *  its VALUE and not an id. A parameter that accepts a write, reports\n\t\t\t *  success and changes nothing an agent can use is a decoy, so it was\n\t\t\t *  deleted rather than left to teach somebody that per-person secrets\n\t\t\t *  worked.\n\t\t\t *\n\t\t\t *  `conversation.attach(secret)` is the route that was missing. */\n\t\t\tendUserId?: string;\n\t\t\t/** The only hosts a tool may send this key to, like\n\t\t\t *  `[\"api.example.com\"]`. Left out, the first tool saved with it pins\n\t\t\t *  its own host, and a tool sending it anywhere else is refused with\n\t\t\t *  SecretHostNotAllowed. */\n\t\t\tallowedHosts?: string[];\n\t\t}): Promise<Secret> => {\n\t\t\t// FIELDS PICKED, not the input object forwarded.\n\t\t\t//\n\t\t\t// Removing `endUserId` from the type above did not stop it being SENT.\n\t\t\t// This forwarded `input` wholesale, so a JavaScript caller still put\n\t\t\t// the field on the wire and TypeScript was the only thing that had\n\t\t\t// changed. Caught by running the PUBLISHED 0.19.0 in a throwaway\n\t\t\t// project rather than by reading the source, which is the only way it\n\t\t\t// could have been caught: the types agreed with themselves.\n\t\t\t//\n\t\t\t// Picking is what makes a removal real, and it also means an unknown\n\t\t\t// field can never reach the API by accident.\n\t\t\tconst res = await this.#http.post<{ secret?: SecretMeta } & SecretMeta>('/v1/secrets', {\n\t\t\t\tname: input.name,\n\t\t\t\tvalue: input.value,\n\t\t\t\t...(input.description !== undefined && { description: input.description }),\n\t\t\t\t...(input.agentId !== undefined && { agentId: input.agentId }),\n\t\t\t\t...(input.endUserId !== undefined && { endUserId: input.endUserId }),\n\t\t\t\t...(input.allowedHosts !== undefined && { allowedHosts: input.allowedHosts }),\n\t\t\t});\n\t\t\tconst meta = res.secret ?? res;\n\t\t\treturn new Secret(this.#http, meta.id, meta);\n\t\t},\n\t\t/** Every secret this WORKSPACE holds, values excluded. Pass `agentId` to\n\t\t *  include that agent's own secrets alongside the workspace ones.\n\t\t *\n\t\t *  One of your end users' secrets is NOT in here, deliberately: ask for\n\t\t *  those with `ws.endUser(id).secrets.list()`. A listing that mixed them\n\t\t *  would be a listing you could not act on, since deleting from it would\n\t\t *  reach into somebody's personal credentials. */\n\t\tlist: async (agentId?: string): Promise<Secret[]> => {\n\t\t\tconst res = await this.#http.get<{ secrets: SecretMeta[] }>(\n\t\t\t\t'/v1/secrets',\n\t\t\t\tagentId ? { agentId } : undefined,\n\t\t\t);\n\t\t\treturn (res.secrets ?? []).map((m) => new Secret(this.#http, m.id, m));\n\t\t},\n\t\t// `update` and `delete` are GONE from here. They live on the Secret you\n\t\t// are holding: `secret.update(value)`, `secret.delete()`. Two ways to do\n\t\t// one thing is how a surface becomes hard to learn, and the object is\n\t\t// the one that reads at a call site.\n\t};\n\n\t/**\n\t * Agent creators' accounts: apps signed in to ONCE, in the workspace, for\n\t * any agent here to use.\n\t *\n\t * An ACCOUNT is one saved sign-in to one app (Gmail, signed in as\n\t * support@example.com). An agent reaches one only through a CONNECTION in its\n\t * setup that names it: `agent.connections.add({ app, account })`. Connecting\n\t * an account grants no agent anything on its own.\n\t *\n\t * The person signs in on the app's own page, so YOU NEVER HANDLE A TOKEN.\n\t * `connect` hands you a url to send them to.\n\t *\n\t * Your end users' own accounts are not here: they belong to each person, and\n\t * live under `ws.endUser(id).accounts`. An agent uses those through a\n\t * connection built with `Connection.endUserAccount(app)`.\n\t */\n\treadonly accounts = {\n\t\t/**\n\t\t * Begin connecting an account. Returns it, still `pending`, and the url\n\t\t * to send the person to; they sign in there, and\n\t\t * `account.waitUntilConnected()` tells you when they are done.\n\t\t *\n\t\t * `nickname` is your own name for it, such as `'Support inbox'`, shown\n\t\t * beside the email it is signed in as. Connecting grants nothing by\n\t\t * itself: only an agent whose setup names the account uses it.\n\t\t */\n\t\tconnect: async (input: { app: AppId; nickname?: string }): Promise<{ account: Account; url: string }> => {\n\t\t\t// FIELDS PICKED, never the input object forwarded: an undeclared field\n\t\t\t// must never reach the API because a JavaScript caller passed it.\n\t\t\tconst res = await this.#http.post<{ account?: AccountData; url: string }>('/v1/accounts/connect', {\n\t\t\t\tapp: input.app,\n\t\t\t\t...(input.nickname !== undefined && { nickname: input.nickname }),\n\t\t\t});\n\t\t\tconst account = accountIn(res, '/v1/accounts/connect');\n\t\t\treturn { account: new Account(this.#http, account.id, account), url: res.url };\n\t\t},\n\n\t\t/** Every agent creator's account in this workspace, each with the agents\n\t\t *  that use it (`usedBy`). `app` narrows to one app's. */\n\t\tlist: async (input: { app?: AppId } = {}): Promise<Account[]> => {\n\t\t\tconst res = await this.#http.get<{ accounts: AccountData[] }>(\n\t\t\t\t'/v1/accounts',\n\t\t\t\tinput.app ? { app: input.app } : undefined,\n\t\t\t);\n\t\t\treturn (res.accounts ?? []).map((a) => new Account(this.#http, a.id, a));\n\t\t},\n\t};\n\n\t/**\n\t * The apps an agent can connect, and each one's own ready-made tools: what a\n\t * connection's `tools` chooses from.\n\t *\n\t * ```ts\n\t * const tools = await ws.apps.tools(App.SLACK);\n\t * const send = tools.find((t) => t.name === 'Send message');\n\t * await agent.connections.change('slack', { tools: [send!.id] });\n\t * ```\n\t */\n\treadonly apps = {\n\t\t/** One app's current tools, the common ones first. A tool marked `deletes`\n\t\t *  removes something; leave those out unless the agent needs them. */\n\t\ttools: async (app: AppId): Promise<AppTool[]> => {\n\t\t\tconst res = await this.#http.get<{ tools?: AppTool[] }>(`/v1/connections/apps/${encodeURIComponent(app)}/tools`);\n\t\t\treturn res.tools ?? [];\n\t\t},\n\t};\n\n\t/**\n\t * Knowledge bases: named folders of files your agents read.\n\t *\n\t * Called `knowledgeBases`, not `knowledge`, on purpose. `agent.knowledge`\n\t * already means one agent's FILES, and a `ws.knowledge.list()` returning\n\t * bases rather than files would be the same word meaning two different things\n\t * one level apart. The longer name is worth it.\n\t */\n\treadonly knowledgeBases = {\n\t\t/**\n\t\t * Create a base. The KEY is what agent configurations store, so pick\n\t\t * something readable: `product-docs`, not `kb1`.\n\t\t *\n\t\t * A key already in use is an error rather than a silent overwrite, because\n\t\t * the base it would replace may be one several agents already read from.\n\t\t */\n\t\tcreate: async (fields: {\n\t\t\tkey: string;\n\t\t\tname?: string;\n\t\t\tdescription?: string;\n\t\t}): Promise<KnowledgeBase> => {\n\t\t\tconst res = await this.#http.post<{ base: KnowledgeBaseData }>(\n\t\t\t\t'/v1/knowledge/bases',\n\t\t\t\tfields,\n\t\t\t);\n\t\t\treturn new KnowledgeBase(this.#http, res.base.key, res.base);\n\t\t},\n\n\t\t/** Every base in this workspace. No pagination: bases are few, and a\n\t\t *  workspace with hundreds of them has a naming problem rather than a\n\t\t *  paging one. */\n\t\tlist: async (): Promise<KnowledgeBase[]> => {\n\t\t\tconst res = await this.#http.get<{ bases: KnowledgeBaseData[] }>('/v1/knowledge/bases');\n\t\t\treturn (res.bases ?? []).map((b) => new KnowledgeBase(this.#http, b.key, b));\n\t\t},\n\n\t\t/** One base, by key. Returns a HANDLE you act through: `kb.files.put(...)`,\n\t\t *  `kb.attachments()`, `kb.delete()`. */\n\t\tget: async (key: string): Promise<KnowledgeBase> => {\n\t\t\tconst res = await this.#http.get<{ base: KnowledgeBaseData }>(\n\t\t\t\t`/v1/knowledge/bases/${encodeURIComponent(key)}`,\n\t\t\t);\n\t\t\treturn new KnowledgeBase(this.#http, res.base.key, res.base);\n\t\t},\n\t};\n\n\t/**\n\t * Databases your agents can query, each registered once under a key.\n\t *\n\t * Register first, then name the key in an agent's `databases`. Registering\n\t * logs in before saving, so a wrong login fails here instead of in a\n\t * conversation, and nothing is saved when it does. A database answers only\n\t * the agents whose configuration names its key.\n\t */\n\treadonly databases = {\n\t\t/**\n\t\t * Register a database under a key. Pass a connection string as `url`, or\n\t\t * the same login as `engine`, `host`, `port`, `database`, `username` and\n\t\t * `password`. Read-only unless `writable: true`.\n\t\t *\n\t\t * A key already in use is refused rather than overwritten, because agents\n\t\t * may already be querying the database it names.\n\t\t */\n\t\tcreate: async (fields: DatabaseFields): Promise<Database> => {\n\t\t\tconst res = await this.#http.post<{ database: DatabaseData }>('/v1/databases', fields);\n\t\t\treturn new Database(this.#http, res.database.key, res.database);\n\t\t},\n\n\t\t/** Check a login and see its tables, saving nothing. A refused login comes\n\t\t *  back as `{ ok: false, error }`, not as an exception. */\n\t\ttest: async (login: DatabaseLogin): Promise<DatabaseTestResult> =>\n\t\t\tthis.#http.post<DatabaseTestResult>('/v1/databases/test', login),\n\n\t\t/** Every database registered in this workspace, oldest first. */\n\t\tlist: async (): Promise<Database[]> => {\n\t\t\tconst res = await this.#http.get<{ databases: DatabaseData[] }>('/v1/databases');\n\t\t\treturn (res.databases ?? []).map((d) => new Database(this.#http, d.key, d));\n\t\t},\n\n\t\t/** One database, by key. Returns a HANDLE: `db.tables()`, `db.describe()`,\n\t\t *  `db.delete()`. */\n\t\tget: async (key: string): Promise<Database> => {\n\t\t\tconst res = await this.#http.get<{ database: DatabaseData }>(`/v1/databases/${encodeURIComponent(key)}`);\n\t\t\treturn new Database(this.#http, res.database.key, res.database);\n\t\t},\n\t};\n\n\t/**\n\t * Whether this workspace's agents may call outside services. `'off'` refuses\n\t * every HTTP tool and leaves out web search and opening web pages, on every\n\t * agent, from their next call or turn. MCP servers and connections are not\n\t * covered yet. Anyone can read it; only an owner or admin, signed in, can\n\t * change it (an API key gets 403).\n\t */\n\treadonly outsideCalls = {\n\t\tget: async (): Promise<'on' | 'off'> =>\n\t\t\t(await this.#http.get<{ outsideCalls: 'on' | 'off' }>('/v1/workspace/outside-calls')).outsideCalls,\n\t\tset: async (value: 'on' | 'off'): Promise<'on' | 'off'> =>\n\t\t\t(await this.#http.put<{ outsideCalls: 'on' | 'off' }>('/v1/workspace/outside-calls', { outsideCalls: value })).outsideCalls,\n\t};\n\n\treadonly projects = {\n\t\tcreate: async (fields: ProjectFields): Promise<Project> => {\n\t\t\tconst data = toProjectData(await this.#http.post('/v1/projects', fields));\n\t\t\treturn new Project(this.#http, data.id, data);\n\t\t},\n\t\tlist: async (): Promise<Project[]> => {\n\t\t\tconst res = await this.#http.get<{ projects: unknown[] }>('/v1/projects');\n\t\t\treturn (res.projects ?? [])\n\t\t\t\t.map((p) => toProjectData(p as never))\n\t\t\t\t.map((p) => new Project(this.#http, p.id, p));\n\t\t},\n\t};\n\n\t// ---- The account, read-only ------------------------------------------\n\t//\n\t// Everything below reads. There is no create-a-key, no invite, no change of\n\t// plan and no payment method, deliberately and not for want of an endpoint.\n\t// A key is a long-lived credential that ends up in CI, in a container image\n\t// and in somebody's shell history; the blast radius of one that leaks should\n\t// be \"they could read our balance\", not \"they added themselves to the\n\t// account\".\n\t//\n\t// Each of these is scoped to the key's OWN workspace by the server, from the\n\t// key's row rather than from anything the caller sends, so there is no\n\t// workspace argument to pass and no way to point them elsewhere.\n\n\t/**\n\t * Who is on this workspace, and what each of them may do.\n\t *\n\t * ```ts\n\t * for (const m of await ws.members()) {\n\t *   console.log(m.email, m.role);\n\t * }\n\t * ```\n\t */\n\tasync members(): Promise<WorkspaceMember[]> {\n\t\tconst res = await this.#http.get<{ members: WorkspaceMember[] }>('/v1/teams/members');\n\t\treturn res.members ?? [];\n\t}\n\n\t/**\n\t * What credit is left, and roughly how many turns that buys.\n\t *\n\t * The turn counts are the useful half: a balance in credits is not something\n\t * anybody can act on without knowing what a turn costs.\n\t *\n\t * ```ts\n\t * const { credits, standardTurnsRemaining } = await ws.credits();\n\t * if (standardTurnsRemaining < 100) await topUpSomehow();\n\t * ```\n\t */\n\tasync credits(): Promise<Credits> {\n\t\tconst res = await this.#http.get<Partial<Credits>>('/v1/credits');\n\t\treturn {\n\t\t\tcredits: res.credits ?? 0,\n\t\t\tstandardTurnsRemaining: res.standardTurnsRemaining ?? 0,\n\t\t\tpremiumTurnsRemaining: res.premiumTurnsRemaining ?? 0,\n\t\t};\n\t}\n\n\t/**\n\t * Which seat plan this workspace is on.\n\t *\n\t * Seats and credits are separate purchases: this says how many people may\n\t * share the account, not how much work they may do. Returns null when the\n\t * server cannot say, rather than guessing at the free plan, because \"we do\n\t * not know\" and \"you are on the cheapest one\" are different answers.\n\t */\n\tasync plan(): Promise<SeatPlan | null> {\n\t\tconst res = await this.#http.get<{\n\t\t\tplans?: SeatPlan[];\n\t\t\tcurrentPlanKey?: string | null;\n\t\t}>('/v1/seat-plans');\n\t\tif (!res.currentPlanKey) return null;\n\t\treturn (res.plans ?? []).find((p) => p.key === res.currentPlanKey) ?? null;\n\t}\n\n\t/** Address an agent you already have the id of. No request. */\n\tagent(agentId: string): Agent {\n\t\treturn new Agent(this.#http, agentId);\n\t}\n\n\t// `ws.conversation(id)` IS GONE, deliberately.\n\t//\n\t// A conversation belongs to an agent, or to a project, and is now addressed\n\t// from whichever one owns it: `ws.agent(a).conversation(id)`. Addressing it\n\t// from the workspace made the parent look optional, which is how this SDK\n\t// came to describe conversations as parentless in its own reference.\n\t//\n\t// The objection to moving it was that a caller would have to store two ids.\n\t// In practice the agent id is a constant in the caller's own code, because\n\t// they configured the agent; it is not a per-row value.\n\n\t/** Address a project you already have the id of. No request. */\n\tproject(projectId: string): Project {\n\t\treturn new Project(this.#http, projectId);\n\t}\n\n\t/**\n\t * One of YOUR end users. No request.\n\t *\n\t * The object everything about a person hangs off: their accounts, their\n\t * secrets, their conversations across every agent. You say who once, here,\n\t * instead of threading an `endUserId` through each call and forgetting it in\n\t * one of them.\n\t *\n\t * ```ts\n\t * const ananya = ws.endUser(row.userId);\n\t * const { url } = await ananya.accounts.connect({ app: App.GMAIL });\n\t * await ananya.conversations();\n\t * ```\n\t *\n\t * A SCOPE, NOT A RECORD. Every other addresser here points at a row we\n\t * store and can list back: `ws.agent(id)`, `ws.project(id)`,\n\t * `ws.account(id)`, `ws.secret(id)`, each with its own\n\t * `ws.<plural>.create/list` (or `connect/list`). This one points at nothing.\n\t * We do not create your end users, we cannot list them, and there is no\n\t * `ws.endUsers` collection anywhere in this SDK. We only write the id you\n\t * give us onto rows we already own.\n\t *\n\t * So this does not fetch a person. It hands you the same workspace,\n\t * narrowed to one of your people. If a `ws.endUsers` ever appears here,\n\t * something has started claiming to own them.\n\t *\n\t * It hangs off the workspace because a an end-user id is MEANINGLESS WITHOUT\n\t * ONE: uniqueness is (workspace_id, end_user_id, provider), so two of our\n\t * own customers can each have a person called `user_1` without colliding.\n\t *\n\t * NOT `ws.user()`, and not a workspace member. `ws.members()` lists the\n\t * colleagues who share this account, with ids we issued and authenticate.\n\t * This takes an id from YOUR database that we store verbatim and never\n\t * check. Passing one where the other belongs used to be a call that could\n\t * not fail, because there is nothing for an end-user id to fail against.\n\t */\n\tendUser(endUserId: string): EndUser {\n\t\treturn new EndUser(this.#http, endUserId);\n\t}\n\n\t/** Address an account you already have the id of. No request.\n\t *\n\t *  The sibling of `ws.agent(id)`. ANY account in this workspace: the agent\n\t *  creator's, or one of your end users' (`data.owner` says which, after a\n\t *  read). An account never belongs to one agent: many agents can name it,\n\t *  which is why reconnecting it once fixes all of them. `account.get()`\n\t *  reads it, and a missing one throws. */\n\taccount(accountId: string): Account {\n\t\treturn new Account(this.#http, accountId);\n\t}\n\n\t/** Address a secret you already have the id of. No request. */\n\tsecret(secretId: string): Secret {\n\t\treturn new Secret(this.#http, secretId);\n\t}\n\n\t/** Address a knowledge base you already know the key of. No request.\n\t *\n\t *  The sibling of `agent()` and `project()`, and it was the\n\t *  one missing: reaching a base meant `knowledgeBases.get(key)`, which costs a\n\t *  round trip to learn something the caller already knew. Use `get()` when you\n\t *  want the base's RECORD; use this when you only want to put a file in it. */\n\tknowledgeBase(key: string): KnowledgeBase {\n\t\treturn new KnowledgeBase(this.#http, key);\n\t}\n\n\t/** Address a database you already know the key of. No request. */\n\tdatabase(key: string): Database {\n\t\treturn new Database(this.#http, key);\n\t}\n}\n\n/**\n * The way in.\n *\n * ```ts\n * import { AgentNava } from '@cerebro-labs/agentnava-sdk';\n *\n * const ws = AgentNava.getWorkspace();          // reads AGENTNAVA_API_KEY\n * const ws = AgentNava.getWorkspace('ank_...'); // or pass the key\n * ```\n *\n * IT MAKES NO REQUEST. `get` here means \"hand me the workspace this key names\",\n * not \"go and fetch it\"; the first round trip happens on the first method you\n * call. `ws.get()` is the one that actually reads the record.\n *\n * An API key belongs to exactly one workspace, so there is nothing to select\n * and no workspace argument anywhere in this SDK. This does not CREATE a\n * workspace either: the key already names one, and creating them is not\n * something an API key may do (see \"the account is read-only\").\n */\nexport const AgentNava = {\n\tgetWorkspace(options: string | ClientOptions = {}): Workspace {\n\t\treturn new Workspace(typeof options === 'string' ? { apiKey: options } : options);\n\t},\n\t/** For a partner app's server: Sign in with AgentNava, then a workspace key (partner-app.ts). */\n\tpartnerApp(options: PartnerAppOptions): PartnerApp {\n\t\treturn new PartnerApp(options);\n\t},\n};\n"]}