@chusky/sdk 1.8.0 → 1.8.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +6 -0
- package/docs/api-contract.md +7 -0
- package/openapi.yaml +1 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,12 @@
|
|
|
2
2
|
|
|
3
3
|
Releases use semantic versioning and are tagged `sdk-vX.Y.Z`.
|
|
4
4
|
|
|
5
|
+
## 1.8.1 - 2026-10-01
|
|
6
|
+
|
|
7
|
+
- Outcome verification accepts per-check `evidenceId` references to owned,
|
|
8
|
+
trusted mission receipts, artifacts, and human confirmations. Submitted
|
|
9
|
+
pass results and agent-authored evidence cannot bypass verification.
|
|
10
|
+
|
|
5
11
|
## 1.8.0 - 2026-10-01
|
|
6
12
|
|
|
7
13
|
- Expose catalog-declared MCP authentication headers through `mcp.connect()`;
|
package/docs/api-contract.md
CHANGED
|
@@ -4,6 +4,13 @@ This document is the implementation contract for the SDK. It prevents the existi
|
|
|
4
4
|
|
|
5
5
|
## Principles
|
|
6
6
|
|
|
7
|
+
Outcome checks of kind `receipt`, `artifact`, or `human` require `missionId`
|
|
8
|
+
and a per-check `evidenceId` referencing that owner's persisted mission proof.
|
|
9
|
+
Only system-verified receipts/artifacts or human-verified confirmations qualify.
|
|
10
|
+
Expected fields compare recorded `id`, `kind`, `source`, `ref`, and `hash`;
|
|
11
|
+
descriptions are not assertions of verified provider state. Provider reads still
|
|
12
|
+
execute live and cannot be replaced with stored receipts or submitted results.
|
|
13
|
+
|
|
7
14
|
1. `/v1` is the only public prefix. Existing `/cli`, Telegram, channel, and workflow routes remain private transport endpoints.
|
|
8
15
|
2. Developers create an API key in the Chusky dashboard and configure it as `CHUSKY_API_KEY` in their server environment. An end-user identifier is supplied in `X-Chusky-User-Id` and is never inferred from a phone number, display name, or channel identity. The first-party web dashboard may use its Better Auth session cookie for user-scoped `/v1` resources; API keys remain server-side credentials.
|
|
9
16
|
3. API keys are revocable and scope-enforced (`resource:read`, `resource:write`, `resource:*`, or `*`). Never use CLI device tokens for the SDK.
|
package/openapi.yaml
CHANGED
|
@@ -503,6 +503,7 @@ paths:
|
|
|
503
503
|
properties:
|
|
504
504
|
id: { type: string, maxLength: 160 }
|
|
505
505
|
kind: { type: string, enum: [provider_read, receipt, artifact, human] }
|
|
506
|
+
evidenceId: { type: string, maxLength: 200, description: Exact trusted evidence ID in the owned mission for receipt, artifact, or human checks. Agent assertions are not accepted. }
|
|
506
507
|
description: { type: string, maxLength: 1000 }
|
|
507
508
|
provider: { type: string, maxLength: 120 }
|
|
508
509
|
toolSlug: { type: string, maxLength: 200, description: Required for provider_read; must be available in the owner's Composio session and read-only. }
|