@dialgem/sdk 0.1.0-beta.0 → 0.1.0-beta.2

package/dist/index.js

@@ -104,10 +104,10 @@ function isErrorBody(body) {
 }
 
 // src/version.ts
-var VERSION = "0.1.0-beta.0";
+var VERSION = "0.1.0-beta.2";
 
 // src/core/http.ts
-var RETRYABLE_METHODS = /* @__PURE__ */ new Set(["GET", "PATCH", "DELETE"]);
+var RETRYABLE_METHODS = /* @__PURE__ */ new Set(["GET", "PUT", "PATCH", "DELETE"]);
 var MAX_RETRY_DELAY_MS = 6e4;
 var HttpClient = class {
   baseURL;
@@ -130,6 +130,19 @@ var HttpClient = class {
   post(path2, body, options) {
     return this.request("POST", path2, { body, options });
   }
+  /**
+   * POST a `FormData` body — file uploads.
+   *
+   * The body is sent as-is and `Content-Type` is left unset, because only
+   * `fetch` knows the multipart boundary it is about to generate. Setting the
+   * header ourselves produces a request no server can parse.
+   */
+  postForm(path2, form, options) {
+    return this.request("POST", path2, { body: form, options });
+  }
+  put(path2, body, options) {
+    return this.request("PUT", path2, { body, options });
+  }
   patch(path2, body, options) {
     return this.request("PATCH", path2, { body, options });
   }
@@ -138,10 +151,11 @@ var HttpClient = class {
   }
   async request(method, path2, { query, body, options = {} }) {
     const url = this.buildURL(path2, query);
-    const headers = this.buildHeaders(body !== void 0, options.headers);
-    const payload = body === void 0 ? void 0 : JSON.stringify(body);
+    const isForm = isFormData(body);
+    const headers = this.buildHeaders(body !== void 0 && !isForm, options.headers);
+    const payload = body === void 0 ? void 0 : isForm ? body : JSON.stringify(body);
     const timeout = options.timeout ?? this.#timeout;
-    const maxRetries = options.maxRetries ?? (RETRYABLE_METHODS.has(method) ? this.#maxRetries : 0);
+    const maxRetries = isForm ? 0 : options.maxRetries ?? (RETRYABLE_METHODS.has(method) ? this.#maxRetries : 0);
     assertTimeout(timeout);
     assertMaxRetries(maxRetries);
     for (let attempt = 0; ; attempt++) {
@@ -195,7 +209,7 @@ var HttpClient = class {
     const params = new URLSearchParams();
     for (const [key, value] of Object.entries(query)) {
       if (value === void 0 || value === null) continue;
-      params.append(key, String(value));
+      for (const item of Array.isArray(value) ? value : [value]) params.append(key, String(item));
     }
     const qs = params.toString();
     return qs ? `${url}?${qs}` : url;
@@ -218,6 +232,9 @@ var HttpClient = class {
     return Object.fromEntries(merged.values());
   }
 };
+function isFormData(value) {
+  return typeof FormData !== "undefined" && value instanceof FormData;
+}
 function assertTimeout(value) {
   if (!Number.isInteger(value) || value <= 0) {
     throw new DialgemError(`\`timeout\` must be a positive integer of milliseconds, got ${String(value)}.`);
@@ -314,11 +331,14 @@ var Agents = class extends APIResource {
   knowledge;
   /** Remote MCP servers whose tools are exposed to the agent. */
   mcpServers;
+  /** Frozen snapshots of the agent that a number or a call can pin. */
+  versions;
   constructor(client) {
     super(client);
     this.functions = new AgentFunctions(client);
     this.knowledge = new AgentKnowledge(client);
     this.mcpServers = new AgentMCPServers(client);
+    this.versions = new AgentVersions(client);
   }
   /** Create an agent. Only `name` is required; everything else has a server default. */
   create(body, options) {
@@ -339,6 +359,48 @@ var Agents = class extends APIResource {
     return this._client.delete(path`/v1/agents/${agentId}`, options);
   }
 };
+var AgentVersions = class extends APIResource {
+  /** Freeze the agent as it is now. Returns the new version, snapshot included. */
+  publish(agentId, body = {}, options) {
+    return this._client.post(path`/v1/agents/${agentId}/versions`, body, options);
+  }
+  /**
+     * One page of published versions, newest first, without their snapshots.
+     *
+     * Returns the array. When you need to page — an agent published on every
+     * deploy accumulates versions, and nothing prunes them — read `has_more` from
+     * {@link listPage} instead and pass the last `version` as `before_version`.
+     */
+  async list(agentId, params, options) {
+    return (await this.listPage(agentId, params, options)).versions;
+  }
+  /** {@link list} with the `has_more` flag, for paging. */
+  listPage(agentId, params, options) {
+    return this._client.get(
+      path`/v1/agents/${agentId}/versions`,
+      // Spread into a plain query record: an `interface` has no index
+      // signature, so it does not structurally satisfy `Query`.
+      { ...params },
+      options
+    );
+  }
+  /** One version with its full snapshot. Version 0 is the draft: use `agents.retrieve`. */
+  retrieve(agentId, version, options) {
+    return this._client.get(
+      path`/v1/agents/${agentId}/versions/${versionSegment(version)}`,
+      void 0,
+      options
+    );
+  }
+};
+function versionSegment(version) {
+  if (!Number.isInteger(version) || version < 1) {
+    throw new DialgemError(
+      `Expected a published version number (a positive integer), got ${JSON.stringify(version)}. Version 0 is the draft \u2014 read it with agents.retrieve().`
+    );
+  }
+  return String(version);
+}
 var AgentFunctions = class extends APIResource {
   list(agentId, options) {
     return this._client.get(path`/v1/agents/${agentId}/functions`, void 0, options);
@@ -383,6 +445,13 @@ var AgentMCPServers = class extends APIResource {
     return this._client.delete(path`/v1/agents/${agentId}/mcp-servers/${serverId}`, options);
   }
   /** Connect to the server now, list its tools, and store the result as `last_status`. */
+  /**
+   * What the server offers right now, with each tool's description and argument schema. Connects live like
+   * `test`, but stores nothing. An unreachable server is not an error: `tools` is empty and `error` says why.
+   */
+  listTools(agentId, serverId, options) {
+    return this._client.get(path`/v1/agents/${agentId}/mcp-servers/${serverId}/tools`, void 0, options);
+  }
   test(agentId, serverId, options) {
     return this._client.post(path`/v1/agents/${agentId}/mcp-servers/${serverId}/test`, void 0, options);
   }
@@ -391,35 +460,33 @@ var AgentMCPServers = class extends APIResource {
 // src/core/pagination.ts
 var Page = class _Page {
   data;
-  total;
-  page;
-  page_size;
+  has_more;
+  pagination_key;
   #fetchPage;
   constructor(data, fetchPage) {
     this.data = data.data;
-    this.total = data.total;
-    this.page = data.page;
-    this.page_size = data.page_size;
+    this.has_more = data.has_more;
+    this.pagination_key = data.pagination_key;
     this.#fetchPage = fetchPage;
   }
   hasNextPage() {
-    return this.data.length > 0 && this.page * this.page_size < this.total;
+    return this.has_more && this.pagination_key !== null;
   }
   async getNextPage() {
     if (!this.hasNextPage()) throw new DialgemError("No next page; check hasNextPage() first.");
-    return new _Page(await this.#fetchPage(this.page + 1), this.#fetchPage);
+    return new _Page(await this.#fetchPage(this.pagination_key), this.#fetchPage);
   }
 };
 var PagePromise = class {
   #fetchPage;
-  #startPage;
+  #startKey;
   #first;
-  constructor(fetchPage, startPage) {
+  constructor(fetchPage, startKey = null) {
     this.#fetchPage = fetchPage;
-    this.#startPage = startPage;
+    this.#startKey = startKey;
   }
   #firstPage() {
-    this.#first ??= this.#fetchPage(this.#startPage).then((data) => new Page(data, this.#fetchPage));
+    this.#first ??= this.#fetchPage(this.#startKey).then((data) => new Page(data, this.#fetchPage));
     return this.#first;
   }
   then(onfulfilled, onrejected) {
@@ -444,24 +511,64 @@ var PagePromise = class {
 // src/resources/calls.ts
 var Calls = class extends APIResource {
   /**
-   * Calls, newest first. Await for one page, or iterate for every call:
+   * Calls, newest first by default. Await for one page, or iterate for every call:
    *
-   *   const page = await dialgem.calls.list({ page_size: 50 })
-   *   for await (const call of dialgem.calls.list({ status: "completed" })) {
-   *     if (call.started_at < cutoff) break // newest first: everything after is older
-   *   }
+   *   const page = await dialgem.calls.list({ limit: 50 })
+   *   for await (const call of dialgem.calls.list({ status: "completed", start_after: since })) { ... }
    */
   list(params = {}, options) {
-    const fetchPage = async (page) => {
-      const res = await this._client.get("/v1/calls", { ...params, page }, options);
-      return { data: res.calls, total: res.total, page: res.page, page_size: res.page_size };
+    const query = toQuery(params);
+    const fetchPage = async (paginationKey) => {
+      const res = await this._client.get(
+        "/v1/calls",
+        { ...query, pagination_key: paginationKey ?? void 0 },
+        options
+      );
+      return { data: res.calls, has_more: res.has_more, pagination_key: res.pagination_key };
     };
-    return new PagePromise(fetchPage, params.page ?? 1);
+    return new PagePromise(fetchPage);
   }
-  /** One call, including its transcript, analysis and recording URL. */
+  /** One call, including its transcript, analysis, latency and recording URL. */
   retrieve(callId, options) {
     return this._client.get(path`/v1/calls/${callId}`, void 0, options);
   }
+  /** Replace the call's `metadata`. */
+  update(callId, body, options) {
+    return this._client.patch(path`/v1/calls/${callId}`, body, options);
+  }
+  /**
+   * Permanently delete a finished call: its record, transcript, analysis and
+   * recording. A call still in progress is refused with `ConflictError`; stop it first.
+   */
+  delete(callId, options) {
+    return this._client.delete(path`/v1/calls/${callId}`, options);
+  }
+  /**
+   * Run a finished call's post-call analysis again, with the agent's *current* analysis
+   * settings, and return the updated call. Use it after changing the fields or the model
+   * and wanting an older call read the new way.
+   *
+   * It replaces `analysis`; it does not bill the call again and does not send `call_analyzed`
+   * again, so read the result from this response or from `retrieve`. The model call can take
+   * a while. `ConflictError` with `errCode` `call_in_progress` until the call has ended,
+   * `no_transcript` when there is nothing to analyze, `agent_deleted` if the agent is gone.
+   * Not retried by default.
+   */
+  rerunAnalysis(callId, options) {
+    return this._client.post(path`/v1/calls/${callId}/rerun-analysis`, void 0, options);
+  }
+  /**
+   * End an ongoing call now, as if the agent had hung up. The call becomes
+   * `completed` with `disconnection_reason: "manual_stopped"` a moment later, and
+   * the usual `call_ended` webhook follows.
+   *
+   * `ConflictError` with `errCode` `call_not_ongoing` if it already ended, or
+   * `call_not_connected` if no agent is on the call yet (e.g. still ringing).
+   * Not retried by default.
+   */
+  stop(callId, options) {
+    return this._client.post(path`/v1/calls/${callId}/stop`, void 0, options);
+  }
   /**
    * Dial `to` from one of your organization's numbers, with `agent_id` (or the
    * number's outbound agent) on the line.
@@ -481,13 +588,76 @@ var Calls = class extends APIResource {
     return this._client.post("/v1/calls/register", body, options);
   }
 };
+function toQuery(params) {
+  const { metadata, ...rest } = params;
+  const query = { ...rest };
+  query["limit"] = params.limit ?? 10;
+  for (const [key, value] of Object.entries(metadata ?? {})) {
+    query[`metadata.${key}`] = String(value);
+  }
+  return query;
+}
 
 // src/resources/catalog.ts
 var Voices = class extends APIResource {
-  /** Voices available to agents, by name. Put a voice's `provider_voice_id` in an agent's `voice_id`. */
+  /**
+   * Voices available to agents: the shared catalog plus the ones your
+   * organization cloned, yours first. Put a voice's `provider_voice_id` in an
+   * agent's `voice_id`.
+   */
   list(params = {}, options) {
     return this._client.get("/v1/voices", params, options);
   }
+  /**
+   * Clone a voice from audio you upload. The new voice is private to your
+   * organization and never appears in another one's catalog.
+   *
+   * Consent is required: you are asserting that you hold the rights to the
+   * audio and have the speaker's consent, and that assertion is recorded
+   * against your API identity.
+   *
+   * The upload is never retried, whatever `maxRetries` says — a retried
+   * multipart body can send truncated audio, and a clone built from half the
+   * recording succeeds and sounds wrong.
+   */
+  clone(params, options) {
+    const { name, files, consent_confirmed, engine, description, language, filenames } = params;
+    if (!consent_confirmed) {
+      throw new DialgemError(
+        "consent_confirmed must be true: you are asserting that you hold the rights to this audio and have the speaker's consent to clone their voice."
+      );
+    }
+    if (!files?.length) {
+      throw new DialgemError("At least one audio file is required to clone a voice.");
+    }
+    const form = new FormData();
+    form.append("name", name);
+    form.append("consent_confirmed", "true");
+    if (engine) form.append("engine", engine);
+    if (description) form.append("description", description);
+    if (language) form.append("language", language);
+    files.forEach((file, i) => {
+      const fallback = file.name || `clip-${i + 1}.wav`;
+      form.append("files", file, filenames?.[i] ?? fallback);
+    });
+    return this._client.postForm("/v1/voices/clone", form, options);
+  }
+  /**
+   * Delete a voice your organization cloned, at the provider and here.
+   *
+   * Only your own cloned voices: the shared catalog is not deletable, and a
+   * voice an agent still uses is refused with a 409 rather than leaving that
+   * agent without one.
+   */
+  delete(voiceId, options) {
+    return this._client.delete(path`/v1/voices/${voiceId}`, options);
+  }
+};
+var ExtractionModels = class extends APIResource {
+  /** Models an agent may use for post-call analysis, with an estimated cost per session. */
+  list(options) {
+    return this._client.get("/v1/models/extraction", void 0, options);
+  }
 };
 var FlowTemplates = class extends APIResource {
   /** Built-in conversation-flow templates (summaries, without `flow_config`). */
@@ -508,6 +678,287 @@ var PromptTemplates = class extends APIResource {
   }
 };
 
+// src/resources/account.ts
+var ApiKey = class extends APIResource {
+  /**
+   * Who this key is: your organization and the key's name, prefix, scopes, allowed addresses
+   * and expiry. It answers for any valid key whatever its scopes, so an integration can check
+   * what it was given. Never returns the secret.
+   *
+   * ```ts
+   * const { key } = await dialgem.apiKey.retrieve()
+   * if (key && !key.full_access) console.log("scoped to", key.scopes)
+   * ```
+   */
+  retrieve(options) {
+    return this._client.get("/v1/api-key-info", void 0, options);
+  }
+};
+var Sessions = class extends APIResource {
+  /**
+   * The calls your organization has in progress right now, with a `count`.
+   *
+   * Live state read from the service's own registry — use it for a
+   * concurrency check before placing a call. For finished calls use
+   * `calls.list`; a call whose teardown never arrived is not counted here.
+   */
+  list(options) {
+    return this._client.get("/v1/agent/sessions", void 0, options);
+  }
+  /**
+   * Change a live call's prompt and/or variables. It applies from the agent's **next turn**.
+   *
+   * `sessionId` is a session's `session_id` from `list`, or the call's own `call_id`. Only this call changes:
+   * the agent, its published versions and other calls are untouched, and the change is gone when the call ends.
+   * A turn already being spoken finishes as it was. `dynamic_variables` are merged over the call's variables;
+   * `system_prompt` replaces the prompt for the rest of the call.
+   *
+   * The call may be on any service instance. `NotFoundError` if it is not live (or is another organization's),
+   * `ConflictError` with `errCode` `session_ended` once it is over, `UnprocessableEntityError` with `errCode`
+   * `flow_agent_prompt` for a flow agent's prompt (its variables can still change). Not retried by default.
+   *
+   * ```ts
+   * await dialgem.sessions.update(callId, { dynamic_variables: { plan: "pro" } })
+   * ```
+   */
+  update(sessionId, body, options) {
+    return this._client.patch(path`/v1/agent/sessions/${sessionId}`, body, options);
+  }
+  /**
+   * Make the agent say `text` on a live call, in its own voice. Answers at once; the line plays behind what the
+   * agent is saying, or now with `interrupt: true`. The agent's conversation records it as something it said.
+   *
+   * Off unless the deployment enables live control: `ForbiddenError` with `errCode` `live_control_disabled`.
+   * `ConflictError` `human_has_call` while a human has taken the call. Owners, admins and API keys only.
+   * Not retried by default.
+   *
+   * ```ts
+   * await dialgem.sessions.say(callId, { text: "One moment while I check that." })
+   * ```
+   */
+  say(sessionId, body, options) {
+    return this._client.post(path`/v1/agent/sessions/${sessionId}/say`, body, options);
+  }
+  /**
+   * Hand a taken-over call back to the agent, for when the socket that took it is gone. The agent is told a
+   * human had the call and that it did not hear what was said. Same availability and limits as `say`.
+   * Listening in and taking over run over a WebSocket (`/v1/agent/sessions/{id}/live`), which this SDK does not wrap.
+   */
+  release(sessionId, options) {
+    return this._client.post(path`/v1/agent/sessions/${sessionId}/release`, void 0, options);
+  }
+};
+
+// src/resources/simulations.ts
+var Simulations = class extends APIResource {
+  /** Make a suite for one of your agents. */
+  createSuite(body, options) {
+    return this._client.post("/v1/simulations/suites", body, options);
+  }
+  /** Your suites, newest first, each with its latest run. Pass `agent_id` for one agent's. */
+  listSuites(params = {}, options) {
+    return this._client.get("/v1/simulations/suites", params, options);
+  }
+  /** One suite with its cases. */
+  retrieveSuite(suiteId, options) {
+    return this._client.get(path`/v1/simulations/suites/${suiteId}`, void 0, options);
+  }
+  /**
+   * Rename a suite or set its publish gate: `off`, `warn` (publishing a version succeeds and lists the suites the draft
+   * has not passed) or `block` (publishing is refused with 409 `simulation_required` until it has).
+   */
+  updateSuite(suiteId, body, options) {
+    return this._client.patch(path`/v1/simulations/suites/${suiteId}`, body, options);
+  }
+  /** Delete a suite and its cases. Past runs are deleted with it. */
+  deleteSuite(suiteId, options) {
+    return this._client.delete(path`/v1/simulations/suites/${suiteId}`, options);
+  }
+  /** Add a case (up to 50 per suite). 422 `invalid_case` says what to fix. */
+  createCase(suiteId, body, options) {
+    return this._client.post(path`/v1/simulations/suites/${suiteId}/cases`, body, options);
+  }
+  /** Change a case. Fields you leave out keep their value. */
+  updateCase(caseId, body, options) {
+    return this._client.patch(path`/v1/simulations/cases/${caseId}`, body, options);
+  }
+  deleteCase(caseId, options) {
+    return this._client.delete(path`/v1/simulations/cases/${caseId}`, options);
+  }
+  /**
+   * Run every case of a suite against the draft, a published version or `"latest_published"`. Answers at once
+   * (`202`); the run happens in the background, so poll `retrieveRun` until `status` is `completed`.
+   *
+   * 409 `suite_empty`, 422 `agent_type_not_supported` (multi-prompt agents), 429 `too_many_runs` or
+   * `daily_run_limit`.
+   */
+  run(suiteId, body = {}, options) {
+    return this._client.post(path`/v1/simulations/suites/${suiteId}/runs`, body, options);
+  }
+  /** Runs, newest first. Pass `suite_id` for one suite's. */
+  listRuns(params = {}, options) {
+    return this._client.get("/v1/simulations/runs", params, options);
+  }
+  /** A run with every case's transcript, tool calls and check results. */
+  retrieveRun(runId, options) {
+    return this._client.get(path`/v1/simulations/runs/${runId}`, void 0, options);
+  }
+  /** Stop a run that has not finished. Cases already under way finish; the rest are skipped. */
+  cancelRun(runId, options) {
+    return this._client.post(path`/v1/simulations/runs/${runId}/cancel`, void 0, options);
+  }
+};
+
+// src/resources/web-calls.ts
+var WebCalls = class extends APIResource {
+  /**
+   * Create a call for one visitor and get its access token.
+   *
+   *   const { access_token } = await dialgem.webCalls.create({ agent_id, metadata: { visitor: "v_123" } })
+   *
+   * `metadata` and `dialgem_llm_dynamic_variables` are fixed here, by you, and cannot be changed by the page.
+   * 409 `web_origins_not_configured` until an origin is allowed; 402 if the organization cannot pay for calls;
+   * 429 when more than `limits.tokens_per_minute` calls are created in a minute.
+   */
+  create(body, options) {
+    return this._client.post("/v1/calls/web", body, options);
+  }
+  /** The origins browser calls may start from, and the limits that apply. */
+  retrieveSettings(options) {
+    return this._client.get("/v1/web-calls/settings", void 0, options);
+  }
+  /**
+   * Replace the allowed origins. Each is `scheme://host[:port]`; `https://*.example.com` allows any subdomain
+   * (not the bare domain) and `*` allows any website. Tokens already issued keep the list they were issued with.
+   */
+  updateSettings(body, options) {
+    return this._client.put("/v1/web-calls/settings", body, options);
+  }
+};
+
+// src/resources/contacts.ts
+var Contacts = class extends APIResource {
+  /** Bulk import from CSV, with a dry-run preview. */
+  imports;
+  constructor(client) {
+    super(client);
+    this.imports = new ContactImports(client);
+  }
+  /**
+   * Add a contact. `phone` is any way of writing a valid number; without a leading `+`
+   * also pass `default_country` (`"US"`). A number that is already a contact answers 409
+   * with its `contact_id`.
+   */
+  create(body, options) {
+    return this._client.post("/v1/contacts", body, options);
+  }
+  /**
+   * Contacts, newest first. Await for one page, or iterate for every contact:
+   *
+   */
+  list(params = {}, options) {
+    const fetchPage = async (cursor) => {
+      const res = await this._client.get(
+        "/v1/contacts",
+        { ...params, cursor: cursor ?? void 0 },
+        options
+      );
+      return { data: res.contacts, has_more: res.next_cursor !== null, pagination_key: res.next_cursor };
+    };
+    return new PagePromise(fetchPage);
+  }
+  /**
+   * The contact with this phone number. The number is matched as E.164, so
+   * `("(212) 220-0001", { default_country: "US" })` finds `+12122200001`. Throws
+   * `NotFoundError` if you have no such contact, and `UnprocessableEntityError` if the text is
+   * not a phone number.
+   */
+  retrieveByPhone(phone, params = {}, options) {
+    return this._client.get(path`/v1/contacts/by-phone/${phone}`, params, options);
+  }
+  /** One contact, with its lists and how many calls it has had. */
+  retrieve(contactId, options) {
+    return this._client.get(path`/v1/contacts/${contactId}`, void 0, options);
+  }
+  /**
+   * Partial update: only the fields you send change, and `null` clears a field.
+   * `attributes` replaces the whole set, so send every field you want kept.
+   */
+  update(contactId, body, options) {
+    return this._client.patch(path`/v1/contacts/${contactId}`, body, options);
+  }
+  /**
+   * Erase a contact and its list memberships. Calls already made stay in the call log, and
+   * a do-not-call entry for the number stays too, so forgetting a person never makes a number
+   * that asked not to be called dialable again.
+   */
+  delete(contactId, options) {
+    return this._client.delete(path`/v1/contacts/${contactId}`, options);
+  }
+  /** Calls to or from the contact's number, newest first. Summaries, not transcripts. */
+  calls(contactId, params = {}, options) {
+    return this._client.get(path`/v1/contacts/${contactId}/calls`, params, options);
+  }
+};
+var ContactImports = class extends APIResource {
+  /** The file's headers, a guessed column mapping and a few rows. Imports nothing. */
+  inspect(csv, options) {
+    return this._client.post("/v1/contacts/imports/inspect", { csv }, options);
+  }
+  /**
+   * Start an import. Without `mapping` the columns are guessed from the headers. With
+   * `dry_run: true` nothing is written: the import only validates and reports.
+   */
+  create(body, options) {
+    return this._client.post("/v1/contacts/imports", body, options);
+  }
+  /** Recent imports, newest first. */
+  list(options) {
+    return this._client.get("/v1/contacts/imports", void 0, options);
+  }
+  /** Progress and counts. */
+  retrieve(importId, options) {
+    return this._client.get(path`/v1/contacts/imports/${importId}`, void 0, options);
+  }
+  /** The rows that were rejected, with the line, the reason and what each held. */
+  errors(importId, params = {}, options) {
+    return this._client.get(path`/v1/contacts/imports/${importId}/errors`, params, options);
+  }
+  /** Apply a previewed import: the file is read again, so what is applied is what was previewed. */
+  commit(importId, options) {
+    return this._client.post(path`/v1/contacts/imports/${importId}/commit`, void 0, options);
+  }
+  /** Stop an import that has not finished. Contacts a running import already wrote stay. */
+  cancel(importId, options) {
+    return this._client.delete(path`/v1/contacts/imports/${importId}`, options);
+  }
+};
+var ContactLists = class extends APIResource {
+  list(options) {
+    return this._client.get("/v1/contact-lists", void 0, options);
+  }
+  /** Names are unique within your organization, ignoring case. */
+  create(body, options) {
+    return this._client.post("/v1/contact-lists", body, options);
+  }
+  retrieve(listId, options) {
+    return this._client.get(path`/v1/contact-lists/${listId}`, void 0, options);
+  }
+  update(listId, body, options) {
+    return this._client.patch(path`/v1/contact-lists/${listId}`, body, options);
+  }
+  delete(listId, options) {
+    return this._client.delete(path`/v1/contact-lists/${listId}`, options);
+  }
+  /** Add up to 1000 of your contacts. Already-members are ignored; `added` says how many were new. */
+  addContacts(listId, contactIds, options) {
+    return this._client.post(path`/v1/contact-lists/${listId}/members`, { contact_ids: contactIds }, options);
+  }
+  removeContact(listId, contactId, options) {
+    return this._client.delete(path`/v1/contact-lists/${listId}/members/${contactId}`, options);
+  }
+};
+
 // src/resources/phone-numbers.ts
 var PhoneNumbers = class extends APIResource {
   /** Register a number you own (`phone_number` in E.164) with Dialgem. */
@@ -518,6 +969,20 @@ var PhoneNumbers = class extends APIResource {
   list(options) {
     return this._client.get("/v1/phone-numbers", void 0, options);
   }
+  /**
+   * One number by its E.164 value, e.g. `+14155550123`.
+   *
+   * Keyed on the number rather than on `id`, because the number is what you
+   * have when you are asking whether it is registered at all. Throws
+   * `NotFoundError` when it is not.
+   */
+  retrieve(phoneNumber, options) {
+    return this._client.get(
+      path`/v1/phone-numbers/by-number/${phoneNumber}`,
+      void 0,
+      options
+    );
+  }
   /**
    * Partial update.
    *
@@ -533,61 +998,237 @@ var PhoneNumbers = class extends APIResource {
   assign(phoneNumberId, body, options) {
     return this._client.patch(path`/v1/phone-numbers/${phoneNumberId}/assign`, body, options);
   }
+  /**
+   * Send one signed test request to the number's inbound routing webhook and report what a real call would have done
+   * with your answer: the status, how long you took against the time budget, and any field that would be ignored.
+   * Throws a `ConflictError` (`inbound_webhook_not_set`) when the number has no `inbound_webhook_url`.
+   */
+  testInboundWebhook(phoneNumberId, options) {
+    return this._client.post(path`/v1/phone-numbers/${phoneNumberId}/inbound-webhook/test`, void 0, options);
+  }
+  /**
+   * Replace the inbound webhook's signing secret. The new secret is returned **once**, as `inbound_webhook_secret`
+   * on the number; the old one stops working at once.
+   */
+  rotateInboundWebhookSecret(phoneNumberId, options) {
+    return this._client.post(path`/v1/phone-numbers/${phoneNumberId}/inbound-webhook/rotate-secret`, void 0, options);
+  }
   /** Release the number from Dialgem. It stops routing calls and disappears from `list()`; your carrier account is untouched. */
   delete(phoneNumberId, options) {
     return this._client.delete(path`/v1/phone-numbers/${phoneNumberId}`, options);
   }
 };
 
+// src/resources/chats.ts
+var Chats = class extends APIResource {
+  /**
+   * Start a chat. If the agent has a first message it is already in `messages`.
+   *
+   * `UnprocessableEntityError` with `errCode` `agent_type_not_supported` (flow agents) or `chat_requires_storage`.
+   * Not retried by default.
+   */
+  create(body, options) {
+    return this._client.post("/v1/chats", body, options);
+  }
+  /**
+   * Chats, newest first. Await for one page, or iterate for every chat. Entries leave out `messages`;
+   * `retrieve` a chat for them.
+   */
+  list(params = {}, options) {
+    const fetchPage = async (paginationKey) => {
+      const res = await this._client.get(
+        "/v1/chats",
+        { ...params, pagination_key: paginationKey ?? void 0 },
+        options
+      );
+      return { data: res.chats, has_more: res.has_more, pagination_key: res.pagination_key };
+    };
+    return new PagePromise(fetchPage);
+  }
+  /** One chat with all its messages. */
+  retrieve(chatId, options) {
+    return this._client.get(path`/v1/chats/${chatId}`, void 0, options);
+  }
+  /** Replace the chat's `metadata` (the whole object). */
+  update(chatId, body, options) {
+    return this._client.patch(path`/v1/chats/${chatId}`, body, options);
+  }
+  /** Delete a chat and its messages. */
+  delete(chatId, options) {
+    return this._client.delete(path`/v1/chats/${chatId}`, options);
+  }
+  /**
+   * Send the user's message and wait for the agent's reply. Returns only the new entries, in order: the user's
+   * message, any tool use, the agent's reply.
+   *
+   * If the agent's model fails (`ServerError`, `errCode` `model_error`) nothing is stored and the same message
+   * can be sent again. `ConflictError` with `errCode` `chat_busy` while another reply is in progress,
+   * `chat_ended` after the end, `message_limit` at the cap. If the agent calls its end-call tool, the reply's
+   * `chat_status` is `ended`.
+   *
+   * Not retried by default: a retry after an ambiguous failure could send the message twice.
+   */
+  sendMessage(chatId, content, options) {
+    return this._client.post(path`/v1/chats/${chatId}/messages`, { content }, options);
+  }
+  /** End the chat. Ending twice is fine. The analysis arrives a moment later; read it with `retrieve`. */
+  end(chatId, options) {
+    return this._client.post(path`/v1/chats/${chatId}/end`, void 0, options);
+  }
+  /**
+   * Analyse an ended chat again with the agent's current analysis settings and return it. `ConflictError` with
+   * `errCode` `chat_in_progress` until it has ended, `no_transcript` when it has no messages.
+   */
+  rerunAnalysis(chatId, options) {
+    return this._client.post(path`/v1/chats/${chatId}/rerun-analysis`, void 0, options);
+  }
+};
+
+// src/resources/flows.ts
+var Flows = class extends APIResource {
+  /** Validate and save a flow. `UnprocessableEntityError` (`errCode` `flow_invalid`) lists every problem. Not retried by default. */
+  create(body, options) {
+    return this._client.post("/v1/flows", body, options);
+  }
+  /** Flows, newest first. Await for one page, or iterate for every flow. Entries leave out `flow_config`. */
+  list(params = {}, options) {
+    const fetchPage = async (paginationKey) => {
+      const res = await this._client.get(
+        "/v1/flows",
+        { ...params, pagination_key: paginationKey ?? void 0 },
+        options
+      );
+      return { data: res.flows, has_more: res.has_more, pagination_key: res.pagination_key };
+    };
+    return new PagePromise(fetchPage);
+  }
+  /** One flow with its `flow_config`. */
+  retrieve(flowId, options) {
+    return this._client.get(path`/v1/flows/${flowId}`, void 0, options);
+  }
+  /** Rename a flow and/or replace its `flow_config` (checked again). Agents it was attached to are not changed. */
+  update(flowId, body, options) {
+    return this._client.patch(path`/v1/flows/${flowId}`, body, options);
+  }
+  /** Delete a saved flow. Agents it was attached to keep their copy. */
+  delete(flowId, options) {
+    return this._client.delete(path`/v1/flows/${flowId}`, options);
+  }
+};
+
+// src/resources/llms.ts
+var LLMs = class extends APIResource {
+  /** Save LLM settings. Anything left out takes the default a new agent gets. Not retried by default. */
+  create(body, options) {
+    return this._client.post("/v1/llms", body, options);
+  }
+  /** Saved LLMs, newest first. Await for one page, or iterate for every one. */
+  list(params = {}, options) {
+    const fetchPage = async (paginationKey) => {
+      const res = await this._client.get(
+        "/v1/llms",
+        { ...params, pagination_key: paginationKey ?? void 0 },
+        options
+      );
+      return { data: res.llms, has_more: res.has_more, pagination_key: res.pagination_key };
+    };
+    return new PagePromise(fetchPage);
+  }
+  retrieve(llmId, options) {
+    return this._client.get(path`/v1/llms/${llmId}`, void 0, options);
+  }
+  /** Change the fields you send. Agents it was attached to are not changed. */
+  update(llmId, body, options) {
+    return this._client.patch(path`/v1/llms/${llmId}`, body, options);
+  }
+  /** Delete saved LLM settings. Agents they were attached to keep their copy. */
+  delete(llmId, options) {
+    return this._client.delete(path`/v1/llms/${llmId}`, options);
+  }
+};
+
 // src/webhooks.ts
 var WEBHOOK_SIGNATURE_HEADER = "x-dialgem-signature";
 var WEBHOOK_EVENT_HEADER = "x-dialgem-event";
+var WEBHOOK_PREVIOUS_SIGNATURE_HEADER = "x-dialgem-signature-previous";
+var WEBHOOK_DELIVERY_HEADER = "x-dialgem-delivery";
+var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1e3;
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
+var SIGNATURE_RE = /^v=(\d{10,16}),d=([0-9a-f]{64})$/;
 var Webhooks = class {
   /**
-   * Returns whether `signature` is the HMAC-SHA256 of `payload` under `secret`.
-   * Constant-time. Returns `false` for a missing or malformed signature; throws only
-   * if `secret` is empty, which is a configuration error rather than a bad request.
+   * Returns whether `signature` is a current, valid signature of `payload` under
+   * `secret`. Constant-time. Returns `false` for a missing, malformed, tampered or
+   * stale signature; throws only if `secret` is empty, which is a configuration
+   * error rather than a bad request.
    */
-  async verify(payload, signature, secret) {
+  async verify(payload, signature, secret, options = {}) {
     if (!secret) {
       throw new DialgemError(
         "Webhook secret is empty. Set the agent's `webhook_signing_secret` and pass the same value here."
       );
     }
-    const received = firstHeader(signature)?.trim().toLowerCase();
-    if (!received || !/^[0-9a-f]{64}$/.test(received)) return false;
-    const expected = await hmacSha256Hex(secret, toBytes(payload));
+    const match = SIGNATURE_RE.exec(firstHeader(signature)?.trim().toLowerCase() ?? "");
+    if (!match) return false;
+    const [, timestamp, received] = match;
+    const now = options.now ?? Date.now();
+    if (Math.abs(now - Number(timestamp)) > (options.toleranceMs ?? DEFAULT_SIGNATURE_TOLERANCE_MS)) {
+      return false;
+    }
+    const body = toBytes(payload);
+    const message = new Uint8Array(body.length + timestamp.length);
+    message.set(body, 0);
+    message.set(encoder.encode(timestamp), body.length);
+    const expected = await hmacSha256Hex(secret, message);
     return timingSafeEqual(expected, received);
   }
   /**
-   * Verifies the signature, then parses the body.
+   * Verifies a webhook's signature, then parses its body.
+   *
+   * @throws WebhookVerificationError if the signature is missing, invalid or stale.
+   */
+  async constructEvent(payload, signature, secret, options = {}) {
+    const parsed = await this.#verifiedJson(payload, signature, secret, options);
+    if (typeof parsed !== "object" || parsed === null || typeof parsed.event !== "string") {
+      throw new WebhookVerificationError("Webhook body has no `event` field.");
+    }
+    return parsed;
+  }
+  /**
+   * Verifies a request Dialgem made to one of your custom functions, then parses
+   * its body. For functions with `args_at_root`, the body is the arguments object
+   * alone; use `verify` and parse it yourself.
    *
-   * @throws WebhookVerificationError if the signature is missing or does not match.
+   * @throws WebhookVerificationError if the signature is missing, invalid or stale.
    */
-  async constructEvent(payload, signature, secret) {
+  async constructFunctionCall(payload, signature, secret, options = {}) {
+    const parsed = await this.#verifiedJson(payload, signature, secret, options);
+    const body = parsed;
+    if (!body || typeof body.name !== "string" || typeof body.call !== "object" || body.call === null) {
+      throw new WebhookVerificationError(
+        "Function request body has no `name` and `call`. Does this function have args_at_root set?"
+      );
+    }
+    return body;
+  }
+  async #verifiedJson(payload, signature, secret, options) {
     if (!firstHeader(signature)) {
       throw new WebhookVerificationError(
         `Missing ${WEBHOOK_SIGNATURE_HEADER} header. Is a webhook_signing_secret set on the agent?`
       );
     }
-    if (!await this.verify(payload, signature, secret)) {
+    if (!await this.verify(payload, signature, secret, options)) {
       throw new WebhookVerificationError(
-        "Webhook signature does not match the body. Check the secret, and that the body was not re-serialized before verification."
+        "Signature is invalid or older than the allowed tolerance. Check the secret, the server clock, and that the body was not re-serialized before verification."
       );
     }
     const text = typeof payload === "string" ? payload : decoder.decode(toBytes(payload));
-    let parsed;
     try {
-      parsed = JSON.parse(text);
+      return JSON.parse(text);
     } catch {
-      throw new WebhookVerificationError("Webhook body is signed but is not valid JSON.");
-    }
-    if (typeof parsed !== "object" || parsed === null || typeof parsed.event !== "string") {
-      throw new WebhookVerificationError("Webhook body has no `event` field.");
+      throw new WebhookVerificationError("Body is signed but is not valid JSON.");
     }
-    return parsed;
   }
 };
 var webhooks = new Webhooks();
@@ -617,22 +1258,50 @@ function timingSafeEqual(a, b) {
 }
 
 // src/client.ts
-var DEFAULT_BASE_URL = "https://api.dialgem.com";
+var BASE_URL = "https://api.dialgem.com";
 var DEFAULT_TIMEOUT_MS = 6e4;
 var DEFAULT_MAX_RETRIES = 2;
 var Dialgem = class {
-  static DEFAULT_BASE_URL = DEFAULT_BASE_URL;
+  static BASE_URL = BASE_URL;
   /** Webhook verification without a client instance: `Dialgem.webhooks.constructEvent(...)`. */
   static webhooks = webhooks;
   agents;
   calls;
   phoneNumbers;
   voices;
+  /** Models available for post-call analysis. */
+  extractionModels;
   flowTemplates;
   promptTemplates;
+  /** Calls in progress right now. */
+  sessions;
+  /** Text conversations with an agent. */
+  chats;
+  flows;
+  llms;
+  /** What this API key is and may do. */
+  apiKey;
+  /**
+   * Verify what Dialgem sends you: `dialgem.webhooks.constructEvent(rawBody, signatureHeader, secret)`.
+   */
   webhooks = webhooks;
-  baseURL;
+  /** The organization's webhook destinations: create, update, rotate the signing secret, test. */
+  /** The people you call, with CSV import under `contacts.imports`. */
+  contacts;
+  /** Named groups of contacts. */
+  contactLists;
+  /** Browser calls: tokens for `@dialgem/client`, and the origins allowed to start them. */
+  webCalls;
+  /** Saved test conversations for an agent, run in text, with an optional publish gate. */
+  simulations;
+  /** Always `https://api.dialgem.com`. */
+  baseURL = BASE_URL;
   constructor(options = {}) {
+    if ("baseURL" in options) {
+      throw new DialgemError(
+        "`baseURL` is not an option: the SDK always talks to https://api.dialgem.com. Remove it."
+      );
+    }
     if (isBrowser() && !options.dangerouslyAllowBrowser) {
       throw new DialgemError(
         "The Dialgem SDK is for server-side use: running it in a browser exposes your API key to every visitor. Call Dialgem from your backend instead, or pass `dangerouslyAllowBrowser: true` if you understand the risk."
@@ -649,10 +1318,9 @@ var Dialgem = class {
     assertTimeout(timeout);
     assertMaxRetries(maxRetries);
     const fetchImpl = options.fetch ?? defaultFetch();
-    this.baseURL = (options.baseURL ?? readEnv("DIALGEM_BASE_URL") ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
     const http = new HttpClient({
       apiKey,
-      baseURL: this.baseURL,
+      baseURL: BASE_URL,
       timeout,
       maxRetries,
       fetch: fetchImpl,
@@ -662,8 +1330,18 @@ var Dialgem = class {
     this.calls = new Calls(http);
     this.phoneNumbers = new PhoneNumbers(http);
     this.voices = new Voices(http);
+    this.extractionModels = new ExtractionModels(http);
     this.flowTemplates = new FlowTemplates(http);
     this.promptTemplates = new PromptTemplates(http);
+    this.sessions = new Sessions(http);
+    this.chats = new Chats(http);
+    this.flows = new Flows(http);
+    this.llms = new LLMs(http);
+    this.apiKey = new ApiKey(http);
+    this.contacts = new Contacts(http);
+    this.contactLists = new ContactLists(http);
+    this.webCalls = new WebCalls(http);
+    this.simulations = new Simulations(http);
   }
 };
 function readEnv(name) {
@@ -683,6 +1361,6 @@ function defaultFetch() {
   return (url, init) => f.call(globalThis, url, init);
 }
 
-export { APIConnectionError, APIConnectionTimeoutError, APIError, APIUserAbortError, AuthenticationError, BadRequestError, ConflictError, DEFAULT_BASE_URL, Dialgem, DialgemError, InternalServerError, NotFoundError, Page, PagePromise, PermissionDeniedError, RateLimitError, UnprocessableEntityError, VERSION, WEBHOOK_EVENT_HEADER, WEBHOOK_SIGNATURE_HEADER, WebhookVerificationError, Webhooks, webhooks };
+export { APIConnectionError, APIConnectionTimeoutError, APIError, APIUserAbortError, AuthenticationError, BASE_URL, BadRequestError, ConflictError, DEFAULT_SIGNATURE_TOLERANCE_MS, Dialgem, DialgemError, InternalServerError, NotFoundError, Page, PagePromise, PermissionDeniedError, RateLimitError, UnprocessableEntityError, VERSION, WEBHOOK_DELIVERY_HEADER, WEBHOOK_EVENT_HEADER, WEBHOOK_PREVIOUS_SIGNATURE_HEADER, WEBHOOK_SIGNATURE_HEADER, WebhookVerificationError, Webhooks, webhooks };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map