@inferencesh/sdk 0.20.0 → 0.21.0

package/CHANGELOG.md

@@ -7,6 +7,63 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.21.0] - 2026-10-08
+
+Breaking: `AgentClient.http` requires `fetch`, the `AppTag*` constants are removed, and `StreamableManagerOptions` is a type alias. See Changed and Removed.
+
+### Added
+
+- `HttpClient.fetch(endpoint, init?)`: fetches an endpoint with the client's auth, headers and credentials mode and resolves with the raw `Response`, for bodies `request()` does not parse (streams, text). A refused response throws the error `request()` would (`InferenceError`, `RequirementsNotMetException`). Type `HttpFetchInit`.
+- `StreamRequest` and `StreamRequestInit`: a function that sends a stream's request. `StreamableManager` takes `{ request }` in place of `{ url, headers, credentials }`, and `streamable()` / `streamableRaw()` take one in place of the URL. With `(init) => http.fetch(endpoint, init)` the stream carries the token of the moment it connects and a refusal goes through `onError`. Type `StreamableSource`.
+- `onError` gets a third argument, `FailedRequest` (`{ token }`): the bearer token the failed request carried, so a handler that refreshes credentials can tell a request sent before the refresh from one sent after it.
+- `getToken` may be async (`() => string | null | undefined | Promise<string | null | undefined>`). `request()`, `fetch()` and the EventSource handshake wait for it.
+- `HttpClient.request()` takes `handleErrors` (default `true`). With `handleErrors: false` the caller handles the request's failure itself: `onError` is not called for it, nothing is retried, and the error is thrown as it is.
+
+- Types: `StoreCategoryDTO` and `StoreTagDTO` (`GET /store/categories`, `GET /store/tags`); the decision app contract (`DecisionInput`, `DecisionVisionInput`, `DecisionOutput` and its question and answer types); `ErrorCodeImpersonationReasonRequired`.
+
+### Changed
+
+- `AgentClient.http` requires `fetch` and no longer requires `getStreamableConfig`. A hand-built `AgentClient` must add `http.fetch`; `Inference` and `HttpClient` already have it.
+- The streams the SDK opens itself (`tasks.run()` and `tasks.watch()`, `Agent` chat streams, the agent chat in `@inferencesh/sdk/agent`) go through `HttpClient.fetch`. A stream the api refuses now reaches `onError` like a refused request, and fails with an `InferenceError` (`statusCode`, `responseBody`) where it failed with `Error('HTTP <status>: <body>')`.
+- A request that got no response (the network failed) goes to `onError` from `fetch()` and the EventSource handshake too, as it already did from `request()`. The failure is thrown unless the handler's retry resolves with a response. A request aborted through its signal is not handed to `onError`.
+- The EventSource handshake and `fetch()` take what `onError` resolves with only when it is a `Response`; anything else leaves the refused response in place.
+- `StreamableManagerOptions` is a type alias (`StreamableSource & { ... }`), no longer an interface: it cannot be extended with `interface X extends StreamableManagerOptions<T>`; use an intersection.
+
+### Removed
+
+- The `AppTag*` constants (`AppTagTextToImage` and the rest). App tags come from the store: `GET /store/tags`, typed `StoreTagDTO`.
+
+### Deprecated
+
+- `HttpClient.getStreamableConfig()`: a request made from the config bypasses `onError` and carries the token of the moment the config was read. Use `fetch()` or a `StreamRequest`. It throws when `getToken` is async.
+
+## [0.20.1] - 2026-10-08
+
+### Added
+
+- Types: app tags and the decision app category.
+
+## [0.20.0] - 2026-10-07
+
+### Added
+
+- `tasks.files(id)`, `tasks.deleteFiles(id)` and `tasks.delete(id, { files })`: list a task's files and delete them with or without the task.
+- Types: task files, MCP Apps (`_meta.ui`, `AppUIRef`, the MCP tool call UI fields), remote tags and policy rules, `AppDTO.resolved_function`, `DescriptionLimit`.
+
+### Changed
+
+- Types: forms lose the bounty and reward fields; a bounty's proof form drops `proof_min_length`.
+
+### Security
+
+- `next` ^16.3.6 (resolves 16.3.8) for GHSA-vcvr-r3jv-pc5j.
+
+## [0.19.0] - 2026-10-04
+
+### Changed
+
+- Types regenerated; the run parameters docs drop `params.variant`.
+
 ## [0.18.0] - 2026-10-04
 
 ### Added

package/dist/agent/actions.js

@@ -109,11 +109,8 @@ export function createActions(ctx) {
             return;
         }
         // Single unified stream with TypedEvents (both Chat and ChatMessage events)
-        const { url, headers, credentials } = api.getChatStreamConfig(client, id);
         const manager = new StreamableManager({
-            url,
-            headers,
-            credentials,
+            request: api.chatStreamRequest(client, id),
             onError: (error) => {
                 console.warn('[AgentSDK] Stream error:', error);
                 callbacks.onError?.(error);

package/dist/agent/api.d.ts

@@ -9,6 +9,7 @@
  */
 import type { AlwaysAllowOptionsDTO, AlwaysAllowResultDTO, ChatAgentDTO, ChatDTO, ChatMessageDTO, ChatSettingsDTO, ChatSettingsRequest, InterruptDTO, ToolExplanationDTO } from '../types';
 import type { AgentOptions, AgentClient, AgentInfo, FileRef } from './types';
+import type { StreamRequest } from '../http/streamable';
 export interface SendResult {
     chatId: string;
     userMessage: ChatMessageDTO;
@@ -69,8 +70,4 @@ export declare function updateChatSettings(client: AgentClient, chatId: string,
 export declare function resolveInterrupt(client: AgentClient, interruptId: string, decision: 'allow' | 'deny'): Promise<InterruptDTO>;
 export declare function listRunInterrupts(client: AgentClient, runId: string): Promise<InterruptDTO[]>;
 export declare function uploadFile(client: AgentClient, file: globalThis.File): Promise<FileRef>;
-export declare function getChatStreamConfig(client: AgentClient, chatId: string): {
-    url: string;
-    headers: Record<string, string>;
-    credentials: RequestCredentials;
-};
+export declare function chatStreamRequest(client: AgentClient, chatId: string): StreamRequest;

package/dist/agent/api.js

@@ -203,6 +203,6 @@ export async function listRunInterrupts(client, runId) {
 export async function uploadFile(client, file) {
     return client.files.upload(file);
 }
-export function getChatStreamConfig(client, chatId) {
-    return client.http.getStreamableConfig(`/chats/${chatId}/stream`);
+export function chatStreamRequest(client, chatId) {
+    return (init) => client.http.fetch(`/chats/${chatId}/stream`, init);
 }

package/dist/agent/types.d.ts

@@ -19,7 +19,7 @@ export interface AlwaysAllowChoice {
  */
 export interface AgentClient {
     /** HTTP client for API requests */
-    http: Pick<HttpClient, 'request' | 'getStreamableConfig' | 'getStreamDefault' | 'getPollIntervalMs'>;
+    http: Pick<HttpClient, 'request' | 'fetch' | 'getStreamDefault' | 'getPollIntervalMs'>;
     /** Files API for uploads */
     files: {
         upload: (data: string | Blob | globalThis.File) => Promise<FileRef>;

package/dist/api/agents.js

@@ -209,13 +209,11 @@ export class Agent {
     streamUntilIdle(options, gate) {
         if (!this.chatId)
             return Promise.resolve();
-        const { url, headers, credentials } = this.http.getStreamableConfig(`/chats/${this.chatId}/stream`);
+        const endpoint = `/chats/${this.chatId}/stream`;
         return new Promise((resolve) => {
             this.stream?.stop();
             this.stream = new StreamableManager({
-                url,
-                headers,
-                credentials,
+                request: (init) => this.http.fetch(endpoint, init),
             });
             // Last chat/run observation was idle but the gate wasn't settled yet;
             // a terminal message for this turn can settle it.

package/dist/api/tasks.js

@@ -110,7 +110,6 @@ export class TasksAPI {
         const { onUpdate, onPartialUpdate, onDelta } = options;
         // Accumulate state across partial updates to preserve fields like session_id
         let accumulatedTask = { ...task };
-        const { url, headers, credentials } = this.http.getStreamableConfig(`/tasks/${task.id}/stream`);
         let streamManager;
         const done = new Promise((resolve, reject) => {
             const settle = (data, stripped) => {
@@ -128,9 +127,7 @@ export class TasksAPI {
                 }
             };
             streamManager = new StreamableManager({
-                url,
-                headers,
-                credentials,
+                request: (init) => this.http.fetch(`/tasks/${task.id}/stream`, init),
                 onDelta,
                 onData: (data) => {
                     // Merge new data, preserving existing fields if not in update

package/dist/http/client.d.ts

@@ -1,10 +1,26 @@
 import type { Response } from './response';
 import { EventSource } from 'eventsource';
+/** What a failed request was sent with, for an error handler that acts on it. */
+export interface FailedRequest {
+    /**
+     * The bearer token the request carried, or undefined when it carried none
+     * (proxy mode, or no apiKey and getToken returned nothing). A handler that
+     * refreshes credentials compares it with the token in hand: when they
+     * differ, the credentials were already replaced and a retry is enough.
+     */
+    token: string | undefined;
+}
 /**
  * Error handler that can intercept errors and optionally retry the request.
  * Return a promise to retry with a new result, or throw/rethrow to propagate the error.
+ * `retry` sends the request again with the token of that moment and does not
+ * come back through the handler. `request` describes the attempt that failed.
  */
-export type ErrorHandler = (error: unknown, retry: () => Promise<unknown>) => Promise<unknown>;
+export type ErrorHandler = (error: unknown, retry: () => Promise<unknown>, request: FailedRequest) => Promise<unknown>;
+/** Options of HttpClient.fetch: a fetch init whose credentials mode is the client's. */
+export type HttpFetchInit = Omit<RequestInit, 'headers' | 'credentials'> & {
+    headers?: Record<string, string>;
+};
 export type MessageHandler = (messages: import('../types').ResponseMessage[]) => void;
 export interface HttpClientConfig {
     /** Your inference.sh API key (required unless using proxyUrl) */
@@ -16,8 +32,11 @@ export interface HttpClientConfig {
      * When set, requests are routed through your proxy server to protect API keys.
      */
     proxyUrl?: string;
-    /** Dynamic token getter (alternative to apiKey) */
-    getToken?: () => string | null | undefined;
+    /**
+     * Dynamic token getter (alternative to apiKey), asked before every request.
+     * It may be async: the request waits for the token.
+     */
+    getToken?: () => string | null | undefined | Promise<string | null | undefined>;
     /** Dynamic headers */
     headers?: Record<string, string | (() => string | undefined)>;
     /** Request credentials mode */
@@ -71,15 +90,53 @@ export declare class HttpClient {
     isProxyMode(): boolean;
     /** Resolve dynamic headers */
     private resolveHeaders;
-    /** Get authorization token */
-    private getAuthToken;
+    /** The bearer token a request sent now carries; none through a proxy, which adds its own. */
+    private bearerToken;
+    /** The configured headers plus what identifies the request: its bearer, or through a proxy its target. */
+    private requestHeaders;
+    /**
+     * Where a request whose caller cannot set headers (EventSource) or reads
+     * the URL (streams) goes: the API, or the proxy with the target as a query
+     * parameter.
+     */
+    private streamUrl;
     /**
      * Make an HTTP request to the API
      */
-    request<T, P extends object = Record<string, unknown>>(method: 'get' | 'post' | 'put' | 'delete', endpoint: string, options?: {
+    request<T, P extends object = Record<string, unknown>>(method: 'get' | 'post' | 'put' | 'delete', endpoint: string, { handleErrors, ...options }?: {
         params?: P;
         data?: unknown;
+        /**
+         * `false` when the caller handles this request's failure itself: the
+         * client's error handler (onError) is not consulted, so there is no
+         * prompt, no redirect and no retry, and the error is thrown as it is.
+         */
+        handleErrors?: boolean;
     }): Promise<Response<T>>;
+    /**
+     * Fetch an API endpoint with the client's auth, headers and credentials
+     * mode and resolve with the raw response, for bodies request() does not
+     * parse (streams, text). A failure goes through onError like one of
+     * request() does: a refused response, or a request that got no response.
+     * It resolves with the response onError's retry got; when onError resolves
+     * with anything else the failure stands and is thrown, the error request()
+     * would throw. A request aborted through `init.signal` rejects with the
+     * abort and is not an error for onError.
+     */
+    fetch(endpoint: string, init?: HttpFetchInit): Promise<globalThis.Response>;
+    /**
+     * One fetch of `url` on behalf of `targetUrl`. A refused response, or a
+     * request that got none, goes to onError; the result is the response its
+     * retry got. Without one the failure stands: the error of a request that
+     * got no response is thrown, and a refusal is thrown as the error its body
+     * was read into or, for a caller that passes the response on
+     * (`refused: 'return'`), handed back with its body unread.
+     */
+    private fetchHandled;
+    /** The error a refused response stands for, read from its body. */
+    private readError;
+    /** HTTP errors → RFC 9457 problem+json */
+    private responseError;
     /**
      * Execute the actual HTTP request (internal)
      */
@@ -87,6 +144,10 @@ export declare class HttpClient {
     /**
      * Get URL and headers for NDJSON streaming.
      * Returns the full URL and auth headers needed for streamable requests.
+     * It answers synchronously, so it throws when getToken is async.
+     * @deprecated Use fetch(), or a StreamRequest built on it
+     * (`(init) => http.fetch(endpoint, init)`): a request made from this config
+     * bypasses onError and carries the token of the moment the config was read.
      */
     getStreamableConfig(endpoint: string): {
         url: string;
@@ -100,7 +161,7 @@ export declare class HttpClient {
     private extractErrorDetail;
     /**
      * Create an EventSource for SSE streaming
-     * @deprecated Use getStreamableConfig() with StreamableManager instead
+     * @deprecated Use StreamableManager with a StreamRequest instead
      */
     createEventSource(endpoint: string): Promise<EventSource | null>;
 }

package/dist/http/client.js

@@ -54,32 +54,139 @@ export class HttpClient {
         }
         return resolved;
     }
-    /** Get authorization token */
-    getAuthToken() {
-        if (this.getToken) {
-            return this.getToken();
+    /** The bearer token a request sent now carries; none through a proxy, which adds its own. */
+    async bearerToken() {
+        if (this.proxyUrl)
+            return undefined;
+        return (this.getToken ? await this.getToken() : this.apiKey) || undefined;
+    }
+    /** The configured headers plus what identifies the request: its bearer, or through a proxy its target. */
+    requestHeaders(targetUrl, token) {
+        const headers = this.resolveHeaders();
+        if (this.proxyUrl) {
+            headers['x-inf-target-url'] = targetUrl.toString();
+        }
+        else if (token) {
+            headers['Authorization'] = `Bearer ${token}`;
         }
-        return this.apiKey;
+        return headers;
+    }
+    /**
+     * Where a request whose caller cannot set headers (EventSource) or reads
+     * the URL (streams) goes: the API, or the proxy with the target as a query
+     * parameter.
+     */
+    streamUrl(targetUrl) {
+        if (!this.proxyUrl)
+            return targetUrl.toString();
+        const proxyUrlWithQuery = new URL(this.proxyUrl, typeof window !== 'undefined' ? window.location.origin : 'http://localhost');
+        proxyUrlWithQuery.searchParams.set('__inf_target', targetUrl.toString());
+        return proxyUrlWithQuery.toString();
     }
     /**
      * Make an HTTP request to the API
      */
-    async request(method, endpoint, options = {}) {
-        const doRequest = () => this.executeRequest(method, endpoint, options);
+    async request(method, endpoint, { handleErrors = true, ...options } = {}) {
+        const send = (token) => this.executeRequest(method, endpoint, options, token);
+        const token = await this.bearerToken();
         try {
-            return await doRequest();
+            return await send(token);
         }
         catch (error) {
-            if (this.onError) {
-                return await this.onError(error, doRequest);
+            if (this.onError && handleErrors) {
+                return await this.onError(error, async () => send(await this.bearerToken()), { token });
             }
             throw error;
         }
     }
+    /**
+     * Fetch an API endpoint with the client's auth, headers and credentials
+     * mode and resolve with the raw response, for bodies request() does not
+     * parse (streams, text). A failure goes through onError like one of
+     * request() does: a refused response, or a request that got no response.
+     * It resolves with the response onError's retry got; when onError resolves
+     * with anything else the failure stands and is thrown, the error request()
+     * would throw. A request aborted through `init.signal` rejects with the
+     * abort and is not an error for onError.
+     */
+    async fetch(endpoint, init = {}) {
+        const targetUrl = new URL(`${this.baseUrl}${endpoint}`);
+        const response = await this.fetchHandled(this.streamUrl(targetUrl), targetUrl, init, 'throw');
+        // What onError's retry got is handed over unread, and can be a refusal too.
+        if (!response.ok)
+            throw await this.readError(response);
+        return response;
+    }
+    /**
+     * One fetch of `url` on behalf of `targetUrl`. A refused response, or a
+     * request that got none, goes to onError; the result is the response its
+     * retry got. Without one the failure stands: the error of a request that
+     * got no response is thrown, and a refusal is thrown as the error its body
+     * was read into or, for a caller that passes the response on
+     * (`refused: 'return'`), handed back with its body unread.
+     */
+    async fetchHandled(url, targetUrl, init, refused) {
+        const send = (token) => fetch(url, {
+            ...init,
+            headers: { ...init.headers, ...this.requestHeaders(targetUrl, token) },
+            credentials: this.credentials,
+        });
+        const retry = async () => send(await this.bearerToken());
+        const token = await this.bearerToken();
+        let response;
+        try {
+            response = await send(token);
+        }
+        catch (error) {
+            // The caller aborted the request; nothing failed.
+            if (!this.onError || init.signal?.aborted)
+                throw error;
+            const handled = await this.onError(error, retry, { token });
+            if (handled instanceof globalThis.Response)
+                return handled;
+            throw error;
+        }
+        if (response.ok || (refused === 'return' && !this.onError))
+            return response;
+        // The body is read once: from a clone only when the response is handed back.
+        const error = await this.readError(refused === 'return' ? response.clone() : response);
+        const handled = await this.onError?.(error, retry, { token });
+        if (handled instanceof globalThis.Response)
+            return handled;
+        if (refused === 'return')
+            return response;
+        throw error;
+    }
+    /** The error a refused response stands for, read from its body. */
+    async readError(response) {
+        const responseText = await response.text().catch(() => '');
+        let data = null;
+        try {
+            data = JSON.parse(responseText);
+        }
+        catch {
+            // Not JSON
+        }
+        return this.responseError(response.status, responseText, data);
+    }
+    /** HTTP errors → RFC 9457 problem+json */
+    responseError(status, responseText, data) {
+        if (status === 412 && data && typeof data === 'object' && 'errors' in data && Array.isArray(data.errors)) {
+            return RequirementsNotMetException.fromResponse(data, status);
+        }
+        let errorDetail;
+        if (data && typeof data === 'object') {
+            errorDetail = this.extractErrorDetail(data) ?? JSON.stringify(data);
+        }
+        else if (responseText) {
+            errorDetail = responseText.slice(0, 500);
+        }
+        return new InferenceError(status, errorDetail || 'Request failed', responseText);
+    }
     /**
      * Execute the actual HTTP request (internal)
      */
-    async executeRequest(method, endpoint, options = {}) {
+    async executeRequest(method, endpoint, options, token) {
         // Build the target URL (always points to the API)
         const targetUrl = new URL(`${this.baseUrl}${endpoint}`);
         if (options.params) {
@@ -92,23 +199,11 @@ export class HttpClient {
             });
         }
         // In proxy mode, requests go to the proxy with target URL in a header
-        const isProxyMode = !!this.proxyUrl;
-        const fetchUrl = isProxyMode ? this.proxyUrl : targetUrl.toString();
+        const fetchUrl = this.proxyUrl ?? targetUrl.toString();
         const headers = {
             'Content-Type': 'application/json',
-            ...this.resolveHeaders(),
+            ...this.requestHeaders(targetUrl, token),
         };
-        if (isProxyMode) {
-            // Proxy mode: send target URL as header, no auth (proxy handles it)
-            headers['x-inf-target-url'] = targetUrl.toString();
-        }
-        else {
-            // Direct mode: include authorization header
-            const token = this.getAuthToken();
-            if (token) {
-                headers['Authorization'] = `Bearer ${token}`;
-            }
-        }
         const fetchOptions = {
             method: method.toUpperCase(),
             headers,
@@ -126,19 +221,8 @@ export class HttpClient {
         catch {
             // Not JSON
         }
-        // HTTP errors → RFC 9457 problem+json
         if (!response.ok) {
-            if (response.status === 412 && data && 'errors' in data && Array.isArray(data.errors)) {
-                throw RequirementsNotMetException.fromResponse(data, response.status);
-            }
-            let errorDetail;
-            if (data && typeof data === 'object') {
-                errorDetail = this.extractErrorDetail(data) ?? JSON.stringify(data);
-            }
-            else if (responseText) {
-                errorDetail = responseText.slice(0, 500);
-            }
-            throw new InferenceError(response.status, errorDetail || 'Request failed', responseText);
+            throw this.responseError(response.status, responseText, data);
         }
         if (response.status === 204 || !responseText) {
             return { data: undefined, messages: [] };
@@ -156,26 +240,22 @@ export class HttpClient {
     /**
      * Get URL and headers for NDJSON streaming.
      * Returns the full URL and auth headers needed for streamable requests.
+     * It answers synchronously, so it throws when getToken is async.
+     * @deprecated Use fetch(), or a StreamRequest built on it
+     * (`(init) => http.fetch(endpoint, init)`): a request made from this config
+     * bypasses onError and carries the token of the moment the config was read.
      */
     getStreamableConfig(endpoint) {
         const targetUrl = new URL(`${this.baseUrl}${endpoint}`);
-        const isProxyMode = !!this.proxyUrl;
-        let url;
-        const headers = { ...this.resolveHeaders() };
-        if (isProxyMode) {
-            const proxyUrlWithQuery = new URL(this.proxyUrl, typeof window !== 'undefined' ? window.location.origin : 'http://localhost');
-            proxyUrlWithQuery.searchParams.set('__inf_target', targetUrl.toString());
-            url = proxyUrlWithQuery.toString();
-            headers['x-inf-target-url'] = targetUrl.toString();
-        }
-        else {
-            url = targetUrl.toString();
-            const token = this.getAuthToken();
-            if (token) {
-                headers['Authorization'] = `Bearer ${token}`;
-            }
+        const token = this.proxyUrl ? undefined : this.getToken ? this.getToken() : this.apiKey;
+        if (token instanceof Promise) {
+            throw new Error('getStreamableConfig() cannot wait for an async getToken; use fetch() instead');
         }
-        return { url, headers, credentials: this.credentials };
+        return {
+            url: this.streamUrl(targetUrl),
+            headers: this.requestHeaders(targetUrl, token || undefined),
+            credentials: this.credentials,
+        };
     }
     /**
      * Pull a human-readable detail string from a parsed problem+json / API error
@@ -189,56 +269,16 @@ export class HttpClient {
     }
     /**
      * Create an EventSource for SSE streaming
-     * @deprecated Use getStreamableConfig() with StreamableManager instead
+     * @deprecated Use StreamableManager with a StreamRequest instead
      */
     createEventSource(endpoint) {
         const targetUrl = new URL(`${this.baseUrl}${endpoint}`);
-        const isProxyMode = !!this.proxyUrl;
-        // For proxy mode: Browser EventSource can't send custom headers,
-        // so append target URL as query param instead
-        let fetchUrl;
-        if (isProxyMode) {
-            const proxyUrlWithQuery = new URL(this.proxyUrl, typeof window !== 'undefined' ? window.location.origin : 'http://localhost');
-            proxyUrlWithQuery.searchParams.set('__inf_target', targetUrl.toString());
-            fetchUrl = proxyUrlWithQuery.toString();
-        }
-        else {
-            fetchUrl = targetUrl.toString();
-        }
-        const resolvedHeaders = this.resolveHeaders();
         // The EventSource error event omits the response body, so a failed initial
         // connection (e.g. 403 otp_required) is handled here in the fetch wrapper:
         // route it through onError like request() does, and hand the retried
         // response (e.g. after OTP verification) back so the stream connects.
-        const doFetch = async (input, init) => {
-            const headers = {
-                ...init?.headers,
-                ...resolvedHeaders,
-            };
-            if (isProxyMode) {
-                headers['x-inf-target-url'] = targetUrl.toString();
-            }
-            else {
-                const token = this.getAuthToken();
-                if (token) {
-                    headers['Authorization'] = `Bearer ${token}`;
-                }
-            }
-            const response = await fetch(input, { ...init, headers, credentials: this.credentials });
-            if (!response.ok && this.onError) {
-                const body = await response.clone().text().catch(() => '');
-                let data;
-                try {
-                    data = JSON.parse(body);
-                }
-                catch { /* non-JSON body */ }
-                const error = new InferenceError(response.status, this.extractErrorDetail(data) ?? 'Request failed', body);
-                const handled = await this.onError(error, () => doFetch(input, init));
-                return handled ?? response;
-            }
-            return response;
-        };
-        return Promise.resolve(new EventSource(fetchUrl, { fetch: doFetch }));
+        const doFetch = (input, init) => this.fetchHandled(input, targetUrl, init ?? {}, 'return');
+        return Promise.resolve(new EventSource(this.streamUrl(targetUrl), { fetch: doFetch }));
     }
 }
 /**

package/dist/http/index.d.ts

@@ -1,4 +1,4 @@
-export { HttpClient, type HttpClientConfig, type ErrorHandler, createHttpClient } from './client';
+export { HttpClient, type HttpClientConfig, type ErrorHandler, type FailedRequest, type HttpFetchInit, createHttpClient } from './client';
 export { StreamManager, type StreamManagerOptions, type PartialDataWrapper } from './stream';
-export { streamable, streamableRaw, StreamableManager, type StreamableOptions, type StreamableMessage, type StreamableManagerOptions } from './streamable';
+export { streamable, streamableRaw, StreamableManager, type StreamableOptions, type StreamableMessage, type StreamableManagerOptions, type StreamableSource, type StreamRequest, type StreamRequestInit } from './streamable';
 export { InferenceError, RequirementsNotMetException } from './errors';

package/dist/http/streamable.d.ts

@@ -3,6 +3,19 @@
  * This is the NDJSON alternative to SSE/EventSource that avoids
  * the browser's ~6 connection limit per domain.
  */
+/** What a stream asks of whatever sends its request. */
+export interface StreamRequestInit {
+    method: 'GET' | 'POST';
+    headers: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}
+/**
+ * Sends a stream's request in place of a plain fetch of a URL. With
+ * `(init) => http.fetch(endpoint, init)` the request carries the client's
+ * auth and a refusal goes through its error handler.
+ */
+export type StreamRequest = (init: StreamRequestInit) => Promise<Response>;
 export interface StreamableOptions {
     /** Additional headers to include */
     headers?: Record<string, string>;
@@ -14,7 +27,7 @@ export interface StreamableOptions {
     signal?: AbortSignal;
     /** Skip heartbeat messages (default: true) */
     skipHeartbeats?: boolean;
-    /** Request credentials mode (for cookie-based auth) */
+    /** Request credentials mode (for cookie-based auth); a StreamRequest brings its own */
     credentials?: RequestCredentials;
 }
 export interface StreamableMessage<T = unknown> {
@@ -30,19 +43,26 @@ export interface StreamableMessage<T = unknown> {
 /**
  * Stream NDJSON from an HTTP endpoint using fetch + ReadableStream.
  * Yields parsed JSON objects, automatically filtering heartbeats.
+ * `source` is the URL to fetch, or a StreamRequest that sends the request.
  */
-export declare function streamable<T = unknown>(url: string, options?: StreamableOptions): AsyncGenerator<T>;
+export declare function streamable<T = unknown>(source: string | StreamRequest, options?: StreamableOptions): AsyncGenerator<T>;
 /**
  * StreamableManager provides a callback-based API similar to StreamManager
  * but uses fetch + ReadableStream instead of EventSource.
  */
-export interface StreamableManagerOptions<T> {
+/** Where a StreamableManager's stream comes from: a URL it fetches, or a StreamRequest. */
+export type StreamableSource = {
     /** URL to connect to */
     url: string;
     /** Additional headers */
     headers?: Record<string, string>;
     /** Request credentials mode (for cookie-based auth) */
     credentials?: RequestCredentials;
+} | {
+    /** Sends the request, e.g. `(init) => http.fetch(endpoint, init)` */
+    request: StreamRequest;
+};
+export type StreamableManagerOptions<T> = StreamableSource & {
     /** Request body */
     body?: unknown;
     /** Called for each message */
@@ -57,7 +77,7 @@ export interface StreamableManagerOptions<T> {
     onEnd?: () => void;
     /** Called for delta events (streaming token deltas) */
     onDelta?: (delta: Record<string, any>, seq: number) => void;
-}
+};
 export declare class StreamableManager<T> {
     private options;
     private abortController;
@@ -76,4 +96,4 @@ export declare class StreamableManager<T> {
  * Raw streamable that yields the full message including wrapper.
  * Use this when you need access to event type or fields.
  */
-export declare function streamableRaw<T = unknown>(url: string, options?: StreamableOptions): AsyncGenerator<StreamableMessage<T> | T>;
+export declare function streamableRaw<T = unknown>(source: string | StreamRequest, options?: StreamableOptions): AsyncGenerator<StreamableMessage<T> | T>;

package/dist/http/streamable.js

@@ -3,12 +3,8 @@
  * This is the NDJSON alternative to SSE/EventSource that avoids
  * the browser's ~6 connection limit per domain.
  */
-/**
- * Stream NDJSON from an HTTP endpoint using fetch + ReadableStream.
- * Yields parsed JSON objects, automatically filtering heartbeats.
- */
-export async function* streamable(url, options = {}) {
-    const { headers = {}, body, method = body ? 'POST' : 'GET', signal, skipHeartbeats = true, credentials, } = options;
+/** Send the stream's request and hand back the body to read. */
+async function openStream(source, { headers = {}, body, method = body ? 'POST' : 'GET', signal, credentials }) {
     const requestHeaders = {
         Accept: 'application/x-ndjson',
         ...headers,
@@ -16,13 +12,13 @@ export async function* streamable(url, options = {}) {
     if (body) {
         requestHeaders['Content-Type'] = 'application/json';
     }
-    const res = await fetch(url, {
+    const init = {
         method,
         headers: requestHeaders,
         body: body ? JSON.stringify(body) : undefined,
         signal,
-        credentials,
-    });
+    };
+    const res = typeof source === 'string' ? await fetch(source, { ...init, credentials }) : await source(init);
     if (!res.ok) {
         const text = await res.text();
         throw new Error(`HTTP ${res.status}: ${text}`);
@@ -30,7 +26,16 @@ export async function* streamable(url, options = {}) {
     if (!res.body) {
         throw new Error('No response body');
     }
-    const reader = res.body.getReader();
+    return res.body;
+}
+/**
+ * Stream NDJSON from an HTTP endpoint using fetch + ReadableStream.
+ * Yields parsed JSON objects, automatically filtering heartbeats.
+ * `source` is the URL to fetch, or a StreamRequest that sends the request.
+ */
+export async function* streamable(source, options = {}) {
+    const { skipHeartbeats = true } = options;
+    const reader = (await openStream(source, options)).getReader();
     const decoder = new TextDecoder();
     let buffer = '';
     try {
@@ -109,12 +114,16 @@ export class StreamableManager {
         this.abortController = new AbortController();
         try {
             this.options.onStart?.();
-            for await (const message of streamableRaw(this.options.url, {
-                headers: this.options.headers,
-                body: this.options.body,
-                signal: this.abortController.signal,
-                credentials: this.options.credentials,
-            })) {
+            const { options } = this;
+            const stream = 'request' in options
+                ? streamableRaw(options.request, { body: options.body, signal: this.abortController.signal })
+                : streamableRaw(options.url, {
+                    headers: options.headers,
+                    body: options.body,
+                    signal: this.abortController.signal,
+                    credentials: options.credentials,
+                });
+            for await (const message of stream) {
                 if (!this.isRunning)
                     break;
                 const wrapper = message;
@@ -179,30 +188,9 @@ export class StreamableManager {
  * Raw streamable that yields the full message including wrapper.
  * Use this when you need access to event type or fields.
  */
-export async function* streamableRaw(url, options = {}) {
-    const { headers = {}, body, method = body ? 'POST' : 'GET', signal, skipHeartbeats = true, credentials, } = options;
-    const requestHeaders = {
-        Accept: 'application/x-ndjson',
-        ...headers,
-    };
-    if (body) {
-        requestHeaders['Content-Type'] = 'application/json';
-    }
-    const res = await fetch(url, {
-        method,
-        headers: requestHeaders,
-        body: body ? JSON.stringify(body) : undefined,
-        signal,
-        credentials,
-    });
-    if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`HTTP ${res.status}: ${text}`);
-    }
-    if (!res.body) {
-        throw new Error('No response body');
-    }
-    const reader = res.body.getReader();
+export async function* streamableRaw(source, options = {}) {
+    const { skipHeartbeats = true } = options;
+    const reader = (await openStream(source, options)).getReader();
     const decoder = new TextDecoder();
     let buffer = '';
     try {

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-export { HttpClient, type HttpClientConfig, type ErrorHandler, type MessageHandler, createHttpClient } from './http/client';
+export { HttpClient, type HttpClientConfig, type ErrorHandler, type FailedRequest, type HttpFetchInit, type MessageHandler, createHttpClient } from './http/client';
 export type { Response } from './http/response';
 import type { Response } from './http/response';
 export { StreamManager, type StreamManagerOptions, type PartialDataWrapper } from './http/stream';
-export { StreamableManager, type StreamableManagerOptions, type StreamableMessage, streamable, streamableRaw } from './http/streamable';
+export { StreamableManager, type StreamableManagerOptions, type StreamableSource, type StreamRequest, type StreamRequestInit, type StreamableMessage, streamable, streamableRaw } from './http/streamable';
 export { PollManager, type PollManagerOptions } from './http/poll';
 export { InferenceError, RequirementsNotMetException, SessionError, SessionNotFoundError, SessionExpiredError, SessionEndedError, WorkerLostError, isRequirementsNotMetException, isInferenceError, isSessionError, } from './http/errors';
 export { TasksAPI, type RunOptions, type WatchOptions, type TaskWatch } from './api/tasks';

package/dist/types.d.ts

@@ -481,6 +481,12 @@ export interface CreateAppRequest {
     agent_description?: string;
     category?: AppCategory;
     images?: AppImages;
+    /**
+     * Tags replace the app's tags when given; omitted, a deploy takes them
+     * from the version's metadata.tags, and keeps the stored ones if that is
+     * empty too.
+     */
+    tags?: string[];
     version?: AppVersionInput;
     preserve_current_version?: boolean;
 }
@@ -1220,6 +1226,12 @@ export interface AppDTO extends BaseModelDTO, PermissionModelDTO {
     agent_description: string;
     category: AppCategory;
     images: AppImages;
+    /**
+     * Tags name what the app does and its traits, as lowercase slugs
+     * (text-to-image, open-weights). GET /store/tags lists the ones in use
+     * with their titles.
+     */
+    tags: string[];
     version_id: string;
     version?: AppVersionDTO;
     status: AppStatus;
@@ -2427,7 +2439,7 @@ export interface DecideEntitlementRequestRequest {
  * and APIError.Code on the legacy envelope. Clients branch on these, so a
  * code is a named const here, where it generates into models and the SDKs.
  */
-export type ErrorCode = "invalid_request" | "validation_error" | "unauthorized" | "forbidden" | "not_found" | "conflict" | "name_conflict" | "already_exists" | "not_configured" | "method_not_allowed" | "rate_limited" | "internal_error" | "team_role_required" | "blocked_by_usage_policy" | "last_owner" | "account_deactivated" | "account_banned" | "person_required" | "otp_required" | "mcp_auth_expired" | "limit_exceeded" | "feature_not_available" | "entitlement_unavailable" | "payment_required" | "payment_method_required" | "form_closed" | "already_submitted" | "already_claimed" | "already_entitled" | "request_open" | "agents_disabled" | "remote_offline" | "remote_timeout" | "harness_not_drivable" | "harness_too_old";
+export type ErrorCode = "invalid_request" | "validation_error" | "unauthorized" | "forbidden" | "not_found" | "conflict" | "name_conflict" | "already_exists" | "not_configured" | "method_not_allowed" | "rate_limited" | "internal_error" | "team_role_required" | "blocked_by_usage_policy" | "last_owner" | "account_deactivated" | "account_banned" | "person_required" | "otp_required" | "impersonation_reason_required" | "mcp_auth_expired" | "limit_exceeded" | "feature_not_available" | "entitlement_unavailable" | "payment_required" | "payment_method_required" | "form_closed" | "already_submitted" | "already_claimed" | "already_entitled" | "request_open" | "agents_disabled" | "remote_offline" | "remote_timeout" | "harness_not_drivable" | "harness_too_old";
 export declare const ErrorCodeInvalidRequest: ErrorCode;
 export declare const ErrorCodeValidationError: ErrorCode;
 export declare const ErrorCodeUnauthorized: ErrorCode;
@@ -2471,6 +2483,12 @@ export declare const ErrorCodeAccountBanned: ErrorCode;
  */
 export declare const ErrorCodePersonRequired: ErrorCode;
 export declare const ErrorCodeOTPRequired: ErrorCode;
+/**
+ * ErrorCodeImpersonationReasonRequired (403): a platform admin named a
+ * team they are not a member of without a live impersonation grant.
+ * Clients stop viewing as the team on it.
+ */
+export declare const ErrorCodeImpersonationReasonRequired: ErrorCode;
 export declare const ErrorCodeMCPAuthExpired: ErrorCode;
 /**
  * Entitlements. LimitExceeded (402) and FeatureNotAvailable (403) carry
@@ -4077,6 +4095,23 @@ export interface StatBuckets {
     this_week: number;
     all_time: number;
 }
+export interface StoreCategoryDTO {
+    slug: string;
+    name: string;
+    description: string;
+    icon: string;
+    rank: number;
+    count: number;
+}
+/**
+ * StoreTagDTO is one app tag the store lists: a tag at least
+ * shared.MinAppsPerListedTag public apps carry.
+ */
+export interface StoreTagDTO {
+    slug: string;
+    title: string;
+    count: number;
+}
 /**
  * SubscriptionDTO for API responses
  */
@@ -4833,7 +4868,7 @@ export declare const ApiKeyScopeUser: ApiKeyScope;
  * service account, not a person, and outlives the admin who created it.
  */
 export declare const ApiKeyScopeWorkspace: ApiKeyScope;
-export type AppCategory = "image" | "video" | "audio" | "text" | "chat" | "3d" | "other" | "flow";
+export type AppCategory = "image" | "video" | "audio" | "text" | "chat" | "3d" | "other" | "flow" | "decision";
 export declare const AppCategoryImage: AppCategory;
 export declare const AppCategoryVideo: AppCategory;
 export declare const AppCategoryAudio: AppCategory;
@@ -4842,6 +4877,10 @@ export declare const AppCategoryChat: AppCategory;
 export declare const AppCategory3D: AppCategory;
 export declare const AppCategoryOther: AppCategory;
 export declare const AppCategoryFlow: AppCategory;
+/**
+ * Decision models: typed questions in, a probability for every answer out, no generation.
+ */
+export declare const AppCategoryDecision: AppCategory;
 export type AppStatus = "active" | "maintenance" | "deprecated" | "retired";
 export declare const AppStatusActive: AppStatus;
 export declare const AppStatusMaintenance: AppStatus;
@@ -5045,6 +5084,148 @@ export interface ChannelContext {
     channel_type?: ChannelType;
     channel_metadata?: any;
 }
+/**
+ * DecisionChoiceOption is one answer option of a choice question.
+ */
+export interface DecisionChoiceOption {
+    /**
+     * Name is returned as the choice and keys the probabilities.
+     */
+    name: string;
+    /**
+     * Description says what the option covers.
+     */
+    description?: any;
+}
+/**
+ * DecisionChoiceQuestion asks which one of a fixed set of options holds.
+ */
+export interface DecisionChoiceQuestion {
+    /**
+     * ID is the caller's key for the question; its answer comes back under it.
+     */
+    id: string;
+    instructions: any;
+    options: DecisionChoiceOption[];
+}
+/**
+ * DecisionScoreQuestion asks where the state sits on ordered levels.
+ */
+export interface DecisionScoreQuestion {
+    id: string;
+    instructions: any;
+    /**
+     * Levels are described low end to high end; a level's number is its index.
+     */
+    levels: any[];
+}
+/**
+ * DecisionNoulCriteria pins down what yes and no mean for a noul question.
+ */
+export interface DecisionNoulCriteria {
+    true?: any;
+    false?: any;
+}
+/**
+ * DecisionNoulQuestion asks for the probability that something is true.
+ */
+export interface DecisionNoulQuestion {
+    id: string;
+    instructions: any;
+    criteria?: DecisionNoulCriteria;
+}
+/**
+ * DecisionInput is one state and the questions asked of it.
+ */
+export interface DecisionInput {
+    state: any;
+    choices?: DecisionChoiceQuestion[];
+    scores?: DecisionScoreQuestion[];
+    nouls?: DecisionNoulQuestion[];
+}
+/**
+ * DecisionVisionInput is the input of a decision model that also sees
+ * images: a DecisionInput plus the images the questions are about.
+ */
+export interface DecisionVisionInput extends DecisionInput {
+    /**
+     * Images are file URIs. Every question sees them.
+     */
+    images?: string[];
+}
+/**
+ * DecisionChoiceAnswer is the answer to a choice question.
+ */
+export interface DecisionChoiceAnswer {
+    /**
+     * Choice is the highest-probability option.
+     */
+    choice: string;
+    confidence: number;
+    /**
+     * Probabilities maps every option name to its probability.
+     */
+    probabilities: {
+        [key: string]: number;
+    };
+}
+/**
+ * DecisionScoreAnswer is the answer to a score question.
+ */
+export interface DecisionScoreAnswer {
+    /**
+     * Score is the probability-weighted level, 0 to the top level number.
+     */
+    score: number;
+    /**
+     * Normalized is Score over the top level number: 0 to 1.
+     */
+    normalized: number;
+    confidence: number;
+    /**
+     * Probabilities maps each level number, as a string, to its probability.
+     */
+    probabilities: {
+        [key: string]: number;
+    };
+    /**
+     * Legend maps each level number back to its description.
+     */
+    legend: {
+        [key: string]: any;
+    };
+}
+/**
+ * DecisionNoulAnswer is the answer to a noul question.
+ */
+export interface DecisionNoulAnswer {
+    /**
+     * Noul is the probability that the answer is yes.
+     */
+    noul: number;
+}
+/**
+ * DecisionOutput is the answers, keyed by question id within each kind.
+ */
+export interface DecisionOutput {
+    choices: {
+        [key: string]: DecisionChoiceAnswer;
+    };
+    scores: {
+        [key: string]: DecisionScoreAnswer;
+    };
+    nouls: {
+        [key: string]: DecisionNoulAnswer;
+    };
+    /**
+     * Model is the model that answered.
+     */
+    model: string;
+    /**
+     * InputTokens is what the model read; decision models write none.
+     */
+    input_tokens: number;
+}
 /**
  * DescriptionLimit is the most characters a resource's description may have.
  */

package/dist/types.js

@@ -379,6 +379,12 @@ export const ErrorCodeAccountBanned = "account_banned";
  */
 export const ErrorCodePersonRequired = "person_required";
 export const ErrorCodeOTPRequired = "otp_required";
+/**
+ * ErrorCodeImpersonationReasonRequired (403): a platform admin named a
+ * team they are not a member of without a live impersonation grant.
+ * Clients stop viewing as the team on it.
+ */
+export const ErrorCodeImpersonationReasonRequired = "impersonation_reason_required";
 export const ErrorCodeMCPAuthExpired = "mcp_auth_expired";
 /**
  * Entitlements. LimitExceeded (402) and FeatureNotAvailable (403) carry
@@ -598,6 +604,10 @@ export const AppCategoryChat = "chat";
 export const AppCategory3D = "3d";
 export const AppCategoryOther = "other";
 export const AppCategoryFlow = "flow";
+/**
+ * Decision models: typed questions in, a probability for every answer out, no generation.
+ */
+export const AppCategoryDecision = "decision";
 export const AppStatusActive = "active";
 export const AppStatusMaintenance = "maintenance";
 export const AppStatusDeprecated = "deprecated";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inferencesh/sdk",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Official JavaScript/TypeScript SDK for inference.sh - Run AI models with a simple API",
   "type": "module",
   "main": "dist/index.js",