@inferencesh/sdk 0.21.0 → 0.22.0

package/dist/types.js

@@ -203,6 +203,12 @@ export const ScopeSecretsRead = "secrets:read";
  * Empty scopes = full access (for backwards compatibility with existing keys).
  */
 export const ScopeSecretsWrite = "secrets:write";
+/**
+ * ScopeSecretsReveal reads a secret's plaintext value. A key holding
+ * secrets:read holds it too (keys revealed with secrets:read before it
+ * existed); an app's OAuth token or a bound session never does.
+ */
+export const ScopeSecretsReveal = "secrets:reveal";
 /**
  * Action-level scopes for credentials (connected accounts, vaults,
  * auth schemes, MCP servers).
@@ -284,6 +290,32 @@ export const ScopeSettingsRead = "settings:read";
  * Empty scopes = full access (for backwards compatibility with existing keys).
  */
 export const ScopeSettingsWrite = "settings:write";
+/**
+ * Approvals: answering a human-in-the-loop question (a tool approval, a
+ * gate, a widget or MCP input request, always-allow) and widening a
+ * chat's approval policy (allow every tool, skip hooks, allow rules).
+ * Held only by the account holder's own sign-in.
+ */
+export const ScopeApprovalsWrite = "approvals:write";
+/**
+ * ScopeAdminRead views platform administration (/admin GET). Held
+ * only by an admin's own sign-in; the route's admin gate decides
+ * whether it carries power.
+ */
+export const ScopeAdminRead = "admin:read";
+/**
+ * ScopeAdminWrite changes platform administration (/admin). Held only
+ * by an admin's own sign-in.
+ */
+export const ScopeAdminWrite = "admin:write";
+/**
+ * ScopeAdminPricing reads and changes store pricing: a version's
+ * terms, its draft pricing (edit, evaluate, discard, publish, apply to
+ * the listing) and the sample tasks drafts are evaluated against. Held
+ * by an admin's own sign-in with platform power, and by a key of the
+ * platform's automation account (ScopeDefinition.Automation).
+ */
+export const ScopeAdminPricing = "admin:pricing";
 export const ScopeGroupAgents = "agents";
 export const ScopeGroupApps = "apps";
 export const ScopeGroupConversations = "conversations";
@@ -302,6 +334,8 @@ export const ScopeGroupKnowledge = "knowledge";
 export const ScopeGroupArtifacts = "artifacts";
 export const ScopeGroupUser = "user";
 export const ScopeGroupSettings = "settings";
+export const ScopeGroupApprovals = "approvals";
+export const ScopeGroupAdmin = "admin";
 /**
  * AlwaysAllowScopeExact: this call exactly (each piece of the command,
  * the file, the domain).
@@ -379,6 +413,21 @@ export const ErrorCodeAccountBanned = "account_banned";
  */
 export const ErrorCodePersonRequired = "person_required";
 export const ErrorCodeOTPRequired = "otp_required";
+/**
+ * ErrorCodeRequiresSignIn (403): the action needs a scope only the
+ * account holder's own sign-in holds (answering an approval, widening a
+ * chat's approval policy, the account, API keys, billing changes,
+ * admin), and the request carried an API key, an app's OAuth token or
+ * another delegated credential. Sign in on the web app or with `belt
+ * login` to do it.
+ */
+export const ErrorCodeRequiresSignIn = "requires_sign_in";
+/**
+ * ErrorCodeInsufficientScope (403): the credential does not hold the
+ * scope the operation takes (an API key, an app's OAuth token or a
+ * narrowed login granted less). The detail names the scope.
+ */
+export const ErrorCodeInsufficientScope = "insufficient_scope";
 /**
  * ErrorCodeImpersonationReasonRequired (403): a platform admin named a
  * team they are not a member of without a live impersonation grant.
@@ -386,6 +435,37 @@ export const ErrorCodeOTPRequired = "otp_required";
  */
 export const ErrorCodeImpersonationReasonRequired = "impersonation_reason_required";
 export const ErrorCodeMCPAuthExpired = "mcp_auth_expired";
+/**
+ * Admin elevation ("belt admin elevate"). AdminSessionRequired (403): a
+ * platform admin's credential that carries no admin power reached an
+ * admin route; a CLI login gets it by elevating. CLISessionRequired
+ * (403): only a CLI login may ask to be elevated. AdminRequired (403):
+ * only a platform admin may ask for or grant one. SameAdminRequired
+ * (403): the elevation was asked for by another account.
+ * BrowserSessionRequired (403): only the admin's own browser sign-in
+ * grants one, and only the person's own browser sign-in changes how the
+ * account is signed into (authenticator enrollment, RequireBrowserSession).
+ * InvalidTTL (400): the elevation asked for a window outside
+ * models.AdminElevationMinTTL..AdminElevationMaxTTL.
+ * AdminScopesNotApproved (403): a platform admin's CLI login was approved
+ * with a scope list that does not name the admin scopes, so it can't be
+ * elevated: log in again approving them, then elevate.
+ */
+export const ErrorCodeAdminSessionRequired = "admin_session_required";
+export const ErrorCodeAdminScopesNotApproved = "admin_scopes_not_approved";
+export const ErrorCodeCLISessionRequired = "cli_session_required";
+export const ErrorCodeAdminRequired = "admin_required";
+export const ErrorCodeSameAdminRequired = "same_admin_required";
+export const ErrorCodeBrowserSessionRequired = "browser_session_required";
+export const ErrorCodeInvalidTTL = "invalid_ttl";
+/**
+ * AdminAuthenticatorRequired (403): a platform admin without an
+ * authenticator app (TOTP) enrolled. Admin power needs one; until it is
+ * enrolled (POST /auth/totp/enroll, then /auth/totp/confirm) the admin
+ * works as an ordinary member. An admin who has one but whose session
+ * has not proved it gets otp_required instead: re-authenticate with it.
+ */
+export const ErrorCodeAdminAuthenticatorRequired = "admin_authenticator_required";
 /**
  * Entitlements. LimitExceeded (402) and FeatureNotAvailable (403) carry
  * EntitlementErrorMeta. EntitlementUnavailable (500) means the plan could
@@ -418,6 +498,32 @@ export const ErrorCodeAlreadyClaimed = "already_claimed";
  */
 export const ErrorCodeAlreadyEntitled = "already_entitled";
 export const ErrorCodeRequestOpen = "request_open";
+/**
+ * Authorization codes (device sign-in, admin elevation) (400): the code
+ * is unknown, already approved or denied, or past its expiry.
+ */
+export const ErrorCodeInvalidCode = "invalid_code";
+export const ErrorCodeAlreadyProcessed = "already_processed";
+export const ErrorCodeExpired = "expired";
+/**
+ * Run-time refusals. AppRetired (410): the app no longer runs.
+ * AppMaintenance (503, Retry-After): the owner paused it; the message is
+ * theirs. InvalidTransition (409): the task already moved on.
+ */
+export const ErrorCodeAppRetired = "app_retired";
+export const ErrorCodeAppMaintenance = "app_maintenance";
+export const ErrorCodeInvalidTransition = "invalid_transition";
+/**
+ * Session-bound runs. SessionNotFound (404), SessionExpired and
+ * SessionEnded (410), WorkerLeased, AppMismatch and VersionMismatch
+ * (409). The SDKs match these upper-case strings.
+ */
+export const ErrorCodeSessionNotFound = "SESSION_NOT_FOUND";
+export const ErrorCodeSessionExpired = "SESSION_EXPIRED";
+export const ErrorCodeSessionEnded = "SESSION_ENDED";
+export const ErrorCodeWorkerLeased = "WORKER_LEASED";
+export const ErrorCodeAppMismatch = "APP_MISMATCH";
+export const ErrorCodeVersionMismatch = "VERSION_MISMATCH";
 /**
  * Remote harness refusals.
  */
@@ -1198,6 +1304,11 @@ export const PolicyKindFlow = "Flow";
  * PolicyKindWebFetch: fetched domains.
  */
 export const PolicyKindWebFetch = "WebFetch";
+/**
+ * PolicyKindSecretSend: an agent of another team sending the runner's
+ * secrets to a host.
+ */
+export const PolicyKindSecretSend = "SecretSend";
 /**
  * FunctionKindRun takes an input and returns an output (optionally
  * yielding progress on the way). The zero value means this.

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const SDK_VERSION: string;

package/dist/version.js

@@ -0,0 +1,7 @@
+/**
+ * SDK version string, sent in the X-Client-Source header. Read from
+ * package.json so the version has one source; `../package.json` resolves from
+ * both src/ and dist/, and npm always ships package.json.
+ */
+import pkg from '../package.json' with { type: 'json' };
+export const SDK_VERSION = pkg.version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inferencesh/sdk",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Official JavaScript/TypeScript SDK for inference.sh - Run AI models with a simple API",
   "type": "module",
   "main": "dist/index.js",
@@ -12,6 +12,7 @@
       "default": "./dist/index.js"
     },
     "./proxy": {
+      "inference-src": "./src/proxy/index.ts",
       "types": "./dist/proxy/index.d.ts",
       "default": "./dist/proxy/index.js"
     },