@inferencesh/sdk 0.25.0 → 0.26.1

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.26.1] - 2026-10-12
+
+### Added
+
+- Generated types follow the API: `AuthSchemeSpec` gains `resource`, `issuer`, `authorization_response_iss_parameter_supported`, `callback` and `profile`, and `AuthSchemeClientAuth` adds `"none"`.
+
+## [0.26.0] - 2026-10-12
+
+Breaking (types only, following the API's credential model): `CredentialRequirement.provider` is now a `ProviderSeed` object (`{ name?, website? }`) instead of a string, and the requirement's `name`, `website` and `key` fields moved into it. Requirements are keyed by slug.
+
+### Added
+
+- Generated types for the credential model: `ProviderSeed`, `ProviderSummary`, `ConnectTokens`, `SecretField`, `CredentialRequirements`, and the auth scheme vocabulary (`AuthSchemeKind`, `AuthSchemeFlow`, `AuthSchemeAPIKeyIn`, `AuthSchemeHTTPScheme`, `AuthSchemeClientAuth`), plus `provider_info` and MCP credentials on the DTOs.
+
 ## [0.25.0] - 2026-10-12
 
 ### Added

package/dist/types.d.ts

@@ -548,7 +548,7 @@ export interface AppVersionInput {
     };
     kernel?: string;
     required_secrets?: SecretRequirement[];
-    required_credentials?: CredentialRequirement[];
+    required_credentials?: CredentialRequirements;
     resources?: AppResources;
 }
 /**
@@ -1408,7 +1408,7 @@ export interface AppFunction {
      * in app code. Each must be covered by the app-wide list in inf.yml.
      * Empty means the function gets the app-wide list.
      */
-    credentials?: CredentialRequirement[];
+    credentials?: CredentialRequirements;
     /**
      * Annotations are MCP tool hints (read-only, destructive, idempotent,
      * open-world) declared on the function. Hints only: nothing trusts
@@ -1448,33 +1448,63 @@ export interface SecretRequirement {
     optional?: boolean;
 }
 /**
- * CredentialRequirement is an entry under credentials: in inf.yml: keys an
- * app needs that belong to a provider. Provider names whose credential
- * supplies them; Secrets lists the keys to inject from it (an API key
- * credential), Scopes what to ask for (an OAuth one).
+ * CredentialRequirement is an entry under credentials: in inf.yml: a
+ * credential the app uses, keyed by the credential's slug (what
+ * Credential.Provider stores). Secrets lists the keys to inject from it (an
+ * API key credential), Scopes what to ask for (an OAuth one), Capabilities
+ * the platform-defined grants it needs ("x.tweet.read", "google.sheets":
+ * an OAuth grant with the scopes it implies), each a capability of the
+ * entry's own provider. Provider seeds the catalog row for the company the
+ * first time it is seen and never overwrites it; Auth seeds the auth scheme
+ * when the slug is free.
  * 	credentials:
- * 	  - provider: acme
- * 	    name: Acme CRM
- * 	    website: acme.com
+ * 	  slack:
+ * 	    capabilities: [slack.channels.write]
+ * 	  acme:
  * 	    secrets: [ACME_API_KEY]
- * Key is a capability of a provider the platform defines ("x.tweet.read",
- * "google.sheets"): an OAuth grant with the scopes it implies. An entry sets
- * Provider, Key, or both; with both, Key decides how it is resolved.
+ * 	    provider: {name: Acme CRM, website: acme.com}
+ * The list form that preceded it is still read: `- provider: acme` names
+ * the slug, `- key: x.tweet.read` a capability (its slug is the part
+ * before the first dot), `name:` and `website:` seed the provider.
  */
 export interface CredentialRequirement {
-    provider?: string;
-    /**
-     * Name and Website describe a provider the platform does not list: the
-     * name its credential is shown under and the site its logo comes from.
-     */
-    name?: string;
-    website?: string;
-    key?: string;
+    slug?: string;
+    capabilities?: string[];
     description?: string;
     optional?: boolean;
     secrets?: string[];
     scopes?: string[];
+    /**
+     * Provider describes the company the credential belongs to, for a
+     * catalog row that does not exist yet. Its slug defaults to the
+     * credential slug.
+     */
+    provider?: ProviderSeed;
+    /**
+     * Auth is the credential's auth scheme, for a slug no row defines yet.
+     */
+    auth?: AuthSchemeSpec;
+}
+/**
+ * ProviderSeed is a provider (the company behind a credential) as an app
+ * declares it: enough to create its catalog row when none exists.
+ */
+export interface ProviderSeed {
+    slug?: string;
+    name?: string;
+    description?: string;
+    website?: string;
+    logo_uri?: string;
+    docs_uri?: string;
+    tos_uri?: string;
+    policy_uri?: string;
 }
+/**
+ * CredentialRequirements is the credentials: list of a manifest. It reads
+ * both forms: a map keyed by credential slug (the current one) and a list
+ * of entries; it is always written as a list.
+ */
+export type CredentialRequirements = CredentialRequirement[];
 /**
  * AppDTO is the API response for a full app.
  */
@@ -1571,7 +1601,7 @@ export interface AppVersionDTO extends BaseModelDTO {
     };
     kernel: string;
     required_secrets?: SecretRequirement[];
-    required_credentials?: CredentialRequirement[];
+    required_credentials?: CredentialRequirements;
     resources: AppResources;
     /**
      * Sandbox is the version's declared sandbox exceptions. Absent on a
@@ -2449,6 +2479,16 @@ export interface ToolExplanationDTO {
      */
     risk: string;
 }
+/**
+ * ConnectTokens are tokens a provider minted while connecting, for grants
+ * that need no redirect (OAuth client credentials): the credential service
+ * saves them on the login it writes. They travel inside the process only.
+ */
+export interface ConnectTokens {
+    AccessToken: SensitiveString;
+    RefreshToken: SensitiveString;
+    ExpiresAt?: string;
+}
 /**
  * CredentialDTO is the API response for a credential (never exposes secrets).
  */
@@ -2478,12 +2518,32 @@ export interface CredentialDTO extends BaseModelDTO, PermissionModelDTO {
     is_primary: boolean;
     error_message?: string;
 }
+/**
+ * ProviderSummary is the company a credential slug belongs to: the
+ * providers row's identity, for grouping and display.
+ */
+export interface ProviderSummary {
+    slug: string;
+    name: string;
+    icon_url?: string;
+    website?: string;
+    docs_url?: string;
+}
 /**
  * CredentialConfigDTO is the merged view: provider catalog + credential state.
  */
 export interface CredentialConfigDTO {
     slug: string;
+    /**
+     * Provider is the credential slug (what Credential.Provider stores):
+     * one way to authenticate. The company it belongs to is ProviderInfo.
+     */
     provider: string;
+    /**
+     * ProviderInfo is the company this slug belongs to, for grouping: the
+     * providers row its auth scheme names, else the slug's own identity.
+     */
+    provider_info?: ProviderSummary;
     type: string;
     name: string;
     short_name: string;
@@ -3970,6 +4030,13 @@ export interface MCPServerDTO {
      */
     setup?: MCPServerSetup;
     documentation_url: string;
+    /**
+     * Credentials is what the server needs to be called (the same shape as
+     * an app's inf.yml credentials). CredentialSlug is the first entry's
+     * slug: the vault entry a call sends, so a page can link to it.
+     */
+    credentials?: CredentialRequirements;
+    credential_slug?: string;
     connection_status?: string;
     /**
      * ConnectionScope is who the caller's connection to this server belongs
@@ -4481,7 +4548,7 @@ export interface SetupAction {
  */
 export interface CheckRequirementsRequest {
     secrets?: SecretRequirement[];
-    credentials?: CredentialRequirement[];
+    credentials?: CredentialRequirements;
 }
 /**
  * CheckRequirementsResponse is the API response for checking requirements
@@ -4534,6 +4601,23 @@ export interface SecretDTO extends BaseModelDTO, PermissionModelDTO {
      */
     credential_id?: string;
 }
+/**
+ * SensitiveString is a string type that prevents accidental exposure of secrets.
+ * It redacts in JSON/fmt output unless explicitly accessed via .Expose().
+ * Encryption at rest is handled by the GORM "sensitive" serializer
+ * (api/internal/lib/secrets). Fields must be tagged: `gorm:"serializer:sensitive"`
+ * Note: map-based GORM Updates (map[string]any{"value": ...}) bypass serializers.
+ * Always use struct-based operations for SensitiveString fields.
+ * Redaction:
+ *   - JSON serialization: always returns "" (empty string)
+ *   - fmt.Sprintf with %s, %v, %#v: always returns "[REDACTED]"
+ *   - Only .Expose() returns the actual value
+ * Encryption is enabled when SECRETS_ENCRYPTION_KEY env var is set.
+ * Values are stored as "enc:v2:<encrypted_dek>:<encrypted_data>" in the database.
+ * Key rotation only re-encrypts the DEK, not the data.
+ */
+export interface SensitiveString {
+}
 /**
  * SocketAccess is where one end of a socket dials and the credential it
  * presents. The task's caller gets one in the run response; the worker gets
@@ -5410,6 +5494,409 @@ export declare const GPUTypeIntel: GPUType;
 export declare const GPUTypeNvidia: GPUType;
 export declare const GPUTypeAMD: GPUType;
 export declare const GPUTypeApple: GPUType;
+/**
+ * AuthSchemeKind is how a provider authenticates: the kinds of an OpenAPI
+ * Security Scheme Object (oauth2, apiKey, http), named the same so a
+ * vendor's spec maps onto a scheme without translation.
+ */
+export type AuthSchemeKind = "oauth2" | "api_key" | "http" | "oauth2_authorization_code";
+/**
+ * AuthSchemeOAuth2 is OAuth 2.0; Flow says which grant.
+ */
+export declare const AuthSchemeOAuth2: AuthSchemeKind;
+/**
+ * AuthSchemeAPIKey is one or more keys a person pastes, sent as a
+ * header or query parameter.
+ */
+export declare const AuthSchemeAPIKey: AuthSchemeKind;
+/**
+ * AuthSchemeHTTP is a pasted secret sent as an HTTP auth scheme
+ * (Authorization: Bearer or Basic).
+ */
+export declare const AuthSchemeHTTP: AuthSchemeKind;
+/**
+ * Deprecated: the kind is AuthSchemeOAuth2 with AuthSchemeFlowAuthorizationCode.
+ * Same value, so comparisons keep working; rows still stored as
+ * "oauth2_authorization_code" are read as oauth2 (UnmarshalJSON).
+ */
+export declare const AuthSchemeOAuth2AuthorizationCode: "oauth2";
+/**
+ * AuthSchemeFlow is the OAuth 2.0 grant an oauth2 scheme uses.
+ */
+export type AuthSchemeFlow = "authorization_code" | "client_credentials";
+/**
+ * AuthSchemeFlowAuthorizationCode is the user-consent flow: authorization
+ * endpoint → code → token endpoint, optionally with PKCE. The default.
+ */
+export declare const AuthSchemeFlowAuthorizationCode: AuthSchemeFlow;
+/**
+ * AuthSchemeFlowClientCredentials is server-to-server: the app's client
+ * id and secret are exchanged at the token endpoint, no redirect, no
+ * user. The login is the app's own.
+ */
+export declare const AuthSchemeFlowClientCredentials: AuthSchemeFlow;
+/**
+ * AuthSchemeAPIKeyIn is where an api_key scheme's key travels.
+ */
+export type AuthSchemeAPIKeyIn = "header" | "query";
+export declare const AuthSchemeAPIKeyInHeader: AuthSchemeAPIKeyIn;
+export declare const AuthSchemeAPIKeyInQuery: AuthSchemeAPIKeyIn;
+/**
+ * AuthSchemeHTTPScheme is the Authorization scheme of an http scheme.
+ */
+export type AuthSchemeHTTPScheme = "bearer" | "basic";
+export declare const AuthSchemeHTTPBearer: AuthSchemeHTTPScheme;
+export declare const AuthSchemeHTTPBasic: AuthSchemeHTTPScheme;
+/**
+ * SecretField is one value a person pastes to connect an api_key or http
+ * scheme: its vault key and how the form asks for it. Several fields make
+ * a multi-secret provider (Kling's access and secret key).
+ */
+export interface SecretField {
+    key: string;
+    label?: string;
+    placeholder?: string;
+    sensitive?: boolean;
+    optional?: boolean;
+}
+/**
+ * AuthSchemeClientAuth is how client_id/client_secret reach the token
+ * endpoint. Most providers accept either; a few insist on one.
+ */
+export type AuthSchemeClientAuth = "basic" | "body" | "none";
+/**
+ * AuthSchemeClientAuthBasic sends them as an HTTP Basic Authorization
+ * header (RFC 6749 §2.3.1, the default).
+ */
+export declare const AuthSchemeClientAuthBasic: AuthSchemeClientAuth;
+/**
+ * AuthSchemeClientAuthBody sends them as form fields in the request body.
+ */
+export declare const AuthSchemeClientAuthBody: AuthSchemeClientAuth;
+/**
+ * AuthSchemeClientAuthNone is a public client (RFC 8414
+ * token_endpoint_auth_method "none"): the client id goes in the body,
+ * there is no secret, and PKCE is what proves the client. Its OAuth app
+ * is complete with a client id alone (a dynamically registered client,
+ * or a Client ID Metadata Document URL).
+ */
+export declare const AuthSchemeClientAuthNone: AuthSchemeClientAuth;
+/**
+ * AuthSchemeTokenRequest is the token request's body encoding.
+ */
+export type AuthSchemeTokenRequest = "form" | "json";
+export declare const AuthSchemeTokenRequestForm: AuthSchemeTokenRequest;
+export declare const AuthSchemeTokenRequestJSON: AuthSchemeTokenRequest;
+/**
+ * AuthSchemeRefresh is when an access token is refreshed.
+ */
+export type AuthSchemeRefresh = "" | "always";
+/**
+ * AuthSchemeRefreshWhenExpiring refreshes within five minutes of the
+ * reported expiry; a token with no expiry is treated as long-lived
+ * (Slack without token rotation, Notion).
+ */
+export declare const AuthSchemeRefreshWhenExpiring: AuthSchemeRefresh;
+/**
+ * AuthSchemeRefreshAlways refreshes on every read: the provider reports
+ * no expiry but the token does expire (Salesforce's session timeout is
+ * per org and not reported).
+ */
+export declare const AuthSchemeRefreshAlways: AuthSchemeRefresh;
+/**
+ * AuthSchemeRevokeStyle is how the token reaches the revoke endpoint.
+ */
+export type AuthSchemeRevokeStyle = "bearer" | "query" | "form";
+export declare const AuthSchemeRevokeBearer: AuthSchemeRevokeStyle;
+export declare const AuthSchemeRevokeQuery: AuthSchemeRevokeStyle;
+export declare const AuthSchemeRevokeForm: AuthSchemeRevokeStyle;
+/**
+ * AuthSchemeRevoke is the optional token revocation on disconnect.
+ */
+export interface AuthSchemeRevoke {
+    url: string;
+    style: AuthSchemeRevokeStyle;
+    /**
+     * ClientAuth also sends client_id and client_secret in the form
+     * (Discord).
+     */
+    client_auth?: boolean;
+}
+/**
+ * AuthSchemeAppKey is one key of the OAuth app a login goes through. The
+ * client id and secret are implied (PREFIX_CLIENT_ID, PREFIX_CLIENT_SECRET);
+ * listing them only overrides their label and placeholder. Other keys
+ * (bot_token, signing_secret, tenant_id) are optional extras the app holds,
+ * read back by name in templates as {app.<name>} and by hooks.
+ */
+export interface AuthSchemeAppKey {
+    /**
+     * Name is the key's role: client_id, client_secret, bot_token, …
+     */
+    name: string;
+    /**
+     * Key is the vault key; default PREFIX_<NAME>.
+     */
+    key?: string;
+    label?: string;
+    placeholder?: string;
+    sensitive?: boolean;
+    /**
+     * Optional is implied for every name but client_id and client_secret.
+     */
+    optional?: boolean;
+}
+/**
+ * AuthSchemeLookup is a call made after the token exchange, with the new
+ * access token as bearer; its decoded response becomes a document root of
+ * its name for the identity, metadata and later lookups ({user.email},
+ * {resources.0.id}). userinfo_url is shorthand for the lookup named user.
+ * URL, body and headers are templates.
+ */
+export interface AuthSchemeLookup {
+    name: string;
+    url: string;
+    method?: string;
+    /**
+     * Body is sent as is; a JSON body is the default content type
+     * (Dropbox's "null", Linear's GraphQL query).
+     */
+    body?: string;
+    content_type?: string;
+    headers?: {
+        [key: string]: string;
+    };
+}
+/**
+ * AuthSchemeCapability is something an app can ask for from this provider,
+ * satisfied by a connection holding its scopes. Scopes are in the scheme's
+ * own (friendly) names, the ones a credential stores.
+ */
+export interface AuthSchemeCapability {
+    key: string;
+    scopes?: string[];
+    satisfies?: string[];
+    display_name: string;
+    description?: string;
+}
+/**
+ * AuthSchemeSpec is one way to authenticate against a provider, as data.
+ * Everything a standard OAuth2 provider needs is a field; where a provider
+ * deviates in a way data cannot express, the spec names a hook and Go
+ * supplies it (authprovider.RegisterTokenResponseHook and friends).
+ * Templates: URLs, headers, lookup bodies, identifier, name, metadata and
+ * env values are strings with {{path}} placeholders. A path is read from
+ * the flow's document, which grows as the flow goes:
+ * 	client_id                  from the authorize step on
+ * 	vars.* (and each var bare)  what the vars hook produced, e.g. {{tenant}}
+ * 	access_token, token.*      after the token exchange (token.* is the
+ * 	                           decoded response)
+ * 	callback.*                 the other query params the callback carried
+ * 	                           (QuickBooks' realmId, Shopify's shop)
+ * 	<lookup>.*                 each lookup's response, by its name; user.*
+ * 	                           is the userinfo lookup
+ * 	expires_at, metadata.*, app.*   env only: the token's expiry (RFC 3339),
+ * 	                           the stored metadata, the app's extra keys
+ * Array elements are indexed: {{resources.0.id}}. {{a|b}} takes the first
+ * path present. A template none of whose placeholders resolve renders "":
+ * omitted from env and metadata, blank as identifier or name.
+ */
+export interface AuthSchemeSpec {
+    kind: AuthSchemeKind;
+    /**
+     * Flow is the oauth2 grant; empty means authorization_code.
+     */
+    flow?: AuthSchemeFlow;
+    /**
+     * Fields are what a person pastes (api_key and http kinds).
+     */
+    fields?: SecretField[];
+    /**
+     * In and ParamName say where an api_key key goes on a request: the
+     * header or query parameter of that name. ValuePrefix is prepended to
+     * the value ("Bearer "). Not needed to connect; read by injection.
+     */
+    in?: AuthSchemeAPIKeyIn;
+    param_name?: string;
+    value_prefix?: string;
+    /**
+     * Scheme and BearerFormat describe an http kind's Authorization header.
+     */
+    scheme?: AuthSchemeHTTPScheme;
+    bearer_format?: string;
+    authorization_endpoint?: string;
+    scopes?: string[];
+    /**
+     * ScopeAliases map the scheme's own scope names to what the provider
+     * wants on the wire ("gmail.send" → "https://www.googleapis.com/auth/
+     * gmail.send"). Credentials store the alias; the wire form is used only
+     * in requests. A scope with no alias is sent as is.
+     */
+    scope_aliases?: {
+        [key: string]: string;
+    };
+    scope_param?: string;
+    scope_separator?: string;
+    omit_scope_param?: boolean;
+    pkce?: boolean;
+    /**
+     * ClientIDParam is the name the client id travels under in the
+     * authorize URL and the token body; default "client_id" (TikTok:
+     * "client_key").
+     */
+    client_id_param?: string;
+    /**
+     * ExtraAuthorizeParams are appended to the authorize URL verbatim
+     * (Google's access_type=offline). AddScopesParams override them when
+     * re-authorizing for more scopes (Google's include_granted_scopes).
+     */
+    extra_authorize_params?: {
+        [key: string]: string;
+    };
+    add_scopes_params?: {
+        [key: string]: string;
+    };
+    /**
+     * AccountHintParam is the authorize param that names the account to sign
+     * in with (Google's and Microsoft's "login_hint"). When re-authorizing
+     * for more scopes it carries the login's account identifier, so the
+     * provider goes to that account instead of offering a chooser. Empty =
+     * no hint sent.
+     */
+    account_hint_param?: string;
+    /**
+     * AnotherAccountParams are authorize params for connecting an account
+     * next to one already connected: the provider shows its account chooser
+     * instead of signing the user back in to the account it remembers
+     * (Google prompt=select_account). They override ExtraAuthorizeParams.
+     */
+    another_account_params?: {
+        [key: string]: string;
+    };
+    /**
+     * RequiredScopes are always requested, on a connect and when
+     * re-authorizing for more scopes, whatever the caller asked for: the
+     * scopes the identity lookup and token refresh need (Google's openid,
+     * email and profile; X's users.read and offline.access). In the
+     * scheme's own names, like Scopes. Empty = only what was asked for.
+     */
+    required_scopes?: string[];
+    /**
+     * IncrementalAddScopes: re-authorizing for more scopes asks only for
+     * the new ones (plus RequiredScopes), and the provider returns a token
+     * that also covers what the login already holds (Google, with
+     * include_granted_scopes in AddScopesParams). Without it the full list
+     * is asked for again.
+     */
+    incremental_add_scopes?: boolean;
+    /**
+     * Resource is the RFC 8707 resource indicator: the protected resource
+     * the token is minted for (an MCP server's URL). Sent on the authorize,
+     * code and refresh requests when the profile takes one. Empty = none.
+     */
+    resource?: string;
+    /**
+     * Issuer is the authorization server's RFC 8414 issuer. With
+     * AuthorizationResponseIssParameterSupported, the callback's iss must
+     * name it (RFC 9207, against mix-up); an issuer alone still refuses a
+     * callback naming another one.
+     */
+    issuer?: string;
+    authorization_response_iss_parameter_supported?: boolean;
+    /**
+     * Callback is the name of the redirect URI the app was registered with
+     * (<app>/settings/secrets/oauth/<callback>). Empty = the slug. Schemes
+     * whose clients are registered once for many slugs share one (an MCP
+     * server's dynamically registered client and the Client ID Metadata
+     * Document name the "mcp" callback); the flow's provider then comes
+     * from the connect intent, never from the callback's path.
+     */
+    callback?: string;
+    /**
+     * Profile names the authorization server's deviations from the specs
+     * (authprovider.AuthServerProfile: endpoints placed by app fields,
+     * scopes on refresh, actionable errors, admin consent). Empty = none.
+     */
+    profile?: string;
+    token_endpoint?: string;
+    /**
+     * RevocationEndpoint is the RFC 7009 endpoint, when the provider has
+     * one and Revoke names no style of its own: tokens are revoked there
+     * with a form POST.
+     */
+    revocation_endpoint?: string;
+    client_auth?: AuthSchemeClientAuth;
+    token_request?: AuthSchemeTokenRequest;
+    /**
+     * Headers go on every request to the provider (User-Agent for Reddit,
+     * Notion-Version); values are templates ({{client_id}} for Twitch's
+     * Client-Id).
+     */
+    headers?: {
+        [key: string]: string;
+    };
+    /**
+     * TokenResponseHook names the Go reader for a token response that is
+     * not the RFC 6749 shape (Slack's nested authed_user). Empty = standard.
+     */
+    token_response_hook?: string;
+    refresh?: AuthSchemeRefresh;
+    revoke?: AuthSchemeRevoke;
+    /**
+     * UserInfoURL is fetched with the new access token; the response is the
+     * identity document (user.*). UserInfoURLPath instead reads that URL
+     * from a path within the token response (Salesforce's "id"). Lookups
+     * are further calls, each becoming a root of its name, in order, after
+     * user. With none of these, the token response is all there is.
+     */
+    userinfo_url?: string;
+    userinfo_url_path?: string;
+    lookups?: AuthSchemeLookup[];
+    /**
+     * Identifier is the connected account's stable, human-readable id
+     * ("{{user.email}}", "@{{user.data.username}}"); Name its display name.
+     */
+    identifier?: string;
+    name?: string;
+    /**
+     * AccountID is the account's id as the provider keeps it and never
+     * changes it ("{{user.sub}}" for Google, "{{user.data.id}}" for X), as
+     * opposed to Identifier, which the user may rename. Logins are matched
+     * and chosen by it. Empty = Identifier, for providers whose identifier
+     * already is such an id (Slack, Notion).
+     */
+    account_id?: string;
+    /**
+     * IdentityHook names Go code that derives identifier and name when a
+     * template cannot (Discord's discriminator rule). It wins over both.
+     */
+    identity_hook?: string;
+    /**
+     * Metadata is what the credential stores about the account, by key.
+     */
+    metadata?: {
+        [key: string]: string;
+    };
+    /**
+     * Env is what a run reads, by variable. Empty = PREFIX_ACCESS_TOKEN and
+     * PREFIX_ACCESS_TOKEN_EXPIRES_AT.
+     */
+    env?: {
+        [key: string]: string;
+    };
+    /**
+     * AppKeys are the OAuth app's keys beyond the implied client id and
+     * secret, and label overrides for those.
+     */
+    app_keys?: AuthSchemeAppKey[];
+    /**
+     * VarsHook names Go code that turns the app's extra keys into the
+     * {var} values substituted into the URLs (Microsoft's tenant,
+     * Salesforce's sandbox host).
+     */
+    vars_hook?: string;
+    capabilities?: AuthSchemeCapability[];
+}
 /**
  * Visibility represents the visibility level of a resource
  */

package/dist/types.js

@@ -742,6 +742,75 @@ export const GPUTypeIntel = "intel";
 export const GPUTypeNvidia = "nvidia";
 export const GPUTypeAMD = "amd";
 export const GPUTypeApple = "apple";
+/**
+ * AuthSchemeOAuth2 is OAuth 2.0; Flow says which grant.
+ */
+export const AuthSchemeOAuth2 = "oauth2";
+/**
+ * AuthSchemeAPIKey is one or more keys a person pastes, sent as a
+ * header or query parameter.
+ */
+export const AuthSchemeAPIKey = "api_key";
+/**
+ * AuthSchemeHTTP is a pasted secret sent as an HTTP auth scheme
+ * (Authorization: Bearer or Basic).
+ */
+export const AuthSchemeHTTP = "http";
+/**
+ * Deprecated: the kind is AuthSchemeOAuth2 with AuthSchemeFlowAuthorizationCode.
+ * Same value, so comparisons keep working; rows still stored as
+ * "oauth2_authorization_code" are read as oauth2 (UnmarshalJSON).
+ */
+export const AuthSchemeOAuth2AuthorizationCode = AuthSchemeOAuth2;
+/**
+ * AuthSchemeFlowAuthorizationCode is the user-consent flow: authorization
+ * endpoint → code → token endpoint, optionally with PKCE. The default.
+ */
+export const AuthSchemeFlowAuthorizationCode = "authorization_code";
+/**
+ * AuthSchemeFlowClientCredentials is server-to-server: the app's client
+ * id and secret are exchanged at the token endpoint, no redirect, no
+ * user. The login is the app's own.
+ */
+export const AuthSchemeFlowClientCredentials = "client_credentials";
+export const AuthSchemeAPIKeyInHeader = "header";
+export const AuthSchemeAPIKeyInQuery = "query";
+export const AuthSchemeHTTPBearer = "bearer";
+export const AuthSchemeHTTPBasic = "basic";
+/**
+ * AuthSchemeClientAuthBasic sends them as an HTTP Basic Authorization
+ * header (RFC 6749 §2.3.1, the default).
+ */
+export const AuthSchemeClientAuthBasic = "basic";
+/**
+ * AuthSchemeClientAuthBody sends them as form fields in the request body.
+ */
+export const AuthSchemeClientAuthBody = "body";
+/**
+ * AuthSchemeClientAuthNone is a public client (RFC 8414
+ * token_endpoint_auth_method "none"): the client id goes in the body,
+ * there is no secret, and PKCE is what proves the client. Its OAuth app
+ * is complete with a client id alone (a dynamically registered client,
+ * or a Client ID Metadata Document URL).
+ */
+export const AuthSchemeClientAuthNone = "none";
+export const AuthSchemeTokenRequestForm = "form";
+export const AuthSchemeTokenRequestJSON = "json";
+/**
+ * AuthSchemeRefreshWhenExpiring refreshes within five minutes of the
+ * reported expiry; a token with no expiry is treated as long-lived
+ * (Slack without token rotation, Notion).
+ */
+export const AuthSchemeRefreshWhenExpiring = "";
+/**
+ * AuthSchemeRefreshAlways refreshes on every read: the provider reports
+ * no expiry but the token does expire (Salesforce's session timeout is
+ * per org and not reported).
+ */
+export const AuthSchemeRefreshAlways = "always";
+export const AuthSchemeRevokeBearer = "bearer";
+export const AuthSchemeRevokeQuery = "query";
+export const AuthSchemeRevokeForm = "form";
 export const VisibilityPrivate = "private";
 export const VisibilityTeam = "team";
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inferencesh/sdk",
-  "version": "0.25.0",
+  "version": "0.26.1",
   "description": "Official JavaScript/TypeScript SDK for inference.sh - Run AI models with a simple API",
   "type": "module",
   "main": "dist/index.js",