@inferencesh/sdk 0.26.2 → 0.28.0

package/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.28.0] - 2026-10-15
+
+### Changed
+- Types regenerated for the credentials vocabulary (INF-1079): `AuthSchemeDTO`, `AuthSchemeCreateRequest`, `AuthSchemeUpdateRequest`, `AuthSchemeHooksDTO`, `AuthSchemeSeedResult` are now `AuthProviderDTO`, `AuthProviderCreateRequest`, `AuthProviderUpdateRequest`, `AuthProviderHooksDTO`, `AuthProviderSeedResult`; `AuthSchemeSpec` and its `AuthScheme*` enums are `AuthMethod` and `AuthMethod*`; `ProviderDTO`, `ProviderSeed`, `ProviderSummary`, `ProviderTreeDTO`, `ProviderUpsertRequest`, `ProviderCategory`, `ProviderStatus` are `Company*`. `CredentialConfigDTO.company` is the company (`provider_info` still carries the same value, deprecated). Wire formats are unchanged.
+- `pollUntilIdle` rejects once and stops polling when the run fails; `sendMessage({ stream: false })` no longer hangs forever (99075b7).
+- Test mocks tidied (70cce44); dependabot overrides and `allowBuilds` in the pnpm workspace (75be627, 54b7ce1).
+
+## [0.27.0] - 2026-10-13
+
+### Changed
+
+- `client.agent(...).sendMessage(text, { files })` sends the files as `MessageInput.attachments` (FileRefs with filename and content type) instead of the deprecated `images` / `files` URI lists.
+- A `tool(...).handler()` handler may return `{ result, attachments }` (`ClientToolResult`, now exported from the package root) like a `clientToolHandlers` handler: the result text plus files uploaded with `client.files.upload`.
+
+### Added
+
+- Generated types follow the API: `MCPServerDTO.connection` (`ConnectionInfo` with `MCPConnectionFacts`); `connection_status` is deprecated.
+
+## [0.26.2] - 2026-10-13
+
 Added: `mcpTool(name, { server, toolName, credentialId? })` names the MCP server by its slug (the API's model: a server declares the provider it signs in through); `credentialId` pins one connection. The old `mcpTool(name, credentialId, toolName)` still works (deprecated): the API saves such a tool with the server the connection's provider is declared by. `MCPServerUpdateBody` gains `credentials`; its `auth_type`, `oauth_client_id` and `oauth_secret_key` are no longer read by the API (the provider's OAuth app is set through `PUT /credentials/{slug}/app`). Generated types: `MCPToolConfig.server`; `MCPServerDTO.oauth_client_id`, `CredentialProviderMCP` and `CredentialTypeMCP` are gone from the API.
 
 ### Changed

package/dist/agent/types.d.ts

@@ -6,6 +6,7 @@
 import type { Dispatch } from 'react';
 import type { AgentRunDTO, AgentVersionDTO, AlwaysAllowOptionsDTO, AlwaysAllowResultDTO, ToolExplanationDTO, ChatAgentDTO, ChatDTO, ChatMessageDTO, ChatSettingsDTO, ChatSettingsRequest, AgentTool, AgentConfigInput as GeneratedAgentConfig, CoreAppConfigInput as CoreAppConfig, FileRef, ElicitResult } from '../types.js';
 import type { HttpClient } from '../http/client.js';
+import type { ClientToolResult } from '../tool-builder.js';
 import type { StreamableManager } from '../http/streamable.js';
 import type { PollManager } from '../http/poll.js';
 export type { FileRef } from '../types.js';
@@ -221,19 +222,8 @@ export interface AgentChatProviderProps {
     /** Children */
     children: React.ReactNode;
 }
-/**
- * What a client tool handler returns: the result text, or the text plus files.
- *
- * `attachments` are files already uploaded with POST /files (for example with
- * `client.files.upload(dataUrlOrBlob)` or the chat's `uploadFile`), passed as
- * `FileRef`s, the same as message attachments. An image attachment reaches the
- * model as image input when the model supports images; other files are listed
- * on the tool message.
- */
-export type ClientToolResult = string | {
-    result: string;
-    attachments?: FileRef[];
-};
+/** What a client tool handler returns (defined with the tool builder). */
+export type { ClientToolResult } from '../tool-builder.js';
 /**
  * Client tool handler function - takes args and returns a result (sync or async)
  */

package/dist/api/agents.js

@@ -63,8 +63,7 @@ export class Agent {
         const isTemplate = typeof this.config === 'string';
         const hasCallbacks = !!(options.onMessage || options.onChat || options.onToolCall || options.onDelta);
         // Process files - either already uploaded (FileDTO with uri) or needs upload (Blob)
-        let imageUris;
-        let fileUris;
+        let attachments;
         if (options.files && options.files.length > 0) {
             const toUpload = [];
             const alreadyUploaded = [];
@@ -78,14 +77,11 @@ export class Agent {
             }
             const uploadedFiles = toUpload.length > 0 ? await Promise.all(toUpload.map((blob) => this.files.upload(blob))) : [];
             const allFiles = [...alreadyUploaded, ...uploadedFiles];
-            const images = allFiles.filter((f) => f.content_type?.startsWith('image/'));
-            const others = allFiles.filter((f) => !f.content_type?.startsWith('image/'));
-            if (images.length > 0)
-                imageUris = images.map((f) => f.uri);
-            if (others.length > 0)
-                fileUris = others.map((f) => f.uri);
+            if (allFiles.length > 0) {
+                attachments = allFiles.map(({ id, uri, filename, content_type, size }) => ({ id, uri, filename, content_type, size }));
+            }
         }
-        const input = { text, images: imageUris, files: fileUris, role: 'user', context: [], system_prompt: '', context_size: 0 };
+        const input = attachments ? { text, attachments } : { text };
         const body = {
             chat_id: this.chatId ?? undefined,
             context: this.context,
@@ -334,9 +330,9 @@ export class Agent {
         // fetched chat never carries chat_messages, so their absence cannot tell
         // the two apart.
         const unchanged = {};
-        return new Promise((resolve) => {
+        return new Promise((resolve, reject) => {
             this.poller?.stop();
-            this.poller = new PollManager({
+            const poller = new PollManager({
                 pollFunction: async () => {
                     // Lightweight status check first
                     const statusResp = await this.http.request('get', `/chats/${this.chatId}/status`);
@@ -395,8 +391,19 @@ export class Agent {
                 onError: (error) => {
                     console.warn('[Agent] Poll error:', error);
                 },
+                // PollManager gave up after maxRetries consecutive errors: it has
+                // already stopped polling, so fail the turn once. A caller stop
+                // (disconnect, abort, a newer turn) passes no error.
+                onStop: (error) => {
+                    if (!error)
+                        return;
+                    if (this.poller === poller)
+                        this.poller = null;
+                    reject(error);
+                },
             });
-            this.poller.start();
+            this.poller = poller;
+            poller.start();
         });
     }
 }

package/dist/api/write-bodies.d.ts

@@ -12,7 +12,7 @@
  * chats, engines and teams send PATCH; apps.patch and flows.patch are the
  * partial siblings of the POST updates that also edit a version.
  */
-import type { AgentConfigInput, AgentImages, AppDTO, ChatDTO, CredentialRequirements, EngineDTO, FlowDTO, FlowVersionDTO, KnowledgeDTO, ProjectDTO, TeamDTO, Visibility } from '../types.js';
+import type { AgentConfigInput, ResourceImages, AppDTO, ChatDTO, CredentialRequirements, EngineDTO, FlowDTO, FlowVersionDTO, KnowledgeDTO, ProjectDTO, TeamDTO, Visibility } from '../types.js';
 /**
  * POST /agents/{id}. Visibility and images, and a new version when
  * `version` is set. Name, title, harness, placement: set at creation.
@@ -20,7 +20,7 @@ import type { AgentConfigInput, AgentImages, AppDTO, ChatDTO, CredentialRequirem
  */
 export interface AgentUpdateBody {
     visibility?: Visibility;
-    images?: AgentImages;
+    images?: ResourceImages;
     version?: AgentConfigInput;
 }
 /**

package/dist/http/poll.d.ts

@@ -19,8 +19,12 @@ export interface PollManagerOptions<T> {
     onError?: (error: Error) => void;
     /** Called when polling starts */
     onStart?: () => void;
-    /** Called when polling stops (intentionally or after max retries) */
-    onStop?: () => void;
+    /**
+     * Called once when polling stops. `error` is the last poll error when the
+     * manager gave up after `maxRetries` consecutive errors; it is undefined
+     * when the caller stopped it.
+     */
+    onStop?: (error?: Error) => void;
 }
 export declare class PollManager<T> {
     private options;
@@ -34,6 +38,7 @@ export declare class PollManager<T> {
     start(): void;
     /** Stop polling and clean up. */
     stop(): void;
+    private halt;
     private cleanup;
     private poll;
 }

package/dist/http/poll.js

@@ -30,11 +30,14 @@ export class PollManager {
     }
     /** Stop polling and clean up. */
     stop() {
+        this.halt();
+    }
+    halt(error) {
         if (this.isStopped)
             return;
         this.isStopped = true;
         this.cleanup();
-        this.options.onStop?.();
+        this.options.onStop?.(error);
     }
     cleanup() {
         if (this.interval) {
@@ -66,7 +69,7 @@ export class PollManager {
             this.consecutiveErrors++;
             this.options.onError?.(error);
             if (this.consecutiveErrors >= this.options.maxRetries) {
-                this.stop();
+                this.halt(error);
             }
         }
     }

package/dist/index.d.ts

@@ -32,7 +32,7 @@ export { STREAM_FORMAT, CLEAR_KEY, ERROR_KEY, REDIAL_CODES } from './live/protoc
 export { isLiveField, parseMediaType, pcmFormat, splitLiveSchema, binaryLiveField, alternativeLabel, alternativeTag, } from './live/schema.js';
 export type { JsonSchema, MediaType, PCMFormat, LiveField } from './live/schema.js';
 export { tool, appTool, agentTool, webhookTool, httpTool, callTool, mcpTool, internalTools, string, number, integer, boolean, enumOf, object, array, optional, } from './tool-builder.js';
-export type { ClientTool, ClientToolHandler } from './tool-builder.js';
+export type { ClientTool, ClientToolHandler, ClientToolResult } from './tool-builder.js';
 export { lifecycleHook, learningHooks } from './hook-builder.js';
 export type { LifecycleHookBuilder } from './hook-builder.js';
 export { DeltaAccumulator, createLLMDeltaAccumulator, type DeltaEvent, type FieldTags, type FieldTagsRegistry } from './delta.js';

package/dist/tool-builder.d.ts

@@ -1,9 +1,22 @@
 /**
  * Tool Builder - Fluent API for defining agent tools
  */
-import { AgentTool, InternalToolsConfig } from './types.js';
+import { AgentTool, FileRef, InternalToolsConfig } from './types.js';
+/**
+ * What a client tool handler returns: the result text, or the text plus files.
+ *
+ * `attachments` are files already uploaded with POST /files (for example with
+ * `client.files.upload(dataUrlOrBlob)` or the chat's `uploadFile`), passed as
+ * `FileRef`s, the same as message attachments. An image attachment reaches the
+ * model as image input when the model supports images; other files are listed
+ * on the tool message.
+ */
+export type ClientToolResult = string | {
+    result: string;
+    attachments?: FileRef[];
+};
 /** Handler function for client tools (executed in browser/Node) */
-export type ClientToolHandler = (args: Record<string, unknown>) => Promise<string> | string;
+export type ClientToolHandler = (args: Record<string, unknown>) => Promise<ClientToolResult> | ClientToolResult;
 /** Client tool with schema and handler bundled together */
 export interface ClientTool {
     /** Tool schema (sent to server, describes the tool to the LLM) */

package/dist/types.d.ts

@@ -266,14 +266,6 @@ export interface MCPToolConfigDTO {
     tool_name: string;
     credential_id?: string;
 }
-/**
- * AgentImages contains display images for an agent
- */
-export interface AgentImages {
-    card: string;
-    thumbnail: string;
-    banner: string;
-}
 /**
  * CoreAppConfigDTO references an app used as the agent's core
  */
@@ -295,7 +287,7 @@ export interface AgentDTO extends BaseModelDTO, PermissionModelDTO, ProjectModel
      * Title is the human-readable name; empty falls back to Name.
      */
     title: string;
-    images: AgentImages;
+    images: ResourceImages;
     version_id: string;
     version?: AgentVersionDTO;
     /**
@@ -345,7 +337,7 @@ export interface CreateAgentRequest {
     id?: string;
     name: string;
     title?: string;
-    images?: AgentImages;
+    images?: ResourceImages;
     visibility?: Visibility;
     /**
      * Harness runs the agent: "inference" (ours) or an external harness.
@@ -572,7 +564,7 @@ export interface CreateAppRequest {
     description?: string;
     agent_description?: string;
     category?: AppCategory;
-    images?: AppImages;
+    images?: ResourceImages;
     /**
      * Tags replace the app's tags when given; omitted, a deploy takes them
      * from the version's metadata.tags, and keeps the stored ones if that is
@@ -773,6 +765,12 @@ export interface SecretCreateRequest {
      */
     provider_name?: string;
     provider_website?: string;
+    /**
+     * Label names this key among the owner's keys for Provider (prod,
+     * personal): a new label adds a key beside the others, the same label
+     * replaces that key's value. Empty: the owner's default key.
+     */
+    label?: string;
 }
 /**
  * SecretProviderRequest attaches an existing secret to a provider's
@@ -784,6 +782,11 @@ export interface SecretProviderRequest {
     connection_scope?: CredentialScope;
     provider_name?: string;
     provider_website?: string;
+    /**
+     * Label names the key among the owner's keys for Provider, as on
+     * SecretCreateRequest. Empty: the owner's default key.
+     */
+    label?: string;
 }
 export interface SecretUpdateRequest {
     value: string;
@@ -1103,7 +1106,7 @@ export declare const ScopeSecretsWrite: Scope;
 export declare const ScopeSecretsReveal: Scope;
 /**
  * Action-level scopes for credentials (connected accounts, vaults,
- * auth schemes, MCP servers).
+ * auth providers, MCP servers).
  */
 export declare const ScopeCredentialsRead: Scope;
 /**
@@ -1426,14 +1429,6 @@ export interface AppFunction {
      */
     annotations?: ToolAnnotations;
 }
-/**
- * AppImages holds developer-provided images for the app.
- */
-export interface AppImages {
-    card: string;
-    thumbnail: string;
-    banner: string;
-}
 /**
  * AppGPUResource describes GPU requirements.
  */
@@ -1465,7 +1460,7 @@ export interface SecretRequirement {
  * the platform-defined grants it needs ("x.tweet.read", "google.sheets":
  * an OAuth grant with the scopes it implies), each a capability of the
  * entry's own provider. Provider seeds the catalog row for the company the
- * first time it is seen and never overwrites it; Auth seeds the auth scheme
+ * first time it is seen and never overwrites it; Auth seeds the auth provider
  * when the slug is free.
  * 	credentials:
  * 	  slack:
@@ -1489,17 +1484,17 @@ export interface CredentialRequirement {
      * catalog row that does not exist yet. Its slug defaults to the
      * credential slug.
      */
-    provider?: ProviderSeed;
+    provider?: CompanySeed;
     /**
-     * Auth is the credential's auth scheme, for a slug no row defines yet.
+     * Auth is the credential's auth provider, for a slug no row defines yet.
      */
-    auth?: AuthSchemeSpec;
+    auth?: AuthMethod;
 }
 /**
- * ProviderSeed is a provider (the company behind a credential) as an app
+ * CompanySeed is a provider (the company behind a credential) as an app
  * declares it: enough to create its catalog row when none exists.
  */
-export interface ProviderSeed {
+export interface CompanySeed {
     slug?: string;
     name?: string;
     description?: string;
@@ -1531,7 +1526,7 @@ export interface AppDTO extends BaseModelDTO, PermissionModelDTO {
     description: string;
     agent_description: string;
     category: AppCategory;
-    images: AppImages;
+    images: ResourceImages;
     /**
      * Tags name what the app does and its traits, as lowercase slugs
      * (text-to-image, open-weights). GET /store/tags lists the ones in use
@@ -1702,25 +1697,13 @@ export interface PublicAppStoreDTO {
      */
     title: string;
     description: string;
-    images: AppImages;
+    images: ResourceImages;
     is_featured: boolean;
     rank: number;
     has_approved_version: boolean;
     page_id?: string;
     pricing_description?: string;
 }
-/**
- * ResourceImages is the display-image set every listable resource carries:
- * a card image for grids, a thumbnail for dense rows, a banner for headers.
- * AppImages and AgentImages predate this and hold the same three fields;
- * they should collapse onto this type, but aliasing them changes what
- * gotypegen emits for existing consumers, so that migration is separate.
- */
-export interface ResourceImages {
-    card: string;
-    thumbnail: string;
-    banner: string;
-}
 /**
  * ArtifactDTO is the API shape of an artifact entry.
  */
@@ -1751,6 +1734,12 @@ export interface ArtifactDTO extends BaseModelDTO, PermissionModelDTO {
      * SharedVersionID pins the version viewers see. Empty = always latest.
      */
     shared_version_id?: string;
+    /**
+     * CoverVersionID is the version a captured cover shows. Empty means the
+     * cover (if any) was set by a person or agent, and a capture never
+     * replaces it.
+     */
+    cover_version_id?: string;
     /**
      * Capabilities declared by the latest version (runtime features the page
      * may use). Reserved for the artifact runtime; opaque to the API.
@@ -1763,6 +1752,11 @@ export interface ArtifactDTO extends BaseModelDTO, PermissionModelDTO {
      * URL is the canonical viewer URL for this artifact.
      */
     url?: string;
+    /**
+     * Access is the viewer's level on this artifact: read, interact (may
+     * change its data) or write (may edit it). Set on single reads only.
+     */
+    access?: Permission;
 }
 /**
  * ArtifactVersionDTO is one immutable publish of an artifact.
@@ -2064,6 +2058,21 @@ export interface ResourceStatusDTO {
     status: any;
     updated_at: string;
 }
+/**
+ * ResourceImages is the display-image set every listable resource carries
+ * (apps, agents, artifacts): a card image for grids, a thumbnail for dense
+ * rows, a banner for headers.
+ */
+export interface ResourceImages {
+    card: string;
+    thumbnail: string;
+    banner: string;
+    /**
+     * Dark holds the same slots for a dark theme. Nil means the slots above
+     * serve both themes.
+     */
+    dark?: ResourceImages;
+}
 /**
  * AvailabilityResponse answers "can I use this name?" — for page slugs, team
  * usernames and voucher codes alike.
@@ -2527,17 +2536,34 @@ export interface CredentialDTO extends BaseModelDTO, PermissionModelDTO {
     };
     is_primary: boolean;
     error_message?: string;
+    /**
+     * Secrets are the secret rows linked to the credential (a key's values),
+     * by row and key, never by value. Filled on the vault's api_key configs
+     * and the admin provider tree.
+     */
+    secrets?: CredentialSecretRef[];
 }
 /**
- * ProviderSummary is the company a credential slug belongs to: the
+ * CredentialSecretRef names one secret linked to a credential: the row's
+ * id, the key it is stored under and when its value last changed.
+ */
+export interface CredentialSecretRef {
+    id: string;
+    key: string;
+    updated_at: string;
+}
+/**
+ * CompanySummary is the company a credential slug belongs to: the
  * providers row's identity, for grouping and display.
  */
-export interface ProviderSummary {
+export interface CompanySummary {
     slug: string;
     name: string;
     icon_url?: string;
     website?: string;
     docs_url?: string;
+    terms_url?: string;
+    privacy_url?: string;
 }
 /**
  * CredentialConfigDTO is the merged view: provider catalog + credential state.
@@ -2551,9 +2577,14 @@ export interface CredentialConfigDTO {
     provider: string;
     /**
      * ProviderInfo is the company this slug belongs to, for grouping: the
-     * providers row its auth scheme names, else the slug's own identity.
+     * providers row its auth provider names, else the slug's own identity.
      */
-    provider_info?: ProviderSummary;
+    provider_info?: CompanySummary;
+    /**
+     * Company is ProviderInfo under its settled name (INF-1079); provider_info
+     * stays one release.
+     */
+    company?: CompanySummary;
     type: string;
     name: string;
     short_name: string;
@@ -2579,8 +2610,8 @@ export interface CredentialConfigDTO {
      */
     app?: CredentialDTO;
     /**
-     * AuthSchemeID is set when the provider is one the team defined
-     * itself (models.AuthScheme), so the UI can offer edit and remove.
+     * AuthProviderID is set when the provider is one the team defined
+     * itself (models.AuthProvider), so the UI can offer edit and remove.
      */
     auth_scheme_id?: string;
     /**
@@ -2594,6 +2625,12 @@ export interface CredentialConfigDTO {
      * connected.
      */
     accounts?: (CredentialDTO | undefined)[];
+    /**
+     * MultiAccount: several accounts of this provider can be connected side
+     * by side, each addressed by its account_id; the default (is_primary) is
+     * used where none is named.
+     */
+    multi_account: boolean;
 }
 /**
  * SecretFieldConfig defines a secret field for the UI
@@ -4046,12 +4083,44 @@ export interface MCPServerDTO {
      */
     credentials?: CredentialRequirements;
     credential_slug?: string;
+    /**
+     * Deprecated: Connection.Status. Kept for clients reading it.
+     */
     connection_status?: string;
     /**
-     * ConnectionScope is who the caller's connection to this server belongs
+     * Deprecated: Connection.Scope. ConnectionScope is who the caller's connection to this server belongs
      * to (user, team, org, platform); empty when not connected.
      */
     connection_scope?: CredentialScope;
+    /**
+     * Connection is the whole of it: the login's status and scope above,
+     * and what the connection made with that login holds.
+     */
+    connection?: ConnectionInfo;
+}
+/**
+ * ConnectionInfo is the caller's standing with a server: their login's
+ * status (connected, expired, error; "" when they hold none) and whose it
+ * is, and what the connection made with that login holds.
+ */
+export interface ConnectionInfo extends MCPConnectionFacts {
+    /**
+     * Status and Scope are the caller's login's for the server: whether
+     * they can call it, and whose the login is.
+     */
+    status?: string;
+    scope?: CredentialScope;
+}
+/**
+ * MCPConnectionFacts is what an MCP connection (a server reached through
+ * one login) has recorded: the catalogue it listed, its last call.
+ */
+export interface MCPConnectionFacts {
+    connection_id?: string;
+    tool_count?: number;
+    tools_listed_at?: string;
+    last_called_at?: string;
+    last_error?: string;
 }
 /**
  * MCPServerSetup is what a server's directory entry knows about setting the
@@ -4609,6 +4678,26 @@ export interface SecretDTO extends BaseModelDTO, PermissionModelDTO {
      * a plain secret.
      */
     credential_id?: string;
+    /**
+     * The four below are read from the credential a listing preloads; a
+     * row read without it leaves them empty.
+     * Provider is the slug of the credential the secret belongs to.
+     */
+    provider?: string;
+    /**
+     * ProviderName is that credential's display name ("Anthropic").
+     */
+    provider_name?: string;
+    /**
+     * Label is the credential's account identifier: a key's label.
+     */
+    label?: string;
+    /**
+     * CredentialDefault is whether the credential is its owner's default.
+     * Always serialised: a linked non-default row and an unlabelled row
+     * must not read the same.
+     */
+    credential_default: boolean;
 }
 /**
  * SensitiveString is a string type that prevents accidental exposure of secrets.
@@ -5504,58 +5593,58 @@ export declare const GPUTypeNvidia: GPUType;
 export declare const GPUTypeAMD: GPUType;
 export declare const GPUTypeApple: GPUType;
 /**
- * AuthSchemeKind is how a provider authenticates: the kinds of an OpenAPI
+ * AuthMethodKind is how a provider authenticates: the kinds of an OpenAPI
  * Security Scheme Object (oauth2, apiKey, http), named the same so a
  * vendor's spec maps onto a scheme without translation.
  */
-export type AuthSchemeKind = "oauth2" | "api_key" | "http" | "oauth2_authorization_code";
+export type AuthMethodKind = "oauth2" | "api_key" | "http" | "oauth2_authorization_code";
 /**
- * AuthSchemeOAuth2 is OAuth 2.0; Flow says which grant.
+ * AuthMethodOAuth2 is OAuth 2.0; Flow says which grant.
  */
-export declare const AuthSchemeOAuth2: AuthSchemeKind;
+export declare const AuthMethodOAuth2: AuthMethodKind;
 /**
- * AuthSchemeAPIKey is one or more keys a person pastes, sent as a
+ * AuthMethodAPIKey is one or more keys a person pastes, sent as a
  * header or query parameter.
  */
-export declare const AuthSchemeAPIKey: AuthSchemeKind;
+export declare const AuthMethodAPIKey: AuthMethodKind;
 /**
- * AuthSchemeHTTP is a pasted secret sent as an HTTP auth scheme
+ * AuthMethodHTTP is a pasted secret sent as an HTTP auth provider
  * (Authorization: Bearer or Basic).
  */
-export declare const AuthSchemeHTTP: AuthSchemeKind;
+export declare const AuthMethodHTTP: AuthMethodKind;
 /**
- * Deprecated: the kind is AuthSchemeOAuth2 with AuthSchemeFlowAuthorizationCode.
+ * Deprecated: the kind is AuthMethodOAuth2 with AuthMethodFlowAuthorizationCode.
  * Same value, so comparisons keep working; rows still stored as
  * "oauth2_authorization_code" are read as oauth2 (UnmarshalJSON).
  */
-export declare const AuthSchemeOAuth2AuthorizationCode: "oauth2";
+export declare const AuthMethodOAuth2AuthorizationCode: "oauth2";
 /**
- * AuthSchemeFlow is the OAuth 2.0 grant an oauth2 scheme uses.
+ * AuthMethodFlow is the OAuth 2.0 grant an oauth2 scheme uses.
  */
-export type AuthSchemeFlow = "authorization_code" | "client_credentials";
+export type AuthMethodFlow = "authorization_code" | "client_credentials";
 /**
- * AuthSchemeFlowAuthorizationCode is the user-consent flow: authorization
+ * AuthMethodFlowAuthorizationCode is the user-consent flow: authorization
  * endpoint → code → token endpoint, optionally with PKCE. The default.
  */
-export declare const AuthSchemeFlowAuthorizationCode: AuthSchemeFlow;
+export declare const AuthMethodFlowAuthorizationCode: AuthMethodFlow;
 /**
- * AuthSchemeFlowClientCredentials is server-to-server: the app's client
+ * AuthMethodFlowClientCredentials is server-to-server: the app's client
  * id and secret are exchanged at the token endpoint, no redirect, no
  * user. The login is the app's own.
  */
-export declare const AuthSchemeFlowClientCredentials: AuthSchemeFlow;
+export declare const AuthMethodFlowClientCredentials: AuthMethodFlow;
 /**
- * AuthSchemeAPIKeyIn is where an api_key scheme's key travels.
+ * AuthMethodAPIKeyIn is where an api_key scheme's key travels.
  */
-export type AuthSchemeAPIKeyIn = "header" | "query";
-export declare const AuthSchemeAPIKeyInHeader: AuthSchemeAPIKeyIn;
-export declare const AuthSchemeAPIKeyInQuery: AuthSchemeAPIKeyIn;
+export type AuthMethodAPIKeyIn = "header" | "query";
+export declare const AuthMethodAPIKeyInHeader: AuthMethodAPIKeyIn;
+export declare const AuthMethodAPIKeyInQuery: AuthMethodAPIKeyIn;
 /**
- * AuthSchemeHTTPScheme is the Authorization scheme of an http scheme.
+ * AuthMethodHTTPScheme is the Authorization scheme of an http scheme.
  */
-export type AuthSchemeHTTPScheme = "bearer" | "basic";
-export declare const AuthSchemeHTTPBearer: AuthSchemeHTTPScheme;
-export declare const AuthSchemeHTTPBasic: AuthSchemeHTTPScheme;
+export type AuthMethodHTTPScheme = "bearer" | "basic";
+export declare const AuthMethodHTTPBearer: AuthMethodHTTPScheme;
+export declare const AuthMethodHTTPBasic: AuthMethodHTTPScheme;
 /**
  * SecretField is one value a person pastes to connect an api_key or http
  * scheme: its vault key and how the form asks for it. Several fields make
@@ -5569,62 +5658,62 @@ export interface SecretField {
     optional?: boolean;
 }
 /**
- * AuthSchemeClientAuth is how client_id/client_secret reach the token
+ * AuthMethodClientAuth is how client_id/client_secret reach the token
  * endpoint. Most providers accept either; a few insist on one.
  */
-export type AuthSchemeClientAuth = "basic" | "body" | "none";
+export type AuthMethodClientAuth = "basic" | "body" | "none";
 /**
- * AuthSchemeClientAuthBasic sends them as an HTTP Basic Authorization
+ * AuthMethodClientAuthBasic sends them as an HTTP Basic Authorization
  * header (RFC 6749 §2.3.1, the default).
  */
-export declare const AuthSchemeClientAuthBasic: AuthSchemeClientAuth;
+export declare const AuthMethodClientAuthBasic: AuthMethodClientAuth;
 /**
- * AuthSchemeClientAuthBody sends them as form fields in the request body.
+ * AuthMethodClientAuthBody sends them as form fields in the request body.
  */
-export declare const AuthSchemeClientAuthBody: AuthSchemeClientAuth;
+export declare const AuthMethodClientAuthBody: AuthMethodClientAuth;
 /**
- * AuthSchemeClientAuthNone is a public client (RFC 8414
+ * AuthMethodClientAuthNone is a public client (RFC 8414
  * token_endpoint_auth_method "none"): the client id goes in the body,
  * there is no secret, and PKCE is what proves the client. Its OAuth app
  * is complete with a client id alone (a dynamically registered client,
  * or a Client ID Metadata Document URL).
  */
-export declare const AuthSchemeClientAuthNone: AuthSchemeClientAuth;
+export declare const AuthMethodClientAuthNone: AuthMethodClientAuth;
 /**
- * AuthSchemeTokenRequest is the token request's body encoding.
+ * AuthMethodTokenRequest is the token request's body encoding.
  */
-export type AuthSchemeTokenRequest = "form" | "json";
-export declare const AuthSchemeTokenRequestForm: AuthSchemeTokenRequest;
-export declare const AuthSchemeTokenRequestJSON: AuthSchemeTokenRequest;
+export type AuthMethodTokenRequest = "form" | "json";
+export declare const AuthMethodTokenRequestForm: AuthMethodTokenRequest;
+export declare const AuthMethodTokenRequestJSON: AuthMethodTokenRequest;
 /**
- * AuthSchemeRefresh is when an access token is refreshed.
+ * AuthMethodRefresh is when an access token is refreshed.
  */
-export type AuthSchemeRefresh = "" | "always";
+export type AuthMethodRefresh = "" | "always";
 /**
- * AuthSchemeRefreshWhenExpiring refreshes within five minutes of the
+ * AuthMethodRefreshWhenExpiring refreshes within five minutes of the
  * reported expiry; a token with no expiry is treated as long-lived
  * (Slack without token rotation, Notion).
  */
-export declare const AuthSchemeRefreshWhenExpiring: AuthSchemeRefresh;
+export declare const AuthMethodRefreshWhenExpiring: AuthMethodRefresh;
 /**
- * AuthSchemeRefreshAlways refreshes on every read: the provider reports
+ * AuthMethodRefreshAlways refreshes on every read: the provider reports
  * no expiry but the token does expire (Salesforce's session timeout is
  * per org and not reported).
  */
-export declare const AuthSchemeRefreshAlways: AuthSchemeRefresh;
+export declare const AuthMethodRefreshAlways: AuthMethodRefresh;
 /**
- * AuthSchemeRevokeStyle is how the token reaches the revoke endpoint.
+ * AuthMethodRevokeStyle is how the token reaches the revoke endpoint.
  */
-export type AuthSchemeRevokeStyle = "bearer" | "query" | "form";
-export declare const AuthSchemeRevokeBearer: AuthSchemeRevokeStyle;
-export declare const AuthSchemeRevokeQuery: AuthSchemeRevokeStyle;
-export declare const AuthSchemeRevokeForm: AuthSchemeRevokeStyle;
+export type AuthMethodRevokeStyle = "bearer" | "query" | "form";
+export declare const AuthMethodRevokeBearer: AuthMethodRevokeStyle;
+export declare const AuthMethodRevokeQuery: AuthMethodRevokeStyle;
+export declare const AuthMethodRevokeForm: AuthMethodRevokeStyle;
 /**
- * AuthSchemeRevoke is the optional token revocation on disconnect.
+ * AuthMethodRevoke is the optional token revocation on disconnect.
  */
-export interface AuthSchemeRevoke {
+export interface AuthMethodRevoke {
     url: string;
-    style: AuthSchemeRevokeStyle;
+    style: AuthMethodRevokeStyle;
     /**
      * ClientAuth also sends client_id and client_secret in the form
      * (Discord).
@@ -5632,13 +5721,13 @@ export interface AuthSchemeRevoke {
     client_auth?: boolean;
 }
 /**
- * AuthSchemeAppKey is one key of the OAuth app a login goes through. The
+ * AuthMethodAppKey is one key of the OAuth app a login goes through. The
  * client id and secret are implied (PREFIX_CLIENT_ID, PREFIX_CLIENT_SECRET);
  * listing them only overrides their label and placeholder. Other keys
  * (bot_token, signing_secret, tenant_id) are optional extras the app holds,
  * read back by name in templates as {app.<name>} and by hooks.
  */
-export interface AuthSchemeAppKey {
+export interface AuthMethodAppKey {
     /**
      * Name is the key's role: client_id, client_secret, bot_token, …
      */
@@ -5656,13 +5745,13 @@ export interface AuthSchemeAppKey {
     optional?: boolean;
 }
 /**
- * AuthSchemeLookup is a call made after the token exchange, with the new
+ * AuthMethodLookup is a call made after the token exchange, with the new
  * access token as bearer; its decoded response becomes a document root of
  * its name for the identity, metadata and later lookups ({user.email},
  * {resources.0.id}). userinfo_url is shorthand for the lookup named user.
  * URL, body and headers are templates.
  */
-export interface AuthSchemeLookup {
+export interface AuthMethodLookup {
     name: string;
     url: string;
     method?: string;
@@ -5677,11 +5766,11 @@ export interface AuthSchemeLookup {
     };
 }
 /**
- * AuthSchemeCapability is something an app can ask for from this provider,
+ * AuthMethodCapability is something an app can ask for from this provider,
  * satisfied by a connection holding its scopes. Scopes are in the scheme's
  * own (friendly) names, the ones a credential stores.
  */
-export interface AuthSchemeCapability {
+export interface AuthMethodCapability {
     key: string;
     scopes?: string[];
     satisfies?: string[];
@@ -5689,10 +5778,10 @@ export interface AuthSchemeCapability {
     description?: string;
 }
 /**
- * AuthSchemeSpec is one way to authenticate against a provider, as data.
+ * AuthMethod is one way to authenticate against a provider, as data.
  * Everything a standard OAuth2 provider needs is a field; where a provider
  * deviates in a way data cannot express, the spec names a hook and Go
- * supplies it (authprovider.RegisterTokenResponseHook and friends).
+ * supplies it (authmethod.RegisterTokenResponseHook and friends).
  * Templates: URLs, headers, lookup bodies, identifier, name, metadata and
  * env values are strings with {{path}} placeholders. A path is read from
  * the flow's document, which grows as the flow goes:
@@ -5710,12 +5799,12 @@ export interface AuthSchemeCapability {
  * path present. A template none of whose placeholders resolve renders "":
  * omitted from env and metadata, blank as identifier or name.
  */
-export interface AuthSchemeSpec {
-    kind: AuthSchemeKind;
+export interface AuthMethod {
+    kind: AuthMethodKind;
     /**
      * Flow is the oauth2 grant; empty means authorization_code.
      */
-    flow?: AuthSchemeFlow;
+    flow?: AuthMethodFlow;
     /**
      * Fields are what a person pastes (api_key and http kinds).
      */
@@ -5725,13 +5814,13 @@ export interface AuthSchemeSpec {
      * header or query parameter of that name. ValuePrefix is prepended to
      * the value ("Bearer "). Not needed to connect; read by injection.
      */
-    in?: AuthSchemeAPIKeyIn;
+    in?: AuthMethodAPIKeyIn;
     param_name?: string;
     value_prefix?: string;
     /**
      * Scheme and BearerFormat describe an http kind's Authorization header.
      */
-    scheme?: AuthSchemeHTTPScheme;
+    scheme?: AuthMethodHTTPScheme;
     bearer_format?: string;
     authorization_endpoint?: string;
     scopes?: string[];
@@ -5823,7 +5912,7 @@ export interface AuthSchemeSpec {
     callback?: string;
     /**
      * Profile names the authorization server's deviations from the specs
-     * (authprovider.AuthServerProfile: endpoints placed by app fields,
+     * (authmethod.AuthServerProfile: endpoints placed by app fields,
      * scopes on refresh, actionable errors, admin consent). Empty = none.
      */
     profile?: string;
@@ -5834,8 +5923,8 @@ export interface AuthSchemeSpec {
      * with a form POST.
      */
     revocation_endpoint?: string;
-    client_auth?: AuthSchemeClientAuth;
-    token_request?: AuthSchemeTokenRequest;
+    client_auth?: AuthMethodClientAuth;
+    token_request?: AuthMethodTokenRequest;
     /**
      * Headers go on every request to the provider (User-Agent for Reddit,
      * Notion-Version); values are templates ({{client_id}} for Twitch's
@@ -5849,8 +5938,8 @@ export interface AuthSchemeSpec {
      * not the RFC 6749 shape (Slack's nested authed_user). Empty = standard.
      */
     token_response_hook?: string;
-    refresh?: AuthSchemeRefresh;
-    revoke?: AuthSchemeRevoke;
+    refresh?: AuthMethodRefresh;
+    revoke?: AuthMethodRevoke;
     /**
      * UserInfoURL is fetched with the new access token; the response is the
      * identity document (user.*). UserInfoURLPath instead reads that URL
@@ -5860,7 +5949,7 @@ export interface AuthSchemeSpec {
      */
     userinfo_url?: string;
     userinfo_url_path?: string;
-    lookups?: AuthSchemeLookup[];
+    lookups?: AuthMethodLookup[];
     /**
      * Identifier is the connected account's stable, human-readable id
      * ("{{user.email}}", "@{{user.data.username}}"); Name its display name.
@@ -5897,14 +5986,14 @@ export interface AuthSchemeSpec {
      * AppKeys are the OAuth app's keys beyond the implied client id and
      * secret, and label overrides for those.
      */
-    app_keys?: AuthSchemeAppKey[];
+    app_keys?: AuthMethodAppKey[];
     /**
      * VarsHook names Go code that turns the app's extra keys into the
      * {var} values substituted into the URLs (Microsoft's tenant,
      * Salesforce's sandbox host).
      */
     vars_hook?: string;
-    capabilities?: AuthSchemeCapability[];
+    capabilities?: AuthMethodCapability[];
 }
 /**
  * Visibility represents the visibility level of a resource
@@ -5922,9 +6011,15 @@ export declare const VisibilityUnlisted: Visibility;
 /**
  * Permission represents a permission level for access checks.
  */
-export type Permission = "read" | "write" | "use";
+export type Permission = "read" | "write" | "interact" | "use";
 export declare const PermRead: Permission;
 export declare const PermWrite: Permission;
+/**
+ * PermInteract changes what a page's people keep in it (an artifact's
+ * shared data) without editing the page. Write covers interact, and
+ * interact covers read; public and unlisted visibility grant read only.
+ */
+export declare const PermInteract: Permission;
 /**
  * PermUse is execute intent: run an app, load a skill/knowledge into an
  * agent context, invoke an MCP tool. Distinct from read — a public
@@ -6595,8 +6690,11 @@ export interface ResponseFormat {
  * assignment.
  * Which model runs is not a setting: the app is the model. An app that
  * fronts several models (a router) declares its own `model` input.
+ * Field order is schema order: the generated pydantic model, and the input
+ * form built from its JSON schema, list fields as they are declared here.
  */
 export interface LLMSettings {
+    system_prompt: string;
     context_size: number;
     temperature?: number;
     top_p?: number;
@@ -6610,23 +6708,24 @@ export interface LLMSettings {
     max_tokens?: number;
     reasoning_effort?: string;
     reasoning_max_tokens?: number;
-    system_prompt: string;
     tools?: Tool[];
     tool_choice?: ToolChoice;
     response_format?: ResponseFormat;
 }
 /**
- * LLMInput is the input envelope for an LLM provider task: the settings plus
- * the conversation, with the current turn split out of the context.
+ * LLMInput is the input envelope for an LLM provider task: the conversation,
+ * with the current turn split out of the context, plus the settings.
+ * Field order is schema order (see LLMSettings): the turn comes first, the
+ * settings last, so an input form shows what to say before how to say it.
  */
 export interface LLMInput extends LLMSettings {
-    context: LLMContextMessage[];
-    role?: ChatMessageRole;
     text?: string;
-    reasoning?: string;
-    attachments?: FileRef[];
     images?: string[];
     files?: string[];
+    attachments?: FileRef[];
+    context: LLMContextMessage[];
+    role?: ChatMessageRole;
+    reasoning?: string;
     tool_call_id?: string;
 }
 /**

package/dist/types.js

@@ -211,7 +211,7 @@ export const ScopeSecretsWrite = "secrets:write";
 export const ScopeSecretsReveal = "secrets:reveal";
 /**
  * Action-level scopes for credentials (connected accounts, vaults,
- * auth schemes, MCP servers).
+ * auth providers, MCP servers).
  */
 export const ScopeCredentialsRead = "credentials:read";
 /**
@@ -743,74 +743,74 @@ export const GPUTypeNvidia = "nvidia";
 export const GPUTypeAMD = "amd";
 export const GPUTypeApple = "apple";
 /**
- * AuthSchemeOAuth2 is OAuth 2.0; Flow says which grant.
+ * AuthMethodOAuth2 is OAuth 2.0; Flow says which grant.
  */
-export const AuthSchemeOAuth2 = "oauth2";
+export const AuthMethodOAuth2 = "oauth2";
 /**
- * AuthSchemeAPIKey is one or more keys a person pastes, sent as a
+ * AuthMethodAPIKey is one or more keys a person pastes, sent as a
  * header or query parameter.
  */
-export const AuthSchemeAPIKey = "api_key";
+export const AuthMethodAPIKey = "api_key";
 /**
- * AuthSchemeHTTP is a pasted secret sent as an HTTP auth scheme
+ * AuthMethodHTTP is a pasted secret sent as an HTTP auth provider
  * (Authorization: Bearer or Basic).
  */
-export const AuthSchemeHTTP = "http";
+export const AuthMethodHTTP = "http";
 /**
- * Deprecated: the kind is AuthSchemeOAuth2 with AuthSchemeFlowAuthorizationCode.
+ * Deprecated: the kind is AuthMethodOAuth2 with AuthMethodFlowAuthorizationCode.
  * Same value, so comparisons keep working; rows still stored as
  * "oauth2_authorization_code" are read as oauth2 (UnmarshalJSON).
  */
-export const AuthSchemeOAuth2AuthorizationCode = AuthSchemeOAuth2;
+export const AuthMethodOAuth2AuthorizationCode = AuthMethodOAuth2;
 /**
- * AuthSchemeFlowAuthorizationCode is the user-consent flow: authorization
+ * AuthMethodFlowAuthorizationCode is the user-consent flow: authorization
  * endpoint → code → token endpoint, optionally with PKCE. The default.
  */
-export const AuthSchemeFlowAuthorizationCode = "authorization_code";
+export const AuthMethodFlowAuthorizationCode = "authorization_code";
 /**
- * AuthSchemeFlowClientCredentials is server-to-server: the app's client
+ * AuthMethodFlowClientCredentials is server-to-server: the app's client
  * id and secret are exchanged at the token endpoint, no redirect, no
  * user. The login is the app's own.
  */
-export const AuthSchemeFlowClientCredentials = "client_credentials";
-export const AuthSchemeAPIKeyInHeader = "header";
-export const AuthSchemeAPIKeyInQuery = "query";
-export const AuthSchemeHTTPBearer = "bearer";
-export const AuthSchemeHTTPBasic = "basic";
+export const AuthMethodFlowClientCredentials = "client_credentials";
+export const AuthMethodAPIKeyInHeader = "header";
+export const AuthMethodAPIKeyInQuery = "query";
+export const AuthMethodHTTPBearer = "bearer";
+export const AuthMethodHTTPBasic = "basic";
 /**
- * AuthSchemeClientAuthBasic sends them as an HTTP Basic Authorization
+ * AuthMethodClientAuthBasic sends them as an HTTP Basic Authorization
  * header (RFC 6749 §2.3.1, the default).
  */
-export const AuthSchemeClientAuthBasic = "basic";
+export const AuthMethodClientAuthBasic = "basic";
 /**
- * AuthSchemeClientAuthBody sends them as form fields in the request body.
+ * AuthMethodClientAuthBody sends them as form fields in the request body.
  */
-export const AuthSchemeClientAuthBody = "body";
+export const AuthMethodClientAuthBody = "body";
 /**
- * AuthSchemeClientAuthNone is a public client (RFC 8414
+ * AuthMethodClientAuthNone is a public client (RFC 8414
  * token_endpoint_auth_method "none"): the client id goes in the body,
  * there is no secret, and PKCE is what proves the client. Its OAuth app
  * is complete with a client id alone (a dynamically registered client,
  * or a Client ID Metadata Document URL).
  */
-export const AuthSchemeClientAuthNone = "none";
-export const AuthSchemeTokenRequestForm = "form";
-export const AuthSchemeTokenRequestJSON = "json";
+export const AuthMethodClientAuthNone = "none";
+export const AuthMethodTokenRequestForm = "form";
+export const AuthMethodTokenRequestJSON = "json";
 /**
- * AuthSchemeRefreshWhenExpiring refreshes within five minutes of the
+ * AuthMethodRefreshWhenExpiring refreshes within five minutes of the
  * reported expiry; a token with no expiry is treated as long-lived
  * (Slack without token rotation, Notion).
  */
-export const AuthSchemeRefreshWhenExpiring = "";
+export const AuthMethodRefreshWhenExpiring = "";
 /**
- * AuthSchemeRefreshAlways refreshes on every read: the provider reports
+ * AuthMethodRefreshAlways refreshes on every read: the provider reports
  * no expiry but the token does expire (Salesforce's session timeout is
  * per org and not reported).
  */
-export const AuthSchemeRefreshAlways = "always";
-export const AuthSchemeRevokeBearer = "bearer";
-export const AuthSchemeRevokeQuery = "query";
-export const AuthSchemeRevokeForm = "form";
+export const AuthMethodRefreshAlways = "always";
+export const AuthMethodRevokeBearer = "bearer";
+export const AuthMethodRevokeQuery = "query";
+export const AuthMethodRevokeForm = "form";
 export const VisibilityPrivate = "private";
 export const VisibilityTeam = "team";
 /**
@@ -822,6 +822,12 @@ export const VisibilityPublic = "public";
 export const VisibilityUnlisted = "unlisted";
 export const PermRead = "read";
 export const PermWrite = "write";
+/**
+ * PermInteract changes what a page's people keep in it (an artifact's
+ * shared data) without editing the page. Write covers interact, and
+ * interact covers read; public and unlisted visibility grant read only.
+ */
+export const PermInteract = "interact";
 /**
  * PermUse is execute intent: run an app, load a skill/knowledge into an
  * agent context, invoke an MCP tool. Distinct from read — a public

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inferencesh/sdk",
-  "version": "0.26.2",
+  "version": "0.28.0",
   "description": "Official JavaScript/TypeScript SDK for inference.sh - Run AI models with a simple API",
   "type": "module",
   "main": "dist/index.js",