@inferencesh/sdk 0.29.0 → 0.30.0

package/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.30.0] - 2026-10-18
+
+### Removed
+- `credentialId` on `httpTool().auth()` and `mcpTool()`, and the positional `mcpTool(name, credentialId, toolName)`: a tool no longer pins a connection. Credential-auth HTTP tools and MCP tools always sign in with the caller's own login to the provider at run time; `mcpTool(name, { server, toolName })` requires `server` (INF-1012). Generated types: `ToolAuthConfig`, `MCPToolConfig` and `MCPToolConfigDTO` lose `credential_id`.
+
 ## [0.29.0] - 2026-10-17
 
 ### Removed

package/README.md

@@ -377,7 +377,7 @@ Use the fluent builders to define `AgentTool` schemas. Client tools (`tool`) run
 | `agentTool(name, agentRef)` | Server | Delegate to a sub-agent |
 | `httpTool(name, url)` / `callTool(name, url)` | Server | HTTP request with credential injection (preferred over `webhookTool`) |
 | `webhookTool(name, url)` | Server | Unsigned webhook (legacy; use `httpTool` for new tools) |
-| `mcpTool(name, { server, toolName, credentialId? })` | Server | Call a tool on an MCP server (by slug), signed in through the server's provider; `credentialId` pins one connection. `mcpTool(name, credentialId, toolName)` still works and is saved with the connection's server |
+| `mcpTool(name, { server, toolName })` | Server | Call a tool on an MCP server (by slug), signed in with the runner's own connection to the server's provider |
 | `internalTools()` | Server | Built-in tools: plan, memory, widget, finish, skills, meta, remote, knowledge, artifact, agent |
 
 ```typescript
@@ -401,7 +401,7 @@ const clientTool = tool('get_weather')
 const gmailSend = httpTool('gmail_send', 'https://gmail.googleapis.com/gmail/v1/users/me/messages/send')
   .describe('Send an email via Gmail')
   .method('POST')
-  .auth({ credential: CredentialProviderGoogle, credentialId: 'your-credential-id' })
+  .auth({ credential: CredentialProviderGoogle })
   .build();
 
 // API key or bearer auth

package/dist/agent/actions.js

@@ -575,6 +575,7 @@ export function createActions(ctx) {
                 throw error;
             }
         },
+        listRunInterrupts: (runId) => api.listRunInterrupts(client, runId),
         loadOlderMessages: async () => {
             const chatId = getChatId();
             const cursor = getState().messageCursor;

package/dist/agent/types.d.ts

@@ -4,7 +4,7 @@
  * Public types for the Agent chat module.
  */
 import type { Dispatch } from 'react';
-import type { AgentRunDTO, AgentVersionDTO, AlwaysAllowOptionsDTO, AlwaysAllowResultDTO, ToolExplanationDTO, ChatAgentDTO, ChatDTO, ChatMessageDTO, ChatSettingsDTO, ChatSettingsRequest, AgentTool, AgentConfigInput as GeneratedAgentConfig, CoreAppConfigInput as CoreAppConfig, FileRef, ElicitResult } from '../types.js';
+import type { AgentRunDTO, AgentVersionDTO, AlwaysAllowOptionsDTO, AlwaysAllowResultDTO, ToolExplanationDTO, ChatAgentDTO, ChatDTO, ChatMessageDTO, ChatSettingsDTO, ChatSettingsRequest, AgentTool, AgentConfigInput as GeneratedAgentConfig, CoreAppConfigInput as CoreAppConfig, FileRef, ElicitResult, InterruptDTO } from '../types.js';
 import type { HttpClient } from '../http/client.js';
 import type { ClientToolResult } from '../tool-builder.js';
 import type { StreamableManager } from '../http/streamable.js';
@@ -190,6 +190,8 @@ export interface AgentChatActions {
      * `requires_sign_in` (ErrorCodeRequiresSignIn).
      */
     resolveInterrupt: (interruptId: string, decision: 'allow' | 'deny') => Promise<void>;
+    /** A run's pending interrupts (`heldTurn` finds a held turn among them). */
+    listRunInterrupts: (runId: string) => Promise<InterruptDTO[]>;
     /** Load older messages (scroll-up pagination). Returns true if more exist. */
     loadOlderMessages: () => Promise<boolean>;
     /** Whether there are older messages to load */

package/dist/api/tasks.js

@@ -1,6 +1,6 @@
 import { streamUntilTerminal } from '../http/stream-until-terminal.js';
 import { PollManager } from '../http/poll.js';
-import { TaskStatusCompleted, TaskStatusFailed, TaskStatusCancelled, } from '../types.js';
+import { TaskStatusCompleted, TaskStatusFailed, TaskStatusCancelled, TaskStatusRejected, } from '../types.js';
 import { parseStatus } from '../utils.js';
 //TODO: This is ugly...
 function stripTask(task) {
@@ -28,6 +28,9 @@ function settleTerminal(data, stripped, settle) {
         case TaskStatusCancelled:
             settle.reject(new Error('task cancelled'));
             break;
+        case TaskStatusRejected:
+            settle.reject(new Error(data.error || 'task rejected'));
+            break;
     }
 }
 /**

package/dist/index.d.ts

@@ -36,8 +36,8 @@ export type { ClientTool, ClientToolHandler, ClientToolResult } from './tool-bui
 export { lifecycleHook, learningHooks } from './hook-builder.js';
 export type { LifecycleHookBuilder } from './hook-builder.js';
 export { DeltaAccumulator, createLLMDeltaAccumulator, type DeltaEvent, type FieldTags, type FieldTagsRegistry } from './delta.js';
-export { parseStatus, isTerminalStatus, isChatBusy, isAwaitingHuman, isRunTerminal, isRunInterrupted, isRunSettled, isRunWorking, isMessageTerminal, pendingApprovals, } from './utils.js';
-export type { PendingApproval } from './utils.js';
+export { parseStatus, isTerminalStatus, isChatBusy, isAwaitingHuman, isRunTerminal, isRunInterrupted, isRunSettled, isRunWorking, isMessageTerminal, pendingApprovals, heldTurn, } from './utils.js';
+export type { PendingApproval, HeldTurn } from './utils.js';
 export * from './types.js';
 export type { TaskDTO as Task } from './types.js';
 import { HttpClient, type HttpClientConfig } from './http/client.js';

package/dist/index.js

@@ -38,7 +38,7 @@ export { lifecycleHook, learningHooks } from './hook-builder.js';
 // Delta accumulator for streaming responses
 export { DeltaAccumulator, createLLMDeltaAccumulator } from './delta.js';
 // Status utilities (handle both int and string status values)
-export { parseStatus, isTerminalStatus, isChatBusy, isAwaitingHuman, isRunTerminal, isRunInterrupted, isRunSettled, isRunWorking, isMessageTerminal, pendingApprovals, } from './utils.js';
+export { parseStatus, isTerminalStatus, isChatBusy, isAwaitingHuman, isRunTerminal, isRunInterrupted, isRunSettled, isRunWorking, isMessageTerminal, pendingApprovals, heldTurn, } from './utils.js';
 // Types - includes TaskStatus constants and all DTOs
 export * from './types.js';
 // =============================================================================

package/dist/tool-builder.d.ts

@@ -100,13 +100,12 @@ declare class HTTPToolBuilder extends ToolBuilder {
     constructor(name: string, url: string);
     method(m: string): this;
     /**
-     * How the tool authenticates: `credential` sends a connected account's
-     * access token (pick the account with `credentialId`), `apiKey` / `bearer`
-     * send a vault secret.
+     * How the tool authenticates: `credential` sends the access token of the
+     * runner's own connection to that provider, `apiKey` / `bearer` send a
+     * vault secret.
      */
     auth(config: {
         credential?: string;
-        credentialId?: string;
         apiKey?: string;
         bearer?: string;
         header?: string;
@@ -131,24 +130,15 @@ export interface MCPToolTarget {
     /** The MCP server's slug (a workspace registration or a directory entry). */
     server: string;
     toolName: string;
-    /** Pins one connection to the server's provider; by default the runner's own is used. */
-    credentialId?: string;
 }
 /**
  * Create an MCP tool: `toolName` on the MCP server `target.server` (its slug).
- * The call signs in with the runner's connection to the server's provider;
- * `credentialId` pins one connection instead.
- *
- * The older form `mcpTool(name, credentialId, toolName)` (a string second
- * argument) still works: a tool naming only a connection is saved with the
- * server that connection's provider is declared by.
+ * The call signs in with the runner's own connection to the server's provider.
  */
-export declare function mcpTool(name: string, target: MCPToolTarget | string, toolName?: string): MCPToolBuilder;
+export declare function mcpTool(name: string, target: MCPToolTarget): MCPToolBuilder;
 declare class MCPToolBuilder extends ToolBuilder {
     private target;
-    constructor(name: string, target: Partial<MCPToolTarget> & {
-        toolName: string;
-    });
+    constructor(name: string, target: MCPToolTarget);
     build(): AgentTool;
 }
 declare class InternalToolsBuilder {

package/dist/tool-builder.js

@@ -184,13 +184,13 @@ class HTTPToolBuilder extends ToolBuilder {
         return this;
     }
     /**
-     * How the tool authenticates: `credential` sends a connected account's
-     * access token (pick the account with `credentialId`), `apiKey` / `bearer`
-     * send a vault secret.
+     * How the tool authenticates: `credential` sends the access token of the
+     * runner's own connection to that provider, `apiKey` / `bearer` send a
+     * vault secret.
      */
     auth(config) {
         if (config.credential) {
-            this.authConfig = { type: ToolAuthTypeCredential, provider: config.credential, credential_id: config.credentialId };
+            this.authConfig = { type: ToolAuthTypeCredential, provider: config.credential };
         }
         else if (config.apiKey) {
             this.authConfig = { type: ToolAuthTypeAPIKey, secret: config.apiKey, header: config.header || 'X-API-Key' };
@@ -238,17 +238,9 @@ export const httpTool = (name, url) => new HTTPToolBuilder(name, url);
 export const callTool = (name, url) => new HTTPToolBuilder(name, url);
 /**
  * Create an MCP tool: `toolName` on the MCP server `target.server` (its slug).
- * The call signs in with the runner's connection to the server's provider;
- * `credentialId` pins one connection instead.
- *
- * The older form `mcpTool(name, credentialId, toolName)` (a string second
- * argument) still works: a tool naming only a connection is saved with the
- * server that connection's provider is declared by.
+ * The call signs in with the runner's own connection to the server's provider.
  */
-export function mcpTool(name, target, toolName) {
-    if (typeof target === 'string') {
-        return new MCPToolBuilder(name, { toolName: toolName ?? '', credentialId: target });
-    }
+export function mcpTool(name, target) {
     return new MCPToolBuilder(name, target);
 }
 class MCPToolBuilder extends ToolBuilder {
@@ -264,9 +256,8 @@ class MCPToolBuilder extends ToolBuilder {
             type: ToolTypeMCP,
             require_approval: this.approval || undefined,
             mcp: {
+                server: this.target.server,
                 tool_name: this.target.toolName,
-                ...(this.target.server ? { server: this.target.server } : {}),
-                ...(this.target.credentialId ? { credential_id: this.target.credentialId } : {}),
             },
         };
     }

package/dist/types.d.ts

@@ -172,7 +172,6 @@ export declare const ToolAuthTypeBearer: ToolAuthType;
 export interface ToolAuthConfig {
     type: ToolAuthType;
     provider?: string;
-    credential_id?: string;
     secret?: string;
     header?: string;
 }
@@ -203,15 +202,12 @@ export interface HTTPToolConfig {
 /**
  * MCPToolConfig is a tool of an MCP server: the server by its slug (the
  * agent's team's registration, its org's or the directory's) and the tool
- * to call. CredentialID pins the connection the call signs in with; without
- * it the runner's connection to the server's provider is used. A tool
- * written with only a connection is saved with the server that
- * connection's provider is declared by.
+ * to call. Each call signs in with the runner's connection to the
+ * server's provider (Credential.ToolConnection).
  */
 export interface MCPToolConfig {
     server?: string;
     tool_name: string;
-    credential_id?: string;
 }
 export interface AppToolConfigDTO {
     ref: string;
@@ -264,7 +260,6 @@ export interface HTTPToolConfigDTO {
 export interface MCPToolConfigDTO {
     server: string;
     tool_name: string;
-    credential_id?: string;
 }
 /**
  * CoreAppConfigDTO references an app used as the agent's core
@@ -1489,6 +1484,34 @@ export interface CredentialRequirement {
      * Auth is the credential's auth provider, for a slug no row defines yet.
      */
     auth?: AuthMethod;
+    /**
+     * The rest describe the platform api_key scheme a platform app's deploy
+     * catalogues for the slug: set on the scheme it creates, and filled into
+     * an existing one only where that is still empty (an admin's edit
+     * stands). Any other deploy ignores them.
+     * DisplayName is the scheme's name ("Claude Code"); at most
+     * MaxCredentialDisplayName characters.
+     */
+    display_name?: string;
+    /**
+     * ConnectionScope is who a connection belongs to: team (empty) or user.
+     */
+    connection_scope?: CredentialScope;
+    /**
+     * Instructions tell a person how to get the key (markdown, at most
+     * MaxAuthProviderInstructions characters).
+     */
+    instructions?: string;
+    /**
+     * DocsURL is the scheme's documentation link.
+     */
+    docs_url?: string;
+    /**
+     * ExpiresAfterDays is how long a saved key lasts: it counts as expired
+     * this many days after it is saved. 0 is never; at most
+     * MaxExpiresAfterDays.
+     */
+    expires_after_days?: number;
 }
 /**
  * CompanySeed is a provider (the company behind a credential) as an app
@@ -2652,9 +2675,20 @@ export interface CredentialConfigDTO {
     description: string;
     icon_url?: string;
     how_it_works?: string[];
+    /**
+     * Instructions tell a person how to get what this credential asks for
+     * (markdown, links allowed): the auth scheme's.
+     */
+    instructions?: string;
     docs_url?: string;
     secret_fields?: SecretFieldConfig[];
     allows_byok: boolean;
+    /**
+     * ExpiresAfterDays is how long a saved key lasts, in days: a key counts
+     * as expired that long after it is saved (its credential's expires_at).
+     * 0 is never.
+     */
+    expires_after_days?: number;
     available: boolean;
     has_managed: boolean;
     /**
@@ -2702,6 +2736,10 @@ export interface SecretFieldConfig {
     placeholder: string;
     sensitive: boolean;
     optional: boolean;
+    /**
+     * Pattern is the scheme field's pattern (shared.SecretField.Pattern).
+     */
+    pattern?: string;
 }
 /**
  * SearchRequest represents a search request.
@@ -3017,7 +3055,7 @@ export interface DecideEntitlementRequestRequest {
  * and APIError.Code on the legacy envelope. Clients branch on these, so a
  * code is a named const here, where it generates into models and the SDKs.
  */
-export type ErrorCode = "invalid_request" | "validation_error" | "unauthorized" | "forbidden" | "not_found" | "conflict" | "name_conflict" | "already_exists" | "not_configured" | "method_not_allowed" | "rate_limited" | "internal_error" | "team_role_required" | "blocked_by_usage_policy" | "last_owner" | "account_deactivated" | "account_banned" | "person_required" | "otp_required" | "requires_sign_in" | "insufficient_scope" | "invalid_scope" | "impersonation_reason_required" | "mcp_auth_expired" | "admin_session_required" | "admin_scopes_not_approved" | "cli_session_required" | "admin_required" | "same_admin_required" | "browser_session_required" | "invalid_ttl" | "admin_authenticator_required" | "limit_exceeded" | "feature_not_available" | "entitlement_unavailable" | "payment_required" | "payment_method_required" | "form_closed" | "already_submitted" | "already_claimed" | "already_entitled" | "request_open" | "invalid_code" | "already_processed" | "expired" | "code_confirmation_required" | "app_retired" | "app_maintenance" | "invalid_transition" | "SESSION_NOT_FOUND" | "SESSION_EXPIRED" | "SESSION_ENDED" | "WORKER_LEASED" | "APP_MISMATCH" | "VERSION_MISMATCH" | "agents_disabled" | "remote_offline" | "remote_timeout" | "harness_not_drivable" | "harness_too_old";
+export type ErrorCode = "invalid_request" | "validation_error" | "unauthorized" | "forbidden" | "not_found" | "conflict" | "name_conflict" | "already_exists" | "not_configured" | "method_not_allowed" | "rate_limited" | "internal_error" | "requirements_not_met" | "team_role_required" | "blocked_by_usage_policy" | "last_owner" | "account_deactivated" | "account_banned" | "person_required" | "otp_required" | "requires_sign_in" | "insufficient_scope" | "invalid_scope" | "impersonation_reason_required" | "mcp_auth_expired" | "admin_session_required" | "admin_scopes_not_approved" | "cli_session_required" | "admin_required" | "same_admin_required" | "browser_session_required" | "invalid_ttl" | "admin_authenticator_required" | "limit_exceeded" | "feature_not_available" | "entitlement_unavailable" | "payment_required" | "payment_method_required" | "form_closed" | "already_submitted" | "already_claimed" | "already_entitled" | "request_open" | "invalid_code" | "already_processed" | "expired" | "code_confirmation_required" | "app_retired" | "app_maintenance" | "invalid_transition" | "SESSION_NOT_FOUND" | "SESSION_EXPIRED" | "SESSION_ENDED" | "WORKER_LEASED" | "APP_MISMATCH" | "VERSION_MISMATCH" | "agents_disabled" | "remote_offline" | "remote_timeout" | "harness_not_drivable" | "harness_too_old";
 export declare const ErrorCodeInvalidRequest: ErrorCode;
 export declare const ErrorCodeValidationError: ErrorCode;
 export declare const ErrorCodeUnauthorized: ErrorCode;
@@ -3030,6 +3068,12 @@ export declare const ErrorCodeNotConfigured: ErrorCode;
 export declare const ErrorCodeMethodNotAllowed: ErrorCode;
 export declare const ErrorCodeRateLimited: ErrorCode;
 export declare const ErrorCodeInternalError: ErrorCode;
+/**
+ * ErrorCodeRequirementsNotMet (412): the run needs a secret or a
+ * credential the caller has not set up. Meta "errors" lists each
+ * RequirementError, its action saying how to set it up.
+ */
+export declare const ErrorCodeRequirementsNotMet: ErrorCode;
 /**
  * ErrorCodeTeamRoleRequired: the caller's team role or org-admin status
  * does not allow the action. Meta is TeamRoleRequiredMeta when a
@@ -4723,6 +4767,11 @@ export interface SetupAction {
      * list comes from; sent back when the keys are saved.
      */
     provider_website?: string;
+    /**
+     * Instructions tell a person how to get what the provider's scheme
+     * asks for (markdown, links allowed).
+     */
+    instructions?: string;
 }
 /**
  * CheckRequirementsRequest is the request body for checking requirements
@@ -5759,6 +5808,12 @@ export interface SecretField {
     placeholder?: string;
     sensitive?: boolean;
     optional?: boolean;
+    /**
+     * Pattern, when set, is a regular expression (RE2) a saved value must
+     * match, so a pasted login link or the wrong key is refused on save
+     * instead of failing the first run ("^sk-ant-oat01-").
+     */
+    pattern?: string;
 }
 /**
  * AuthMethodClientAuth is how client_id/client_secret reach the token
@@ -6650,6 +6705,12 @@ export declare const GraphEdgeTypeReferences: GraphEdgeType;
 export declare const GraphEdgeTypeSupersedes: GraphEdgeType;
 export declare const GraphEdgeTypeInput: GraphEdgeType;
 export declare const GraphEdgeTypeOutput: GraphEdgeType;
+/**
+ * InterruptResourceTurn is an interrupt that holds a run's next turn before
+ * its model call, with nothing in flight; its ResourceID is the run's. An
+ * allow starts the turn, a deny ends the run.
+ */
+export declare const InterruptResourceTurn: InterruptResourceType;
 /**
  * MergeStrategy defines how a delta field should be merged by consumers.
  */
@@ -7456,6 +7517,12 @@ export declare const TaskStatusUploading: TaskStatus;
 export declare const TaskStatusCompleted: TaskStatus;
 export declare const TaskStatusFailed: TaskStatus;
 export declare const TaskStatusCancelled: TaskStatus;
+/**
+ * TaskStatusRejected is a run admission refused (no balance, no payment
+ * method). The task is written already ended, keeping what was asked
+ * for; it never ran and no status leads to it.
+ */
+export declare const TaskStatusRejected: TaskStatus;
 /**
  * Infra defines where a task should run.
  */
@@ -7801,7 +7868,7 @@ export declare const InterruptResolutionDeny: InterruptResolution;
 /**
  * InterruptResourceType identifies the kind of resource an interrupt gates.
  */
-export type InterruptResourceType = "tool_invocation" | "hook_event";
+export type InterruptResourceType = "turn" | "tool_invocation" | "hook_event";
 export declare const InterruptResourceToolInvocation: InterruptResourceType;
 export declare const InterruptResourceHookEvent: InterruptResourceType;
 /**

package/dist/types.js

@@ -389,6 +389,12 @@ export const ErrorCodeNotConfigured = "not_configured";
 export const ErrorCodeMethodNotAllowed = "method_not_allowed";
 export const ErrorCodeRateLimited = "rate_limited";
 export const ErrorCodeInternalError = "internal_error";
+/**
+ * ErrorCodeRequirementsNotMet (412): the run needs a secret or a
+ * credential the caller has not set up. Meta "errors" lists each
+ * RequirementError, its action saying how to set it up.
+ */
+export const ErrorCodeRequirementsNotMet = "requirements_not_met";
 /**
  * ErrorCodeTeamRoleRequired: the caller's team role or org-admin status
  * does not allow the action. Meta is TeamRoleRequiredMeta when a
@@ -980,6 +986,12 @@ export const GraphEdgeTypeReferences = "references";
 export const GraphEdgeTypeSupersedes = "supersedes";
 export const GraphEdgeTypeInput = "input";
 export const GraphEdgeTypeOutput = "output";
+/**
+ * InterruptResourceTurn is an interrupt that holds a run's next turn before
+ * its model call, with nothing in flight; its ResourceID is the run's. An
+ * allow starts the turn, a deny ends the run.
+ */
+export const InterruptResourceTurn = "turn";
 export const MergeStrategyConcat = "concat";
 export const MergeStrategyReplace = "replace";
 export const MergeStrategyIndexed = "indexed";
@@ -1455,6 +1467,12 @@ export const TaskStatusUploading = 9;
 export const TaskStatusCompleted = 10;
 export const TaskStatusFailed = 11;
 export const TaskStatusCancelled = 12;
+/**
+ * TaskStatusRejected is a run admission refused (no balance, no payment
+ * method). The task is written already ended, keeping what was asked
+ * for; it never ran and no status leads to it.
+ */
+export const TaskStatusRejected = 13;
 export const InfraPrivate = "private";
 export const InfraCloud = "cloud";
 export const InfraPrivateFirst = "private_first";

package/dist/utils.d.ts

@@ -2,6 +2,7 @@
  * Status utilities for handling both int and string-based status values.
  * Provides future compatibility when API migrates from int to string status.
  */
+import type { InterruptDTO } from './types.js';
 import { TaskStatus } from './types.js';
 import type { AgentRunState, ChatDTO, ChatMessageStatus } from './types.js';
 /**
@@ -10,7 +11,7 @@ import type { AgentRunState, ChatDTO, ChatMessageStatus } from './types.js';
  */
 export declare function parseStatus(status: number | string | undefined | null): TaskStatus;
 /**
- * Check if a task status is terminal (completed, failed, or cancelled).
+ * Check if a task status is terminal (completed, failed, cancelled, or rejected).
  * Handles both int and string status values.
  */
 export declare function isTerminalStatus(status: number | string | undefined | null): boolean;
@@ -39,3 +40,12 @@ export type PendingApproval = {
  * which the API projects onto the chat, so no message scan is needed.
  */
 export declare function pendingApprovals(chat: ChatDTO | null | undefined): PendingApproval[];
+/** A run's next turn held for the person (InterruptResourceTurn): after a long stretch without them, it waits for "keep going" (allow) or "stop" (deny). */
+export type HeldTurn = {
+    interruptId: string;
+    runId: string;
+    /** Steps the run took without the person, when the api says. */
+    steps: number | null;
+};
+/** The held turn among a run's pending interrupts, if one is held. */
+export declare function heldTurn(interrupts: InterruptDTO[] | null | undefined): HeldTurn | null;

package/dist/utils.js

@@ -2,8 +2,8 @@
  * Status utilities for handling both int and string-based status values.
  * Provides future compatibility when API migrates from int to string status.
  */
-import { InterruptReasonToolApproval, InterruptStatusPending } from './types.js';
-import { TaskStatusUnknown, TaskStatusReceived, TaskStatusQueued, TaskStatusDispatched, TaskStatusPreparing, TaskStatusServing, TaskStatusSettingUp, TaskStatusRunning, TaskStatusCancelling, TaskStatusUploading, TaskStatusCompleted, TaskStatusFailed, TaskStatusCancelled, AgentRunStateWorking, AgentRunStateSubmitted, AgentRunStateInputRequired, AgentRunStateAuthRequired, AgentRunStateCompleted, AgentRunStateFailed, AgentRunStateCanceled, AgentRunStateRejected, ChatMessageStatusReady, ChatMessageStatusFailed, ChatMessageStatusCancelled, ChatStatusBusy, ChatStatusAwaitingInput, } from './types.js';
+import { InterruptReasonToolApproval, InterruptResourceTurn, InterruptStatusPending } from './types.js';
+import { TaskStatusUnknown, TaskStatusReceived, TaskStatusQueued, TaskStatusDispatched, TaskStatusPreparing, TaskStatusServing, TaskStatusSettingUp, TaskStatusRunning, TaskStatusCancelling, TaskStatusUploading, TaskStatusCompleted, TaskStatusFailed, TaskStatusCancelled, TaskStatusRejected, AgentRunStateWorking, AgentRunStateSubmitted, AgentRunStateInputRequired, AgentRunStateAuthRequired, AgentRunStateCompleted, AgentRunStateFailed, AgentRunStateCanceled, AgentRunStateRejected, ChatMessageStatusReady, ChatMessageStatusFailed, ChatMessageStatusCancelled, ChatStatusBusy, ChatStatusAwaitingInput, } from './types.js';
 /** Map string status names to TaskStatus values (for future string-based API) */
 const STATUS_STRING_MAP = {
     unknown: TaskStatusUnknown,
@@ -19,6 +19,7 @@ const STATUS_STRING_MAP = {
     completed: TaskStatusCompleted,
     failed: TaskStatusFailed,
     cancelled: TaskStatusCancelled,
+    rejected: TaskStatusRejected,
 };
 /**
  * Parse task status from int or string to TaskStatus number.
@@ -37,12 +38,12 @@ export function parseStatus(status) {
     return TaskStatusUnknown;
 }
 /**
- * Check if a task status is terminal (completed, failed, or cancelled).
+ * Check if a task status is terminal (completed, failed, cancelled, or rejected).
  * Handles both int and string status values.
  */
 export function isTerminalStatus(status) {
     const parsed = parseStatus(status);
-    return parsed === TaskStatusCompleted || parsed === TaskStatusFailed || parsed === TaskStatusCancelled;
+    return parsed === TaskStatusCompleted || parsed === TaskStatusFailed || parsed === TaskStatusCancelled || parsed === TaskStatusRejected;
 }
 // Run and message state predicates. Ports of the Go methods AgentRunState.IsTerminal/
 // IsInterrupted/IsSettled and ChatMessageStatus.IsTerminal; every consumer uses these.
@@ -79,7 +80,8 @@ export function isAwaitingHuman(chat) {
         return isRunInterrupted(run.state);
     return chat?.status === ChatStatusAwaitingInput;
 }
-function parseApprovalMeta(interrupt) {
+/** An interrupt's meta, which arrives as an object or a JSON string. */
+function parseMeta(interrupt) {
     const meta = interrupt.meta;
     if (!meta)
         return {};
@@ -104,7 +106,7 @@ export function pendingApprovals(chat) {
         if (interrupt.reason !== InterruptReasonToolApproval || interrupt.status !== InterruptStatusPending) {
             continue;
         }
-        const meta = parseApprovalMeta(interrupt);
+        const meta = parseMeta(interrupt);
         out.push({
             interruptId: interrupt.id,
             toolInvocationId: interrupt.resource_id ?? meta.tool_invocation_id ?? '',
@@ -115,3 +117,11 @@ export function pendingApprovals(chat) {
     }
     return out;
 }
+/** The held turn among a run's pending interrupts, if one is held. */
+export function heldTurn(interrupts) {
+    const interrupt = interrupts?.find(i => i.resource_type === InterruptResourceTurn && i.status === InterruptStatusPending);
+    if (!interrupt)
+        return null;
+    const { steps } = parseMeta(interrupt);
+    return { interruptId: interrupt.id, runId: interrupt.run_id, steps: typeof steps === 'number' ? steps : null };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inferencesh/sdk",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Official JavaScript/TypeScript SDK for inference.sh - Run AI models with a simple API",
   "type": "module",
   "main": "dist/index.js",