@inferencesh/sdk 0.6.54 → 0.7.1

package/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-09-23
+
+### Changed
+
+- `client.credentials` (`CredentialsAPI`) replaces `client.integrations` / `IntegrationsAPI`; both old names remain as deprecated aliases
+- `httpTool().auth({ credential, credentialId })` writes auth type `credential`; `integration` / `integrationId` still work
+- Requirement errors use type `credential` (was `integration`); check against `RequirementTypeCredential`
+- `CredentialsAPI.checkRequirements` is typed (`CheckRequirementsRequest` with `credentials`, `CheckRequirementsResponse`)
+- API key scopes are `credentials:read` / `credentials:write` (`integrations:*` keys keep working)
+
 ## [0.6.8] - 2026-05-20
 
 ### Added

package/README.md

@@ -377,7 +377,7 @@ Use the fluent builders to define `AgentTool` schemas. Client tools (`tool`) run
 | `agentTool(name, agentRef)` | Server | Delegate to a sub-agent |
 | `httpTool(name, url)` / `callTool(name, url)` | Server | HTTP request with credential injection (preferred over `webhookTool`) |
 | `webhookTool(name, url)` | Server | Unsigned webhook (legacy; use `httpTool` for new tools) |
-| `mcpTool(name, integrationId, toolName)` | Server | Call a tool on a connected MCP integration |
+| `mcpTool(name, credentialId, toolName)` | Server | Call a tool through a connected MCP credential |
 | `internalTools()` | Server | Built-in plan, memory, and widget tools |
 
 ```typescript
@@ -397,11 +397,11 @@ const clientTool = tool('get_weather')
   .param('city', string('City name'))
   .build();
 
-// HTTP tool with OAuth integration credentials (injected server-side)
+// HTTP tool authenticated with a connected account (token injected server-side)
 const gmailSend = httpTool('gmail_send', 'https://gmail.googleapis.com/gmail/v1/users/me/messages/send')
   .describe('Send an email via Gmail')
   .method('POST')
-  .auth({ integration: CredentialProviderGoogle, integrationId: 'your-integration-id' })
+  .auth({ credential: CredentialProviderGoogle, credentialId: 'your-credential-id' })
   .build();
 
 // API key or bearer auth
@@ -420,7 +420,7 @@ const imageGen = appTool('generate_image', 'infsh/flux-schnell@abc123')
   .requireApproval()
   .build();
 
-const mcpSearch = mcpTool('notion_search', 'your-mcp-integration-id', 'search')
+const mcpSearch = mcpTool('notion_search', 'your-mcp-credential-id', 'search')
   .describe('Search Notion pages')
   .param('query', string('Search query'))
   .build();
@@ -642,9 +642,9 @@ if (task.status === TaskStatusCompleted) {
 }
 ```
 
-## Integration Constants
+## Credential Constants
 
-`CredentialDTO` fields (`provider`, `type`, `auth`, `status`) use typed string unions exported as constants:
+`CredentialDTO` fields (`provider`, `type`, `status`) use typed string unions exported as constants:
 
 ```typescript
 import type { CredentialDTO } from '@inferencesh/sdk';
@@ -655,24 +655,25 @@ import {
   CredentialStatusDisconnected,
   CredentialStatusExpired,
   CredentialStatusError,
+  RequirementTypeCredential,
   isRequirementsNotMetException,
 } from '@inferencesh/sdk';
 
-function isGoogleConnected(integration: CredentialDTO): boolean {
+function isGoogleConnected(credential: CredentialDTO): boolean {
   return (
-    integration.provider === CredentialProviderGoogle &&
-    integration.status === CredentialStatusConnected
+    credential.provider === CredentialProviderGoogle &&
+    credential.status === CredentialStatusConnected
   );
 }
 
-// HTTP 412 when an app requires a missing secret, integration, or scope
+// HTTP 412 when an app requires a missing secret, credential, or scope
 try {
   await client.run({ app: 'my-app', input: {} });
 } catch (error) {
   if (isRequirementsNotMetException(error)) {
     for (const req of error.errors) {
-      if (req.type === 'integration' && req.action?.provider === CredentialProviderGoogle) {
-        // User must connect Google — see https://inference.sh/docs/extend/integrations
+      if (req.type === RequirementTypeCredential && req.action?.provider === CredentialProviderGoogle) {
+        // User must connect Google — see https://inference.sh/docs/extend/credentials
       }
     }
   }

package/dist/api/{integrations.d.ts → credentials.d.ts}

@@ -1,22 +1,22 @@
 import { HttpClient } from '../http/client';
 import type { Response } from '../http/response';
-import { CredentialDTO, CredentialConfigDTO, CredentialConnectRequest, CredentialConnectResponse, CursorListRequest, CursorListResponse } from '../types';
+import { CheckRequirementsRequest, CheckRequirementsResponse, CredentialDTO, CredentialConfigDTO, CredentialConnectRequest, CredentialConnectResponse, CursorListRequest, CursorListResponse } from '../types';
 /**
- * Integrations API
+ * Credentials API: the accounts and keys a team has connected to external services.
  */
-export declare class IntegrationsAPI {
+export declare class CredentialsAPI {
     private readonly http;
     constructor(http: HttpClient);
     /**
-     * List integrations with cursor-based pagination
+     * List credentials with cursor-based pagination
      */
     list(params?: Partial<CursorListRequest>): Promise<Response<CursorListResponse<CredentialDTO>>>;
     /**
-     * Get available integrations
+     * List the providers a credential can be connected for
      */
     listAvailable(): Promise<Response<CredentialConfigDTO[]>>;
     /**
-     * Get integration configs
+     * Get provider connection configs
      */
     getConfigs(): Promise<Response<CredentialConfigDTO[]>>;
     /**
@@ -24,19 +24,19 @@ export declare class IntegrationsAPI {
      */
     getCapabilities(): Promise<Response<unknown>>;
     /**
-     * Check requirements
+     * Check whether secret and credential requirements are satisfied
      */
-    checkRequirements(data: unknown): Promise<Response<unknown>>;
+    checkRequirements(data: CheckRequirementsRequest): Promise<Response<CheckRequirementsResponse>>;
     /**
-     * Connect an integration
+     * Connect a credential
      */
     connect(data: CredentialConnectRequest): Promise<Response<CredentialConnectResponse>>;
     /**
-     * Get an integration by provider key
+     * Get a credential by provider key
      */
     get(provider: string): Promise<Response<CredentialDTO>>;
     /**
-     * Disconnect an integration
+     * Disconnect a credential
      */
     disconnect(provider: string): Promise<Response<void>>;
 }

package/dist/api/{integrations.js → credentials.js}

@@ -1,24 +1,24 @@
 /**
- * Integrations API
+ * Credentials API: the accounts and keys a team has connected to external services.
  */
-export class IntegrationsAPI {
+export class CredentialsAPI {
     constructor(http) {
         this.http = http;
     }
     /**
-     * List integrations with cursor-based pagination
+     * List credentials with cursor-based pagination
      */
     async list(params) {
         return this.http.request('post', '/credentials/list', { data: params });
     }
     /**
-     * Get available integrations
+     * List the providers a credential can be connected for
      */
     async listAvailable() {
         return this.http.request('get', '/credentials/available');
     }
     /**
-     * Get integration configs
+     * Get provider connection configs
      */
     async getConfigs() {
         return this.http.request('get', '/credentials/configs');
@@ -30,27 +30,27 @@ export class IntegrationsAPI {
         return this.http.request('get', '/credentials/capabilities');
     }
     /**
-     * Check requirements
+     * Check whether secret and credential requirements are satisfied
      */
     async checkRequirements(data) {
         return this.http.request('post', '/credentials/check', { data });
     }
     /**
-     * Connect an integration
+     * Connect a credential
      */
     async connect(data) {
         return this.http.request('post', '/credentials', { data });
     }
     /**
-     * Get an integration by provider key
+     * Get a credential by provider key
      */
     async get(provider) {
-        return this.http.request('get', `/credentials/${provider}`);
+        return this.http.request('get', `/credentials/${encodeURIComponent(provider)}`);
     }
     /**
-     * Disconnect an integration
+     * Disconnect a credential
      */
     async disconnect(provider) {
-        return this.http.request('delete', `/credentials/${provider}`);
+        return this.http.request('delete', `/credentials/${encodeURIComponent(provider)}`);
     }
 }

package/dist/api/sockets.d.ts

@@ -34,6 +34,7 @@ export declare class SocketsAPI {
     forTask(taskId: string): Promise<SocketDTO | null>;
     /** A fresh credential for the caller's end, e.g. after a reload or to redial. */
     access(id: string): Promise<Response<SocketAccess>>;
+    private credentialFor;
     delete(id: string): Promise<Response<void>>;
     /**
      * Dials the caller's end of a stream task's socket. The session is

package/dist/api/sockets.js

@@ -27,6 +27,12 @@ export class SocketsAPI {
     async access(id) {
         return this.http.request('post', `/sockets/${id}/access`);
     }
+    async credentialFor(taskId) {
+        const socket = await this.forTask(taskId);
+        if (!socket)
+            throw new Error(`task ${taskId} has no socket: is it a stream function?`);
+        return (await this.access(socket.id)).data;
+    }
     async delete(id) {
         return this.http.request('delete', `/sockets/${id}`);
     }
@@ -35,20 +41,17 @@ export class SocketsAPI {
      * `waiting` until the app's first frame, then `live`; see LiveSession.
      */
     async open(target, handlers = {}, options = {}) {
-        const task = typeof target === 'string' ? (await this.tasks.get(target)).data : target;
-        let access = typeof target === 'string' ? undefined : target.socket;
-        let socketId = access?.id;
-        if (!access) {
-            const socket = await this.forTask(task.id);
-            if (!socket)
-                throw new Error(`task ${task.id} has no socket: is it a stream function?`);
-            socketId = socket.id;
-            access = (await this.access(socket.id)).data;
-        }
+        const taskId = typeof target === 'string' ? target : target.id;
+        // Given only an id, the task (for the watch) and a credential for its
+        // socket are independent: fetch them together.
+        const [task, access] = await Promise.all([
+            typeof target === 'string' ? this.tasks.get(target).then((res) => res.data) : target,
+            (typeof target !== 'string' && target.socket) || this.credentialFor(taskId),
+        ]);
         const session = new LiveSession({
             access,
             handlers,
-            renew: async () => (await this.access(socketId)).data,
+            renew: async () => (await this.access(access.id)).data,
             task: options.watchTask === false ? undefined : this.tasks.watch(task),
             webSocket: options.webSocket,
         });

package/dist/index.d.ts

@@ -20,13 +20,15 @@ export { ArtifactsAPI } from './api/artifacts';
 export { TeamsAPI, type MeResponse } from './api/teams';
 export { SecretsAPI } from './api/secrets';
 export { ApiKeysAPI } from './api/api-keys';
-export { IntegrationsAPI } from './api/integrations';
+export { CredentialsAPI } from './api/credentials';
+/** @deprecated renamed CredentialsAPI */
+export { CredentialsAPI as IntegrationsAPI } from './api/credentials';
 export { SearchAPI } from './api/search';
 export { ProjectsAPI } from './api/projects';
 export { MCPServersAPI } from './api/mcp-servers';
-export { LiveSession } from './live/session';
+export { LiveSession, accessUrl } from './live/session';
 export type { LiveState, LiveEnd, LiveHandlers, LiveSessionOptions, WebSocketLike, WebSocketConstructor } from './live/session';
-export { STREAM_FORMAT, isLiveField, parseMediaType, pcmFormat, splitLiveSchema, binaryLiveField, alternativeLabel, } from './live/schema';
+export { STREAM_FORMAT, CLEAR_KEY, isLiveField, parseMediaType, pcmFormat, splitLiveSchema, binaryLiveField, alternativeLabel, } from './live/schema';
 export type { JsonSchema, MediaType, PCMFormat, LiveField } from './live/schema';
 export { tool, appTool, agentTool, webhookTool, httpTool, callTool, mcpTool, internalTools, string, number, integer, boolean, enumOf, object, array, optional, } from './tool-builder';
 export type { ClientTool, ClientToolHandler } from './tool-builder';
@@ -56,7 +58,7 @@ import { ArtifactsAPI } from './api/artifacts';
 import { TeamsAPI } from './api/teams';
 import { SecretsAPI } from './api/secrets';
 import { ApiKeysAPI } from './api/api-keys';
-import { IntegrationsAPI } from './api/integrations';
+import { CredentialsAPI } from './api/credentials';
 import { SearchAPI } from './api/search';
 import { ProjectsAPI } from './api/projects';
 import { MCPServersAPI } from './api/mcp-servers';
@@ -112,11 +114,13 @@ export declare class Inference {
     readonly teams: TeamsAPI;
     readonly secrets: SecretsAPI;
     readonly apiKeys: ApiKeysAPI;
-    readonly integrations: IntegrationsAPI;
+    readonly credentials: CredentialsAPI;
     readonly search: SearchAPI;
     readonly projects: ProjectsAPI;
     readonly mcpServers: MCPServersAPI;
     readonly sockets: SocketsAPI;
+    /** @deprecated renamed `credentials` */
+    get integrations(): CredentialsAPI;
     constructor(config: InferenceConfig | HttpClientConfig);
     /** @internal */
     _request<T>(method: 'get' | 'post' | 'put' | 'delete', endpoint: string, options?: {

package/dist/index.js

@@ -22,13 +22,15 @@ export { ArtifactsAPI } from './api/artifacts';
 export { TeamsAPI } from './api/teams';
 export { SecretsAPI } from './api/secrets';
 export { ApiKeysAPI } from './api/api-keys';
-export { IntegrationsAPI } from './api/integrations';
+export { CredentialsAPI } from './api/credentials';
+/** @deprecated renamed CredentialsAPI */
+export { CredentialsAPI as IntegrationsAPI } from './api/credentials';
 export { SearchAPI } from './api/search';
 export { ProjectsAPI } from './api/projects';
 export { MCPServersAPI } from './api/mcp-servers';
 // Live: the socket of a stream task and the live fields of its schemas
-export { LiveSession } from './live/session';
-export { STREAM_FORMAT, isLiveField, parseMediaType, pcmFormat, splitLiveSchema, binaryLiveField, alternativeLabel, } from './live/schema';
+export { LiveSession, accessUrl } from './live/session';
+export { STREAM_FORMAT, CLEAR_KEY, isLiveField, parseMediaType, pcmFormat, splitLiveSchema, binaryLiveField, alternativeLabel, } from './live/schema';
 // Tool Builder (fluent API)
 export { tool, appTool, agentTool, webhookTool, httpTool, callTool, mcpTool, internalTools, string, number, integer, boolean, enumOf, object, array, optional, } from './tool-builder';
 // Hook Builder (fluent API)
@@ -58,7 +60,7 @@ import { ArtifactsAPI } from './api/artifacts';
 import { TeamsAPI } from './api/teams';
 import { SecretsAPI } from './api/secrets';
 import { ApiKeysAPI } from './api/api-keys';
-import { IntegrationsAPI } from './api/integrations';
+import { CredentialsAPI } from './api/credentials';
 import { SearchAPI } from './api/search';
 import { ProjectsAPI } from './api/projects';
 import { MCPServersAPI } from './api/mcp-servers';
@@ -72,6 +74,10 @@ import { MCPServersAPI } from './api/mcp-servers';
  * ```
  */
 export class Inference {
+    /** @deprecated renamed `credentials` */
+    get integrations() {
+        return this.credentials;
+    }
     constructor(config) {
         // Handle both simple config and full HttpClientConfig
         this.http = new HttpClient({
@@ -101,7 +107,7 @@ export class Inference {
         this.teams = new TeamsAPI(this.http);
         this.secrets = new SecretsAPI(this.http);
         this.apiKeys = new ApiKeysAPI(this.http);
-        this.integrations = new IntegrationsAPI(this.http);
+        this.credentials = new CredentialsAPI(this.http);
         this.search = new SearchAPI(this.http);
         this.projects = new ProjectsAPI(this.http);
         this.mcpServers = new MCPServersAPI(this.http);

package/dist/live/schema.d.ts

@@ -17,6 +17,11 @@
  * JSON Schema type keeps it.
  */
 export declare const STREAM_FORMAT = "stream";
+/**
+ * A control frame, `{"$clear": "audio"}`: drop what has been buffered of a
+ * live output field. Reserved keys start with `$`, which no field name can.
+ */
+export declare const CLEAR_KEY = "$clear";
 /** The part of JSON Schema these helpers read. */
 export interface JsonSchema {
     $ref?: string;

package/dist/live/schema.js

@@ -17,6 +17,11 @@
  * JSON Schema type keeps it.
  */
 export const STREAM_FORMAT = 'stream';
+/**
+ * A control frame, `{"$clear": "audio"}`: drop what has been buffered of a
+ * live output field. Reserved keys start with `$`, which no field name can.
+ */
+export const CLEAR_KEY = '$clear';
 export function isLiveField(schema) {
     return !!schema && schema.format === STREAM_FORMAT;
 }
@@ -46,7 +51,10 @@ export function pcmFormat(media) {
         return null;
     return { sampleRate, channels };
 }
-/** Resolves a `#/$defs/` reference against the root, recursively. */
+/**
+ * Resolves a `#/$defs/` reference against the root, recursively. The result
+ * carries no top-level `$ref` (a validator ignores a `$ref`'s siblings).
+ */
 function deref(schema, root) {
     if (!schema.$ref || !root.$defs)
         return schema;
@@ -55,14 +63,17 @@ function deref(schema, root) {
     if (!target)
         return schema;
     // The reference's own fields (title, description) win over the target's.
-    return { ...deref(target, root), ...schema };
+    const { $ref: _ref, ...own } = schema;
+    return { ...deref(target, root), ...own };
 }
 function itemAlternatives(items, root) {
     const resolved = deref(items, root);
     const options = (resolved.anyOf ?? resolved.oneOf);
-    if (options?.length)
-        return options.map((option) => deref(option, root));
-    return [resolved];
+    const alternatives = options?.length ? options.map((option) => deref(option, root)) : [resolved];
+    // Each alternative must stand on its own (a form validates it without the
+    // root), and nested references (an enum field, a nested model) still point
+    // into the root's $defs, so they travel with it.
+    return root.$defs ? alternatives.map((alternative) => ({ ...alternative, $defs: root.$defs })) : alternatives;
 }
 /**
  * Splits a function schema into what a form renders (the ordinary

package/dist/live/session.d.ts

@@ -27,6 +27,12 @@ export interface LiveHandlers {
     onBinary?: (data: ArrayBuffer) => void;
     /** A partial output object keyed by field name. */
     onPatch?: (patch: Record<string, unknown>) => void;
+    /**
+     * Drop what you have buffered of this live output field: the app sends it
+     * when an answer is cut short, e.g. the user talked over it. Without this
+     * handler the control frame reaches onPatch as `{"$clear": field}`.
+     */
+    onClear?: (field: string) => void;
 }
 /**
  * Follows the task the socket belongs to. `done` settles when the task ends
@@ -67,6 +73,11 @@ export interface LiveSessionOptions {
     /** The WebSocket to dial with; defaults to the runtime's global one. */
     webSocket?: WebSocketConstructor;
 }
+/**
+ * Where to dial. A browser cannot set headers on a WebSocket, so the
+ * credential rides in the query, as the relay documents.
+ */
+export declare function accessUrl(access: Pick<SocketAccess, 'url' | 'token'>): string;
 export declare class LiveSession {
     private ws;
     private current;

package/dist/live/session.js

@@ -1,3 +1,4 @@
+import { CLEAR_KEY } from './schema';
 const WS_OPEN = 1;
 // 1012: the relay is restarting and closed an end that still waited for its
 // peer. 1013: the peer did not come in time. Both mean "dial again" while the
@@ -11,6 +12,14 @@ function globalWebSocket() {
     }
     return ctor;
 }
+/**
+ * Where to dial. A browser cannot set headers on a WebSocket, so the
+ * credential rides in the query, as the relay documents.
+ */
+export function accessUrl(access) {
+    const sep = access.url.includes('?') ? '&' : '?';
+    return `${access.url}${sep}access_token=${encodeURIComponent(access.token)}`;
+}
 export class LiveSession {
     constructor(options) {
         this.ws = null;
@@ -37,9 +46,7 @@ export class LiveSession {
     connect() {
         this.setState('connecting');
         this.watchTask();
-        // A browser cannot set headers on a WebSocket, so the credential rides in
-        // the query, as the relay documents.
-        const ws = new this.WebSocket(`${this.access.url}?access_token=${encodeURIComponent(this.access.token)}`);
+        const ws = new this.WebSocket(accessUrl(this.access));
         ws.binaryType = 'arraybuffer';
         this.ws = ws;
         ws.onopen = () => this.setState('waiting');
@@ -57,7 +64,15 @@ export class LiveSession {
                     patch = { text: event.data };
                 }
                 if (patch && typeof patch === 'object' && !Array.isArray(patch)) {
-                    this.handlers.onPatch?.(patch);
+                    const record = patch;
+                    const clear = record[CLEAR_KEY];
+                    if (this.handlers.onClear && typeof clear === 'string') {
+                        this.handlers.onClear(clear);
+                        delete record[CLEAR_KEY];
+                        if (Object.keys(record).length === 0)
+                            return;
+                    }
+                    this.handlers.onPatch?.(record);
                 }
             }
             else {

package/dist/tool-builder.d.ts

@@ -86,9 +86,16 @@ declare class HTTPToolBuilder extends ToolBuilder {
     private headerMap;
     constructor(name: string, url: string);
     method(m: string): this;
+    /**
+     * How the tool authenticates: `credential` sends a connected account's
+     * access token (pick the account with `credentialId`), `apiKey` / `bearer`
+     * send a vault secret.
+     */
     auth(config: {
-        integration?: string;
-        integrationId?: string;
+        credential?: string;
+        credentialId?: string;
+        /** @deprecated renamed `credential` */ integration?: string;
+        /** @deprecated renamed `credentialId` */ integrationId?: string;
         apiKey?: string;
         bearer?: string;
         header?: string;
@@ -109,11 +116,12 @@ export declare const httpTool: (name: string, url: string) => HTTPToolBuilder;
 /** Create a call tool — makes authenticated HTTP requests. Preferred name for httpTool. */
 export declare const callTool: (name: string, url: string) => HTTPToolBuilder;
 /** Create an MCP connector tool (calls a tool on a connected MCP server) */
-export declare const mcpTool: (name: string, integrationId: string, toolName: string) => MCPToolBuilder;
+/** `credentialId` is the MCP credential the tool runs through. */
+export declare const mcpTool: (name: string, credentialId: string, toolName: string) => MCPToolBuilder;
 declare class MCPToolBuilder extends ToolBuilder {
-    private integrationId;
+    private credentialId;
     private toolName;
-    constructor(name: string, integrationId: string, toolName: string);
+    constructor(name: string, credentialId: string, toolName: string);
     build(): AgentTool;
 }
 declare class InternalToolsBuilder {
@@ -128,6 +136,8 @@ declare class InternalToolsBuilder {
     finish(enabled?: boolean): this;
     /** Enable meta tools */
     meta(enabled?: boolean): this;
+    /** Enable remote tools (run commands on the user's connected remotes) */
+    remote(enabled?: boolean): this;
     /** Enable all internal tools */
     all(): this;
     /** Disable all internal tools */

package/dist/tool-builder.js

@@ -1,7 +1,7 @@
 /**
  * Tool Builder - Fluent API for defining agent tools
  */
-import { ToolTypeClient, ToolTypeApp, ToolTypeAgent, ToolTypeHook, ToolTypeHTTP, ToolTypeMCP } from './types';
+import { ToolAuthTypeAPIKey, ToolAuthTypeBearer, ToolAuthTypeCredential, ToolTypeClient, ToolTypeApp, ToolTypeAgent, ToolTypeHook, ToolTypeHTTP, ToolTypeMCP } from './types';
 // =============================================================================
 // Schema Builders
 // =============================================================================
@@ -183,15 +183,21 @@ class HTTPToolBuilder extends ToolBuilder {
         this.httpMethod = m;
         return this;
     }
+    /**
+     * How the tool authenticates: `credential` sends a connected account's
+     * access token (pick the account with `credentialId`), `apiKey` / `bearer`
+     * send a vault secret.
+     */
     auth(config) {
-        if (config.integration) {
-            this.authConfig = { type: 'integration', provider: config.integration, integration_id: config.integrationId };
+        const provider = config.credential ?? config.integration;
+        if (provider) {
+            this.authConfig = { type: ToolAuthTypeCredential, provider, credential_id: config.credentialId ?? config.integrationId };
         }
         else if (config.apiKey) {
-            this.authConfig = { type: 'api_key', secret: config.apiKey, header: config.header || 'X-API-Key' };
+            this.authConfig = { type: ToolAuthTypeAPIKey, secret: config.apiKey, header: config.header || 'X-API-Key' };
         }
         else if (config.bearer) {
-            this.authConfig = { type: 'bearer', secret: config.bearer };
+            this.authConfig = { type: ToolAuthTypeBearer, secret: config.bearer };
         }
         return this;
     }
@@ -232,11 +238,12 @@ export const httpTool = (name, url) => new HTTPToolBuilder(name, url);
 /** Create a call tool — makes authenticated HTTP requests. Preferred name for httpTool. */
 export const callTool = (name, url) => new HTTPToolBuilder(name, url);
 /** Create an MCP connector tool (calls a tool on a connected MCP server) */
-export const mcpTool = (name, integrationId, toolName) => new MCPToolBuilder(name, integrationId, toolName);
+/** `credentialId` is the MCP credential the tool runs through. */
+export const mcpTool = (name, credentialId, toolName) => new MCPToolBuilder(name, credentialId, toolName);
 class MCPToolBuilder extends ToolBuilder {
-    constructor(name, integrationId, toolName) {
+    constructor(name, credentialId, toolName) {
         super(name);
-        this.integrationId = integrationId;
+        this.credentialId = credentialId;
         this.toolName = toolName;
     }
     build() {
@@ -246,7 +253,7 @@ class MCPToolBuilder extends ToolBuilder {
             description: this.desc,
             type: ToolTypeMCP,
             require_approval: this.approval || undefined,
-            mcp: { integration_id: this.integrationId, tool_name: this.toolName },
+            mcp: { credential_id: this.credentialId, tool_name: this.toolName },
         };
     }
 }
@@ -282,6 +289,11 @@ class InternalToolsBuilder {
         this.config.meta = enabled;
         return this;
     }
+    /** Enable remote tools (run commands on the user's connected remotes) */
+    remote(enabled = true) {
+        this.config.remote = enabled;
+        return this;
+    }
     /** Enable all internal tools */
     all() {
         this.config.plan = true;

package/dist/types.d.ts

@@ -11,6 +11,7 @@ export interface InternalToolsConfig {
     meta?: boolean;
     artifact?: boolean;
     spawn?: boolean;
+    remote?: boolean;
 }
 /**
  * AgentTool represents a unified tool that can be used by an agent
@@ -99,12 +100,37 @@ export interface ClientToolConfig {
     input_schema?: any;
     output_schema?: any;
 }
+/**
+ * ToolAuthType says how an HTTP tool authenticates.
+ */
+export type ToolAuthType = string;
+/**
+ * ToolAuthTypeNone sends no credentials (same as leaving type empty).
+ */
+export declare const ToolAuthTypeNone: ToolAuthType;
+/**
+ * ToolAuthTypeCredential sends a connected credential's access token.
+ */
+export declare const ToolAuthTypeCredential: ToolAuthType;
+/**
+ * ToolAuthTypeAPIKey sends a vault secret in a header.
+ */
+export declare const ToolAuthTypeAPIKey: ToolAuthType;
+/**
+ * ToolAuthTypeBearer sends a vault secret as a bearer token.
+ */
+export declare const ToolAuthTypeBearer: ToolAuthType;
 /**
  * ToolAuthConfig declares how a tool authenticates.
  */
 export interface ToolAuthConfig {
-    type: string;
+    type: ToolAuthType;
     provider?: string;
+    credential_id?: string;
+    /**
+     * Deprecated: the credential id used to be called integration_id. Read
+     * through CredentialRef(); never written.
+     */
     integration_id?: string;
     secret?: string;
     header?: string;
@@ -120,7 +146,12 @@ export interface HTTPToolConfig {
     output_schema?: any;
 }
 export interface MCPToolConfig {
-    integration_id: string;
+    credential_id?: string;
+    /**
+     * Deprecated: the credential id used to be called integration_id. Read
+     * through CredentialRef(); never written.
+     */
+    integration_id?: string;
     tool_name: string;
 }
 export interface AppToolConfigDTO {
@@ -160,7 +191,7 @@ export interface HTTPToolConfigDTO {
     output_schema?: any;
 }
 export interface MCPToolConfigDTO {
-    integration_id: string;
+    credential_id: string;
     tool_name: string;
 }
 /**
@@ -195,6 +226,15 @@ export interface AgentDTO extends BaseModelDTO, PermissionModelDTO, ProjectModel
     images: AgentImages;
     version_id: string;
     version?: AgentVersionDTO;
+    /**
+     * ProfileID is set when a harness profile on a remote thinks for this
+     * agent instead of our loop.
+     */
+    profile_id?: string;
+    /**
+     * RemoteID is the machine the agent's terminal tools run on by default.
+     */
+    remote_id?: string;
 }
 export interface AgentVersionDTO extends BaseModelDTO, PermissionModelDTO {
     description: string;
@@ -266,6 +306,12 @@ export interface AgentRunDTO extends BaseModelDTO, PermissionModelDTO {
     tool_invocation_id?: string;
     trigger_id?: string;
     metadata?: any;
+    /**
+     * ProfileID is the harness profile that thought for this run; nil when it
+     * was our own loop. RemoteID is the machine it ran on, if any.
+     */
+    profile_id?: string;
+    remote_id?: string;
 }
 export interface APIResponse<T extends any> {
     success: boolean;
@@ -392,7 +438,7 @@ export interface AppVersionInput {
     };
     kernel?: string;
     required_secrets?: SecretRequirement[];
-    required_integrations?: CredentialRequirement[];
+    required_credentials?: CredentialRequirement[];
     resources?: AppResources;
 }
 /**
@@ -551,7 +597,7 @@ export interface CredentialCompleteOAuthRequest {
     code_verifier?: string;
 }
 export interface CredentialConnectResponse {
-    integration?: CredentialDTO;
+    credential?: CredentialDTO;
     auth_url?: string;
     state?: string;
     code_verifier?: string;
@@ -808,15 +854,16 @@ export declare const ScopeSecretsRead: Scope;
  */
 export declare const ScopeSecretsWrite: Scope;
 /**
- * Action-level scopes for Integrations
+ * Action-level scopes for credentials (connected accounts, vaults,
+ * custom providers, MCP servers). Formerly integrations:read|write.
  */
-export declare const ScopeIntegrationsRead: Scope;
+export declare const ScopeCredentialsRead: Scope;
 /**
  * API Key Scopes - hierarchical permission system.
  * Resource-level scopes (e.g., "agents") imply all action-level scopes (e.g., "agents:read").
  * Empty scopes = full access (for backwards compatibility with existing keys).
  */
-export declare const ScopeIntegrationsWrite: Scope;
+export declare const ScopeCredentialsWrite: Scope;
 /**
  * Action-level scopes for Engines
  */
@@ -897,7 +944,7 @@ export declare const ScopeGroupProjects: ScopeGroup;
 export declare const ScopeGroupTeams: ScopeGroup;
 export declare const ScopeGroupBilling: ScopeGroup;
 export declare const ScopeGroupSecrets: ScopeGroup;
-export declare const ScopeGroupIntegrations: ScopeGroup;
+export declare const ScopeGroupCredentials: ScopeGroup;
 export declare const ScopeGroupEngines: ScopeGroup;
 export declare const ScopeGroupApiKeys: ScopeGroup;
 export declare const ScopeGroupKnowledge: ScopeGroup;
@@ -1046,13 +1093,28 @@ export interface SecretRequirement {
     optional?: boolean;
 }
 /**
- * CredentialRequirement defines an integration that an app requires.
- * Key is the provider slug (e.g. "bytedance", "google").
- * Secrets lists the specific env var names to inject from this integration.
- * Scopes lists OAuth scopes needed (for OAuth integrations).
+ * CredentialRequirement is an entry under credentials: in inf.yml: keys an
+ * app needs that belong to a provider. Provider names whose credential
+ * supplies them; Secrets lists the keys to inject from it (an API key
+ * credential), Scopes what to ask for (an OAuth one).
+ * 	credentials:
+ * 	  - provider: acme
+ * 	    name: Acme CRM
+ * 	    website: acme.com
+ * 	    secrets: [ACME_API_KEY]
+ * Key is a capability of a provider the platform defines ("x.tweet.read",
+ * "google.sheets"): an OAuth grant with the scopes it implies. An entry sets
+ * Provider, Key, or both; with both, Key decides how it is resolved.
  */
 export interface CredentialRequirement {
-    key: string;
+    provider?: string;
+    /**
+     * Name and Website describe a provider the platform does not list: the
+     * name its credential is shown under and the site its logo comes from.
+     */
+    name?: string;
+    website?: string;
+    key?: string;
     description?: string;
     optional?: boolean;
     secrets?: string[];
@@ -1106,7 +1168,7 @@ export interface AppVersionDTO extends BaseModelDTO {
     };
     kernel: string;
     required_secrets?: SecretRequirement[];
-    required_integrations?: CredentialRequirement[];
+    required_credentials?: CredentialRequirement[];
     resources: AppResources;
     checksum?: string;
 }
@@ -1633,6 +1695,15 @@ export interface ChatDTO extends BaseModelDTO, PermissionModelDTO {
     agent_data: ChatData;
     active_run?: AgentRunDTO;
     pending_interrupts?: InterruptDTO[];
+    /**
+     * HarnessSessionID is the harness's own session id when a remote profile
+     * thinks for this chat; `claude --resume <id>` opens it on that machine.
+     */
+    harness_session_id?: string;
+    /**
+     * ForkedFromMessageID is the message this chat was branched at.
+     */
+    forked_from_message_id?: string;
 }
 /**
  * ChatMessageDTO for API responses
@@ -3058,9 +3129,9 @@ export interface CompletePaymentRequest {
     payment_id?: string;
 }
 /**
- * UpdateIntegrationScopesRequest updates integration scopes.
+ * UpdateCredentialScopesRequest adds OAuth scopes to a connected credential.
  */
-export interface UpdateIntegrationScopesRequest {
+export interface UpdateCredentialScopesRequest {
     scopes: string[];
 }
 /**
@@ -3105,7 +3176,7 @@ export declare const RequirementTypeSecret: RequirementType;
 /**
  * Requirement error types
  */
-export declare const RequirementTypeIntegration: RequirementType;
+export declare const RequirementTypeCredential: RequirementType;
 /**
  * Requirement error types
  */
@@ -3137,13 +3208,23 @@ export interface SetupAction {
     scope_descriptions?: {
         [key: string]: string;
     };
+    /**
+     * Secrets are the keys to supply for an add_secret action on a
+     * provider: saved against Provider, they become its credential.
+     */
+    secrets?: string[];
+    /**
+     * ProviderWebsite is where the logo of a provider the platform does not
+     * list comes from; sent back when the keys are saved.
+     */
+    provider_website?: string;
 }
 /**
  * CheckRequirementsRequest is the request body for checking requirements
  */
 export interface CheckRequirementsRequest {
     secrets?: SecretRequirement[];
-    integrations?: CredentialRequirement[];
+    credentials?: CredentialRequirement[];
 }
 /**
  * CheckRequirementsResponse is the API response for checking requirements
@@ -4143,7 +4224,7 @@ export declare const GraphNodeTypeApproval: GraphNodeType;
 export declare const GraphNodeTypeConditional: GraphNodeType;
 export declare const GraphNodeTypeFlowNode: GraphNodeType;
 export declare const GraphNodeTypeTrigger: GraphNodeType;
-export declare const GraphNodeTypeIntegrationRequirement: GraphNodeType;
+export declare const GraphNodeTypeCredentialRequirement: GraphNodeType;
 /**
  * GraphNodeStatus represents the status of a node
  */

package/dist/types.js

@@ -1,4 +1,20 @@
 // Code generated by gotypegen. DO NOT EDIT.
+/**
+ * ToolAuthTypeNone sends no credentials (same as leaving type empty).
+ */
+export const ToolAuthTypeNone = "none";
+/**
+ * ToolAuthTypeCredential sends a connected credential's access token.
+ */
+export const ToolAuthTypeCredential = "credential";
+/**
+ * ToolAuthTypeAPIKey sends a vault secret in a header.
+ */
+export const ToolAuthTypeAPIKey = "api_key";
+/**
+ * ToolAuthTypeBearer sends a vault secret as a bearer token.
+ */
+export const ToolAuthTypeBearer = "bearer";
 /**
  * API Key Scopes - hierarchical permission system.
  * Resource-level scopes (e.g., "agents") imply all action-level scopes (e.g., "agents:read").
@@ -182,15 +198,16 @@ export const ScopeSecretsRead = "secrets:read";
  */
 export const ScopeSecretsWrite = "secrets:write";
 /**
- * Action-level scopes for Integrations
+ * Action-level scopes for credentials (connected accounts, vaults,
+ * custom providers, MCP servers). Formerly integrations:read|write.
  */
-export const ScopeIntegrationsRead = "integrations:read";
+export const ScopeCredentialsRead = "credentials:read";
 /**
  * API Key Scopes - hierarchical permission system.
  * Resource-level scopes (e.g., "agents") imply all action-level scopes (e.g., "agents:read").
  * Empty scopes = full access (for backwards compatibility with existing keys).
  */
-export const ScopeIntegrationsWrite = "integrations:write";
+export const ScopeCredentialsWrite = "credentials:write";
 /**
  * Action-level scopes for Engines
  */
@@ -267,7 +284,7 @@ export const ScopeGroupProjects = "projects";
 export const ScopeGroupTeams = "teams";
 export const ScopeGroupBilling = "billing";
 export const ScopeGroupSecrets = "secrets";
-export const ScopeGroupIntegrations = "integrations";
+export const ScopeGroupCredentials = "credentials";
 export const ScopeGroupEngines = "engines";
 export const ScopeGroupApiKeys = "apikeys";
 export const ScopeGroupKnowledge = "knowledge";
@@ -383,7 +400,7 @@ export const RequirementTypeSecret = "secret";
 /**
  * Requirement error types
  */
-export const RequirementTypeIntegration = "integration";
+export const RequirementTypeCredential = "credential";
 /**
  * Requirement error types
  */
@@ -537,7 +554,7 @@ export const GraphNodeTypeApproval = "approval";
 export const GraphNodeTypeConditional = "conditional";
 export const GraphNodeTypeFlowNode = "flow_node";
 export const GraphNodeTypeTrigger = "trigger";
-export const GraphNodeTypeIntegrationRequirement = "integration_requirement";
+export const GraphNodeTypeCredentialRequirement = "credential_requirement";
 export const GraphNodeStatusPending = "pending";
 export const GraphNodeStatusReady = "ready";
 export const GraphNodeStatusRunning = "running";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inferencesh/sdk",
-  "version": "0.6.54",
+  "version": "0.7.1",
   "description": "Official JavaScript/TypeScript SDK for inference.sh - Run AI models with a simple API",
   "type": "module",
   "main": "dist/index.js",