@ingram-cloud/sdk 1.0.0 → 1.2.0

package/dist/client.js

@@ -314,6 +314,9 @@ export class IngramCloud {
     usage = {
         /** Token/cost/run totals grouped by app, smith, model, or customer. */
         breakdown: (query, opts) => this.json("GET", "/usage", { ...opts, query }),
+        /** The raw billable-usage event ledger (keyset-paginated, newest first) — the
+         *  per-event rows the breakdown aggregates. */
+        events: (query, opts) => this.page("/usage/events", query, opts),
     };
     // ── Files (the OpenAI Files API) ─────────────────────────────────────────
     files = {
@@ -382,6 +385,10 @@ export class IngramCloud {
             }),
             delete: (wid, opts) => this.empty("DELETE", `/tenant/webhooks/${enc(wid)}`, opts),
             test: (wid, opts) => this.json("POST", `/tenant/webhooks/${enc(wid)}/test`, opts),
+            /** The persisted delivery attempts for a webhook (durable retry audit trail). */
+            deliveries: (wid, query, opts) => this.page(`/tenant/webhooks/${enc(wid)}/deliveries`, query, opts),
+            /** Force a fresh delivery attempt for one record (e.g. after the endpoint recovers). */
+            redeliver: (wid, did, opts) => this.json("POST", `/tenant/webhooks/${enc(wid)}/deliveries/${enc(did)}/redeliver`, opts),
         },
         providers: {
             list: (opts) => this.data("GET", "/tenant/providers", opts),
@@ -438,6 +445,17 @@ export class IngramCloud {
             delete: (opts) => this.empty("DELETE", "/tenant/email", opts),
         },
     };
+    // ── Delegated connector consent (connector OAuth, #123) ─────────────────
+    // Tenant-admin token. The tenant's hosted consent page (the provider's
+    // `authorize_url`) reads the pending request, then completes or declines it
+    // server-to-server; the returned `redirect_url` is where to 302 the browser.
+    oauth = {
+        authorizeRequests: {
+            get: (requestId, opts) => this.json("GET", `/oauth/authorize-requests/${enc(requestId)}`, opts),
+            complete: (requestId, body, opts) => this.json("POST", `/oauth/authorize-requests/${enc(requestId)}/complete`, { ...opts, body }),
+            decline: (requestId, opts) => this.json("POST", `/oauth/authorize-requests/${enc(requestId)}/decline`, opts),
+        },
+    };
     // ── Organization (org token: projects + billing) ────────────────────────
     organization = {
         projects: {

package/dist/zod/deployments.js

@@ -27,16 +27,38 @@ import { pageOut } from "./_page.js";
 export const DeploymentTarget = z
     .object({ type: z.enum(["smith", "agent"]), id: z.string() })
     .meta({ id: "DeploymentTarget" });
+/** The connectable channel kinds. The single source for both the request
+ *  (`DeploymentIn.kind`) and the response (`DeploymentOut.kind`); the API derives
+ *  its accepted-kinds set from these options, so the enum is the discoverable list. */
+export const DeploymentKind = z
+    .enum([
+    "whatsapp",
+    "telegram",
+    "slack",
+    "discord",
+    "sms",
+    "voice",
+    "email",
+    "mcp",
+    "web",
+])
+    .meta({ id: "DeploymentKind" });
 export const DeploymentOut = z
     .object({
     id: z.string(),
     target: DeploymentTarget,
-    kind: z.string(),
+    kind: DeploymentKind,
     address: z.string().nullable(),
     provider: z.string().nullable(),
     provider_metadata: z.record(z.string(), z.unknown()).optional(),
     /** Names of the encrypted secret fields that are set (values never returned). */
     secret_keys: z.array(z.string()).optional(),
+    /** The connectable MCP endpoint — present only for `kind: "mcp"`. Paste into
+     *  Claude / ChatGPT as the server URL; survives a later GET, not just create. */
+    mcp_url: z.string().optional(),
+    /** The shareable hosted-page URL — present only for `kind: "web"`. Open in a
+     *  browser to chat with the agent; survives a later GET, not just create. */
+    page_url: z.string().optional(),
     status: z.string(),
     created_at: z.string().nullable(),
 })
@@ -49,6 +71,8 @@ export const DeploymentListOut = pageOut(DeploymentOut, "DeploymentListOut");
  * - whatsapp `start_token`: `start_token`, `prefilled_message`, `deep_link` (wa.me link).
  * - slack `provision`/`oauth_install`: `install_url`, `state`, optional `slack_app_id`.
  * - email `provision`: no extras (plain `DeploymentOut`).
+ * - mcp: `mcp_url` (on the base `DeploymentOut`, so it also survives a GET).
+ * - web: `page_url` (on the base `DeploymentOut`, so it also survives a GET).
  * All are optional — which appear depends on the kind + setup mode.
  */
 export const DeploymentCreatedOut = DeploymentOut.extend({
@@ -65,7 +89,7 @@ export const DeploymentIn = z
     /** Who the deployment binds: a `smith` (fixed) or an `agent` (mints a smith
      *  per inbound sender). A smith token may only target its own smith. */
     target: DeploymentTarget,
-    kind: z.string(),
+    kind: DeploymentKind,
     address: z.string().nullish(),
     provider: z.string().nullish(),
     provider_metadata: z.record(z.string(), z.unknown()).optional(),

package/dist/zod/tenant.js

@@ -67,6 +67,32 @@ export const WebhookPatch = z
     active: z.boolean().nullish(),
 })
     .meta({ id: "WebhookPatch" });
+/** One persisted delivery attempt record for a webhook — the audit trail behind
+ *  durable, retried delivery. `status` is `pending` | `succeeded` | `dead`. */
+export const WebhookDeliveryOut = z
+    .object({
+    id: z.string(),
+    event_id: z.string(),
+    event_type: z.string(),
+    url: z.string(),
+    status: z.string(),
+    attempts: z.number(),
+    last_status: z.number().nullable(),
+    last_error: z.string(),
+    next_attempt_at: z.string().nullable(),
+    delivered_at: z.string().nullable(),
+    created_at: z.string().nullable(),
+})
+    .meta({ id: "WebhookDeliveryOut" });
+export const WebhookDeliveryListOut = pageOut(WebhookDeliveryOut, "WebhookDeliveryListOut");
+/** The redeliver ack — the outcome of the forced re-attempt. */
+export const WebhookRedeliverOut = z
+    .object({
+    delivery_id: z.string(),
+    delivered: z.boolean(),
+    status: z.number().nullable(),
+})
+    .meta({ id: "WebhookRedeliverOut" });
 // ── Tokens (mint / list / revoke RS256 JWTs) ─────────────────────────────────
 /** A minted-token *summary* — the list/listing shape. The secret `token` is
  *  NEVER echoed here; it only appears in {@link MintedTokenOut} on create. */
@@ -184,6 +210,7 @@ export const ProviderOut = z
     token_uri: z.string().nullable(),
     scopes_allowed: z.array(z.string()),
     refresh_webhook: z.string().nullable(),
+    authorize_url: z.string().nullable(),
     has_client_secret: z.boolean(),
 })
     .meta({ id: "ProviderOut" });
@@ -204,8 +231,34 @@ export const ProviderIn = z
     token_uri: z.string().nullish(),
     scopes_allowed: z.array(z.string()).default([]),
     refresh_webhook: z.string().nullish(),
+    /** Tenant-hosted connector consent page (#123): the connector OAuth
+     *  authorize endpoint redirects the end-user here (`?request_id=…`)
+     *  instead of rendering the built-in connect-token page. */
+    authorize_url: z.string().nullish(),
 })
     .meta({ id: "ProviderIn" });
+// ── Delegated connector consent (connector OAuth, #123) ─────────────────────
+/** Render data for a tenant-hosted consent page: the pending authorize request
+ *  stashed by `GET /oauth/authorize` when the tenant's provider registers an
+ *  `authorize_url`. */
+export const AuthorizeRequestOut = z
+    .object({
+    client_name: z.string(),
+    target_name: z.string(),
+    tenant: z.string(),
+    resource: z.string(),
+    deployment_id: z.string(),
+})
+    .meta({ id: "AuthorizeRequestOut" });
+/** Complete the delegated grant: the tenant asserts (server-to-server) which
+ *  smith the end-user authorized. */
+export const AuthorizeCompleteIn = z
+    .object({ smith_id: z.string() })
+    .meta({ id: "AuthorizeCompleteIn" });
+/** Where the tenant 302s the browser after completing or declining. */
+export const AuthorizeRedirectOut = z
+    .object({ redirect_url: z.string() })
+    .meta({ id: "AuthorizeRedirectOut" });
 // ── Hosted-tool catalog ──────────────────────────────────────────────────────
 /** One tool hosted by Ingram Cloud that the catalog advertises. */
 export const HostedToolOut = z

package/package.json

@@ -1,12 +1,23 @@
 {
 	"name": "@ingram-cloud/sdk",
-	"version": "1.0.0",
+	"version": "1.2.0",
 	"description": "Typed wire contract + management-plane client for the Ingram Cloud API: Zod schemas to validate request/response bodies, TypeScript types for the JSON you read back, SSE/webhook event types, and a typed REST client.",
 	"license": "MIT",
 	"type": "module",
 	"homepage": "https://cloud.ingram.tech",
-	"keywords": ["ingram-cloud", "ingram", "sdk", "api", "wire", "zod", "openapi"],
-	"files": ["ts", "dist"],
+	"keywords": [
+		"ingram-cloud",
+		"ingram",
+		"sdk",
+		"api",
+		"wire",
+		"zod",
+		"openapi"
+	],
+	"files": [
+		"ts",
+		"dist"
+	],
 	"publishConfig": {
 		"access": "public"
 	},
@@ -45,10 +56,10 @@
 		"prepublishOnly": "bun run build"
 	},
 	"devDependencies": {
-		"@ingram-tech/oxlint-config": "^0.2.1",
-		"oxfmt": "^0.57.0",
-		"oxlint": "^1.70.0",
-		"typescript": "^6.0.0"
+		"@ingram-tech/oxlint-config": "^0.2.2",
+		"oxfmt": "^0.58.0",
+		"oxlint": "^1.73.0",
+		"typescript": "^6"
 	},
 	"dependencies": {
 		"zod": "^4.4.3"

package/ts/client.ts

@@ -29,6 +29,7 @@ import type {
 	ICAgent,
 	ICAgentVersion,
 	ICApproval,
+	ICAuthorizeRequest,
 	ICBudget,
 	ICBudgetStatus,
 	ICCatalogEntry,
@@ -63,11 +64,13 @@ import type {
 	ICUiResource,
 	ICUsage,
 	ICUsageBreakdown,
+	ICUsageEvent,
 	ICVectorStore,
 	ICVectorStoreFile,
 	ICVectorStoreFileBatch,
 	ICVectorStoreSearchPage,
 	ICWebhook,
+	ICWebhookDelivery,
 	ICWhatsAppConfig,
 	ICWorkingMemory,
 } from "./responses.js";
@@ -110,6 +113,8 @@ import type { RestoreIn } from "./zod/smith-revisions.js";
 import type { SmithCreate, SmithPatch } from "./zod/smiths.js";
 import type { TelegramBotIn } from "./zod/telegram.js";
 import type {
+	AuthorizeCompleteIn,
+	AuthorizeRedirectOut,
 	HostedToolOut,
 	ModelKeyConfiguredOut,
 	ModelKeyIn,
@@ -119,6 +124,7 @@ import type {
 	WebhookCreateOut,
 	WebhookIn,
 	WebhookPatch,
+	WebhookRedeliverOut,
 } from "./zod/tenant.js";
 import type { WhatsAppConfigIn } from "./zod/whatsapp.js";
 
@@ -811,6 +817,18 @@ export class IngramCloud {
 			},
 			opts?: RequestOptions,
 		) => this.json<ICUsageBreakdown>("GET", "/usage", { ...opts, query }),
+		/** The raw billable-usage event ledger (keyset-paginated, newest first) — the
+		 *  per-event rows the breakdown aggregates. */
+		events: (
+			query?: PageOpts & {
+				smith_id?: string;
+				meter?: string;
+				customer_id?: string;
+				from?: string;
+				to?: string;
+			},
+			opts?: RequestOptions,
+		) => this.page<ICUsageEvent>("/usage/events", query, opts),
 	};
 
 	// ── Files (the OpenAI Files API) ─────────────────────────────────────────
@@ -1022,6 +1040,20 @@ export class IngramCloud {
 					`/tenant/webhooks/${enc(wid)}/test`,
 					opts,
 				),
+			/** The persisted delivery attempts for a webhook (durable retry audit trail). */
+			deliveries: (wid: string, query?: PageOpts, opts?: RequestOptions) =>
+				this.page<ICWebhookDelivery>(
+					`/tenant/webhooks/${enc(wid)}/deliveries`,
+					query,
+					opts,
+				),
+			/** Force a fresh delivery attempt for one record (e.g. after the endpoint recovers). */
+			redeliver: (wid: string, did: string, opts?: RequestOptions) =>
+				this.json<z.infer<typeof WebhookRedeliverOut>>(
+					"POST",
+					`/tenant/webhooks/${enc(wid)}/deliveries/${enc(did)}/redeliver`,
+					opts,
+				),
 		},
 
 		providers: {
@@ -1146,6 +1178,38 @@ export class IngramCloud {
 		},
 	};
 
+	// ── Delegated connector consent (connector OAuth, #123) ─────────────────
+	// Tenant-admin token. The tenant's hosted consent page (the provider's
+	// `authorize_url`) reads the pending request, then completes or declines it
+	// server-to-server; the returned `redirect_url` is where to 302 the browser.
+
+	readonly oauth = {
+		authorizeRequests: {
+			get: (requestId: string, opts?: RequestOptions) =>
+				this.json<ICAuthorizeRequest>(
+					"GET",
+					`/oauth/authorize-requests/${enc(requestId)}`,
+					opts,
+				),
+			complete: (
+				requestId: string,
+				body: z.input<typeof AuthorizeCompleteIn>,
+				opts?: RequestOptions,
+			) =>
+				this.json<z.infer<typeof AuthorizeRedirectOut>>(
+					"POST",
+					`/oauth/authorize-requests/${enc(requestId)}/complete`,
+					{ ...opts, body },
+				),
+			decline: (requestId: string, opts?: RequestOptions) =>
+				this.json<z.infer<typeof AuthorizeRedirectOut>>(
+					"POST",
+					`/oauth/authorize-requests/${enc(requestId)}/decline`,
+					opts,
+				),
+		},
+	};
+
 	// ── Organization (org token: projects + billing) ────────────────────────
 
 	readonly organization = {

package/ts/responses.ts

@@ -52,6 +52,7 @@ export type {
 	ICTrace,
 	ICTraceDetail,
 	ICUsageBreakdown,
+	ICUsageEvent,
 } from "./zod/observability.js";
 export type { ICProject } from "./zod/projects.js";
 export type { ICRun, ICRunUsage, ICInputMessage, ICRunEvent } from "./zod/runs.js";
@@ -63,6 +64,7 @@ export type { ICTelegramBot } from "./zod/telegram.js";
 export type {
 	ICEvent,
 	ICWebhook,
+	ICWebhookDelivery,
 	ICToken,
 	ICMintedToken,
 	ICUsage,
@@ -71,6 +73,7 @@ export type {
 	ICModelCatalog,
 	ICModelKey,
 	ICProvider,
+	ICAuthorizeRequest,
 } from "./zod/tenant.js";
 export type { ICWhatsAppConfig } from "./zod/whatsapp.js";
 export type {

package/ts/zod/deployments.ts

@@ -29,16 +29,39 @@ export const DeploymentTarget = z
 	.object({ type: z.enum(["smith", "agent"]), id: z.string() })
 	.meta({ id: "DeploymentTarget" });
 
+/** The connectable channel kinds. The single source for both the request
+ *  (`DeploymentIn.kind`) and the response (`DeploymentOut.kind`); the API derives
+ *  its accepted-kinds set from these options, so the enum is the discoverable list. */
+export const DeploymentKind = z
+	.enum([
+		"whatsapp",
+		"telegram",
+		"slack",
+		"discord",
+		"sms",
+		"voice",
+		"email",
+		"mcp",
+		"web",
+	])
+	.meta({ id: "DeploymentKind" });
+
 export const DeploymentOut = z
 	.object({
 		id: z.string(),
 		target: DeploymentTarget,
-		kind: z.string(),
+		kind: DeploymentKind,
 		address: z.string().nullable(),
 		provider: z.string().nullable(),
 		provider_metadata: z.record(z.string(), z.unknown()).optional(),
 		/** Names of the encrypted secret fields that are set (values never returned). */
 		secret_keys: z.array(z.string()).optional(),
+		/** The connectable MCP endpoint — present only for `kind: "mcp"`. Paste into
+		 *  Claude / ChatGPT as the server URL; survives a later GET, not just create. */
+		mcp_url: z.string().optional(),
+		/** The shareable hosted-page URL — present only for `kind: "web"`. Open in a
+		 *  browser to chat with the agent; survives a later GET, not just create. */
+		page_url: z.string().optional(),
 		status: z.string(),
 		created_at: z.string().nullable(),
 	})
@@ -53,6 +76,8 @@ export const DeploymentListOut = pageOut(DeploymentOut, "DeploymentListOut");
  * - whatsapp `start_token`: `start_token`, `prefilled_message`, `deep_link` (wa.me link).
  * - slack `provision`/`oauth_install`: `install_url`, `state`, optional `slack_app_id`.
  * - email `provision`: no extras (plain `DeploymentOut`).
+ * - mcp: `mcp_url` (on the base `DeploymentOut`, so it also survives a GET).
+ * - web: `page_url` (on the base `DeploymentOut`, so it also survives a GET).
  * All are optional — which appear depends on the kind + setup mode.
  */
 export const DeploymentCreatedOut = DeploymentOut.extend({
@@ -71,7 +96,7 @@ export const DeploymentIn = z
 		/** Who the deployment binds: a `smith` (fixed) or an `agent` (mints a smith
 		 *  per inbound sender). A smith token may only target its own smith. */
 		target: DeploymentTarget,
-		kind: z.string(),
+		kind: DeploymentKind,
 		address: z.string().nullish(),
 		provider: z.string().nullish(),
 		provider_metadata: z.record(z.string(), z.unknown()).optional(),

package/ts/zod/observability.ts

@@ -153,3 +153,4 @@ export type ICSpanNode = z.infer<typeof SpanNodeOut>;
 export type ICTrace = z.infer<typeof TraceOut>;
 export type ICTraceDetail = z.infer<typeof TraceDetailOut>;
 export type ICUsageBreakdown = z.infer<typeof UsageBreakdownOut>;
+export type ICUsageEvent = z.infer<typeof UsageEventOut>;

package/ts/zod/tenant.ts

@@ -78,6 +78,35 @@ export const WebhookPatch = z
 	})
 	.meta({ id: "WebhookPatch" });
 
+/** One persisted delivery attempt record for a webhook — the audit trail behind
+ *  durable, retried delivery. `status` is `pending` | `succeeded` | `dead`. */
+export const WebhookDeliveryOut = z
+	.object({
+		id: z.string(),
+		event_id: z.string(),
+		event_type: z.string(),
+		url: z.string(),
+		status: z.string(),
+		attempts: z.number(),
+		last_status: z.number().nullable(),
+		last_error: z.string(),
+		next_attempt_at: z.string().nullable(),
+		delivered_at: z.string().nullable(),
+		created_at: z.string().nullable(),
+	})
+	.meta({ id: "WebhookDeliveryOut" });
+
+export const WebhookDeliveryListOut = pageOut(WebhookDeliveryOut, "WebhookDeliveryListOut");
+
+/** The redeliver ack — the outcome of the forced re-attempt. */
+export const WebhookRedeliverOut = z
+	.object({
+		delivery_id: z.string(),
+		delivered: z.boolean(),
+		status: z.number().nullable(),
+	})
+	.meta({ id: "WebhookRedeliverOut" });
+
 // ── Tokens (mint / list / revoke RS256 JWTs) ─────────────────────────────────
 
 /** A minted-token *summary* — the list/listing shape. The secret `token` is
@@ -213,6 +242,7 @@ export const ProviderOut = z
 		token_uri: z.string().nullable(),
 		scopes_allowed: z.array(z.string()),
 		refresh_webhook: z.string().nullable(),
+		authorize_url: z.string().nullable(),
 		has_client_secret: z.boolean(),
 	})
 	.meta({ id: "ProviderOut" });
@@ -236,9 +266,39 @@ export const ProviderIn = z
 		token_uri: z.string().nullish(),
 		scopes_allowed: z.array(z.string()).default([]),
 		refresh_webhook: z.string().nullish(),
+		/** Tenant-hosted connector consent page (#123): the connector OAuth
+		 *  authorize endpoint redirects the end-user here (`?request_id=…`)
+		 *  instead of rendering the built-in connect-token page. */
+		authorize_url: z.string().nullish(),
 	})
 	.meta({ id: "ProviderIn" });
 
+// ── Delegated connector consent (connector OAuth, #123) ─────────────────────
+
+/** Render data for a tenant-hosted consent page: the pending authorize request
+ *  stashed by `GET /oauth/authorize` when the tenant's provider registers an
+ *  `authorize_url`. */
+export const AuthorizeRequestOut = z
+	.object({
+		client_name: z.string(),
+		target_name: z.string(),
+		tenant: z.string(),
+		resource: z.string(),
+		deployment_id: z.string(),
+	})
+	.meta({ id: "AuthorizeRequestOut" });
+
+/** Complete the delegated grant: the tenant asserts (server-to-server) which
+ *  smith the end-user authorized. */
+export const AuthorizeCompleteIn = z
+	.object({ smith_id: z.string() })
+	.meta({ id: "AuthorizeCompleteIn" });
+
+/** Where the tenant 302s the browser after completing or declining. */
+export const AuthorizeRedirectOut = z
+	.object({ redirect_url: z.string() })
+	.meta({ id: "AuthorizeRedirectOut" });
+
 // ── Hosted-tool catalog ──────────────────────────────────────────────────────
 
 /** One tool hosted by Ingram Cloud that the catalog advertises. */
@@ -257,6 +317,7 @@ export const HostedToolsListOut = z
 
 export type ICEvent = z.infer<typeof EventOut>;
 export type ICWebhook = z.infer<typeof WebhookOut>;
+export type ICWebhookDelivery = z.infer<typeof WebhookDeliveryOut>;
 export type ICToken = z.infer<typeof TokenOut>;
 export type ICMintedToken = z.infer<typeof MintedTokenOut>;
 export type ICUsage = z.infer<typeof UsageOut>;
@@ -265,3 +326,4 @@ export type ICModelProvider = z.infer<typeof ModelProviderOut>;
 export type ICModelCatalog = z.infer<typeof ModelsListOut>;
 export type ICModelKey = z.infer<typeof ModelKeyOut>;
 export type ICProvider = z.infer<typeof ProviderOut>;
+export type ICAuthorizeRequest = z.infer<typeof AuthorizeRequestOut>;