@introspection-sdk/introspection-browser 0.5.5 → 0.5.7

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> @introspection-sdk/introspection-browser@0.5.5 build /home/runner/work/introspection-js-sdk/introspection-js-sdk/packages/introspection-browser
+> @introspection-sdk/introspection-browser@0.5.7 build /home/runner/work/introspection-js-sdk/introspection-js-sdk/packages/introspection-browser
 > tsc
 

package/README.md

@@ -38,30 +38,42 @@ single-page app **create and stream Introspection tasks directly from the
 browser, with no API key in JavaScript**. Authentication is the standard B2B2C
 flow (see the [`sample-auth`](../../examples/apps/sample-auth) example):
 
+**The browser talks only to the Data Plane.** Runtime resolution is a Control
+Plane call and stays on your backend, so the CP never has to serve CORS to
+customer web origins.
+
 1. The app's **own backend ("broker")** mints an Introspection access token —
    via RFC 8693 token-exchange of the partner IdP token, a PKCE
    `authorization_code`, or `client_credentials`. The IdP secret never leaves
-   the backend.
-2. `client.runtimes(name).run()` uses that token at the Control Plane to
-   resolve a runtime and mint a short-lived runner token.
-3. The returned runner talks directly to the selected Data Plane endpoint for
-   tasks, files, conversations, and shares.
+   the backend. The backend returns **`{ token, runtimeId, dpUrl }`**: it
+   resolves the runtime id server-side (e.g. with the Node SDK's
+   `client.runtimes.resolveByName("support-agent")`) and supplies the Data
+   Plane URL, so the SPA needs no Introspection config of its own.
+2. `client.connect()` redeems the token at the **Data Plane**
+   `POST /v1/oauth/exchange` for the HttpOnly `intro_dp_session` cookie.
+3. `client.tasks.start({ runtime_id })` and friends ride that cookie against
+   the Data Plane for tasks, files, conversations, and shares.
 
 ```typescript
 import { IntrospectionApiClient } from "@introspection-sdk/introspection-browser/api";
 
+// Your backend returns { token, runtimeId, dpUrl }: it mints the access token,
+// resolves the runtime id, and supplies the DP URL — so the browser never
+// calls the CP and carries no Introspection config of its own.
+const { token, runtimeId, dpUrl } = await fetch(
+  "/api/introspection/session",
+).then((r) => r.json());
+
 const client = new IntrospectionApiClient({
-  cpUrl: "https://api.introspection.dev",
-  // your backend returns a fresh Introspection access token
-  getToken: () => fetch("/api/introspection/token").then((r) => r.text()),
+  dpUrl,
+  getToken: () => token,
 });
 
-const runner = await client.runtimes("support-agent").run({
-  identity: { user_id: "u_42" },
-});
+await client.connect(); // -> intro_dp_session cookie
 
-const run = await runner.tasks.start({
+const run = await client.tasks.start({
   prompt: "Summarize my latest order",
+  runtime_id: runtimeId,
   idle_timeout_seconds: 120, // idle window before the sandbox is torn down
 });
 
@@ -70,62 +82,43 @@ for await (const ev of run.stream()) {
 }
 ```
 
-`runner.tasks` exposes the full CRUD surface (`create` / `start` / `get` /
+`client.tasks` exposes the full CRUD surface (`create` / `start` / `get` /
 `list` / `update` / `delete` / `archive` / `unarchive`) plus per-run streaming
 (`run.stream()`, `run.text()`, `run.cancel()`).
 
 `create` and `start` accept **`idle_timeout_seconds`** (`number`) to override
 the interactive idle window before the sandbox is torn down. `0` tears it down
 as soon as it's provisioned; omit to use the deployment default. Clamped to the
-task timeout.
-
-The older cookie-session path is still available for apps that already know a
-Data Plane URL:
-
-```typescript
-const client = new IntrospectionApiClient({
-  dpUrl: "https://dp.us.introspection.dev",
-  getToken: () => fetch("/api/introspection/token").then((r) => r.text()),
-});
-
-await client.connect(); // -> intro_dp_session cookie
-await client.tasks.start({
-  prompt: "Summarize my latest order",
-  runtime_id: "019ed295-5d76-7432-863b-f9327af50221",
-});
-```
-
-For new runtime-backed browser apps, prefer
-`client.runtimes("support-agent").run()` so the browser follows the same
-runtime resolution flow as the Node SDK and does not carry runtime ids.
+task timeout. When no `runtime_id` is supplied, pass `agent_name` to select a
+named recipe agent instead.
 
 ## Files and conversations
 
-The same runner session also reaches `/v1/files` and (read-only)
-`/v1/conversations` using the CP-minted runner token:
+The same cookie session also reaches `/v1/files` and (read-only)
+`/v1/conversations` on the Data Plane:
 
 ```typescript
 // Files — CRUD + upload/download, all identity-scoped
-await runner.files.upload({ file: new Blob(["hi"]), name: "hi.txt" });
-const page = await runner.files.list();
-const bytes = await runner.files.download(page.records[0].id);
+await client.files.upload({ file: new Blob(["hi"]), name: "hi.txt" });
+const page = await client.files.list();
+const bytes = await client.files.download(page.records[0].id);
 
 // Conversations — read-only projection over the telemetry store
-for await (const summary of runner.conversations.list()) {
+for await (const summary of client.conversations.list()) {
   console.log(summary.conversation_id);
 }
 // Resolve the latest turn of a conversation (Responses-API shape)
-const turn = await runner.conversations.retrieve(conversationId);
+const turn = await client.conversations.retrieve(conversationId);
 console.log(turn?.output_messages);
 ```
 
-`runner.files` mirrors the Node SDK's `FilesApi` (`list` / `upload` /
+`client.files` mirrors the Node SDK's `FilesApi` (`list` / `upload` /
 `createText` / `get` / `update` / `delete` / `download` / `downloadStream`,
-plus `files.versions`). `runner.conversations` mirrors `ConversationsApi`
+plus `files.versions`). `client.conversations` mirrors `ConversationsApi`
 (`list`, `retrieve`, and `conversations.items.list()` / `.get()`). Both `list`
 helpers return a `Paginator` — `await` it for the first page or `for await` it
 to auto-page.
 
-> **CORS:** the Control Plane must allow the SPA origin for runtime resolution,
-> and each selected Data Plane must allow the origin for runner task/file/
-> conversation calls.
+> **CORS:** the browser only calls the Data Plane, so just the selected Data
+> Plane needs to allow the SPA origin. The Control Plane never receives browser
+> requests — runtime resolution happens on your backend.

package/dist/api/client.d.ts

@@ -2,17 +2,22 @@
  * Browser-side Introspection API client.
  *
  * Lets a single-page app create and stream Introspection tasks directly
- * from the browser, with no API key in JavaScript. The auth boundary:
+ * from the browser, with no API key in JavaScript. The browser talks only
+ * to the Data Plane — runtime resolution and any other Control Plane work
+ * stays on the app's backend, so the CP never needs to serve CORS to
+ * customer web origins. The auth boundary:
  *
- *   1. The SPA's own backend ("broker") mints an Introspection access
- *      token — via RFC 8693 token-exchange of the partner IdP token, a
- *      PKCE `authorization_code`, or `client_credentials`. The IdP
- *      secret never leaves the backend. The SPA fetches that token
- *      through the `getToken` callback.
+ *   1. The SPA's own backend ("broker") mints a short-lived Introspection
+ *      access token — via RFC 8693 token-exchange of the partner IdP
+ *      token, a PKCE `authorization_code`, or `client_credentials` (the
+ *      IdP secret never leaves the backend) — and, when a specific runtime
+ *      is needed, resolves its `runtime_id` server-side. The SPA fetches
+ *      the token through the `getToken` callback.
  *   2. `connect()` redeems the token at the DP `POST /v1/oauth/exchange`
  *      for the HttpOnly `intro_dp_session` cookie.
  *   3. Every subsequent call rides that cookie (`credentials: "include"`)
- *      — `client.tasks.start(...)`, `.get(...)`, run streaming, etc.
+ *      — `client.tasks.start({ runtime_id })`, `.get(...)`, run streaming,
+ *      etc.
  *
  * When the session cookie expires, an in-flight request gets a 401, and
  * the client transparently re-runs `getToken` + the DP exchange once
@@ -20,21 +25,13 @@
  */
 import { ConversationsClient, FilesClient, SharesClient } from "@introspection-sdk/http";
 import { TasksClient } from "./tasks.js";
-import { type BrowserRuntimeHandleFactory, type BrowserRuntimesClient } from "./runtimes.js";
 export interface IntrospectionApiClientOptions {
-    /**
-     * Control Plane REST base URL. Used by `client.runtimes(name).run()` to
-     * resolve runtimes and mint runner specs. Defaults to
-     * `https://api.introspection.dev`.
-     */
-    cpUrl?: string;
     /**
      * Data Plane REST base URL for the cookie-session APIs (`connect()` and
-     * top-level `client.tasks` / `client.files` / `client.conversations` /
-     * `client.shares`). Runner APIs use the DP endpoint returned by CP and do
-     * not require this option.
+     * `client.tasks` / `client.files` / `client.conversations` /
+     * `client.shares`). Required — the browser only talks to the DP.
      */
-    dpUrl?: string;
+    dpUrl: string;
     /**
      * Returns a fresh Introspection access token from the app's broker
      * (its own backend). Called on `connect()` and again whenever the DP
@@ -50,13 +47,7 @@ export interface IntrospectionApiClientOptions {
 }
 export declare class IntrospectionApiClient {
     private readonly opts;
-    /**
-     * CRUD on CP `/v1/runtimes` and the `(idOrName) => RuntimeHandle` factory.
-     * Call as `client.runtimes("customer-agent").run()`.
-     */
-    readonly runtimes: BrowserRuntimesClient & BrowserRuntimeHandleFactory;
     private readonly fetchImpl;
-    private readonly cpHttp;
     private readonly cookieClients;
     constructor(opts: IntrospectionApiClientOptions);
     /** `/v1/tasks` operations bound to the DP session cookie. */
@@ -75,8 +66,5 @@ export declare class IntrospectionApiClient {
     private exchange;
     /** 401 recovery: re-exchange, reporting success so the call can retry. */
     private reexchange;
-    private requireCookieClient;
-    private requireDpUrl;
-    private requestFreshRunnerSpec;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,YAAY,EACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC3B,MAAM,eAAe,CAAC;AAWvB,MAAM,WAAW,6BAA6B;IAC5C;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C;AAED,qBAAa,sBAAsB;IAWrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAVjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,GAAG,2BAA2B,CAAC;IAEvE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;gBAExB,IAAI,EAAE,6BAA6B;IAoChE,6DAA6D;IAC7D,IAAI,KAAK,IAAI,WAAW,CAEvB;IAED,6DAA6D;IAC7D,IAAI,KAAK,IAAI,WAAW,CAEvB;IAED,4EAA4E;IAC5E,IAAI,aAAa,IAAI,mBAAmB,CAEvC;IAED,oEAAoE;IACpE,IAAI,MAAM,IAAI,YAAY,CAEzB;IAED;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAKhB,QAAQ;IAkBtB,0EAA0E;YAC5D,UAAU;IASxB,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,YAAY;YASN,sBAAsB;CAgBrC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,YAAY,EACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASzC,MAAM,WAAW,6BAA6B;IAC5C;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C;AAED,qBAAa,sBAAsB;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;gBAEjB,IAAI,EAAE,6BAA6B;IAwBhE,6DAA6D;IAC7D,IAAI,KAAK,IAAI,WAAW,CAEvB;IAED,6DAA6D;IAC7D,IAAI,KAAK,IAAI,WAAW,CAEvB;IAED,4EAA4E;IAC5E,IAAI,aAAa,IAAI,mBAAmB,CAEvC;IAED,oEAAoE;IACpE,IAAI,MAAM,IAAI,YAAY,CAEzB;IAED;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAIhB,QAAQ;IAiBtB,0EAA0E;YAC5D,UAAU;CAQzB"}

package/dist/api/client.js

@@ -2,35 +2,33 @@
  * Browser-side Introspection API client.
  *
  * Lets a single-page app create and stream Introspection tasks directly
- * from the browser, with no API key in JavaScript. The auth boundary:
+ * from the browser, with no API key in JavaScript. The browser talks only
+ * to the Data Plane — runtime resolution and any other Control Plane work
+ * stays on the app's backend, so the CP never needs to serve CORS to
+ * customer web origins. The auth boundary:
  *
- *   1. The SPA's own backend ("broker") mints an Introspection access
- *      token — via RFC 8693 token-exchange of the partner IdP token, a
- *      PKCE `authorization_code`, or `client_credentials`. The IdP
- *      secret never leaves the backend. The SPA fetches that token
- *      through the `getToken` callback.
+ *   1. The SPA's own backend ("broker") mints a short-lived Introspection
+ *      access token — via RFC 8693 token-exchange of the partner IdP
+ *      token, a PKCE `authorization_code`, or `client_credentials` (the
+ *      IdP secret never leaves the backend) — and, when a specific runtime
+ *      is needed, resolves its `runtime_id` server-side. The SPA fetches
+ *      the token through the `getToken` callback.
  *   2. `connect()` redeems the token at the DP `POST /v1/oauth/exchange`
  *      for the HttpOnly `intro_dp_session` cookie.
  *   3. Every subsequent call rides that cookie (`credentials: "include"`)
- *      — `client.tasks.start(...)`, `.get(...)`, run streaming, etc.
+ *      — `client.tasks.start({ runtime_id })`, `.get(...)`, run streaming,
+ *      etc.
  *
  * When the session cookie expires, an in-flight request gets a 401, and
  * the client transparently re-runs `getToken` + the DP exchange once
  * before retrying.
  */
-import { BrowserBearerHttpClient, BrowserHttpClient, stripTrailingSlash, toApiError, } from "./http.js";
+import { BrowserHttpClient, stripTrailingSlash, toApiError } from "./http.js";
 import { ConversationsClient, FilesClient, SharesClient, } from "@introspection-sdk/http";
 import { TasksClient } from "./tasks.js";
-import { attachBrowserRuntimes, } from "./runtimes.js";
 export class IntrospectionApiClient {
     opts;
-    /**
-     * CRUD on CP `/v1/runtimes` and the `(idOrName) => RuntimeHandle` factory.
-     * Call as `client.runtimes("customer-agent").run()`.
-     */
-    runtimes;
     fetchImpl;
-    cpHttp;
     cookieClients;
     constructor(opts) {
         this.opts = opts;
@@ -38,63 +36,48 @@ export class IntrospectionApiClient {
         if (!this.fetchImpl) {
             throw new Error("global fetch is unavailable; pass `fetch` or run in a modern browser");
         }
-        this.cpHttp = new BrowserBearerHttpClient({
-            apiUrl: opts.cpUrl ?? "https://api.introspection.dev",
-            token: opts.getToken,
-            additionalHeaders: opts.additionalHeaders,
-            fetch: opts.fetch,
-        });
-        this.runtimes = attachBrowserRuntimes(this.cpHttp, {
+        if (!opts.dpUrl) {
+            throw new Error("IntrospectionApiClient requires a dpUrl");
+        }
+        const http = new BrowserHttpClient({
+            apiUrl: opts.dpUrl,
             additionalHeaders: opts.additionalHeaders,
             fetch: opts.fetch,
-            requestFreshRunnerSpec: (source) => this.requestFreshRunnerSpec(source),
+            onUnauthorized: () => this.reexchange(),
         });
-        if (opts.dpUrl) {
-            const http = new BrowserHttpClient({
-                apiUrl: opts.dpUrl,
-                additionalHeaders: opts.additionalHeaders,
-                fetch: opts.fetch,
-                onUnauthorized: () => this.reexchange(),
-            });
-            this.cookieClients = {
-                tasks: new TasksClient(http),
-                files: new FilesClient(http),
-                conversations: new ConversationsClient(http),
-                shares: new SharesClient(http),
-            };
-        }
-        else {
-            this.cookieClients = null;
-        }
+        this.cookieClients = {
+            tasks: new TasksClient(http),
+            files: new FilesClient(http),
+            conversations: new ConversationsClient(http),
+            shares: new SharesClient(http),
+        };
     }
     /** `/v1/tasks` operations bound to the DP session cookie. */
     get tasks() {
-        return this.requireCookieClient("tasks");
+        return this.cookieClients.tasks;
     }
     /** `/v1/files` operations bound to the DP session cookie. */
     get files() {
-        return this.requireCookieClient("files");
+        return this.cookieClients.files;
     }
     /** Read-only `/v1/conversations` projection bound to the session cookie. */
     get conversations() {
-        return this.requireCookieClient("conversations");
+        return this.cookieClients.conversations;
     }
     /** `/v1/shares` read-sharing grants bound to the session cookie. */
     get shares() {
-        return this.requireCookieClient("shares");
+        return this.cookieClients.shares;
     }
     /**
      * Mint a token via `getToken` and redeem it at the DP for the
      * `intro_dp_session` cookie. Call once before issuing task requests.
      */
     async connect() {
-        this.requireDpUrl();
         await this.exchange();
     }
     async exchange() {
-        const dpUrl = this.requireDpUrl();
         const token = await this.opts.getToken();
-        const res = await this.fetchImpl(`${stripTrailingSlash(dpUrl)}/v1/oauth/exchange`, {
+        const res = await this.fetchImpl(`${stripTrailingSlash(this.opts.dpUrl)}/v1/oauth/exchange`, {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
@@ -116,31 +99,5 @@ export class IntrospectionApiClient {
             return false;
         }
     }
-    requireCookieClient(key) {
-        if (!this.cookieClients) {
-            throw new Error(`IntrospectionApiClient.${key} requires dpUrl; use client.runtimes(...).run() for runner-bound APIs or pass dpUrl for cookie-session APIs`);
-        }
-        return this.cookieClients[key];
-    }
-    requireDpUrl() {
-        if (!this.opts.dpUrl) {
-            throw new Error("IntrospectionApiClient.connect() requires dpUrl; use client.runtimes(...).run() for runner-bound APIs or pass dpUrl for cookie-session APIs");
-        }
-        return this.opts.dpUrl;
-    }
-    async requestFreshRunnerSpec(source) {
-        if (source.kind === "runtime") {
-            return this.cpHttp.request({
-                method: "POST",
-                path: `/v1/runtimes/${encodeURIComponent(source.id)}/run`,
-                body: source.options ?? {},
-            });
-        }
-        return this.cpHttp.request({
-            method: "POST",
-            path: `/v1/experiments/${encodeURIComponent(source.id)}/run`,
-            body: source.options ?? {},
-        });
-    }
 }
 //# sourceMappingURL=client.js.map

package/dist/api/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,YAAY,GACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,qBAAqB,GAGtB,MAAM,eAAe,CAAC;AAuCvB,MAAM,OAAO,sBAAsB;IAWJ;IAV7B;;;OAGG;IACM,QAAQ,CAAsD;IAEtD,SAAS,CAAe;IACxB,MAAM,CAA0B;IAChC,aAAa,CAAuB;IAErD,YAA6B,IAAmC;QAAnC,SAAI,GAAJ,IAAI,CAA+B;QAC9D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAuB,CAAC;YACxC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,+BAA+B;YACrD,KAAK,EAAE,IAAI,CAAC,QAAQ;YACpB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE;YACjD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,sBAAsB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;SACxE,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC;gBACjC,MAAM,EAAE,IAAI,CAAC,KAAK;gBAClB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,GAAG;gBACnB,KAAK,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC;gBAC5B,aAAa,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC;gBAC5C,MAAM,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC;aAC/B,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,6DAA6D;IAC7D,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,4EAA4E;IAC5E,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACnD,CAAC;IAED,oEAAoE;IACpE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAC9B,GAAG,kBAAkB,CAAC,KAAK,CAAC,oBAAoB,EAChD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/B,WAAW,EAAE,SAAS;SACvB,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAClE,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,mBAAmB,CACzB,GAAM;QAEN,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,6GAA6G,CAC3I,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,6IAA6I,CAC9I,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,MAA2B;QAE3B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAa;gBACrC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM;gBACzD,IAAI,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAa;YACrC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM;YAC5D,IAAI,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,YAAY,GACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA8BzC,MAAM,OAAO,sBAAsB;IAIJ;IAHZ,SAAS,CAAe;IACxB,aAAa,CAAgB;IAE9C,YAA6B,IAAmC;QAAnC,SAAI,GAAJ,IAAI,CAA+B;QAC9D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC;YACjC,MAAM,EAAE,IAAI,CAAC,KAAK;YAClB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG;YACnB,KAAK,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC;YAC5B,KAAK,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC;YAC5B,aAAa,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC;YAC5C,MAAM,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC;SAC/B,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;IAClC,CAAC;IAED,6DAA6D;IAC7D,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;IAClC,CAAC;IAED,4EAA4E;IAC5E,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;IAC1C,CAAC;IAED,oEAAoE;IACpE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAC9B,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAC1D;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/B,WAAW,EAAE,SAAS;SACvB,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAClE,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/api/http.d.ts

@@ -26,7 +26,6 @@ export interface BrowserHttpConfig {
      */
     onUnauthorized?: () => Promise<boolean>;
 }
-export type BrowserApiHttpClient = Pick<BaseHttpClient, "request" | "stream">;
 /**
  * Cookie-authenticated HTTP wrapper bound to one DP endpoint. Has no
  * opinion about which resource it serves — the caller picks the path.
@@ -34,26 +33,4 @@ export type BrowserApiHttpClient = Pick<BaseHttpClient, "request" | "stream">;
 export declare class BrowserHttpClient extends BaseHttpClient {
     constructor(cfg: BrowserHttpConfig);
 }
-export interface BrowserBearerHttpConfig {
-    /** REST base URL every request is prefixed with. */
-    apiUrl: string;
-    /** Bearer token, or a provider returning the latest token before each request. */
-    token: string | (() => string | Promise<string>);
-    /** Extra headers merged into every request. */
-    additionalHeaders?: Record<string, string>;
-    /** Custom `fetch` (for tests or non-standard runtimes). */
-    fetch?: typeof fetch;
-}
-/**
- * Bearer-authenticated browser HTTP wrapper. Used for CP runtime calls with
- * brokered access tokens and for DP runner calls with CP-minted runner tokens.
- */
-export declare class BrowserBearerHttpClient extends BaseHttpClient {
-    private readonly tokenBox;
-    private readonly getToken?;
-    constructor(cfg: BrowserBearerHttpConfig);
-    private refreshToken;
-    request<T>(opts: Parameters<BaseHttpClient["request"]>[0]): Promise<T>;
-    stream(opts: Parameters<BaseHttpClient["stream"]>[0]): Promise<Response>;
-}
 //# sourceMappingURL=http.d.ts.map

package/dist/api/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/api/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,UAAU,EACX,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC;AAE1C,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,QAAQ,CAAC,CAAC;AAE9E;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,cAAc;gBACvC,GAAG,EAAE,iBAAiB;CAYnC;AAED,MAAM,WAAW,uBAAuB;IACtC,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,cAAc;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAiC;gBAE/C,GAAG,EAAE,uBAAuB;YAiB1B,YAAY;IAKpB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAKtE,MAAM,CACV,IAAI,EAAE,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAC5C,OAAO,CAAC,QAAQ,CAAC;CAIrB"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/api/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,UAAU,EACX,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC;AAE1C,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACzC;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,cAAc;gBACvC,GAAG,EAAE,iBAAiB;CAYnC"}

package/dist/api/http.js

@@ -31,42 +31,4 @@ export class BrowserHttpClient extends BaseHttpClient {
         });
     }
 }
-/**
- * Bearer-authenticated browser HTTP wrapper. Used for CP runtime calls with
- * brokered access tokens and for DP runner calls with CP-minted runner tokens.
- */
-export class BrowserBearerHttpClient extends BaseHttpClient {
-    tokenBox;
-    getToken;
-    constructor(cfg) {
-        const tokenBox = { value: typeof cfg.token === "string" ? cfg.token : "" };
-        super({
-            apiUrl: cfg.apiUrl,
-            additionalHeaders: cfg.additionalHeaders,
-            fetch: cfg.fetch,
-            transport: {
-                authHeaders: () => {
-                    if (!tokenBox.value)
-                        return {};
-                    return { Authorization: `Bearer ${tokenBox.value}` };
-                },
-            },
-        });
-        this.tokenBox = tokenBox;
-        this.getToken = typeof cfg.token === "function" ? cfg.token : undefined;
-    }
-    async refreshToken() {
-        if (!this.getToken)
-            return;
-        this.tokenBox.value = await this.getToken();
-    }
-    async request(opts) {
-        await this.refreshToken();
-        return super.request(opts);
-    }
-    async stream(opts) {
-        await this.refreshToken();
-        return super.stream(opts);
-    }
-}
 //# sourceMappingURL=http.js.map

package/dist/api/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/api/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,UAAU,GACX,MAAM,yBAAyB,CAAC;AAEjC,4EAA4E;AAC5E,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC;AAmB1C;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,YAAY,GAAsB;QAChC,KAAK,CAAC;YACJ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE;gBACT,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;gBACvB,WAAW,EAAE,SAAS;gBACtB,cAAc,EAAE,GAAG,CAAC,cAAc;aACnC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAaD;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,cAAc;IACxC,QAAQ,CAAoB;IAC5B,QAAQ,CAAkC;IAE3D,YAAY,GAA4B;QACtC,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3E,KAAK,CAAC;YACJ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE;gBACT,WAAW,EAAE,GAA2B,EAAE;oBACxC,IAAI,CAAC,QAAQ,CAAC,KAAK;wBAAE,OAAO,EAAE,CAAC;oBAC/B,OAAO,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;gBACvD,CAAC;aACF;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,IAA8C;QAC7D,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,OAAO,CAAI,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAA6C;QAE7C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/api/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,UAAU,GACX,MAAM,yBAAyB,CAAC;AAEjC,4EAA4E;AAC5E,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC;AAiB1C;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,YAAY,GAAsB;QAChC,KAAK,CAAC;YACJ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE;gBACT,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;gBACvB,WAAW,EAAE,SAAS;gBACtB,cAAc,EAAE,GAAG,CAAC,cAAc;aACnC;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/api/index.d.ts

@@ -6,34 +6,40 @@
  * Separate from the package's default telemetry export so apps only pull
  * in what they use.
  *
+ * The browser talks only to the Data Plane. Resolving a runtime by name
+ * (a Control Plane call) stays on your backend, which hands the browser a
+ * short-lived access token plus the resolved `runtime_id`.
+ *
  * @example
  * ```typescript
  * import { IntrospectionApiClient } from "@introspection-sdk/introspection-browser/api";
  *
+ * // Your backend returns { token, runtimeId, dpUrl } — it mints the access
+ * // token, resolves the runtime id, and surfaces the DP URL (e.g. from the
+ * // Node SDK's serviceAccountToken response), so the browser never calls the CP.
+ * const { token, runtimeId, dpUrl } = await fetch(
+ *   "/api/introspection/session",
+ * ).then((r) => r.json());
+ *
  * const client = new IntrospectionApiClient({
- *   cpUrl: "https://api.introspection.dev",
- *   // your backend mints the Introspection access token (the session's
- *   // project is derived from its claims — no projectId option needed)
- *   getToken: () => fetch("/api/introspection/token").then((r) => r.text()),
+ *   dpUrl,
+ *   getToken: () => token,
  * });
  *
- * const runner = await client.runtimes("support-agent").run({
- *   identity: { user_id: "u_42" },
- * });
- * const run = await runner.tasks.start({
+ * await client.connect(); // -> intro_dp_session cookie
+ * const run = await client.tasks.start({
  *   prompt: "Summarize my latest order",
+ *   runtime_id: runtimeId,
  * });
  * for await (const ev of run.stream()) console.log(ev.event, ev.data);
  * ```
  */
 export { IntrospectionApiClient, type IntrospectionApiClientOptions, } from "./client.js";
-export { BrowserRunner, Runner, type BrowserRunnerOwner, type BrowserRunnerSource, } from "./runner.js";
-export { BrowserRuntimesClient, BrowserRuntimeHandle, attachBrowserRuntimes, isUuid, type BrowserRuntimeHandleFactory, type BrowserRuntimeRunRequestBody, } from "./runtimes.js";
 export { TasksClient, TaskRunsClient, RunHandle, type CreateTaskParams, type StartTaskParams, } from "./tasks.js";
 export { ConversationItemsClient, ConversationsClient, FileVersionsClient, FilesClient, SharesClient, type FileUploadBody, } from "@introspection-sdk/http";
-export { BrowserBearerHttpClient, BrowserHttpClient, type BrowserApiHttpClient, type BrowserBearerHttpConfig, type BrowserHttpConfig, } from "./http.js";
+export { BrowserHttpClient, type BrowserHttpConfig } from "./http.js";
 export { parseSse } from "./sse.js";
 export { Paginator, cursorPaginate, type PageSource, } from "@introspection-sdk/http";
-export type { Task, TaskRun, TaskStatus, TaskCreateResponse, TaskListParams, TaskUpdateParams, TaskRunCreateParams, TaskCancelResponse, RunIdentityInput, Paginated, SseEvent, File, FileType, FileListParams, FileUpdateParams, FileCreateTextParams, ListParams, ConversationSummary, ConversationItem, ConversationItemList, ConversationListParams, ConversationItemListParams, ConversationItemInclude, ConversationResponse, ResourceShare, ShareResourceType, ShareCreateParams, ShareListParams, Recipe, RunRequest, RunnerContext, RunnerDeployment, RunnerSpec, Runtime, RuntimeCreate, RuntimeListParams, RuntimeUpdate, } from "@introspection-sdk/types";
+export type { Task, TaskRun, TaskStatus, TaskCreateResponse, TaskListParams, TaskUpdateParams, TaskRunCreateParams, TaskCancelResponse, RunIdentityInput, Paginated, SseEvent, File, FileType, FileListParams, FileUpdateParams, FileCreateTextParams, ListParams, ConversationSummary, ConversationItem, ConversationItemList, ConversationListParams, ConversationItemListParams, ConversationItemInclude, ConversationResponse, ResourceShare, ShareResourceType, ShareCreateParams, ShareListParams, } from "@introspection-sdk/types";
 export { IntrospectionAPIError, AuthenticationError, InsufficientScopeError, NotFoundError, NetworkError, RunnerExpiredError, } from "@introspection-sdk/types";
 //# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,MAAM,EACN,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,EACN,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,GAClC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,EACX,cAAc,EACd,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EACL,SAAS,EACT,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EACV,IAAI,EACJ,OAAO,EACP,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,MAAM,EACN,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,YAAY,EACZ,kBAAkB,GACnB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,cAAc,EACd,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EACL,SAAS,EACT,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EACV,IAAI,EACJ,OAAO,EACP,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,YAAY,EACZ,kBAAkB,GACnB,MAAM,0BAA0B,CAAC"}

package/dist/api/index.js

@@ -6,32 +6,38 @@
  * Separate from the package's default telemetry export so apps only pull
  * in what they use.
  *
+ * The browser talks only to the Data Plane. Resolving a runtime by name
+ * (a Control Plane call) stays on your backend, which hands the browser a
+ * short-lived access token plus the resolved `runtime_id`.
+ *
  * @example
  * ```typescript
  * import { IntrospectionApiClient } from "@introspection-sdk/introspection-browser/api";
  *
+ * // Your backend returns { token, runtimeId, dpUrl } — it mints the access
+ * // token, resolves the runtime id, and surfaces the DP URL (e.g. from the
+ * // Node SDK's serviceAccountToken response), so the browser never calls the CP.
+ * const { token, runtimeId, dpUrl } = await fetch(
+ *   "/api/introspection/session",
+ * ).then((r) => r.json());
+ *
  * const client = new IntrospectionApiClient({
- *   cpUrl: "https://api.introspection.dev",
- *   // your backend mints the Introspection access token (the session's
- *   // project is derived from its claims — no projectId option needed)
- *   getToken: () => fetch("/api/introspection/token").then((r) => r.text()),
+ *   dpUrl,
+ *   getToken: () => token,
  * });
  *
- * const runner = await client.runtimes("support-agent").run({
- *   identity: { user_id: "u_42" },
- * });
- * const run = await runner.tasks.start({
+ * await client.connect(); // -> intro_dp_session cookie
+ * const run = await client.tasks.start({
  *   prompt: "Summarize my latest order",
+ *   runtime_id: runtimeId,
  * });
  * for await (const ev of run.stream()) console.log(ev.event, ev.data);
  * ```
  */
 export { IntrospectionApiClient, } from "./client.js";
-export { BrowserRunner, Runner, } from "./runner.js";
-export { BrowserRuntimesClient, BrowserRuntimeHandle, attachBrowserRuntimes, isUuid, } from "./runtimes.js";
 export { TasksClient, TaskRunsClient, RunHandle, } from "./tasks.js";
 export { ConversationItemsClient, ConversationsClient, FileVersionsClient, FilesClient, SharesClient, } from "@introspection-sdk/http";
-export { BrowserBearerHttpClient, BrowserHttpClient, } from "./http.js";
+export { BrowserHttpClient } from "./http.js";
 export { parseSse } from "./sse.js";
 export { Paginator, cursorPaginate, } from "@introspection-sdk/http";
 export { IntrospectionAPIError, AuthenticationError, InsufficientScopeError, NotFoundError, NetworkError, RunnerExpiredError, } from "@introspection-sdk/types";

package/dist/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,sBAAsB,GAEvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,MAAM,GAGP,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,GAGP,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,EACX,cAAc,EACd,SAAS,GAGV,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,YAAY,GAEb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,uBAAuB,EACvB,iBAAiB,GAIlB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EACL,SAAS,EACT,cAAc,GAEf,MAAM,yBAAyB,CAAC;AA0CjC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,YAAY,EACZ,kBAAkB,GACnB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EACL,sBAAsB,GAEvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,cAAc,EACd,SAAS,GAGV,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,YAAY,GAEb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAA0B,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EACL,SAAS,EACT,cAAc,GAEf,MAAM,yBAAyB,CAAC;AAiCjC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,YAAY,EACZ,kBAAkB,GACnB,MAAM,0BAA0B,CAAC"}