@m8tes/sdk 0.1.0-alpha.2 → 0.1.0-alpha.3

package/CHANGELOG.md

@@ -5,7 +5,9 @@ All notable changes to `@m8tes/sdk`.
 > **Release process** (mirrors `sdk/py`): every change to behaviour or public API
 > lands an entry under `## [Unreleased]` in the same commit. A RELEASE then bumps
 > `package.json` `version` (semver) and retitles that section. Entries are never
-> skipped — without one, a consumer cannot tell what changed. Publish via the `Publish @m8tes/sdk` workflow — never `npm publish` by
+> skipped — without one, a consumer cannot tell what changed. A version bump
+> merged to main publishes automatically (`Publish npm packages`); dry-run stays
+> on the package-specific workflow. Never `npm publish` by
 > hand (it does not rewrite the pnpm `workspace:` protocol).
 >
 > While the version is a `-alpha.N` prerelease, publish with dist-tag `alpha`.
@@ -13,8 +15,34 @@ All notable changes to `@m8tes/sdk`.
 
 ## [Unreleased]
 
+## [0.1.0-alpha.3] — 2026-08-19
+
+### Changed
+
+- **`runs.get` / `poll` / `wait` / `createAndWait` forward `user_id`.** Strict
+  multi-tenant mode requires `?user_id=` on every by-ID GET; `createAndWait`
+  reuses the create body's `user_id`, then falls back to the created run's
+  stamped `user_id` (agent-inherited scope). A wait-only `options.user_id` is
+  folded into the create body when params omit it; conflicting scopes are
+  rejected before POST. After create, poll prefers the API-stamped owner when
+  it differs from the request scope.
+- **`runs.cancel(id, { user_id })`** — same end-user scope as get (strict mode).
+- **`ApproveParams.remember` docs match persistence.** `remember: true` on allow
+  stores a cross-run always-allow policy (not run-only); deny+remember stays
+  run-scoped.
+
 ### Added
 
+- **`Usage.unlimited_runs`.** Mirrors `GET /api/v2/usage` so clients can tell a
+  bypassed meter from a soft over-limit.
+- **`Page.nextStartingAfter` / list envelope `next_starting_after`.** Cursor for the
+  next `starting_after` page when `hasMore` is true.
+- **`PermissionRequest.can_remember` / `remember_default` and
+  `PermissionPolicy.source`.** `remember_default: false` tells a client the
+  Always-allow control must start unticked (force-ask floor: spend, access,
+  destroy); `source` names the surface that minted a standing grant
+  (`"run_approval"` / `"api"`; null on legacy rows).
+
 - **`user_id` end-user scoping on agent and task sub-resource methods.**
   `agents.enableWebhook` / `disableWebhook` / `enableEmailInbox` /
   `disableEmailInbox`, `tasks.enableWebhook` / `disableWebhook`, and the full

package/dist/index.cjs

@@ -1298,12 +1298,14 @@ function createHttp(options = {}) {
 var Page = class {
   data;
   hasMore;
+  nextStartingAfter;
   /** Fetches the next page given a cursor. Absent on a terminal page. */
   fetchNext;
-  constructor(data, hasMore, fetchNext) {
+  constructor(data, hasMore, fetchNext, nextStartingAfter) {
     this.data = data;
     this.hasMore = hasMore;
     this.fetchNext = fetchNext;
+    this.nextStartingAfter = nextStartingAfter ?? null;
   }
   /**
    * Auto-paging: yields every item across every page.
@@ -1321,7 +1323,10 @@ var Page = class {
       yield* page.data;
       const last = page.data.at(-1);
       if (!page.hasMore || !last || !page.fetchNext) return;
-      const cursor = typeof last.id === "number" || typeof last.id === "string" ? last.id : typeof last.name === "string" ? last.name : void 0;
+      let cursor = page.nextStartingAfter === null || page.nextStartingAfter === void 0 ? void 0 : page.nextStartingAfter;
+      if (cursor === void 0) {
+        cursor = typeof last.id === "number" || typeof last.id === "string" ? last.id : typeof last.name === "string" ? last.name : void 0;
+      }
       if (cursor === void 0 || seen.has(cursor)) return;
       seen.add(cursor);
       page = await page.fetchNext(cursor);
@@ -1373,7 +1378,8 @@ function createAgentsResource(http) {
         return new Page(
           res?.data ?? [],
           res?.has_more ?? false,
-          (starting_after) => fetchPage({ ...p, starting_after })
+          (starting_after) => fetchPage({ ...p, starting_after }),
+          res?.next_starting_after
         );
       };
       return fetchPage({ ...params });
@@ -1418,7 +1424,7 @@ function createAppsResource(http) {
     const res = await http.request("GET", "/apps/", {
       query: toQuery({ user_id: params.user_id })
     });
-    return new Page(res?.data ?? [], res?.has_more ?? false);
+    return new Page(res?.data ?? [], res?.has_more ?? false, void 0, res?.next_starting_after);
   };
   return {
     list,
@@ -1468,7 +1474,8 @@ function pager(http, path) {
     return new Page(
       res?.data ?? [],
       res?.has_more ?? false,
-      (starting_after) => fetchPage({ ...p, starting_after })
+      (starting_after) => fetchPage({ ...p, starting_after }),
+      res?.next_starting_after
     );
   };
   return fetchPage;
@@ -1570,7 +1577,7 @@ function createModelsResource(http) {
   return {
     async list() {
       const res = await http.request("GET", "/models/");
-      return new Page(res?.data ?? [], res?.has_more ?? false);
+      return new Page(res?.data ?? [], res?.has_more ?? false, void 0, res?.next_starting_after);
     }
   };
 }
@@ -2038,12 +2045,15 @@ function createRunsResource(http) {
     return form;
   };
   const hasFiles = (p) => (p.files?.length ?? 0) > 0;
-  const deps = {
-    get: (runId, signal) => http.request("GET", `/runs/${seg(runId)}`, { signal }),
+  const pollDeps = (userId) => ({
+    get: (runId, signal) => http.request("GET", `/runs/${seg(runId)}`, {
+      query: toQuery({ user_id: userId }),
+      signal
+    }),
     permissions: async (runId, signal) => items(await http.request("GET", `/runs/${seg(runId)}/permissions`, { signal })),
     approve: (runId, params, signal) => http.request("POST", `/runs/${seg(runId)}/approve`, { body: { remember: false, ...params }, signal }),
     answer: (runId, params, signal) => http.request("POST", `/runs/${seg(runId)}/answer`, { body: params, signal })
-  };
+  });
   const createAsync = async (params) => {
     const headers = idempotencyHeaders(params.idempotencyKey);
     return hasFiles(params) ? http.request("POST", "/runs/with-files", { form: createForm(params, false), headers }) : http.request("POST", "/runs", { body: createBody(params, false), headers });
@@ -2061,18 +2071,26 @@ function createRunsResource(http) {
     createAsync,
     async createAndWait(params, options = {}) {
       if (options.signal?.aborted) throw new RunWaitAbortedError();
-      const started = await createAsync(params);
+      if (options.user_id != null && params.user_id != null && options.user_id !== params.user_id) {
+        throw new ValidationError(
+          `createAndWait: options.user_id (${JSON.stringify(options.user_id)}) conflicts with params.user_id (${JSON.stringify(params.user_id)}). Use one scope for create and poll.`,
+          { type: "invalid_request_error", code: 0, status: 0 }
+        );
+      }
+      const createParams = params.user_id == null && options.user_id != null ? { ...params, user_id: options.user_id } : params;
+      const started = await createAsync(createParams);
+      const userId = started.user_id ?? createParams.user_id ?? void 0;
       try {
-        return await waitForRun(deps, started.id, options);
+        return await waitForRun(pollDeps(userId), started.id, { ...options, user_id: userId });
       } catch (err) {
         throw withRunId(err, started.id);
       }
     },
-    poll(runId, options) {
-      return pollRun(deps, runId, options);
+    poll(runId, options = {}) {
+      return pollRun(pollDeps(options.user_id), runId, options);
     },
-    wait(runId, options) {
-      return waitForRun(deps, runId, options);
+    wait(runId, options = {}) {
+      return waitForRun(pollDeps(options.user_id), runId, options);
     },
     // `confirm` is a QUERY param and the route takes no body (verified against
     // fastapi/app/routers/v2/runs.py::retry_run), so send neither.
@@ -2094,8 +2112,10 @@ function createRunsResource(http) {
         options
       );
     },
-    get(runId) {
-      return http.request("GET", `/runs/${seg(runId)}`);
+    get(runId, params = {}) {
+      return http.request("GET", `/runs/${seg(runId)}`, {
+        query: toQuery({ user_id: params.user_id })
+      });
     },
     async list(params = {}) {
       const { agent_id, teammate_id, ...rest } = params;
@@ -2107,13 +2127,16 @@ function createRunsResource(http) {
         return new Page(
           res?.data ?? [],
           res?.has_more ?? false,
-          (starting_after) => fetchPage({ ...p, starting_after })
+          (starting_after) => fetchPage({ ...p, starting_after }),
+          res?.next_starting_after
         );
       };
       return fetchPage(q);
     },
-    cancel(runId) {
-      return http.request("POST", `/runs/${seg(runId)}/cancel`, { body: {} });
+    cancel(runId, params = {}) {
+      return http.request("POST", `/runs/${seg(runId)}/cancel`, {
+        query: toQuery({ user_id: params.user_id })
+      });
     },
     approve(runId, params) {
       return http.request("POST", `/runs/${seg(runId)}/approve`, {
@@ -2204,7 +2227,8 @@ function createTasksResource(http) {
         return new Page(
           res?.data ?? [],
           res?.has_more ?? false,
-          (starting_after) => fetchPage({ ...p, starting_after })
+          (starting_after) => fetchPage({ ...p, starting_after }),
+          res?.next_starting_after
         );
       };
       return fetchPage(q);
@@ -2307,7 +2331,7 @@ function createWebhooksResource(http) {
 }
 
 // src/index.ts
-var M8TES_SDK_VERSION = "0.1.0-alpha.2";
+var M8TES_SDK_VERSION = "0.1.0-alpha.3";
 var M8tes = class {
   runs;
   agents;