@miosa/sdk 1.2.1 → 1.2.3

package/dist/index.js

@@ -1,4 +1,4 @@
-import { randomUUID } from 'crypto';
+import { createHmac, timingSafeEqual, randomUUID } from 'crypto';
 import EventEmitter from 'events';
 
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
@@ -592,6 +592,13 @@ var Admin = class {
       model_id: modelId
     });
   }
+  /** POST /api/v1/admin/impersonate — returns {token, expires_at}. */
+  impersonate(externalUserId, options = {}) {
+    return this.http.post("/admin/impersonate", {
+      external_user_id: externalUserId,
+      ttl_sec: options.ttlSec ?? 3600
+    });
+  }
 };
 
 // src/resources/analytics.ts
@@ -674,6 +681,17 @@ var ApiKeys = class {
     });
     return unwrap2(data);
   }
+  /** POST /api/v1/api-keys/scoped — L2 delegation token bound to one external user. */
+  async createScoped(params) {
+    const body = stripUndefined2({
+      external_user_id: params.externalUserId,
+      scopes: params.scopes,
+      expires_at: params.expiresAt
+    });
+    return unwrap2(
+      await this.http.post("/api-keys/scoped", body)
+    );
+  }
   async delete(keyId) {
     await this.http.delete(`/api-keys/${keyId}`);
   }
@@ -3621,6 +3639,32 @@ function stripUndefined10(input) {
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
 }
+function dockerDeployMetadata(metadata) {
+  return {
+    ...metadata ?? {},
+    deployment_product: "docker_deploy"
+  };
+}
+function dockerDeployProduct(deployment) {
+  return deployment.deployment_product ?? deployment.metadata?.["deployment_product"];
+}
+function dockerDeployHostId(deployment) {
+  const metadataHost = deployment.metadata?.["docker_deploy_host_id"];
+  return deployment.docker_deploy_host_id ?? (typeof metadataHost === "string" ? metadataHost : null);
+}
+function addDoctorCheck(checks, name, ok, message, details) {
+  checks.push({ name, ok, message, ...details ? { details } : {} });
+}
+function hostHealthy(host) {
+  return Boolean(
+    host && host.status === "active" && host.appliance_status === "healthy"
+  );
+}
+function probeUrl(publicUrl, probePath) {
+  const url = new URL(publicUrl);
+  url.pathname = probePath.startsWith("/") ? probePath : `/${probePath}`;
+  return url.toString();
+}
 var DeploymentVersions = class {
   constructor(http, deploymentId) {
     this.http = http;
@@ -3803,6 +3847,125 @@ var Deployments = class {
     });
     return unwrap23(data);
   }
+  /**
+   * Create a deployment that runs on the workspace's dedicated Docker Deploy
+   * runtime. It uses the same /deployments API as MIOSA Deploy, but marks the
+   * deployment so the control plane attaches it to the workspace Docker host.
+   */
+  async createDockerDeploy(params) {
+    return this.create({
+      ...params,
+      metadata: dockerDeployMetadata(params.metadata)
+    });
+  }
+  /**
+   * Verify a Docker Deploy deployment before telling a user or agent it is
+   * live. Checks product markers, appliance host health, route metadata, and
+   * optionally probes the public URL.
+   */
+  async doctorDockerDeploy(deploymentId, params = {}) {
+    const checks = [];
+    const deployment = await this.get(deploymentId);
+    const metadata = deployment.metadata ?? {};
+    const product = dockerDeployProduct(deployment);
+    const hostId = dockerDeployHostId(deployment);
+    addDoctorCheck(
+      checks,
+      "deployment_product",
+      product === "docker_deploy",
+      product === "docker_deploy" ? "Deployment is marked for Docker Deploy." : `Expected deployment_product=docker_deploy, got ${String(product ?? "missing")}.`,
+      { deployment_product: product ?? null }
+    );
+    addDoctorCheck(
+      checks,
+      "docker_deploy_host_id",
+      Boolean(hostId),
+      hostId ? "Deployment has a Docker Deploy host id." : "Deployment has no docker_deploy_host_id.",
+      { docker_deploy_host_id: hostId }
+    );
+    let host;
+    if (hostId) {
+      try {
+        const rawHost = await this.http.get(
+          `/docker-deploy/hosts/${hostId}`
+        );
+        host = unwrap23(rawHost);
+        addDoctorCheck(
+          checks,
+          "docker_deploy_host_health",
+          hostHealthy(host),
+          hostHealthy(host) ? "Docker Deploy host is active and healthy." : `Docker Deploy host status=${host.status} appliance=${host.appliance_status}.`,
+          {
+            status: host.status,
+            appliance_status: host.appliance_status
+          }
+        );
+      } catch (error) {
+        addDoctorCheck(
+          checks,
+          "docker_deploy_host_health",
+          false,
+          error instanceof Error ? error.message : String(error)
+        );
+      }
+    }
+    const runtime = metadata["runtime"];
+    const hasRuntimeRoute = typeof runtime === "object" && runtime !== null && typeof runtime["ip"] === "string" && typeof runtime["port"] === "number";
+    addDoctorCheck(
+      checks,
+      "runtime_route",
+      hasRuntimeRoute,
+      hasRuntimeRoute ? "Deployment has appliance runtime route metadata." : "Deployment is missing appliance runtime route metadata.",
+      typeof runtime === "object" && runtime !== null ? runtime : void 0
+    );
+    let probe;
+    const publicUrl = deployment.public_url;
+    const path = params.probePath ?? params.probe_path ?? "/";
+    if (publicUrl && typeof fetch === "function") {
+      const url = probeUrl(publicUrl, path);
+      const controller = new AbortController();
+      const timeout = setTimeout(
+        () => controller.abort(),
+        params.timeoutMs ?? params.timeout_ms ?? 1e4
+      );
+      try {
+        const response = await fetch(url, {
+          method: "GET",
+          signal: controller.signal
+        });
+        probe = { url, ok: response.ok, status: response.status };
+        addDoctorCheck(
+          checks,
+          "public_url_probe",
+          response.ok,
+          response.ok ? `Public URL returned HTTP ${response.status}.` : `Public URL returned HTTP ${response.status}.`,
+          { url, status: response.status }
+        );
+      } catch (error) {
+        probe = {
+          url,
+          ok: false,
+          error: error instanceof Error ? error.message : String(error)
+        };
+        addDoctorCheck(
+          checks,
+          "public_url_probe",
+          false,
+          probe.error ?? "Public URL probe failed.",
+          { url }
+        );
+      } finally {
+        clearTimeout(timeout);
+      }
+    }
+    return {
+      ok: checks.every((check) => check.ok),
+      deployment,
+      ...host ? { host } : {},
+      checks,
+      ...probe ? { probe } : {}
+    };
+  }
   async update(deploymentId, params) {
     const body = stripUndefined10({
       name: params.name,
@@ -3919,6 +4082,90 @@ var Deployments = class {
   }
 };
 
+// src/resources/docker-deploy.ts
+function workspaceId(params) {
+  return params?.workspace_id ?? params?.workspaceId;
+}
+function ensureBody(params) {
+  const body = {};
+  const id = params.workspace_id ?? params.workspaceId;
+  const externalId = params.external_workspace_id ?? params.externalWorkspaceId;
+  if (id) body.workspace_id = id;
+  if (externalId) body.external_workspace_id = externalId;
+  return body;
+}
+function unwrapHost(response) {
+  const host = response.data ?? response.host;
+  if (!host) {
+    throw new Error("Docker Deploy host response was empty.");
+  }
+  return host;
+}
+function unwrapTemplates(response) {
+  return response.data ?? response.templates ?? [];
+}
+function unwrapTemplate(response) {
+  const template = response.data ?? response.template;
+  if (!template) {
+    throw new Error("Docker Deploy template response was empty.");
+  }
+  return template;
+}
+var DockerDeploy = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /**
+   * List Docker Deploy appliance hosts scoped to the current tenant.
+   *
+   * Pass a workspace ID to inspect the dedicated always-on appliance machine
+   * for one white-label workspace.
+   */
+  async listHosts(params = {}) {
+    const res = await this.http.get(
+      "/docker-deploy/hosts",
+      { workspace_id: workspaceId(params) }
+    );
+    return res.data ?? res.hosts ?? [];
+  }
+  /**
+   * Ensure a workspace has its dedicated Docker Deploy appliance host.
+   *
+   * The host may still be `pending`, `provisioning`, or `bootstrapping` after
+   * this call. Treat `status === "active"` and `appliance_status === "healthy"`
+   * as the ready condition before sending app/container traffic to it.
+   */
+  async ensureHost(params = {}) {
+    const res = await this.http.post(
+      "/docker-deploy/hosts/ensure",
+      ensureBody(params)
+    );
+    return { host: unwrapHost(res), queued: res.queued ?? false };
+  }
+  /** Fetch one Docker Deploy host by ID. */
+  async getHost(hostId) {
+    const res = await this.http.get(
+      `/docker-deploy/hosts/${hostId}`
+    );
+    return unwrapHost(res);
+  }
+  /** List Docker Deploy starter templates. */
+  async listTemplates() {
+    const res = await this.http.get(
+      "/docker-deploy/templates"
+    );
+    return unwrapTemplates(res);
+  }
+  /** Fetch one Docker Deploy starter template by ID. */
+  async getTemplate(templateId) {
+    const res = await this.http.get(
+      `/docker-deploy/templates/${encodeURIComponent(templateId)}`
+    );
+    return unwrapTemplate(res);
+  }
+};
+
 // src/resources/email.ts
 function unwrap24(data) {
   if (data && typeof data === "object") {
@@ -5070,49 +5317,49 @@ var OcWorkspaces = class {
   /**
    * Fetch a single workspace.
    */
-  async get(hostId, workspaceId) {
+  async get(hostId, workspaceId2) {
     return this.http.get(
-      `${this.base(hostId)}/${workspaceId}`
+      `${this.base(hostId)}/${workspaceId2}`
     );
   }
   /**
    * Update workspace metadata (name, branch).
    */
-  async update(hostId, workspaceId, params) {
+  async update(hostId, workspaceId2, params) {
     return this.http.patch(
-      `${this.base(hostId)}/${workspaceId}`,
+      `${this.base(hostId)}/${workspaceId2}`,
       params
     );
   }
   /**
    * Delete a workspace.
    */
-  async delete(hostId, workspaceId) {
-    return this.http.delete(`${this.base(hostId)}/${workspaceId}`);
+  async delete(hostId, workspaceId2) {
+    return this.http.delete(`${this.base(hostId)}/${workspaceId2}`);
   }
   /**
    * Pull the latest changes from the remote repository.
    */
-  async pull(hostId, workspaceId) {
+  async pull(hostId, workspaceId2) {
     return this.http.post(
-      `${this.base(hostId)}/${workspaceId}/pull`
+      `${this.base(hostId)}/${workspaceId2}/pull`
     );
   }
   /**
    * Open a terminal session scoped to the workspace root directory.
    * Returns a short-lived WebSocket ticket.
    */
-  async openTerminal(hostId, workspaceId) {
+  async openTerminal(hostId, workspaceId2) {
     return this.http.post(
-      `${this.base(hostId)}/${workspaceId}/open-terminal`
+      `${this.base(hostId)}/${workspaceId2}/open-terminal`
     );
   }
   /**
    * Stream workspace setup / clone / install events.
    */
-  events(hostId, workspaceId) {
+  events(hostId, workspaceId2) {
     return this.http.stream(
-      `${this.base(hostId)}/${workspaceId}/events`
+      `${this.base(hostId)}/${workspaceId2}/events`
     );
   }
 };
@@ -6033,6 +6280,16 @@ var Sandbox = class _Sandbox {
         output_path: params.outputPath ?? params.output_path ?? params.path ?? params.sourcePath ?? params.source_path,
         source_snapshot_path: params.sourceSnapshotPath ?? params.source_snapshot_path,
         entrypoint: params.entrypoint,
+        build_command: params.buildCommand ?? params.build_command,
+        run_command: params.runCommand ?? params.run_command,
+        start_command: params.startCommand ?? params.start_command,
+        port: params.port,
+        health_check_path: params.healthCheckPath ?? params.health_check_path,
+        deployment_type: params.deploymentType ?? params.deployment_type,
+        type: params.type,
+        mode: params.mode,
+        database: params.database,
+        resources: params.resources,
         domain: params.domain,
         custom_domain: params.customDomain ?? params.custom_domain
       })
@@ -6047,6 +6304,9 @@ var Sandbox = class _Sandbox {
       )
     );
   }
+  async deployDocker(params = {}) {
+    return this.deploy({ ...params, deploymentType: "docker_deploy" });
+  }
   /** Check readiness of the sandbox (GET /sandboxes/:id/readiness). */
   async readiness() {
     return unwrap36(
@@ -6705,22 +6965,96 @@ var OrgInvites = class {
 function unwrap41(payload) {
   if (payload && typeof payload === "object") {
     const p = payload;
-    for (const k of ["data", "tenant", "items"]) {
+    for (const k of ["data", "tenant", "branding", "items"]) {
       if (k in p) return p[k];
     }
   }
   return payload;
 }
-var Tenant = class {
+var PreviewDomain = class {
   constructor(http) {
     this.http = http;
   }
   http;
+  /** Get the tenant's white-label preview domain settings. */
+  async get() {
+    const data = await this.http.get("/tenant/preview-domain");
+    return unwrap41(data);
+  }
+  /** Set the tenant's white-label preview domain. */
+  async set(domain) {
+    const data = await this.http.put("/tenant/preview-domain", {
+      preview_domain: domain
+    });
+    return unwrap41(data);
+  }
+  /** Re-run DNS verification for the configured preview domain. */
+  async verify() {
+    const data = await this.http.post(
+      "/tenant/preview-domain/verify",
+      {}
+    );
+    return unwrap41(data);
+  }
+  /** Remove the tenant's custom preview domain. */
+  async delete() {
+    await this.http.delete("/tenant/preview-domain");
+  }
+};
+var Branding = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** Get tenant branding used by white-label hosted surfaces. */
+  async get() {
+    const data = await this.http.get("/tenant/branding");
+    return unwrap41(data);
+  }
+  /** Update tenant branding used by white-label hosted surfaces. */
+  async set(params) {
+    const body = Object.fromEntries(
+      Object.entries(params).filter(([, v]) => v !== void 0)
+    );
+    const data = await this.http.put("/tenant/branding", {
+      branding: body
+    });
+    return unwrap41(data);
+  }
+  /** Reset tenant branding to platform defaults. */
+  async delete() {
+    await this.http.delete("/tenant/branding");
+  }
+};
+var Tenant = class {
+  http;
+  preview_domain;
+  branding;
+  /** camelCase alias for SDK consumers that avoid snake_case properties. */
+  previewDomain;
+  constructor(http) {
+    this.http = http;
+    this.preview_domain = new PreviewDomain(http);
+    this.previewDomain = this.preview_domain;
+    this.branding = new Branding(http);
+  }
   /** Get the current tenant's plan, limits, and live usage counters. */
   async current() {
     const data = await this.http.get("/tenant/plan");
     return unwrap41(data);
   }
+  /** Convenience alias for `tenant.branding.get()`. */
+  async getBranding() {
+    return this.branding.get();
+  }
+  /** Convenience alias for `tenant.branding.set(...)`. */
+  async setBranding(params) {
+    return this.branding.set(params);
+  }
+  /** Convenience alias for `tenant.branding.delete()`. */
+  async deleteBranding() {
+    await this.branding.delete();
+  }
 };
 
 // src/resources/usage.ts
@@ -6842,11 +7176,42 @@ function stripUndefined25(input) {
 function idempotencyKey10(key) {
   return key ?? randomUUID();
 }
+function bodyBuffer(body) {
+  if (Buffer.isBuffer(body)) return body;
+  if (typeof body === "string") return Buffer.from(body, "utf8");
+  return Buffer.from(body);
+}
+function verifySignature(body, header, secret, toleranceSec = 300) {
+  const parts = Object.fromEntries(
+    header.split(",").map((chunk) => chunk.split("=", 2)).filter(([key, value]) => key && value)
+  );
+  const timestamp = parts.t;
+  const received = parts.v1;
+  if (!timestamp || !received || !secret) return false;
+  const unixSeconds = Number(timestamp);
+  if (!Number.isFinite(unixSeconds)) return false;
+  const ageSec = Math.abs(Date.now() / 1e3 - unixSeconds);
+  if (ageSec > toleranceSec) {
+    throw new Error("webhook timestamp too old");
+  }
+  const rawBody = bodyBuffer(body);
+  const signed = Buffer.concat([Buffer.from(`${timestamp}.`), rawBody]);
+  const expected = createHmac("sha256", secret).update(signed).digest("hex");
+  try {
+    return timingSafeEqual(
+      Buffer.from(expected, "utf8"),
+      Buffer.from(received, "utf8")
+    );
+  } catch {
+    return false;
+  }
+}
 var Webhooks = class {
   constructor(http) {
     this.http = http;
   }
   http;
+  static verifySignature = verifySignature;
   async list(params = {}) {
     const query = stripUndefined25({ ...params });
     const data = await this.http.get("/webhooks", query);
@@ -6911,9 +7276,9 @@ var WorkspaceInvites = class {
    *
    * `POST /workspaces/:id/invites`
    */
-  async create(workspaceId, params) {
+  async create(workspaceId2, params) {
     return this.http.post(
-      `/workspaces/${workspaceId}/invites`,
+      `/workspaces/${workspaceId2}/invites`,
       params
     );
   }
@@ -6922,9 +7287,9 @@ var WorkspaceInvites = class {
    *
    * `GET /workspaces/:id/invites`
    */
-  async list(workspaceId) {
+  async list(workspaceId2) {
     const res = await this.http.get(
-      `/workspaces/${workspaceId}/invites`
+      `/workspaces/${workspaceId2}/invites`
     );
     return res.data ?? [];
   }
@@ -6936,9 +7301,9 @@ var WorkspaceInvites = class {
    *
    * `DELETE /workspaces/:id/invites/:invite_id`
    */
-  async revoke(workspaceId, inviteId) {
+  async revoke(workspaceId2, inviteId) {
     return this.http.delete(
-      `/workspaces/${workspaceId}/invites/${inviteId}`
+      `/workspaces/${workspaceId2}/invites/${inviteId}`
     );
   }
   /**
@@ -6992,9 +7357,9 @@ var WorkspaceMembers = class {
    *
    * `GET /workspaces/:id/members`
    */
-  async list(workspaceId) {
+  async list(workspaceId2) {
     const res = await this.http.get(
-      `/workspaces/${workspaceId}/members`
+      `/workspaces/${workspaceId2}/members`
     );
     return res.data ?? res;
   }
@@ -7010,9 +7375,9 @@ var WorkspaceMembers = class {
    * @throws `MiosaError` with code `NOT_TENANT_MEMBER` if the user is not an
    *   org member.
    */
-  async add(workspaceId, params) {
+  async add(workspaceId2, params) {
     const res = await this.http.post(
-      `/workspaces/${workspaceId}/members`,
+      `/workspaces/${workspaceId2}/members`,
       params
     );
     return res.data ?? res;
@@ -7022,9 +7387,9 @@ var WorkspaceMembers = class {
    *
    * `PATCH /workspaces/:id/members/:user_id`
    */
-  async updateRole(workspaceId, userId, params) {
+  async updateRole(workspaceId2, userId, params) {
     const res = await this.http.patch(
-      `/workspaces/${workspaceId}/members/${userId}`,
+      `/workspaces/${workspaceId2}/members/${userId}`,
       params
     );
     return res.data ?? res;
@@ -7039,9 +7404,9 @@ var WorkspaceMembers = class {
    *
    * @throws `MiosaError` with code `LAST_OWNER` if the target is the sole owner.
    */
-  async remove(workspaceId, userId) {
+  async remove(workspaceId2, userId) {
     return this.http.delete(
-      `/workspaces/${workspaceId}/members/${userId}`
+      `/workspaces/${workspaceId2}/members/${userId}`
     );
   }
 };
@@ -7098,6 +7463,8 @@ var Miosa = class {
    * Versions, releases, rollback, custom domains.
    */
   deployments;
+  /** Docker Deploy appliance hosts — one always-on workspace host, many apps. */
+  dockerDeploy;
   /** Credit balance and usage. */
   credits;
   /** Admin surface (`/api/v1/admin/*`) — requires an admin credential. */
@@ -7192,6 +7559,7 @@ var Miosa = class {
     this.computers = new Computers(this.http);
     this.sandboxes = new Sandboxes(this.http);
     this.deployments = new Deployments(this.http);
+    this.dockerDeploy = new DockerDeploy(this.http);
     this.credits = new Credits(this.http);
     this.admin = new Admin(this.http);
     this.openComputers = new OpenComputers(this.http);
@@ -7221,6 +7589,6 @@ var Miosa = class {
   }
 };
 
-export { Admin, Analytics, ApiKeys, AuditLog, AuthError, Benchmarks, BuilderSessions, Channels, Checkpoints, CommandCenter, Community, Completions, Computer, ComputerAudit, ComputerAutoStop, ComputerEnv, ComputerInbox, ComputerLogs, ComputerNetwork, ComputerOsa, ComputerPorts, ComputerSecrets, ComputerTerminal, ComputerVolumes, Computers, Credits, CronJobs, Dashboard, Databases, DeploymentDomains, DeploymentReleases, DeploymentRuntimeInstances, DeploymentVersions, Deployments, Desktop, EgressAudit, EgressNetwork, EgressSecrets, Email, EmailCampaigns, EmailInbox, EmailTemplates, Embeddings, Exec, ExternalKeys, Files, FlatCustomDomains, Functions, HealthChecks, InsufficientCreditsError, Integrations, Mcp, Miosa, MiosaError, Models, NetworkError, NetworkPolicy, NotFoundError, OAuthFlow, OpenComputers, OrgInvites, ProjectAuth, ProjectIntegrations, ProviderDefaults, RateLimitError, Regions, SANDBOX_TEMPLATE, Sandbox, SandboxArtifacts, SandboxAudit, SandboxCommands, SandboxEnv, SandboxEvents, SandboxFiles, SandboxNetwork, SandboxPreview, SandboxPreviews, SandboxSecrets, SandboxTags, SandboxTemplates, SandboxTerminal, Sandboxes, ScopedFs, Settings, SnapshotsStandalone, Storage, Tenant, TimeoutError, Usage, ValidationError, Volumes, Webhooks, WorkspaceInvites, WorkspaceMembers };
+export { Admin, Analytics, ApiKeys, AuditLog, AuthError, Benchmarks, BuilderSessions, Channels, Checkpoints, CommandCenter, Community, Completions, Computer, ComputerAudit, ComputerAutoStop, ComputerEnv, ComputerInbox, ComputerLogs, ComputerNetwork, ComputerOsa, ComputerPorts, ComputerSecrets, ComputerTerminal, ComputerVolumes, Computers, Credits, CronJobs, Dashboard, Databases, DeploymentDomains, DeploymentReleases, DeploymentRuntimeInstances, DeploymentVersions, Deployments, Desktop, DockerDeploy, EgressAudit, EgressNetwork, EgressSecrets, Email, EmailCampaigns, EmailInbox, EmailTemplates, Embeddings, Exec, ExternalKeys, Files, FlatCustomDomains, Functions, HealthChecks, InsufficientCreditsError, Integrations, Mcp, Miosa, MiosaError, Models, NetworkError, NetworkPolicy, NotFoundError, OAuthFlow, OpenComputers, OrgInvites, ProjectAuth, ProjectIntegrations, ProviderDefaults, RateLimitError, Regions, SANDBOX_TEMPLATE, Sandbox, SandboxArtifacts, SandboxAudit, SandboxCommands, SandboxEnv, SandboxEvents, SandboxFiles, SandboxNetwork, SandboxPreview, SandboxPreviews, SandboxSecrets, SandboxTags, SandboxTemplates, SandboxTerminal, Sandboxes, ScopedFs, Settings, SnapshotsStandalone, Storage, Tenant, TimeoutError, Usage, ValidationError, Volumes, Webhooks, WorkspaceInvites, WorkspaceMembers, verifySignature };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map