@naturali/sdk 0.219.0 → 0.220.0

package/dist/index.cjs

@@ -1266,7 +1266,7 @@ var Agents = class {
 	/**
 	* Create an agent
 	*
-	* Creates a new agent bound to an AI provider.
+	* Creates a new agent bound to an AI provider. A `{{secret:...}}` reference in an inline `tool_bindings[].tool` also needs `secrets:UseSecret` on that secret, else `403`.
 	*/
 	static createAgent(options) {
 		return (options.client ?? client).post({
@@ -1305,7 +1305,7 @@ var Agents = class {
 	/**
 	* Partially update an agent
 	*
-	* Partially updates an existing agent. Identical to PUT — both perform partial updates.
+	* Partially updates an existing agent. Identical to PUT — both perform partial updates. A `{{secret:...}}` reference in an inline `tool_bindings[].tool` also needs `secrets:UseSecret` on that secret, else `403`.
 	*/
 	static patchAgent(options) {
 		return (options.client ?? client).patch({
@@ -1320,7 +1320,7 @@ var Agents = class {
 	/**
 	* Update an agent
 	*
-	* Updates an existing agent. Identical to PATCH — both perform partial updates.
+	* Updates an existing agent. Identical to PATCH — both perform partial updates. A `{{secret:...}}` reference in an inline `tool_bindings[].tool` also needs `secrets:UseSecret` on that secret, else `403`.
 	*/
 	static updateAgent(options) {
 		return (options.client ?? client).put({
@@ -1477,6 +1477,10 @@ var AiProviders = class {
 	* A provider's credential is its linked `secret_id`; `config.apiKey` is
 	* refused with `400 VALIDATION_FAILED`.
 	*
+	* A record with both `base_url` and `secret_id` sends the secret to that
+	* URL, so creating one also needs `secrets:UseSecret` on the secret, else
+	* `403`.
+	*
 	* A `bedrock` or `vertex` record must link one. Without it the provider
 	* SDK signs with the server's own credentials (the AWS default credential
 	* chain, Google Application Default Credentials), which is refused with
@@ -1521,7 +1525,7 @@ var AiProviders = class {
 	/**
 	* Update an AI provider
 	*
-	* Updates an AI provider configuration
+	* Updates an AI provider configuration. Setting `base_url` or `secret_id` so the record holds both also needs `secrets:UseSecret` on the secret, else `403`.
 	*/
 	static updateAiProvider(options) {
 		return (options.client ?? client).patch({
@@ -5849,7 +5853,7 @@ var Triggers = class {
 	/**
 	* Create a trigger
 	*
-	* Creates a new trigger for a project
+	* Creates a new trigger for a project. A `{{secret:...}}` reference in `tool_context` also needs `secrets:UseSecret` on that secret, else `403`.
 	*/
 	static createTrigger(options) {
 		return (options.client ?? client).post({
@@ -5897,7 +5901,7 @@ var Triggers = class {
 	/**
 	* Update a trigger
 	*
-	* Updates an existing trigger's configuration. The type is immutable. Changing `target_type` or `target_id` re-checks that the caller may start the resulting target, because a firing runs with the trigger creator's authority rather than the updater's. A caller who could not start the new target is answered `403` and the trigger keeps the target it had.
+	* Updates an existing trigger's configuration. The type is immutable. Changing `target_type` or `target_id` re-checks that the caller may start the resulting target, because a firing runs with the trigger creator's authority rather than the updater's. A caller who could not start the new target is answered `403` and the trigger keeps the target it had. A `{{secret:...}}` reference in a written `tool_context`, or in the stored one when the target changes, also needs `secrets:UseSecret` on that secret, else `403`.
 	*
 	*/
 	static updateTrigger(options) {

package/dist/index.d.cts

@@ -7149,9 +7149,9 @@ type NodeExecution = {
  */
 type RequiredAction = {
   /**
-   * Discriminator identifying the kind of pause. Open enum — new pause kinds may be added in minor releases; clients must tolerate unknown values.
+   * Discriminator identifying the kind of pause. Open enum — new pause kinds may be added in minor releases; clients must tolerate unknown values. `child_run` is a `loop` or `sub_orchestration` node whose child runs, listed in `context.orchestration_run_ids`, have not settled; their settle resumes it, and it accepts no human input.
    */
-  type: 'human_input' | 'webhook_receive' | 'approval' | 'paused';
+  type: 'human_input' | 'webhook_receive' | 'approval' | 'paused' | 'child_run';
   /**
    * The node the run is parked at. Absent for a `paused` action, which no node produced.
    */
@@ -32938,7 +32938,7 @@ export declare class Agents {
   /**
    * Create an agent
    *
-   * Creates a new agent bound to an AI provider.
+   * Creates a new agent bound to an AI provider. A `{{secret:...}}` reference in an inline `tool_bindings[].tool` also needs `secrets:UseSecret` on that secret, else `403`.
    */
   static createAgent<ThrowOnError extends boolean = false>(options: Options<CreateAgentData, ThrowOnError>): RequestResult<CreateAgentResponses, CreateAgentErrors, ThrowOnError>;
   /**
@@ -32958,13 +32958,13 @@ export declare class Agents {
   /**
    * Partially update an agent
    *
-   * Partially updates an existing agent. Identical to PUT — both perform partial updates.
+   * Partially updates an existing agent. Identical to PUT — both perform partial updates. A `{{secret:...}}` reference in an inline `tool_bindings[].tool` also needs `secrets:UseSecret` on that secret, else `403`.
    */
   static patchAgent<ThrowOnError extends boolean = false>(options: Options<PatchAgentData, ThrowOnError>): RequestResult<PatchAgentResponses, PatchAgentErrors, ThrowOnError>;
   /**
    * Update an agent
    *
-   * Updates an existing agent. Identical to PATCH — both perform partial updates.
+   * Updates an existing agent. Identical to PATCH — both perform partial updates. A `{{secret:...}}` reference in an inline `tool_bindings[].tool` also needs `secrets:UseSecret` on that secret, else `403`.
    */
   static updateAgent<ThrowOnError extends boolean = false>(options: Options<UpdateAgentData, ThrowOnError>): RequestResult<UpdateAgentResponses, UpdateAgentErrors, ThrowOnError>;
   /**
@@ -33051,6 +33051,10 @@ export declare class AiProviders {
    * A provider's credential is its linked `secret_id`; `config.apiKey` is
    * refused with `400 VALIDATION_FAILED`.
    *
+   * A record with both `base_url` and `secret_id` sends the secret to that
+   * URL, so creating one also needs `secrets:UseSecret` on the secret, else
+   * `403`.
+   *
    * A `bedrock` or `vertex` record must link one. Without it the provider
    * SDK signs with the server's own credentials (the AWS default credential
    * chain, Google Application Default Credentials), which is refused with
@@ -33076,7 +33080,7 @@ export declare class AiProviders {
   /**
    * Update an AI provider
    *
-   * Updates an AI provider configuration
+   * Updates an AI provider configuration. Setting `base_url` or `secret_id` so the record holds both also needs `secrets:UseSecret` on the secret, else `403`.
    */
   static updateAiProvider<ThrowOnError extends boolean = false>(options: Options<UpdateAiProviderData, ThrowOnError>): RequestResult<UpdateAiProviderResponses, UpdateAiProviderErrors, ThrowOnError>;
   /**
@@ -35320,7 +35324,7 @@ export declare class Triggers {
   /**
    * Create a trigger
    *
-   * Creates a new trigger for a project
+   * Creates a new trigger for a project. A `{{secret:...}}` reference in `tool_context` also needs `secrets:UseSecret` on that secret, else `403`.
    */
   static createTrigger<ThrowOnError extends boolean = false>(options: Options<CreateTriggerData, ThrowOnError>): RequestResult<CreateTriggerResponses, CreateTriggerErrors, ThrowOnError>;
   /**
@@ -35344,7 +35348,7 @@ export declare class Triggers {
   /**
    * Update a trigger
    *
-   * Updates an existing trigger's configuration. The type is immutable. Changing `target_type` or `target_id` re-checks that the caller may start the resulting target, because a firing runs with the trigger creator's authority rather than the updater's. A caller who could not start the new target is answered `403` and the trigger keeps the target it had.
+   * Updates an existing trigger's configuration. The type is immutable. Changing `target_type` or `target_id` re-checks that the caller may start the resulting target, because a firing runs with the trigger creator's authority rather than the updater's. A caller who could not start the new target is answered `403` and the trigger keeps the target it had. A `{{secret:...}}` reference in a written `tool_context`, or in the stored one when the target changes, also needs `secrets:UseSecret` on that secret, else `403`.
    *
    */
   static updateTrigger<ThrowOnError extends boolean = false>(options: Options<UpdateTriggerData, ThrowOnError>): RequestResult<UpdateTriggerResponses, UpdateTriggerErrors, ThrowOnError>;

package/dist/index.d.mts

@@ -7149,9 +7149,9 @@ type NodeExecution = {
  */
 type RequiredAction = {
   /**
-   * Discriminator identifying the kind of pause. Open enum — new pause kinds may be added in minor releases; clients must tolerate unknown values.
+   * Discriminator identifying the kind of pause. Open enum — new pause kinds may be added in minor releases; clients must tolerate unknown values. `child_run` is a `loop` or `sub_orchestration` node whose child runs, listed in `context.orchestration_run_ids`, have not settled; their settle resumes it, and it accepts no human input.
    */
-  type: 'human_input' | 'webhook_receive' | 'approval' | 'paused';
+  type: 'human_input' | 'webhook_receive' | 'approval' | 'paused' | 'child_run';
   /**
    * The node the run is parked at. Absent for a `paused` action, which no node produced.
    */
@@ -32938,7 +32938,7 @@ export declare class Agents {
   /**
    * Create an agent
    *
-   * Creates a new agent bound to an AI provider.
+   * Creates a new agent bound to an AI provider. A `{{secret:...}}` reference in an inline `tool_bindings[].tool` also needs `secrets:UseSecret` on that secret, else `403`.
    */
   static createAgent<ThrowOnError extends boolean = false>(options: Options<CreateAgentData, ThrowOnError>): RequestResult<CreateAgentResponses, CreateAgentErrors, ThrowOnError>;
   /**
@@ -32958,13 +32958,13 @@ export declare class Agents {
   /**
    * Partially update an agent
    *
-   * Partially updates an existing agent. Identical to PUT — both perform partial updates.
+   * Partially updates an existing agent. Identical to PUT — both perform partial updates. A `{{secret:...}}` reference in an inline `tool_bindings[].tool` also needs `secrets:UseSecret` on that secret, else `403`.
    */
   static patchAgent<ThrowOnError extends boolean = false>(options: Options<PatchAgentData, ThrowOnError>): RequestResult<PatchAgentResponses, PatchAgentErrors, ThrowOnError>;
   /**
    * Update an agent
    *
-   * Updates an existing agent. Identical to PATCH — both perform partial updates.
+   * Updates an existing agent. Identical to PATCH — both perform partial updates. A `{{secret:...}}` reference in an inline `tool_bindings[].tool` also needs `secrets:UseSecret` on that secret, else `403`.
    */
   static updateAgent<ThrowOnError extends boolean = false>(options: Options<UpdateAgentData, ThrowOnError>): RequestResult<UpdateAgentResponses, UpdateAgentErrors, ThrowOnError>;
   /**
@@ -33051,6 +33051,10 @@ export declare class AiProviders {
    * A provider's credential is its linked `secret_id`; `config.apiKey` is
    * refused with `400 VALIDATION_FAILED`.
    *
+   * A record with both `base_url` and `secret_id` sends the secret to that
+   * URL, so creating one also needs `secrets:UseSecret` on the secret, else
+   * `403`.
+   *
    * A `bedrock` or `vertex` record must link one. Without it the provider
    * SDK signs with the server's own credentials (the AWS default credential
    * chain, Google Application Default Credentials), which is refused with
@@ -33076,7 +33080,7 @@ export declare class AiProviders {
   /**
    * Update an AI provider
    *
-   * Updates an AI provider configuration
+   * Updates an AI provider configuration. Setting `base_url` or `secret_id` so the record holds both also needs `secrets:UseSecret` on the secret, else `403`.
    */
   static updateAiProvider<ThrowOnError extends boolean = false>(options: Options<UpdateAiProviderData, ThrowOnError>): RequestResult<UpdateAiProviderResponses, UpdateAiProviderErrors, ThrowOnError>;
   /**
@@ -35320,7 +35324,7 @@ export declare class Triggers {
   /**
    * Create a trigger
    *
-   * Creates a new trigger for a project
+   * Creates a new trigger for a project. A `{{secret:...}}` reference in `tool_context` also needs `secrets:UseSecret` on that secret, else `403`.
    */
   static createTrigger<ThrowOnError extends boolean = false>(options: Options<CreateTriggerData, ThrowOnError>): RequestResult<CreateTriggerResponses, CreateTriggerErrors, ThrowOnError>;
   /**
@@ -35344,7 +35348,7 @@ export declare class Triggers {
   /**
    * Update a trigger
    *
-   * Updates an existing trigger's configuration. The type is immutable. Changing `target_type` or `target_id` re-checks that the caller may start the resulting target, because a firing runs with the trigger creator's authority rather than the updater's. A caller who could not start the new target is answered `403` and the trigger keeps the target it had.
+   * Updates an existing trigger's configuration. The type is immutable. Changing `target_type` or `target_id` re-checks that the caller may start the resulting target, because a firing runs with the trigger creator's authority rather than the updater's. A caller who could not start the new target is answered `403` and the trigger keeps the target it had. A `{{secret:...}}` reference in a written `tool_context`, or in the stored one when the target changes, also needs `secrets:UseSecret` on that secret, else `403`.
    *
    */
   static updateTrigger<ThrowOnError extends boolean = false>(options: Options<UpdateTriggerData, ThrowOnError>): RequestResult<UpdateTriggerResponses, UpdateTriggerErrors, ThrowOnError>;

package/dist/index.mjs

@@ -1265,7 +1265,7 @@ var Agents = class {
 	/**
 	* Create an agent
 	*
-	* Creates a new agent bound to an AI provider.
+	* Creates a new agent bound to an AI provider. A `{{secret:...}}` reference in an inline `tool_bindings[].tool` also needs `secrets:UseSecret` on that secret, else `403`.
 	*/
 	static createAgent(options) {
 		return (options.client ?? client).post({
@@ -1304,7 +1304,7 @@ var Agents = class {
 	/**
 	* Partially update an agent
 	*
-	* Partially updates an existing agent. Identical to PUT — both perform partial updates.
+	* Partially updates an existing agent. Identical to PUT — both perform partial updates. A `{{secret:...}}` reference in an inline `tool_bindings[].tool` also needs `secrets:UseSecret` on that secret, else `403`.
 	*/
 	static patchAgent(options) {
 		return (options.client ?? client).patch({
@@ -1319,7 +1319,7 @@ var Agents = class {
 	/**
 	* Update an agent
 	*
-	* Updates an existing agent. Identical to PATCH — both perform partial updates.
+	* Updates an existing agent. Identical to PATCH — both perform partial updates. A `{{secret:...}}` reference in an inline `tool_bindings[].tool` also needs `secrets:UseSecret` on that secret, else `403`.
 	*/
 	static updateAgent(options) {
 		return (options.client ?? client).put({
@@ -1476,6 +1476,10 @@ var AiProviders = class {
 	* A provider's credential is its linked `secret_id`; `config.apiKey` is
 	* refused with `400 VALIDATION_FAILED`.
 	*
+	* A record with both `base_url` and `secret_id` sends the secret to that
+	* URL, so creating one also needs `secrets:UseSecret` on the secret, else
+	* `403`.
+	*
 	* A `bedrock` or `vertex` record must link one. Without it the provider
 	* SDK signs with the server's own credentials (the AWS default credential
 	* chain, Google Application Default Credentials), which is refused with
@@ -1520,7 +1524,7 @@ var AiProviders = class {
 	/**
 	* Update an AI provider
 	*
-	* Updates an AI provider configuration
+	* Updates an AI provider configuration. Setting `base_url` or `secret_id` so the record holds both also needs `secrets:UseSecret` on the secret, else `403`.
 	*/
 	static updateAiProvider(options) {
 		return (options.client ?? client).patch({
@@ -5848,7 +5852,7 @@ var Triggers = class {
 	/**
 	* Create a trigger
 	*
-	* Creates a new trigger for a project
+	* Creates a new trigger for a project. A `{{secret:...}}` reference in `tool_context` also needs `secrets:UseSecret` on that secret, else `403`.
 	*/
 	static createTrigger(options) {
 		return (options.client ?? client).post({
@@ -5896,7 +5900,7 @@ var Triggers = class {
 	/**
 	* Update a trigger
 	*
-	* Updates an existing trigger's configuration. The type is immutable. Changing `target_type` or `target_id` re-checks that the caller may start the resulting target, because a firing runs with the trigger creator's authority rather than the updater's. A caller who could not start the new target is answered `403` and the trigger keeps the target it had.
+	* Updates an existing trigger's configuration. The type is immutable. Changing `target_type` or `target_id` re-checks that the caller may start the resulting target, because a firing runs with the trigger creator's authority rather than the updater's. A caller who could not start the new target is answered `403` and the trigger keeps the target it had. A `{{secret:...}}` reference in a written `tool_context`, or in the stored one when the target changes, also needs `secrets:UseSecret` on that secret, else `403`.
 	*
 	*/
 	static updateTrigger(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/sdk",
-  "version": "0.219.0",
+  "version": "0.220.0",
   "description": "TypeScript SDK for the naturali.ai API, generated from its OpenAPI specs",
   "keywords": [
     "naturali",
@@ -38,7 +38,7 @@
   },
   "devDependencies": {
     "@hey-api/openapi-ts": "^0.99.0",
-    "@naturali/api": "0.219.0",
+    "@naturali/api": "0.220.0",
     "@ttoss/openapi-codegen": "^0.10.0",
     "@types/node": "^26.5.1",
     "tsdown": "^0.23.0",