@palai/sdk 0.1.0

package/dist/resources/model-routes.js

@@ -0,0 +1,74 @@
+import { callArgs, enc } from "./shared.js";
+// ModelRoutes is the model-routing admin surface (E13 T8 write + E16 T1 read-back, MCI-006): a project
+// binds its own provider connection and publishes route revisions, so two projects on one stack run
+// different models on different credentials — AND reads them back. The list methods return the admin
+// ListView envelope ({object:"list", data:[…]}) — a full, small, tenant-scoped set, no cursor. Requires a
+// key with the `provision` capability. A connection projection carries the secret REF name only, never a
+// value.
+export class ModelRoutes {
+    #client;
+    constructor(client) {
+        this.#client = client;
+    }
+    // createConnection binds a provider family to a secret-ref handle (201).
+    async createConnection(params, options = {}) {
+        const r = await this.#client.request("POST", "/v1/model-connections", { body: params, ...callArgs(options) });
+        return r.body;
+    }
+    // verifyConnection performs a REAL credential probe against the connection's endpoint (E29): the control
+    // plane redeems this connection's own credential and asks the endpoint whether it accepts it. It resolves
+    // (200) for every outcome it reached a verdict on, INCLUDING a rejected credential — the request
+    // succeeded and the verdict is in the body, because a 4xx would blame the caller's request for the
+    // operator's key. Only an unknown connection rejects, with a 404.
+    async verifyConnection(connectionID, options = {}) {
+        const r = await this.#client.request("POST", `/v1/model-connections/${enc(connectionID)}/verify`, callArgs(options));
+        return r.body;
+    }
+    // createRoute opens a named route alias for the project (201).
+    async createRoute(params, options = {}) {
+        const r = await this.#client.request("POST", "/v1/model-routes", { body: params, ...callArgs(options) });
+        return r.body;
+    }
+    // createRevision adds a DRAFT revision to a route (201) — a draft never steers a run; publishing does.
+    async createRevision(routeID, params, options = {}) {
+        const r = await this.#client.request("POST", `/v1/model-routes/${enc(routeID)}/revisions`, { body: params, ...callArgs(options) });
+        return r.body;
+    }
+    // publishRevision makes a draft revision the project's routed target. Re-publishing is idempotent.
+    async publishRevision(routeID, revisionID, options = {}) {
+        const r = await this.#client.request("POST", `/v1/model-routes/${enc(routeID)}/revisions/${enc(revisionID)}/publish`, callArgs(options));
+        return r.body;
+    }
+    // --- E16 T1 read-back (the E13 T10 write-only gap) ------------------------------------------------
+    // listConnections returns the project's connections (secret REF names only, never values).
+    async listConnections(options = {}) {
+        const r = await this.#client.request("GET", "/v1/model-connections", callArgs(options));
+        return r.body;
+    }
+    // getConnection reads one connection by id; an absent/foreign id is a 404.
+    async getConnection(connectionID, options = {}) {
+        const r = await this.#client.request("GET", `/v1/model-connections/${enc(connectionID)}`, callArgs(options));
+        return r.body;
+    }
+    // listRoutes returns the project's route aliases.
+    async listRoutes(options = {}) {
+        const r = await this.#client.request("GET", "/v1/model-routes", callArgs(options));
+        return r.body;
+    }
+    // getRoute reads one route alias by id; an absent/foreign id is a 404.
+    async getRoute(routeID, options = {}) {
+        const r = await this.#client.request("GET", `/v1/model-routes/${enc(routeID)}`, callArgs(options));
+        return r.body;
+    }
+    // listRevisions returns a route's revisions (each with its derived `published` flag).
+    async listRevisions(routeID, options = {}) {
+        const r = await this.#client.request("GET", `/v1/model-routes/${enc(routeID)}/revisions`, callArgs(options));
+        return r.body;
+    }
+    // getRevision reads one revision of a route; an absent/foreign route or revision is a 404.
+    async getRevision(routeID, revisionID, options = {}) {
+        const r = await this.#client.request("GET", `/v1/model-routes/${enc(routeID)}/revisions/${enc(revisionID)}`, callArgs(options));
+        return r.body;
+    }
+}
+//# sourceMappingURL=model-routes.js.map

package/dist/resources/model-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-routes.js","sourceRoot":"","sources":["../../src/resources/model-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAmC,MAAM,aAAa,CAAC;AA6D7E,uGAAuG;AACvG,oGAAoG;AACpG,qGAAqG;AACrG,0GAA0G;AAC1G,yGAAyG;AACzG,SAAS;AACT,MAAM,OAAO,WAAW;IACtB,OAAO,CAAQ;IACf,YAAY,MAAa;QACvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,gBAAgB,CAAC,MAAmC,EAAE,OAAO,GAAgB,EAAE;QACnF,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAkB,MAAM,EAAE,uBAAuB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/H,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,yGAAyG;IACzG,0GAA0G;IAC1G,iGAAiG;IACjG,mGAAmG;IACnG,kEAAkE;IAClE,KAAK,CAAC,gBAAgB,CAAC,YAAoB,EAAE,OAAO,GAAgB,EAAE;QACpE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAA8B,MAAM,EAAE,yBAAyB,GAAG,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAClJ,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,WAAW,CAAC,MAA8B,EAAE,OAAO,GAAgB,EAAE;QACzE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAa,MAAM,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrH,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,uGAAuG;IACvG,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,MAAsC,EAAE,OAAO,GAAgB,EAAE;QACrG,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAqB,MAAM,EAAE,oBAAoB,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvJ,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,UAAkB,EAAE,OAAO,GAAgB,EAAE;QAClF,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAqB,MAAM,EAAE,oBAAoB,GAAG,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7J,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,qGAAqG;IAErG,2FAA2F;IAC3F,KAAK,CAAC,eAAe,CAAC,OAAO,GAAgB,EAAE;QAC7C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAA4B,KAAK,EAAE,uBAAuB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACnH,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,aAAa,CAAC,YAAoB,EAAE,OAAO,GAAgB,EAAE;QACjE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAkB,KAAK,EAAE,yBAAyB,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9H,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,UAAU,CAAC,OAAO,GAAgB,EAAE;QACxC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAuB,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzG,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,OAAO,GAAgB,EAAE;QACvD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAa,KAAK,EAAE,oBAAoB,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/G,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,OAAO,GAAgB,EAAE;QAC5D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAA+B,KAAK,EAAE,oBAAoB,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3I,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,UAAkB,EAAE,OAAO,GAAgB,EAAE;QAC9E,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAqB,KAAK,EAAE,oBAAoB,GAAG,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACpJ,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;CACF"}

package/dist/resources/reads.d.ts

@@ -0,0 +1,49 @@
+import type { MCPConnection, ModelConnection, RepositoryBinding, Tool, ToolSet } from "../generated/types.ts";
+import type { Palai } from "../client.ts";
+import { type CallOptions, type ListParams, type Page } from "./shared.ts";
+export interface Trigger {
+    id: string;
+    object: string;
+    [key: string]: unknown;
+}
+export declare class RepositoryBindings {
+    #private;
+    constructor(client: Palai);
+    list(params?: ListParams, options?: CallOptions): Promise<Page<RepositoryBinding>>;
+    retrieve(bindingID: string, options?: CallOptions): Promise<RepositoryBinding>;
+}
+export declare class Tools {
+    #private;
+    constructor(client: Palai);
+    list(params?: ListParams, options?: CallOptions): Promise<Page<Tool>>;
+    retrieve(toolID: string, options?: CallOptions): Promise<Tool>;
+    listSets(params?: ListParams, options?: CallOptions): Promise<Page<ToolSet>>;
+}
+export declare class MCPConnections {
+    #private;
+    constructor(client: Palai);
+    list(params?: ListParams, options?: CallOptions): Promise<Page<MCPConnection>>;
+    retrieve(connectionID: string, options?: CallOptions): Promise<MCPConnection>;
+}
+export declare class Triggers {
+    #private;
+    constructor(client: Palai);
+    list(params?: ListParams, options?: CallOptions): Promise<Page<Trigger>>;
+    retrieve(triggerID: string, options?: CallOptions): Promise<Trigger>;
+}
+/**
+ * The model providers this project can route to, and the models each one offers.
+ *
+ * ‼️ THIS IS THE ONLY SOURCE OF A MODEL LIST. The engine has no `GET /v1/models` — it answers 404
+ * (measured 2026-08-26). Models are reachable only THROUGH a connection, which is the honest shape:
+ * a model id means nothing without the provider serving it, and the same name can be offered by two
+ * connections with different credentials and different limits.
+ */
+export declare class ModelConnections {
+    #private;
+    constructor(client: Palai);
+    list(options?: CallOptions): Promise<ModelConnection[]>;
+    /** The model ids this connection offers. */
+    models(connectionID: string, options?: CallOptions): Promise<string[]>;
+}
+//# sourceMappingURL=reads.d.ts.map

package/dist/resources/reads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reads.d.ts","sourceRoot":"","sources":["../../src/resources/reads.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAC9G,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAA2B,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,IAAI,EAAE,MAAM,aAAa,CAAC;AASpG,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,qBAAa,kBAAkB;;IAE7B,YAAY,MAAM,EAAE,KAAK,EAExB;IACK,IAAI,CAAC,MAAM,GAAE,UAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAG/F;IACK,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAGvF;CACF;AAGD,qBAAa,KAAK;;IAEhB,YAAY,MAAM,EAAE,KAAK,EAExB;IACK,IAAI,CAAC,MAAM,GAAE,UAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAGlF;IACK,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvE;IAEK,QAAQ,CAAC,MAAM,GAAE,UAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAGzF;CACF;AAID,qBAAa,cAAc;;IAEzB,YAAY,MAAM,EAAE,KAAK,EAExB;IACK,IAAI,CAAC,MAAM,GAAE,UAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAG3F;IACK,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAGtF;CACF;AAGD,qBAAa,QAAQ;;IAEnB,YAAY,MAAM,EAAE,KAAK,EAExB;IACK,IAAI,CAAC,MAAM,GAAE,UAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAGrF;IACK,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAG7E;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;;IAE3B,YAAY,MAAM,EAAE,KAAK,EAExB;IAEK,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAGhE;IAED,4CAA4C;IACtC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAO/E;CACF"}

package/dist/resources/reads.js

@@ -0,0 +1,91 @@
+import { callArgs, enc, listPath } from "./shared.js";
+// RepositoryBindings: the external repositories a project's coding sessions attach (spec §30.1).
+export class RepositoryBindings {
+    #client;
+    constructor(client) {
+        this.#client = client;
+    }
+    async list(params = {}, options = {}) {
+        const r = await this.#client.request("GET", listPath("/v1/repository-bindings", params), callArgs(options));
+        return r.body;
+    }
+    async retrieve(bindingID, options = {}) {
+        const r = await this.#client.request("GET", `/v1/repository-bindings/${enc(bindingID)}`, callArgs(options));
+        return r.body;
+    }
+}
+// Tools: the extensibility tool lineages + the named tool-sets (spec §20.2, §28.2-28.4).
+export class Tools {
+    #client;
+    constructor(client) {
+        this.#client = client;
+    }
+    async list(params = {}, options = {}) {
+        const r = await this.#client.request("GET", listPath("/v1/tools", params), callArgs(options));
+        return r.body;
+    }
+    async retrieve(toolID, options = {}) {
+        const r = await this.#client.request("GET", `/v1/tools/${enc(toolID)}`, callArgs(options));
+        return r.body;
+    }
+    // listSets pages the named tool-sets (GET /v1/tool-sets).
+    async listSets(params = {}, options = {}) {
+        const r = await this.#client.request("GET", listPath("/v1/tool-sets", params), callArgs(options));
+        return r.body;
+    }
+}
+// MCPConnections: the admin-registered upstream MCP servers (spec §28.13-28.14). Read-only here — the
+// register/discover writes are the admin-only management surface, not this parity task.
+export class MCPConnections {
+    #client;
+    constructor(client) {
+        this.#client = client;
+    }
+    async list(params = {}, options = {}) {
+        const r = await this.#client.request("GET", listPath("/v1/mcp-connections", params), callArgs(options));
+        return r.body;
+    }
+    async retrieve(connectionID, options = {}) {
+        const r = await this.#client.request("GET", `/v1/mcp-connections/${enc(connectionID)}`, callArgs(options));
+        return r.body;
+    }
+}
+// Triggers: the automation triggers read surface (spec §20.2.2).
+export class Triggers {
+    #client;
+    constructor(client) {
+        this.#client = client;
+    }
+    async list(params = {}, options = {}) {
+        const r = await this.#client.request("GET", listPath("/v1/triggers", params), callArgs(options));
+        return r.body;
+    }
+    async retrieve(triggerID, options = {}) {
+        const r = await this.#client.request("GET", `/v1/triggers/${enc(triggerID)}`, callArgs(options));
+        return r.body;
+    }
+}
+/**
+ * The model providers this project can route to, and the models each one offers.
+ *
+ * ‼️ THIS IS THE ONLY SOURCE OF A MODEL LIST. The engine has no `GET /v1/models` — it answers 404
+ * (measured 2026-08-26). Models are reachable only THROUGH a connection, which is the honest shape:
+ * a model id means nothing without the provider serving it, and the same name can be offered by two
+ * connections with different credentials and different limits.
+ */
+export class ModelConnections {
+    #client;
+    constructor(client) {
+        this.#client = client;
+    }
+    async list(options = {}) {
+        const r = await this.#client.request("GET", "/v1/model-connections", callArgs(options));
+        return r.body.data;
+    }
+    /** The model ids this connection offers. */
+    async models(connectionID, options = {}) {
+        const r = await this.#client.request("GET", `/v1/model-connections/${enc(connectionID)}/models`, callArgs(options));
+        return r.body.data.map((m) => m.id);
+    }
+}
+//# sourceMappingURL=reads.js.map

package/dist/resources/reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reads.js","sourceRoot":"","sources":["../../src/resources/reads.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAgD,MAAM,aAAa,CAAC;AAepG,iGAAiG;AACjG,MAAM,OAAO,kBAAkB;IAC7B,OAAO,CAAQ;IACf,YAAY,MAAa;QACvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAM,GAAe,EAAE,EAAE,OAAO,GAAgB,EAAE;QAC3D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAA0B,KAAK,EAAE,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACrI,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,OAAO,GAAgB,EAAE;QACzD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAoB,KAAK,EAAE,2BAA2B,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/H,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,OAAO,KAAK;IAChB,OAAO,CAAQ;IACf,YAAY,MAAa;QACvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAM,GAAe,EAAE,EAAE,OAAO,GAAgB,EAAE;QAC3D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAa,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1G,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,OAAO,GAAgB,EAAE;QACtD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAO,KAAK,EAAE,aAAa,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjG,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IACD,0DAA0D;IAC1D,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAe,EAAE,EAAE,OAAO,GAAgB,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAgB,KAAK,EAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjH,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;CACF;AAED,sGAAsG;AACtG,wFAAwF;AACxF,MAAM,OAAO,cAAc;IACzB,OAAO,CAAQ;IACf,YAAY,MAAa;QACvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAM,GAAe,EAAE,EAAE,OAAO,GAAgB,EAAE;QAC3D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAsB,KAAK,EAAE,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7H,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,YAAoB,EAAE,OAAO,GAAgB,EAAE;QAC5D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAgB,KAAK,EAAE,uBAAuB,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1H,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;CACF;AAED,iEAAiE;AACjE,MAAM,OAAO,QAAQ;IACnB,OAAO,CAAQ;IACf,YAAY,MAAa;QACvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAM,GAAe,EAAE,EAAE,OAAO,GAAgB,EAAE;QAC3D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAgB,KAAK,EAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAChH,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,OAAO,GAAgB,EAAE;QACzD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAU,KAAK,EAAE,gBAAgB,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1G,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IAC3B,OAAO,CAAQ;IACf,YAAY,MAAa;QACvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAO,GAAgB,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAA8B,KAAK,EAAE,uBAAuB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACrH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,MAAM,CAAC,YAAoB,EAAE,OAAO,GAAgB,EAAE;QAC1D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAClC,KAAK,EACL,yBAAyB,GAAG,CAAC,YAAY,CAAC,SAAS,EACnD,QAAQ,CAAC,OAAO,CAAC,CAClB,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/resources/responses.d.ts

@@ -0,0 +1,70 @@
+import type { JSONSchema } from "../schema.ts";
+import type { Response as PalaiResponse, ResponseCreateRequest } from "../generated/types.ts";
+import type { Palai } from "../client.ts";
+import { ResponseStream } from "../stream.ts";
+import { type ListParams, type Page } from "./shared.ts";
+export interface CreateOptions {
+    /** Override the auto-generated stable idempotency key (e.g. to dedupe across processes). */
+    idempotencyKey?: string;
+    signal?: AbortSignal | undefined;
+    timeoutMs?: number;
+    maxRetries?: number;
+}
+export interface RetrieveOptions {
+    signal?: AbortSignal | undefined;
+    timeoutMs?: number;
+    maxRetries?: number;
+}
+/** Options for `run` — everything `create` takes, plus how long to wait. */
+export interface RunOptions extends StreamOptions {
+    /** How long to wait for a terminal event. Default 300_000 ms.
+     *  The engine can hold a run in `waiting` while it provisions a machine, so this is a real
+     *  bound: a measurement saw a run still `waiting` after 45 seconds. */
+    deadlineMs?: number;
+}
+/** Options for `parse` — the output contract plus the usual run knobs. */
+export interface ParseOptions extends RunOptions {
+    schema: JSONSchema;
+    /** A name for the schema, forwarded to providers that require one. */
+    name: string;
+    model?: string;
+    effort?: string;
+}
+/** One tool the agent called, with what it was given and what came back.
+ *
+ *  ‼️ READ `succeeded`, NEVER `state`. The two answer different questions and a live run proved
+ *  they disagree: the journal emitted `tool_call.completed.v1` while this record carried
+ *  `result.status: "error"`. `state` says the call FINISHED; `result.status` says whether it
+ *  WORKED. `succeeded` is `undefined` when the server has not said yet — unknown is not failure. */
+export interface ToolCall {
+    id: string;
+    name: string;
+    state: string;
+    arguments: Record<string, unknown>;
+    result?: {
+        status?: string;
+        error?: {
+            code?: string;
+            message?: string;
+        };
+    };
+    replay_class?: string;
+    succeeded?: boolean | undefined;
+}
+export interface StreamOptions extends CreateOptions {
+    /** Resume a prior stream from this cursor instead of the beginning. */
+    lastEventId?: string | null;
+}
+export declare class Responses {
+    #private;
+    constructor(client: Palai);
+    create(request: ResponseCreateRequest, options?: CreateOptions): Promise<PalaiResponse>;
+    retrieve(responseID: string, options?: RetrieveOptions): Promise<PalaiResponse>;
+    list(params?: ListParams, options?: RetrieveOptions): Promise<Page<PalaiResponse>>;
+    cancel(responseID: string, options?: RetrieveOptions): Promise<void>;
+    run(request: ResponseCreateRequest, options?: RunOptions): Promise<PalaiResponse>;
+    parse<T>(prompt: string, options: ParseOptions): Promise<T>;
+    toolCalls(responseID: string, options?: RetrieveOptions): Promise<ToolCall[]>;
+    stream(request: ResponseCreateRequest, options?: StreamOptions): ResponseStream;
+}
+//# sourceMappingURL=responses.d.ts.map

package/dist/resources/responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../src/resources/responses.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,KAAK,EAAE,QAAQ,IAAI,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAA2B,KAAK,UAAU,EAAE,KAAK,IAAI,EAAE,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C;;2EAEuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,MAAM,EAAE,UAAU,CAAC;IACnB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;oGAKoG;AACpG,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAeD,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAGD,qBAAa,SAAS;;IAGpB,YAAY,MAAM,EAAE,KAAK,EAExB;IAMK,MAAM,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,CAShG;IAKK,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAWxF;IAIK,IAAI,CAAC,MAAM,GAAE,UAAe,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAG/F;IAGK,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM7E;IAUK,GAAG,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,GAAE,UAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAoB1F;IAUK,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAiBhE;IAIK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAOtF;IAMD,MAAM,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,GAAE,aAAkB,GAAG,cAAc,CAalF;CACF"}

package/dist/resources/responses.js

@@ -0,0 +1,147 @@
+import { randomUUID } from "node:crypto";
+import { ResponseStream } from "../stream.js";
+import { PalaiConnectionError } from "../errors.js";
+import { callArgs, enc, listPath } from "./shared.js";
+function withSuccess(call) {
+    const status = call.result?.status;
+    return { ...call, succeeded: status === undefined ? undefined : status === "ok" };
+}
+/** The model's text, joined across every message part of the output.
+ *  `content` is not a declared field of the content-item schema — that schema fixes only the
+ *  `type` discriminator — so it arrives as an open field. Reading it is what an open union means. */
+function responseText(response) {
+    const output = response.output ?? [];
+    return output.map((part) => (typeof part.content === "string" ? part.content : "")).join("");
+}
+// Responses is the /v1/responses resource group: create, retrieve, cancel, and stream.
+export class Responses {
+    #client;
+    constructor(client) {
+        this.#client = client;
+    }
+    // create posts a new response and returns the queued Response handle from the 202 body
+    // (its id, session_id, and run_id). A stable Idempotency-Key is minted once per call and
+    // reused across transport retries, so a retried create settles exactly one response; pass
+    // options.idempotencyKey to supply your own.
+    async create(request, options = {}) {
+        const result = await this.#client.request("POST", "/v1/responses", {
+            body: request,
+            idempotencyKey: options.idempotencyKey ?? newIdempotencyKey(),
+            signal: options.signal,
+            ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+            ...(options.maxRetries !== undefined ? { maxRetries: options.maxRetries } : {}),
+        });
+        return result.body;
+    }
+    // retrieve reads a stored response, including its model and, on a failed terminal, the
+    // problem-shaped error. A 404 throws NotFoundError; a 410 (retention-purged) throws
+    // GoneError.
+    async retrieve(responseID, options = {}) {
+        const result = await this.#client.request("GET", `/v1/responses/${encodeURIComponent(responseID)}`, {
+            signal: options.signal,
+            ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+            ...(options.maxRetries !== undefined ? { maxRetries: options.maxRetries } : {}),
+        });
+        return result.body;
+    }
+    // list returns a tenant-scoped page of run history (GET /v1/responses, E13 T4), with the shared
+    // opaque cursor and the basic filters (?status=, created_at bounds).
+    async list(params = {}, options = {}) {
+        const result = await this.#client.request("GET", listPath("/v1/responses", params), callArgs(options));
+        return result.body;
+    }
+    // cancel requests best-effort cancellation of an in-flight response (accepted as 202).
+    async cancel(responseID, options = {}) {
+        await this.#client.request("POST", `/v1/responses/${encodeURIComponent(responseID)}/cancel`, {
+            signal: options.signal,
+            ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+            ...(options.maxRetries !== undefined ? { maxRetries: options.maxRetries } : {}),
+        });
+    }
+    // run drives one turn and returns it FINISHED — the shape both OpenAI and Anthropic give their
+    // `create()`. Palai's own create answers 202 with a queued handle (the engine is genuinely
+    // asynchronous), so the waiting lives here rather than being hidden inside `create`.
+    //
+    // ‼️ IT DOES NOT POLL. The journal already announces the terminal state; asking the same question
+    // on a timer would be asking a server that is already answering. Neither vendor offers a poll
+    // helper on this path — OpenAI's `_and_poll` methods exist only on the deprecated Assistants
+    // surface, Vector Stores and Videos.
+    async run(request, options = {}) {
+        const deadlineMs = options.deadlineMs ?? 300_000;
+        const stream = this.stream(request, options);
+        let timer;
+        const expiry = new Promise((resolve) => {
+            timer = setTimeout(() => resolve(null), deadlineMs);
+        });
+        try {
+            const settled = await Promise.race([stream.finalResponse(), expiry]);
+            if (settled !== null)
+                return settled;
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+        // The deadline won. Ask the server where the run actually is: one request turns "something
+        // went wrong" into a status the caller can act on.
+        const id = stream.responseID ?? "(unknown)";
+        const latest = await this.retrieve(id);
+        throw new PalaiConnectionError(`response ${id} did not reach a terminal state within ${deadlineMs}ms (last seen: ${latest.status})`);
+    }
+    // parse drives one turn under a JSON-Schema output contract and returns the decoded value.
+    //
+    // The name is `parse` because that is what BOTH vendors call this: OpenAI's
+    // `responses.parse(text_format:)` and Anthropic's `messages.parse()`.
+    //
+    // ‼️ THE SCHEMA IS NOT VALIDATED HERE. The server reads `output.format` and answers 400 on a
+    // value it does not accept. A second validator in the SDK would be a second definition of
+    // "invalid", and the day the two disagree the caller cannot tell which one is right.
+    async parse(prompt, options) {
+        const request = {
+            input: prompt,
+            ...(options.model !== undefined ? { model: options.model } : {}),
+            ...(options.effort !== undefined ? { effort: options.effort } : {}),
+            output: { format: "json_schema", name: options.name, schema: options.schema },
+        };
+        const response = await this.run(request, options);
+        const text = responseText(response);
+        try {
+            return JSON.parse(text);
+        }
+        catch (cause) {
+            // ‼️ THE RAW TEXT IS NOT IN THIS MESSAGE. A failed parse is exactly when the model output is
+            // least trustworthy and most likely to be pasted into a log; the error says what was expected
+            // without carrying the payload.
+            throw new PalaiConnectionError(`response ${response.id}: the model's output did not parse as JSON`, { cause });
+        }
+    }
+    // toolCalls reads the AUTHORITATIVE record of what the agent did — arguments AND results.
+    // The event stream carries neither: its payload is only {run_id, tool_call_id, tool_name}.
+    async toolCalls(responseID, options = {}) {
+        const r = await this.#client.request("GET", `/v1/responses/${enc(responseID)}/tool-calls`, callArgs(options));
+        return r.body.data.map(withSuccess);
+    }
+    // stream creates a response and returns a resumable, typed event stream over its session.
+    // It returns synchronously; the create fires lazily on first consumption. The stream
+    // reconnects with Last-Event-ID on a drop, and stream.finalResponse() resolves the
+    // canonical terminal Response.
+    stream(request, options = {}) {
+        return new ResponseStream({
+            transport: this.#client,
+            start: async () => {
+                const created = await this.create(request, options);
+                return {
+                    responseID: String(created.id),
+                    sessionID: String(created.session_id ?? ""),
+                };
+            },
+            signal: options.signal,
+            lastEventId: options.lastEventId ?? null,
+        });
+    }
+}
+// newIdempotencyKey mints a fresh, collision-resistant key for one logical create.
+function newIdempotencyKey() {
+    return `idem_${randomUUID()}`;
+}
+//# sourceMappingURL=responses.js.map

package/dist/resources/responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.js","sourceRoot":"","sources":["../../src/resources/responses.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAA8B,MAAM,aAAa,CAAC;AAiDlF,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;IACnC,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;AACpF,CAAC;AAED;;qGAEqG;AACrG,SAAS,YAAY,CAAC,QAAuB;IAC3C,MAAM,MAAM,GAAI,QAA4D,CAAC,MAAM,IAAI,EAAE,CAAC;IAC1F,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/F,CAAC;AAOD,uFAAuF;AACvF,MAAM,OAAO,SAAS;IACpB,OAAO,CAAQ;IAEf,YAAY,MAAa;QACvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,uFAAuF;IACvF,yFAAyF;IACzF,0FAA0F;IAC1F,6CAA6C;IAC7C,KAAK,CAAC,MAAM,CAAC,OAA8B,EAAE,OAAO,GAAkB,EAAE;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAgB,MAAM,EAAE,eAAe,EAAE;YAChF,IAAI,EAAE,OAAO;YACb,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,iBAAiB,EAAE;YAC7D,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,uFAAuF;IACvF,oFAAoF;IACpF,aAAa;IACb,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,OAAO,GAAoB,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CACvC,KAAK,EACL,iBAAiB,kBAAkB,CAAC,UAAU,CAAC,EAAE,EACjD;YACE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CACF,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,gGAAgG;IAChG,qEAAqE;IACrE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAe,EAAE,EAAE,OAAO,GAAoB,EAAE;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAsB,KAAK,EAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5H,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,OAAO,GAAoB,EAAE;QAC5D,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAU,MAAM,EAAE,iBAAiB,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE;YACpG,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;IACL,CAAC;IAED,+FAA+F;IAC/F,2FAA2F;IAC3F,qFAAqF;IACrF,EAAE;IACF,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,qCAAqC;IACrC,KAAK,CAAC,GAAG,CAAC,OAA8B,EAAE,OAAO,GAAe,EAAE;QAChE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,KAAgD,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC3C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACrE,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC;QACvC,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,2FAA2F;QAC3F,mDAAmD;QACnD,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,WAAW,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,IAAI,oBAAoB,CAC5B,YAAY,EAAE,0CAA0C,UAAU,kBAAkB,MAAM,CAAC,MAAM,GAAG,CACrG,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,EAAE;IACF,6FAA6F;IAC7F,0FAA0F;IAC1F,qFAAqF;IACrF,KAAK,CAAC,KAAK,CAAI,MAAc,EAAE,OAAqB;QAClD,MAAM,OAAO,GAAG;YACd,KAAK,EAAE,MAAM;YACb,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;SAC1C,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6FAA6F;YAC7F,8FAA8F;YAC9F,gCAAgC;YAChC,MAAM,IAAI,oBAAoB,CAAC,YAAY,QAAQ,CAAC,EAAE,4CAA4C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,2FAA2F;IAC3F,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,OAAO,GAAoB,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAClC,KAAK,EACL,iBAAiB,GAAG,CAAC,UAAU,CAAC,aAAa,EAC7C,QAAQ,CAAC,OAAO,CAAC,CAClB,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED,0FAA0F;IAC1F,qFAAqF;IACrF,mFAAmF;IACnF,+BAA+B;IAC/B,MAAM,CAAC,OAA8B,EAAE,OAAO,GAAkB,EAAE;QAChE,OAAO,IAAI,cAAc,CAAC;YACxB,SAAS,EAAE,IAAI,CAAC,OAAO;YACvB,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpD,OAAO;oBACL,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC9B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;iBAC5C,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;SACzC,CAAC,CAAC;IACL,CAAC;CACF;AAED,mFAAmF;AACnF,SAAS,iBAAiB;IACxB,OAAO,QAAQ,UAAU,EAAE,EAAE,CAAC;AAChC,CAAC"}

package/dist/resources/secret-refs.d.ts

@@ -0,0 +1,24 @@
+import type { Palai } from "../client.ts";
+import { type CallOptions, type ListView } from "./shared.ts";
+export interface SecretRef {
+    name: string;
+    version: number;
+    object: string;
+    [key: string]: unknown;
+}
+export interface SecretRefCreateParams {
+    name: string;
+    value: string;
+}
+export interface SecretRefRotateParams {
+    value: string;
+}
+export declare class SecretRefs {
+    #private;
+    constructor(client: Palai);
+    create(params: SecretRefCreateParams, options?: CallOptions): Promise<SecretRef>;
+    list(options?: CallOptions): Promise<ListView<SecretRef>>;
+    retrieve(name: string, options?: CallOptions): Promise<SecretRef>;
+    rotate(name: string, params: SecretRefRotateParams, options?: CallOptions): Promise<SecretRef>;
+}
+//# sourceMappingURL=secret-refs.d.ts.map

package/dist/resources/secret-refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-refs.d.ts","sourceRoot":"","sources":["../../src/resources/secret-refs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAiB,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK7E,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AACD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AAKD,qBAAa,UAAU;;IAErB,YAAY,MAAM,EAAE,KAAK,EAExB;IAIK,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAGzF;IAGK,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAGlE;IAGK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAG1E;IAIK,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAGvG;CACF"}

package/dist/resources/secret-refs.js

@@ -0,0 +1,33 @@
+import { callArgs, enc } from "./shared.js";
+// SecretRefs is the restart-less secret-ref write-path (spec §39.x, E13 T3, SEC-002/MCI-002): a tenant
+// POSTs a write-only value the resolver reads fresh, so a rotation takes effect with no restart; reads
+// return metadata only. Requires a key with the `provision` capability.
+export class SecretRefs {
+    #client;
+    constructor(client) {
+        this.#client = client;
+    }
+    // create stores a new secret under a name (201). The response is metadata only — the value never
+    // comes back.
+    async create(params, options = {}) {
+        const r = await this.#client.request("POST", "/v1/secret-refs", { body: params, ...callArgs(options) });
+        return r.body;
+    }
+    // list returns the tenant's secret-ref metadata (names/versions), never values.
+    async list(options = {}) {
+        const r = await this.#client.request("GET", "/v1/secret-refs", callArgs(options));
+        return r.body;
+    }
+    // retrieve reads one secret-ref's metadata by name; an unknown name is a 404.
+    async retrieve(name, options = {}) {
+        const r = await this.#client.request("GET", `/v1/secret-refs/${enc(name)}`, callArgs(options));
+        return r.body;
+    }
+    // rotate inserts a new version for an existing name; rotating a never-created name is a 404. The new
+    // value takes effect with no restart.
+    async rotate(name, params, options = {}) {
+        const r = await this.#client.request("POST", `/v1/secret-refs/${enc(name)}/rotate`, { body: params, ...callArgs(options) });
+        return r.body;
+    }
+}
+//# sourceMappingURL=secret-refs.js.map

package/dist/resources/secret-refs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-refs.js","sourceRoot":"","sources":["../../src/resources/secret-refs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAmC,MAAM,aAAa,CAAC;AAoB7E,uGAAuG;AACvG,uGAAuG;AACvG,wEAAwE;AACxE,MAAM,OAAO,UAAU;IACrB,OAAO,CAAQ;IACf,YAAY,MAAa;QACvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,iGAAiG;IACjG,cAAc;IACd,KAAK,CAAC,MAAM,CAAC,MAA6B,EAAE,OAAO,GAAgB,EAAE;QACnE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAY,MAAM,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnH,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,IAAI,CAAC,OAAO,GAAgB,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAsB,KAAK,EAAE,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACvG,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,OAAO,GAAgB,EAAE;QACpD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAY,KAAK,EAAE,mBAAmB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1G,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,qGAAqG;IACrG,sCAAsC;IACtC,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,MAA6B,EAAE,OAAO,GAAgB,EAAE;QACjF,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAY,MAAM,EAAE,mBAAmB,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvI,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;CACF"}