@palai/sdk 0.1.0

package/dist/resources/sessions.d.ts

@@ -0,0 +1,106 @@
+import type { Command, Session } from "../generated/types.ts";
+import type { Palai } from "../client.ts";
+import { type CallOptions, type ListParams, type Page } from "./shared.ts";
+export interface SteerParams {
+    message: string;
+    commandId?: string;
+}
+export type InterruptParams = SteerParams;
+export interface SessionCreateParams {
+    name?: string;
+    /**
+     * The session's DEFAULT agent pin. Every run in this session inherits it and resolves it to that
+     * agent's currently PUBLISHED revision — so updating the agent reaches the next message. A run that
+     * names its own agent overrides it for that run.
+     *
+     * Accepts what defineAgent returned or a bare profile id, because a caller holding the first should
+     * not have to reach into it for the second. The object form is deliberately open — a PublishedAgent
+     * carries more than an id, and excess-property checking would reject the very value defineAgent hands
+     * back, which is the one this field exists to take.
+     */
+    agent?: {
+        id: string;
+        [key: string]: unknown;
+    } | string;
+    /**
+     * WHAT THIS SESSION RUNS ON. The model is chosen HERE — when the conversation starts — not when the
+     * agent was defined: an agent is an identity and a behaviour, and freezing a model into one would make
+     * "run this agent on a different model" mean "define a second agent". A single run may still name its
+     * own `model` for that one turn.
+     */
+    model?: string;
+    /**
+     * How hard the model thinks for this session, on the canonical ladder. A separate axis from `model`:
+     * keep the model and raise the effort, or the other way round.
+     *
+     * Which rungs a given model accepts is the PROVIDER's answer — Anthropic's ladder has no `none` or
+     * `minimal` — and the plane refuses a rung the routed model cannot express rather than quietly
+     * substituting a more expensive one.
+     */
+    effort?: Effort;
+}
+/**
+ * The canonical reasoning-effort ladder, ascending — as an OPEN set.
+ *
+ * ‼️ `(string & {})` IS NOT NOISE. It keeps the named rungs in autocomplete while letting an
+ * unknown one through, and the reason is measured: this ladder is not fixed. Anthropic's own rungs
+ * differ per model (`xhigh` arrived with Opus 4.7; Opus 4.5 accepts only low/medium/high), and its
+ * API declares `stop_details.category` "an open set" for the same reason. A closed union would make
+ * the server adding an eighth rung a COMPILE ERROR in every application already using this SDK —
+ * the one failure mode an SDK must never have.
+ */
+export type Effort = "none" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max" | (string & {});
+/**
+ * SessionConfigParams changes what the REST of a session runs on.
+ *
+ * ‼️ EACH HALF IS INDEPENDENTLY OPTIONAL, AND THAT IS THE WHOLE SHAPE. Omitting a field leaves it exactly
+ * as it was — so raising the effort cannot silently reset the model — while passing an EMPTY STRING is a
+ * real value that CLEARS that choice and returns the decision to the layers below (the agent revision,
+ * then the project's published model route).
+ *
+ * CHANGING EITHER NEVER INTERRUPTS A RUN IN FLIGHT. A run resolves its configuration at each model-step
+ * boundary, so a change made while the model is answering takes effect at the next step of that same turn,
+ * or at the next turn when the current one has no further step. Nothing is cancelled and no partial answer
+ * is discarded.
+ */
+export interface SessionConfigParams {
+    model?: string;
+    effort?: Effort | "";
+}
+export declare class SessionCommands {
+    #private;
+    constructor(client: Palai);
+    steer(sessionID: string, params: SteerParams, options?: CallOptions): Promise<Command>;
+    interrupt(sessionID: string, params: InterruptParams, options?: CallOptions): Promise<Command>;
+}
+export declare class Sessions {
+    #private;
+    readonly commands: SessionCommands;
+    constructor(client: Palai);
+    create(params?: SessionCreateParams, options?: CallOptions): Promise<Session>;
+    /**
+     * configure changes the model and/or the reasoning effort for the REST of this session, and returns the
+     * re-read session so the caller sees what is now in effect rather than what they asked for.
+     *
+     * ‼️ IT DOES NOT INTERRUPT A RUN IN FLIGHT. A run resolves its configuration at each model-step boundary,
+     * so a change made while the model is answering lands at the next step of that same turn — or at the
+     * next turn if the current one has no further step. The answer being produced is never discarded.
+     *
+     * Omitting a field leaves it alone; passing an empty string CLEARS it and returns that decision to the
+     * layers below. Reading it back is `retrieve`, which renders both unconditionally, so a caller never has
+     * to keep its own copy of what the session is running on.
+     *
+     *     await palai.sessions.configure(id, { model: "claude-sonnet-5" });   // keep the effort
+     *     await palai.sessions.configure(id, { effort: "xhigh" });            // keep the model
+     *     await palai.sessions.configure(id, { effort: "" });                 // back to the layers below
+     */
+    configure(sessionID: string, params: SessionConfigParams, options?: CallOptions): Promise<Session>;
+    rename(sessionID: string, name: string, options?: CallOptions): Promise<Session>;
+    setAutoApprove(sessionID: string, params: {
+        tools?: boolean;
+        publications?: boolean;
+    }, options?: CallOptions): Promise<Session>;
+    retrieve(sessionID: string, options?: CallOptions): Promise<Session>;
+    list(params?: ListParams, options?: CallOptions): Promise<Page<Session>>;
+}
+//# sourceMappingURL=sessions.d.ts.map

package/dist/resources/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/resources/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAA2B,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,IAAI,EAAE,MAAM,aAAa,CAAC;AAMpG,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AACD,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC;AAI1C,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC;IACxD;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEtG;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC;CACtB;AAMD,qBAAa,eAAe;;IAE1B,YAAY,MAAM,EAAE,KAAK,EAExB;IAKD,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzF;IAID,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjG;CAiBF;AAGD,qBAAa,QAAQ;;IAEnB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,YAAY,MAAM,EAAE,KAAK,EAGxB;IAKK,MAAM,CAAC,MAAM,GAAE,mBAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAwB1F;IAED;;;;;;;;;;;;;;;OAeG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmB3G;IASK,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAUzF;IAaK,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,EACnD,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAWlB;IAIK,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAG7E;IAGK,IAAI,CAAC,MAAM,GAAE,UAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAGrF;CACF"}

package/dist/resources/sessions.js

@@ -0,0 +1,161 @@
+import { randomUUID } from "node:crypto";
+import { callArgs, enc, listPath } from "./shared.js";
+// SessionCommands is the durable command surface of a session (spec §9.2, §22.4) — E08's steering
+// product, used from the SDK for the first time. steer and interrupt are both send_message
+// deliveries; the delivery mode is the only difference (queue is the default fire path and not
+// exposed here — the plan asks for steer + interrupt).
+export class SessionCommands {
+    #client;
+    constructor(client) {
+        this.#client = client;
+    }
+    // steer delivers a message at the next safe boundary WITHOUT interrupting the current step
+    // (delivery=steer). Acceptance is durable-queued (202), not applied; the returned Command is the
+    // queued handle, or — on a duplicate command_id — the original unchanged (idempotent).
+    steer(sessionID, params, options = {}) {
+        return this.#send(sessionID, "steer", params, options);
+    }
+    // interrupt delivers a message that preempts the current step (delivery=interrupt). Same durable,
+    // idempotent acceptance as steer.
+    interrupt(sessionID, params, options = {}) {
+        return this.#send(sessionID, "interrupt", params, options);
+    }
+    async #send(sessionID, delivery, params, options) {
+        const body = {
+            command_id: params.commandId ?? newCommandId(),
+            kind: "send_message",
+            delivery,
+            message: params.message,
+        };
+        const result = await this.#client.request("POST", `/v1/sessions/${enc(sessionID)}/commands`, {
+            body,
+            // command_id carries idempotency server-side, so a network re-send settles exactly one command.
+            idempotent: true,
+            ...callArgs(options),
+        });
+        return result.body;
+    }
+}
+// Sessions is the /v1/sessions resource: create, retrieve, list, and the durable command surface.
+export class Sessions {
+    #client;
+    commands;
+    constructor(client) {
+        this.#client = client;
+        this.commands = new SessionCommands(client);
+    }
+    // create opens a standalone session (201). Creation is cheap and unkeyed — a retried create mints
+    // a new session — so it carries no idempotency key. `name` is the optional display label; without
+    // one the session's projection derives a label from its first prompt (see `rename`).
+    async create(params = {}, options = {}) {
+        const { agent, name, model, effort } = params;
+        const body = {};
+        if (name !== undefined) {
+            body.name = name;
+        }
+        if (agent !== undefined) {
+            body.agent_id = typeof agent === "string" ? agent : agent.id;
+        }
+        if (model !== undefined) {
+            body.model = model;
+        }
+        if (effort !== undefined) {
+            body.effort = effort;
+        }
+        const args = callArgs(options);
+        // A create with NOTHING to say still sends no body — the pre-existing bodyless call, unchanged, so a
+        // caller who passed no params keeps the exact request they had.
+        const result = await this.#client.request("POST", "/v1/sessions", Object.keys(body).length === 0 ? args : { body, ...args });
+        return result.body;
+    }
+    /**
+     * configure changes the model and/or the reasoning effort for the REST of this session, and returns the
+     * re-read session so the caller sees what is now in effect rather than what they asked for.
+     *
+     * ‼️ IT DOES NOT INTERRUPT A RUN IN FLIGHT. A run resolves its configuration at each model-step boundary,
+     * so a change made while the model is answering lands at the next step of that same turn — or at the
+     * next turn if the current one has no further step. The answer being produced is never discarded.
+     *
+     * Omitting a field leaves it alone; passing an empty string CLEARS it and returns that decision to the
+     * layers below. Reading it back is `retrieve`, which renders both unconditionally, so a caller never has
+     * to keep its own copy of what the session is running on.
+     *
+     *     await palai.sessions.configure(id, { model: "claude-sonnet-5" });   // keep the effort
+     *     await palai.sessions.configure(id, { effort: "xhigh" });            // keep the model
+     *     await palai.sessions.configure(id, { effort: "" });                 // back to the layers below
+     */
+    async configure(sessionID, params, options = {}) {
+        const body = {};
+        if (params.model !== undefined) {
+            body.model = params.model;
+        }
+        if (params.effort !== undefined) {
+            body.effort = params.effort;
+        }
+        if (Object.keys(body).length === 0) {
+            // A PATCH that names neither would be refused by the plane as a request that lost its field, and a
+            // 400 for a call the caller could not have meant is worse than a local complaint.
+            throw new TypeError("sessions.configure requires at least one of `model` or `effort`");
+        }
+        const result = await this.#client.request("PATCH", `/v1/sessions/${enc(sessionID)}`, { body, ...callArgs(options) });
+        return result.body;
+    }
+    // rename sets a session's display label and returns the re-read session, so the caller sees both
+    // the label and the `name_source` that now reads "operator".
+    //
+    // This, and not the create-time name, is the call a session list needs: most sessions are never
+    // created through `create` at all — posting a response opens one implicitly — so they reach a list
+    // screen with no label to have been given one. Passing an EMPTY string is meaningful: it clears the
+    // operator label and returns the row to its derived one.
+    async rename(sessionID, name, options = {}) {
+        const result = await this.#client.request("PATCH", `/v1/sessions/${enc(sessionID)}`, {
+            body: { name },
+            // Setting a label to X twice leaves it X, so a connection torn after the server committed is
+            // safe to re-send. That is a property of THIS call, not of PATCH, which is why it is declared
+            // here rather than in the transport's method table.
+            idempotent: true,
+            ...callArgs(options),
+        });
+        return result.body;
+    }
+    // setAutoApprove arms (or disarms) this session's STANDING authorization, and returns the re-read
+    // session so the caller sees `auto_approve_set_by` — the principal the server stamped from the verified
+    // key, which is who every auto-decision will be recorded AS.
+    //
+    // ‼️ IT ANSWERS APPROVALS, IT DOES NOT SKIP THEM. The control plane still writes the approval row and
+    // still decides it through the same throat a human's POST uses, so the approvals list still shows what
+    // ran and the approver policy still applies. Armed or not, `approvals.list()` is the record.
+    //
+    // TWO FLAGS AND NEVER ONE. A gated TOOL call lands in the run's own workspace while a human watches; a
+    // PUBLICATION writes to somebody's repository and outlives the session. Omitting a field leaves it as it
+    // was, so arming tools does not quietly arm publications.
+    async setAutoApprove(sessionID, params, options = {}) {
+        const body = {};
+        if (params.tools !== undefined)
+            body.auto_approve_tools = params.tools;
+        if (params.publications !== undefined)
+            body.auto_approve_publications = params.publications;
+        const result = await this.#client.request("PATCH", `/v1/sessions/${enc(sessionID)}`, {
+            body,
+            // Setting a standing flag to X twice leaves it X.
+            idempotent: true,
+            ...callArgs(options),
+        });
+        return result.body;
+    }
+    // retrieve reads a session within the verified scope; an unknown or foreign id is a 404
+    // (NotFoundError).
+    async retrieve(sessionID, options = {}) {
+        const result = await this.#client.request("GET", `/v1/sessions/${enc(sessionID)}`, callArgs(options));
+        return result.body;
+    }
+    // list returns a tenant-scoped page of sessions with the shared cursor + basic filters.
+    async list(params = {}, options = {}) {
+        const result = await this.#client.request("GET", listPath("/v1/sessions", params), callArgs(options));
+        return result.body;
+    }
+}
+function newCommandId() {
+    return `cmd_${randomUUID()}`;
+}
+//# sourceMappingURL=sessions.js.map

package/dist/resources/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/resources/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAgD,MAAM,aAAa,CAAC;AA2EpG,kGAAkG;AAClG,2FAA2F;AAC3F,+FAA+F;AAC/F,uDAAuD;AACvD,MAAM,OAAO,eAAe;IAC1B,OAAO,CAAQ;IACf,YAAY,MAAa;QACvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,2FAA2F;IAC3F,iGAAiG;IACjG,uFAAuF;IACvF,KAAK,CAAC,SAAiB,EAAE,MAAmB,EAAE,OAAO,GAAgB,EAAE;QACrE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,kGAAkG;IAClG,kCAAkC;IAClC,SAAS,CAAC,SAAiB,EAAE,MAAuB,EAAE,OAAO,GAAgB,EAAE;QAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,QAA+B,EAAE,MAAmB,EAAE,OAAoB;QACvG,MAAM,IAAI,GAAyB;YACjC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,YAAY,EAAE;YAC9C,IAAI,EAAE,cAAc;YACpB,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAU,MAAM,EAAE,gBAAgB,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;YACpG,IAAI;YACJ,gGAAgG;YAChG,UAAU,EAAE,IAAI;YAChB,GAAG,QAAQ,CAAC,OAAO,CAAC;SACrB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,OAAO,QAAQ;IACnB,OAAO,CAAQ;IACN,QAAQ,CAAkB;IAEnC,YAAY,MAAa;QACvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,kGAAkG;IAClG,kGAAkG;IAClG,qFAAqF;IACrF,KAAK,CAAC,MAAM,CAAC,MAAM,GAAwB,EAAE,EAAE,OAAO,GAAgB,EAAE;QACtE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC9C,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,qGAAqG;QACrG,gEAAgE;QAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CACvC,MAAM,EACN,cAAc,EACd,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAC1D,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,MAA2B,EAAE,OAAO,GAAgB,EAAE;QACvF,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,mGAAmG;YACnG,kFAAkF;YAClF,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CACvC,OAAO,EACP,gBAAgB,GAAG,CAAC,SAAS,CAAC,EAAE,EAChC,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAC/B,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,iGAAiG;IACjG,6DAA6D;IAC7D,EAAE;IACF,gGAAgG;IAChG,mGAAmG;IACnG,oGAAoG;IACpG,yDAAyD;IACzD,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,IAAY,EAAE,OAAO,GAAgB,EAAE;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAU,OAAO,EAAE,gBAAgB,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE;YAC5F,IAAI,EAAE,EAAE,IAAI,EAAE;YACd,6FAA6F;YAC7F,8FAA8F;YAC9F,oDAAoD;YACpD,UAAU,EAAE,IAAI;YAChB,GAAG,QAAQ,CAAC,OAAO,CAAC;SACrB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,kGAAkG;IAClG,wGAAwG;IACxG,6DAA6D;IAC7D,EAAE;IACF,sGAAsG;IACtG,uGAAuG;IACvG,6FAA6F;IAC7F,EAAE;IACF,uGAAuG;IACvG,yGAAyG;IACzG,0DAA0D;IAC1D,KAAK,CAAC,cAAc,CAClB,SAAiB,EACjB,MAAmD,EACnD,OAAO,GAAgB,EAAE;QAEzB,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,KAAK,CAAC;QACvE,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,yBAAyB,GAAG,MAAM,CAAC,YAAY,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAU,OAAO,EAAE,gBAAgB,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE;YAC5F,IAAI;YACJ,kDAAkD;YAClD,UAAU,EAAE,IAAI;YAChB,GAAG,QAAQ,CAAC,OAAO,CAAC;SACrB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,wFAAwF;IACxF,mBAAmB;IACnB,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,OAAO,GAAgB,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAU,KAAK,EAAE,gBAAgB,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/G,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,IAAI,CAAC,MAAM,GAAe,EAAE,EAAE,OAAO,GAAgB,EAAE;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAgB,KAAK,EAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACrH,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF;AAED,SAAS,YAAY;IACnB,OAAO,OAAO,UAAU,EAAE,EAAE,CAAC;AAC/B,CAAC"}

package/dist/resources/shared.d.ts

@@ -0,0 +1,31 @@
+import type { RequestOptions } from "../client.ts";
+export interface CallOptions {
+    signal?: AbortSignal | undefined;
+    timeoutMs?: number;
+    maxRetries?: number;
+}
+export interface DownloadOptions {
+    signal?: AbortSignal | undefined;
+    timeoutMs?: number;
+}
+export interface ListParams {
+    after?: string;
+    limit?: number;
+    status?: string;
+    createdAfter?: string;
+    createdBefore?: string;
+}
+export interface Page<T> {
+    data: T[];
+    has_more: boolean;
+    next_cursor?: string | null;
+    previous_cursor?: string | null;
+}
+export interface ListView<T> {
+    object: string;
+    data: T[];
+}
+export declare function callArgs(options?: CallOptions): RequestOptions;
+export declare function listPath(path: string, params?: ListParams): string;
+export declare function enc(segment: string): string;
+//# sourceMappingURL=shared.d.ts.map

package/dist/resources/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/resources/shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AASnD,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAOD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAKD,MAAM,WAAW,IAAI,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAID,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,CAAC,EAAE,CAAC;CACX;AAID,wBAAgB,QAAQ,CAAC,OAAO,GAAE,WAAgB,GAAG,cAAc,CAKlE;AAID,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,UAAe,GAAG,MAAM,CAStE;AAGD,wBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3C"}

package/dist/resources/shared.js

@@ -0,0 +1,32 @@
+// callArgs projects CallOptions onto the client's RequestOptions, dropping absent numeric fields so
+// exactOptionalPropertyTypes stays satisfied (a bare `timeoutMs: undefined` is not assignable).
+export function callArgs(options = {}) {
+    const out = { signal: options.signal };
+    if (options.timeoutMs !== undefined)
+        out.timeoutMs = options.timeoutMs;
+    if (options.maxRetries !== undefined)
+        out.maxRetries = options.maxRetries;
+    return out;
+}
+// listPath appends the shared list query to a path. Absent params add no key, so a bare list() sends
+// a clean path; a present param is URL-encoded by URLSearchParams.
+export function listPath(path, params = {}) {
+    const query = new URLSearchParams();
+    if (params.after !== undefined)
+        query.set("after", params.after);
+    if (params.limit !== undefined)
+        query.set("limit", String(params.limit));
+    if (params.status !== undefined)
+        query.set("status", params.status);
+    if (params.createdAfter !== undefined)
+        query.set("created_after", params.createdAfter);
+    if (params.createdBefore !== undefined)
+        query.set("created_before", params.createdBefore);
+    const qs = query.toString();
+    return qs === "" ? path : `${path}?${qs}`;
+}
+// enc is the path-segment encoder every resource uses for ids (matches responses.ts).
+export function enc(segment) {
+    return encodeURIComponent(segment);
+}
+//# sourceMappingURL=shared.js.map

package/dist/resources/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/resources/shared.ts"],"names":[],"mappings":"AAsDA,oGAAoG;AACpG,gGAAgG;AAChG,MAAM,UAAU,QAAQ,CAAC,OAAO,GAAgB,EAAE;IAChD,MAAM,GAAG,GAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACvD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACvE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,mEAAmE;AACnE,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAM,GAAe,EAAE;IAC5D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACvF,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1F,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC5B,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,GAAG,CAAC,OAAe;IACjC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC"}

package/dist/resources/skills.d.ts

@@ -0,0 +1,40 @@
+import type { Palai } from "../client.ts";
+import { type CallOptions, type ListView } from "./shared.ts";
+export interface Skill {
+    id: string;
+    object: string;
+    [key: string]: unknown;
+}
+export interface SkillRevision {
+    id: string;
+    object: string;
+    /** quarantined | approved | enabled. A revision is not runnable until it is enabled. */
+    state?: string;
+    /** sha256 over the sanitized archive — what a run PINS, never "latest". */
+    digest?: string;
+    /** Static-scan hits keeping a revision quarantined: the rule and the path, never a captured value. */
+    scan_findings?: Array<{
+        kind?: string;
+        path?: string;
+        rule?: string;
+    }>;
+    [key: string]: unknown;
+}
+export interface SkillRevisionInstallParams {
+    /** Base64 of the skill archive. */
+    archive?: string;
+    /** A URL the control plane fetches. Vetted server-side; a private or loopback target is refused. */
+    source_url?: string;
+    [key: string]: unknown;
+}
+export declare class Skills {
+    #private;
+    constructor(client: Palai);
+    create(params: {
+        name: string;
+    }, options?: CallOptions): Promise<Skill>;
+    installRevision(skillID: string, params: SkillRevisionInstallParams, options?: CallOptions): Promise<SkillRevision>;
+    enable(skillID: string, revisionID: string, options?: CallOptions): Promise<SkillRevision>;
+    list(options?: CallOptions): Promise<ListView<Skill>>;
+}
+//# sourceMappingURL=skills.d.ts.map

package/dist/resources/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/resources/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAiB,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK7E,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAKD,MAAM,WAAW,0BAA0B;IACzC,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAUD,qBAAa,MAAM;;IAEjB,YAAY,MAAM,EAAE,KAAK,EAExB;IAIK,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,CAGhF;IAKK,eAAe,CACnB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,aAAa,CAAC,CAOxB;IAIK,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAOnG;IAGK,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAG9D;CACF"}

package/dist/resources/skills.js

@@ -0,0 +1,40 @@
+import { callArgs, enc } from "./shared.js";
+// Skills is the /v1/skills resource.
+//
+// ‼️ THE ENGINE FOR THIS HAS SHIPPED FOR A WHILE AND NOTHING COULD REACH IT. Installation, archive
+// sanitisation, the static scan, the quarantine lifecycle and the digest pin all existed; what was
+// missing was the half a customer installs. A skill nobody can install is a skill nobody has.
+//
+// A SKILL GRANTS NO CAPABILITY. Its metadata rides the run context and its body is read on demand — it
+// cannot let an agent call a tool it is not already permitted to use.
+export class Skills {
+    #client;
+    constructor(client) {
+        this.#client = client;
+    }
+    // create opens a named skill lineage. Like an agent profile it carries IDENTITY only: what the skill
+    // says lives on its revisions.
+    async create(params, options = {}) {
+        const r = await this.#client.request("POST", "/v1/skills", { body: params, ...callArgs(options) });
+        return r.body;
+    }
+    // installRevision adds a revision from an archive or a URL. It arrives QUARANTINED: the static scan
+    // runs first and a revision with findings stays unrunnable until they are resolved, so installing is
+    // never the same act as enabling.
+    async installRevision(skillID, params, options = {}) {
+        const r = await this.#client.request("POST", `/v1/skills/${enc(skillID)}/revisions`, { body: params, ...callArgs(options) });
+        return r.body;
+    }
+    // enable makes a revision runnable. Separate from install because they are separate decisions: one
+    // brings untrusted content into the tenant, the other lets a run read it.
+    async enable(skillID, revisionID, options = {}) {
+        const r = await this.#client.request("POST", `/v1/skills/${enc(skillID)}/revisions/${enc(revisionID)}/enable`, callArgs(options));
+        return r.body;
+    }
+    // list returns the tenant's skill lineages.
+    async list(options = {}) {
+        const r = await this.#client.request("GET", "/v1/skills", callArgs(options));
+        return r.body;
+    }
+}
+//# sourceMappingURL=skills.js.map

package/dist/resources/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/resources/skills.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAmC,MAAM,aAAa,CAAC;AAkC7E,qCAAqC;AACrC,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,8FAA8F;AAC9F,EAAE;AACF,uGAAuG;AACvG,sEAAsE;AACtE,MAAM,OAAO,MAAM;IACjB,OAAO,CAAQ;IACf,YAAY,MAAa;QACvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,qGAAqG;IACrG,+BAA+B;IAC/B,KAAK,CAAC,MAAM,CAAC,MAAwB,EAAE,OAAO,GAAgB,EAAE;QAC9D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAQ,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1G,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,oGAAoG;IACpG,qGAAqG;IACrG,kCAAkC;IAClC,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,MAAkC,EAClC,OAAO,GAAgB,EAAE;QAEzB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAClC,MAAM,EACN,cAAc,GAAG,CAAC,OAAO,CAAC,YAAY,EACtC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CACvC,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,mGAAmG;IACnG,0EAA0E;IAC1E,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,UAAkB,EAAE,OAAO,GAAgB,EAAE;QACzE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAClC,MAAM,EACN,cAAc,GAAG,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,UAAU,CAAC,SAAS,EAChE,QAAQ,CAAC,OAAO,CAAC,CAClB,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,IAAI,CAAC,OAAO,GAAgB,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAkB,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9F,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;CACF"}

package/dist/schema.d.ts

@@ -0,0 +1,35 @@
+/** A JSON Schema node the output contract will carry. */
+export type JSONSchema = {
+    type: "string" | "number" | "integer" | "boolean";
+} | {
+    type: "array";
+    items: JSONSchema;
+} | {
+    type: "object";
+    properties: Record<string, JSONSchema>;
+    required: string[];
+    additionalProperties: false;
+} | {
+    enum: string[];
+};
+/** Builders, so a schema reads as a schema rather than as a wall of braces. */
+export declare const s: {
+    string: {
+        readonly type: "string";
+    };
+    number: {
+        readonly type: "number";
+    };
+    integer: {
+        readonly type: "integer";
+    };
+    boolean: {
+        readonly type: "boolean";
+    };
+    array(items: JSONSchema): JSONSchema;
+    /** `additionalProperties` is always false: the server wants a strict schema, and an undeclared
+     *  field slipping through is the defect strictness exists to prevent. */
+    object(properties: Record<string, JSONSchema>, required: string[]): JSONSchema;
+    enum(values: string[]): JSONSchema;
+};
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAYA,yDAAyD;AACzD,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,oBAAoB,EAAE,KAAK,CAAA;CAAE,GAC3G;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvB,+EAA+E;AAC/E,eAAO,MAAM,CAAC;;uBACI,QAAQ;;;uBACR,QAAQ;;;uBACP,SAAS;;;uBACT,SAAS;;iBAEb,UAAU,GAAG,UAAU;IAIpC;6EACyE;uBACtD,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,YAAY,MAAM,EAAE,GAAG,UAAU;iBAIjE,MAAM,EAAE,GAAG,UAAU;CAGnC,CAAC"}

package/dist/schema.js

@@ -0,0 +1,30 @@
+// JSON Schema, written by the caller.
+//
+// ‼️ THERE IS NO ZOD DEPENDENCY HERE, AND THAT IS DELIBERATE. `@palai/sdk` ships with an empty
+// `dependencies` list, and a schema library is not worth ending that: every consumer would inherit
+// it, including ones that already use a different validator. OpenAI solves the same problem with an
+// optional subpath (`openai/helpers/zod`) that only works if you installed zod; this is the
+// zero-dependency half of that idea — you hand over a schema, and if you happen to use zod you can
+// produce one with `z.toJSONSchema(...)` yourself.
+//
+// The server is the only validator. `output.format` is READ: an unrecognised value answers 400
+// (measured 2026-08-26), so a second validator here would be a second definition of "invalid".
+/** Builders, so a schema reads as a schema rather than as a wall of braces. */
+export const s = {
+    string: { type: "string" },
+    number: { type: "number" },
+    integer: { type: "integer" },
+    boolean: { type: "boolean" },
+    array(items) {
+        return { type: "array", items };
+    },
+    /** `additionalProperties` is always false: the server wants a strict schema, and an undeclared
+     *  field slipping through is the defect strictness exists to prevent. */
+    object(properties, required) {
+        return { type: "object", properties, required: [...required].sort(), additionalProperties: false };
+    },
+    enum(values) {
+        return { enum: values };
+    },
+};
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,+FAA+F;AAC/F,mGAAmG;AACnG,oGAAoG;AACpG,4FAA4F;AAC5F,mGAAmG;AACnG,mDAAmD;AACnD,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAS/F,+EAA+E;AAC/E,MAAM,CAAC,MAAM,CAAC,GAAG;IACf,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAgC;IACxD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAgC;IACxD,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAgC;IAC1D,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAgC;IAE1D,KAAK,CAAC,KAAiB;QACrB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;6EACyE;IACzE,MAAM,CAAC,UAAsC,EAAE,QAAkB;QAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IACrG,CAAC;IAED,IAAI,CAAC,MAAgB;QACnB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF,CAAC"}

package/dist/server-only.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=server-only.d.ts.map

package/dist/server-only.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-only.d.ts","sourceRoot":"","sources":["../src/server-only.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,CAAC"}

package/dist/server-only.js

@@ -0,0 +1,22 @@
+// The API key path is server-only. Importing this module marks its importer as
+// server-only: if the module is ever evaluated in a browser bundle, it throws instead of
+// silently shipping the secret to the client. Bundlers that honor the package's "browser"
+// export condition never reach a credential module (they resolve ./index.browser, which
+// carries no key); this runtime check is the framework-agnostic backstop for bundlers and
+// runtimes that do not. It is a no-op in Node and other server runtimes, where there is no
+// window/document, so the SDK stays usable and unit-testable off any single framework.
+//
+// This is deliberately NOT the `server-only` npm package: that package throws on import in
+// plain Node (its default export throws outside the React `react-server` condition), which
+// would make the SDK Next.js-only and untestable in a Node test runner. A browser-shaped
+// global check gives the same protection without that coupling.
+const inBrowser = typeof globalThis.window !== "undefined" ||
+    typeof globalThis.document !== "undefined";
+if (inBrowser) {
+    throw new Error("@palai/sdk: a Palai client configured with an API key must never be bundled for the " +
+        "browser — that would ship your secret to every visitor. Import it only from server " +
+        "code (route handlers, server actions, server components), or use the browser-safe " +
+        "'@palai/sdk/browser' entrypoint, which carries no credential.");
+}
+export {};
+//# sourceMappingURL=server-only.js.map

package/dist/server-only.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-only.js","sourceRoot":"","sources":["../src/server-only.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,yFAAyF;AACzF,0FAA0F;AAC1F,wFAAwF;AACxF,0FAA0F;AAC1F,2FAA2F;AAC3F,uFAAuF;AACvF,EAAE;AACF,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,gEAAgE;AAEhE,MAAM,SAAS,GACb,OAAQ,UAAmC,CAAC,MAAM,KAAK,WAAW;IAClE,OAAQ,UAAqC,CAAC,QAAQ,KAAK,WAAW,CAAC;AAEzE,IAAI,SAAS,EAAE,CAAC;IACd,MAAM,IAAI,KAAK,CACb,sFAAsF;QACpF,qFAAqF;QACrF,oFAAoF;QACpF,+DAA+D,CAClE,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,CAAC"}

package/dist/stream.d.ts

@@ -0,0 +1,38 @@
+import type { Event, Response as PalaiResponse } from "./generated/types.ts";
+export interface SSEFrame {
+    id: string | undefined;
+    event: string | undefined;
+    data: string;
+}
+export declare function parseEventStream(body: ReadableStream<Uint8Array>): AsyncGenerator<SSEFrame>;
+export declare function isTerminalEvent(event: Event): boolean;
+export interface StreamTransport {
+    openEventStream(sessionID: string, lastEventId: string | null, signal: AbortSignal | undefined): Promise<globalThis.Response>;
+    retrieveResponse(responseID: string): Promise<PalaiResponse>;
+}
+export interface StreamStart {
+    responseID: string;
+    sessionID: string;
+}
+export interface ResponseStreamInit {
+    transport: StreamTransport;
+    /** Runs once, lazily, on first consumption — typically the create POST. */
+    start: () => Promise<StreamStart>;
+    signal?: AbortSignal | undefined;
+    lastEventId?: string | null;
+    maxReconnects?: number;
+    backoffBaseMs?: number;
+    backoffMaxMs?: number;
+}
+export declare class ResponseStream implements AsyncIterable<Event> {
+    #private;
+    constructor(init: ResponseStreamInit);
+    get responseID(): string | undefined;
+    get sessionID(): string | undefined;
+    get lastEventId(): string | null;
+    [Symbol.asyncIterator](): AsyncGenerator<Event>;
+    finalResponse(): Promise<PalaiResponse>;
+}
+export declare function fullJitterBackoff(attempt: number, baseMs: number, maxMs: number): number;
+export declare function delay(ms: number, signal?: AbortSignal | undefined): Promise<void>;
+//# sourceMappingURL=stream.d.ts.map

package/dist/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../src/stream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAM7E,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAOD,wBAAuB,gBAAgB,CACrC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,GAC/B,cAAc,CAAC,QAAQ,CAAC,CAkC1B;AA4CD,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAErD;AAKD,MAAM,WAAW,eAAe;IAC9B,eAAe,CACb,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,MAAM,EAAE,WAAW,GAAG,SAAS,GAC9B,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAChC,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC9D;AAKD,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,eAAe,CAAC;IAC3B,2EAA2E;IAC3E,KAAK,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD,qBAAa,cAAe,YAAW,aAAa,CAAC,KAAK,CAAC;;IAYzD,YAAY,IAAI,EAAE,kBAAkB,EAQnC;IAID,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IACD,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IAID,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IASD,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,CAM9C;IAMK,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,CAc5C;CA4GF;AAoCD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMxF;AAID,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBjF"}