@pstdio/pocketcoder-sdk 0.9.0 → 0.10.0

package/dist/index.js

@@ -1427,7 +1427,8 @@ z.object({ name: SecretNameSchema });
 const issuerUrl = z.url().refine((value) => {
 	if (!URL.canParse(value)) return false;
 	const url = new URL(value);
-	return url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash;
+	const clusterLocal = url.protocol === "http:" && url.hostname.endsWith(".svc.cluster.local");
+	return (url.protocol === "https:" || clusterLocal) && !url.username && !url.password && !url.search && !url.hash;
 });
 const IssuerConfigSchema = z.strictObject({
 	url: issuerUrl,
@@ -2514,7 +2515,8 @@ const TerminalSessionPageSchema = CursorPageSchema(TerminalSessionSchema);
 //#region ../contracts/src/protocol/protocol-credentials.ts
 const WorkspaceCredentialSchema = z.object({
 	lease_id: z.uuid(),
-	path: z.string().regex(/^\/run\/pocketcoder\/secrets\/leases\/[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/),
+	path: z.string().regex(/^\/run\/pocketcoder\/secrets\/leases\/(?:sessions\/[0-9a-f-]{36}\/)?[A-Za-z0-9][A-Za-z0-9_.%-]{0,127}$/),
+	session_id: z.uuid().optional(),
 	credential: z.string().min(1).max(SOURCE_CREDENTIAL_MAX_BYTES).refine((value) => !value.includes("\0")),
 	expires_at: z.iso.datetime(),
 	purpose: z.enum(["setup-issuer", "runtime-issuer"])
@@ -2532,6 +2534,9 @@ const CredentialInstalledPayload = z.object({
 	previous_lease_id: z.uuid(),
 	lease_id: z.uuid()
 });
+const CredentialInstallPayload = z.object({ credentials: z.array(WorkspaceCredentialSchema).min(1).max(64) });
+const CredentialRemovePayload = z.object({ session_id: z.uuid() });
+const CredentialInstallAckPayload = z.object({ lease_ids: z.array(z.uuid()).min(1).max(64) });
 //#endregion
 //#region ../contracts/src/protocol/protocol-stream.ts
 const ProxyStreamStartPayload = z.object({
@@ -2621,7 +2626,8 @@ const EnvelopeBase = z.object({
 		z.literal(11),
 		z.literal(12),
 		z.literal(13),
-		z.literal(14)
+		z.literal(14),
+		z.literal(15)
 	]),
 	workspace_id: z.uuid(),
 	connection_id: z.uuid(),
@@ -2760,6 +2766,10 @@ z.discriminatedUnion("type", [
 		type: z.literal("credential_installed"),
 		payload: CredentialInstalledPayload
 	}),
+	EnvelopeBase.extend({
+		type: z.literal("credential_install_ack"),
+		payload: CredentialInstallAckPayload
+	}),
 	EnvelopeBase.extend({
 		type: z.literal("setup_complete"),
 		payload: z.object({ request_id: z.uuid() })
@@ -2939,6 +2949,14 @@ z.discriminatedUnion("type", [
 		type: z.literal("credential_installed_ack"),
 		payload: CredentialInstalledPayload
 	}),
+	EnvelopeBase.extend({
+		type: z.literal("credential_install"),
+		payload: CredentialInstallPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("credential_remove"),
+		payload: CredentialRemovePayload
+	}),
 	EnvelopeBase.extend({
 		type: z.literal("setup_complete_ack"),
 		payload: z.object({ request_id: z.uuid() })
@@ -3243,7 +3261,11 @@ const ExecutionProfileSchema = z.strictObject({
 	isolationScopeId: z.uuid(),
 	budgetScopeIds: z.array(z.uuid()).min(1).max(1e3).refine((items) => new Set(items).size === items.length, "Values must be unique"),
 	templateDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/),
-	credentialBindingId: z.uuid().nullable()
+	credentialBindingId: z.uuid().nullable(),
+	credentialPlacement: z.enum(["exclusive", "shared"]).optional()
+}).refine((profile) => profile.credentialBindingId !== null || profile.credentialPlacement === void 0, {
+	message: "Only a credentialed profile can choose its credential placement",
+	path: ["credentialPlacement"]
 });
 const SessionCreateSchema = z.strictObject({
 	sessionId: z.uuid(),
@@ -3457,7 +3479,7 @@ const ManagedExportPageSchema = z.strictObject({
 //#region ../contracts/src/sessions/placement.ts
 function managedPlacement(principalId, sessionId, input) {
 	const profile = ExecutionProfileSchema.parse(input);
-	const mode = profile.credentialBindingId === null ? "shared" : "exclusive";
+	const mode = profile.credentialBindingId === null || profile.credentialPlacement === "shared" ? "shared" : "exclusive";
 	return {
 		mode,
 		key: digestOf({

package/package.json

@@ -6,7 +6,7 @@
       "type:library"
     ]
   },
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": false,
   "description": "Runtime-validated TypeScript client for the PocketCoder control plane.",
   "type": "module",