@qoder-ai/qoder-agent-sdk 1.0.41 → 1.0.42

package/dist/core/runtime-launch-options.d.ts

@@ -1,6 +1,6 @@
 import type { DiagnosticsSink } from './sdk-diagnostics.js';
 import type { SdkPluginConfig, ToolConfig } from '../types/common.js';
-import type { InternalAuthOptions } from '../types/auth.js';
+import type { InternalAuthOptions, SdkAuthPayload } from '../types/auth.js';
 import type { PermissionMode } from '../types/permissions.js';
 import type { McpServerConfigForProcessTransport } from '../protocol/mcp.js';
 import type { McpServerToolPolicy } from '../types/mcp.js';
@@ -98,8 +98,15 @@ export declare class RuntimeLaunchOptionsBuilder {
     private readSettingsFile;
     private writeGeneratedSettingsFile;
     private createAuthPayloadFile;
-    private buildAuthPayload;
-    private resolveServiceAccountKey;
-    private resolveAccessToken;
 }
+/**
+ * Maps the SDK's auth options onto the wire payload the CLI accepts.
+ *
+ * One implementation for both delivery paths: the one-shot payload file a
+ * Worker reads at startup, and the daemon's in-band `initialize` auth.
+ *
+ * @param env caller-supplied environment override; `{ envVar }` credential
+ *   inputs resolve against it when it owns the variable, else `process.env`.
+ */
+export declare function buildSdkAuthPayload(auth: InternalAuthOptions, env?: Record<string, string | undefined>): SdkAuthPayload;
 export {};

package/dist/core/usage-normalize.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Normalization of the CLI's usage payloads into the public `UsageInfo` /
+ * `SessionCreditsUsage` shapes.
+ *
+ * Shared by both account-level query paths — the per-Query control plane and
+ * the daemon query plane — because they talk to the same CLI endpoints and
+ * must not drift in which fields they accept.
+ */
+import type { SessionCreditsUsage, UsageInfo } from '../protocol/common.js';
+export declare function normalizeSessionCreditsUsage(value: unknown): SessionCreditsUsage | undefined;
+export declare function normalizeUsageInfo(value: unknown): UsageInfo | null;

package/dist/daemon/daemon-connection.d.ts

@@ -1,5 +1,6 @@
 import type { Readable, Writable } from "node:stream";
-import { type DaemonControlRequestFrame, type DaemonWireSessionMessage, type JsonObject, type JsonValue, type OpenSessionParams, type RenameSessionResult } from "./protocol.js";
+import { type DaemonCommandResultMap, type DaemonCommandParamsMap, type DaemonControlRequestFrame, type DaemonQueryMethod, type DaemonWireSessionMessage, type JsonObject, type JsonValue, type OpenSessionParams, type RenameSessionResult } from "./protocol.js";
+import type { SdkAuthPayload } from "../types/auth.js";
 import { DaemonSessionTransport, type DaemonSessionTransportOptions } from "./daemon-session-transport.js";
 export declare const SESSION_STORE_FILE_CHECKPOINTING_CAPABILITY = "session_store_file_checkpointing_v1";
 export declare const SESSION_STORE_FORK_BARRIER_CAPABILITY = "session_store_fork_barrier_v1";
@@ -9,6 +10,17 @@ export interface DaemonConnectionOptions {
     requestHandler?: DaemonRequestHandler;
     maxFrameBytes?: number;
 }
+export interface DaemonInitializeOptions {
+    /** Advertised in addition to the capability this SDK cannot work without. */
+    capabilities?: readonly string[];
+    timeoutMs?: number;
+    /**
+     * Daemon-level credentials, sent in-band on the initialize frame. This is
+     * what unlocks the account-level query plane; Session management works
+     * without it. Carries a plaintext credential — never log it.
+     */
+    auth?: SdkAuthPayload;
+}
 export type DaemonRequestHandler = (request: DaemonControlRequestFrame) => Promise<JsonValue>;
 export declare class DaemonRpcError extends Error {
     readonly code: string;
@@ -55,7 +67,7 @@ export declare class DaemonConnection {
     private failure;
     private readonly failureListeners;
     constructor(options: DaemonConnectionOptions);
-    initialize(sdkVersion: string, optionalCapabilitiesOrTimeout?: readonly string[] | number, timeoutMs?: number): Promise<void>;
+    initialize(sdkVersion: string, options?: DaemonInitializeOptions): Promise<void>;
     createSessionTransport(options: DaemonSessionTransportOptions): DaemonSessionTransport;
     supportsCapability(capability: string): boolean;
     onFailure(listener: (error: Error) => void): () => void;
@@ -65,6 +77,15 @@ export declare class DaemonConnection {
     sendSessionMessage(message: DaemonWireSessionMessage): Promise<void>;
     closeSession(sessionId: string): Promise<void>;
     deleteSession(localSessionId: string): Promise<void>;
+    /**
+     * Sends one account-level query (`daemon_queries_v1`).
+     *
+     * Rejected with `DaemonProtocolError` when the daemon never reported the
+     * capability, and with `DaemonRpcError` carrying the daemon's error code when
+     * the query itself fails. The timeout is request-scoped: a slow upstream call
+     * fails that one query, not the connection.
+     */
+    query<Method extends DaemonQueryMethod>(method: Method, params: DaemonCommandParamsMap[Method]): Promise<DaemonCommandResultMap[Method]>;
     shutdown(timeoutMs?: number): Promise<void>;
     fail(error: unknown, notifyListeners?: boolean): void;
     private request;

package/dist/daemon/protocol.d.ts

@@ -3,7 +3,17 @@
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import type { BYOKModelValidationInput, BYOKProviderInfo, ByokConfigCheckResult, ByokConfigInfo, ByokConfigReference, CheckByokConfigInput, CreateByokConfigInput, DeleteByokConfigInput, UpdateByokConfigInput } from "../protocol/control.js";
+import type { AccountInfo, ModelInfo, SessionCreditsUsage, UsageInfo } from "../protocol/common.js";
+import type { PluginDetails } from "../types/plugins.js";
+import type { SdkAuthPayload } from "../types/auth.js";
 export declare const DAEMON_PROTOCOL_VERSION: 2;
+/**
+ * Reported by the daemon in its initialize result once it accepted an `auth`
+ * payload, i.e. when the account-level query plane is usable on this
+ * connection. Absent for a daemon that only manages Sessions.
+ */
+export declare const DAEMON_QUERIES_CAPABILITY = "daemon_queries_v1";
 export type JsonPrimitive = string | number | boolean | null;
 export type JsonValue = JsonPrimitive | JsonValue[] | {
     [key: string]: JsonValue;
@@ -64,6 +74,15 @@ export type InitializeDaemonParams = {
     daemon_protocol_version: typeof DAEMON_PROTOCOL_VERSION;
     sdk_version: string;
     capabilities: string[];
+    /**
+     * Daemon-level credentials, independent from the per-Session auth the daemon
+     * forwards to Workers. Omitting it keeps Session management fully functional
+     * while every account-level query fails with `AUTH_REQUIRED`.
+     *
+     * Carries a plaintext credential — it must never reach a log or an error
+     * message.
+     */
+    auth?: SdkAuthPayload;
 };
 export type InitializeDaemonResult = {
     daemon_protocol_version: typeof DAEMON_PROTOCOL_VERSION;
@@ -102,7 +121,82 @@ export type DeleteSessionParams = {
     local_session_id: string;
 };
 export type ShutdownParams = Record<string, never>;
-export type DaemonCommandMethod = "initialize" | "open_session" | "list_sessions" | "rename_session" | "close_session" | "delete_session" | "shutdown";
+/**
+ * Account-level query plane (`daemon_queries_v1`).
+ *
+ * Every method is scoped to the daemon's own credentials rather than to a
+ * Session, so none of them carries a `session_id`. Params and results reuse the
+ * worker control-plane payload types: the daemon answers these from the same
+ * services and must not grow a second definition of the same wire shape.
+ */
+export type DaemonQueryMethod = "get_models" | "get_byok_config" | "validate_byok_model" | "list_byok_configs" | "create_byok_config" | "update_byok_config" | "delete_byok_config" | "check_byok_config" | "list_plugins" | "get_usage_info" | "account_info";
+export type DaemonGetModelsParams = {
+    /** Any value other than `live` is served from the catalog cache. */
+    fetchStrategy?: "live" | "cache";
+    /** Cache identity for the per-account shared catalog; empty for anonymous. */
+    uid?: string;
+    outerProviders?: string[];
+};
+export type DaemonGetModelsResult = {
+    models: ModelInfo[];
+};
+export type DaemonGetByokConfigParams = Record<string, never>;
+export type DaemonGetByokConfigResult = {
+    providers: BYOKProviderInfo[];
+};
+/**
+ * Validates a set of *unsaved* model parameters. `request.type` already carries
+ * the wire discriminant, so the provider's model type key travels as
+ * `model_type` (with `provider_type` accepted as the legacy spelling).
+ */
+export type DaemonValidateByokModelParams = BYOKModelValidationInput & {
+    model_type?: string;
+    provider_type?: string;
+};
+export type DaemonValidateByokModelResult = {
+    success: boolean;
+};
+export type DaemonListByokConfigsParams = Record<string, never>;
+export type DaemonListByokConfigsResult = {
+    configs: ByokConfigInfo[];
+};
+export type DaemonCreateByokConfigParams = {
+    config: CreateByokConfigInput;
+};
+export type DaemonCreateByokConfigResult = {
+    config: ByokConfigReference;
+};
+export type DaemonUpdateByokConfigParams = {
+    config: UpdateByokConfigInput;
+};
+export type DaemonDeleteByokConfigParams = {
+    target: DeleteByokConfigInput;
+};
+/**
+ * Checks a *saved or about-to-be-saved* configuration: BYOK models are verified
+ * against the server, custom providers only locally. Business failures arrive
+ * as a success frame carrying `ByokConfigCheckResult`, never as an error frame.
+ */
+export type DaemonCheckByokConfigParams = {
+    config: CheckByokConfigInput;
+};
+export type DaemonCheckByokConfigResult = ByokConfigCheckResult;
+export type DaemonListPluginsParams = Record<string, never>;
+export type DaemonListPluginsResult = {
+    plugins: PluginDetails[];
+};
+export type DaemonGetUsageInfoParams = Record<string, never>;
+export type DaemonGetUsageInfoResult = {
+    usage: UsageInfo | null;
+    session: SessionCreditsUsage;
+    /** Account quota lookup failure; the session credits remain usable. */
+    usage_error?: string;
+};
+export type DaemonAccountInfoParams = Record<string, never>;
+export type DaemonAccountInfoResult = {
+    account: AccountInfo;
+};
+export type DaemonCommandMethod = "initialize" | "open_session" | "list_sessions" | "rename_session" | "close_session" | "delete_session" | "shutdown" | DaemonQueryMethod;
 export interface DaemonCommandParamsMap {
     initialize: InitializeDaemonParams;
     open_session: OpenSessionParams;
@@ -111,8 +205,19 @@ export interface DaemonCommandParamsMap {
     close_session: CloseSessionParams;
     delete_session: DeleteSessionParams;
     shutdown: ShutdownParams;
+    get_models: DaemonGetModelsParams;
+    get_byok_config: DaemonGetByokConfigParams;
+    validate_byok_model: DaemonValidateByokModelParams;
+    list_byok_configs: DaemonListByokConfigsParams;
+    create_byok_config: DaemonCreateByokConfigParams;
+    update_byok_config: DaemonUpdateByokConfigParams;
+    delete_byok_config: DaemonDeleteByokConfigParams;
+    check_byok_config: DaemonCheckByokConfigParams;
+    list_plugins: DaemonListPluginsParams;
+    get_usage_info: DaemonGetUsageInfoParams;
+    account_info: DaemonAccountInfoParams;
 }
-export type DaemonCommandRequest = DaemonControlRequestFrame<"initialize", InitializeDaemonParams> | DaemonControlRequestFrame<"open_session", OpenSessionParams> | DaemonControlRequestFrame<"list_sessions", ListSessionsParams> | DaemonControlRequestFrame<"rename_session", RenameSessionParams> | DaemonControlRequestFrame<"close_session", CloseSessionParams> | DaemonControlRequestFrame<"delete_session", DeleteSessionParams> | DaemonControlRequestFrame<"shutdown", ShutdownParams>;
+export type DaemonCommandRequest = DaemonControlRequestFrame<"initialize", InitializeDaemonParams> | DaemonControlRequestFrame<"open_session", OpenSessionParams> | DaemonControlRequestFrame<"list_sessions", ListSessionsParams> | DaemonControlRequestFrame<"rename_session", RenameSessionParams> | DaemonControlRequestFrame<"close_session", CloseSessionParams> | DaemonControlRequestFrame<"delete_session", DeleteSessionParams> | DaemonControlRequestFrame<"shutdown", ShutdownParams> | DaemonControlRequestFrame<"get_models", DaemonGetModelsParams> | DaemonControlRequestFrame<"get_byok_config", DaemonGetByokConfigParams> | DaemonControlRequestFrame<"validate_byok_model", DaemonValidateByokModelParams> | DaemonControlRequestFrame<"list_byok_configs", DaemonListByokConfigsParams> | DaemonControlRequestFrame<"create_byok_config", DaemonCreateByokConfigParams> | DaemonControlRequestFrame<"update_byok_config", DaemonUpdateByokConfigParams> | DaemonControlRequestFrame<"delete_byok_config", DaemonDeleteByokConfigParams> | DaemonControlRequestFrame<"check_byok_config", DaemonCheckByokConfigParams> | DaemonControlRequestFrame<"list_plugins", DaemonListPluginsParams> | DaemonControlRequestFrame<"get_usage_info", DaemonGetUsageInfoParams> | DaemonControlRequestFrame<"account_info", DaemonAccountInfoParams>;
 export interface DaemonCommandResultMap {
     initialize: InitializeDaemonResult;
     open_session: OpenSessionResult;
@@ -121,6 +226,17 @@ export interface DaemonCommandResultMap {
     close_session: null;
     delete_session: null;
     shutdown: null;
+    get_models: DaemonGetModelsResult;
+    get_byok_config: DaemonGetByokConfigResult;
+    validate_byok_model: DaemonValidateByokModelResult;
+    list_byok_configs: DaemonListByokConfigsResult;
+    create_byok_config: DaemonCreateByokConfigResult;
+    update_byok_config: null;
+    delete_byok_config: null;
+    check_byok_config: DaemonCheckByokConfigResult;
+    list_plugins: DaemonListPluginsResult;
+    get_usage_info: DaemonGetUsageInfoResult;
+    account_info: DaemonAccountInfoResult;
 }
 export declare class DaemonProtocolError extends Error {
     readonly code: "DAEMON_PROTOCOL_ERROR";

package/dist/daemon/start-daemon.d.ts

@@ -1,6 +1,10 @@
 import type { InternalAuthOptions } from '../types/auth.js';
 import type { ProcessTransportOptions } from '../core/process-transport.js';
 import type { QueryTransportProvider } from '../core/transport.js';
+import type { DaemonGetModelsParams, DaemonValidateByokModelParams } from './protocol.js';
+import type { BYOKProviderInfo, ByokConfigCheckResult, ByokConfigInfo, ByokConfigReference, CheckByokConfigInput, CreateByokConfigInput, DeleteByokConfigInput, UpdateByokConfigInput } from '../protocol/control.js';
+import type { AccountInfo, ModelInfo, UsageInfo } from '../protocol/common.js';
+import type { PluginDetails } from '../types/plugins.js';
 export type DaemonState = 'ready' | 'stopping' | 'stopped' | 'failed';
 export type SessionRuntimeState = 'pending' | 'ready' | 'inactive' | 'failed';
 export interface DaemonSessionInfo {
@@ -15,6 +19,16 @@ export interface StartDaemonOptions {
     auth: InternalAuthOptions;
     /** Idle Worker timeout in milliseconds. Set to 0 to disable reclamation. */
     workerIdleTimeoutMs?: number;
+    /**
+     * Budget for the `daemon.initialize` round trip; defaults to 30s.
+     *
+     * The CLI lands the in-band credentials while handling initialize — token
+     * exchange, user info, a possible host callback for the first token, and the
+     * account tier prefill — so the wall time follows the host's network and the
+     * CLI's own startup cost. Raise this when either is slow; initialize only
+     * resolves once that work is complete.
+     */
+    initializeTimeoutMs?: number;
     cwd?: string;
     pathToQoderCLIExecutable?: string;
     proxy?: string;
@@ -25,6 +39,27 @@ export interface Daemon {
     listSessions(): Promise<DaemonSessionInfo[]>;
     renameSession(localSessionId: string, title: string): Promise<DaemonSessionInfo>;
     deleteSession(localSessionId: string): Promise<void>;
+    /**
+     * Account-level queries, answered from the credentials the daemon was
+     * started with — never from a Session's. They require a daemon that accepted
+     * `StartDaemonOptions.auth` and reported `daemon_queries_v1`; otherwise they
+     * reject.
+     *
+     * Unlike the per-`Query` equivalents these do not swallow failures into
+     * `null`: capability is already negotiated here, so a rejection is a real
+     * error (`DaemonRpcError` carries the daemon's code and retryable flag).
+     */
+    getModels(options?: DaemonGetModelsParams): Promise<ModelInfo[]>;
+    getByokConfig(): Promise<BYOKProviderInfo[]>;
+    validateByokModel(input: DaemonValidateByokModelParams): Promise<boolean>;
+    listByokConfigs(): Promise<ByokConfigInfo[]>;
+    createByokConfig(input: CreateByokConfigInput): Promise<ByokConfigReference>;
+    updateByokConfig(input: UpdateByokConfigInput): Promise<void>;
+    deleteByokConfig(target: DeleteByokConfigInput): Promise<void>;
+    checkByokConfig(input: CheckByokConfigInput): Promise<ByokConfigCheckResult>;
+    listPlugins(): Promise<PluginDetails[]>;
+    getUsageInfo(): Promise<UsageInfo | null>;
+    accountInfo(): Promise<AccountInfo>;
     stop(): Promise<void>;
 }
 interface InternalDaemonRuntime {

package/dist/index.d.ts

@@ -59,6 +59,7 @@ export { initDaemon, shutdownDaemon } from './daemon/global-daemon.js';
 export type { DaemonFallbackReason, DaemonInitResult, InitDaemonOptions, } from './daemon/global-daemon.js';
 export { startDaemon } from './daemon/start-daemon.js';
 export type { Daemon, DaemonState, DaemonSessionInfo, SessionRuntimeState, StartDaemonOptions, } from './daemon/start-daemon.js';
+export type { DaemonGetModelsParams, DaemonValidateByokModelParams, } from './daemon/protocol.js';
 export { DEFAULT_RUNTIME_TRANSPORT, } from './core/default-runtime.js';
 export { ProcessTransport, QoderCliProcessError, } from './core/process-transport.js';
 export { hasResolvableQoderWorkerRuntime, QoderWorkerRuntimeError, WorkerTransport, resolveQoderWorkerRuntimePath, } from './core/worker-transport.js';
@@ -91,7 +92,7 @@ export type { AccessTokenInput, AuthOptions, FetchServiceAccountToken, ServiceAc
  */
 export type { FetchJobToken, JobTokenAuthOptions, JobTokenRequest, JobTokenResult, } from './types/auth.js';
 export type { Base64ImageSource, UrlImageSource, URLImageSource, ImageSource, ImageContentBlock, ImageBlockParam, ContentBlock, MessageParam, AccountInfo, UsageAddOnQuotaBucket, UsageInfo, UsageOrgResourcePackage, UsageQuotaBucket, SessionCreditsUsage, ApiKeySource, ExitReason, FastModeState, ConfigScope, SettingSource, SDKAssistantMessageError, SDKStatus, EffortLevel, ThinkingAdaptive, ThinkingEnabled, ThinkingDisabled, ThinkingConfig, ModelInfo, ModelSource, ServerModelJson, ServerModelJsonValue, ModelStrategy, ModelPromotion, LocalizedModelText, ModelContextConfig, ModelContextWindowEntry, ModelEffortEntry, ModelThinkingConfig, ModelThinkingDisabled, ModelThinkingEnabled, ModelUsage, NonNullableUsage, SlashCommand, ToolConfig, SdkPluginConfig, } from './types/common.js';
-export type { SDKMessage, SDKAssistantMessage, SDKToolNonExecutionKind, SDKToolResultMeta, SDKMessageOrigin, SDKArtifactInfo, SDKArtifactUpdateMessage, SDKAvailableModelsUpdateMessage, SDKCommandsChangedMessage, SDKUserMessage, SDKUserMessageReplay, SDKResultMessage, SDKResultSuccess, SDKResultError, SDKSystemMessage, SDKSystemInitMessage, SDKSystemMessageSubtype, SDKSystemMessageBySubtype, SDKPartialAssistantMessage, SDKCompactBoundaryMessage, SDKStatusMessage, SDKAPIRetryMessage, SDKModelQueueStatusMessage, SDKControlRequestProgressMessage, SDKCommandLifecycleMessage, SDKHookStartedMessage, SDKHookProgressMessage, SDKHookResponseMessage, SDKPermissionDeniedMessage, SDKMirrorErrorMessage, SDKTaskNotificationMessage, SDKTaskStartedMessage, SDKTaskProgressMessage, SDKTaskUpdatedMessage, SDKBackgroundTasksChangedMessage, SDKSessionStateChangedMessage, SDKPlanModeChangedMessage, SDKSessionTitleChangedMessage, SDKFilesPersistedEvent, SDKElicitationCompleteMessage, SDKPromptSuggestionMessage, SDKCloudAgentEventMessage, SDKMemoryGenerationMessage, SDKMemoryConsumptionMessage, SDKSkillEvolutionMessage, SDKPermissionDenial, } from './types/messages.js';
+export type { SDKMessage, SDKAssistantMessage, SDKToolNonExecutionKind, SDKToolResultMeta, SDKMessageOrigin, SDKSelectedSkill, SDKArtifactInfo, SDKArtifactUpdateMessage, SDKAvailableModelsUpdateMessage, SDKCommandsChangedMessage, SDKUserMessage, SDKUserMessageReplay, SDKResultMessage, SDKResultSuccess, SDKResultError, SDKSystemMessage, SDKSystemInitMessage, SDKSystemMessageSubtype, SDKSystemMessageBySubtype, SDKPartialAssistantMessage, SDKCompactBoundaryMessage, SDKStatusMessage, SDKAPIRetryMessage, SDKModelQueueStatusMessage, SDKControlRequestProgressMessage, SDKCommandLifecycleMessage, SDKHookStartedMessage, SDKHookProgressMessage, SDKHookResponseMessage, SDKPermissionDeniedMessage, SDKMirrorErrorMessage, SDKTaskNotificationMessage, SDKTaskStartedMessage, SDKTaskProgressMessage, SDKTaskUpdatedMessage, SDKBackgroundTasksChangedMessage, SDKSessionStateChangedMessage, SDKPlanModeChangedMessage, SDKSessionTitleChangedMessage, SDKFilesPersistedEvent, SDKElicitationCompleteMessage, SDKPromptSuggestionMessage, SDKCloudAgentEventMessage, SDKMemoryGenerationMessage, SDKMemoryConsumptionMessage, SDKSkillEvolutionMessage, SDKPermissionDenial, } from './types/messages.js';
 export type { DefaultRuntimeTransport, } from './core/default-runtime.js';
 export type { QueryTransportCreateOptions, QueryTransportProviderOption, } from './core/query-transport.js';
 export type { ProcessTransportOptions } from './core/process-transport.js';