@rayrun/sdk 0.3.0 → 0.4.0

package/README.md

@@ -9,6 +9,7 @@ import { Rayrun } from '@rayrun/sdk';
 
 const rayrun = new Rayrun({ apiKey: process.env.RAYRUN_API_KEY });
 const { items: connections } = await rayrun.connections.list();
+const { items: matchingTools } = await rayrun.tools.list({ query: 'create issue' });
 ```
 
 Create keys in **Dashboard → Settings → API keys**. The plaintext is shown once.
@@ -17,6 +18,18 @@ The client covers catalog search, connection and credential setup, OAuth links,
 client policies, reusable access profiles, activity, review queues, and webhooks. Safe reads retry
 rate limits, server errors, and transient network failures; writes do not retry automatically.
 
+Inspect the effective policy applied to one connected client without reproducing policy logic in
+your application:
+
+```js
+const { items: effectivePolicy } = await rayrun.clients.listTools(clientUid, {
+  query: 'create issue',
+});
+```
+
+Each result includes the effective decision and the workspace, access-profile, or client layer that
+restricted it.
+
 ## Reuse one access ceiling across clients
 
 ```js
@@ -92,7 +105,8 @@ const valid = verifyWebhookSignature({
 ```
 
 After verification, parse the body as `WebhookPayload`. Every event has a stable `id`, `type`, and
-`occurredAt`; its `data` shape is narrowed by `type`. Use `id` to deduplicate retries.
+`occurredAt`; its `data` shape is narrowed by `type`. Delivery is at least once, so make processing
+idempotent and deduplicate on `id`.
 For `activity.call`, `arguments` and `result` contain the captured tool payloads, or `null` when
 capture was disabled for that connection, the webhook did not opt in with
 `forwardToolPayloads: true`, or no result existed. `payloadCaptured` distinguishes a metadata-only

package/index.d.ts

@@ -63,6 +63,27 @@ export type Client = {
   uid: string;
   userName: string;
 };
+export type ClientTool = {
+  approved: boolean;
+  clientDecision: ToolDecision | null;
+  effectiveDecision: ToolDecision;
+  effectiveReason:
+    | 'definition-unapproved'
+    | 'workspace-tool-rule'
+    | 'workspace-default'
+    | 'client-profile-tool-rule'
+    | 'client-profile-default'
+    | 'client-tool-rule'
+    | 'client-default'
+    | 'multiple-layers'
+    | 'workspace-and-client';
+  name: string;
+  riskLevel: Risk;
+  riskReason: string;
+  serviceName: string;
+  uid: string;
+  workspaceDecision: ToolDecision | null;
+};
 export type AccessProfile = {
   assignedClientCount: number;
   description: string;
@@ -263,7 +284,7 @@ export class Rayrun {
     setPolicy(uid: string, mode: ToolAccessMode): Promise<void>;
   };
   tools: {
-    list(query?: PageQuery & { connectionUid?: string }): Promise<CursorPage<Tool>>;
+    list(query?: PageQuery & { connectionUid?: string; query?: string }): Promise<CursorPage<Tool>>;
     setPolicy(
       connectionUid: string,
       toolUid: string,
@@ -272,6 +293,7 @@ export class Rayrun {
   };
   clients: {
     list(query?: PageQuery): Promise<CursorPage<Client>>;
+    listTools(uid: string, query?: PageQuery & { query?: string }): Promise<CursorPage<ClientTool>>;
     setAccessProfile(
       uid: string,
       profileUid: string | null,

package/index.js

@@ -114,6 +114,7 @@ export class Rayrun {
     };
     this.clients = {
       list: (query) => this.request('GET', '/clients', { query }),
+      listTools: (uid, query) => this.request('GET', `/clients/${uid}/tools`, { query }),
       setAccessProfile: (uid, profileUid, expectedVersion) =>
         this.request('PATCH', `/clients/${uid}/access-profile`, {
           body: { expectedVersion, profileUid },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rayrun/sdk",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Type-safe client for the Rayrun public API",
   "license": "MIT",
   "repository": {