@runtypelabs/sdk 10.12.0 → 10.13.0

package/dist/index.cjs

@@ -14445,7 +14445,7 @@ function transformQueryParams(params) {
 }
 //#endregion
 //#region src/version.ts
-const SDK_VERSION = "10.12.0";
+const SDK_VERSION = "10.13.0";
 /**
 * Canonical client identity the API uses for attribution
 * (`detectActorSource` in apps/api/src/lib/audit-log.ts keys `'sdk'` off the

package/dist/index.d.cts

@@ -1125,6 +1125,8 @@ interface paths {
               };
               tools?: {
                 approval?: {
+                  /** @enum {string} */
+                  approver?: "owner" | "end-user";
                   choices?: {
                     alwaysAllow?: boolean;
                     alwaysDeny?: boolean;
@@ -1656,6 +1658,8 @@ interface paths {
                 };
                 tools?: {
                   approval?: {
+                    /** @enum {string} */
+                    approver?: "owner" | "end-user";
                     choices?: {
                       alwaysAllow?: boolean;
                       alwaysDeny?: boolean;
@@ -1884,7 +1888,7 @@ interface paths {
     put?: never;
     /**
      * Fetch external agent card
-     * @description Proxy-fetch an external agent card from a URL, avoiding CORS issues. The URL is validated against SSRF attacks.
+     * @description Proxy-fetch an external agent card from a URL, avoiding CORS issues. The URL is validated against SSRF attacks. With `transport: "device"`, the card is fetched through the paired local listener `deviceId`, so the URL must be a loopback address on that machine. Pass `bearerToken` when the card itself requires one.
      */
     post: {
       parameters: {
@@ -1896,6 +1900,15 @@ interface paths {
       requestBody?: {
         content: {
           "application/json": {
+            /** @description Sent as `Authorization: Bearer` on the card request. Never stored or echoed. */
+            bearerToken?: string;
+            /** @description The paired listener to fetch through. Required when transport is "device". */
+            deviceId?: string;
+            /**
+             * @description How to reach the card: directly (default) or through a paired local listener
+             * @enum {string}
+             */
+            transport?: "http" | "device";
             /** Format: uri */
             url: string;
           };
@@ -2451,6 +2464,8 @@ interface paths {
               };
               tools?: {
                 approval?: {
+                  /** @enum {string} */
+                  approver?: "owner" | "end-user";
                   choices?: {
                     alwaysAllow?: boolean;
                     alwaysDeny?: boolean;
@@ -4481,6 +4496,15 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
+        /** @description An external agent call failed upstream: rejected credentials, rate limited, an HTTP error, a network failure, or an invalid response */
+        502: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
         /** @description Asynchronous execution unavailable */
         503: {
           headers: {
@@ -4490,6 +4514,15 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
+        /** @description An external agent call timed out */
+        504: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
       };
     };
     delete?: never;
@@ -8909,6 +8942,126 @@ interface paths {
     patch?: never;
     trace?: never;
   };
+  "/v1/client/approve": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Answer an end-user approval gate
+     * @description Session-authenticated approval for browser client-token sessions. Answers a paused approval whose gate the agent authored with `tools.approval.approver: 'end-user'`, then streams the continued run over Server-Sent Events in the same shape as `/v1/client/resume`. The decision is bound to the session that started the turn, single-use, and bound to the exact reviewed tool parameters; visitors cannot create persistent "always allow" grants. A gate with the default `owner` approver is refused with `403 APPROVAL_APPROVER_NOT_END_USER`; answer those with `POST /v1/dispatch/approve`. Does not count against execution limits.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          "application/json": {
+            /** @description The `approvalId` from the `approval_start` event this decision answers. */
+            approvalId: string;
+            /** @description Id for the assistant message this resumed leg produces, so a re-send deduplicates by id. Optional; same contract as `/v1/client/resume`. */
+            assistantMessageId?: string;
+            /** @enum {string} */
+            decision: "approved" | "denied";
+            executionId: string;
+            /** @description The visitor's own note on the decision, recorded with it. Optional. */
+            reason?: string;
+            sessionId: string;
+            /** @default true */
+            streamResponse?: boolean;
+          };
+        };
+      };
+      responses: {
+        /** @description SSE stream of the continued execution, or a buffered JSON continuation result when streamResponse is false */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["DispatchToolOutputContinuationJsonResponse"];
+            "text/event-stream": unknown;
+          };
+        };
+        /** @description Validation error, or the approvalId does not match the pending approval */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+        /** @description Session not found or expired */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+        /** @description Client token inactive, origin mismatch, execution belongs to another session, or the gate needs the owner (`APPROVAL_APPROVER_NOT_END_USER`) */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+        /** @description No paused execution found for the executionId, or the approval expired */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+        /** @description The approval was already resolved (`APPROVAL_ALREADY_RESOLVED`) */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+        /** @description Internal server error */
+        500: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+        /** @description Neutral service-unavailable response when the owner platform-key spend limit blocks an end-user continuation */
+        503: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/v1/client/chat": {
     parameters: {
       query?: never;
@@ -51757,6 +51910,8 @@ interface components {
           };
           tools?: {
             approval?: {
+              /** @enum {string} */
+              approver?: "owner" | "end-user";
               choices?: {
                 alwaysAllow?: boolean;
                 alwaysDeny?: boolean;
@@ -52534,6 +52689,8 @@ interface components {
         };
         tools?: {
           approval?: {
+            /** @enum {string} */
+            approver?: "owner" | "end-user";
             choices?: {
               alwaysAllow?: boolean;
               alwaysDeny?: boolean;

package/dist/index.d.ts

@@ -1125,6 +1125,8 @@ interface paths {
               };
               tools?: {
                 approval?: {
+                  /** @enum {string} */
+                  approver?: "owner" | "end-user";
                   choices?: {
                     alwaysAllow?: boolean;
                     alwaysDeny?: boolean;
@@ -1656,6 +1658,8 @@ interface paths {
                 };
                 tools?: {
                   approval?: {
+                    /** @enum {string} */
+                    approver?: "owner" | "end-user";
                     choices?: {
                       alwaysAllow?: boolean;
                       alwaysDeny?: boolean;
@@ -1884,7 +1888,7 @@ interface paths {
     put?: never;
     /**
      * Fetch external agent card
-     * @description Proxy-fetch an external agent card from a URL, avoiding CORS issues. The URL is validated against SSRF attacks.
+     * @description Proxy-fetch an external agent card from a URL, avoiding CORS issues. The URL is validated against SSRF attacks. With `transport: "device"`, the card is fetched through the paired local listener `deviceId`, so the URL must be a loopback address on that machine. Pass `bearerToken` when the card itself requires one.
      */
     post: {
       parameters: {
@@ -1896,6 +1900,15 @@ interface paths {
       requestBody?: {
         content: {
           "application/json": {
+            /** @description Sent as `Authorization: Bearer` on the card request. Never stored or echoed. */
+            bearerToken?: string;
+            /** @description The paired listener to fetch through. Required when transport is "device". */
+            deviceId?: string;
+            /**
+             * @description How to reach the card: directly (default) or through a paired local listener
+             * @enum {string}
+             */
+            transport?: "http" | "device";
             /** Format: uri */
             url: string;
           };
@@ -2451,6 +2464,8 @@ interface paths {
               };
               tools?: {
                 approval?: {
+                  /** @enum {string} */
+                  approver?: "owner" | "end-user";
                   choices?: {
                     alwaysAllow?: boolean;
                     alwaysDeny?: boolean;
@@ -4481,6 +4496,15 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
+        /** @description An external agent call failed upstream: rejected credentials, rate limited, an HTTP error, a network failure, or an invalid response */
+        502: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
         /** @description Asynchronous execution unavailable */
         503: {
           headers: {
@@ -4490,6 +4514,15 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
+        /** @description An external agent call timed out */
+        504: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
       };
     };
     delete?: never;
@@ -8909,6 +8942,126 @@ interface paths {
     patch?: never;
     trace?: never;
   };
+  "/v1/client/approve": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Answer an end-user approval gate
+     * @description Session-authenticated approval for browser client-token sessions. Answers a paused approval whose gate the agent authored with `tools.approval.approver: 'end-user'`, then streams the continued run over Server-Sent Events in the same shape as `/v1/client/resume`. The decision is bound to the session that started the turn, single-use, and bound to the exact reviewed tool parameters; visitors cannot create persistent "always allow" grants. A gate with the default `owner` approver is refused with `403 APPROVAL_APPROVER_NOT_END_USER`; answer those with `POST /v1/dispatch/approve`. Does not count against execution limits.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody: {
+        content: {
+          "application/json": {
+            /** @description The `approvalId` from the `approval_start` event this decision answers. */
+            approvalId: string;
+            /** @description Id for the assistant message this resumed leg produces, so a re-send deduplicates by id. Optional; same contract as `/v1/client/resume`. */
+            assistantMessageId?: string;
+            /** @enum {string} */
+            decision: "approved" | "denied";
+            executionId: string;
+            /** @description The visitor's own note on the decision, recorded with it. Optional. */
+            reason?: string;
+            sessionId: string;
+            /** @default true */
+            streamResponse?: boolean;
+          };
+        };
+      };
+      responses: {
+        /** @description SSE stream of the continued execution, or a buffered JSON continuation result when streamResponse is false */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["DispatchToolOutputContinuationJsonResponse"];
+            "text/event-stream": unknown;
+          };
+        };
+        /** @description Validation error, or the approvalId does not match the pending approval */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+        /** @description Session not found or expired */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+        /** @description Client token inactive, origin mismatch, execution belongs to another session, or the gate needs the owner (`APPROVAL_APPROVER_NOT_END_USER`) */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+        /** @description No paused execution found for the executionId, or the approval expired */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+        /** @description The approval was already resolved (`APPROVAL_ALREADY_RESOLVED`) */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+        /** @description Internal server error */
+        500: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+        /** @description Neutral service-unavailable response when the owner platform-key spend limit blocks an end-user continuation */
+        503: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/v1/client/chat": {
     parameters: {
       query?: never;
@@ -51757,6 +51910,8 @@ interface components {
           };
           tools?: {
             approval?: {
+              /** @enum {string} */
+              approver?: "owner" | "end-user";
               choices?: {
                 alwaysAllow?: boolean;
                 alwaysDeny?: boolean;
@@ -52534,6 +52689,8 @@ interface components {
         };
         tools?: {
           approval?: {
+            /** @enum {string} */
+            approver?: "owner" | "end-user";
             choices?: {
               alwaysAllow?: boolean;
               alwaysDeny?: boolean;

package/dist/index.mjs

@@ -14444,7 +14444,7 @@ function transformQueryParams(params) {
 }
 //#endregion
 //#region src/version.ts
-const SDK_VERSION = "10.12.0";
+const SDK_VERSION = "10.13.0";
 /**
 * Canonical client identity the API uses for attribution
 * (`detectActorSource` in apps/api/src/lib/audit-log.ts keys `'sdk'` off the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/sdk",
-  "version": "10.12.0",
+  "version": "10.13.0",
   "type": "module",
   "description": "TypeScript SDK for the Runtype API with fluent methods. Use it to quickly realize AI products, agents, and workflows.",
   "main": "dist/index.cjs",
@@ -24,7 +24,7 @@
   ],
   "dependencies": {},
   "devDependencies": {
-    "@runtypelabs/shared": "3.72.0",
+    "@runtypelabs/shared": "3.74.0",
     "openapi-typescript": "^7.13.0",
     "tsdown": "^0.23.0",
     "typescript": "^6.0.3",