@tokenite/sdk 2.0.0 → 2.0.1

package/README.md

@@ -85,7 +85,7 @@ await fetch('/api/auth/exchange', {
 
 ### Managed agents (Anthropic)
 
-Tokenite proxies Anthropic's [Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview) surface — the `/v1/agents`, `/v1/environments`, `/v1/sessions`, `/v1/vaults`, and `/v1/files` endpoints — under the same BYOK model as Messages. The app points the Anthropic SDK at `tk.proxyUrl('anthropic')`; the proxy injects the managed-agents beta header and forwards calls to the user's Anthropic org.
+Tokenite proxies Anthropic's [Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview) surface — the `/v1/agents`, `/v1/environments`, `/v1/sessions`, `/v1/vaults`, `/v1/files`, and `/v1/skills` endpoints — under the same BYOK model as Messages. The app points the Anthropic SDK at `tk.proxyUrl('anthropic')`; the proxy injects the right beta header per surface (`managed-agents-2026-04-01` for agents/environments/sessions/vaults, `files-api-2025-04-14` for files, `skills-2025-10-02` for skills) and forwards calls to the user's Anthropic org. Client-supplied `anthropic-beta` headers are passed through and merged with the auto-injected ones, so callers can opt into additional betas (e.g. multi-version skills) without losing the proxy-managed defaults.
 
 **Explicit consent required.** Because agent sessions run long-lived, billable server-side work on Anthropic (`$0.08/hr` session runtime on top of tokens), the proxy rejects agent-surface calls unless the app was created with `allowsManagedAgents: true`. The flag sits alongside the other app fields on creation:
 
@@ -93,7 +93,8 @@ Tokenite proxies Anthropic's [Managed Agents](https://platform.claude.com/docs/e
 await admin.apps.create({
   name: 'Life Coach',
   callbackUrl: 'https://lifecoach.ai/callback',
-  requiredProviders: ['anthropic'],
+  modelStrategy: 'models',
+  allowedModels: ['claude-opus-4-7', 'claude-sonnet-4-6'],
   allowsManagedAgents: true,          // ← opt in
 });
 ```
@@ -405,12 +406,6 @@ export type AppInfo = {
   readonly websiteUrl: string | null;
   /** Absolute URL to the app's icon (PNG/SVG). null when the developer hasn't set one — render initials or a generic glyph. */
   readonly iconUrl: string | null;
-  /** Providers the app declares it needs */
-  readonly requiredProviders: readonly Provider[];
-  /** Fallback order when `allowSubstitution` is true */
-  readonly preferredProviders: readonly Provider[];
-  /** Whether the app accepts substitute providers when a required one isn't available */
-  readonly allowSubstitution: boolean;
 };
 
 /**

package/dist/admin/types.d.ts

@@ -6,9 +6,6 @@ export type AppRecord = {
     readonly builderId: string;
     readonly name: string;
     readonly callbackUrl: string;
-    readonly requiredProviders: readonly Provider[];
-    readonly preferredProviders: readonly Provider[];
-    readonly allowSubstitution: boolean;
     readonly allowedModels?: readonly string[];
     readonly modelStrategy: ModelStrategy;
     readonly requiredTier?: RequiredTier;
@@ -24,9 +21,6 @@ export type CreatedApp = AppRecord & {
 export type CreateAppInput = {
     readonly name: string;
     readonly callbackUrl: string;
-    readonly requiredProviders: readonly Provider[];
-    readonly preferredProviders?: readonly Provider[];
-    readonly allowSubstitution?: boolean;
     readonly allowedModels?: readonly string[];
     readonly modelStrategy?: ModelStrategy;
     readonly requiredTier?: RequiredTier;

package/dist/client.js

@@ -1,6 +1,14 @@
 import { extractErrorMessage } from './error.js';
-const DEFAULT_BASE_URL = 'https://tokenite.ai';
-const DEFAULT_PROXY_URL = 'https://api.tokenite.ai';
+// `tokenite.ai` is the marketing site. The dashboard (which hosts the
+// OAuth consent screen and the API the SDK calls — /oauth/authorize,
+// /api/oauth/token) lives at `app.tokenite.ai`. Older versions of this
+// SDK pointed at `tokenite.ai` and only worked because that hostname
+// was aliased to the dashboard CloudFront; the marketing-site move on
+// 2026-05-06 broke that. Marketing CF now redirects /oauth/* and
+// /api/* to app.tokenite.ai, so older SDK installs continue to work,
+// but new installs should hit the dashboard directly.
+const DEFAULT_BASE_URL = 'https://app.tokenite.ai';
+const DEFAULT_PROXY_URL = 'https://proxy.tokenite.ai';
 const IFRAME_WIDTH = 480;
 const IFRAME_HEIGHT = 620;
 /**

package/dist/types.d.ts

@@ -175,12 +175,6 @@ export type AppInfo = {
     readonly websiteUrl: string | null;
     /** Absolute URL to the app's icon (PNG/SVG). null when the developer hasn't set one — render initials or a generic glyph. */
     readonly iconUrl: string | null;
-    /** Providers the app declares it needs */
-    readonly requiredProviders: readonly Provider[];
-    /** Fallback order when `allowSubstitution` is true */
-    readonly preferredProviders: readonly Provider[];
-    /** Whether the app accepts substitute providers when a required one isn't available */
-    readonly allowSubstitution: boolean;
 };
 /**
  * Full access context for a single access token: the app it belongs to,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenite/sdk",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "SDK for integrating \"Login with Tokenite\" into your app. Your users bring their own AI tokens — you pay nothing.",
   "type": "module",
   "exports": {