@toloka-platform/sdk 0.5.1 → 0.5.2

package/dist/cli/toloka.js.jsc.sha256

@@ -1 +1 @@
-115309d50a2755a511f097ac14ea83f5cd03fa198fb0e975e64ad9538c2e3474  toloka.js.jsc
+4144ed5bb1a0a9b6f7b983e854cc0094315f954e25f0a31097f6394bc7adc7dd  toloka.js.jsc

package/dist/cli/toloka.js.sha256

@@ -1 +1 @@
-5f0222c5ad52de0073174b3fcc1d9a3433262a803f2e2be183337d8dc3106215  toloka.js
+babd9144be52b672bdbba134f9820f13e96c51081f7600408354e564aeb8ef13  toloka.js

package/docs/cli.md

@@ -137,8 +137,16 @@ toloka project url
 toloka project remove <alias>
 toloka project create [alias] [--name <name>] [--team-id <id>] [--delivery-order-id <id>]
 toloka project untrack <pipeline|dataset> <name> [--confirm]
+toloka project token [--preset <name>] [--permissions <list>] [--expires-in <seconds>] [--projects <list>]
+toloka project tokens
+toloka project revoke-token <tokenId>
+toloka project revoke-tokens
 ```
 
+`token` mints a project-scoped token for the selected project and prints it once; it is never stored. The token acts as you inside that project (plus any `--projects`, which must belong to the same team) with the permissions of the `--preset` (`read`, `write`, `deploy`, `labeling-read`, `labeling-write`, `labeling-deploy`; default `write`) or an explicit `--permissions` list, and expires after `--expires-in` seconds (60..21600, default six hours). Hand it to an agent as `TOLOKA_API_KEY`. One user may hold at most 1000 live tokens per project, counted against every project the token covers; beyond that, `token` fails with `429 You already hold 1000 live tokens for project <id>; revoke unused tokens first`.
+
+`tokens` lists every live token of the selected project, newest first, with its id, user, expiry, projects, and permissions. `revoke-token <tokenId>` revokes one token and prints `Revoked <tokenId>.`; `revoke-tokens` revokes every live token of the selected project in one call and prints `Revoked <n> tokens.`. A token that covers several projects is revoked as a whole by either command. Revocation takes effect immediately.
+
 `add`, `switch`, `remove`, and `create` write the machine registry in the credentials file. They refuse `--api-key` / `--base-url` / `TOLOKA_*` when those would select a different key or platform than the stored file. `project list` prints project id, name, and team id. `create` uses the account's only writable team (`GET /me` lists the teams; `whoami` prints them) and asks for `--team-id` when there are several. A project owned by an internal team also needs `--delivery-order-id`; `toloka delivery-order list` shows the orders and answers with an explanation for accounts without internal teams.
 
 `project untrack` removes one pipeline or dataset binding from `toloka.json` without deleting the live resource. It previews the name and id in a terminal; outside a terminal, pass `--confirm` after reviewing the state file.

package/openapi/gen/api.ts

@@ -57,6 +57,7 @@ import type {
   ListProjectPipelinesParams,
   ListProjectSecrets200,
   ListProjectTokens200,
+  ListProjectTokensParams,
   ListProjectTrainings200,
   ListProjectTrainingsParams,
   ListProjects200,
@@ -83,6 +84,7 @@ import type {
   ProjectSecretName,
   ReplacePipelineGraphBody,
   ReplaceTrainingConfigurationBody,
+  RevokedScopedTokens,
   RunCost,
   RunId,
   RunItem,
@@ -1646,7 +1648,37 @@ export const createProjectToken = async (projectId: ProjectId,
 
 
 
-export const getListProjectTokensUrl = (projectId: ProjectId,) => {
+export const getListProjectTokensUrl = (projectId: ProjectId,
+    params?: ListProjectTokensParams,) => {
+  const normalizedParams = new URLSearchParams();
+
+  Object.entries(params || {}).forEach(([key, value]) => {
+    
+    if (value !== undefined) {
+      normalizedParams.append(key, value === null ? 'null' : value.toString())
+    }
+  });
+
+  const stringifiedParams = normalizedParams.toString();
+
+  return stringifiedParams.length > 0 ? `/api/v2-beta/projects/${projectId}/tokens?${stringifiedParams}` : `/api/v2-beta/projects/${projectId}/tokens`
+}
+
+export const listProjectTokens = async (projectId: ProjectId,
+    params?: ListProjectTokensParams, options?: RequestInit): Promise<ListProjectTokens200> => {
+  
+  return potatoFetch<ListProjectTokens200>(getListProjectTokensUrl(projectId,params),
+  {      
+    ...options,
+    method: 'GET'
+    
+    
+  }
+);}
+
+
+
+export const getRevokeProjectTokensUrl = (projectId: ProjectId,) => {
 
 
   
@@ -1654,12 +1686,12 @@ export const getListProjectTokensUrl = (projectId: ProjectId,) => {
   return `/api/v2-beta/projects/${projectId}/tokens`
 }
 
-export const listProjectTokens = async (projectId: ProjectId, options?: RequestInit): Promise<ListProjectTokens200> => {
+export const revokeProjectTokens = async (projectId: ProjectId, options?: RequestInit): Promise<RevokedScopedTokens> => {
   
-  return potatoFetch<ListProjectTokens200>(getListProjectTokensUrl(projectId),
+  return potatoFetch<RevokedScopedTokens>(getRevokeProjectTokensUrl(projectId),
   {      
     ...options,
-    method: 'GET'
+    method: 'DELETE'
     
     
   }

package/openapi/gen/models/index.ts

@@ -312,6 +312,7 @@ export * from './listProjectPipelines200';
 export * from './listProjectPipelinesParams';
 export * from './listProjectSecrets200';
 export * from './listProjectTokens200';
+export * from './listProjectTokensParams';
 export * from './listProjectTrainings200';
 export * from './listProjectTrainingsParams';
 export * from './listProjects200';
@@ -784,6 +785,7 @@ export * from './quorumNodeSettingsSmartSearchAnyOfProjectDescription';
 export * from './quorumNodeSettingsUi';
 export * from './replacePipelineGraphBody';
 export * from './replaceTrainingConfigurationBody';
+export * from './revokedScopedTokens';
 export * from './rootNode';
 export * from './rootNodeSettings';
 export * from './rootNodeSettingsCompletedFieldProxies';

package/openapi/gen/models/listProjectTokens200.ts

@@ -1,5 +1,7 @@
 import type { ScopedTokenSummary } from './scopedTokenSummary';
+import type { Pagination } from './pagination';
 
 export type ListProjectTokens200 = {
   tokens: ScopedTokenSummary[];
+  pagination: Pagination;
 };

package/openapi/gen/models/listProjectTokensParams.ts

@@ -0,0 +1,5 @@
+
+export type ListProjectTokensParams = {
+limit?: number;
+offset?: number;
+};

package/openapi/gen/models/revokedScopedTokens.ts

@@ -0,0 +1,4 @@
+
+export interface RevokedScopedTokens {
+  revokedCount: number;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toloka-platform/sdk",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "private": false,
   "description": "Build, inspect, and operate Toloka pipeline projects as TypeScript source. The public API may change between minor versions before 1.0.",
   "license": "Apache-2.0",
@@ -77,6 +77,6 @@
     "bun": ">=1.4.0"
   },
   "tolokaBuild": {
-    "commit": "f42223610fd0991694e1fb7852690b9b9a42e565"
+    "commit": "ae2c20f000f63863115fd153a0e15dc599dd85ed"
   }
 }

package/skills/catalog.json

@@ -11,8 +11,8 @@
         "testing",
         "checks"
       ],
-      "version": "0.5.1",
-      "digest": "d10767a13e558bb74e64768dbcc5260e8f78b5541050ed5cb6d5eb9809733107",
+      "version": "0.5.2",
+      "digest": "0c36f68ae116fe72362d43c9a2b4bc74685614c41f8bccf1fb053b2d13a1ea94",
       "files": [
         "SKILL.md",
         "references/node-semantics.md",
@@ -29,7 +29,7 @@
         "bug",
         "report"
       ],
-      "version": "0.5.1",
+      "version": "0.5.2",
       "digest": "70f0bd2c80b32f87896aeb27c363b8a2d37f40e22424f57fe1aad142e125ad67",
       "files": [
         "SKILL.md",
@@ -46,7 +46,7 @@
         "getting-started",
         "agent"
       ],
-      "version": "0.5.1",
+      "version": "0.5.2",
       "digest": "ccf148c682de4e452bb031db95d3933257899006b1766f0fdbc3d15265a63bb9",
       "files": [
         "SKILL.md"
@@ -63,7 +63,7 @@
         "sft",
         "models"
       ],
-      "version": "0.5.1",
+      "version": "0.5.2",
       "digest": "f9c34569fc344f365c79c86819adffc86c78a2ce74e17ba10755ddefaf71790f",
       "files": [
         "SKILL.md"
@@ -80,7 +80,7 @@
         "prompt",
         "models"
       ],
-      "version": "0.5.1",
+      "version": "0.5.2",
       "digest": "902aee47c952e105a6340ee56bf22e79513e2d45d19a7ffbf58990f277387e34",
       "files": [
         "SKILL.md"

package/skills/toloka-build/references/workflow-and-cli.md

@@ -92,6 +92,12 @@ revoke an API key.
 
 Standalone and Bun-global `toloka` installations check the public npm registry at most once per day and install eligible releases at least 24 hours old before rerunning the command. Project-local installs, CI, and `config`, `version`, and `help` skip the check. Turn it off with `toloka config set auto-update false`. For manual standalone updates, rerun `curl -fsSL https://platform.toloka.ai/cli/install.sh | sh -s -- --native`; Bun-global updates should use `--bun` instead. Preserve the mode and put any original `TOLOKA_CLI_INSTALL_DIR`, `TOLOKA_CLI_CHANNEL`, `TOLOKA_CLI_PACKAGE`, and `TOLOKA_CLI_REGISTRY` overrides on the `sh` side of the pipe again. A package version pin does not disable automatic updates, which always use the public npm registry.
 
+## Hand out a project-scoped token
+
+`toloka project token` mints a token that acts as the signed-in user inside the selected project only (`--projects` adds more projects of the same team), with the permissions of `--preset` (default `write`) or an explicit `--permissions` list, for at most six hours. It is printed once and never stored; pass it to another agent or script as `TOLOKA_API_KEY`. `toloka project tokens` lists the live tokens of the project; `toloka project revoke-token <tokenId>` ends one and `toloka project revoke-tokens` ends every live token of the project at once, for example when a run finished or a token leaked. One user may hold at most 1000 live tokens per project; when `token` fails with `429 … revoke unused tokens first`, run `revoke-tokens`.
+
+A scoped token downloads project files in two steps: a request to `ProjectFile.url` with the token answers `200 {"url": "<storage URL>"}` instead of the redirect a human credential gets. Fetch that `url` as a plain request without the `X-Scoped-Token` header; HTTP clients replay custom headers across redirects, and the token must never reach the storage host.
+
 ## Configure the CLI
 
 Provide the API key and base URL on networked workflows through `TOLOKA_API_KEY` and
@@ -126,6 +132,10 @@ toloka project url
 toloka project remove <alias>
 toloka project create [alias] [--name <name>] [--team-id <id>] [--delivery-order-id <id>]
 toloka project untrack <pipeline|dataset> <name> [--confirm]
+toloka project token [--preset <name>] [--permissions <list>] [--expires-in <seconds>] [--projects <list>]
+toloka project tokens
+toloka project revoke-token <tokenId>
+toloka project revoke-tokens
 toloka delivery-order list
 toloka audience specialization list [--json]
 toloka init

package/src/cli/commands/project.ts

@@ -14,7 +14,7 @@ import { addProject, assertProjectSelected, createProject, currentProject, listR
 import { readTolokaState } from "../../state";
 import { assertCli } from "../cli-error";
 import { formatTable } from "../table";
-import type { CreateScopedTokenBodyAnyOfPreset } from "../../../openapi/gen/models";
+import type { CreateScopedTokenBodyAnyOfPreset, ScopedTokenSummary } from "../../../openapi/gen/models";
 
 const TOKEN_PRESETS: readonly CreateScopedTokenBodyAnyOfPreset[] = [
   "read",
@@ -183,7 +183,10 @@ export const registerProjectCommands = (program: Command, host: CommandHost): vo
     .action(async () => {
       const { client, projectId } = await resolveContext(globals(), context);
       assertProjectSelected(projectId);
-      const { tokens } = await client.projects.listTokens({ projectId });
+      const tokens: ScopedTokenSummary[] = [];
+      for await (const token of client.projects.listAllTokens({ projectId })) {
+        tokens.push(token);
+      }
       context.io.stdout(
         tokens.length === 0
           ? "No live tokens."
@@ -209,6 +212,15 @@ export const registerProjectCommands = (program: Command, host: CommandHost): vo
       await client.projects.revokeToken({ projectId, tokenId });
       context.io.stdout(`Revoked ${tokenId}.`);
     });
+  project
+    .command("revoke-tokens")
+    .description("revoke every live project-scoped token of the project; they stop working immediately")
+    .action(async () => {
+      const { client, projectId } = await resolveContext(globals(), context);
+      assertProjectSelected(projectId);
+      const { revokedCount } = await client.projects.revokeAllTokens({ projectId });
+      context.io.stdout(`Revoked ${revokedCount} token${revokedCount === 1 ? "" : "s"}.`);
+    });
   const create = project
     .command("create")
     .argument("[alias]", "local name for the new project")

package/src/client.ts

@@ -37,6 +37,7 @@ import type {
   ListAudienceSpecializationsParams,
   ListProjectModelsParams,
   ListProjectsParams,
+  ListProjectTokensParams,
   ListTrainingRunsParams,
   ListProjectTrainingsParams,
   Pipeline as GeneratedPipeline,
@@ -292,10 +293,17 @@ const createClientImplementation = (config: ClientConfig) => {
       }, params),
     createToken: ({ projectId, ...body }: { projectId: ProjectId } & CreateScopedTokenBody) =>
       wire.createProjectToken(projectId, body, requestOptions),
-    listTokens: ({ projectId }: { projectId: ProjectId }) =>
-      wire.listProjectTokens(projectId, requestOptions),
+    listTokens: ({ projectId, ...params }: { projectId: ProjectId } & ListProjectTokensParams) =>
+      wire.listProjectTokens(projectId, params, requestOptions),
+    listAllTokens: ({ projectId, ...params }: { projectId: ProjectId } & ListProjectTokensParams) =>
+      listAllPages(async (pageOptions) => {
+        const page = await wire.listProjectTokens(projectId, { ...params, ...pageOptions }, requestOptions);
+        return { items: page.tokens, pagination: page.pagination };
+      }, params),
     revokeToken: ({ projectId, tokenId }: { projectId: ProjectId; tokenId: string }) =>
       wire.revokeProjectToken(projectId, tokenId, requestOptions),
+    revokeAllTokens: ({ projectId }: { projectId: ProjectId }) =>
+      wire.revokeProjectTokens(projectId, requestOptions),
     revokeCurrentToken: () => wire.revokeCurrentToken(requestOptions),
   };