antpath 0.2.1 → 0.4.0

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-e4adb3ee5b4053a78a8ddaf9cd653fbaf6a0ddf98432411308964c8fd40909f8  cli.mjs
+a602b27fb33ed22e122096a17bbe0a1f132a6981e55db03ace316dddc048eac2  cli.mjs

package/dist/client.d.ts

@@ -1,14 +1,106 @@
-import type { ManagedAgentProvider } from "./providers/types.js";
-import type { TemplateDefinition } from "./template/types.js";
-import type { CleanupPolicy, RunHandle, RunOptions } from "./types.js";
-import { SecretString } from "./utils/secrets.js";
+import { type FetchLike, type Output, type PlatformInlineSecrets, type PlatformProxyEndpoint, type ResolvedTemplate, type Run, type RunEvent, type SignedOutputLink, type TemplateDefinition, type WhoAmI } from "./_shared/index.js";
 export interface AntpathClientOptions {
-    anthropicApiKey?: string | SecretString;
-    provider?: ManagedAgentProvider;
-    cleanupPolicy?: CleanupPolicy;
+    /** Workspace-scoped SDK API token. */
+    readonly apiToken: string;
+    /**
+     * Dashboard BFF root, e.g. `https://antpath.example.com`. Optional —
+     * defaults to the canonical hosted URL (`https://antpath.ai`).
+     * Self-hosted deployments override; the default lives in source so
+     * the agent reading the SDK call site can see exactly where the call
+     * goes.
+     */
+    readonly baseUrl?: string;
+    /** Optional `fetch` override for testing. */
+    readonly fetch?: FetchLike;
 }
+/**
+ * Per-run submission options. `secrets.anthropic.apiKey` is REQUIRED on
+ * every call — the dashboard does not store provider credentials on
+ * your behalf. Optional `mcpServers`, `skills`, and `proxyEndpointAuth`
+ * round out the session-scoped credential bundle.
+ */
+export interface RunSubmitOptions {
+    readonly variables?: Record<string, string>;
+    readonly secrets: PlatformInlineSecrets;
+    readonly proxyEndpoints?: readonly PlatformProxyEndpoint[];
+    readonly cleanup?: {
+        readonly session?: "retain" | "delete";
+    };
+    readonly idempotencyKey?: string;
+    readonly signal?: AbortSignal;
+}
+export interface StreamEventsOptions {
+    readonly intervalMs?: number;
+    readonly signal?: AbortSignal;
+}
+export interface WaitForRunOptions {
+    readonly intervalMs?: number;
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Lightweight reference to a submitted run. All read-back operations
+ * delegate to the same `AntpathClient` and the same operations module
+ * the CLI uses, so SDK and CLI never drift.
+ */
+export declare class RunRef {
+    #private;
+    readonly runId: string;
+    constructor(client: AntpathClient, runId: string);
+    get(): Promise<Run>;
+    events(): Promise<readonly RunEvent[]>;
+    stream(options?: StreamEventsOptions): AsyncIterable<RunEvent>;
+    wait(options?: WaitForRunOptions): Promise<Run>;
+    outputs(): Promise<readonly Output[]>;
+    cancel(): Promise<void>;
+    delete(): Promise<void>;
+}
+/**
+ * Unified user-facing client for the antpath platform. The same class
+ * powers the published `antpath` SDK and (under the hood) every host-side
+ * subcommand of the in-container `antpath` CLI. All operations talk to
+ * the dashboard BFF and operate on durable run records.
+ *
+ * The SDK never asks the caller for a workspace id — workspace identity
+ * is derived server-side from the API token on every request. Use
+ * `client.whoami()` if you want to introspect which workspace the
+ * token resolves to.
+ */
 export declare class AntpathClient {
     #private;
     constructor(options: AntpathClientOptions);
-    run(template: TemplateDefinition, options?: RunOptions): Promise<RunHandle>;
+    /**
+     * Submit a run and wait for it to reach a terminal state. Returns the
+     * final `Run` record. For long-running flows, prefer `submitRun` +
+     * `streamEvents` + `waitForRun`.
+     */
+    run(template: TemplateDefinition, options: RunSubmitOptions): Promise<Run>;
+    /**
+     * Submit a run and return a `RunRef` immediately. Use the ref to
+     * stream events, fetch outputs, cancel, or delete the run.
+     */
+    submitRun(template: TemplateDefinition, options: RunSubmitOptions): Promise<RunRef>;
+    /**
+     * Same as `submitRun` but accepts an already-compiled `ResolvedTemplate`.
+     * Useful when consuming a `.json` template directly.
+     */
+    submitResolvedRun(template: ResolvedTemplate, options: RunSubmitOptions): Promise<RunRef>;
+    getRun(runId: string): Promise<Run>;
+    listEvents(runId: string): Promise<readonly RunEvent[]>;
+    /**
+     * Poll the events endpoint and yield new events as they arrive. Stops
+     * when the run reaches a terminal state, when the signal is aborted,
+     * or when the caller breaks out of the iterator.
+     */
+    streamEvents(runId: string, options?: StreamEventsOptions): AsyncIterable<RunEvent>;
+    /**
+     * Poll the run record until it reaches a terminal status (succeeded,
+     * failed, terminated). Throws if `timeoutMs` elapses first.
+     */
+    waitForRun(runId: string, options?: WaitForRunOptions): Promise<Run>;
+    listOutputs(runId: string): Promise<readonly Output[]>;
+    createOutputLink(runId: string, outputId: string): Promise<SignedOutputLink>;
+    cancelRun(runId: string): Promise<void>;
+    deleteRun(runId: string): Promise<void>;
+    whoami(): Promise<WhoAmI>;
 }

package/dist/client.js

@@ -1,39 +1,202 @@
-import { validateCredentials } from "./credentials.js";
-import { AnthropicManagedAgentsProvider } from "./providers/anthropic/provider.js";
-import { RunController } from "./run/controller.js";
-import { compileTemplate } from "./template/compiler.js";
+import { HttpClient, operations, toPlatformSubmissionTemplate, validateProxyAuth, compileTemplate } from "./_shared/index.js";
+/**
+ * Lightweight reference to a submitted run. All read-back operations
+ * delegate to the same `AntpathClient` and the same operations module
+ * the CLI uses, so SDK and CLI never drift.
+ */
+export class RunRef {
+    runId;
+    #client;
+    constructor(client, runId) {
+        this.#client = client;
+        this.runId = runId;
+    }
+    get() {
+        return this.#client.getRun(this.runId);
+    }
+    events() {
+        return this.#client.listEvents(this.runId);
+    }
+    stream(options) {
+        return this.#client.streamEvents(this.runId, options);
+    }
+    wait(options) {
+        return this.#client.waitForRun(this.runId, options);
+    }
+    outputs() {
+        return this.#client.listOutputs(this.runId);
+    }
+    cancel() {
+        return this.#client.cancelRun(this.runId);
+    }
+    delete() {
+        return this.#client.deleteRun(this.runId);
+    }
+}
+/**
+ * Unified user-facing client for the antpath platform. The same class
+ * powers the published `antpath` SDK and (under the hood) every host-side
+ * subcommand of the in-container `antpath` CLI. All operations talk to
+ * the dashboard BFF and operate on durable run records.
+ *
+ * The SDK never asks the caller for a workspace id — workspace identity
+ * is derived server-side from the API token on every request. Use
+ * `client.whoami()` if you want to introspect which workspace the
+ * token resolves to.
+ */
 export class AntpathClient {
-    #provider;
-    #cleanupPolicy;
+    #http;
     constructor(options) {
-        if (options.provider) {
-            this.#provider = options.provider;
+        if (!options.apiToken) {
+            throw new Error("AntpathClient: apiToken is required");
         }
-        else if (options.anthropicApiKey) {
-            this.#provider = new AnthropicManagedAgentsProvider({ apiKey: options.anthropicApiKey });
+        this.#http = new HttpClient({
+            ...(options.baseUrl ? { baseUrl: options.baseUrl } : {}),
+            apiToken: options.apiToken,
+            ...(options.fetch ? { fetch: options.fetch } : {})
+        });
+    }
+    /**
+     * Submit a run and wait for it to reach a terminal state. Returns the
+     * final `Run` record. For long-running flows, prefer `submitRun` +
+     * `streamEvents` + `waitForRun`.
+     */
+    async run(template, options) {
+        const ref = await this.submitRun(template, options);
+        return ref.wait(options.signal ? { signal: options.signal } : {});
+    }
+    /**
+     * Submit a run and return a `RunRef` immediately. Use the ref to
+     * stream events, fetch outputs, cancel, or delete the run.
+     */
+    async submitRun(template, options) {
+        const resolved = compileTemplate(template, options.variables ?? {});
+        return this.submitResolvedRun(resolved, options);
+    }
+    /**
+     * Same as `submitRun` but accepts an already-compiled `ResolvedTemplate`.
+     * Useful when consuming a `.json` template directly.
+     */
+    async submitResolvedRun(template, options) {
+        if (!options.secrets || !options.secrets.anthropic?.apiKey) {
+            throw new Error("AntpathClient.submitRun: secrets.anthropic.apiKey is required");
         }
-        else {
-            throw new Error("AntpathClient requires anthropicApiKey or provider");
+        if (options.proxyEndpoints && options.proxyEndpoints.length > 0) {
+            validateProxyAuth(options.proxyEndpoints, options.secrets.proxyEndpointAuth);
         }
-        this.#cleanupPolicy = options.cleanupPolicy ?? "manual";
+        // The BFF derives `workspaceId` from the API token; the SDK never
+        // names it. See `references/development-principles.md`
+        // (Agent-first surface design, Concrete rule 3).
+        const submission = {
+            idempotencyKey: options.idempotencyKey ?? generateIdempotencyKey(),
+            template: toPlatformSubmissionTemplate(template),
+            ...(options.variables ? { variables: options.variables } : {}),
+            ...(options.cleanup ? { cleanup: options.cleanup } : {}),
+            secrets: options.secrets,
+            ...(options.proxyEndpoints && options.proxyEndpoints.length > 0
+                ? { proxyEndpoints: options.proxyEndpoints }
+                : {})
+        };
+        const run = await operations.submitRun(this.#http, submission);
+        return new RunRef(this, run.id);
     }
-    async run(template, options = {}) {
-        const resolved = compileTemplate(template, options.variables ?? {});
-        validateCredentials(resolved, options.credentials ?? {});
-        const controller = new RunController({
-            provider: this.#provider,
-            template: resolved,
-            credentials: options.credentials ?? {},
-            cleanupPolicy: options.cleanupPolicy ?? this.#cleanupPolicy,
-            timeoutMs: options.timeoutMs,
-            signal: options.signal,
-            logger: options.logger,
-            onEvent: options.onEvent,
-            onEventAbortOnError: options.onEventAbortOnError ?? false,
-            sessionResources: options.sessionResources ?? []
-        });
-        await controller.start();
-        return controller;
+    getRun(runId) {
+        return operations.getRun(this.#http, runId);
+    }
+    listEvents(runId) {
+        return operations.listRunEvents(this.#http, runId);
+    }
+    /**
+     * Poll the events endpoint and yield new events as they arrive. Stops
+     * when the run reaches a terminal state, when the signal is aborted,
+     * or when the caller breaks out of the iterator.
+     */
+    async *streamEvents(runId, options = {}) {
+        const intervalMs = options.intervalMs ?? 1_000;
+        const signal = options.signal;
+        let seenIds = new Set();
+        while (!signal?.aborted) {
+            const events = await this.listEvents(runId);
+            for (const event of events) {
+                if (!seenIds.has(event.id)) {
+                    seenIds.add(event.id);
+                    yield event;
+                }
+            }
+            const run = await this.getRun(runId);
+            if (isTerminal(run.status))
+                return;
+            await sleep(intervalMs, signal);
+        }
+    }
+    /**
+     * Poll the run record until it reaches a terminal status (succeeded,
+     * failed, terminated). Throws if `timeoutMs` elapses first.
+     */
+    async waitForRun(runId, options = {}) {
+        const intervalMs = options.intervalMs ?? 1_500;
+        const timeoutMs = options.timeoutMs;
+        const signal = options.signal;
+        const deadline = typeof timeoutMs === "number" ? Date.now() + timeoutMs : Number.POSITIVE_INFINITY;
+        while (!signal?.aborted) {
+            const run = await this.getRun(runId);
+            if (isTerminal(run.status))
+                return run;
+            if (Date.now() >= deadline) {
+                throw new Error(`AntpathClient.waitForRun: timeout after ${timeoutMs}ms`);
+            }
+            await sleep(intervalMs, signal);
+        }
+        throw new Error("AntpathClient.waitForRun: aborted");
+    }
+    listOutputs(runId) {
+        return operations.listOutputs(this.#http, runId);
+    }
+    createOutputLink(runId, outputId) {
+        return operations.createOutputLink(this.#http, runId, outputId);
     }
+    cancelRun(runId) {
+        return operations.cancelRun(this.#http, runId);
+    }
+    deleteRun(runId) {
+        return operations.deleteRun(this.#http, runId);
+    }
+    whoami() {
+        return operations.whoami(this.#http);
+    }
+}
+const TERMINAL_STATUSES = new Set([
+    "succeeded",
+    "failed",
+    "terminated",
+    "cancelled",
+    "canceled",
+    "cleaned_up"
+]);
+function isTerminal(status) {
+    return typeof status === "string" && TERMINAL_STATUSES.has(status);
+}
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(new Error("aborted"));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(new Error("aborted"));
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function generateIdempotencyKey() {
+    const cryptoObj = globalThis.crypto;
+    if (cryptoObj?.randomUUID)
+        return cryptoObj.randomUUID();
+    return `idem-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
 }
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AAEnF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAWzD,MAAM,OAAO,aAAa;IACf,SAAS,CAAuB;IAChC,cAAc,CAAgB;IAEvC,YAAY,OAA6B;QACvC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QACpC,CAAC;aAAM,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YACnC,IAAI,CAAC,SAAS,GAAG,IAAI,8BAA8B,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAA4B,EAAE,UAAsB,EAAE;QAC9D,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACpE,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,IAAI,aAAa,CAAC;YACnC,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc;YAC3D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,KAAK;YACzD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE;SACjD,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,UAAU,EACV,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EAYhB,MAAM,iBAAiB,CAAC;AA2CzB;;;;GAIG;AACH,MAAM,OAAO,MAAM;IACR,KAAK,CAAS;IACd,OAAO,CAAgB;IAEhC,YAAY,MAAqB,EAAE,KAAa;QAC9C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,CAAC,OAA6B;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,OAA2B;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,aAAa;IACf,KAAK,CAAa;IAE3B,YAAY,OAA6B;QACvC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC;YAC1B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,QAA4B,EAAE,OAAyB;QAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,QAA4B,EAAE,OAAyB;QACrE,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAA0B,EAAE,OAAyB;QAC3E,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,iBAAiB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC/E,CAAC;QACD,kEAAkE;QAClE,uDAAuD;QACvD,iDAAiD;QACjD,MAAM,UAAU,GAA+B;YAC7C,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,sBAAsB,EAAE;YAClE,QAAQ,EAAE,4BAA4B,CAAC,QAAQ,CAAC;YAChD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAC7D,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/D,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,YAAY,CAAC,KAAa,EAAE,UAA+B,EAAE;QAClE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACtB,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO;YACnC,MAAM,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,UAA6B,EAAE;QAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,QAAQ,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACnG,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,GAAG,CAAC;YACvC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,2CAA2C,SAAS,IAAI,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,OAAO,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,gBAAgB,CAAC,KAAa,EAAE,QAAgB;QAC9C,OAAO,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClE,CAAC;IAED,SAAS,CAAC,KAAa;QACrB,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,SAAS,CAAC,KAAa;QACrB,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,MAAM;QACJ,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;CACF;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,MAA0B;IAC5C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,MAA+B;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,SAAS,GAAI,UAAyD,CAAC,MAAM,CAAC;IACpF,IAAI,SAAS,EAAE,UAAU;QAAE,OAAO,SAAS,CAAC,UAAU,EAAE,CAAC;IACzD,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAClF,CAAC"}

package/dist/index.d.ts

@@ -1,10 +1,16 @@
-export { AntpathClient } from "./client.js";
-export { AntpathPlatformClient, PlatformApiError, validateProxyAuth, buildPlatformAllowedHosts, resetDefaultSecretsDeprecationWarning } from "./platform/index.js";
-export type { PlatformEvent, PlatformOutput, PlatformRun, SignedOutputLink, PlatformInlineSecrets, PlatformRunSubmissionRequest, PlatformProxyEndpoint, PlatformProxyEndpointAuth, PlatformProxyAuthShape, PlatformProxyMethod, PlatformProxyResponseMode, AntpathPlatformClientOptions } from "./platform/index.js";
-export { AnthropicManagedAgentsProvider } from "./providers/anthropic/provider.js";
-export type { ManagedAgentProvider, ProviderSkillRef, SessionResourceInput, UploadFileInput } from "./providers/types.js";
-export { isAgentEvent, isAgentCustomToolUse, isAgentMcpToolResult, isAgentMcpToolUse, isAgentMessage, isAgentThinking, isAgentToolResult, isAgentToolUse, isSessionError, isSessionEvent, isSessionStatusIdle, isSessionStatusRescheduled, isSessionStatusRunning, isSessionStatusTerminated, isSpanEvent, isUserEvent, isUserMessage } from "./providers/known-events.js";
-export { compileTemplate, defineTemplate, requiredOAuthAccessToken, requiredStaticBearer, string, type EnvironmentDefinition, type ResolvedTemplate, type TemplateDefinition, type TemplateVariableDefinition } from "./template/index.js";
-export type { CleanupPolicy, CleanupResult, CredentialInput, DownloadOutputsOptions, DownloadOutputsResult, Logger, OutputManifest, ProviderEvent, ProviderFile, ProviderResourceIds, RunEvent, RunEventHandler, RunHandle, RunOptions, RunResult, RunStatus, SessionResourceUpload, UsageSummary } from "./types.js";
-export { SecretString, redactSecrets } from "./utils/secrets.js";
-export { AntpathError, CleanupError, CredentialValidationError, ProviderError, RunStateError, TemplateValidationError } from "./errors.js";
+/**
+ * Public surface of the `antpath` SDK.
+ *
+ * ONE class (`AntpathClient`) talks to the dashboard BFF. The CLI exposes
+ * the SAME operations via subcommands. Everything else is types, errors,
+ * template helpers, and event type guards re-exported from `@antpath/shared`.
+ */
+export { AntpathClient, RunRef } from "./client.js";
+export type { AntpathClientOptions, RunSubmitOptions, StreamEventsOptions, WaitForRunOptions } from "./client.js";
+export { AntpathApiError, AntpathError, CleanupError, CredentialValidationError, ProviderError, RunStateError, TemplateValidationError } from "./_shared/index.js";
+export { buildPlatformAllowedHosts, compileTemplate, defineTemplate, requiredOAuthAccessToken, requiredStaticBearer, string, toPlatformSubmissionTemplate, validateProxyAuth } from "./_shared/index.js";
+export type { CredentialRequirement, EnvironmentDefinition, McpServerDefinition, OutputDefinition, ResolvedTemplate, ResolvedMcpServer, SkillDefinition, TemplateDefinition, TemplateVariableDefinition } from "./_shared/index.js";
+export type { Output, ProviderEvent, Run, RunEvent, RunSubmissionInput, SignedOutputLink, UsageSummary, WhoAmI } from "./_shared/index.js";
+export type { PlatformAnthropicSecrets as AnthropicSecrets, PlatformInlineSecrets as InlineSecrets, PlatformMcpServerSecret as McpServerSecret, PlatformProxyEndpoint as ProxyEndpoint, PlatformProxyEndpointAuth as ProxyEndpointAuth, PlatformProxyAuthValue as ProxyAuthValue, PlatformRunSubmissionRequest as RunSubmissionRequest, PlatformSkillReference as SkillReference, PlatformTemplateSubmission as TemplateSubmission, ProxyAuthShape, ProxyMethod, ProxyResponseMode } from "./_shared/index.js";
+export { isAgentCustomToolUse, isAgentEvent, isAgentMcpToolResult, isAgentMcpToolUse, isAgentMessage, isAgentThinking, isAgentToolResult, isAgentToolUse, isSessionError, isSessionEvent, isSessionStatusIdle, isSessionStatusRescheduled, isSessionStatusRunning, isSessionStatusTerminated, isSpanEvent, isUserEvent, isUserMessage } from "./_shared/index.js";
+export { SecretString, redactSecrets } from "./_shared/index.js";

package/dist/index.js

@@ -1,8 +1,17 @@
-export { AntpathClient } from "./client.js";
-export { AntpathPlatformClient, PlatformApiError, validateProxyAuth, buildPlatformAllowedHosts, resetDefaultSecretsDeprecationWarning } from "./platform/index.js";
-export { AnthropicManagedAgentsProvider } from "./providers/anthropic/provider.js";
-export { isAgentEvent, isAgentCustomToolUse, isAgentMcpToolResult, isAgentMcpToolUse, isAgentMessage, isAgentThinking, isAgentToolResult, isAgentToolUse, isSessionError, isSessionEvent, isSessionStatusIdle, isSessionStatusRescheduled, isSessionStatusRunning, isSessionStatusTerminated, isSpanEvent, isUserEvent, isUserMessage } from "./providers/known-events.js";
-export { compileTemplate, defineTemplate, requiredOAuthAccessToken, requiredStaticBearer, string } from "./template/index.js";
-export { SecretString, redactSecrets } from "./utils/secrets.js";
-export { AntpathError, CleanupError, CredentialValidationError, ProviderError, RunStateError, TemplateValidationError } from "./errors.js";
+/**
+ * Public surface of the `antpath` SDK.
+ *
+ * ONE class (`AntpathClient`) talks to the dashboard BFF. The CLI exposes
+ * the SAME operations via subcommands. Everything else is types, errors,
+ * template helpers, and event type guards re-exported from `@antpath/shared`.
+ */
+export { AntpathClient, RunRef } from "./client.js";
+// Errors
+export { AntpathApiError, AntpathError, CleanupError, CredentialValidationError, ProviderError, RunStateError, TemplateValidationError } from "./_shared/index.js";
+// Template helpers
+export { buildPlatformAllowedHosts, compileTemplate, defineTemplate, requiredOAuthAccessToken, requiredStaticBearer, string, toPlatformSubmissionTemplate, validateProxyAuth } from "./_shared/index.js";
+// Event type guards
+export { isAgentCustomToolUse, isAgentEvent, isAgentMcpToolResult, isAgentMcpToolUse, isAgentMessage, isAgentThinking, isAgentToolResult, isAgentToolUse, isSessionError, isSessionEvent, isSessionStatusIdle, isSessionStatusRescheduled, isSessionStatusRunning, isSessionStatusTerminated, isSpanEvent, isUserEvent, isUserMessage } from "./_shared/index.js";
+// Secret utilities
+export { SecretString, redactSecrets } from "./_shared/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,qCAAqC,EACtC,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AAEnF,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,WAAW,EACX,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,eAAe,EACf,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,MAAM,EAKP,MAAM,qBAAqB,CAAC;AAqB7B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,uBAAuB,EACxB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAQpD,SAAS;AACT,OAAO,EACL,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,uBAAuB,EACxB,MAAM,iBAAiB,CAAC;AAEzB,mBAAmB;AACnB,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,MAAM,EACN,4BAA4B,EAC5B,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AA4CzB,oBAAoB;AACpB,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,WAAW,EACX,aAAa,EACd,MAAM,iBAAiB,CAAC;AAEzB,mBAAmB;AACnB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC"}

package/docs/cleanup.md

@@ -4,12 +4,15 @@ title: Cleanup
 
 # Cleanup
 
-Cleanup is manual by default:
+By default, the worker cleans up Claude resources after a run reaches a terminal status (`succeeded`, `failed`, `terminated`). Skip cleanup explicitly when you need provider-side files/events for inspection:
 
 ```ts
-await handle.cleanup();
+const ref = await client.submitRun(template, {
+  secrets: { anthropic: { apiKey: process.env.ANTHROPIC_API_KEY! } },
+  cleanup: { session: "retain" }
+});
 ```
 
-This preserves provider-side files/events for inspection and avoids deleting outputs before users download them.
+The corresponding CLI flag is `--cleanup retain` (default `delete`).
 
-If the SDK process exits before cleanup, provider resources may remain in the user's provider workspace. The result includes provider IDs so a future cleanup helper can recover orphaned resources when the caller recreates a Client with the same key.
+A retained session remains visible to Anthropic until the workspace's retention policy reclaims it. The dashboard records `cleanupStatus` (`succeeded` for delete, `retained` for retain, `failed` for crash-stranded resources) and `provider_resources` rows so a future repair operation can recover orphaned resources when needed.

package/docs/credentials.md

@@ -4,11 +4,11 @@ title: Credentials
 
 # Credentials
 
-antpath does not store provider keys or MCP credential values.
+antpath does not store provider keys or MCP credential values across runs.
 
-The caller creates `AntpathClient` with a provider key. MCP credentials are passed at run time and validated against Template requirements.
+The caller passes a workspace-scoped SDK token and provider key inline on every `submitRun` call. The dashboard vaults the bundle for the lifetime of a single run and destroys it at cleanup. MCP credentials and skill references travel the same way.
 
-MVP credential types:
+MVP credential types for MCP auth:
 
 - `static_bearer`;
 - `oauth_access_token`.
@@ -29,13 +29,12 @@ The platform's managed HTTP proxy is the agent-first alternative. The caller dec
 
 ```ts
 import {
-  AntpathPlatformClient,
+  AntpathClient,
   validateProxyAuth,
   buildPlatformAllowedHosts
 } from "antpath";
 
-const client = new AntpathPlatformClient({
-  baseUrl: "https://dashboard.antpath.dev",
+const client = new AntpathClient({
   apiToken: "ant_..."
 });
 
@@ -65,8 +64,7 @@ const proxyEndpointAuth = [
 // Fail fast at submission time when policy and auth disagree.
 validateProxyAuth(proxyEndpoints, proxyEndpointAuth);
 
-const run = await client.submitRun({
-  templateId: "tmpl_xxx",
+const ref = await client.submitRun(template, {
   proxyEndpoints,
   secrets: {
     anthropic: { apiKey: process.env.ANTHROPIC_API_KEY! },
@@ -78,7 +76,7 @@ const run = await client.submitRun({
 Inside the run container, every session has the platform CLI mounted at `/antpath/antpath` (a Node ESM bundle) and a manifest at `/antpath/index.json` describing the declared endpoints. The skill calls the proxy via the CLI:
 
 ```bash
-node /antpath/antpath proxy stripe \
+/antpath/antpath proxy stripe \
   --method GET \
   --path /v1/charges/ch_123 \
   --response-mode headers_only
@@ -86,7 +84,7 @@ node /antpath/antpath proxy stripe \
 
 The CLI reads the per-run bearer from `/antpath/run-token`, attaches the `X-Antpath-Proxy-Protocol` header, and the BFF injects the bearer/header/query/basic credential before dispatching the outbound call. Only the response (subject to `responseMode` and `maxResponseBytes`) reaches the container. `--response-mode` can only narrow below the policy ceiling.
 
-`node /antpath/antpath --help` reads endpoint details from `/antpath/index.json`. Runs that do not declare any `proxyEndpoints` still have the CLI and an empty manifest mounted, so agents never need to introspect whether the surface exists.
+`/antpath/antpath --help` reads endpoint details from `/antpath/index.json`. Runs that do not declare any `proxyEndpoints` still have the CLI and an empty manifest mounted, so agents never need to introspect whether the surface exists.
 
 ### Networking
 
@@ -99,7 +97,7 @@ const allowedHosts = buildPlatformAllowedHosts({
 });
 ```
 
-### Deprecation: `defaultSecrets`
+### Secrets are always explicit at the call site
 
-`AntpathPlatformClientOptions.defaultSecrets` is deprecated. Pass `secrets` explicitly on every `submitRun` call so the active credentials are visible at the call site (agent-first design). The client emits a one-time deprecation warning when constructed with `defaultSecrets`.
+There is no `defaultSecrets` and no client-held secret state. Every `submitRun` call carries its full `secrets` bundle (Anthropic key + optional MCP credentials + optional skill references + optional `proxyEndpointAuth`). This is the agent-first invariant: the credentials being used on any given call are visible in the same line of code that submits the run.