broods 0.2.1 → 0.3.0

package/dist/account.js

@@ -0,0 +1,271 @@
+// @bun
+// src/account.ts
+var DEFAULT_ACCOUNT_BASE_URL = "https://gateway.broods.app";
+
+class BroodsAccountApiError extends Error {
+  status;
+  body;
+  constructor(method, path, status, body) {
+    super(`${method} ${path} failed with ${status}: ${body}`);
+    this.name = "BroodsAccountApiError";
+    this.status = status;
+    this.body = body;
+  }
+}
+function envVar(name) {
+  return typeof process !== "undefined" ? process?.env?.[name] : undefined;
+}
+
+class BroodsAccountClient {
+  baseUrl;
+  accountSecret;
+  fetchImpl;
+  constructor(options = {}) {
+    const baseUrl = options.baseUrl ?? envVar("BROODS_BASE_URL") ?? DEFAULT_ACCOUNT_BASE_URL;
+    const accountSecret = options.accountSecret ?? envVar("BROODS_ACCOUNT_SECRET");
+    if (!accountSecret)
+      throw new Error("BroodsAccountClient requires an accountSecret (or BROODS_ACCOUNT_SECRET).");
+    this.baseUrl = baseUrl.replace(/\/+$/, "");
+    this.accountSecret = accountSecret;
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  async getAccount() {
+    const result = await this.request("GET", "/v1/account");
+    if (!result)
+      throw new BroodsAccountApiError("GET", "/v1/account", 404, "Account not found");
+    return result.account;
+  }
+  async updateAccount(patch) {
+    const result = await this.request("PATCH", "/v1/account", patch);
+    return result?.account ?? null;
+  }
+  async rotateSecret() {
+    const result = await this.request("POST", "/v1/account/rotate-secret");
+    if (!result)
+      throw new BroodsAccountApiError("POST", "/v1/account/rotate-secret", 404, "Account not found");
+    return result;
+  }
+  async deleteAccount() {
+    const result = await this.request("DELETE", "/v1/account");
+    return result ?? { deleted: false };
+  }
+  webhookUrl(accountId, agentId, channelType) {
+    const segments = [accountId, agentId, channelType].map(encodeURIComponent);
+    return `${this.baseUrl}/webhooks/${segments.join("/")}`;
+  }
+  async listAgents() {
+    const result = await this.request("GET", "/v1/agents");
+    return result?.agents ?? [];
+  }
+  async createAgent(input) {
+    const result = await this.request("POST", "/v1/agents", input);
+    if (!result)
+      throw new BroodsAccountApiError("POST", "/v1/agents", 404, "Not found");
+    return result;
+  }
+  async getAgent(agentId) {
+    return await this.request("GET", `/v1/agents/${encodeURIComponent(agentId)}`);
+  }
+  async updateAgent(agentId, patch) {
+    return await this.request("PATCH", `/v1/agents/${encodeURIComponent(agentId)}`, patch);
+  }
+  async deleteAgent(agentId) {
+    const result = await this.request("DELETE", `/v1/agents/${encodeURIComponent(agentId)}`);
+    return result?.deleted ?? false;
+  }
+  async listCrons() {
+    const result = await this.request("GET", "/v1/crons");
+    return result?.crons ?? [];
+  }
+  async createCron(input) {
+    const result = await this.request("POST", "/v1/crons", input);
+    if (!result)
+      throw new BroodsAccountApiError("POST", "/v1/crons", 404, "Not found");
+    return result;
+  }
+  async getCron(cronId) {
+    return await this.request("GET", `/v1/crons/${encodeURIComponent(cronId)}`);
+  }
+  async updateCron(cronId, patch) {
+    return await this.request("PATCH", `/v1/crons/${encodeURIComponent(cronId)}`, patch);
+  }
+  async deleteCron(cronId) {
+    const result = await this.request("DELETE", `/v1/crons/${encodeURIComponent(cronId)}`);
+    return result?.deleted ?? false;
+  }
+  async listCronRuns(cronId, options = {}) {
+    const query = options.limit !== undefined ? `?limit=${options.limit}` : "";
+    const result = await this.request("GET", `/v1/crons/${encodeURIComponent(cronId)}/runs${query}`);
+    return result?.runs ?? [];
+  }
+  async listWorkspaces() {
+    const result = await this.request("GET", "/v1/workspaces");
+    return result?.workspaces ?? [];
+  }
+  async createWorkspace(input) {
+    const result = await this.request("POST", "/v1/workspaces", input);
+    if (!result)
+      throw new BroodsAccountApiError("POST", "/v1/workspaces", 404, "Not found");
+    return result;
+  }
+  async getWorkspace(workspaceId) {
+    return await this.request("GET", `/v1/workspaces/${encodeURIComponent(workspaceId)}`);
+  }
+  async updateWorkspace(workspaceId, patch) {
+    return await this.request("PATCH", `/v1/workspaces/${encodeURIComponent(workspaceId)}`, patch);
+  }
+  async deleteWorkspace(workspaceId) {
+    const result = await this.request("DELETE", `/v1/workspaces/${encodeURIComponent(workspaceId)}`);
+    return result?.deleted ?? false;
+  }
+  async listWorkspaceFiles(workspaceId) {
+    const result = await this.request("GET", `/v1/workspaces/${encodeURIComponent(workspaceId)}/files`);
+    return result?.files ?? [];
+  }
+  async getWorkspaceFileUrl(workspaceId, path) {
+    const query = `?path=${encodeURIComponent(path)}`;
+    const result = await this.request("GET", `/v1/workspaces/${encodeURIComponent(workspaceId)}/files${query}`);
+    return result?.url ?? null;
+  }
+  async uploadWorkspaceFile(workspaceId, input) {
+    const path = `/v1/workspaces/${encodeURIComponent(workspaceId)}/files`;
+    const result = await this.request("POST", path, input);
+    if (!result)
+      throw new BroodsAccountApiError("POST", path, 404, "Workspace not found");
+    return result.file;
+  }
+  async renameWorkspaceFile(workspaceId, path, newPath) {
+    const result = await this.request("PATCH", `/v1/workspaces/${encodeURIComponent(workspaceId)}/files`, { path, newPath });
+    return result?.renamed ?? false;
+  }
+  async deleteWorkspaceFile(workspaceId, path) {
+    const result = await this.request("DELETE", `/v1/workspaces/${encodeURIComponent(workspaceId)}/files`, { path });
+    return result?.deleted ?? false;
+  }
+  async listSandboxes() {
+    const result = await this.request("GET", "/v1/sandboxes");
+    return result?.sandboxes ?? [];
+  }
+  async createSandbox(input) {
+    const result = await this.request("POST", "/v1/sandboxes", input);
+    if (!result)
+      throw new BroodsAccountApiError("POST", "/v1/sandboxes", 404, "Not found");
+    return result;
+  }
+  async getSandbox(sandboxId) {
+    return await this.request("GET", `/v1/sandboxes/${encodeURIComponent(sandboxId)}`);
+  }
+  async updateSandbox(sandboxId, patch) {
+    return await this.request("PATCH", `/v1/sandboxes/${encodeURIComponent(sandboxId)}`, patch);
+  }
+  async deleteSandbox(sandboxId) {
+    const result = await this.request("DELETE", `/v1/sandboxes/${encodeURIComponent(sandboxId)}`);
+    return result?.deleted ?? false;
+  }
+  async suspendSandbox(sandboxId, reservationKey) {
+    return await this.sandboxAction(sandboxId, "suspend", { reservationKey });
+  }
+  async resumeSandbox(sandboxId, reservationKey) {
+    return await this.sandboxAction(sandboxId, "resume", { reservationKey });
+  }
+  async terminateSandbox(sandboxId, reservationKey) {
+    return await this.sandboxAction(sandboxId, "terminate", { reservationKey });
+  }
+  async snapshotSandbox(sandboxId, reservationKey, name) {
+    return await this.sandboxAction(sandboxId, "snapshot", { reservationKey, name });
+  }
+  async openSandboxTerminal(sandboxId, reservationKey) {
+    return await this.sandboxAction(sandboxId, "terminal", { reservationKey });
+  }
+  async listTools() {
+    const result = await this.request("GET", "/v1/tools");
+    return result?.tools ?? [];
+  }
+  async createTool(input) {
+    const result = await this.request("POST", "/v1/tools", input);
+    if (!result)
+      throw new BroodsAccountApiError("POST", "/v1/tools", 404, "Not found");
+    return result;
+  }
+  async getTool(toolId) {
+    return await this.request("GET", `/v1/tools/${encodeURIComponent(toolId)}`);
+  }
+  async updateTool(toolId, patch) {
+    return await this.request("PATCH", `/v1/tools/${encodeURIComponent(toolId)}`, patch);
+  }
+  async deleteTool(toolId) {
+    const result = await this.request("DELETE", `/v1/tools/${encodeURIComponent(toolId)}`);
+    return result?.deleted ?? false;
+  }
+  async listPolicies() {
+    const result = await this.request("GET", "/v1/policies");
+    return result?.policies ?? [];
+  }
+  async createPolicy(input) {
+    const result = await this.request("POST", "/v1/policies", input);
+    if (!result)
+      throw new BroodsAccountApiError("POST", "/v1/policies", 404, "Not found");
+    return result;
+  }
+  async getPolicy(policyId) {
+    return await this.request("GET", `/v1/policies/${encodeURIComponent(policyId)}`);
+  }
+  async updatePolicy(policyId, patch) {
+    return await this.request("PATCH", `/v1/policies/${encodeURIComponent(policyId)}`, patch);
+  }
+  async deletePolicy(policyId) {
+    const result = await this.request("DELETE", `/v1/policies/${encodeURIComponent(policyId)}`);
+    return result?.deleted ?? false;
+  }
+  async listSkills() {
+    const result = await this.request("GET", "/v1/skills");
+    return result?.skills ?? [];
+  }
+  async createSkill(input) {
+    const result = await this.request("POST", "/v1/skills", input);
+    if (!result)
+      throw new BroodsAccountApiError("POST", "/v1/skills", 404, "Not found");
+    return result;
+  }
+  async getSkill(skillName) {
+    return await this.request("GET", `/v1/skills/${encodeURIComponent(skillName)}`);
+  }
+  async uploadSkill(skillName, input) {
+    const path = `/v1/skills/${encodeURIComponent(skillName)}`;
+    const result = await this.request("PUT", path, input);
+    if (!result)
+      throw new BroodsAccountApiError("PUT", path, 404, "Skill not found");
+    return result;
+  }
+  async deleteSkill(skillName) {
+    const result = await this.request("DELETE", `/v1/skills/${encodeURIComponent(skillName)}`);
+    return result?.deleted ?? false;
+  }
+  async sandboxAction(sandboxId, action, body) {
+    const path = `/v1/sandboxes/${encodeURIComponent(sandboxId)}/${action}`;
+    const result = await this.request("POST", path, body);
+    if (!result)
+      throw new BroodsAccountApiError("POST", path, 404, "Sandbox not found");
+    return result;
+  }
+  async request(method, path, body) {
+    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${this.accountSecret}`,
+        ...body !== undefined ? { "Content-Type": "application/json" } : {}
+      },
+      ...body !== undefined ? { body: JSON.stringify(body) } : {}
+    });
+    if (response.status === 404)
+      return null;
+    if (!response.ok) {
+      throw new BroodsAccountApiError(method, path, response.status, await response.text());
+    }
+    return await response.json();
+  }
+}
+export {
+  BroodsAccountClient,
+  BroodsAccountApiError
+};

package/dist/cli/index.js

@@ -2595,7 +2595,7 @@ function renderStreamPart(part, state) {
 // package.json
 var package_default = {
   name: "broods",
-  version: "0.2.1",
+  version: "0.3.0",
   description: "CLI + TypeScript SDK for the broods agent platform.",
   type: "module",
   license: "MIT",
@@ -2622,6 +2622,10 @@ var package_default = {
     ".": {
       types: "./dist/index.d.ts",
       import: "./dist/index.js"
+    },
+    "./account": {
+      types: "./dist/account.d.ts",
+      import: "./dist/account.js"
     }
   },
   main: "./dist/index.js",

package/dist/index.d.ts

@@ -950,6 +950,319 @@ declare class BroodsClient {
 }
 declare function normalizeHttpServiceUrl(value: string): string;
 
+/**
+ * Account config-plane client for the broods public account REST API.
+ *
+ * This is the DYNAMIC counterpart to the config-first `broods dev` / `broods
+ * deploy` flow: `broods dev` syncs the predefined resources declared in your
+ * `broods/` folder, while `BroodsAccountClient` creates and mutates the full
+ * account config plane at runtime — agents, sandboxes (config + lifecycle),
+ * workspaces (config + files), tools, policies, skills, crons, and the account
+ * itself — e.g. a multi-tenant app provisioning one agent per customer from its
+ * own backend.
+ *
+ * Kept intentionally standalone (import from `broods/account`): pure fetch,
+ * no Node built-ins, no `.env` file loading — so it runs in edge/worker
+ * runtimes such as Convex actions, Cloudflare Workers, and the browser-less
+ * server runtimes, as well as Node and Bun.
+ *
+ * Auth: every call sends `Authorization: Bearer {accountSecret}` to
+ * `{baseUrl}/v1/...`. Secrets inside agent configs are encrypted at rest by
+ * the platform and come back redacted (`********`) on reads.
+ */
+
+interface BroodsAccountClientOptions {
+    /** Base URL of the broods gateway. Falls back to `BROODS_BASE_URL`, then `https://gateway.broods.app`. */
+    baseUrl?: string;
+    /** Account secret used as the Bearer token. Falls back to `BROODS_ACCOUNT_SECRET`. */
+    accountSecret?: string;
+    fetch?: typeof fetch;
+}
+/** Public account record returned by `GET /v1/account`. */
+interface BroodsAccount {
+    accountId: string;
+    username: string;
+    status: string;
+    [key: string]: unknown;
+}
+/** Public agent record; `config` comes back with secret values redacted. */
+interface AccountAgent {
+    accountId: string;
+    agentId: string;
+    name: string;
+    description?: string;
+    status: string;
+    config: AgentConfig;
+    createdAt: string;
+    updatedAt: string;
+}
+interface CreateAgentResult {
+    accountId: string;
+    agentId: string;
+    name: string;
+    description?: string;
+}
+/** Fields accepted by `PATCH /v1/agents/{id}`. `config` is deep-merged; `null` values delete keys. */
+interface UpdateAgentInput {
+    name?: string;
+    description?: string | null;
+    config?: unknown;
+}
+/** Public workspace record returned by the workspaces routes. */
+interface AccountWorkspace {
+    accountId: string;
+    workspaceId: string;
+    name: string;
+    description?: string;
+    config: WorkspaceConfig;
+    createdAt: string;
+    updatedAt: string;
+}
+/** One entry of a workspace file listing (`GET /v1/workspaces/{id}/files`). */
+interface WorkspaceFileEntry {
+    path: string;
+    name: string;
+    isFolder: boolean;
+    sizeBytes?: number;
+    updatedAt?: string;
+}
+/** Public sandbox config record; `config` comes back with secret values (e.g. `envVars`) redacted. */
+interface AccountSandbox {
+    accountId: string;
+    sandboxId: string;
+    name: string;
+    description?: string;
+    config: SandboxConfig;
+    createdAt: string;
+    updatedAt: string;
+    [key: string]: unknown;
+}
+/** Public agent-policy record returned by the policies routes. */
+interface AccountPolicy {
+    accountId: string;
+    policyId: string;
+    name: string;
+    description?: string;
+    document: AgentPolicyDocument;
+    status: string;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Public uploaded-tool record returned by the tools routes. */
+interface AccountTool {
+    accountId: string;
+    toolId: string;
+    name: string;
+    description: string;
+    inputSchema: unknown;
+    sha256: string;
+    runtime: "isolate" | "sandbox";
+    defaultConfig?: unknown;
+    status: string;
+    createdAt: string;
+    updatedAt: string;
+    deletedAt?: string;
+}
+/** Fields accepted by `POST /v1/tools`. `bundle` is already-bundled JavaScript module source. */
+interface CreateToolInput {
+    name: string;
+    description: string;
+    inputSchema: unknown;
+    bundle: string;
+    runtime?: "isolate" | "sandbox";
+    defaultConfig?: unknown;
+}
+/** Fields accepted by `PATCH /v1/tools/{toolId}`; every field is optional. Omitting `bundle` keeps the stored one. */
+interface UpdateToolInput {
+    name?: string;
+    description?: string;
+    inputSchema?: unknown;
+    bundle?: string;
+    runtime?: "isolate" | "sandbox";
+    defaultConfig?: unknown;
+}
+/**
+ * Body of a skill upload (`POST /v1/skills`, `PUT /v1/skills/{skillName}`).
+ * `json` needs `name`/`description`/`content`; `files` needs base64 `files`
+ * including a root `SKILL.md`; `github` needs a tree `url`.
+ */
+interface SkillUploadInput {
+    source: "json" | "files" | "github";
+    name?: string;
+    description?: string;
+    content?: string;
+    files?: Array<{
+        path: string;
+        contentBase64: string;
+        contentType?: string;
+    }>;
+    url?: string;
+}
+/** Result of `POST /v1/account/rotate-secret`. The returned `secret` is shown once; the old secret stops working immediately. */
+interface RotateSecretResult {
+    account: BroodsAccount;
+    secret: string;
+}
+/** Result of `DELETE /v1/account`: the account and all account-scoped data are removed; `cleanup` reports per-resource deletion counts. */
+interface DeleteAccountResult {
+    deleted: boolean;
+    cleanup?: Record<string, number>;
+}
+/** Result of a suspend/resume/terminate sandbox lifecycle action. */
+interface SandboxLifecycleResult {
+    status: string;
+}
+/** Result of `POST /v1/sandboxes/{id}/snapshot`. */
+interface SandboxSnapshotResult {
+    status: string;
+    snapshotId?: string;
+    externalImageId?: string;
+}
+/** Sealed ticket from `POST /v1/sandboxes/{id}/terminal`; hand `token` to the gateway terminal WebSocket at `websocketPath`. */
+interface SandboxTerminalTicket {
+    token: string;
+    expiresAt: number;
+    websocketPath: string;
+}
+/** Non-2xx response from the account API (404s on id routes return null instead). */
+declare class BroodsAccountApiError extends Error {
+    readonly status: number;
+    readonly body: string;
+    constructor(method: string, path: string, status: number, body: string);
+}
+/**
+ * Typed client for the broods account config API. All `get`/`update`/`delete`
+ * methods return `null`/`false` when the resource does not exist (HTTP 404) so
+ * callers can implement upsert flows without try/catch; every other non-2xx
+ * status throws {@link BroodsAccountApiError}.
+ */
+declare class BroodsAccountClient {
+    private readonly baseUrl;
+    private readonly accountSecret;
+    private readonly fetchImpl;
+    constructor(options?: BroodsAccountClientOptions);
+    /** The account this secret belongs to. Its `accountId` is the first segment of channel webhook URLs. */
+    getAccount(): Promise<BroodsAccount>;
+    /** Update account metadata (username/description). Returns null when the account is gone. Runtime config is managed through the agent endpoints. */
+    updateAccount(patch: {
+        username?: string;
+        description?: string | null;
+    }): Promise<BroodsAccount | null>;
+    /** Rotate the account secret. The returned `secret` is shown once and the current secret stops working immediately, so persist it before the process exits. */
+    rotateSecret(): Promise<RotateSecretResult>;
+    /** Delete this account and cascade-clean every account-scoped resource. `cleanup` reports per-resource deletion counts. */
+    deleteAccount(): Promise<DeleteAccountResult>;
+    /**
+     * Provider webhook URL for one of an agent's channels. Paste this into the
+     * provider's webhook settings (Slack Event Subscriptions, Zalo OA webhook,
+     * Pancake page webhook). Routing is per account + agent, so each agent's
+     * channels are isolated from every other agent's.
+     */
+    webhookUrl(accountId: string, agentId: string, channelType: string): string;
+    listAgents(): Promise<AccountAgent[]>;
+    createAgent(input: {
+        name: string;
+        description?: string;
+        config: unknown;
+    }): Promise<CreateAgentResult>;
+    getAgent(agentId: string): Promise<AccountAgent | null>;
+    /** PATCH an agent. `config` deep-merges into the stored config; `null` leaves delete keys. Returns null when the agent is gone. */
+    updateAgent(agentId: string, patch: UpdateAgentInput): Promise<AccountAgent | null>;
+    deleteAgent(agentId: string): Promise<boolean>;
+    listCrons(): Promise<Cron[]>;
+    createCron(input: CreateCronInput): Promise<Cron>;
+    getCron(cronId: string): Promise<Cron | null>;
+    updateCron(cronId: string, patch: UpdateCronInput): Promise<Cron | null>;
+    deleteCron(cronId: string): Promise<boolean>;
+    /** Run history for a cron, newest first. Returns [] when the cron is gone. */
+    listCronRuns(cronId: string, options?: {
+        limit?: number;
+    }): Promise<CronRun[]>;
+    listWorkspaces(): Promise<AccountWorkspace[]>;
+    createWorkspace(input: {
+        name: string;
+        description?: string;
+        config?: unknown;
+    }): Promise<AccountWorkspace>;
+    getWorkspace(workspaceId: string): Promise<AccountWorkspace | null>;
+    updateWorkspace(workspaceId: string, patch: {
+        name?: string;
+        description?: string | null;
+        config?: unknown;
+    }): Promise<AccountWorkspace | null>;
+    deleteWorkspace(workspaceId: string): Promise<boolean>;
+    /** Flat listing of every file in the workspace's S3-backed filesystem. Returns [] when the workspace is gone. */
+    listWorkspaceFiles(workspaceId: string): Promise<WorkspaceFileEntry[]>;
+    /** Short-lived download URL for one workspace file. Returns null when the workspace or file is gone. */
+    getWorkspaceFileUrl(workspaceId: string, path: string): Promise<string | null>;
+    /** Upload or replace one workspace file from base64 content. Throws when the workspace is gone (404). */
+    uploadWorkspaceFile(workspaceId: string, input: {
+        path: string;
+        contentBase64: string;
+        contentType?: string;
+    }): Promise<WorkspaceFileEntry>;
+    /** Rename a workspace file or folder. Returns false when the workspace or source path is gone. */
+    renameWorkspaceFile(workspaceId: string, path: string, newPath: string): Promise<boolean>;
+    /** Delete a workspace file or folder. Returns false when the workspace or path is gone. */
+    deleteWorkspaceFile(workspaceId: string, path: string): Promise<boolean>;
+    listSandboxes(): Promise<AccountSandbox[]>;
+    createSandbox(input: {
+        name: string;
+        description?: string;
+        config?: unknown;
+    }): Promise<AccountSandbox>;
+    getSandbox(sandboxId: string): Promise<AccountSandbox | null>;
+    /** PATCH a sandbox config. `config` fully replaces the stored config. Returns null when the sandbox is gone. */
+    updateSandbox(sandboxId: string, patch: {
+        name?: string;
+        description?: string | null;
+        config?: unknown;
+    }): Promise<AccountSandbox | null>;
+    deleteSandbox(sandboxId: string): Promise<boolean>;
+    /** Suspend a persistent sandbox reservation. Throws on 404/403/409 (missing sandbox, foreign reservation, or unsupported provider). */
+    suspendSandbox(sandboxId: string, reservationKey: string): Promise<SandboxLifecycleResult>;
+    /** Resume a persistent sandbox reservation. Throws on 404/403/409. */
+    resumeSandbox(sandboxId: string, reservationKey: string): Promise<SandboxLifecycleResult>;
+    /** Terminate a persistent sandbox reservation and drop its live-instance row. Throws on 404/403/409. */
+    terminateSandbox(sandboxId: string, reservationKey: string): Promise<SandboxLifecycleResult>;
+    /** Snapshot a persistent sandbox reservation into a reusable image (self-hosted `sandbox` provider). Throws on 404/403/409. */
+    snapshotSandbox(sandboxId: string, reservationKey: string, name: string): Promise<SandboxSnapshotResult>;
+    /** Mint a short-lived sealed ticket for an interactive PTY session on a persistent sandbox (`sandbox`/`lambda` providers). Throws on 404/403/409. */
+    openSandboxTerminal(sandboxId: string, reservationKey: string): Promise<SandboxTerminalTicket>;
+    listTools(): Promise<AccountTool[]>;
+    createTool(input: CreateToolInput): Promise<AccountTool>;
+    getTool(toolId: string): Promise<AccountTool | null>;
+    /** PATCH an uploaded tool. Omitting `bundle` keeps the stored bundle and runtime. Returns null when the tool is gone. */
+    updateTool(toolId: string, patch: UpdateToolInput): Promise<AccountTool | null>;
+    deleteTool(toolId: string): Promise<boolean>;
+    listPolicies(): Promise<AccountPolicy[]>;
+    createPolicy(input: {
+        name: string;
+        description?: string;
+        document: AgentPolicyDocument;
+    }): Promise<AccountPolicy>;
+    getPolicy(policyId: string): Promise<AccountPolicy | null>;
+    /** PATCH a policy. `description: null` clears it. Returns null when the policy is gone. */
+    updatePolicy(policyId: string, patch: {
+        name?: string;
+        description?: string | null;
+        document?: AgentPolicyDocument;
+        status?: string;
+    }): Promise<AccountPolicy | null>;
+    deletePolicy(policyId: string): Promise<boolean>;
+    /** All skills for the account, each with its `<accountId>/<name>` path. */
+    listSkills(): Promise<Skill[]>;
+    /** Upload a new skill from JSON content, a base64 file bundle, or a GitHub tree URL. Every bundle must include a root `SKILL.md`. */
+    createSkill(input: SkillUploadInput): Promise<Skill>;
+    getSkill(skillName: string): Promise<Skill | null>;
+    /** Replace a skill's bundle in place (`PUT`). Throws when the skill is gone (404). */
+    uploadSkill(skillName: string, input: SkillUploadInput): Promise<Skill>;
+    deleteSkill(skillName: string): Promise<boolean>;
+    /** POST a sandbox lifecycle action, throwing on any non-2xx (including 404, since these are not upsert flows). */
+    private sandboxAction;
+    private request;
+}
+
 /**
  * WebSocket client for deployed-agent endpoints.
  * Uses the gateway URL when configured, or derives one from the core service URL.
@@ -1379,5 +1692,5 @@ declare function isResource(value: unknown): value is AnyResource;
 declare function isChannelDefinition(value: unknown): value is AnyChannelDefinition;
 declare function isBroodsConfig(value: unknown): value is BroodsConfigDefinition;
 
-export { BroodsClient, BroodsWebSocketClient, DEFAULT_CORE_BASE_URL, MAX_OBSERVABILITY_BACKFILL, BroodsWebSocketClient as WebSocketClient, BroodsWebSocketClient as WebsocketClient, defineAgent, defineBroods, defineCron, defineDiscordChannel, defineGitHubChannel, definePancakeChannel, definePolicy, defineSandbox, defineSkill, defineSlackChannel, defineTelegramChannel, defineTool, defineWorkspace, defineZaloChannel, env, isBroodsConfig, isChannelDefinition, isObservabilityClientMessage, isResource, normalizeHttpServiceUrl, readSseStream, resolveRunEvents, toWebSocketBaseUrl };
-export type { Account, Agent, AgentChannelWorkspaceScope, AgentChannelsConfig, AgentCodeHookConfig, AgentConfig, AgentConfigDoc, AgentDefinitionConfig, AgentDiscordChannelConfig, AgentGitHubChannelConfig, AgentHandle, AgentHookEventName, AgentHooks, AgentHooksConfig, AgentPancakeChannelConfig, AgentPolicyConfig, AgentPolicyDefinitionConfig, AgentPolicyDocument, AgentProviderSettings, AgentReference, AgentResource, AgentRunEventInput, AgentRunInput, AgentRunModelOverrides, AgentRunOverrides, AgentRunResult, AgentSkillsDefinitionConfig, AgentSlackChannelConfig, AgentStreamPart, AgentSubagentDefinitionConfig, AgentTelegramChannelConfig, AgentWebhookHookConfig, AgentWorkspaceInput, AgentWorkspaceRef, AgentWorkspaceRefInput, AgentZaloChannelConfig, AnyChannelDefinition, AnyResource, AsyncAgentRun, AsyncPollOptions, AsyncRequestAccepted, AsyncStatus, BroodsClientOptions, BroodsConfigDefinition, BroodsProjectConfig, BroodsWebSocketClientOptions, ChannelDefinition, ChannelMessageReceived, ChannelReference, ChannelType, CliManifest, CliManifestResource, CliResourceKind, CreateClientCronInput, CreateCronInput, Cron, CronDefinitionConfig, CronDoc, CronLastStatus, CronResource, CronRun, CronStatus, CustomTool, DiscordChannelDefinition, DiscordChannelInput, DiscordMessageSource, DiscordSource, Doc, EnvAccessor, EnvRef, EnvRefString, EnvironmentDoc, GeneratedIds, GitHubChannelDefinition, GitHubChannelInput, GitHubMessageSource, GitHubSource, HookContext, Id, LogLevel, ObservabilityBackfillMessage, ObservabilityClientMessage, ObservabilityErrorMessage, ObservabilityLogEntry, ObservabilityLogMessage, ObservabilityReadyMessage, ObservabilityServerMessage, ObservabilitySpanMessage, ObservabilitySpanRow, ObservabilitySubscribeMessage, ObservabilityUnsubscribeMessage, PancakeChannelDefinition, PancakeChannelInput, PancakeMessageSource, PancakeSource, PolicyDefinitionConfig, PolicyResource, ProjectDoc, ProviderConfigInput, ProviderSettingsInput, ResourceApi, ResourceDefinition, ResourceDefinitionInput, ResourceKind, Sandbox, SandboxConfig, SandboxConfigDoc, SandboxDefinitionConfig, SandboxResource, Skill, SkillDefinitionConfig, SkillResource, SlackChannelDefinition, SlackChannelInput, SlackMessageSource, SlackSource, TelegramChannelDefinition, TelegramChannelInput, TelegramMessageSource, TelegramSource, ToolApprovalSummary, ToolDefinitionConfig, ToolResource, UpdateCronInput, WebSocketClientCancelMessage, WebSocketClientExecuteMessage, WebSocketClientMessage, WebSocketConstructorLike, WebSocketHandlers, WebSocketLike, WebSocketRunInput, WebSocketServerMessage, WebSocketStreamMessage, WebSocketSubscription, Workspace, WorkspaceConfig, WorkspaceConfigDoc, WorkspaceResource, ZaloChannelDefinition, ZaloChannelInput, ZaloMessageSource, ZaloSource };
+export { BroodsAccountApiError, BroodsAccountClient, BroodsClient, BroodsWebSocketClient, DEFAULT_CORE_BASE_URL, MAX_OBSERVABILITY_BACKFILL, BroodsWebSocketClient as WebSocketClient, BroodsWebSocketClient as WebsocketClient, defineAgent, defineBroods, defineCron, defineDiscordChannel, defineGitHubChannel, definePancakeChannel, definePolicy, defineSandbox, defineSkill, defineSlackChannel, defineTelegramChannel, defineTool, defineWorkspace, defineZaloChannel, env, isBroodsConfig, isChannelDefinition, isObservabilityClientMessage, isResource, normalizeHttpServiceUrl, readSseStream, resolveRunEvents, toWebSocketBaseUrl };
+export type { Account, AccountAgent, AccountPolicy, AccountSandbox, AccountTool, AccountWorkspace, Agent, AgentChannelWorkspaceScope, AgentChannelsConfig, AgentCodeHookConfig, AgentConfig, AgentConfigDoc, AgentDefinitionConfig, AgentDiscordChannelConfig, AgentGitHubChannelConfig, AgentHandle, AgentHookEventName, AgentHooks, AgentHooksConfig, AgentPancakeChannelConfig, AgentPolicyConfig, AgentPolicyDefinitionConfig, AgentPolicyDocument, AgentProviderSettings, AgentReference, AgentResource, AgentRunEventInput, AgentRunInput, AgentRunModelOverrides, AgentRunOverrides, AgentRunResult, AgentSkillsDefinitionConfig, AgentSlackChannelConfig, AgentStreamPart, AgentSubagentDefinitionConfig, AgentTelegramChannelConfig, AgentWebhookHookConfig, AgentWorkspaceInput, AgentWorkspaceRef, AgentWorkspaceRefInput, AgentZaloChannelConfig, AnyChannelDefinition, AnyResource, AsyncAgentRun, AsyncPollOptions, AsyncRequestAccepted, AsyncStatus, BroodsAccount, BroodsAccountClientOptions, BroodsClientOptions, BroodsConfigDefinition, BroodsProjectConfig, BroodsWebSocketClientOptions, ChannelDefinition, ChannelMessageReceived, ChannelReference, ChannelType, CliManifest, CliManifestResource, CliResourceKind, CreateAgentResult, CreateClientCronInput, CreateCronInput, CreateToolInput, Cron, CronDefinitionConfig, CronDoc, CronLastStatus, CronResource, CronRun, CronStatus, CustomTool, DeleteAccountResult, DiscordChannelDefinition, DiscordChannelInput, DiscordMessageSource, DiscordSource, Doc, EnvAccessor, EnvRef, EnvRefString, EnvironmentDoc, GeneratedIds, GitHubChannelDefinition, GitHubChannelInput, GitHubMessageSource, GitHubSource, HookContext, Id, LogLevel, ObservabilityBackfillMessage, ObservabilityClientMessage, ObservabilityErrorMessage, ObservabilityLogEntry, ObservabilityLogMessage, ObservabilityReadyMessage, ObservabilityServerMessage, ObservabilitySpanMessage, ObservabilitySpanRow, ObservabilitySubscribeMessage, ObservabilityUnsubscribeMessage, PancakeChannelDefinition, PancakeChannelInput, PancakeMessageSource, PancakeSource, PolicyDefinitionConfig, PolicyResource, ProjectDoc, ProviderConfigInput, ProviderSettingsInput, ResourceApi, ResourceDefinition, ResourceDefinitionInput, ResourceKind, RotateSecretResult, Sandbox, SandboxConfig, SandboxConfigDoc, SandboxDefinitionConfig, SandboxLifecycleResult, SandboxResource, SandboxSnapshotResult, SandboxTerminalTicket, Skill, SkillDefinitionConfig, SkillResource, SkillUploadInput, SlackChannelDefinition, SlackChannelInput, SlackMessageSource, SlackSource, TelegramChannelDefinition, TelegramChannelInput, TelegramMessageSource, TelegramSource, ToolApprovalSummary, ToolDefinitionConfig, ToolResource, UpdateAgentInput, UpdateCronInput, UpdateToolInput, WebSocketClientCancelMessage, WebSocketClientExecuteMessage, WebSocketClientMessage, WebSocketConstructorLike, WebSocketHandlers, WebSocketLike, WebSocketRunInput, WebSocketServerMessage, WebSocketStreamMessage, WebSocketSubscription, Workspace, WorkspaceConfig, WorkspaceConfigDoc, WorkspaceFileEntry, WorkspaceResource, ZaloChannelDefinition, ZaloChannelInput, ZaloMessageSource, ZaloSource };