lua-cli 3.26.0 → 3.28.0

package/dist/api-exports.d.ts

@@ -415,7 +415,10 @@ declare interface ApiResponse<T = any> {
         message: string;
         code?: string;
         statusCode?: number;
+        retryAfterSeconds?: number;
         error?: string;
+        oldAccountLabel?: string;
+        newAccountLabel?: string;
     };
 }
 
@@ -851,6 +854,13 @@ export declare const Channels: ChannelsApi;
  *   subject: 'Your order',
  *   html: '<p>Thanks for your order!</p>',
  * });
+ *
+ * // Post into a Teams group chat the agent is already part of
+ * await Channels.send({
+ *   channel: 'teams',
+ *   to: { conversationId: '19:9495c339...@thread.v2' },
+ *   text: 'Sample LOT-4471 is missing origin and cupping score.',
+ * });
  * ```
  */
 export declare interface ChannelsApi {
@@ -858,6 +868,11 @@ export declare interface ChannelsApi {
      * Send a text message on any supported channel.
      * Returns `ChannelSendOutput` — check `persisted` if memory durability matters.
      *
+     * Address a person with `userId` (any channel), `phoneNumber` (whatsapp/sms)
+     * or `email`. Address a shared conversation with `conversationId` (teams
+     * only) — everyone in it receives the message, and because there is no single
+     * recipient the send returns `persisted: false`.
+     *
      * @example
      * ```typescript
      * const result = await Channels.send({
@@ -957,6 +972,8 @@ export declare interface ChannelSendOptions {
  */
 export declare interface ChannelSendOutput {
     delivered: boolean;
+    /** False for conversation-scoped sends: a shared conversation has no single
+     * user to attribute the message to, so nothing is written to agent memory. */
     persisted: boolean;
     /**
      * True when the send was deferred to the WhatsApp message-request queue
@@ -975,11 +992,15 @@ export declare interface ChannelSendOutput {
 
 /** Recipient — exactly one of the fields must be set. userId works on every
  * channel (resolved via the user's channel history); raw identifiers only on
- * cold-start-capable channels (whatsapp/sms → phoneNumber, email → email). */
+ * cold-start-capable channels (whatsapp/sms → phoneNumber, email → email).
+ * `conversationId` addresses a shared conversation rather than a person —
+ * everyone in it receives the message. Teams only, and warm-only: the agent
+ * must already be part of that conversation. */
 export declare interface ChannelSendTarget {
     userId?: string;
     phoneNumber?: string;
     email?: string;
+    conversationId?: string;
 }
 
 /**
@@ -1059,6 +1080,13 @@ export declare interface ChatHistoryMessage {
     model?: string;
     /** True when the turn reached that model through the Auto selector. */
     autoModelRequested?: boolean;
+    author?: {
+        userId: string;
+    };
+    agent?: {
+        agentId: string;
+        name?: string;
+    };
     /**
      * Permanent recording for a voice-note turn (Lua Desktop). Populated by the
      * admin threads history endpoint from the row's `content.metadata.audio` — a
@@ -1804,6 +1832,13 @@ declare abstract class HttpClient {
      * @protected
      */
     protected httpPost<T>(url: string, data?: any, headers?: Record<string, string>): Promise<ApiResponse<T>>;
+    /**
+     * Performs one HTTP POST attempt.
+     *
+     * Use this only when a successful response contains a one-time secret that
+     * cannot be recovered after an ambiguous network or server failure.
+     */
+    protected httpPostOnce<T>(url: string, data?: any, headers?: Record<string, string>): Promise<ApiResponse<T>>;
     /**
      * Performs an HTTP PUT request
      * @param url - The relative URL path to request (will be appended to baseUrl)
@@ -1900,6 +1935,18 @@ declare interface InboxPushInput {
     /** Idempotency/revision key: same key = revise the existing card in place,
      *  never a second knock. Omit for one-shot notices. */
     key?: string;
+    /** Cross-route resolution (PRO-1208 follow-up #2) — only meaningful on a
+     *  plain NOTICE push that carries a `key`. When `true`, this notice
+     *  declares it REPORTS THE RESOLUTION of whatever an open same-key
+     *  question card is still asking — the agent settled the cycle itself
+     *  (re-reviewed after the fix landed and auto-approved; the incident
+     *  closed on its own). Once the notice lands, the stale question card is
+     *  superseded: settled, no live actions, and never a knock. An in-flight
+     *  user answer always wins — their explicit decision stands. WITHOUT this
+     *  flag a same-key notice never touches the question track: routine
+     *  progress updates coexist with an open ask. Ignored without `key`, and
+     *  on question/fix pushes. Must be the literal boolean `true`. */
+    resolvesQuestion?: boolean;
     /** Conversation the card should hand off into when the user acts. */
     threadId?: string;
 }
@@ -3237,6 +3284,10 @@ export declare class LuaTrigger<T = any> {
     readonly verify?: (ctx: TriggerContext<T>) => boolean | Promise<boolean>;
     readonly filter?: (ctx: TriggerContext<T>) => boolean | Promise<boolean>;
     readonly transform?: (ctx: TriggerContext<T>) => string | AgentInvocationInput | Promise<string | AgentInvocationInput>;
+    readonly tool?: {
+        name: string;
+        input?: (ctx: TriggerContext<T>) => Record<string, unknown> | Promise<Record<string, unknown>>;
+    };
     constructor(config: LuaTriggerConfig<T>);
     getName(): string;
     getDescription(): string;
@@ -3276,6 +3327,24 @@ export declare interface LuaTriggerConfig<T = any> {
      * transform to forward larger or hand-picked fields as the message.
      */
     transform?: (ctx: TriggerContext<T>) => string | AgentInvocationInput | Promise<string | AgentInvocationInput>;
+    /**
+     * Direct tool binding: after `verify`/`filter` pass, the platform executes
+     * this named skill tool DIRECTLY — no chat turn, no LLM, no visible
+     * conversation thread. `name` is the BARE authored tool name (skill-first
+     * resolution server-side); it must be a static string literal — the
+     * compiler carries it into the trigger version as declared metadata.
+     * `input` maps the trigger context to the tool's arguments and runs in the
+     * same server-side slot sandbox (15s budget shared with verify/filter) —
+     * it CANNOT call platform APIs. Omit `input` to execute with `{}`.
+     *
+     * Declaring BOTH `tool` and `transform` runs the tool; the transform is
+     * ignored (the compiler warns). Approval-gated tools are refused server-
+     * side (fail closed) — the execution row records the refusal.
+     */
+    tool?: {
+        name: string;
+        input?: (ctx: TriggerContext<T>) => Record<string, unknown> | Promise<Record<string, unknown>>;
+    };
 }
 
 /**
@@ -4330,6 +4399,7 @@ export declare class LuaWebhook {
     private readonly querySchema?;
     private readonly headerSchema?;
     private readonly bodySchema?;
+    private readonly secret?;
     private readonly executeFunction;
     /**
      * Creates a new LuaWebhook instance.
@@ -4343,6 +4413,11 @@ export declare class LuaWebhook {
      * @param config.execute - Function that processes the webhook request
      */
     constructor(config: LuaWebhookConfig);
+    /**
+     * Gets the webhook's signing key, if one is configured.
+     * Never print this — it is the shared secret callers sign with.
+     */
+    getSecret(): string | undefined;
     /**
      * Gets the webhook name.
      */
@@ -4389,6 +4464,14 @@ export declare interface LuaWebhookConfig {
     headerSchema?: ZodType;
     /** Optional Zod schema for body validation */
     bodySchema?: ZodType;
+    /**
+     * Optional HMAC-SHA256 signing key. When set, Lua rejects any call to this
+     * webhook that does not carry `x-lua-signature: sha256=<hex digest of the
+     * raw request body>`. Must be a literal or a `const` resolvable at compile
+     * time — the compiler cannot read a runtime expression. Rotate by changing
+     * it and re-deploying.
+     */
+    secret?: string;
     /** Function that executes the webhook logic */
     execute: (event: LuaWebhookEvent) => Promise<any>;
 }