robotrock 0.4.0 → 0.5.0

package/dist/{index.js → index.mjs}

@@ -8,35 +8,35 @@ import {
   resolveRobotRockClient,
   resolveRobotRockConfig,
   toDiscriminatedApprovalResult
-} from "./chunk-PZTTI6MW.js";
+} from "./chunk-E7ZWBFZ6.mjs";
 import {
   DEFAULT_THREAD_UPDATE_STATUS,
   assignToSchema,
   createTaskBodySchema,
+  external_exports,
   taskContextSchema,
   threadUpdateBodySchema,
   threadUpdateInputSchema,
   threadUpdateStatusSchema,
   threadUpdateStatuses
-} from "./chunk-2KFY7ZJV.js";
+} from "./chunk-VNXWLPRV.mjs";
 
 // src/webhook.ts
 import { createHmac, timingSafeEqual } from "crypto";
-import { z } from "zod";
 var ROBOTROCK_SIGNATURE_HEADER = "x-robotrock-signature";
-var robotRockWebhookPayloadBodySchema = z.object({
-  taskId: z.string().min(1),
-  action: z.object({
-    id: z.string().min(1),
-    title: z.string().min(1),
-    data: z.unknown()
+var robotRockWebhookPayloadBodySchema = external_exports.object({
+  taskId: external_exports.string().min(1),
+  action: external_exports.object({
+    id: external_exports.string().min(1),
+    title: external_exports.string().min(1),
+    data: external_exports.unknown()
   }),
-  handledBy: z.string().min(1).optional(),
-  handledAt: z.string().min(1),
-  handlerType: z.string().min(1)
+  handledBy: external_exports.string().min(1).optional(),
+  handledAt: external_exports.string().min(1),
+  handlerType: external_exports.string().min(1)
 });
 var robotRockWebhookPayloadSchema = robotRockWebhookPayloadBodySchema.extend({
-  headers: z.record(z.string())
+  headers: external_exports.record(external_exports.string())
 });
 var RobotRockWebhookError = class extends Error {
   constructor(message, code, details) {
@@ -146,4 +146,4 @@ export {
   toDiscriminatedApprovalResult,
   verifyRobotRockWebhook
 };
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.mjs.map

package/dist/{index.js.map → index.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/webhook.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { z } from \"zod\";\n\nconst ROBOTROCK_SIGNATURE_HEADER = \"x-robotrock-signature\";\n\nconst robotRockWebhookPayloadBodySchema = z.object({\n  taskId: z.string().min(1),\n  action: z.object({\n    id: z.string().min(1),\n    title: z.string().min(1),\n    data: z.unknown(),\n  }),\n  handledBy: z.string().min(1).optional(),\n  handledAt: z.string().min(1),\n  handlerType: z.string().min(1),\n});\n\nconst robotRockWebhookPayloadSchema = robotRockWebhookPayloadBodySchema.extend({\n  headers: z.record(z.string()),\n});\n\nexport type RobotRockWebhookErrorCode =\n  | \"MISSING_WEBHOOK_SECRET\"\n  | \"MISSING_SIGNATURE\"\n  | \"INVALID_SIGNATURE\"\n  | \"INVALID_JSON\"\n  | \"INVALID_PAYLOAD\";\n\nexport class RobotRockWebhookError extends Error {\n  constructor(\n    message: string,\n    public readonly code: RobotRockWebhookErrorCode,\n    public readonly details?: unknown\n  ) {\n    super(message);\n    this.name = \"RobotRockWebhookError\";\n  }\n}\n\nexport type RobotRockWebhookPayload = z.infer<typeof robotRockWebhookPayloadSchema>;\n\nexport interface VerifyRobotRockWebhookOptions {\n  /**\n   * Override shared secret (defaults to ROBOTROCK_WEBHOOK_SECRET).\n   * Keep undefined in production to enforce the canonical env var.\n   */\n  secret?: string;\n  /**\n   * Resolve the tenant signing secret by public task id (hosted MCP uses Convex).\n   * Used when secret is not passed explicitly.\n   */\n  resolveSecret?: (taskId: string) => Promise<string | undefined>;\n  /** Signature header to read. @default \"x-robotrock-signature\" */\n  signatureHeader?: string;\n}\n\n/**\n * Verify a RobotRock webhook request and return a validated payload.\n * Throws RobotRockWebhookError with machine-readable `code` for audit logging.\n */\nexport async function verifyRobotRockWebhook(\n  request: Request,\n  options: VerifyRobotRockWebhookOptions = {}\n): Promise<RobotRockWebhookPayload> {\n  const signatureHeaderName = options.signatureHeader ?? ROBOTROCK_SIGNATURE_HEADER;\n  const signature = request.headers.get(signatureHeaderName);\n\n  if (!signature) {\n    throw new RobotRockWebhookError(\n      `Missing webhook signature header: ${signatureHeaderName}`,\n      \"MISSING_SIGNATURE\"\n    );\n  }\n\n  const rawBody = await request.text();\n  const secret = await resolveWebhookSigningSecret(rawBody, options);\n\n  if (!secret) {\n    throw new RobotRockWebhookError(\n      \"Missing webhook signing secret for verification\",\n      \"MISSING_WEBHOOK_SECRET\"\n    );\n  }\n\n  assertValidSignature(rawBody, signature, secret);\n\n  let parsedBody: unknown;\n  try {\n    parsedBody = JSON.parse(rawBody);\n  } catch (error) {\n    throw new RobotRockWebhookError(\"Webhook body is not valid JSON\", \"INVALID_JSON\", {\n      cause: error instanceof Error ? error.message : String(error),\n    });\n  }\n\n  const payloadResult = robotRockWebhookPayloadBodySchema.safeParse(parsedBody);\n  if (!payloadResult.success) {\n    throw new RobotRockWebhookError(\n      \"Webhook payload schema validation failed\",\n      \"INVALID_PAYLOAD\",\n      payloadResult.error.flatten()\n    );\n  }\n\n  return {\n    ...payloadResult.data,\n    headers: normalizeHeaders(request.headers),\n  };\n}\n\nasync function resolveWebhookSigningSecret(\n  rawBody: string,\n  options: VerifyRobotRockWebhookOptions\n): Promise<string | undefined> {\n  if (options.secret) {\n    return options.secret;\n  }\n\n  if (options.resolveSecret) {\n    const taskId = peekWebhookTaskId(rawBody);\n    if (taskId) {\n      const resolved = await options.resolveSecret(taskId);\n      if (resolved) {\n        return resolved;\n      }\n    }\n  }\n\n  return process.env.ROBOTROCK_WEBHOOK_SECRET;\n}\n\nfunction peekWebhookTaskId(rawBody: string): string | undefined {\n  try {\n    const parsed: unknown = JSON.parse(rawBody);\n    if (\n      typeof parsed === \"object\" &&\n      parsed !== null &&\n      \"taskId\" in parsed &&\n      typeof (parsed as { taskId: unknown }).taskId === \"string\"\n    ) {\n      return (parsed as { taskId: string }).taskId;\n    }\n  } catch {\n    // fall through\n  }\n  return undefined;\n}\n\nfunction assertValidSignature(rawBody: string, signature: string, secret: string): void {\n  const expected = `sha256=${createHmac(\"sha256\", secret).update(rawBody).digest(\"hex\")}`;\n  const expectedBuffer = Buffer.from(expected);\n  const receivedBuffer = Buffer.from(signature);\n\n  if (\n    expectedBuffer.length !== receivedBuffer.length ||\n    !timingSafeEqual(expectedBuffer, receivedBuffer)\n  ) {\n    throw new RobotRockWebhookError(\"Webhook signature verification failed\", \"INVALID_SIGNATURE\");\n  }\n}\n\nfunction normalizeHeaders(headers: Headers): Record<string, string> {\n  const result: Record<string, string> = {};\n  headers.forEach((value, key) => {\n    result[key] = value;\n  });\n  return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,YAAY,uBAAuB;AAC5C,SAAS,SAAS;AAElB,IAAM,6BAA6B;AAEnC,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACjD,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,QAAQ,EAAE,OAAO;AAAA,IACf,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACpB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACvB,MAAM,EAAE,QAAQ;AAAA,EAClB,CAAC;AAAA,EACD,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAC/B,CAAC;AAED,IAAM,gCAAgC,kCAAkC,OAAO;AAAA,EAC7E,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC;AAC9B,CAAC;AASM,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC/C,YACE,SACgB,MACA,SAChB;AACA,UAAM,OAAO;AAHG;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAuBA,eAAsB,uBACpB,SACA,UAAyC,CAAC,GACR;AAClC,QAAM,sBAAsB,QAAQ,mBAAmB;AACvD,QAAM,YAAY,QAAQ,QAAQ,IAAI,mBAAmB;AAEzD,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,qCAAqC,mBAAmB;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,QAAQ,KAAK;AACnC,QAAM,SAAS,MAAM,4BAA4B,SAAS,OAAO;AAEjE,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,uBAAqB,SAAS,WAAW,MAAM;AAE/C,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,MAAM,OAAO;AAAA,EACjC,SAAS,OAAO;AACd,UAAM,IAAI,sBAAsB,kCAAkC,gBAAgB;AAAA,MAChF,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AAEA,QAAM,gBAAgB,kCAAkC,UAAU,UAAU;AAC5E,MAAI,CAAC,cAAc,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,cAAc,MAAM,QAAQ;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG,cAAc;AAAA,IACjB,SAAS,iBAAiB,QAAQ,OAAO;AAAA,EAC3C;AACF;AAEA,eAAe,4BACb,SACA,SAC6B;AAC7B,MAAI,QAAQ,QAAQ;AAClB,WAAO,QAAQ;AAAA,EACjB;AAEA,MAAI,QAAQ,eAAe;AACzB,UAAM,SAAS,kBAAkB,OAAO;AACxC,QAAI,QAAQ;AACV,YAAM,WAAW,MAAM,QAAQ,cAAc,MAAM;AACnD,UAAI,UAAU;AACZ,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO,QAAQ,IAAI;AACrB;AAEA,SAAS,kBAAkB,SAAqC;AAC9D,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,OAAO;AAC1C,QACE,OAAO,WAAW,YAClB,WAAW,QACX,YAAY,UACZ,OAAQ,OAA+B,WAAW,UAClD;AACA,aAAQ,OAA8B;AAAA,IACxC;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,SAAiB,WAAmB,QAAsB;AACtF,QAAM,WAAW,UAAU,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;AACrF,QAAM,iBAAiB,OAAO,KAAK,QAAQ;AAC3C,QAAM,iBAAiB,OAAO,KAAK,SAAS;AAE5C,MACE,eAAe,WAAW,eAAe,UACzC,CAAC,gBAAgB,gBAAgB,cAAc,GAC/C;AACA,UAAM,IAAI,sBAAsB,yCAAyC,mBAAmB;AAAA,EAC9F;AACF;AAEA,SAAS,iBAAiB,SAA0C;AAClE,QAAM,SAAiC,CAAC;AACxC,UAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,WAAO,GAAG,IAAI;AAAA,EAChB,CAAC;AACD,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/webhook.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { z } from \"zod\";\n\nconst ROBOTROCK_SIGNATURE_HEADER = \"x-robotrock-signature\";\n\nconst robotRockWebhookPayloadBodySchema = z.object({\n  taskId: z.string().min(1),\n  action: z.object({\n    id: z.string().min(1),\n    title: z.string().min(1),\n    data: z.unknown(),\n  }),\n  handledBy: z.string().min(1).optional(),\n  handledAt: z.string().min(1),\n  handlerType: z.string().min(1),\n});\n\nconst robotRockWebhookPayloadSchema = robotRockWebhookPayloadBodySchema.extend({\n  headers: z.record(z.string()),\n});\n\nexport type RobotRockWebhookErrorCode =\n  | \"MISSING_WEBHOOK_SECRET\"\n  | \"MISSING_SIGNATURE\"\n  | \"INVALID_SIGNATURE\"\n  | \"INVALID_JSON\"\n  | \"INVALID_PAYLOAD\";\n\nexport class RobotRockWebhookError extends Error {\n  constructor(\n    message: string,\n    public readonly code: RobotRockWebhookErrorCode,\n    public readonly details?: unknown\n  ) {\n    super(message);\n    this.name = \"RobotRockWebhookError\";\n  }\n}\n\nexport type RobotRockWebhookPayload = z.infer<typeof robotRockWebhookPayloadSchema>;\n\nexport interface VerifyRobotRockWebhookOptions {\n  /**\n   * Override shared secret (defaults to ROBOTROCK_WEBHOOK_SECRET).\n   * Keep undefined in production to enforce the canonical env var.\n   */\n  secret?: string;\n  /**\n   * Resolve the tenant signing secret by public task id (hosted MCP uses Convex).\n   * Used when secret is not passed explicitly.\n   */\n  resolveSecret?: (taskId: string) => Promise<string | undefined>;\n  /** Signature header to read. @default \"x-robotrock-signature\" */\n  signatureHeader?: string;\n}\n\n/**\n * Verify a RobotRock webhook request and return a validated payload.\n * Throws RobotRockWebhookError with machine-readable `code` for audit logging.\n */\nexport async function verifyRobotRockWebhook(\n  request: Request,\n  options: VerifyRobotRockWebhookOptions = {}\n): Promise<RobotRockWebhookPayload> {\n  const signatureHeaderName = options.signatureHeader ?? ROBOTROCK_SIGNATURE_HEADER;\n  const signature = request.headers.get(signatureHeaderName);\n\n  if (!signature) {\n    throw new RobotRockWebhookError(\n      `Missing webhook signature header: ${signatureHeaderName}`,\n      \"MISSING_SIGNATURE\"\n    );\n  }\n\n  const rawBody = await request.text();\n  const secret = await resolveWebhookSigningSecret(rawBody, options);\n\n  if (!secret) {\n    throw new RobotRockWebhookError(\n      \"Missing webhook signing secret for verification\",\n      \"MISSING_WEBHOOK_SECRET\"\n    );\n  }\n\n  assertValidSignature(rawBody, signature, secret);\n\n  let parsedBody: unknown;\n  try {\n    parsedBody = JSON.parse(rawBody);\n  } catch (error) {\n    throw new RobotRockWebhookError(\"Webhook body is not valid JSON\", \"INVALID_JSON\", {\n      cause: error instanceof Error ? error.message : String(error),\n    });\n  }\n\n  const payloadResult = robotRockWebhookPayloadBodySchema.safeParse(parsedBody);\n  if (!payloadResult.success) {\n    throw new RobotRockWebhookError(\n      \"Webhook payload schema validation failed\",\n      \"INVALID_PAYLOAD\",\n      payloadResult.error.flatten()\n    );\n  }\n\n  return {\n    ...payloadResult.data,\n    headers: normalizeHeaders(request.headers),\n  };\n}\n\nasync function resolveWebhookSigningSecret(\n  rawBody: string,\n  options: VerifyRobotRockWebhookOptions\n): Promise<string | undefined> {\n  if (options.secret) {\n    return options.secret;\n  }\n\n  if (options.resolveSecret) {\n    const taskId = peekWebhookTaskId(rawBody);\n    if (taskId) {\n      const resolved = await options.resolveSecret(taskId);\n      if (resolved) {\n        return resolved;\n      }\n    }\n  }\n\n  return process.env.ROBOTROCK_WEBHOOK_SECRET;\n}\n\nfunction peekWebhookTaskId(rawBody: string): string | undefined {\n  try {\n    const parsed: unknown = JSON.parse(rawBody);\n    if (\n      typeof parsed === \"object\" &&\n      parsed !== null &&\n      \"taskId\" in parsed &&\n      typeof (parsed as { taskId: unknown }).taskId === \"string\"\n    ) {\n      return (parsed as { taskId: string }).taskId;\n    }\n  } catch {\n    // fall through\n  }\n  return undefined;\n}\n\nfunction assertValidSignature(rawBody: string, signature: string, secret: string): void {\n  const expected = `sha256=${createHmac(\"sha256\", secret).update(rawBody).digest(\"hex\")}`;\n  const expectedBuffer = Buffer.from(expected);\n  const receivedBuffer = Buffer.from(signature);\n\n  if (\n    expectedBuffer.length !== receivedBuffer.length ||\n    !timingSafeEqual(expectedBuffer, receivedBuffer)\n  ) {\n    throw new RobotRockWebhookError(\"Webhook signature verification failed\", \"INVALID_SIGNATURE\");\n  }\n}\n\nfunction normalizeHeaders(headers: Headers): Record<string, string> {\n  const result: Record<string, string> = {};\n  headers.forEach((value, key) => {\n    result[key] = value;\n  });\n  return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,YAAY,uBAAuB;AAG5C,IAAM,6BAA6B;AAEnC,IAAM,oCAAoC,iBAAE,OAAO;AAAA,EACjD,QAAQ,iBAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,QAAQ,iBAAE,OAAO;AAAA,IACf,IAAI,iBAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACpB,OAAO,iBAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACvB,MAAM,iBAAE,QAAQ;AAAA,EAClB,CAAC;AAAA,EACD,WAAW,iBAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,WAAW,iBAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,aAAa,iBAAE,OAAO,EAAE,IAAI,CAAC;AAC/B,CAAC;AAED,IAAM,gCAAgC,kCAAkC,OAAO;AAAA,EAC7E,SAAS,iBAAE,OAAO,iBAAE,OAAO,CAAC;AAC9B,CAAC;AASM,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC/C,YACE,SACgB,MACA,SAChB;AACA,UAAM,OAAO;AAHG;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAuBA,eAAsB,uBACpB,SACA,UAAyC,CAAC,GACR;AAClC,QAAM,sBAAsB,QAAQ,mBAAmB;AACvD,QAAM,YAAY,QAAQ,QAAQ,IAAI,mBAAmB;AAEzD,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,qCAAqC,mBAAmB;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,QAAQ,KAAK;AACnC,QAAM,SAAS,MAAM,4BAA4B,SAAS,OAAO;AAEjE,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,uBAAqB,SAAS,WAAW,MAAM;AAE/C,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,MAAM,OAAO;AAAA,EACjC,SAAS,OAAO;AACd,UAAM,IAAI,sBAAsB,kCAAkC,gBAAgB;AAAA,MAChF,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AAEA,QAAM,gBAAgB,kCAAkC,UAAU,UAAU;AAC5E,MAAI,CAAC,cAAc,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,cAAc,MAAM,QAAQ;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG,cAAc;AAAA,IACjB,SAAS,iBAAiB,QAAQ,OAAO;AAAA,EAC3C;AACF;AAEA,eAAe,4BACb,SACA,SAC6B;AAC7B,MAAI,QAAQ,QAAQ;AAClB,WAAO,QAAQ;AAAA,EACjB;AAEA,MAAI,QAAQ,eAAe;AACzB,UAAM,SAAS,kBAAkB,OAAO;AACxC,QAAI,QAAQ;AACV,YAAM,WAAW,MAAM,QAAQ,cAAc,MAAM;AACnD,UAAI,UAAU;AACZ,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO,QAAQ,IAAI;AACrB;AAEA,SAAS,kBAAkB,SAAqC;AAC9D,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,OAAO;AAC1C,QACE,OAAO,WAAW,YAClB,WAAW,QACX,YAAY,UACZ,OAAQ,OAA+B,WAAW,UAClD;AACA,aAAQ,OAA8B;AAAA,IACxC;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,SAAiB,WAAmB,QAAsB;AACtF,QAAM,WAAW,UAAU,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;AACrF,QAAM,iBAAiB,OAAO,KAAK,QAAQ;AAC3C,QAAM,iBAAiB,OAAO,KAAK,SAAS;AAE5C,MACE,eAAe,WAAW,eAAe,UACzC,CAAC,gBAAgB,gBAAgB,cAAc,GAC/C;AACA,UAAM,IAAI,sBAAsB,yCAAyC,mBAAmB;AAAA,EAC9F;AACF;AAEA,SAAS,iBAAiB,SAA0C;AAClE,QAAM,SAAiC,CAAC;AACxC,UAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,WAAO,GAAG,IAAI;AAAA,EAChB,CAAC;AACD,SAAO;AACT;","names":[]}

package/dist/schemas/{index.js → index.mjs}

@@ -8,7 +8,7 @@ import {
   threadUpdateMessageSchema,
   threadUpdateStatusSchema,
   threadUpdateStatuses
-} from "../chunk-2KFY7ZJV.js";
+} from "../chunk-VNXWLPRV.mjs";
 export {
   DEFAULT_THREAD_UPDATE_STATUS,
   assignToSchema,
@@ -20,4 +20,4 @@ export {
   threadUpdateStatusSchema,
   threadUpdateStatuses
 };
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.mjs.map

package/dist/trigger/{index.js → index.mjs}

@@ -1,13 +1,13 @@
 import {
   isRobotRockHandlerWebhookPayload,
   resolveWaitTiming
-} from "../chunk-D2FBSEZK.js";
+} from "../chunk-3ZYQE5LF.mjs";
 import {
   createClient,
   resolveRobotRockConfig,
   toDiscriminatedApprovalResult
-} from "../chunk-PZTTI6MW.js";
-import "../chunk-2KFY7ZJV.js";
+} from "../chunk-E7ZWBFZ6.mjs";
+import "../chunk-VNXWLPRV.mjs";
 
 // src/trigger/index.ts
 import { task, wait } from "@trigger.dev/sdk";
@@ -75,4 +75,4 @@ export {
   approveByHumanTask,
   sendToHumanTask
 };
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.mjs.map

package/dist/workflow/index.d.ts

@@ -1,4 +1,4 @@
-import { DiscriminatedApprovalResult } from '../schemas/index.js';
+import { DiscriminatedApprovalResult, ThreadUpdateStatus, ThreadUpdate } from '../schemas/index.js';
 export { ApprovalResult, TaskContextInput, TaskResult } from '../schemas/index.js';
 import { S as SendToHumanActionInput, a as SendToHumanInput } from '../client-BOm2Ce2f.js';
 export { R as RobotRockHandlerWebhookPayload } from '../handler-webhook-BqEi6Bk-.js';
@@ -31,5 +31,25 @@ declare function sendToHumanInWorkflow<const A extends readonly SendToHumanActio
  * Approve / decline gate for Vercel Workflow (`sendToHumanInWorkflow` with fixed actions).
  */
 declare function approveByHumanInWorkflow(payload: ApproveByHumanWorkflowPayload): Promise<Expand<DiscriminatedApprovalResult<typeof APPROVE_BY_HUMAN_ACTIONS>>>;
+type SendUpdateWorkflowPayload = {
+    /** Thread to log the update against (from a prior task's `threadId`). */
+    threadId: string;
+    /** Short status update (1-2 sentences) shown in the inbox status bar. */
+    message: string;
+    /** Lifecycle status driving the status-bar icon/color. @default "info" */
+    status?: ThreadUpdateStatus;
+    /** Inbox app bucket. Overrides `ROBOTROCK_APP` when set. */
+    app?: string;
+};
+/**
+ * Durable thread update for Vercel Workflow.
+ *
+ * Wraps {@link createClient}'s `sendUpdate` in a `"use step"` so progress
+ * reports are retried and recorded in the run. Fire-and-forget: returns the
+ * created update without suspending the workflow (no human wait involved).
+ *
+ * Call from a function with `"use workflow"` as its first statement.
+ */
+declare function sendUpdateInWorkflow(payload: SendUpdateWorkflowPayload): Promise<ThreadUpdate>;
 
-export { type ApproveByHumanWorkflowPayload, DiscriminatedApprovalResult, type SendToHumanWorkflowPayload, approveByHumanInWorkflow, sendToHumanInWorkflow };
+export { type ApproveByHumanWorkflowPayload, DiscriminatedApprovalResult, type SendToHumanWorkflowPayload, type SendUpdateWorkflowPayload, ThreadUpdate, ThreadUpdateStatus, approveByHumanInWorkflow, sendToHumanInWorkflow, sendUpdateInWorkflow };

package/dist/workflow/{index.js → index.mjs}

@@ -2,16 +2,16 @@ import {
   isRobotRockHandlerWebhookPayload,
   parseValidUntilMs,
   resolveWaitTiming
-} from "../chunk-D2FBSEZK.js";
+} from "../chunk-3ZYQE5LF.mjs";
 import {
   createClient,
   resolveRobotRockConfig,
   toDiscriminatedApprovalResult
-} from "../chunk-PZTTI6MW.js";
+} from "../chunk-E7ZWBFZ6.mjs";
 import {
   __callDispose,
   __using
-} from "../chunk-2KFY7ZJV.js";
+} from "../chunk-VNXWLPRV.mjs";
 
 // src/workflow/index.ts
 import { createWebhook, sleep } from "workflow";
@@ -92,8 +92,24 @@ async function approveByHumanInWorkflow(payload) {
     actions: APPROVE_BY_HUMAN_ACTIONS
   });
 }
+async function sendRobotRockUpdate(payload) {
+  "use step";
+  const { app, ...update } = payload;
+  const baseConfig = resolveRobotRockConfig();
+  const client = createClient({
+    apiKey: baseConfig.apiKey,
+    baseUrl: baseConfig.baseUrl,
+    ...app ?? baseConfig.app ? { app: app ?? baseConfig.app } : {},
+    ...baseConfig.version ? { version: baseConfig.version } : {}
+  });
+  return client.sendUpdate(update);
+}
+async function sendUpdateInWorkflow(payload) {
+  return sendRobotRockUpdate(payload);
+}
 export {
   approveByHumanInWorkflow,
-  sendToHumanInWorkflow
+  sendToHumanInWorkflow,
+  sendUpdateInWorkflow
 };
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.mjs.map

package/dist/workflow/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/workflow/index.ts"],"sourcesContent":["import { createWebhook, sleep } from \"workflow\";\nimport type {\n  DiscriminatedApprovalResult,\n  ThreadUpdate,\n  ThreadUpdateStatus,\n} from \"../schemas/index.js\";\nimport {\n  createClient,\n  type SendToHumanActionInput,\n  type SendToHumanInput,\n} from \"../client.js\";\nimport { resolveRobotRockConfig } from \"../env.js\";\nimport { toDiscriminatedApprovalResult } from \"../approval-result.js\";\nimport {\n  isRobotRockHandlerWebhookPayload,\n  type RobotRockHandlerWebhookPayload,\n} from \"../handler-webhook.js\";\nimport { parseValidUntilMs, resolveWaitTiming } from \"../wait-timing.js\";\n\nexport type SendToHumanWorkflowPayload<\n  A extends readonly SendToHumanActionInput[] = readonly SendToHumanActionInput[],\n> = SendToHumanInput<A> & {\n  /** Inbox app bucket. Overrides `ROBOTROCK_APP` when set. */\n  app?: string;\n};\n\nexport type ApproveByHumanWorkflowPayload = Omit<SendToHumanWorkflowPayload, \"actions\">;\n\ntype Expand<T> = T extends unknown ? { [K in keyof T]: T[K] } : never;\n\nconst APPROVE_BY_HUMAN_ACTIONS = [\n  { id: \"approve\", title: \"Approve\" },\n  { id: \"decline\", title: \"Decline\" },\n] as const;\n\ntype CreateTaskStepInput = {\n  webhookUrl: string;\n  app?: string;\n  validUntil: Date | string;\n  taskInput: Omit<SendToHumanWorkflowPayload, \"validUntil\" | \"app\">;\n};\n\n/**\n * Creates the RobotRock inbox task with the workflow webhook URL as the handler.\n * Marked as a step so API calls run in full Node.js with retries.\n */\nasync function createRobotRockTaskForWebhook(input: CreateTaskStepInput) {\n  \"use step\";\n\n  const baseConfig = resolveRobotRockConfig();\n  const client = createClient({\n    apiKey: baseConfig.apiKey,\n    baseUrl: baseConfig.baseUrl,\n    ...((input.app ?? baseConfig.app) ? { app: input.app ?? baseConfig.app } : {}),\n    ...(baseConfig.version ? { version: baseConfig.version } : {}),\n    webhook: { url: input.webhookUrl },\n  });\n\n  return client.sendToHuman({\n    ...input.taskInput,\n    validUntil: input.validUntil,\n  });\n}\n\nasync function parseRobotRockWebhookRequest(request: Request) {\n  \"use step\";\n\n  const body: unknown = await request.json();\n  if (!isRobotRockHandlerWebhookPayload(body)) {\n    throw new Error(\n      \"Workflow webhook completed with unexpected payload; expected RobotRock handler body (taskId, action.id, action.data).\"\n    );\n  }\n\n  return body;\n}\n\n/**\n * Durable human-in-the-loop wait for Vercel Workflow.\n *\n * Call from a function with `\"use workflow\"` as its first statement. Creates a\n * {@link createWebhook} URL, registers it as the RobotRock task webhook, and\n * suspends until a human handles an action or `validUntil` passes.\n */\nexport async function sendToHumanInWorkflow<\n  const A extends readonly SendToHumanActionInput[],\n>(\n  payload: SendToHumanWorkflowPayload<A>\n): Promise<Expand<DiscriminatedApprovalResult<A>>> {\n  const { validUntil: validUntilInput, app, ...taskInput } = payload;\n  const { validUntil, timeout } = resolveWaitTiming(validUntilInput);\n  const timeoutMs = parseValidUntilMs(validUntil) - Date.now();\n\n  using webhook = createWebhook();\n\n  const sendResult = await createRobotRockTaskForWebhook({\n    webhookUrl: webhook.url,\n    app,\n    validUntil,\n    taskInput,\n  });\n\n  const outcome = await Promise.race([\n    webhook.then((request) => parseRobotRockWebhookRequest(request)),\n    sleep(timeoutMs).then(() => ({ timedOut: true }) as const),\n  ]);\n\n  if (\"timedOut\" in outcome) {\n    throw new Error(`Human response timed out before validUntil (${timeout})`);\n  }\n\n  const output: RobotRockHandlerWebhookPayload = outcome;\n\n  return toDiscriminatedApprovalResult(payload.actions, {\n    id: output.taskId,\n    createdAt: new Date(),\n    status: \"handled\",\n    context: sendResult.task.context,\n    validUntil: Date.now(),\n    handledAt: new Date(output.handledAt).getTime(),\n    handled: {\n      action: {\n        id: output.action.id,\n        data: output.action.data,\n      },\n      handledBy: output.handledBy,\n    },\n  }) as unknown as Expand<DiscriminatedApprovalResult<A>>;\n}\n\n/**\n * Approve / decline gate for Vercel Workflow (`sendToHumanInWorkflow` with fixed actions).\n */\nexport async function approveByHumanInWorkflow(\n  payload: ApproveByHumanWorkflowPayload\n): Promise<Expand<DiscriminatedApprovalResult<typeof APPROVE_BY_HUMAN_ACTIONS>>> {\n  return sendToHumanInWorkflow({\n    ...payload,\n    actions: APPROVE_BY_HUMAN_ACTIONS,\n  });\n}\n\nexport type SendUpdateWorkflowPayload = {\n  /** Thread to log the update against (from a prior task's `threadId`). */\n  threadId: string;\n  /** Short status update (1-2 sentences) shown in the inbox status bar. */\n  message: string;\n  /** Lifecycle status driving the status-bar icon/color. @default \"info\" */\n  status?: ThreadUpdateStatus;\n  /** Inbox app bucket. Overrides `ROBOTROCK_APP` when set. */\n  app?: string;\n};\n\n/**\n * Posts a thread update via `client.sendUpdate()`. Marked as a step so the API\n * call runs in full Node.js with retries and is recorded in the workflow run.\n */\nasync function sendRobotRockUpdate(payload: SendUpdateWorkflowPayload): Promise<ThreadUpdate> {\n  \"use step\";\n\n  const { app, ...update } = payload;\n  const baseConfig = resolveRobotRockConfig();\n  const client = createClient({\n    apiKey: baseConfig.apiKey,\n    baseUrl: baseConfig.baseUrl,\n    ...((app ?? baseConfig.app) ? { app: app ?? baseConfig.app } : {}),\n    ...(baseConfig.version ? { version: baseConfig.version } : {}),\n  });\n\n  return client.sendUpdate(update);\n}\n\n/**\n * Durable thread update for Vercel Workflow.\n *\n * Wraps {@link createClient}'s `sendUpdate` in a `\"use step\"` so progress\n * reports are retried and recorded in the run. Fire-and-forget: returns the\n * created update without suspending the workflow (no human wait involved).\n *\n * Call from a function with `\"use workflow\"` as its first statement.\n */\nexport async function sendUpdateInWorkflow(\n  payload: SendUpdateWorkflowPayload\n): Promise<ThreadUpdate> {\n  return sendRobotRockUpdate(payload);\n}\n\nexport type { RobotRockHandlerWebhookPayload } from \"../handler-webhook.js\";\nexport type {\n  ApprovalResult,\n  DiscriminatedApprovalResult,\n  TaskContextInput,\n  TaskResult,\n  ThreadUpdate,\n  ThreadUpdateStatus,\n} from \"../schemas/index.js\";\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,eAAe,aAAa;AA8BrC,IAAM,2BAA2B;AAAA,EAC/B,EAAE,IAAI,WAAW,OAAO,UAAU;AAAA,EAClC,EAAE,IAAI,WAAW,OAAO,UAAU;AACpC;AAaA,eAAe,8BAA8B,OAA4B;AACvE;AAEA,QAAM,aAAa,uBAAuB;AAC1C,QAAM,SAAS,aAAa;AAAA,IAC1B,QAAQ,WAAW;AAAA,IACnB,SAAS,WAAW;AAAA,IACpB,GAAK,MAAM,OAAO,WAAW,MAAO,EAAE,KAAK,MAAM,OAAO,WAAW,IAAI,IAAI,CAAC;AAAA,IAC5E,GAAI,WAAW,UAAU,EAAE,SAAS,WAAW,QAAQ,IAAI,CAAC;AAAA,IAC5D,SAAS,EAAE,KAAK,MAAM,WAAW;AAAA,EACnC,CAAC;AAED,SAAO,OAAO,YAAY;AAAA,IACxB,GAAG,MAAM;AAAA,IACT,YAAY,MAAM;AAAA,EACpB,CAAC;AACH;AAEA,eAAe,6BAA6B,SAAkB;AAC5D;AAEA,QAAM,OAAgB,MAAM,QAAQ,KAAK;AACzC,MAAI,CAAC,iCAAiC,IAAI,GAAG;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASA,eAAsB,sBAGpB,SACiD;AAKjD;AAAA;AAJA,UAAM,EAAE,YAAY,iBAAiB,KAAK,GAAG,UAAU,IAAI;AAC3D,UAAM,EAAE,YAAY,QAAQ,IAAI,kBAAkB,eAAe;AACjE,UAAM,YAAY,kBAAkB,UAAU,IAAI,KAAK,IAAI;AAE3D,UAAM,UAAU,8BAAc;AAE9B,UAAM,aAAa,MAAM,8BAA8B;AAAA,MACrD,YAAY,QAAQ;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,UAAU,MAAM,QAAQ,KAAK;AAAA,MACjC,QAAQ,KAAK,CAAC,YAAY,6BAA6B,OAAO,CAAC;AAAA,MAC/D,MAAM,SAAS,EAAE,KAAK,OAAO,EAAE,UAAU,KAAK,EAAW;AAAA,IAC3D,CAAC;AAED,QAAI,cAAc,SAAS;AACzB,YAAM,IAAI,MAAM,+CAA+C,OAAO,GAAG;AAAA,IAC3E;AAEA,UAAM,SAAyC;AAE/C,WAAO,8BAA8B,QAAQ,SAAS;AAAA,MACpD,IAAI,OAAO;AAAA,MACX,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ;AAAA,MACR,SAAS,WAAW,KAAK;AAAA,MACzB,YAAY,KAAK,IAAI;AAAA,MACrB,WAAW,IAAI,KAAK,OAAO,SAAS,EAAE,QAAQ;AAAA,MAC9C,SAAS;AAAA,QACP,QAAQ;AAAA,UACN,IAAI,OAAO,OAAO;AAAA,UAClB,MAAM,OAAO,OAAO;AAAA,QACtB;AAAA,QACA,WAAW,OAAO;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,WAlCD;AAAA;AAAA;AAAA;AAAA;AAmCF;AAKA,eAAsB,yBACpB,SAC+E;AAC/E,SAAO,sBAAsB;AAAA,IAC3B,GAAG;AAAA,IACH,SAAS;AAAA,EACX,CAAC;AACH;AAiBA,eAAe,oBAAoB,SAA2D;AAC5F;AAEA,QAAM,EAAE,KAAK,GAAG,OAAO,IAAI;AAC3B,QAAM,aAAa,uBAAuB;AAC1C,QAAM,SAAS,aAAa;AAAA,IAC1B,QAAQ,WAAW;AAAA,IACnB,SAAS,WAAW;AAAA,IACpB,GAAK,OAAO,WAAW,MAAO,EAAE,KAAK,OAAO,WAAW,IAAI,IAAI,CAAC;AAAA,IAChE,GAAI,WAAW,UAAU,EAAE,SAAS,WAAW,QAAQ,IAAI,CAAC;AAAA,EAC9D,CAAC;AAED,SAAO,OAAO,WAAW,MAAM;AACjC;AAWA,eAAsB,qBACpB,SACuB;AACvB,SAAO,oBAAoB,OAAO;AACpC;","names":[]}

package/dist/{workflow-iDk0Hlyg.d.ts → workflow-CUkzjf6m.d.ts}

@@ -1,8 +1,8 @@
 import * as ai from 'ai';
 import { ToolApprovalResponse } from 'ai';
 import { z } from 'zod';
-import { b as RobotRock, a as SendToHumanInput, S as SendToHumanActionInput } from './client-BOm2Ce2f.js';
-import { DiscriminatedApprovalResult } from './schemas/index.js';
+import { b as RobotRock, a as SendToHumanInput, S as SendToHumanActionInput, l as SendUpdateInput } from './client-BOm2Ce2f.js';
+import { DiscriminatedApprovalResult, ThreadUpdate } from './schemas/index.js';
 
 declare const APPROVE_BY_HUMAN_ACTIONS$1: readonly [{
     readonly id: "approve";
@@ -35,6 +35,14 @@ type RobotRockAiWorkflowContext = {
 type RobotRockAiContext = RobotRockAiPollingContext | RobotRockAiTriggerContext | RobotRockAiWorkflowContext;
 declare function normalizeRobotRockAiContext(clientOrContext: RobotRock | RobotRockAiContext): RobotRockAiContext;
 declare function sendToHumanForAi<A extends readonly SendToHumanActionInput[] = readonly SendToHumanActionInput[]>(context: RobotRockAiContext, payload: SendToHumanInput<A>): Promise<DiscriminatedApprovalResult<A>>;
+/**
+ * Posts a thread update for an AI tool, routing by execution mode.
+ *
+ * `sendUpdate` is fire-and-forget (no human wait), so only the workflow path
+ * needs durability — it runs inside a `"use step"`. Trigger and polling modes
+ * issue the request directly.
+ */
+declare function sendUpdateForAi(context: RobotRockAiContext, payload: SendUpdateInput): Promise<ThreadUpdate>;
 declare function approveByHumanForAi(context: RobotRockAiContext, payload: Omit<SendToHumanInput, "actions"> & {
     app?: string;
 }): Promise<DiscriminatedApprovalResult<typeof APPROVE_BY_HUMAN_ACTIONS$1>>;
@@ -101,13 +109,13 @@ declare const approveByHumanInputSchema: z.ZodObject<{
     description: z.ZodString;
     contextSummary: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    description: string;
     name: string;
+    description: string;
     type?: string | undefined;
     contextSummary?: string | undefined;
 }, {
-    description: string;
     name: string;
+    description: string;
     type?: string | undefined;
     contextSummary?: string | undefined;
 }>;
@@ -127,8 +135,8 @@ type ApproveByHumanToolDurableOptions = ApproveByHumanToolOptions & RobotRockAiC
  * - `approveByHumanTool({ mode: "workflow", app?: "my-agent" })` — durable wait via Vercel Workflow.
  */
 declare function approveByHumanTool(clientOrContext: RobotRock | ApproveByHumanToolDurableOptions, maybeOptions?: ApproveByHumanToolOptions): ai.Tool<{
-    description: string;
     name: string;
+    description: string;
     type?: string | undefined;
     contextSummary?: string | undefined;
 }, HumanToolResult>;
@@ -141,11 +149,11 @@ declare const sendToHumanToolInputSchema: z.ZodObject<{
         data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         ui: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, "strip", z.ZodTypeAny, {
-        ui?: Record<string, unknown> | undefined;
         data?: Record<string, unknown> | undefined;
-    }, {
         ui?: Record<string, unknown> | undefined;
+    }, {
         data?: Record<string, unknown> | undefined;
+        ui?: Record<string, unknown> | undefined;
     }>>;
     validUntil: z.ZodOptional<z.ZodString>;
     assignTo: z.ZodOptional<z.ZodEffects<z.ZodObject<{
@@ -170,8 +178,8 @@ declare const sendToHumanToolInputSchema: z.ZodObject<{
     description?: string | undefined;
     validUntil?: string | undefined;
     context?: {
-        ui?: Record<string, unknown> | undefined;
         data?: Record<string, unknown> | undefined;
+        ui?: Record<string, unknown> | undefined;
     } | undefined;
     assignTo?: {
         users?: string[] | undefined;
@@ -183,8 +191,8 @@ declare const sendToHumanToolInputSchema: z.ZodObject<{
     description?: string | undefined;
     validUntil?: string | undefined;
     context?: {
-        ui?: Record<string, unknown> | undefined;
         data?: Record<string, unknown> | undefined;
+        ui?: Record<string, unknown> | undefined;
     } | undefined;
     assignTo?: {
         users?: string[] | undefined;
@@ -196,6 +204,11 @@ type CreateSendToHumanToolOptions<A extends readonly SendToHumanActionInput[] =
     defaultType?: string;
     description?: string;
     toolName?: string;
+    /**
+     * Group every task this tool creates onto a shared thread. Pass the same
+     * value to {@link createSendUpdateTool} so updates land on the same thread.
+     */
+    threadId?: string;
 };
 type CreateSendToHumanToolDurableOptions<A extends readonly SendToHumanActionInput[] = readonly SendToHumanActionInput[]> = CreateSendToHumanToolOptions<A> & RobotRockAiContext & {
     mode: "trigger" | "workflow";
@@ -213,8 +226,8 @@ declare function createSendToHumanTool<A extends readonly SendToHumanActionInput
     description?: string | undefined;
     validUntil?: string | undefined;
     context?: {
-        ui?: Record<string, unknown> | undefined;
         data?: Record<string, unknown> | undefined;
+        ui?: Record<string, unknown> | undefined;
     } | undefined;
     assignTo?: {
         users?: string[] | undefined;
@@ -222,11 +235,77 @@ declare function createSendToHumanTool<A extends readonly SendToHumanActionInput
     } | undefined;
 }, HumanToolResult>;
 
+/**
+ * Result returned to the model by {@link createSendUpdateTool}.
+ *
+ * Updates are fire-and-forget, so a missing thread (no task created yet) is
+ * reported as `{ posted: false }` instead of throwing — that way an agent loop
+ * is never aborted by a non-critical progress update. Genuine failures (auth,
+ * validation, server errors) still throw.
+ */
+type SendUpdateToolResult = {
+    posted: true;
+    threadId: string;
+    update: ThreadUpdate;
+} | {
+    posted: false;
+    threadId: string;
+    reason: "thread_not_found";
+    message: string;
+};
+declare const sendUpdateToolInputSchema: z.ZodObject<{
+    threadId: z.ZodOptional<z.ZodString>;
+    message: z.ZodString;
+    status: z.ZodOptional<z.ZodEnum<["info", "queued", "running", "waiting", "succeeded", "failed", "cancelled"]>>;
+}, "strip", z.ZodTypeAny, {
+    message: string;
+    status?: "info" | "queued" | "running" | "waiting" | "succeeded" | "failed" | "cancelled" | undefined;
+    threadId?: string | undefined;
+}, {
+    message: string;
+    status?: "info" | "queued" | "running" | "waiting" | "succeeded" | "failed" | "cancelled" | undefined;
+    threadId?: string | undefined;
+}>;
+type CreateSendUpdateToolOptions = {
+    /**
+     * Session thread to post updates to when the model does not supply `threadId`.
+     * Pass the same value to {@link createSendToHumanTool} to auto-thread tasks
+     * and updates together.
+     */
+    threadId?: string;
+    description?: string;
+};
+type CreateSendUpdateToolDurableOptions = CreateSendUpdateToolOptions & RobotRockAiContext & {
+    mode: "trigger" | "workflow";
+};
+/**
+ * AI SDK tool that posts a progress update to a RobotRock thread.
+ *
+ * Fire-and-forget (no human wait): the agent reports status as it works.
+ *
+ * - `createSendUpdateTool(robotrock, options?)` — polling client (default).
+ * - `createSendUpdateTool({ mode: "trigger", app?: "my-agent" })` — Trigger.dev worker.
+ * - `createSendUpdateTool({ mode: "workflow", app?: "my-agent" })` — Vercel Workflow (durable step).
+ *
+ * The thread is resolved from the tool input `threadId`, falling back to a
+ * session `threadId` in the options. Provide at least one.
+ */
+declare function createSendUpdateTool(clientOrOptions: RobotRock | CreateSendUpdateToolDurableOptions, maybeOptions?: CreateSendUpdateToolOptions): ai.Tool<{
+    message: string;
+    status?: "info" | "queued" | "running" | "waiting" | "succeeded" | "failed" | "cancelled" | undefined;
+    threadId?: string | undefined;
+}, SendUpdateToolResult>;
+
 type CreateRobotRockAiToolsOptions = {
     /** @default "polling" when `client` is passed; `"trigger"` or `"workflow"` for durable waits. */
     mode?: "polling" | "trigger" | "workflow";
     client?: RobotRock;
     app?: string;
+    /**
+     * Shared thread for tasks and updates these tools create. Enables the
+     * `sendUpdate` tool to auto-thread onto tasks made by the `sendToHuman` tool.
+     */
+    threadId?: string;
 };
 /**
  * Build AI SDK tools for a given RobotRock execution mode.
@@ -249,8 +328,8 @@ type CreateRobotRockAiToolsOptions = {
 declare function createRobotRockAiTools(options: CreateRobotRockAiToolsOptions): {
     context: RobotRockAiContext;
     approveByHuman: (toolOptions?: ApproveByHumanToolOptions) => ai.Tool<{
-        description: string;
         name: string;
+        description: string;
         type?: string | undefined;
         contextSummary?: string | undefined;
     }, HumanToolResult>;
@@ -260,14 +339,19 @@ declare function createRobotRockAiTools(options: CreateRobotRockAiToolsOptions):
         description?: string | undefined;
         validUntil?: string | undefined;
         context?: {
-            ui?: Record<string, unknown> | undefined;
             data?: Record<string, unknown> | undefined;
+            ui?: Record<string, unknown> | undefined;
         } | undefined;
         assignTo?: {
             users?: string[] | undefined;
             groups?: string[] | undefined;
         } | undefined;
     }, HumanToolResult>;
+    sendUpdate: (toolOptions?: CreateSendUpdateToolOptions) => ai.Tool<{
+        message: string;
+        status?: "info" | "queued" | "running" | "waiting" | "succeeded" | "failed" | "cancelled" | undefined;
+        threadId?: string | undefined;
+    }, SendUpdateToolResult>;
 };
 /** Shorthand for `{ mode: "trigger", app }`. */
 declare function createRobotRockAiTriggerContext(options?: Omit<RobotRockAiTriggerContext, "mode">): RobotRockAiContext;
@@ -306,4 +390,4 @@ declare function resolveToolApprovalsViaRobotRock(clientOrContext: RobotRock | R
  */
 declare function runWithRobotRockApprovals<T>(options: RunWithRobotRockApprovalsOptions<T>): Promise<T>;
 
-export { APPROVE_BY_HUMAN_ACTIONS as A, type ResolveToolApprovalsOptions as B, type CreateSendToHumanToolOptions as C, type RobotRockToolApprovalConfig as D, type RunWithRobotRockApprovalsOptions as E, type FormatToolApprovalTaskOptions as F, type HumanToolResult as H, type RobotRockToolCallInfo as R, type ToolApprovalRequestPart as T, approveByHumanTool as a, approveByHumanInputSchema as b, type ApproveByHumanToolOptions as c, type ApproveByHumanToolDurableOptions as d, createSendToHumanTool as e, type CreateSendToHumanToolDurableOptions as f, approveByHumanForAi as g, sendToHumanForAi as h, type RobotRockAiContext as i, type RobotRockAiMode as j, type RobotRockAiPollingContext as k, type RobotRockAiTriggerContext as l, type RobotRockAiWorkflowContext as m, normalizeRobotRockAiContext as n, createRobotRockAiTools as o, createRobotRockAiTriggerContext as p, createRobotRockAiWorkflowContext as q, type CreateRobotRockAiToolsOptions as r, sendToHumanToolInputSchema as s, applyRobotRockToolApprovalToTools as t, collectApprovalRequests as u, createRobotRockNeedsApproval as v, createRobotRockToolApproval as w, resolveToolApprovalsViaRobotRock as x, runWithRobotRockApprovals as y, type RobotRockToolApprovalDecision as z };
+export { APPROVE_BY_HUMAN_ACTIONS as A, createRobotRockNeedsApproval as B, type CreateSendToHumanToolOptions as C, createRobotRockToolApproval as D, resolveToolApprovalsViaRobotRock as E, type FormatToolApprovalTaskOptions as F, runWithRobotRockApprovals as G, type HumanToolResult as H, type RobotRockToolApprovalDecision as I, type ResolveToolApprovalsOptions as J, type RobotRockToolApprovalConfig as K, type RunWithRobotRockApprovalsOptions as L, type RobotRockToolCallInfo as R, type SendUpdateToolResult as S, type ToolApprovalRequestPart as T, approveByHumanTool as a, approveByHumanInputSchema as b, type ApproveByHumanToolOptions as c, type ApproveByHumanToolDurableOptions as d, createSendToHumanTool as e, type CreateSendToHumanToolDurableOptions as f, createSendUpdateTool as g, sendUpdateToolInputSchema as h, type CreateSendUpdateToolOptions as i, type CreateSendUpdateToolDurableOptions as j, approveByHumanForAi as k, sendToHumanForAi as l, sendUpdateForAi as m, normalizeRobotRockAiContext as n, type RobotRockAiContext as o, type RobotRockAiMode as p, type RobotRockAiPollingContext as q, type RobotRockAiTriggerContext as r, sendToHumanToolInputSchema as s, type RobotRockAiWorkflowContext as t, createRobotRockAiTools as u, createRobotRockAiTriggerContext as v, createRobotRockAiWorkflowContext as w, type CreateRobotRockAiToolsOptions as x, applyRobotRockToolApprovalToTools as y, collectApprovalRequests as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robotrock",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Human-in-the-loop approval workflows for AI agents",
   "type": "module",
   "main": "./dist/index.js",
@@ -54,9 +54,13 @@
     "ai-sdk"
   ],
   "license": "MIT",
+  "homepage": "https://docs.robotrock.io",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/robotrock/robotrock.git"
+    "url": "git+https://github.com/quintenb/robotrock-sdk.git"
+  },
+  "bugs": {
+    "url": "https://github.com/quintenb/robotrock-sdk/issues"
   },
   "dependencies": {
     "zod": "^3.25.0"

package/dist/chunk-2KFY7ZJV.js

@@ -1,157 +0,0 @@
-var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : /* @__PURE__ */ Symbol.for("Symbol." + name);
-var __typeError = (msg) => {
-  throw TypeError(msg);
-};
-var __using = (stack, value, async) => {
-  if (value != null) {
-    if (typeof value !== "object" && typeof value !== "function") __typeError("Object expected");
-    var dispose, inner;
-    if (async) dispose = value[__knownSymbol("asyncDispose")];
-    if (dispose === void 0) {
-      dispose = value[__knownSymbol("dispose")];
-      if (async) inner = dispose;
-    }
-    if (typeof dispose !== "function") __typeError("Object not disposable");
-    if (inner) dispose = function() {
-      try {
-        inner.call(this);
-      } catch (e) {
-        return Promise.reject(e);
-      }
-    };
-    stack.push([async, dispose, value]);
-  } else if (async) {
-    stack.push([async]);
-  }
-  return value;
-};
-var __callDispose = (stack, error, hasError) => {
-  var E = typeof SuppressedError === "function" ? SuppressedError : function(e, s, m, _) {
-    return _ = Error(m), _.name = "SuppressedError", _.error = e, _.suppressed = s, _;
-  };
-  var fail = (e) => error = hasError ? new E(e, error, "An error was suppressed during disposal") : (hasError = true, e);
-  var next = (it) => {
-    while (it = stack.pop()) {
-      try {
-        var result = it[1] && it[1].call(it[2]);
-        if (it[0]) return Promise.resolve(result).then(next, (e) => (fail(e), next()));
-      } catch (e) {
-        fail(e);
-      }
-    }
-    if (hasError) throw error;
-  };
-  return next();
-};
-
-// src/schemas/index.ts
-import { z } from "zod";
-var safeUrlSchema = z.string().refine((url) => url.startsWith("http://") || url.startsWith("https://"), {
-  message: "URL must start with http:// or https://"
-});
-var jsonSchema7Schema = z.custom(
-  (val) => typeof val === "object" && val !== null,
-  { message: "Must be a valid JSON Schema object" }
-);
-var uiSchemaSchema = z.custom((val) => typeof val === "object" && val !== null, {
-  message: "Must be a valid UiSchema object"
-});
-var webhookHandlerSchema = z.object({
-  type: z.literal("webhook"),
-  url: safeUrlSchema,
-  headers: z.record(z.string())
-});
-var triggerHandlerSchema = webhookHandlerSchema.extend({
-  type: z.literal("trigger"),
-  tokenId: z.string().min(1)
-});
-var handlerSchema = z.discriminatedUnion("type", [webhookHandlerSchema, triggerHandlerSchema]);
-var taskActionSchema = z.object({
-  id: z.string().min(1),
-  title: z.string().min(1),
-  description: z.string().optional(),
-  schema: jsonSchema7Schema.optional(),
-  ui: uiSchemaSchema.optional(),
-  data: z.record(z.unknown()).optional(),
-  handlers: z.array(handlerSchema).min(1).optional()
-});
-var uiFieldSchemaSchema = z.object({
-  "ui:widget": z.string().optional(),
-  "ui:title": z.string().optional(),
-  "ui:description": z.string().optional(),
-  "ui:options": z.record(z.unknown()).optional(),
-  items: z.lazy(() => z.record(uiFieldSchemaSchema)).optional()
-}).passthrough();
-var contextUiSchema = z.record(uiFieldSchemaSchema).optional();
-var contextDataSchema = z.object({
-  data: z.record(z.unknown()),
-  ui: contextUiSchema
-}).optional();
-var taskContextSchema = z.object({
-  app: z.string().min(1).optional(),
-  type: z.string().min(1),
-  name: z.string().min(1),
-  description: z.string().optional(),
-  validUntil: z.string().optional(),
-  context: contextDataSchema,
-  version: z.literal(2).optional(),
-  actions: z.array(taskActionSchema).min(1, "At least one action is required")
-});
-var assignToSchema = z.object({
-  users: z.array(z.string().email()).optional(),
-  groups: z.array(z.string().min(1)).optional()
-}).refine(
-  (data) => {
-    const groups = data.groups ?? [];
-    if (groups.includes("all") && groups.length > 1) {
-      return false;
-    }
-    return true;
-  },
-  { message: 'Cannot combine "all" with other group slugs' }
-);
-var threadUpdateMessageSchema = z.string().min(1).max(500);
-var threadUpdateStatuses = [
-  "info",
-  "queued",
-  "running",
-  "waiting",
-  "succeeded",
-  "failed",
-  "cancelled"
-];
-var threadUpdateStatusSchema = z.enum(threadUpdateStatuses);
-var DEFAULT_THREAD_UPDATE_STATUS = "info";
-var threadUpdateInputSchema = z.object({
-  message: threadUpdateMessageSchema,
-  status: threadUpdateStatusSchema.optional()
-});
-var createTaskBodySchema = taskContextSchema.extend({
-  assignTo: assignToSchema.optional(),
-  /**
-   * Groups related tasks together. When omitted, the server generates one and
-   * returns it so the caller can reuse it on later tasks in the same thread.
-   */
-  threadId: z.string().min(1).optional(),
-  /**
-   * Optional initial status update logged against the task's thread. Shows in
-   * the inbox status bar and the thread update log.
-   */
-  update: threadUpdateInputSchema.optional()
-});
-var threadUpdateBodySchema = threadUpdateInputSchema;
-
-export {
-  __using,
-  __callDispose,
-  taskContextSchema,
-  assignToSchema,
-  threadUpdateMessageSchema,
-  threadUpdateStatuses,
-  threadUpdateStatusSchema,
-  DEFAULT_THREAD_UPDATE_STATUS,
-  threadUpdateInputSchema,
-  createTaskBodySchema,
-  threadUpdateBodySchema
-};
-//# sourceMappingURL=chunk-2KFY7ZJV.js.map