totemlayer 0.1.4 → 0.1.5

package/bin/network-runtime.mjs

@@ -3,6 +3,7 @@ import { chmod, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { pause } from "./network.mjs";
+import { localModelEndpoint } from "./local-model-provider.mjs";
 
 export function operationKey(agentId, kind, id, index = 0) {
   return `runtime:${createHash("sha256")
@@ -11,18 +12,7 @@ export function operationKey(agentId, kind, id, index = 0) {
 }
 
 export function ollamaOrigin(value = "http://127.0.0.1:11434") {
-  const url = new URL(value);
-  if (
-    !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) ||
-    !["http:", "https:"].includes(url.protocol) ||
-    url.username ||
-    url.password ||
-    url.pathname !== "/" ||
-    url.search ||
-    url.hash
-  )
-    throw new Error("Ollama must use a loopback origin, for example http://127.0.0.1:11434.");
-  return url.origin;
+  return new URL(localModelEndpoint("ollama", { ollamaUrl: value })).origin;
 }
 
 export function boundedHistory(events, currentEventId) {
@@ -84,6 +74,9 @@ async function responseJson(response) {
 
 export async function modelReply({
   origin,
+  provider = "qwen-local",
+  qwenUrl,
+  nimUrl,
   model,
   messages,
   tools,
@@ -92,26 +85,50 @@ export async function modelReply({
   fetcher = fetch,
 }) {
   const timeout = AbortSignal.timeout(timeoutMs);
+  const openai = provider === "qwen-local" || provider === "nim-local";
+  model ??= provider === "qwen-local" ? "qwen3.5-9b" : undefined;
+  const endpoint = localModelEndpoint(provider, { ollamaUrl: origin, qwenUrl, nimUrl });
   try {
-    const response = await fetcher(`${origin}/api/chat`, {
+    const response = await fetcher(endpoint, {
       method: "POST",
       redirect: "error",
       signal: AbortSignal.any([signal, timeout]),
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         model,
-        messages,
+        messages: openai
+          ? messages.map((message) => {
+              const native = { ...message };
+              delete native.tool_name;
+              if (native.tool_calls)
+                native.tool_calls = native.tool_calls.map((call) => ({
+                  ...call,
+                  function: {
+                    ...call.function,
+                    arguments: JSON.stringify(call.function.arguments),
+                  },
+                }));
+              return native;
+            })
+          : messages,
         ...(tools.length ? { tools } : {}),
         stream: false,
-        think: false,
-        options: { num_predict: 512, temperature: 0 },
+        ...(openai
+          ? {
+              ...(provider === "qwen-local"
+                ? { chat_template_kwargs: { enable_thinking: false } }
+                : {}),
+              max_tokens: 512,
+              temperature: 0,
+            }
+          : { think: false, options: { num_predict: 512, temperature: 0 } }),
       }),
     });
     const data = await responseJson(response);
-    if (!data.message || data.message.role !== "assistant")
-      throw new Error("Invalid model response.");
-    const text = typeof data.message.content === "string" ? data.message.content.trim() : "";
-    const calls = data.message.tool_calls ?? [];
+    const message = openai ? data?.choices?.[0]?.message : data.message;
+    if (!message || message.role !== "assistant") throw new Error("Invalid model response.");
+    const text = typeof message.content === "string" ? message.content.trim() : "";
+    let calls = message.tool_calls ?? [];
     if (
       !Array.isArray(calls) ||
       calls.length > 3 ||
@@ -119,6 +136,31 @@ export async function modelReply({
       (!text && !calls.length)
     )
       throw new Error("Invalid or empty model response.");
+    if (openai) {
+      const ids = new Set();
+      calls = calls.map((call) => {
+        if (
+          call?.type !== "function" ||
+          typeof call.id !== "string" ||
+          !call.id ||
+          call.id.length > 200 ||
+          ids.has(call.id) ||
+          typeof call.function?.name !== "string" ||
+          typeof call.function.arguments !== "string" ||
+          call.function.arguments.length > 32768
+        )
+          throw new Error("Invalid model tool call.");
+        const args = JSON.parse(call.function.arguments);
+        if (!args || typeof args !== "object" || Array.isArray(args))
+          throw new Error("Invalid model tool arguments.");
+        ids.add(call.id);
+        return {
+          id: call.id,
+          type: "function",
+          function: { name: call.function.name, arguments: args },
+        };
+      });
+    }
     return { role: "assistant", content: text, ...(calls.length ? { tool_calls: calls } : {}) };
   } catch (error) {
     if (signal.aborted) throw error;
@@ -126,7 +168,7 @@ export async function modelReply({
       new Error(
         timeout.aborted
           ? "The local model timed out."
-          : "The local model could not produce a valid response. Check Ollama and the installed model.",
+          : "The local model could not produce a valid response. Check the local server and installed model.",
       ),
       { code: timeout.aborted ? "MODEL_TIMEOUT" : "MODEL_ERROR" },
     );
@@ -319,6 +361,9 @@ async function generate({
         );
       const response = await modelReply({
         origin: settings.origin,
+        provider: settings.provider,
+        qwenUrl: settings.qwenUrl,
+        nimUrl: settings.nimUrl,
         model: settings.model,
         messages: state.messages,
         tools,
@@ -365,6 +410,9 @@ async function generate({
       state.messages.push({
         role: "tool",
         tool_name: "ask_agent",
+        ...(["qwen-local", "nim-local"].includes(settings.provider)
+          ? { tool_call_id: pending.call.id }
+          : {}),
         content: JSON.stringify(result).slice(0, 12000),
       });
       pending.completed = true;
@@ -404,11 +452,19 @@ async function runtimeLock(directory) {
 }
 
 export async function runRuntime(settings) {
-  if (settings.provider !== "ollama" || !settings.model?.trim())
+  settings.provider ??= "qwen-local";
+  settings.model ??= settings.provider === "qwen-local" ? "qwen3.5-9b" : undefined;
+  if (
+    !["qwen-local", "ollama", "ollama-local", "nim-local"].includes(settings.provider) ||
+    !settings.model?.trim()
+  )
     throw new Error(
-      "Use --provider ollama --model <installed-model>. No model is downloaded automatically.",
+      "Use --provider qwen-local --model <installed-model>. No model is downloaded automatically.",
     );
-  settings.origin = ollamaOrigin(settings.ollamaUrl);
+  const modelEndpoint = localModelEndpoint(settings.provider, settings);
+  settings.origin = new URL(modelEndpoint).origin;
+  if (settings.provider === "nim-local") settings.nimUrl = `${settings.origin}/v1`;
+  if (settings.provider === "qwen-local") settings.qwenUrl = `${settings.origin}/v1`;
   settings.allowAgents = [
     ...new Set(settings.allowAgents.map((address) => address.trim().toLowerCase())),
   ];
@@ -432,7 +488,7 @@ export async function runRuntime(settings) {
   const scope = operationKey(
     identity.id,
     "state",
-    `${settings.baseUrl ?? "https://totemlayer.com"}|${settings.origin}`,
+    `${settings.baseUrl ?? "https://totemlayer.com"}|${settings.provider === "qwen-local" ? modelEndpoint : settings.origin}`,
   ).slice(8);
   const directory = join(settings.stateDir ?? join(homedir(), ".totem", "runtime"), scope);
   const release = await runtimeLock(directory);
@@ -461,7 +517,10 @@ export async function runRuntime(settings) {
   };
   try {
     const beat = async () =>
-      client.runtime.heartbeat({ label: `ollama:${settings.model}`.slice(0, 100) }, { signal });
+      client.runtime.heartbeat(
+        { label: `${settings.provider}:${settings.model}`.slice(0, 100) },
+        { signal },
+      );
     await beat();
     heartbeat = (async () => {
       while (!signal.aborted) {
@@ -483,7 +542,7 @@ export async function runRuntime(settings) {
       type: "runtime_started",
       data: {
         agent: identity.address,
-        provider: "ollama",
+        provider: settings.provider,
         model: settings.model,
         allowedAgents: settings.allowAgents,
       },

package/bin/network.mjs

@@ -3,6 +3,8 @@ import { readFile, stat } from "node:fs/promises";
 import { Totem } from "./sdk/index.js";
 import { runCollaborationListener } from "./collaboration-listener.mjs";
 import { runRuntime } from "./network-runtime.mjs";
+import { runMissionWorker } from "./mission-worker.mjs";
+import { runMissionSupervisor } from "./mission-supervisor.mjs";
 
 export const NETWORK_HELP = `Totem agent messaging
 
@@ -17,7 +19,7 @@ Local adoption:
   totem network me --json
   totem network work --allow-agent peer@workspace.totem --provider codex
   # Or use --provider claude after configuring Claude's Totem MCP server.
-  totem network run --provider ollama --model qwen3.5:9b
+  totem network run --provider qwen-local --model qwen3.5-9b
   Open Chat in Totem and send your agent a message.
 
 Commands:
@@ -30,14 +32,23 @@ Commands:
   totem network listen [--once] [--poll-ms <milliseconds>]
   totem network work --allow-agent <exact-peer-address> --provider codex|claude
     [--repo-root <checkout>] [--check] [--once] [--poll-ms 5000]
+  totem network mission-work --mission-id <id> --provider qwen-local|ollama-local|nim-local --model <installed-model>
+    [--qwen-url http://127.0.0.1:8087/v1] [--ollama-url http://127.0.0.1:11434] [--reasoning]
+    [--nim-url http://127.0.0.1:8000/v1]
+    [--repo-root <checkout>] [--once] [--poll-ms 5000] [--state-dir <private-directory>]
+  totem network mission-start --mission-id <id> --provider qwen-local|ollama-local|nim-local --model <installed-model>
+    --agent-key-file <private-file> --agent-key-file <private-file> [--agent-key-file <private-file>]...
+    [--qwen-url http://127.0.0.1:8087/v1] [--ollama-url http://127.0.0.1:11434] [--reasoning]
+    [--repo-root <checkout>] [--state-dir <private-directory>]
   totem network chat list [--cursor <cursor>] [--limit <1-100>]
   totem network chat show <chat-id>
   totem network chat updates <chat-id> --text <text> [--idempotency-key <key>]
-  totem network run --provider ollama --model <installed-model>
+  totem network run --provider qwen-local --model <installed-model>
     [--allow-agent <exact-address>]... [--auto-reply-hops <0-8>]
     [--system-file <path>] [--once]
+    [--provider nim-local --nim-url http://127.0.0.1:8000/v1 --model <installed-model>]
     [--poll-ms 1000] [--model-timeout-ms 120000] [--reply-timeout-ms 90000]
-    [--ollama-url http://127.0.0.1:11434] [--state-dir <private-directory>]
+    [--qwen-url http://127.0.0.1:8087/v1] [--state-dir <private-directory>]
 
 All commands accept --json for machine-readable output and --base-url <origin>.
 --text-file <path> can replace --text (UTF-8, at most 32 KiB).
@@ -49,8 +60,21 @@ client's task for later peer messages, and journals each message before launch.
 It never silently retries an uncertain or failed model run. Configure Totem MCP
 in that AI app first; neither a Totem key nor a peer message grants Git access.
 --check validates the agent, peer, and checkout without processing messages.
+mission-work is an opt-in worker for one mission. It claims only assigned ready
+work, runs a local Qwen-compatible or Ollama model with bounded repository file changes, and stores results
+before retryable publication. It never downloads a model automatically.
+--reasoning opts code and review into thinking on a compatible installed model,
+with an 8192-token generation budget. Omit it for models without thinking support.
+Code runs in a separate local Git worktree at the mission's immutable base commit.
+It never pushes, opens a PR, merges, or deploys. Each agent uses its own key and process.
+mission-start launches those separate workers with one local command. Each child
+receives only its own private key-file path; cross-owner agents still run with
+their own owner's credentials and consent.
 run executes a real local model for human commands and new A2A messages. It renews
 leases and heartbeats, and acknowledges only handled messages. By default it
+uses qwen-local with the installed qwen3.5-9b alias on http://127.0.0.1:8087/v1.
+An existing Ollama installation can explicitly select --provider ollama and --ollama-url.
+The qwen-local path uses direct local HTTP and never uses Ollama. The runtime
 ignores reply loops. A send with --conversation-hops and two runtimes with
 --auto-reply-hops can continue a bounded exchange with exact allowed peers.
 In human Chat, /ask <allowed-address> <message> routes directly and returns the
@@ -86,11 +110,14 @@ export function parseNetworkArgs(args) {
       limit: { type: "string" },
       all: { type: "boolean" },
       once: { type: "boolean" },
+      reasoning: { type: "boolean" },
       check: { type: "boolean" },
       "poll-ms": { type: "string" },
       provider: { type: "string" },
       model: { type: "string" },
       "ollama-url": { type: "string" },
+      "qwen-url": { type: "string" },
+      "nim-url": { type: "string" },
       "allow-agent": { type: "string", multiple: true },
       "conversation-hops": { type: "string" },
       "auto-reply-hops": { type: "string" },
@@ -99,6 +126,8 @@ export function parseNetworkArgs(args) {
       "reply-timeout-ms": { type: "string" },
       "state-dir": { type: "string" },
       "repo-root": { type: "string" },
+      "mission-id": { type: "string" },
+      "agent-key-file": { type: "string", multiple: true },
     },
   });
   return { ...parsed.values, positionals: parsed.positionals };
@@ -144,6 +173,32 @@ export async function networkMain(args) {
       process.stdout.write(NETWORK_HELP);
       return;
     }
+    if (command === "mission-start") {
+      if (process.env.TOTEM_NETWORK_API_KEY || process.env.TOTEM_NETWORK_API_KEY_FILE)
+        throw new Error(
+          "mission-start takes private --agent-key-file paths, not a shared key environment variable.",
+        );
+      process.once("SIGINT", stop);
+      process.once("SIGTERM", stop);
+      await runMissionSupervisor({
+        keyFiles: options["agent-key-file"],
+        missionId: required(options["mission-id"], "--mission-id <id>"),
+        baseUrl: options["base-url"] ?? process.env.TOTEM_BASE_URL,
+        provider: options.provider,
+        model: options.model,
+        ollamaUrl: options["ollama-url"],
+        qwenUrl: options["qwen-url"],
+        nimUrl: options["nim-url"],
+        reasoning: options.reasoning,
+        repositoryRoot: options["repo-root"] ?? process.cwd(),
+        stateDirectory: options["state-dir"],
+        pollMs: numberOption(options["poll-ms"], 5000, 1000, 60000, "--poll-ms"),
+        once: options.once,
+        signal: controller.signal,
+        emit,
+      });
+      return;
+    }
     if (process.env.TOTEM_NETWORK_API_KEY_FILE) {
       if (secret)
         throw new Error("Set only one of TOTEM_NETWORK_API_KEY and TOTEM_NETWORK_API_KEY_FILE.");
@@ -222,11 +277,45 @@ export async function networkMain(args) {
         await textInput(options),
         write,
       );
-    else if (command === "listen" || command === "run" || command === "work") {
+    else if (
+      command === "listen" ||
+      command === "run" ||
+      command === "work" ||
+      command === "mission-work"
+    ) {
       process.once("SIGINT", stop);
       process.once("SIGTERM", stop);
       const interval = numberOption(options["poll-ms"], 1000, 100, 60000, "--poll-ms");
-      if (command === "work") {
+      if (command === "mission-work") {
+        if (!process.env.TOTEM_NETWORK_API_KEY_FILE)
+          throw new Error("mission-work requires a private TOTEM_NETWORK_API_KEY_FILE.");
+        options.provider ??= "qwen-local";
+        options.model ??= options.provider === "qwen-local" ? "qwen3.5-9b" : undefined;
+        if (
+          !["qwen-local", "ollama-local", "nim-local"].includes(options.provider) ||
+          !options.model
+        )
+          throw new Error(
+            "mission-work requires --provider qwen-local|ollama-local|nim-local --model <installed-model>.",
+          );
+        await runMissionWorker({
+          client,
+          baseUrl,
+          missionId: required(options["mission-id"], "--mission-id <id>"),
+          repositoryRoot: options["repo-root"] ?? process.cwd(),
+          stateDirectory: options["state-dir"],
+          pollMs: numberOption(options["poll-ms"], 5000, 1000, 60000, "--poll-ms"),
+          model: options.model,
+          provider: options.provider,
+          ollamaUrl: options["ollama-url"],
+          qwenUrl: options["qwen-url"],
+          nimUrl: options["nim-url"],
+          reasoning: options.reasoning,
+          once: options.once,
+          signal,
+          emit,
+        });
+      } else if (command === "work") {
         if (!process.env.TOTEM_NETWORK_API_KEY_FILE)
           throw new Error(
             "work requires TOTEM_NETWORK_API_KEY_FILE so the local agent process never inherits a raw Totem key.",
@@ -265,6 +354,8 @@ export async function networkMain(args) {
           provider: options.provider,
           model: options.model,
           ollamaUrl: options["ollama-url"],
+          qwenUrl: options["qwen-url"],
+          nimUrl: options["nim-url"],
           allowAgents: options["allow-agent"] ?? [],
           autoReplyHops: numberOption(options["auto-reply-hops"], 0, 0, 8, "--auto-reply-hops"),
           systemFile: options["system-file"],

package/bin/platform-client.mjs

@@ -28,6 +28,7 @@ const INHERITED_ENVIRONMENT = new Set(
     "PROGRAMFILES",
     "TOTEM_NETWORK_API_KEY_FILE",
     "TOTEM_BASE_URL",
+    "TOTEM_TEST_SANDBOX",
   ].map((name) => name.toUpperCase()),
 );
 

package/bin/sdk/action-types.js

@@ -0,0 +1 @@
+export {};

package/bin/sdk/actions.js

@@ -0,0 +1,84 @@
+import { TotemError } from "./errors.js";
+import { requireActionChecksKey, signalOnlyOptions } from "./request-options.js";
+import { Transport } from "./transport.js";
+export * from "./action-types.js";
+function responseField(payload, key) {
+    const value = payload[key];
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new TotemError("Totem returned an invalid Action Checks response.", {
+            code: "INVALID_RESPONSE",
+        });
+    }
+    return value;
+}
+function proposal(action) {
+    const authorityFields = [
+        "organizationId",
+        "userId",
+        "ownerUserId",
+        "requestedByUserId",
+        "requestedByApiKeyId",
+        "principal",
+        "authentication",
+        "apiKeyId",
+        "from",
+    ];
+    if (!action || typeof action !== "object" || authorityFields.some((key) => key in action)) {
+        throw new TotemError("Action Checks caller authority comes from its separate scoped API key.", {
+            code: "INVALID_ACTION",
+        });
+    }
+    return action;
+}
+/**
+ * Separately authenticated Action Checks client. Human approval stays in Totem's UI.
+ * Writes are never automatically replayed, even when the action has an idempotency key.
+ * After an ambiguous execution failure, use get() to inspect the receipt before proceeding.
+ */
+export class TotemActions {
+    #transport;
+    constructor(options) {
+        this.#transport = new Transport({
+            apiKey: requireActionChecksKey(options.actionChecksApiKey),
+            baseUrl: options.baseUrl,
+            timeoutMs: options.timeoutMs,
+            maxRetries: options.maxRetries,
+            retryDelayMs: options.retryDelayMs,
+            fetch: options.fetch,
+        }, { basePath: "/api/action-checks", responseEnvelope: "object" });
+    }
+    async create(action, options) {
+        const result = await this.#transport.request("POST", "", {
+            ...signalOnlyOptions(options),
+            body: { action: proposal(action) },
+        });
+        return responseField(result, "suite");
+    }
+    async get(suiteId, options) {
+        const result = await this.#transport.request("GET", `/${encodeURIComponent(suiteId)}`, signalOnlyOptions(options));
+        return responseField(result, "suite");
+    }
+    async issueGrant(suiteId, action, options) {
+        const result = await this.#transport.request("POST", `/${encodeURIComponent(suiteId)}/grant`, {
+            ...signalOnlyOptions(options),
+            body: { action: proposal(action) },
+        });
+        return responseField(result, "grant");
+    }
+    async execute(suiteId, input, options) {
+        const result = await this.#transport.request("POST", `/${encodeURIComponent(suiteId)}/execute`, {
+            ...signalOnlyOptions(options),
+            body: { action: proposal(input.action), grant: input.grant },
+        });
+        const suite = responseField(result, "suite");
+        const receipt = result.receipt === null
+            ? null
+            : responseField(result, "receipt");
+        if (typeof result.receiptId !== "string" || !result.receiptId) {
+            throw new TotemError("Totem returned an invalid execution receipt ID.", {
+                code: "INVALID_RESPONSE",
+            });
+        }
+        return { suite, receipt, receiptId: result.receiptId };
+    }
+}

package/bin/sdk/index.js

@@ -1,7 +1,9 @@
 import { TotemError } from "./errors.js";
 import { idempotencyKey, sleep, Transport } from "./transport.js";
+import { assertInputFields, assistantCheckOptions, signalOnlyOptions } from "./request-options.js";
 export * from "./types.js";
 export * from "./errors.js";
+export * from "./actions.js";
 export { idempotencyKey } from "./transport.js";
 function content(input) {
     // Runtime callers (including JavaScript) cannot accidentally provide a sender.
@@ -48,6 +50,21 @@ export class Totem {
     async agent(options) {
         return (await this.#transport.request("GET", "/agents/me", options)).data;
     }
+    assistant = {
+        context: async (options) => (await this.#transport.request("GET", "/assistant/context", signalOnlyOptions(options))).data,
+        checks: {
+            create: async (missionId, input, options) => {
+                assertInputFields(input, ["workItemId", "leaseToken", "action"]);
+                return (await this.#transport.request("POST", `/assistant/missions/${encodeURIComponent(missionId)}/action-checks`, { ...assistantCheckOptions(options), body: input })).data;
+            },
+            list: async (missionId, workItemId, options) => (await this.#transport.request("GET", `/assistant/missions/${encodeURIComponent(missionId)}/action-checks`, { ...signalOnlyOptions(options), query: { workItemId } })).data,
+            recordReceipt: async (missionId, suiteId, input, options) => {
+                assertInputFields(input, ["workItemId"]);
+                return (await this.#transport.request("POST", `/assistant/missions/${encodeURIComponent(missionId)}/action-checks/${encodeURIComponent(suiteId)}/receipt`, { ...signalOnlyOptions(options), body: input })).data;
+            },
+        },
+        permissions: async (missionId, options) => (await this.#transport.request("GET", `/assistant/missions/${encodeURIComponent(missionId)}/permissions`, signalOnlyOptions(options))).data,
+    };
     async resolve(address, options) {
         return (await this.#transport.request("GET", `/resolve/${encodeURIComponent(address)}`, options)).data;
     }
@@ -122,6 +139,64 @@ export class Totem {
     startConversation(input, options) {
         return this.conversations.create(input, options);
     }
+    missions = {
+        list: async (options) => (await this.#transport.request("GET", "/missions", options)).data.missions,
+        listPage: async (query = {}, options) => {
+            const page = await this.#transport.request("GET", "/missions", { ...options, query });
+            return { data: page.data.missions, nextCursor: page.nextCursor ?? null };
+        },
+        iterate: (query = {}, options) => paginate((cursor) => this.missions.listPage({ ...query, cursor }, options), query.cursor),
+        get: async (id, options) => {
+            const result = await this.#transport.request("GET", `/missions/${encodeURIComponent(id)}`, options);
+            return {
+                ...result.data.mission,
+                members: result.data.members,
+                workItems: result.data.workItems,
+                artifacts: result.data.artifacts,
+                events: result.data.events,
+                budget: result.data.budget,
+            };
+        },
+        workItems: async (id, options) => (await this.#transport.request("GET", `/missions/${encodeURIComponent(id)}/work-items`, options)).data.workItems,
+        /** Empty data can still have a nextCursor: readiness is checked after scanning candidates. */
+        workItemsPage: async (id, query = {}, options) => {
+            const page = await this.#transport.request("GET", `/missions/${encodeURIComponent(id)}/work-items`, { ...options, query });
+            return { data: page.data.workItems, nextCursor: page.nextCursor ?? null };
+        },
+        iterateWorkItems: (id, query = {}, options) => paginate((cursor) => this.missions.workItemsPage(id, { ...query, cursor }, options), query.cursor),
+        claim: async (id, workItemId, options) => (await this.#transport.request("POST", `/missions/${encodeURIComponent(id)}/work-items/${encodeURIComponent(workItemId)}/claim`, { ...options, body: {} })).data,
+        renew: async (id, workItemId, leaseToken, options) => (await this.#transport.request("POST", `/missions/${encodeURIComponent(id)}/work-items/${encodeURIComponent(workItemId)}/renew`, { ...options, body: { leaseToken }, retrySafe: true })).data,
+        complete: async (id, workItemId, input, options = {}) => (await this.#transport.request("POST", `/missions/${encodeURIComponent(id)}/work-items/${encodeURIComponent(workItemId)}/complete`, { ...options, body: input, idempotencyKey: options.idempotencyKey ?? idempotencyKey() })).data,
+        reserveEffect: async (id, input, options = {}) => (await this.#transport.request("POST", `/missions/${encodeURIComponent(id)}/effects`, {
+            ...options,
+            body: input,
+            idempotencyKey: options.idempotencyKey ?? idempotencyKey(),
+        })).data,
+        listEffects: async (id, workItemId, options) => (await this.#transport.request("GET", `/missions/${encodeURIComponent(id)}/effects`, {
+            ...options,
+            query: { workItemId },
+        })).data.effects,
+        dispatchEffect: async (id, effectId, leaseToken, options) => (await this.#transport.request("POST", `/missions/${encodeURIComponent(id)}/effects/${encodeURIComponent(effectId)}/dispatch`, {
+            ...options,
+            body: { leaseToken },
+        })).data,
+        settleEffect: async (id, effectId, input, options) => (await this.#transport.request("POST", `/missions/${encodeURIComponent(id)}/effects/${encodeURIComponent(effectId)}/settle`, { ...options, body: input, retrySafe: true })).data,
+        events: {
+            list: (id, query = {}, options) => this.#transport.request("GET", `/missions/${encodeURIComponent(id)}/events`, {
+                ...options,
+                query,
+            }),
+            iterate: (id, query = {}, options) => paginate((cursor) => this.missions.events.list(id, { ...query, cursor }, options), query.cursor),
+            post: async (id, input, options = {}) => {
+                if ("from" in input || "sender" in input || "actor" in input)
+                    throw new TotemError("Mission event actors come from the agent credential.", {
+                        code: "INVALID_EVENT",
+                    });
+                return (await this.#transport.request("POST", `/missions/${encodeURIComponent(id)}/events`, { ...options, body: input, idempotencyKey: options.idempotencyKey ?? idempotencyKey() })).data;
+            },
+            ack: async (id, eventId, options) => (await this.#transport.request("POST", `/missions/${encodeURIComponent(id)}/events/${encodeURIComponent(eventId)}/ack`, { ...options, body: {}, retrySafe: true })).data,
+        },
+    };
     chats = {
         list: (query = {}, options) => this.#transport.request("GET", "/chats", { ...options, query }),
         get: async (id, options = {}) => (await this.#transport.request("GET", `/chats/${encodeURIComponent(id)}`, {

package/bin/sdk/request-options.js

@@ -0,0 +1,36 @@
+import { TotemError } from "./errors.js";
+export function requireActionChecksKey(apiKey) {
+    if (typeof apiKey !== "string" || !/^at_(?:test|live)_[A-Za-z0-9_-]{43}$/.test(apiKey)) {
+        throw new TotemError("A separate scoped Action Checks API key (at_test_ or at_live_) is required; Network credentials cannot authorize actions.", { code: "INVALID_CONFIG" });
+    }
+    return apiKey;
+}
+export function assistantCheckOptions(options) {
+    const { actionChecksApiKey, ...requestOptions } = options ?? {};
+    return {
+        ...signalOnlyOptions(requestOptions),
+        headers: { "X-Totem-Action-Key": requireActionChecksKey(actionChecksApiKey) },
+    };
+}
+export function assertInputFields(input, allowed) {
+    if (!input ||
+        typeof input !== "object" ||
+        Array.isArray(input) ||
+        Object.keys(input).some((key) => !allowed.includes(key))) {
+        throw new TotemError("The request contains unsupported fields; caller identity comes from credentials.", {
+            code: "INVALID_INPUT",
+        });
+    }
+}
+/** These APIs derive caller identity from credentials, never from caller options. */
+export function signalOnlyOptions(options = {}) {
+    if (!options ||
+        typeof options !== "object" ||
+        Array.isArray(options) ||
+        Object.keys(options).some((key) => key !== "signal")) {
+        throw new TotemError("Only an abort signal may be supplied as request options.", {
+            code: "INVALID_REQUEST_OPTIONS",
+        });
+    }
+    return { signal: options.signal };
+}

package/bin/sdk/transport.js

@@ -25,7 +25,8 @@ export class Transport {
     #timeoutMs;
     #maxRetries;
     #retryDelayMs;
-    constructor(options) {
+    #responseEnvelope;
+    constructor(options, api = undefined) {
         if (!options.apiKey?.trim())
             throw new TotemError("An agent API key is required.", { code: "INVALID_CONFIG" });
         const url = new URL(options.baseUrl ?? "https://totemlayer.com");
@@ -41,7 +42,8 @@ export class Transport {
             });
         }
         this.#apiKey = options.apiKey;
-        this.#baseUrl = `${url.origin}/api/v1/network`;
+        this.#baseUrl = `${url.origin}${api?.basePath ?? "/api/v1/network"}`;
+        this.#responseEnvelope = api?.responseEnvelope ?? "data";
         this.#fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
         this.#timeoutMs = options.timeoutMs ?? 15_000;
         this.#maxRetries = options.maxRetries ?? 2;
@@ -117,7 +119,10 @@ export class Transport {
                     }
                     if (!result.ok)
                         throw apiError(result.status, payload, requestId);
-                    if (!payload || typeof payload !== "object" || !("data" in payload)) {
+                    if (!payload ||
+                        typeof payload !== "object" ||
+                        Array.isArray(payload) ||
+                        (this.#responseEnvelope === "data" && !("data" in payload))) {
                         throw new TotemError("Totem returned an invalid response envelope.", {
                             code: "INVALID_RESPONSE",
                             requestId,