Skip to content

chore: version packages - #1255

Merged
BYWallace merged 1 commit into
mainfrom
changeset-release/main
Oct 28, 2026
Merged

chore: version packages#1255
BYWallace merged 1 commit into
mainfrom
changeset-release/main

Conversation

@github-actions

@github-actions github-actions Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@sapiom/agent-core@0.16.0

Minor Changes

  • a76b8bd: The tenant API key now only travels over HTTPS, or plain HTTP to a loopback
    host, from every SDK client, and never follows a redirect to another origin.
    One function, credentialFetch from the new @sapiom/analytics-core/credential
    subpath, is the only code that sets the key header.

    Behavior changes, shipped as 0.x minor bumps: a plain http:// URL to a
    non-loopback host is now refused, and the key headers are stripped on a
    cross-origin redirect. @sapiom/core and @sapiom/browser-pay gain their
    first runtime dependency, @sapiom/analytics-core.

    • @sapiom/core, @sapiom/agent-core and @sapiom/mcp: a plain http://
      URL to a non-loopback host (for example a Docker service name or a LAN IP)
      now fails before the request is sent. On a trusted private network, opt in
      with new SapiomClient({ allowInsecureHttp: true }) (core),
      createClient({ allowInsecureHttp: true }) (agent-core) or
      SAPIOM_ALLOW_INSECURE_HTTP=1 (all clients). localhost, *.localhost,
      127.0.0.1 and [::1] work as before. Core does not retry a refused channel.
    • @sapiom/analytics-core: on such an endpoint the batch is still sent, without
      the key. A redirect to a refused channel drops the batch.
    • Every client follows redirects itself: the first hop to another origin drops
      x-api-key, x-sapiom-api-key and every x-sapiom-* header.
    • @sapiom/core: getHttpClient().defaults.headers no longer carries the key;
      read defaults.credential instead.
    • @sapiom/browser-pay: the payment relay uses the shared rule, so a
      *.localhost base URL and SAPIOM_ALLOW_INSECURE_HTTP=1 are now accepted, and
      a refused base URL throws a CredentialChannelError. Redirects are still
      refused.
    • @sapiom/tools: no behavior change. A refused call now throws a
      CredentialChannelError, a TypeError subclass that keeps name: "TypeError".

Patch Changes

  • 1b9a5f6: Stop linking docs.sapiom.ai pages that no longer exist. The sapiom-agent-authoring skill and its scaffold copies, the Agent Studio system prompt, help palette and welcome screen, and the @sapiom/agent README drop links to the agent quick start, authoring guide, MCP setup, call-surface, credentials and signals guides. The first-run telemetry notice drops its link to a /telemetry page that never existed. Links to /capabilities pages are unchanged.
  • Updated dependencies [1b9a5f6]
  • Updated dependencies [89f1829]
  • Updated dependencies [a76b8bd]
  • Updated dependencies [ec08398]
    • @sapiom/agent@0.14.12
    • @sapiom/analytics-core@0.3.0
    • @sapiom/tools@0.48.0

@sapiom/analytics-core@0.3.0

Minor Changes

  • a76b8bd: The tenant API key now only travels over HTTPS, or plain HTTP to a loopback
    host, from every SDK client, and never follows a redirect to another origin.
    One function, credentialFetch from the new @sapiom/analytics-core/credential
    subpath, is the only code that sets the key header.

    Behavior changes, shipped as 0.x minor bumps: a plain http:// URL to a
    non-loopback host is now refused, and the key headers are stripped on a
    cross-origin redirect. @sapiom/core and @sapiom/browser-pay gain their
    first runtime dependency, @sapiom/analytics-core.

    • @sapiom/core, @sapiom/agent-core and @sapiom/mcp: a plain http://
      URL to a non-loopback host (for example a Docker service name or a LAN IP)
      now fails before the request is sent. On a trusted private network, opt in
      with new SapiomClient({ allowInsecureHttp: true }) (core),
      createClient({ allowInsecureHttp: true }) (agent-core) or
      SAPIOM_ALLOW_INSECURE_HTTP=1 (all clients). localhost, *.localhost,
      127.0.0.1 and [::1] work as before. Core does not retry a refused channel.
    • @sapiom/analytics-core: on such an endpoint the batch is still sent, without
      the key. A redirect to a refused channel drops the batch.
    • Every client follows redirects itself: the first hop to another origin drops
      x-api-key, x-sapiom-api-key and every x-sapiom-* header.
    • @sapiom/core: getHttpClient().defaults.headers no longer carries the key;
      read defaults.credential instead.
    • @sapiom/browser-pay: the payment relay uses the shared rule, so a
      *.localhost base URL and SAPIOM_ALLOW_INSECURE_HTTP=1 are now accepted, and
      a refused base URL throws a CredentialChannelError. Redirects are still
      refused.
    • @sapiom/tools: no behavior change. A refused call now throws a
      CredentialChannelError, a TypeError subclass that keeps name: "TypeError".

Patch Changes

  • 1b9a5f6: Stop linking docs.sapiom.ai pages that no longer exist. The sapiom-agent-authoring skill and its scaffold copies, the Agent Studio system prompt, help palette and welcome screen, and the @sapiom/agent README drop links to the agent quick start, authoring guide, MCP setup, call-surface, credentials and signals guides. The first-run telemetry notice drops its link to a /telemetry page that never existed. Links to /capabilities pages are unchanged.

@sapiom/browser-pay@0.2.0

Minor Changes

  • b386258: Interceptor event URLs are origin-only, and refusal reasons on events are sanitized. CDP attach errors use fixed messages to avoid forwarding transport details.

  • 8d77192: A refused event may include optional retryable and requestId. When retryable is missing, the event leaves it unset. The SDK does not invent it, and polling still follows only relay_in_progress.

    A reason on that event passes through when it matches /^[a-z]+(_[a-z]+)*$/ and is at most 48 characters, including a reason this package does not list. Every other reason is unrecognized. RefusalReason is that open set. KnownRefusalReason names the reasons the relay emits today.

  • a76b8bd: The tenant API key now only travels over HTTPS, or plain HTTP to a loopback
    host, from every SDK client, and never follows a redirect to another origin.
    One function, credentialFetch from the new @sapiom/analytics-core/credential
    subpath, is the only code that sets the key header.

    Behavior changes, shipped as 0.x minor bumps: a plain http:// URL to a
    non-loopback host is now refused, and the key headers are stripped on a
    cross-origin redirect. @sapiom/core and @sapiom/browser-pay gain their
    first runtime dependency, @sapiom/analytics-core.

    • @sapiom/core, @sapiom/agent-core and @sapiom/mcp: a plain http://
      URL to a non-loopback host (for example a Docker service name or a LAN IP)
      now fails before the request is sent. On a trusted private network, opt in
      with new SapiomClient({ allowInsecureHttp: true }) (core),
      createClient({ allowInsecureHttp: true }) (agent-core) or
      SAPIOM_ALLOW_INSECURE_HTTP=1 (all clients). localhost, *.localhost,
      127.0.0.1 and [::1] work as before. Core does not retry a refused channel.
    • @sapiom/analytics-core: on such an endpoint the batch is still sent, without
      the key. A redirect to a refused channel drops the batch.
    • Every client follows redirects itself: the first hop to another origin drops
      x-api-key, x-sapiom-api-key and every x-sapiom-* header.
    • @sapiom/core: getHttpClient().defaults.headers no longer carries the key;
      read defaults.credential instead.
    • @sapiom/browser-pay: the payment relay uses the shared rule, so a
      *.localhost base URL and SAPIOM_ALLOW_INSECURE_HTTP=1 are now accepted, and
      a refused base URL throws a CredentialChannelError. Redirects are still
      refused.
    • @sapiom/tools: no behavior change. A refused call now throws a
      CredentialChannelError, a TypeError subclass that keeps name: "TypeError".

Patch Changes

  • 150bbd7: Better debug logging for browser-pay: an optional logger now receives browser step failures, and CDP errors name the method.
  • Updated dependencies [1b9a5f6]
  • Updated dependencies [a76b8bd]
    • @sapiom/analytics-core@0.3.0

@sapiom/core@0.6.0

Minor Changes

  • a8068d8: Remove the exported ListTransactionsParams type. No client method accepted it, and its fields did not match GET /v1/transactions: the API paginates with page[limit] / page[after] cursors (no offset), and filter[service] takes a service ID (UUID), not a name. Code that imported the type should drop the import; nothing at runtime changes.

  • a76b8bd: The tenant API key now only travels over HTTPS, or plain HTTP to a loopback
    host, from every SDK client, and never follows a redirect to another origin.
    One function, credentialFetch from the new @sapiom/analytics-core/credential
    subpath, is the only code that sets the key header.

    Behavior changes, shipped as 0.x minor bumps: a plain http:// URL to a
    non-loopback host is now refused, and the key headers are stripped on a
    cross-origin redirect. @sapiom/core and @sapiom/browser-pay gain their
    first runtime dependency, @sapiom/analytics-core.

    • @sapiom/core, @sapiom/agent-core and @sapiom/mcp: a plain http://
      URL to a non-loopback host (for example a Docker service name or a LAN IP)
      now fails before the request is sent. On a trusted private network, opt in
      with new SapiomClient({ allowInsecureHttp: true }) (core),
      createClient({ allowInsecureHttp: true }) (agent-core) or
      SAPIOM_ALLOW_INSECURE_HTTP=1 (all clients). localhost, *.localhost,
      127.0.0.1 and [::1] work as before. Core does not retry a refused channel.
    • @sapiom/analytics-core: on such an endpoint the batch is still sent, without
      the key. A redirect to a refused channel drops the batch.
    • Every client follows redirects itself: the first hop to another origin drops
      x-api-key, x-sapiom-api-key and every x-sapiom-* header.
    • @sapiom/core: getHttpClient().defaults.headers no longer carries the key;
      read defaults.credential instead.
    • @sapiom/browser-pay: the payment relay uses the shared rule, so a
      *.localhost base URL and SAPIOM_ALLOW_INSECURE_HTTP=1 are now accepted, and
      a refused base URL throws a CredentialChannelError. Redirects are still
      refused.
    • @sapiom/tools: no behavior change. A refused call now throws a
      CredentialChannelError, a TypeError subclass that keeps name: "TypeError".

Patch Changes

  • Updated dependencies [1b9a5f6]
  • Updated dependencies [a76b8bd]
    • @sapiom/analytics-core@0.3.0

@sapiom/tools@0.48.0

Minor Changes

  • 89f1829: Coding runs and model runs take an optional connectors list: the slugs of the connections the run may use, sent on the wire as connectors. This is how you decide which agent gets which connection. Leaving it unset is unchanged behavior — the key never reaches the wire and every ready connection attaches. [] attaches none. A slug that isn't a ready connection gets the run refused with HTTP 400 connectors_unavailable. A platform release that predates per-run selection ignores the field and attaches every connection, as before.
  • ec08398: connectors.slack gains history() (Slack conversations.history: a channel's top-level messages, paginated, with oldest / latest bounds) and whoAmI() (Slack auth.test: the bot's own user_id and bot_id, to recognise its own posts). Agents that read a channel no longer need their own Slack bot token.

Patch Changes

  • a76b8bd: The tenant API key now only travels over HTTPS, or plain HTTP to a loopback
    host, from every SDK client, and never follows a redirect to another origin.
    One function, credentialFetch from the new @sapiom/analytics-core/credential
    subpath, is the only code that sets the key header.

    Behavior changes, shipped as 0.x minor bumps: a plain http:// URL to a
    non-loopback host is now refused, and the key headers are stripped on a
    cross-origin redirect. @sapiom/core and @sapiom/browser-pay gain their
    first runtime dependency, @sapiom/analytics-core.

    • @sapiom/core, @sapiom/agent-core and @sapiom/mcp: a plain http://
      URL to a non-loopback host (for example a Docker service name or a LAN IP)
      now fails before the request is sent. On a trusted private network, opt in
      with new SapiomClient({ allowInsecureHttp: true }) (core),
      createClient({ allowInsecureHttp: true }) (agent-core) or
      SAPIOM_ALLOW_INSECURE_HTTP=1 (all clients). localhost, *.localhost,
      127.0.0.1 and [::1] work as before. Core does not retry a refused channel.
    • @sapiom/analytics-core: on such an endpoint the batch is still sent, without
      the key. A redirect to a refused channel drops the batch.
    • Every client follows redirects itself: the first hop to another origin drops
      x-api-key, x-sapiom-api-key and every x-sapiom-* header.
    • @sapiom/core: getHttpClient().defaults.headers no longer carries the key;
      read defaults.credential instead.
    • @sapiom/browser-pay: the payment relay uses the shared rule, so a
      *.localhost base URL and SAPIOM_ALLOW_INSECURE_HTTP=1 are now accepted, and
      a refused base URL throws a CredentialChannelError. Redirects are still
      refused.
    • @sapiom/tools: no behavior change. A refused call now throws a
      CredentialChannelError, a TypeError subclass that keeps name: "TypeError".

  • Updated dependencies [1b9a5f6]

  • Updated dependencies [a76b8bd]

    • @sapiom/analytics-core@0.3.0

@sapiom/agent@0.14.12

Patch Changes

  • 1b9a5f6: Stop linking docs.sapiom.ai pages that no longer exist. The sapiom-agent-authoring skill and its scaffold copies, the Agent Studio system prompt, help palette and welcome screen, and the @sapiom/agent README drop links to the agent quick start, authoring guide, MCP setup, call-surface, credentials and signals guides. The first-run telemetry notice drops its link to a /telemetry page that never existed. Links to /capabilities pages are unchanged.
  • Updated dependencies [89f1829]
  • Updated dependencies [a76b8bd]
  • Updated dependencies [ec08398]
    • @sapiom/tools@0.48.0

@sapiom/agent-studio@0.1.39

Patch Changes

  • Updated dependencies [1b9a5f6]
    • @sapiom/harness@0.22.1

@sapiom/axios@0.5.2

Patch Changes

  • Updated dependencies [a8068d8]
  • Updated dependencies [a76b8bd]
    • @sapiom/core@0.6.0

@sapiom/cli@21.0.1

Patch Changes

  • Updated dependencies [1b9a5f6]
  • Updated dependencies [a76b8bd]
    • @sapiom/agent-core@0.16.0
    • @sapiom/agent@0.14.12
    • @sapiom/harness@0.22.1
    • @sapiom/analytics-core@0.3.0
    • @sapiom/sandbox-preview@0.1.34

@sapiom/fetch@0.5.1

Patch Changes

  • Updated dependencies [a8068d8]
  • Updated dependencies [a76b8bd]
    • @sapiom/core@0.6.0

@sapiom/harness@0.22.1

Patch Changes

  • 1b9a5f6: Stop linking docs.sapiom.ai pages that no longer exist. The sapiom-agent-authoring skill and its scaffold copies, the Agent Studio system prompt, help palette and welcome screen, and the @sapiom/agent README drop links to the agent quick start, authoring guide, MCP setup, call-surface, credentials and signals guides. The first-run telemetry notice drops its link to a /telemetry page that never existed. Links to /capabilities pages are unchanged.
  • Updated dependencies [1b9a5f6]
  • Updated dependencies [085a3c4]
  • Updated dependencies [a76b8bd]
    • @sapiom/agent-core@0.16.0
    • @sapiom/agent@0.14.12
    • @sapiom/analytics-core@0.3.0
    • @sapiom/mcp@0.20.2

@sapiom/mcp@0.20.2

Patch Changes

  • 085a3c4: The schedule tool now says sapiom.* platform events can be subscribed to with an event trigger (never emitted) and points to the server instructions for the list; the bundled primer now documents sapiom.run.failed.

  • a76b8bd: The tenant API key now only travels over HTTPS, or plain HTTP to a loopback
    host, from every SDK client, and never follows a redirect to another origin.
    One function, credentialFetch from the new @sapiom/analytics-core/credential
    subpath, is the only code that sets the key header.

    Behavior changes, shipped as 0.x minor bumps: a plain http:// URL to a
    non-loopback host is now refused, and the key headers are stripped on a
    cross-origin redirect. @sapiom/core and @sapiom/browser-pay gain their
    first runtime dependency, @sapiom/analytics-core.

    • @sapiom/core, @sapiom/agent-core and @sapiom/mcp: a plain http://
      URL to a non-loopback host (for example a Docker service name or a LAN IP)
      now fails before the request is sent. On a trusted private network, opt in
      with new SapiomClient({ allowInsecureHttp: true }) (core),
      createClient({ allowInsecureHttp: true }) (agent-core) or
      SAPIOM_ALLOW_INSECURE_HTTP=1 (all clients). localhost, *.localhost,
      127.0.0.1 and [::1] work as before. Core does not retry a refused channel.
    • @sapiom/analytics-core: on such an endpoint the batch is still sent, without
      the key. A redirect to a refused channel drops the batch.
    • Every client follows redirects itself: the first hop to another origin drops
      x-api-key, x-sapiom-api-key and every x-sapiom-* header.
    • @sapiom/core: getHttpClient().defaults.headers no longer carries the key;
      read defaults.credential instead.
    • @sapiom/browser-pay: the payment relay uses the shared rule, so a
      *.localhost base URL and SAPIOM_ALLOW_INSECURE_HTTP=1 are now accepted, and
      a refused base URL throws a CredentialChannelError. Redirects are still
      refused.
    • @sapiom/tools: no behavior change. A refused call now throws a
      CredentialChannelError, a TypeError subclass that keeps name: "TypeError".

  • Updated dependencies [1b9a5f6]

  • Updated dependencies [a76b8bd]

    • @sapiom/agent-core@0.16.0
    • @sapiom/analytics-core@0.3.0
    • @sapiom/sandbox-preview@0.1.34

@sapiom/node-http@0.4.2

Patch Changes

  • Updated dependencies [a8068d8]
  • Updated dependencies [a76b8bd]
    • @sapiom/core@0.6.0

@sapiom/sandbox@0.8.6

Patch Changes

  • @sapiom/fetch@0.5.1

@sapiom/sandbox-preview@0.1.34

Patch Changes

  • Updated dependencies [89f1829]
  • Updated dependencies [a76b8bd]
  • Updated dependencies [ec08398]
    • @sapiom/tools@0.48.0

@sapiom/langchain@0.5.2

Patch Changes

  • Updated dependencies [a8068d8]
  • Updated dependencies [1b9a5f6]
  • Updated dependencies [a76b8bd]
    • @sapiom/core@0.6.0
    • @sapiom/analytics-core@0.3.0

@sapiom/langchain-classic@0.5.2

Patch Changes

  • Updated dependencies [a8068d8]
  • Updated dependencies [1b9a5f6]
  • Updated dependencies [a76b8bd]
    • @sapiom/core@0.6.0
    • @sapiom/analytics-core@0.3.0

@coderabbitai

coderabbitai Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: de6c22c4-9458-46fa-b92a-c24919578210

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added contribution: incomplete Required pull request information is incomplete or ambiguous contributor: external Pull request author does not have write, maintain, or admin access to sapiom-js review: manual External pull request requires maintainer review before automation review: sensitive Changes affect sensitive repository or release infrastructure size: small Review size is at most 100 changed lines area: sdk Changes to SDK core or analytics labels Oct 20, 2026
devin-ai-integration[bot]
devin-ai-integration Bot reviewed Oct 20, 2026
View reviewed changes

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Devin Review

@github-actions
github-actions Bot force-pushed the changeset-release/main branch 9 times, most recently from 00562a5 to 83151b6 Compare October 27, 2026 19:49
@github-actions
github-actions Bot force-pushed the changeset-release/main branch from 83151b6 to dd0ce07 Compare October 28, 2026 01:19
@BYWallace
BYWallace merged commit adcd3b1 into main Oct 28, 2026
14 checks passed
@BYWallace
BYWallace deleted the changeset-release/main branch October 28, 2026 17:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@devin-ai-integration devin-ai-integration[bot] devin-ai-integration[bot] left review comments
@BYWallace BYWallace BYWallace approved these changes

Assignees

No one assigned

Labels

area: sdk Changes to SDK core or analytics contribution: incomplete Required pull request information is incomplete or ambiguous contributor: external Pull request author does not have write, maintain, or admin access to sapiom-js review: manual External pull request requires maintainer review before automation review: sensitive Changes affect sensitive repository or release infrastructure size: small Review size is at most 100 changed lines

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@BYWallace