@deepraxis/cli 0.1.0-dev.891e403 → 0.1.0-dev.8c50d77

package/COMMANDS.md

@@ -2,7 +2,7 @@
 
 Generated by `bun run commands`. DO NOT EDIT.
 
-422 HTTP operations; 424 commands including aliases.
+426 HTTP operations; 428 commands including aliases.
 
 Environment: `PRAXIS_ENV=develop|production` (dev package defaults to `develop`; stable package defaults to `production`). No `--env` option.
 
@@ -32,6 +32,10 @@ Handwritten commands: `login`, `logout`, `whoami`, `org list`, `org switch <orga
 | `praxis agent computer list` | `agent.computers.list` | GET `/agent/v1/computers` | `--param-limit`, `--page` |
 | `praxis agent computer update <computer_id>` | `agent.computers.update` | POST `/agent/v1/computers/{computer_id}` | `--name` |
 | `praxis agent create` | `agent.agents.create` | POST `/agent/v1/agents` | `--name`, `--description`, `--system`, `--kind`, `--computer-id`, `--subagent-model`, `--avatar`, `--environment-id`, `--vault-ids`, `--preset` |
+| `praxis agent customer auth access-token create` | `agent.agents.customers.auth.accessTokens.create` | POST `/agent/v1/agents/{agent_id}/customers/auth/access_tokens` | `--agent` |
+| `praxis agent customer auth access-token delete-current` | `agent.agents.customers.auth.accessTokens.deleteCurrent` | DELETE `/agent/v1/agents/{agent_id}/customers/auth/access_tokens/current` | `--agent` |
+| `praxis agent customer auth access-token renew create` | `agent.agents.customers.auth.accessTokens.renew.create` | POST `/agent/v1/agents/{agent_id}/customers/auth/access_tokens/renew` | `--agent` |
+| `praxis agent customer auth grant-code create` | `agent.agents.customers.auth.grantCodes.create` | POST `/agent/v1/agents/{agent_id}/customers/auth/grant_codes` | `--agent`, `--customer-id`, `--param-version`, `--budget-cents`, `--origin`, `--expires-in`, `--max-session-seconds`, `--anonymous-access-token` |
 | `praxis agent deployment archive <deployment_id>` | `agent.deployments.archive` | POST `/agent/v1/deployments/{deployment_id}/archive` |  |
 | `praxis agent deployment create` | `agent.deployments.create` | POST `/agent/v1/deployments` | `--environment-id`, `--name`, `--description`, `--vault-ids` |
 | `praxis agent deployment get <deployment_id>` | `agent.deployments.retrieve` | GET `/agent/v1/deployments/{deployment_id}` |  |

package/dist/praxis.js

@@ -68,7 +68,7 @@ var operations = [
     resource: "agent.agents",
     method: "create",
     summary: "Create agent",
-    description: 'Create a reusable agent definition, then pass its returned id to sessions.create to start a conversation. The definition includes model, system prompt, tools, MCP servers and an optional multiagent roster. It is saved as version 1; real updates create new versions. Unlike Anthropic Managed Agents, nonempty skills attachments return 400; the native skill tool is separate from the skills field. Use tools: [{type: "agent_toolset_20260401"}] for built-in tools including codemode, skill and agent; inspect toolsets.list for names and schemas, and keep bash enabled for native additions. To offer only some tools, set default_config: {enabled: false} and list the tools to keep in configs, e.g. tools: [{type: "agent_toolset_20260401", default_config: {enabled: false}, configs: [{name: "codemode", enabled: true}, {name: "bash", enabled: true, permission_policy: {type: "always_ask"}}]}]; every tool not listed, including todo_write, enter_plan_mode, ask_user_question and goal_read, follows default_config, and the response echoes it. codemode runs through bash, so enabling codemode while bash is disabled returns 400. Optional mcp_toolset entries pair with mcp_servers. model accepts platform model IDs such as deepseek-flash, not only the Claude IDs in the protocol examples. model.settings.reasoning sets default thinking; other extra model controls return 400. Example: {"name":"helper","model":{"id":"deepseek-flash"},"tools":[{"type":"agent_toolset_20260401"}]}.',
+    description: 'Create a reusable agent definition, then pass its returned id to sessions.create to start a conversation. The definition includes model, system prompt, tools, MCP servers and an optional multiagent roster. It is saved as version 1; real updates create new versions. Unlike Anthropic Managed Agents, nonempty skills attachments return 400; the native skill tool is separate from the skills field. Use tools: [{type: "agent_toolset_20260401"}] for built-in tools including codemode, skill and agent; inspect toolsets.list for names and schemas, and keep bash enabled for native additions. To offer only some tools, set default_config: {enabled: false} and list the tools to keep in configs, e.g. tools: [{type: "agent_toolset_20260401", default_config: {enabled: false}, configs: [{name: "codemode", enabled: true}, {name: "bash", enabled: true, permission_policy: {type: "always_ask"}}]}]; every tool not listed, including todo_write, enter_plan_mode, ask_user_question and goal_read, follows default_config, and the response echoes it. codemode runs through bash, so enabling codemode while bash is disabled returns 400. Optional mcp_toolset entries pair with mcp_servers. model accepts platform model IDs such as deepseek-flash, not only the Claude IDs in the protocol examples. model.settings.reasoning sets default thinking; other extra model controls return 400. model and every models.allowed entry must be a catalog model that can run an agent: an unknown id returns 400 "model <id> is not in the model catalog" and an embedding, image or speech model returns 400 "model <id> cannot run an agent". name is trimmed and may not be blank or contain NUL or line breaks. avatar is trimmed, must not contain spaces or point at a loopback, private or internal host, and its scheme is stored in lowercase. script and workflow binding ids are stored in lowercase, the form automation matches; bindings together with environment_id null return 400 because bindings need a machine. Example: {"name":"helper","model":{"id":"deepseek-flash"},"tools":[{"type":"agent_toolset_20260401"}]}.',
     http: "POST",
     path: "/agent/v1/agents",
     streaming: "no",
@@ -82,7 +82,7 @@ var operations = [
           name: "model",
           type: "object",
           required: true,
-          description: "Model identifier. Accepts the\n[model string](https://platform.claude.com/docs/en/about-claude/models/overview#latest-models-comparison),\ne.g. `claude-opus-5`, or a `model_config` object for additional configuration\ncontrol"
+          description: "A model id from the Praxis model catalog (`praxis.model.models.list`), or a `model_config` object for additional configuration control. Unlike Anthropic, Claude model ids other than those in the catalog are rejected."
         },
         {
           name: "name",
@@ -141,7 +141,7 @@ across all toolsets allowed.`
           type: "array",
           itemType: "object",
           required: false,
-          description: "Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file_..., read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. A resource that is not bound returns 404, a service that is not opened returns 403, and writes to read_only resources are refused. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings."
+          description: "Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings."
         },
         {
           name: "kind",
@@ -292,7 +292,7 @@ to 64 chars each) with values up to 512 chars.`
           name: "model",
           type: "object",
           required: false,
-          description: "Model identifier. Accepts the\n[model string](https://platform.claude.com/docs/en/about-claude/models/overview#latest-models-comparison),\ne.g. `claude-opus-5`, or a `model_config` object for additional configuration\ncontrol. Omit to preserve. Cannot be cleared."
+          description: "A model id from the Praxis model catalog (`praxis.model.models.list`), or a `model_config` object for additional configuration control. Unlike Anthropic, Claude model ids other than those in the catalog are rejected."
         },
         {
           name: "multiagent",
@@ -355,7 +355,7 @@ current version; omit to apply the update unconditionally.`
           type: "array",
           itemType: "object",
           required: false,
-          description: "Replace the whole bindings list; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept a nonempty list."
+          description: "Replace the whole bindings list; omission preserves it, and null or [] clears it. Additions apply only to new sessions; once this version is applied, disabling, removing or downgrading a binding revokes it immediately in running sessions on older versions, while apply=false changes no access. Only service agents accept a nonempty list."
         },
         {
           name: "kind",
@@ -455,6 +455,152 @@ current version; omit to apply the update unconditionally.`
     ],
     query: []
   },
+  {
+    resource: "agent.agents.customers.auth.accessTokens",
+    method: "create",
+    summary: "Create customer access token",
+    description: `Exchange a grant code, or the agent's publishable key for an anonymous visitor, for a customer access token that authorizes the agent's embedded sessions.
+
+No Authorization header is required: the grant code or the publishable key is the credential. Agent Kit calls this from the browser, so send the page Origin. With grant_code, the code is consumed atomically: concurrent attempts have exactly one winner, and unknown, used, expired and other-agent codes all return the same 401 GRANT_CODE_INVALID. The sign-in starts now and lasts the code's max_session_seconds. Unlike Shopify, a visitor without an account gets a token too: send publishable_key instead and a new anonymous customer (anon_…) is created, bound to the request Origin, for 7 days. The access token lasts at most two hours and never outlives the sign-in; renew it with access_tokens/renew before expires_at. Both forms share the per-IP minute limit of anonymous issuance (default 20). Example body: {"grant_code":"cgc_…"}.`,
+    http: "POST",
+    path: "/agent/v1/agents/{agent_id}/customers/auth/access_tokens",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      }
+    ],
+    query: [],
+    body: {
+      required: true,
+      fields: []
+    }
+  },
+  {
+    resource: "agent.agents.customers.auth.accessTokens",
+    method: "deleteCurrent",
+    summary: "Log out customer",
+    description: `Log the customer out by revoking the sign-in of the presented access token and every token issued in it.
+
+Send the current customer access token as the Bearer credential, with no body, when the customer logs out of your site. Every token of the sign-in, including renewed ones, stops working, and their live event streams close; the customer's conversations are kept. Returns 204. Calling it again with the same token returns 401 ACCESS_TOKEN_REVOKED, so treat that as already logged out.`,
+    http: "DELETE",
+    path: "/agent/v1/agents/{agent_id}/customers/auth/access_tokens/current",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.agents.customers.auth.accessTokens.renew",
+    method: "create",
+    summary: "Renew customer access token",
+    description: `Get a fresh customer access token in the same sign-in, authenticated with the current one.
+
+Send the current customer access token as the Bearer credential, with no body, a few minutes before expires_at. The new token keeps the version, budget, context, metadata and origin binding of the sign-in and lasts at most two hours, never past session_expires_at. Unlike Shopify, renewal does not revoke the presented token: it stays valid until its own expiry, so a reply that is streaming on it is not cut off. When less than 60 seconds of the sign-in remain, renewal returns 401 CUSTOMER_SESSION_EXPIRED; sign the customer in again with a new grant code from your backend. A token that was logged out or merged returns 401 ACCESS_TOKEN_REVOKED.`,
+    http: "POST",
+    path: "/agent/v1/agents/{agent_id}/customers/auth/access_tokens/renew",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.agents.customers.auth.grantCodes",
+    method: "create",
+    summary: "Create customer grant code",
+    description: `Sign your logged-in customer in to a service agent from your backend with a one-time grant code that Agent Kit exchanges for a customer access token.
+
+Call this from your backend with your API key after your own login succeeds, then pass the returned code to Agent Kit in the browser; never call it from the browser. Customer authorization follows Shopify Storefront customer access tokens (Multipass-style sign-in, a short-lived token, renewal and logout), so that experience applies. customer_id is your own identifier for the customer: use an opaque id such as your database user id, not an email address or phone number. The value auth is reserved, and ids starting with anon_ are reserved for anonymous customers. The code works once and expires after expires_in seconds (default 900). The sign-in it starts lasts max_session_seconds (default 7 days); version, budget_cents, system_message, agent_override and metadata apply to every token of the sign-in. Unlike Shopify, origin binds the whole sign-in to one page origin, and anonymous_access_token merges the conversations of the anonymous visitor who chatted before signing in into this customer. Example body: {"customer_id":"cus_8f2a91","origin":"https://shop.example.com"}.`,
+    http: "POST",
+    path: "/agent/v1/agents/{agent_id}/customers/auth/grant_codes",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      }
+    ],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "customer_id",
+          type: "string",
+          required: true,
+          description: 'Your stable, opaque identifier for the signed-in customer, such as your database user id. Do not use an email address or phone number. "auth" is reserved, and ids starting with anon_ are reserved for anonymous customers.'
+        },
+        {
+          name: "version",
+          type: "integer",
+          required: false,
+          description: "Existing agent version that every token of this sign-in pins. Defaults to the agent's active_version when the code is issued."
+        },
+        {
+          name: "budget_cents",
+          type: "integer",
+          required: false,
+          description: "Budget in cents for each session the customer starts. Defaults to the embed policy session budget and cannot exceed its maximum."
+        },
+        {
+          name: "system_message",
+          type: "array",
+          itemType: "object",
+          required: false,
+          description: "Optional context the agent receives at the start of each session, as text blocks, limited to 8192 UTF-8 bytes in total."
+        },
+        {
+          name: "agent_override",
+          type: "object",
+          required: false,
+          description: "Optional system prompt override, accepted only when the embed policy allows agent overrides."
+        },
+        {
+          name: "metadata",
+          type: "object",
+          required: false,
+          description: "Up to 16 string pairs copied onto every session the customer starts. The playground key is reserved."
+        },
+        {
+          name: "origin",
+          type: "string",
+          required: false,
+          description: "Page origin, such as https://shop.example.com, that must be one of the agent policy's allowed_origins (or localhost when the policy allows it). When set, every token of this sign-in works only from exactly this origin. Omit to accept any policy origin."
+        },
+        {
+          name: "expires_in",
+          type: "integer",
+          required: false,
+          description: "Seconds the code stays redeemable, from 60 to 86400. Defaults to 900."
+        },
+        {
+          name: "max_session_seconds",
+          type: "integer",
+          required: false,
+          description: "Total lifetime of the sign-in in seconds, from 3600 to 604800 (7 days). Tokens renew within it; after it the customer signs in again. Defaults to 604800."
+        },
+        {
+          name: "anonymous_access_token",
+          type: "string",
+          required: false,
+          description: "The current access token of the anonymous customer who used this agent before signing in. Their conversations become visible to the identified customer, and the anonymous sign-in ends at exchange."
+        }
+      ]
+    }
+  },
   {
     resource: "agent.agents.endUsers",
     method: "list",
@@ -1690,7 +1836,7 @@ Use an id from issuance or listing. Revokes the credential before setting revoke
     resource: "agent.environments",
     method: "create",
     summary: "Create environment",
-    description: "Create a tenant-owned cloud environment: a sandbox recipe (packages to install and networking policy) that sessions can select through environment_id. Package installation happens when the session's sandbox is created; a failed install terminates that session with ENVIRONMENT_PACKAGE_INSTALL_FAILED. Limited networking is applied at sandbox creation. Unlike Anthropic Managed Agents, self_hosted environments, scope and cross-session package caching are not supported.",
+    description: "Create a tenant-owned cloud environment: a sandbox recipe (packages to install and networking policy) that sessions can select through environment_id. Package installation happens when the session's sandbox is created; a failed install terminates that session with ENVIRONMENT_PACKAGE_INSTALL_FAILED. Limited networking is applied at sandbox creation. Unlike Anthropic Managed Agents, self_hosted environments, scope and cross-session package caching are not supported. config.template must name an available sandbox template, otherwise 400 lists the available ones.",
     http: "POST",
     path: "/agent/v1/environments",
     streaming: "no",
@@ -1761,7 +1907,7 @@ rejected. If not specified, defaults based on organization type.`
     resource: "agent.environments",
     method: "update",
     summary: "Update environment",
-    description: "Update the configuration of a tenant-owned cloud environment. Built-in environments are read-only. Package installation and limited networking are applied when a session's sandbox is created. Omitted fields keep their value.",
+    description: "Update the configuration of a tenant-owned cloud environment. Built-in environments are read-only. Package installation and limited networking are applied when a session's sandbox is created. Omitted fields keep their value. A changed config.template must name an available sandbox template, otherwise 400 lists the available ones.",
     http: "POST",
     path: "/agent/v1/environments/{environment_id}",
     streaming: "no",
@@ -1820,7 +1966,7 @@ owning account only.`
     resource: "agent.environments",
     method: "archive",
     summary: "Archive environment",
-    description: "Soft-archive a tenant-owned cloud environment so it can no longer be used to create new sessions. Built-in environments are read-only and cannot be archived.",
+    description: "Soft-archive a tenant-owned cloud environment so it can no longer be used to create new sessions. Built-in environments are read-only and cannot be archived. An environment that the active version of a non-archived agent uses as environment_id returns 409 RESOURCE_IN_USE naming the agents; point them at another environment first.",
     http: "POST",
     path: "/agent/v1/environments/{environment_id}/archive",
     streaming: "no",
@@ -2915,7 +3061,7 @@ If provided, only skills from the specified source will be returned:
     resource: "agent.skills",
     method: "create",
     summary: "Create skill",
-    description: "Upload a skill: a directory that contains SKILL.md, which the agent reads when it needs the skill. Send multipart/form-data with one files part per file, each file name being its path under one top-level directory (pdf/SKILL.md, pdf/scripts/run.py), and an optional display_name. SKILL.md frontmatter needs a description; name defaults to the directory name. Limits: 8 MB in total, at most 200 files, no .. segments, absolute paths or empty names; a violation returns 400 naming the path or field. The upload creates the skill and its first version, and versions are immutable. Attach the skill to an agent with `skills` on the agent.",
+    description: 'Upload a skill: a directory that contains SKILL.md, which the agent reads when it needs the skill. Send multipart/form-data with one files part per file, each file name being its path under one top-level directory (pdf/SKILL.md, pdf/scripts/run.py), and an optional display_name. SKILL.md frontmatter needs a description; name defaults to the directory name and must be one folder name (1-255 characters, no "/", backslash or NUL, not "." or ".."), otherwise the upload returns 400 stating the allowed form. Limits: 8 MB in total, at most 200 files, no .. segments, absolute paths or empty names; a violation returns 400 naming the path or field. The upload creates the skill and its first version, and versions are immutable. Attach the skill to an agent with `skills` on the agent.',
     http: "POST",
     path: "/agent/v1/skills",
     streaming: "no",
@@ -2949,7 +3095,7 @@ file at the root of that directory.`
     resource: "agent.skills",
     method: "delete",
     summary: "Delete skill",
-    description: "Delete a skill that has no live versions. A skill that still has versions returns 409 Delete all versions first; remove each with skills.versions.delete, then call this. Returns {id, type: skill_deleted}. skill_id comes from skills.create or skills.list.",
+    description: "Delete a skill that has no live versions. A skill that is still attached to an agent returns 409 RESOURCE_IN_USE naming up to 10 agent ids (the active or latest version of a non-archived agent counts); remove it from those agents first. A skill that still has versions returns 409 Delete all versions first; remove each with skills.versions.delete, then call this. Returns {id, type: skill_deleted}. skill_id comes from skills.create or skills.list.",
     http: "DELETE",
     path: "/agent/v1/skills/{skill_id}",
     streaming: "no",
@@ -3046,7 +3192,7 @@ file at the root of that directory.`
     resource: "agent.skills.versions",
     method: "delete",
     summary: "Delete skill version",
-    description: "Soft-delete one version of a skill so it can no longer be read or downloaded; latest_version_id of the skill falls back to the newest remaining version. Returns {id, type: skill_version_deleted}. A skill can be deleted only after all of its versions are deleted.",
+    description: "Soft-delete one version of a skill so it can no longer be read or downloaded; latest_version_id of the skill falls back to the newest remaining version. Returns {id, type: skill_version_deleted}. A skill can be deleted only after all of its versions are deleted. A version that a non-archived agent pins, or the last version of a skill an agent attaches without a pin, returns 409 RESOURCE_IN_USE naming the agents.",
     http: "DELETE",
     path: "/agent/v1/skills/{skill_id}/versions/{version}",
     streaming: "no",
@@ -17817,6 +17963,57 @@ var unblockEndUser = (options) => (options.client ?? client).post({
   url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/unblock",
   ...options
 });
+var createCustomerGrantCode = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/customers/auth/grant_codes",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var createCustomerAccessToken = (options) => (options.client ?? client).post({
+  url: "/agent/v1/agents/{agent_id}/customers/auth/access_tokens",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var renewCustomerAccessToken = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/customers/auth/access_tokens/renew",
+  ...options
+});
+var deleteCurrentCustomerAccessToken = (options) => (options.client ?? client).delete({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/customers/auth/access_tokens/current",
+  ...options
+});
 var exchangeEmbedCode = (options) => (options.client ?? client).post({
   url: "/agent/v1/embed/exchange",
   ...options,
@@ -23533,6 +23730,20 @@ function createAgent(transport) {
     agents: {
       archive: bind(transport, agentsArchive),
       create: bind(transport, agentsCreate),
+      customers: {
+        auth: {
+          accessTokens: {
+            create: bind(transport, createCustomerAccessToken),
+            deleteCurrent: bind(transport, deleteCurrentCustomerAccessToken),
+            renew: {
+              create: bind(transport, renewCustomerAccessToken)
+            }
+          },
+          grantCodes: {
+            create: bind(transport, createCustomerGrantCode)
+          }
+        }
+      },
       endUsers: {
         block: {
           create: bind(transport, blockEndUser)
@@ -26377,7 +26588,7 @@ function startProgress(ctx, write = (text) => writeOutput({ stderr: text })) {
 }
 
 // src/main.ts
-var version = "0.1.0-dev.891e403";
+var version = "0.1.0-dev.8c50d77";
 var commands = commandTree(operations);
 var manual = [["login"], ["logout"], ["whoami"], ["org", "list"], ["org", "switch"], ["api"], ["skill"]];
 function route(argv) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepraxis/cli",
-  "version": "0.1.0-dev.891e403",
+  "version": "0.1.0-dev.8c50d77",
   "type": "module",
   "bin": {
     "praxis": "dist/praxis.js"