@kindgi/client 0.1.4 → 0.1.5-rc.0

package/dist/index.js

@@ -47,6 +47,8 @@ function classify(body, status) {
     case "auth-revoked":
       return { code: "auth", message, reason: "unauthenticated" };
     case "permission-denied":
+    case "role-exceeds-principal":
+    case "key-project-mismatch":
       return { code: "auth", message, reason: "forbidden" };
     case "rate-limited":
     case "rate-limit-exceeded":
@@ -75,11 +77,15 @@ function classify(body, status) {
     case "token-not-found":
     case "agent-version-not-found":
     case "promotion-not-found":
+    case "principal-not-found":
+    case "service-account-not-found":
       return notFound(code, message, details);
     case "conflict":
     case "already-terminal":
     case "run-already-terminal":
     case "idempotency-key-body-mismatch":
+    case "idempotency-key-in-flight":
+    case "idempotency-key-replay-withheld":
     case "hitl-required":
     case "agent-already-registered":
     case "tool-already-registered":
@@ -111,8 +117,18 @@ function classify(body, status) {
     case "gate-policy-scope-changed":
     case "gate-policy-scope-unpinned":
     case "gate-policy-needs-pin":
+    case "fact-changed":
+    case "legal-hold":
+    case "erasure-in-progress":
     case "gate-policy-descendant-unpinned":
-      return { code: "conflict", message, reason: code };
+    case "service-account-name-taken":
+    case "service-account-unregistered":
+    case "identity-user-email-taken":
+    case "last-tenant-admin":
+    case "seed-user-admin":
+    case "identity-user-unregister-refused":
+    case "identity-user-unregistered":
+      return conflict(code, message, details);
     case "invalid-request":
     case "validation-failed":
     case "unknown-field":
@@ -126,8 +142,11 @@ function classify(body, status) {
     case "unknown-effect":
     case "invalid-guardrail":
     case "invalid-provider":
+    case "guardrail-config-invalid":
+    case "provider-config-invalid":
     case "supervisor-header-missing":
     case "scope-invalid":
+    case "artifact-too-large":
       return invalidRequest(message, obj, details);
     case "guardrail-violation":
       return {
@@ -140,13 +159,24 @@ function classify(body, status) {
       return byStatus(status, code, message, obj, details);
   }
 }
+function conflict(code, message, details) {
+  return {
+    code: "conflict",
+    message,
+    reason: code,
+    ...details !== void 0 ? { fields: details } : {}
+  };
+}
 function byStatus(status, code, message, obj, details) {
   switch (status) {
     case 404:
     case 410:
       return notFound(code, message, details);
     case 400:
+    case 413:
       return invalidRequest(message, obj, details);
+    case 409:
+      return conflict(code, message, details);
     case 401:
       return { code: "auth", message, reason: "unauthenticated" };
     case 403:
@@ -210,10 +240,10 @@ function readStringField(obj, ...keys) {
 function asRecord(value) {
   return value !== null && typeof value === "object" ? value : void 0;
 }
-function readGuardrailViolations(raw) {
-  if (!Array.isArray(raw)) return [];
+function readGuardrailViolations(raw2) {
+  if (!Array.isArray(raw2)) return [];
   const out = [];
-  for (const entry of raw) {
+  for (const entry of raw2) {
     const v = asRecord(entry);
     if (v === void 0 || typeof v.guardrailId !== "string") continue;
     const reason = asRecord(v.result)?.reason;
@@ -226,10 +256,10 @@ function readGuardrailViolations(raw) {
   }
   return out;
 }
-function readEvaluationErrors(raw) {
-  if (!Array.isArray(raw)) return [];
+function readEvaluationErrors(raw2) {
+  if (!Array.isArray(raw2)) return [];
   const out = [];
-  for (const entry of raw) {
+  for (const entry of raw2) {
     const e = asRecord(entry);
     if (e === void 0 || typeof e.guardrailId !== "string") continue;
     out.push({
@@ -330,9 +360,9 @@ async function* parseSseStream(body) {
         newlineIdx = buffer.indexOf("\n");
         if (line === "") {
           if (dataLines.length > 0) {
-            const raw = dataLines.join("\n");
+            const raw2 = dataLines.join("\n");
             try {
-              const data = JSON.parse(raw);
+              const data = JSON.parse(raw2);
               yield { event: eventName, data, ...eventId !== void 0 ? { id: eventId } : {} };
             } catch {
             }
@@ -470,12 +500,12 @@ function makeAdaptersClient(transport) {
 
 // src/resources/agents.ts
 function makeAgentsClient(transport) {
-  const seg = (s) => encodeURIComponent(s);
+  const seg2 = (s) => encodeURIComponent(s);
   const versions = {
     async list(agentId, filter) {
       return transport.request({
         method: "GET",
-        path: `/v1/agents/${seg(agentId)}/versions`,
+        path: `/v1/agents/${seg2(agentId)}/versions`,
         query: {
           ...filter?.limit !== void 0 && { limit: filter.limit },
           ...filter?.cursor !== void 0 && { cursor: filter.cursor }
@@ -485,13 +515,13 @@ function makeAgentsClient(transport) {
     async get(agentId, version) {
       return transport.request({
         method: "GET",
-        path: `/v1/agents/${seg(agentId)}/versions/${seg(version)}`
+        path: `/v1/agents/${seg2(agentId)}/versions/${seg2(version)}`
       });
     },
     async unregister(agentId, version, options) {
       return transport.request({
         method: "POST",
-        path: `/v1/agents/${seg(agentId)}/versions/${seg(version)}/unregister`,
+        path: `/v1/agents/${seg2(agentId)}/versions/${seg2(version)}/unregister`,
         ...options?.idempotencyKey !== void 0 && {
           idempotencyKey: options.idempotencyKey
         }
@@ -500,7 +530,7 @@ function makeAgentsClient(transport) {
     async derive(agentId, input, options) {
       return transport.request({
         method: "POST",
-        path: `/v1/agents/${seg(agentId)}/versions`,
+        path: `/v1/agents/${seg2(agentId)}/versions`,
         body: input,
         ...options?.idempotencyKey !== void 0 && {
           idempotencyKey: options.idempotencyKey
@@ -510,7 +540,7 @@ function makeAgentsClient(transport) {
     async reinstate(agentId, version, options) {
       const wire = await transport.request({
         method: "POST",
-        path: `/v1/agents/${seg(agentId)}/versions/${seg(version)}/reinstate`,
+        path: `/v1/agents/${seg2(agentId)}/versions/${seg2(version)}/reinstate`,
         ...options?.idempotencyKey !== void 0 && {
           idempotencyKey: options.idempotencyKey
         }
@@ -548,7 +578,7 @@ function makeAgentsClient(transport) {
     async get(agentId) {
       return transport.request({
         method: "GET",
-        path: `/v1/agents/${seg(agentId)}`
+        path: `/v1/agents/${seg2(agentId)}`
       });
     },
     versions,
@@ -557,7 +587,7 @@ function makeAgentsClient(transport) {
       async resolve(agentId, where) {
         return transport.request({
           method: "GET",
-          path: `/v1/agents/${seg(agentId)}/live`,
+          path: `/v1/agents/${seg2(agentId)}/live`,
           query: {
             ...where?.projectId !== void 0 && { projectId: where.projectId },
             ...where?.segments !== void 0 && { segment: where.segments.map(segmentParam) }
@@ -567,13 +597,13 @@ function makeAgentsClient(transport) {
       async list(agentId) {
         return transport.request({
           method: "GET",
-          path: `/v1/agents/${seg(agentId)}/live-versions`
+          path: `/v1/agents/${seg2(agentId)}/live-versions`
         });
       },
       async rollback(agentId, input, options) {
         return transport.request({
           method: "POST",
-          path: `/v1/agents/${seg(agentId)}/live/rollback`,
+          path: `/v1/agents/${seg2(agentId)}/live/rollback`,
           body: input,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
@@ -581,7 +611,7 @@ function makeAgentsClient(transport) {
       async unpin(agentId, input, options) {
         return transport.request({
           method: "POST",
-          path: `/v1/agents/${seg(agentId)}/live/unpin`,
+          path: `/v1/agents/${seg2(agentId)}/live/unpin`,
           body: input,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
@@ -591,7 +621,7 @@ function makeAgentsClient(transport) {
       async create(agentId, input, options) {
         return transport.request({
           method: "POST",
-          path: `/v1/agents/${seg(agentId)}/promotions`,
+          path: `/v1/agents/${seg2(agentId)}/promotions`,
           body: input,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
@@ -599,14 +629,14 @@ function makeAgentsClient(transport) {
       async check(agentId, input) {
         return transport.request({
           method: "POST",
-          path: `/v1/agents/${seg(agentId)}/promotions/check`,
+          path: `/v1/agents/${seg2(agentId)}/promotions/check`,
           body: input
         });
       },
       async list(agentId, filter) {
         return transport.request({
           method: "GET",
-          path: `/v1/agents/${seg(agentId)}/promotions`,
+          path: `/v1/agents/${seg2(agentId)}/promotions`,
           query: {
             ...filter?.scope !== void 0 && scopeQuery(filter.scope),
             ...filter?.limit !== void 0 && { limit: filter.limit },
@@ -617,7 +647,7 @@ function makeAgentsClient(transport) {
       async get(agentId, promotionId) {
         return transport.request({
           method: "GET",
-          path: `/v1/agents/${seg(agentId)}/promotions/${seg(promotionId)}`
+          path: `/v1/agents/${seg2(agentId)}/promotions/${seg2(promotionId)}`
         });
       }
     },
@@ -625,7 +655,7 @@ function makeAgentsClient(transport) {
       async resolve(agentId, scope) {
         return transport.request({
           method: "GET",
-          path: `/v1/agents/${seg(agentId)}/gate-policy`,
+          path: `/v1/agents/${seg2(agentId)}/gate-policy`,
           query: scopeQuery(scope)
         });
       }
@@ -680,6 +710,106 @@ function singleStatusQuery(method, status) {
   throw new KindgiApiError(error);
 }
 
+// src/verify-export.ts
+var ALGORITHMS = {
+  ed25519: { key: { name: "Ed25519" }, verify: { name: "Ed25519" } },
+  "ecdsa-p256-sha256": {
+    key: { name: "ECDSA", namedCurve: "P-256" },
+    verify: { name: "ECDSA", hash: "SHA-256" }
+  }
+};
+var SIGNED_EXPORT_ALGORITHMS = Object.keys(
+  ALGORITHMS
+);
+async function verifySignedExport(envelope, options = {}) {
+  const issues = [];
+  const checkedAgainst = options.trustedKeys !== void 0 ? "trusted-keys" : "its-own-key";
+  const fail = () => ({
+    valid: false,
+    issues,
+    checkedAgainst,
+    signingKeyId: envelope.signingKeyId
+  });
+  const algorithm = Object.hasOwn(ALGORITHMS, envelope.algorithm) ? ALGORITHMS[envelope.algorithm] : void 0;
+  if (algorithm === void 0) {
+    issues.push(
+      `algorithm "${envelope.algorithm}" isn't one this verifier knows (${SIGNED_EXPORT_ALGORITHMS.join(", ")}): a newer verifier may check it`
+    );
+  }
+  if (envelope.canonicalization !== "sorted-key-json") {
+    issues.push(`canonicalization "${envelope.canonicalization}" isn't sorted-key-json`);
+  }
+  if (options.trustedKeys !== void 0 && !options.trustedKeys.some((pem) => samePem(pem, envelope.publicKey))) {
+    issues.push(`it was signed with key "${envelope.signingKeyId}", which isn't one you trust`);
+  }
+  if (issues.length > 0 || algorithm === void 0) return fail();
+  let bytes;
+  let signed;
+  try {
+    bytes = fromBase64(envelope.bundle);
+    const key = await crypto.subtle.importKey(
+      "spki",
+      toArrayBuffer(fromPem(envelope.publicKey)),
+      algorithm.key,
+      false,
+      ["verify"]
+    );
+    signed = await crypto.subtle.verify(
+      algorithm.verify,
+      key,
+      toArrayBuffer(fromBase64(envelope.signature)),
+      toArrayBuffer(bytes)
+    );
+  } catch (cause) {
+    issues.push(`it can't be checked: ${cause instanceof Error ? cause.message : String(cause)}`);
+    return fail();
+  }
+  if (!signed) {
+    issues.push(
+      "the signature doesn't match the bundle: it was changed, or signed with another key"
+    );
+    return fail();
+  }
+  const body = JSON.parse(new TextDecoder().decode(bytes));
+  const notes = [];
+  if (body.exportedAt !== void 0 && body.exportedAt !== envelope.exportedAt) {
+    if (!madeByKindgi014(envelope, body)) {
+      issues.push(
+        `the envelope's exportedAt (${envelope.exportedAt}) isn't the signed one (${String(body.exportedAt)})`
+      );
+      return fail();
+    }
+    notes.push(
+      `made by Kindgi 0.1.4, which stamped the envelope's exportedAt separately: the signed export time is ${String(body.exportedAt)} (the envelope says ${envelope.exportedAt})`
+    );
+  }
+  return {
+    valid: true,
+    checkedAgainst,
+    body,
+    signingKeyId: envelope.signingKeyId,
+    ...notes.length > 0 && { notes }
+  };
+}
+function madeByKindgi014(envelope, body) {
+  return envelope.bundleSchemaVersion === 1 && body.bundleVersion === 1 && body.bundleSchemaVersion === void 0;
+}
+function samePem(a, b) {
+  return a.replace(/\s+/g, "") === b.replace(/\s+/g, "");
+}
+function fromPem(pem) {
+  return fromBase64(pem.replace(/-----(BEGIN|END) [A-Z ]+-----/g, "").replace(/\s+/g, ""));
+}
+function fromBase64(b64) {
+  const binary = atob(b64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function toArrayBuffer(bytes) {
+  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+
 // src/resources/approvals.ts
 function makeApprovalsClient(transport) {
   return {
@@ -801,7 +931,7 @@ function makeApprovalsClient(transport) {
           method: "POST",
           path: `/v1/approvals/${encodeURIComponent(input.approvalId)}/audit-bundle`,
           body: {
-            signingKeyId: input.signingKeyId,
+            ...input.signingKeyId !== void 0 && { signingKeyId: input.signingKeyId },
             ...input.includeMessages !== void 0 && {
               includeMessages: input.includeMessages
             }
@@ -825,26 +955,231 @@ function makeApprovalsClient(transport) {
           )
         );
       },
-      async verify(_bundle, _publicKey) {
-        throw new KindgiApiError(
-          notYetWired(
-            "approvals.audit.verify",
-            "client-side verifier requires the crypto module reachability from the SDK bundle \u2014 not yet vendored (same constraint as provenance.verify + webhooks.verify)"
-          )
-        );
+      async verify(bundle, publicKey) {
+        const checked = await verifySignedExport(bundle, { trustedKeys: [publicKey] });
+        return checked.valid ? { valid: true } : { valid: false, issues: checked.issues ?? [] };
+      }
+    }
+  };
+}
+
+// src/transport.ts
+var DEFAULT_TIMEOUT_MS = 3e4;
+var MUTATING = /* @__PURE__ */ new Set([
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE"
+]);
+function createTransport(options) {
+  const apiUrl = options.apiUrl.replace(/\/+$/u, "");
+  const fetchImpl = options.fetch ?? fetch;
+  const clientTimeoutMs = checkedTimeoutMs(
+    options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+    "ClientOptions.timeoutMs"
+  );
+  return {
+    apiUrl,
+    fetchImpl,
+    authHeaders() {
+      return { Authorization: `Bearer ${authTokenFor(options.auth)}` };
+    },
+    async request(input) {
+      const url = buildUrl(apiUrl, input.path, input.query);
+      const headers = buildHeaders(input, options.auth);
+      const timeoutMs = input.timeoutMs === void 0 ? clientTimeoutMs : checkedTimeoutMs(input.timeoutMs, "timeoutMs");
+      const ac = new AbortController();
+      let timedOut = false;
+      const timer = setTimeout(() => {
+        timedOut = true;
+        ac.abort(new Error("timeout"));
+      }, timeoutMs);
+      let response;
+      try {
+        response = await fetchImpl(url, {
+          method: input.method,
+          headers,
+          ...input.body !== void 0 && { body: JSON.stringify(input.body) },
+          signal: ac.signal
+        });
+      } catch (cause) {
+        clearTimeout(timer);
+        const err = timedOut ? {
+          code: "network",
+          message: `No answer within ${seconds(timeoutMs)}, the client's timeout (timeoutMs).`,
+          cause,
+          timeoutMs
+        } : {
+          code: "network",
+          message: cause instanceof Error ? cause.message : "network request failed",
+          cause
+        };
+        throw new KindgiApiError(err);
+      }
+      clearTimeout(timer);
+      if (response.ok) {
+        if (input.discardResponse === true || response.status === 204) {
+          try {
+            await response.arrayBuffer();
+          } catch {
+          }
+          return void 0;
+        }
+        try {
+          return await response.json();
+        } catch (cause) {
+          const err = {
+            code: "network",
+            message: "Response body was not valid JSON",
+            cause
+          };
+          throw new KindgiApiError(err);
+        }
       }
+      let body;
+      try {
+        body = await response.json();
+      } catch {
+        body = void 0;
+      }
+      throw new KindgiApiError(
+        fromWire(unwrapErrorEnvelope(body, response.status), response.status)
+      );
     }
   };
 }
+function checkedTimeoutMs(value, name) {
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new TypeError(`${name} must be a positive number of milliseconds. Got ${String(value)}.`);
+  }
+  return value;
+}
+function seconds(ms) {
+  return `${ms / 1e3} s`;
+}
+function buildUrl(apiUrl, path, query) {
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  const base = `${apiUrl}${normalizedPath}`;
+  if (query === void 0) return base;
+  const params = [];
+  for (const key of Object.keys(query)) {
+    const value = query[key];
+    if (value === void 0) continue;
+    const values = typeof value === "object" ? value : [String(value)];
+    for (const v of values) params.push(`${encodeURIComponent(key)}=${encodeURIComponent(v)}`);
+  }
+  return params.length === 0 ? base : `${base}?${params.join("&")}`;
+}
+function buildHeaders(input, auth) {
+  const headers = {
+    Accept: "application/json",
+    Authorization: `Bearer ${authTokenFor(auth)}`
+  };
+  if (input.body !== void 0) {
+    headers["Content-Type"] = "application/json; charset=utf-8";
+  }
+  if (input.idempotencyKey !== void 0 && MUTATING.has(input.method)) {
+    headers["Idempotency-Key"] = input.idempotencyKey;
+  }
+  if (input.headers !== void 0) {
+    for (const key of Object.keys(input.headers)) {
+      headers[key] = input.headers[key];
+    }
+  }
+  return headers;
+}
+function authTokenFor(auth) {
+  if (auth.kind === "apiToken") return auth.token;
+  return auth.accessToken;
+}
+function unwrapErrorEnvelope(body, status) {
+  if (body !== null && typeof body === "object" && !Array.isArray(body)) {
+    const inner = body.error;
+    if (inner !== null && typeof inner === "object" && !Array.isArray(inner)) {
+      return inner;
+    }
+  }
+  return { code: "unknown", message: `HTTP ${status} without recognizable error envelope` };
+}
 
 // src/resources/artifacts.ts
+async function raw(transport, req) {
+  const res = await transport.fetchImpl(`${transport.apiUrl}${req.path}`, {
+    method: req.method,
+    headers: { ...transport.authHeaders(), ...req.headers ?? {} },
+    ...req.body !== void 0 && { body: req.body }
+  });
+  if (!res.ok) {
+    const body = req.method === "HEAD" ? {
+      error: {
+        code: res.status === 404 ? "blob-not-found" : "unknown",
+        message: res.status === 404 ? "No such artifact, or it's in a project you can't read" : `HTTP ${res.status}`
+      }
+    } : await res.json().catch(() => null);
+    throw new KindgiApiError(fromWire(unwrapErrorEnvelope(body, res.status), res.status));
+  }
+  return res;
+}
+function headOf(blobId, res) {
+  const name = res.headers.get("X-Kindgi-Blob-Name");
+  return {
+    blobId,
+    name: name !== null ? decodeURIComponent(name) : "",
+    contentType: res.headers.get("Content-Type") ?? "application/octet-stream",
+    size: Number(res.headers.get("Content-Length") ?? "0"),
+    hash: res.headers.get("X-Kindgi-Blob-Hash") ?? ""
+  };
+}
+function uploadForm(input) {
+  const contentType = input.contentType ?? (input.body instanceof Blob && input.body.type !== "" ? input.body.type : "application/octet-stream");
+  const blob = input.body instanceof Blob ? input.body : new Blob([input.body], {
+    type: contentType
+  });
+  const form = new FormData();
+  form.set("file", blob, input.name ?? "file");
+  form.set("contentType", contentType);
+  if (input.name !== void 0) form.set("name", input.name);
+  if (input.tags !== void 0) form.set("tags", JSON.stringify(input.tags));
+  if (input.ownerRunId !== void 0) form.set("ownerRunId", input.ownerRunId);
+  if (input.projectId !== void 0) form.set("projectId", input.projectId);
+  if (input.expectedHash !== void 0) form.set("expectedHash", input.expectedHash);
+  return form;
+}
 function makeArtifactsClient(transport) {
   return {
+    async upload(input, options) {
+      const res = await raw(transport, {
+        method: "POST",
+        path: "/v1/artifacts",
+        body: uploadForm(input),
+        ...options?.idempotencyKey !== void 0 && {
+          headers: { "Idempotency-Key": options.idempotencyKey }
+        }
+      });
+      return await res.json();
+    },
+    async download(blobId) {
+      const res = await raw(transport, {
+        method: "GET",
+        path: `/v1/artifacts/${encodeURIComponent(blobId)}`
+      });
+      return {
+        ...headOf(blobId, res),
+        body: res.body ?? new Response("").body
+      };
+    },
+    async head(blobId) {
+      const res = await raw(transport, {
+        method: "HEAD",
+        path: `/v1/artifacts/${encodeURIComponent(blobId)}`
+      });
+      return headOf(blobId, res);
+    },
     async put(_input) {
       throw new KindgiApiError(
         notYetWired(
           "artifacts.put",
-          "POST /v1/artifacts is a multipart-form upload; the SDK transport is JSON-only. Multipart / raw-stream body support is a planned follow-up"
+          "no route takes a content-addressed BlobRef: use artifacts.upload, which returns the artifact metadata"
         )
       );
     },
@@ -852,7 +1187,7 @@ function makeArtifactsClient(transport) {
       throw new KindgiApiError(
         notYetWired(
           "artifacts.get",
-          "GET /v1/artifacts/{blobId} streams binary bytes; the SDK transport hydrates JSON only. Raw-stream response support is a planned follow-up"
+          "no route takes a content-addressed BlobRef: use artifacts.download(blobId)"
         )
       );
     },
@@ -866,7 +1201,8 @@ function makeArtifactsClient(transport) {
           ...filter?.ownerRunId !== void 0 && {
             ownerRunId: filter.ownerRunId
           },
-          ...filter?.contentType !== void 0 && { contentType: filter.contentType }
+          ...filter?.contentType !== void 0 && { contentType: filter.contentType },
+          ...filter?.projectId !== void 0 && { projectId: filter.projectId }
         }
       });
       return listPage(page);
@@ -928,7 +1264,7 @@ function makeAuditClient(transport) {
 
 // src/resources/auth.ts
 function makeAuthClient(transport) {
-  const seg = (s) => encodeURIComponent(s);
+  const seg2 = (s) => encodeURIComponent(s);
   return {
     providers: {
       async list() {
@@ -949,15 +1285,43 @@ function makeAuthClient(transport) {
       async unregister(providerId, options) {
         return transport.request({
           method: "POST",
-          path: `/v1/auth/providers/${seg(providerId)}/unregister`,
+          path: `/v1/auth/providers/${seg2(providerId)}/unregister`,
+          ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
+        });
+      },
+      async get(providerId) {
+        return transport.request({
+          method: "GET",
+          path: `/v1/auth/providers/${seg2(providerId)}`
+        });
+      },
+      async signIn(providerId, input) {
+        return transport.request({
+          method: "GET",
+          path: `/v1/auth/providers/${seg2(providerId)}/sign-in`,
+          ...input?.kind !== void 0 && { query: { kind: input.kind } }
+        });
+      },
+      async update(providerId, changes, options) {
+        return transport.request({
+          method: "PATCH",
+          path: `/v1/auth/providers/${seg2(providerId)}`,
+          body: changes,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
       }
     },
+    async signInOptions(input) {
+      return transport.request({
+        method: "GET",
+        path: "/v1/auth/sign-in-options",
+        ...input?.email !== void 0 && { query: { email: input.email } }
+      });
+    },
     async login(providerId, input, options) {
       return transport.request({
         method: "POST",
-        path: `/v1/auth/login/${seg(providerId)}`,
+        path: `/v1/auth/login/${seg2(providerId)}`,
         ...input !== void 0 && { body: input },
         ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
       });
@@ -965,7 +1329,7 @@ function makeAuthClient(transport) {
     async callback(providerId, input) {
       return transport.request({
         method: "POST",
-        path: `/v1/auth/callback/${seg(providerId)}`,
+        path: `/v1/auth/callback/${seg2(providerId)}`,
         body: input
       });
     },
@@ -976,6 +1340,12 @@ function makeAuthClient(transport) {
         ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
       });
     },
+    async tokenSignIn() {
+      return transport.request({
+        method: "POST",
+        path: "/v1/auth/token-sign-in"
+      });
+    },
     async logout(options) {
       return transport.request({
         method: "POST",
@@ -988,7 +1358,7 @@ function makeAuthClient(transport) {
 
 // src/resources/blocks.ts
 function makeBlocksClient(transport) {
-  const seg = (s) => encodeURIComponent(s);
+  const seg2 = (s) => encodeURIComponent(s);
   return {
     async publish(input, options) {
       return transport.request({
@@ -1012,13 +1382,13 @@ function makeBlocksClient(transport) {
       });
     },
     async get(blockId) {
-      return transport.request({ method: "GET", path: `/v1/blocks/${seg(blockId)}` });
+      return transport.request({ method: "GET", path: `/v1/blocks/${seg2(blockId)}` });
     },
     versions: {
       async list(blockId, filter) {
         return transport.request({
           method: "GET",
-          path: `/v1/blocks/${seg(blockId)}/versions`,
+          path: `/v1/blocks/${seg2(blockId)}/versions`,
           query: {
             ...filter?.limit !== void 0 && { limit: filter.limit },
             ...filter?.cursor !== void 0 && { cursor: filter.cursor },
@@ -1031,20 +1401,20 @@ function makeBlocksClient(transport) {
       async get(blockId, version) {
         return transport.request({
           method: "GET",
-          path: `/v1/blocks/${seg(blockId)}/versions/${seg(version)}`
+          path: `/v1/blocks/${seg2(blockId)}/versions/${seg2(version)}`
         });
       },
       async unregister(blockId, version, options) {
         return transport.request({
           method: "POST",
-          path: `/v1/blocks/${seg(blockId)}/versions/${seg(version)}/unregister`,
+          path: `/v1/blocks/${seg2(blockId)}/versions/${seg2(version)}/unregister`,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
       },
       async reinstate(blockId, version, options) {
         return transport.request({
           method: "POST",
-          path: `/v1/blocks/${seg(blockId)}/versions/${seg(version)}/reinstate`,
+          path: `/v1/blocks/${seg2(blockId)}/versions/${seg2(version)}/reinstate`,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
       }
@@ -1180,7 +1550,8 @@ function makeComplianceClient(transport) {
           body: input,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
-      }
+      },
+      verify: (bundle, publicKey) => verifySignedExport(bundle, { trustedKeys: [publicKey] })
     }
   };
 }
@@ -1238,6 +1609,16 @@ function makeConversationsClient(transport) {
         }
       });
     },
+    async unregister(id, options) {
+      return transport.request({
+        method: "POST",
+        path: `/v1/conversations/${encodeURIComponent(id)}/unregister`,
+        body: {},
+        ...options?.idempotencyKey !== void 0 && {
+          idempotencyKey: options.idempotencyKey
+        }
+      });
+    },
     async messages(id, filter) {
       const page = await transport.request({
         method: "GET",
@@ -1448,9 +1829,9 @@ function makeEnvClient(transport) {
         });
         return { kind: "ok", record };
       } catch (err) {
-        const conflict = tryReadRevisionConflict(err);
-        if (conflict !== null) {
-          return { kind: "revision-conflict", currentRevision: conflict };
+        const conflict2 = tryReadRevisionConflict(err);
+        if (conflict2 !== null) {
+          return { kind: "revision-conflict", currentRevision: conflict2 };
         }
         throw err;
       }
@@ -1503,12 +1884,12 @@ function comparisonOf(run) {
   return run.kind === "judged" && result?.summary !== void 0 && Array.isArray(result.perCase) ? result : void 0;
 }
 function makeEvalRunsClient(transport) {
-  const seg = (s) => encodeURIComponent(s);
+  const seg2 = (s) => encodeURIComponent(s);
   return {
     async start(suiteId, input, options) {
       return transport.request({
         method: "POST",
-        path: `/v1/eval-suites/${seg(suiteId)}/runs`,
+        path: `/v1/eval-suites/${seg2(suiteId)}/runs`,
         body: { ...input, projectId: options.projectId },
         ...options.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
       });
@@ -1529,17 +1910,17 @@ function makeEvalRunsClient(transport) {
     async get(runId) {
       return transport.request({
         method: "GET",
-        path: `/v1/eval-runs/${seg(runId)}`
+        path: `/v1/eval-runs/${seg2(runId)}`
       });
     },
     async cancel(runId) {
       return transport.request({
         method: "POST",
-        path: `/v1/eval-runs/${seg(runId)}/cancel`
+        path: `/v1/eval-runs/${seg2(runId)}/cancel`
       });
     },
     events(runId, options) {
-      const url = `${transport.apiUrl}/v1/eval-runs/${seg(runId)}/events`;
+      const url = `${transport.apiUrl}/v1/eval-runs/${seg2(runId)}/events`;
       const source = readSse({
         url,
         headers: transport.authHeaders(),
@@ -1559,7 +1940,7 @@ function makeEvalRunsClient(transport) {
 
 // src/resources/eval-suites.ts
 function makeEvalSuitesClient(transport) {
-  const seg = (s) => encodeURIComponent(s);
+  const seg2 = (s) => encodeURIComponent(s);
   return {
     async publish(input, options) {
       return transport.request({
@@ -1587,13 +1968,13 @@ function makeEvalSuitesClient(transport) {
     async get(suiteId) {
       return transport.request({
         method: "GET",
-        path: `/v1/eval-suites/${seg(suiteId)}`
+        path: `/v1/eval-suites/${seg2(suiteId)}`
       });
     },
     async buildFromJudgments(suiteId, input, options) {
       return transport.request({
         method: "POST",
-        path: `/v1/eval-suites/${seg(suiteId)}/versions/from-judgments`,
+        path: `/v1/eval-suites/${seg2(suiteId)}/versions/from-judgments`,
         body: input,
         ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
       });
@@ -1601,7 +1982,7 @@ function makeEvalSuitesClient(transport) {
     async listCases(suiteId, version, query) {
       return transport.request({
         method: "GET",
-        path: `/v1/eval-suites/${seg(suiteId)}/versions/${seg(version)}/cases`,
+        path: `/v1/eval-suites/${seg2(suiteId)}/versions/${seg2(version)}/cases`,
         query: {
           ...query?.limit !== void 0 && { limit: query.limit },
           ...query?.cursor !== void 0 && { cursor: query.cursor }
@@ -1612,7 +1993,7 @@ function makeEvalSuitesClient(transport) {
       async list(suiteId, filter) {
         return transport.request({
           method: "GET",
-          path: `/v1/eval-suites/${seg(suiteId)}/versions`,
+          path: `/v1/eval-suites/${seg2(suiteId)}/versions`,
           query: {
             ...filter?.limit !== void 0 && { limit: filter.limit },
             ...filter?.cursor !== void 0 && { cursor: filter.cursor }
@@ -1622,20 +2003,20 @@ function makeEvalSuitesClient(transport) {
       async get(suiteId, version) {
         return transport.request({
           method: "GET",
-          path: `/v1/eval-suites/${seg(suiteId)}/versions/${seg(version)}`
+          path: `/v1/eval-suites/${seg2(suiteId)}/versions/${seg2(version)}`
         });
       },
       async unregister(suiteId, version, options) {
         return transport.request({
           method: "POST",
-          path: `/v1/eval-suites/${seg(suiteId)}/versions/${seg(version)}/unregister`,
+          path: `/v1/eval-suites/${seg2(suiteId)}/versions/${seg2(version)}/unregister`,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
       },
       async reinstate(suiteId, version, options) {
         return transport.request({
           method: "POST",
-          path: `/v1/eval-suites/${seg(suiteId)}/versions/${seg(version)}/reinstate`,
+          path: `/v1/eval-suites/${seg2(suiteId)}/versions/${seg2(version)}/reinstate`,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
       }
@@ -1758,7 +2139,7 @@ function makeEventsClient(_transport) {
                 new KindgiApiError(
                   notYetWired(
                     "events.stream",
-                    "no GET /v1/events/subscriptions/{id}/stream route on the API \u2014 subscription-scoped SSE surface has not landed (runtime event bus is live; SDK-side SSE reader is ready via readSse; HTTP route pending). Use client.runs.stream(runId) for live run-scoped events."
+                    "no GET /v1/events/subscriptions/{id}/stream route on the API \u2014 subscription-scoped SSE surface has not landed (runtime event bus is live; SDK-side SSE reader is ready via readSse; HTTP route pending). Use client.runs.follow(runId) for live run-scoped events."
                   )
                 )
               );
@@ -1779,6 +2160,19 @@ function makeEventsClient(_transport) {
   };
 }
 
+// src/resources/export-signing-keys.ts
+function makeExportSigningKeysClient(transport) {
+  return {
+    async list() {
+      const page = await transport.request({
+        method: "GET",
+        path: "/v1/export-signing-keys"
+      });
+      return page.data;
+    }
+  };
+}
+
 // src/resources/flows.ts
 function makeFlowsClient(transport) {
   const list = async (id, filter) => {
@@ -1885,7 +2279,7 @@ function makeFlowsClient(transport) {
 
 // src/resources/gate-policies.ts
 function makeGatePoliciesClient(transport) {
-  const seg = (s) => encodeURIComponent(s);
+  const seg2 = (s) => encodeURIComponent(s);
   return {
     async list(filter) {
       return transport.request({
@@ -1902,7 +2296,7 @@ function makeGatePoliciesClient(transport) {
     async get(policyId) {
       return transport.request({
         method: "GET",
-        path: `/v1/gate-policies/${seg(policyId)}`
+        path: `/v1/gate-policies/${seg2(policyId)}`
       });
     },
     async publish(input, options) {
@@ -1917,25 +2311,25 @@ function makeGatePoliciesClient(transport) {
       async list(policyId) {
         return transport.request({
           method: "GET",
-          path: `/v1/gate-policies/${seg(policyId)}/versions`
+          path: `/v1/gate-policies/${seg2(policyId)}/versions`
         });
       },
       async get(policyId, version) {
         return transport.request({
           method: "GET",
-          path: `/v1/gate-policies/${seg(policyId)}/versions/${seg(version)}`
+          path: `/v1/gate-policies/${seg2(policyId)}/versions/${seg2(version)}`
         });
       },
       async unregister(policyId, version) {
         return transport.request({
           method: "POST",
-          path: `/v1/gate-policies/${seg(policyId)}/versions/${seg(version)}/unregister`
+          path: `/v1/gate-policies/${seg2(policyId)}/versions/${seg2(version)}/unregister`
         });
       },
       async reinstate(policyId, version) {
         return transport.request({
           method: "POST",
-          path: `/v1/gate-policies/${seg(policyId)}/versions/${seg(version)}/reinstate`
+          path: `/v1/gate-policies/${seg2(policyId)}/versions/${seg2(version)}/reinstate`
         });
       }
     }
@@ -2008,7 +2402,7 @@ function makeGuardrailsClient(transport) {
 
 // src/resources/identity.ts
 function makeIdentityClient(transport) {
-  const seg = (s) => encodeURIComponent(s);
+  const seg2 = (s) => encodeURIComponent(s);
   return {
     async whoami() {
       return transport.request({
@@ -2031,19 +2425,19 @@ function makeIdentityClient(transport) {
       async get(userId) {
         return transport.request({
           method: "GET",
-          path: `/v1/identity/users/${seg(userId)}`
+          path: `/v1/identity/users/${seg2(userId)}`
         });
       },
       async listSessions(userId) {
         return transport.request({
           method: "GET",
-          path: `/v1/identity/users/${seg(userId)}/sessions`
+          path: `/v1/identity/users/${seg2(userId)}/sessions`
         });
       },
       async revokeSessions(userId, options) {
         return transport.request({
           method: "POST",
-          path: `/v1/identity/users/${seg(userId)}/revoke-sessions`,
+          path: `/v1/identity/users/${seg2(userId)}/revoke-sessions`,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
       }
@@ -2051,31 +2445,63 @@ function makeIdentityClient(transport) {
   };
 }
 
-// src/resources/judge-classes.ts
-function scopeQuery2(scope) {
-  if (scope.kind === "tenant") return { scopeKind: "tenant" };
-  if (scope.kind === "project") return { scopeKind: "project", projectId: scope.projectId };
-  return { scopeKind: "agent", projectId: scope.projectId, agentId: scope.agentId };
-}
-function makeJudgeClassesClient(transport) {
-  const withKey = (options) => options?.idempotencyKey !== void 0 ? { idempotencyKey: options.idempotencyKey } : {};
+// src/resources/improvement-passes.ts
+function makeImprovementPassesClient(transport) {
   return {
-    async create(input, options) {
-      return transport.request({
-        method: "POST",
-        path: "/v1/judge-classes",
-        body: input,
-        ...withKey(options)
-      });
-    },
-    async list(filter) {
+    async list(input = {}) {
       const page = await transport.request({
         method: "GET",
-        path: "/v1/judge-classes",
+        path: "/v1/improvement-passes",
         query: {
-          ...filter?.limit !== void 0 && { limit: filter.limit },
-          ...filter?.cursor !== void 0 && { cursor: filter.cursor },
-          ...filter?.scope !== void 0 && scopeQuery2(filter.scope)
+          ...input.limit !== void 0 && { limit: input.limit },
+          ...input.cursor !== void 0 && { cursor: input.cursor },
+          ...input.agentId !== void 0 && { agentId: input.agentId }
+        }
+      });
+      return listPage(page);
+    },
+    async get(passId) {
+      return transport.request({
+        method: "GET",
+        path: `/v1/improvement-passes/${encodeURIComponent(passId)}`
+      });
+    },
+    async cancel(passId, input = {}) {
+      return transport.request({
+        method: "POST",
+        path: `/v1/improvement-passes/${encodeURIComponent(passId)}/cancel`,
+        body: {},
+        ...input.idempotencyKey !== void 0 && { idempotencyKey: input.idempotencyKey }
+      });
+    }
+  };
+}
+
+// src/resources/judge-classes.ts
+function scopeQuery2(scope) {
+  if (scope.kind === "tenant") return { scopeKind: "tenant" };
+  if (scope.kind === "project") return { scopeKind: "project", projectId: scope.projectId };
+  return { scopeKind: "agent", projectId: scope.projectId, agentId: scope.agentId };
+}
+function makeJudgeClassesClient(transport) {
+  const withKey = (options) => options?.idempotencyKey !== void 0 ? { idempotencyKey: options.idempotencyKey } : {};
+  return {
+    async create(input, options) {
+      return transport.request({
+        method: "POST",
+        path: "/v1/judge-classes",
+        body: input,
+        ...withKey(options)
+      });
+    },
+    async list(filter) {
+      const page = await transport.request({
+        method: "GET",
+        path: "/v1/judge-classes",
+        query: {
+          ...filter?.limit !== void 0 && { limit: filter.limit },
+          ...filter?.cursor !== void 0 && { cursor: filter.cursor },
+          ...filter?.scope !== void 0 && scopeQuery2(filter.scope)
         }
       });
       return listPage(page);
@@ -2278,6 +2704,56 @@ function makeMcpClient(transport) {
 // src/resources/memory.ts
 function makeMemoryClient(transport) {
   return {
+    erasures: {
+      async create(selector, options) {
+        return transport.request({
+          method: "POST",
+          path: "/v1/memory/erasures",
+          body: selector,
+          ...options?.idempotencyKey !== void 0 && {
+            idempotencyKey: options.idempotencyKey
+          }
+        });
+      },
+      async get(id) {
+        return transport.request({
+          method: "GET",
+          path: `/v1/memory/erasures/${encodeURIComponent(id)}`
+        });
+      },
+      async list(filter) {
+        const page = await transport.request({
+          method: "GET",
+          path: "/v1/memory/erasures",
+          query: {
+            ...filter?.limit !== void 0 && { limit: filter.limit },
+            ...filter?.cursor !== void 0 && { cursor: filter.cursor }
+          }
+        });
+        return listPage(page);
+      },
+      async resume(id, options) {
+        return transport.request({
+          method: "POST",
+          path: `/v1/memory/erasures/${encodeURIComponent(id)}/resume`,
+          body: { ...options?.force === true && { force: true } }
+        });
+      },
+      async export() {
+        const ledger = await transport.request({ method: "GET", path: "/v1/memory/erasures/export" });
+        return ledger.data;
+      },
+      async replay(erasures, options) {
+        return transport.request({
+          method: "POST",
+          path: "/v1/memory/erasures/replay",
+          body: { erasures },
+          ...options?.idempotencyKey !== void 0 && {
+            idempotencyKey: options.idempotencyKey
+          }
+        });
+      }
+    },
     facts: {
       async write(input, options) {
         return transport.request({
@@ -2289,11 +2765,22 @@ function makeMemoryClient(transport) {
           }
         });
       },
-      async read(id) {
+      async read(id, options) {
         return transport.request({
           method: "GET",
-          path: `/v1/memory/facts/${encodeURIComponent(id)}`
+          path: `/v1/memory/facts/${encodeURIComponent(id)}`,
+          query: {
+            ...options?.version !== void 0 && { version: options.version },
+            ...options?.asOf !== void 0 && { asOf: options.asOf }
+          }
+        });
+      },
+      async revisions(id) {
+        const envelope = await transport.request({
+          method: "GET",
+          path: `/v1/memory/facts/${encodeURIComponent(id)}/revisions`
         });
+        return envelope.data;
       },
       async list(filter) {
         const page = await transport.request({
@@ -2303,16 +2790,38 @@ function makeMemoryClient(transport) {
             ...filter?.limit !== void 0 && { limit: filter.limit },
             ...filter?.cursor !== void 0 && { cursor: filter.cursor },
             ...filter?.type !== void 0 && { type: filter.type },
-            ...filter?.scope !== void 0 && { scope: JSON.stringify(filter.scope) }
+            ...filter?.scope !== void 0 && { scope: JSON.stringify(filter.scope) },
+            ...filter?.asOf !== void 0 && { asOf: filter.asOf }
           }
         });
         return listPage(page);
       },
-      async delete(id, options) {
+      async supersede(id, input, options) {
         return transport.request({
           method: "POST",
           path: `/v1/memory/facts/${encodeURIComponent(id)}/supersede`,
-          body: {},
+          body: input,
+          ...options?.idempotencyKey !== void 0 && {
+            idempotencyKey: options.idempotencyKey
+          }
+        });
+      },
+      async delete(id, options) {
+        return transport.request({
+          method: "DELETE",
+          path: `/v1/memory/facts/${encodeURIComponent(id)}`,
+          query: {
+            ...options?.expectVersion !== void 0 && { expectVersion: options.expectVersion }
+          }
+        });
+      },
+      async verify(id, options) {
+        return transport.request({
+          method: "POST",
+          path: `/v1/memory/facts/${encodeURIComponent(id)}/verify`,
+          body: {
+            ...options?.expectVersion !== void 0 && { expectVersion: options.expectVersion }
+          },
           ...options?.idempotencyKey !== void 0 && {
             idempotencyKey: options.idempotencyKey
           }
@@ -2402,7 +2911,7 @@ function makeObservationsClient(transport) {
 
 // src/resources/orgs.ts
 function makeOrgsClient(transport) {
-  const seg = (s) => encodeURIComponent(s);
+  const seg2 = (s) => encodeURIComponent(s);
   return {
     async create(input, options) {
       return transport.request({
@@ -2425,13 +2934,13 @@ function makeOrgsClient(transport) {
     async get(orgId) {
       return transport.request({
         method: "GET",
-        path: `/v1/orgs/${seg(orgId)}`
+        path: `/v1/orgs/${seg2(orgId)}`
       });
     },
     async update(orgId, input, options) {
       return transport.request({
         method: "PATCH",
-        path: `/v1/orgs/${seg(orgId)}`,
+        path: `/v1/orgs/${seg2(orgId)}`,
         body: input,
         ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
       });
@@ -2439,7 +2948,7 @@ function makeOrgsClient(transport) {
     async delete(orgId) {
       return transport.request({
         method: "DELETE",
-        path: `/v1/orgs/${seg(orgId)}`,
+        path: `/v1/orgs/${seg2(orgId)}`,
         discardResponse: true
       });
     }
@@ -2606,7 +3115,7 @@ function makePoliciesClient(transport) {
 
 // src/resources/projects.ts
 function makeProjectsClient(transport) {
-  const seg = (s) => encodeURIComponent(s);
+  const seg2 = (s) => encodeURIComponent(s);
   return {
     async create(input, options) {
       return transport.request({
@@ -2635,13 +3144,13 @@ function makeProjectsClient(transport) {
     async get(projectId) {
       return transport.request({
         method: "GET",
-        path: `/v1/projects/${seg(projectId)}`
+        path: `/v1/projects/${seg2(projectId)}`
       });
     },
     async update(projectId, input, options) {
       return transport.request({
         method: "PATCH",
-        path: `/v1/projects/${seg(projectId)}`,
+        path: `/v1/projects/${seg2(projectId)}`,
         body: input,
         ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
       });
@@ -2649,7 +3158,7 @@ function makeProjectsClient(transport) {
     async delete(projectId) {
       return transport.request({
         method: "DELETE",
-        path: `/v1/projects/${seg(projectId)}`,
+        path: `/v1/projects/${seg2(projectId)}`,
         discardResponse: true
       });
     },
@@ -2657,7 +3166,7 @@ function makeProjectsClient(transport) {
       async list(projectId, filter) {
         return transport.request({
           method: "GET",
-          path: `/v1/projects/${seg(projectId)}/memberships`,
+          path: `/v1/projects/${seg2(projectId)}/memberships`,
           query: {
             ...filter?.limit !== void 0 && { limit: filter.limit },
             ...filter?.cursor !== void 0 && { cursor: filter.cursor }
@@ -2667,7 +3176,7 @@ function makeProjectsClient(transport) {
       async add(projectId, input, options) {
         return transport.request({
           method: "POST",
-          path: `/v1/projects/${seg(projectId)}/memberships`,
+          path: `/v1/projects/${seg2(projectId)}/memberships`,
           body: input,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
@@ -2675,7 +3184,7 @@ function makeProjectsClient(transport) {
       async updateRole(projectId, userId, role, options) {
         return transport.request({
           method: "PATCH",
-          path: `/v1/projects/${seg(projectId)}/memberships/${seg(userId)}`,
+          path: `/v1/projects/${seg2(projectId)}/memberships/${seg2(userId)}`,
           body: { role },
           discardResponse: true,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
@@ -2684,7 +3193,7 @@ function makeProjectsClient(transport) {
       async remove(projectId, userId, options) {
         return transport.request({
           method: "DELETE",
-          path: `/v1/projects/${seg(projectId)}/memberships/${seg(userId)}`,
+          path: `/v1/projects/${seg2(projectId)}/memberships/${seg2(userId)}`,
           discardResponse: true,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
@@ -2693,6 +3202,71 @@ function makeProjectsClient(transport) {
   };
 }
 
+// src/resources/proposals.ts
+var seg = (id) => encodeURIComponent(id);
+function makeProposalsClient(transport) {
+  const post = (req) => transport.request({
+    method: "POST",
+    path: req.path,
+    body: req.body,
+    ...req.idempotencyKey !== void 0 && { idempotencyKey: req.idempotencyKey }
+  });
+  return {
+    async list(input = {}) {
+      const page = await transport.request({
+        method: "GET",
+        path: "/v1/proposals",
+        query: {
+          ...input.limit !== void 0 && { limit: input.limit },
+          ...input.cursor !== void 0 && { cursor: input.cursor },
+          ...input.agentId !== void 0 && { agentId: input.agentId },
+          ...input.tier !== void 0 && { tier: input.tier },
+          ...input.status !== void 0 && { status: input.status },
+          ...input.scope !== void 0 && scopeQuery(input.scope)
+        }
+      });
+      return listPage(page);
+    },
+    async get(id) {
+      return transport.request({ method: "GET", path: `/v1/proposals/${seg(id)}` });
+    },
+    async create(input) {
+      const { idempotencyKey, ...body } = input;
+      return transport.request({
+        method: "POST",
+        path: "/v1/proposals",
+        body,
+        ...idempotencyKey !== void 0 && { idempotencyKey }
+      });
+    },
+    async evaluate(id, input) {
+      const { idempotencyKey, ...body } = input;
+      return post({ path: `/v1/proposals/${seg(id)}/evaluate`, body, idempotencyKey });
+    },
+    async request(id, input = {}) {
+      const { idempotencyKey, ...body } = input;
+      return post({ path: `/v1/proposals/${seg(id)}/request`, body, idempotencyKey });
+    },
+    async rollback(id, input = {}) {
+      const { idempotencyKey, ...body } = input;
+      return post({ path: `/v1/proposals/${seg(id)}/rollback`, body, idempotencyKey });
+    },
+    async withdraw(id, input) {
+      const { idempotencyKey, ...body } = input;
+      return post({ path: `/v1/proposals/${seg(id)}/withdraw`, body, idempotencyKey });
+    },
+    async improve(input) {
+      const { idempotencyKey, ...body } = input;
+      return transport.request({
+        method: "POST",
+        path: "/v1/proposals/improve",
+        body,
+        ...idempotencyKey !== void 0 && { idempotencyKey }
+      });
+    }
+  };
+}
+
 // src/resources/provenance.ts
 function makeProvenanceClient(transport) {
   return {
@@ -2726,26 +3300,22 @@ function makeProvenanceClient(transport) {
         method: "POST",
         path: `/v1/provenance/${encodeURIComponent(input.runId)}/export`,
         body: {
-          signingKeyId: input.signingKeyId,
+          ...input.signingKeyId !== void 0 && { signingKeyId: input.signingKeyId },
           ...input.includeMessages !== void 0 && { includeMessages: input.includeMessages }
         },
         ...input.idempotencyKey !== void 0 && { idempotencyKey: input.idempotencyKey }
       });
     },
-    async verify(_exported, _publicKey) {
-      throw new KindgiApiError(
-        notYetWired(
-          "provenance.verify",
-          "client-side ed25519 verification requires the crypto module subpackage to be reachable from the SDK"
-        )
-      );
+    async verify(exported, publicKey) {
+      const checked = await verifySignedExport(exported, { trustedKeys: [publicKey] });
+      return checked.valid ? { valid: true } : { valid: false, issues: checked.issues ?? [] };
     }
   };
 }
 
 // src/resources/providers.ts
 function makeProvidersClient(transport) {
-  const seg = (s) => encodeURIComponent(s);
+  const seg2 = (s) => encodeURIComponent(s);
   return {
     async register(input, options) {
       return transport.request({
@@ -2769,19 +3339,25 @@ function makeProvidersClient(transport) {
     async get(providerId) {
       return transport.request({
         method: "GET",
-        path: `/v1/providers/${seg(providerId)}`
+        path: `/v1/providers/${seg2(providerId)}`
       });
     },
     async capabilities(providerId) {
       return transport.request({
         method: "GET",
-        path: `/v1/providers/${seg(providerId)}/capabilities`
+        path: `/v1/providers/${seg2(providerId)}/capabilities`
+      });
+    },
+    async check(providerId) {
+      return transport.request({
+        method: "GET",
+        path: `/v1/providers/${seg2(providerId)}/check`
       });
     },
     async unregister(providerId, options) {
       return transport.request({
         method: "POST",
-        path: `/v1/providers/${seg(providerId)}/unregister`,
+        path: `/v1/providers/${seg2(providerId)}/unregister`,
         ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
       });
     }
@@ -2892,145 +3468,6 @@ function subscribeToRun(options) {
   });
 }
 
-// src/transport.ts
-var DEFAULT_TIMEOUT_MS = 3e4;
-var MUTATING = /* @__PURE__ */ new Set([
-  "POST",
-  "PUT",
-  "PATCH",
-  "DELETE"
-]);
-function createTransport(options) {
-  const apiUrl = options.apiUrl.replace(/\/+$/u, "");
-  const fetchImpl = options.fetch ?? fetch;
-  const clientTimeoutMs = checkedTimeoutMs(
-    options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
-    "ClientOptions.timeoutMs"
-  );
-  return {
-    apiUrl,
-    fetchImpl,
-    authHeaders() {
-      return { Authorization: `Bearer ${authTokenFor(options.auth)}` };
-    },
-    async request(input) {
-      const url = buildUrl(apiUrl, input.path, input.query);
-      const headers = buildHeaders(input, options.auth);
-      const timeoutMs = input.timeoutMs === void 0 ? clientTimeoutMs : checkedTimeoutMs(input.timeoutMs, "timeoutMs");
-      const ac = new AbortController();
-      let timedOut = false;
-      const timer = setTimeout(() => {
-        timedOut = true;
-        ac.abort(new Error("timeout"));
-      }, timeoutMs);
-      let response;
-      try {
-        response = await fetchImpl(url, {
-          method: input.method,
-          headers,
-          ...input.body !== void 0 && { body: JSON.stringify(input.body) },
-          signal: ac.signal
-        });
-      } catch (cause) {
-        clearTimeout(timer);
-        const err = timedOut ? {
-          code: "network",
-          message: `No answer within ${seconds(timeoutMs)}, the client's timeout (timeoutMs).`,
-          cause,
-          timeoutMs
-        } : {
-          code: "network",
-          message: cause instanceof Error ? cause.message : "network request failed",
-          cause
-        };
-        throw new KindgiApiError(err);
-      }
-      clearTimeout(timer);
-      if (response.ok) {
-        if (input.discardResponse === true || response.status === 204) {
-          try {
-            await response.arrayBuffer();
-          } catch {
-          }
-          return void 0;
-        }
-        try {
-          return await response.json();
-        } catch (cause) {
-          const err = {
-            code: "network",
-            message: "Response body was not valid JSON",
-            cause
-          };
-          throw new KindgiApiError(err);
-        }
-      }
-      let body;
-      try {
-        body = await response.json();
-      } catch {
-        body = void 0;
-      }
-      throw new KindgiApiError(
-        fromWire(unwrapErrorEnvelope(body, response.status), response.status)
-      );
-    }
-  };
-}
-function checkedTimeoutMs(value, name) {
-  if (!Number.isFinite(value) || value <= 0) {
-    throw new TypeError(`${name} must be a positive number of milliseconds. Got ${String(value)}.`);
-  }
-  return value;
-}
-function seconds(ms) {
-  return `${ms / 1e3} s`;
-}
-function buildUrl(apiUrl, path, query) {
-  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
-  const base = `${apiUrl}${normalizedPath}`;
-  if (query === void 0) return base;
-  const params = [];
-  for (const key of Object.keys(query)) {
-    const value = query[key];
-    if (value === void 0) continue;
-    const values = typeof value === "object" ? value : [String(value)];
-    for (const v of values) params.push(`${encodeURIComponent(key)}=${encodeURIComponent(v)}`);
-  }
-  return params.length === 0 ? base : `${base}?${params.join("&")}`;
-}
-function buildHeaders(input, auth) {
-  const headers = {
-    Accept: "application/json",
-    Authorization: `Bearer ${authTokenFor(auth)}`
-  };
-  if (input.body !== void 0) {
-    headers["Content-Type"] = "application/json; charset=utf-8";
-  }
-  if (input.idempotencyKey !== void 0 && MUTATING.has(input.method)) {
-    headers["Idempotency-Key"] = input.idempotencyKey;
-  }
-  if (input.headers !== void 0) {
-    for (const key of Object.keys(input.headers)) {
-      headers[key] = input.headers[key];
-    }
-  }
-  return headers;
-}
-function authTokenFor(auth) {
-  if (auth.kind === "apiToken") return auth.token;
-  return auth.accessToken;
-}
-function unwrapErrorEnvelope(body, status) {
-  if (body !== null && typeof body === "object" && !Array.isArray(body)) {
-    const inner = body.error;
-    if (inner !== null && typeof inner === "object" && !Array.isArray(inner)) {
-      return inner;
-    }
-  }
-  return { code: "unknown", message: `HTTP ${status} without recognizable error envelope` };
-}
-
 // src/resources/runs.ts
 function waitedStartTimeout(e) {
   if (!(e instanceof KindgiApiError) || e.error.code !== "network") return e;
@@ -3044,6 +3481,30 @@ function waitedStartTimeout(e) {
   });
 }
 function makeRunsClient(transport) {
+  const followEvents = (runId, options) => followRun({
+    url: `${transport.apiUrl}/v1/runs/${encodeURIComponent(runId)}/stream`,
+    headers: () => transport.authHeaders(),
+    fetchImpl: transport.fetchImpl,
+    ...options?.signal !== void 0 && { signal: options.signal },
+    ...options?.initialBackoffMs !== void 0 && {
+      initialBackoffMs: options.initialBackoffMs
+    },
+    ...options?.maxBackoffMs !== void 0 && {
+      maxBackoffMs: options.maxBackoffMs
+    }
+  });
+  const followProgressEvents = (runId, options) => followRun({
+    url: `${transport.apiUrl}/v1/runs/${encodeURIComponent(runId)}/progress/stream`,
+    headers: () => transport.authHeaders(),
+    fetchImpl: transport.fetchImpl,
+    ...options?.signal !== void 0 && { signal: options.signal },
+    ...options?.initialBackoffMs !== void 0 && {
+      initialBackoffMs: options.initialBackoffMs
+    },
+    ...options?.maxBackoffMs !== void 0 && {
+      maxBackoffMs: options.maxBackoffMs
+    }
+  });
   return {
     async start(input) {
       const body = "agent" in input ? {
@@ -3089,34 +3550,10 @@ function makeRunsClient(transport) {
         path: `/v1/runs/${encodeURIComponent(runId)}/progress`
       });
     },
-    streamProgress(runId, options) {
-      return followRun({
-        url: `${transport.apiUrl}/v1/runs/${encodeURIComponent(runId)}/progress/stream`,
-        headers: () => transport.authHeaders(),
-        fetchImpl: transport.fetchImpl,
-        ...options?.signal !== void 0 && { signal: options.signal },
-        ...options?.initialBackoffMs !== void 0 && {
-          initialBackoffMs: options.initialBackoffMs
-        },
-        ...options?.maxBackoffMs !== void 0 && {
-          maxBackoffMs: options.maxBackoffMs
-        }
-      });
-    },
-    stream(runId, options) {
-      return followRun({
-        url: `${transport.apiUrl}/v1/runs/${encodeURIComponent(runId)}/stream`,
-        headers: () => transport.authHeaders(),
-        fetchImpl: transport.fetchImpl,
-        ...options?.signal !== void 0 && { signal: options.signal },
-        ...options?.initialBackoffMs !== void 0 && {
-          initialBackoffMs: options.initialBackoffMs
-        },
-        ...options?.maxBackoffMs !== void 0 && {
-          maxBackoffMs: options.maxBackoffMs
-        }
-      });
-    },
+    followProgress: followProgressEvents,
+    follow: followEvents,
+    streamProgress: followProgressEvents,
+    stream: followEvents,
     async get(runId) {
       return transport.request({
         method: "GET",
@@ -3161,6 +3598,7 @@ function makeRunsClient(transport) {
           ...filter?.agentId !== void 0 && { agentId: filter.agentId },
           ...filter?.replays !== void 0 && { replays: filter.replays },
           ...filter?.evalRunId !== void 0 && { evalRunId: filter.evalRunId },
+          ...filter?.triggerId !== void 0 && { triggerId: filter.triggerId },
           ...filter?.includeOutput === true && { include: "output" }
         }
       });
@@ -3201,10 +3639,11 @@ function makeSchedulesClient(transport) {
         }
       });
     },
-    async get(triggerId) {
+    async get(triggerId, options) {
       return transport.request({
         method: "GET",
-        path: `/v1/schedules/${encodeURIComponent(triggerId)}`
+        path: `/v1/schedules/${encodeURIComponent(triggerId)}`,
+        ...options?.upcoming !== void 0 && { query: { upcoming: options.upcoming } }
       });
     },
     async update(triggerId, input, options) {
@@ -3235,6 +3674,30 @@ function makeSchedulesClient(transport) {
         path: `/v1/schedules/${encodeURIComponent(triggerId)}/unregister`,
         ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
       });
+    },
+    async fires(triggerId, filter) {
+      return transport.request({
+        method: "GET",
+        path: `/v1/schedules/${encodeURIComponent(triggerId)}/fires`,
+        query: {
+          ...filter?.limit !== void 0 && { limit: filter.limit },
+          ...filter?.cursor !== void 0 && { cursor: filter.cursor }
+        }
+      });
+    },
+    async runNow(triggerId, options) {
+      return transport.request({
+        method: "POST",
+        path: `/v1/schedules/${encodeURIComponent(triggerId)}/run-now`,
+        ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
+      });
+    },
+    async takeOwnership(triggerId, options) {
+      return transport.request({
+        method: "POST",
+        path: `/v1/schedules/${encodeURIComponent(triggerId)}/owner`,
+        ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
+      });
     }
   };
 }
@@ -3396,8 +3859,8 @@ function makeSecretsClient(transport) {
         });
         return { kind: "ok", record: ok.record, versionId: ok.versionId };
       } catch (err) {
-        const conflict = tryReadVersionConflict(err);
-        if (conflict !== null) return conflict;
+        const conflict2 = tryReadVersionConflict(err);
+        if (conflict2 !== null) return conflict2;
         throw err;
       }
     },
@@ -3517,6 +3980,63 @@ function tryReadVersionConflict(err) {
   return { kind: "version-conflict", currentVersion: current };
 }
 
+// src/resources/service-accounts.ts
+function makeServiceAccountsClient(transport) {
+  const withKey = (options) => options?.idempotencyKey !== void 0 ? { idempotencyKey: options.idempotencyKey } : {};
+  return {
+    async create(input, options) {
+      return transport.request({
+        method: "POST",
+        path: "/v1/service-accounts",
+        body: input,
+        ...withKey(options)
+      });
+    },
+    async list(filter) {
+      const page = await transport.request({
+        method: "GET",
+        path: "/v1/service-accounts",
+        query: {
+          ...filter?.limit !== void 0 && { limit: filter.limit },
+          ...filter?.cursor !== void 0 && { cursor: filter.cursor },
+          ...filter?.includeUnregistered === true && { includeUnregistered: "true" }
+        }
+      });
+      return listPage(page);
+    },
+    async get(serviceAccountId) {
+      return transport.request({
+        method: "GET",
+        path: `/v1/service-accounts/${encodeURIComponent(serviceAccountId)}`
+      });
+    },
+    async grant(serviceAccountId, grant, options) {
+      return transport.request({
+        method: "POST",
+        path: `/v1/service-accounts/${encodeURIComponent(serviceAccountId)}/grant`,
+        body: grant,
+        ...withKey(options)
+      });
+    },
+    async ungrant(serviceAccountId, grant, options) {
+      return transport.request({
+        method: "POST",
+        path: `/v1/service-accounts/${encodeURIComponent(serviceAccountId)}/ungrant`,
+        body: grant,
+        ...withKey(options)
+      });
+    },
+    async unregister(serviceAccountId, options) {
+      return transport.request({
+        method: "POST",
+        path: `/v1/service-accounts/${encodeURIComponent(serviceAccountId)}/unregister`,
+        body: {},
+        ...withKey(options)
+      });
+    }
+  };
+}
+
 // src/resources/signing-keys.ts
 function makeSigningKeysClient(transport) {
   return {
@@ -3559,10 +4079,17 @@ function makeSigningKeysClient(transport) {
 
 // src/resources/supervisor.ts
 var REASON_NO_SUPERVISOR_CRUD = "no /v1/supervisors CRUD routes on the API \u2014 supervisor persistence is caller-plugged via SupervisorBinding at deployment boot (framework does NOT own supervisor storage; analogous to the identity-directory pattern for users)";
-function makeSupervisorClient(transport) {
-  const supervisorHeader = (supervisorId) => ({
-    "X-Supervisor-Id": supervisorId
-  });
+function removed(method, replacement) {
+  return async () => {
+    throw new KindgiApiError(
+      notYetWired(
+        `supervisor.proposals.${method}`,
+        `removed in 0.1.5: proposals now change data blocks; use client.proposals.${replacement} (see client.proposals.create, evaluate and request)`
+      )
+    );
+  };
+}
+function makeSupervisorClient(_transport) {
   return {
     async define(_spec) {
       throw new KindgiApiError(notYetWired("supervisor.define", REASON_NO_SUPERVISOR_CRUD));
@@ -3580,114 +4107,22 @@ function makeSupervisorClient(transport) {
       throw new KindgiApiError(notYetWired("supervisor.delete", REASON_NO_SUPERVISOR_CRUD));
     },
     proposals: {
-      async draft(input) {
-        return transport.request({
-          method: "POST",
-          path: "/v1/proposals",
-          headers: supervisorHeader(input.supervisorId),
-          body: {
-            agentId: input.agentId,
-            agentVersion: input.agentVersion,
-            tier: input.tier,
-            change: input.change,
-            patternRefs: input.patternRefs,
-            hypothesis: input.hypothesis,
-            proposerRuleId: input.proposerRuleId
-          },
-          ...input.idempotencyKey !== void 0 && { idempotencyKey: input.idempotencyKey }
-        });
-      },
-      async list(input) {
-        const page = await transport.request({
-          method: "GET",
-          path: "/v1/proposals",
-          headers: supervisorHeader(input.supervisorId),
-          query: {
-            ...input.limit !== void 0 && { limit: input.limit },
-            ...input.cursor !== void 0 && { cursor: input.cursor },
-            ...input.status !== void 0 && { status: input.status },
-            ...input.agentId !== void 0 && { agentId: input.agentId },
-            ...input.tier !== void 0 && { tier: input.tier }
-          }
-        });
-        return listPage(page);
-      },
-      async get(supervisorId, id) {
-        return transport.request({
-          method: "GET",
-          path: `/v1/proposals/${encodeURIComponent(id)}`,
-          headers: supervisorHeader(supervisorId)
-        });
-      },
-      async dryRun(supervisorId, id, input) {
-        return transport.request({
-          method: "POST",
-          path: `/v1/proposals/${encodeURIComponent(id)}/dry-run`,
-          headers: supervisorHeader(supervisorId),
-          body: {
-            datasetId: input.datasetId,
-            datasetVersion: input.datasetVersion,
-            criterion: input.criterion
-          },
-          ...input.idempotencyKey !== void 0 && { idempotencyKey: input.idempotencyKey }
-        });
-      },
-      async submitForReview(supervisorId, id, input) {
-        const body = {};
-        if (input?.requiredRole !== void 0) body.requiredRole = input.requiredRole;
-        if (input?.expiresAt !== void 0) body.expiresAt = input.expiresAt;
-        return transport.request({
-          method: "POST",
-          path: `/v1/proposals/${encodeURIComponent(id)}/submit-review`,
-          headers: supervisorHeader(supervisorId),
-          body,
-          ...input?.idempotencyKey !== void 0 && { idempotencyKey: input.idempotencyKey }
-        });
-      },
-      async reflectReview(_supervisorId, _id, _input) {
-        throw new KindgiApiError(
-          notYetWired(
-            "supervisor.proposals.reflectReview",
-            "no POST /v1/proposals/{id}/reflect-review route on the API \u2014 review reflection is atomic with POST /v1/approvals/{id}/complete (wire detects the linked proposal + updates status alongside the decision)"
-          )
-        );
-      },
-      async apply(supervisorId, id, input) {
-        const body = {};
-        if (input?.newVersion !== void 0) body.newVersion = input.newVersion;
-        return transport.request({
-          method: "POST",
-          path: `/v1/proposals/${encodeURIComponent(id)}/apply`,
-          headers: supervisorHeader(supervisorId),
-          body,
-          ...input?.idempotencyKey !== void 0 && { idempotencyKey: input.idempotencyKey }
-        });
-      },
-      async rollback(supervisorId, id, input) {
-        return transport.request({
-          method: "POST",
-          path: `/v1/proposals/${encodeURIComponent(id)}/rollback`,
-          headers: supervisorHeader(supervisorId),
-          body: { reason: input.reason },
-          ...input.idempotencyKey !== void 0 && { idempotencyKey: input.idempotencyKey }
-        });
-      },
-      async withdraw(supervisorId, id, input) {
-        return transport.request({
-          method: "POST",
-          path: `/v1/proposals/${encodeURIComponent(id)}/withdraw`,
-          headers: supervisorHeader(supervisorId),
-          body: { reason: input.reason },
-          ...input.idempotencyKey !== void 0 && { idempotencyKey: input.idempotencyKey }
-        });
-      }
+      draft: removed("draft", "create"),
+      list: removed("list", "list"),
+      get: removed("get", "get"),
+      dryRun: removed("dryRun", "evaluate"),
+      submitForReview: removed("submitForReview", "request"),
+      reflectReview: removed("reflectReview", "request"),
+      apply: removed("apply", "request"),
+      rollback: removed("rollback", "rollback"),
+      withdraw: removed("withdraw", "withdraw")
     }
   };
 }
 
 // src/resources/teams.ts
 function makeTeamsClient(transport) {
-  const seg = (s) => encodeURIComponent(s);
+  const seg2 = (s) => encodeURIComponent(s);
   return {
     async create(input, options) {
       return transport.request({
@@ -3710,13 +4145,13 @@ function makeTeamsClient(transport) {
     async get(teamId) {
       return transport.request({
         method: "GET",
-        path: `/v1/teams/${seg(teamId)}`
+        path: `/v1/teams/${seg2(teamId)}`
       });
     },
     async update(teamId, input, options) {
       return transport.request({
         method: "PATCH",
-        path: `/v1/teams/${seg(teamId)}`,
+        path: `/v1/teams/${seg2(teamId)}`,
         body: input,
         ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
       });
@@ -3724,7 +4159,7 @@ function makeTeamsClient(transport) {
     async delete(teamId) {
       return transport.request({
         method: "DELETE",
-        path: `/v1/teams/${seg(teamId)}`,
+        path: `/v1/teams/${seg2(teamId)}`,
         discardResponse: true
       });
     },
@@ -3732,7 +4167,7 @@ function makeTeamsClient(transport) {
       async list(teamId, filter) {
         return transport.request({
           method: "GET",
-          path: `/v1/teams/${seg(teamId)}/memberships`,
+          path: `/v1/teams/${seg2(teamId)}/memberships`,
           query: {
             ...filter?.limit !== void 0 && { limit: filter.limit },
             ...filter?.cursor !== void 0 && { cursor: filter.cursor }
@@ -3742,7 +4177,7 @@ function makeTeamsClient(transport) {
       async add(teamId, input, options) {
         return transport.request({
           method: "POST",
-          path: `/v1/teams/${seg(teamId)}/memberships`,
+          path: `/v1/teams/${seg2(teamId)}/memberships`,
           body: input,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
@@ -3750,7 +4185,7 @@ function makeTeamsClient(transport) {
       async updateRole(teamId, userId, role, options) {
         return transport.request({
           method: "PATCH",
-          path: `/v1/teams/${seg(teamId)}/memberships/${seg(userId)}`,
+          path: `/v1/teams/${seg2(teamId)}/memberships/${seg2(userId)}`,
           body: { role },
           discardResponse: true,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
@@ -3759,7 +4194,7 @@ function makeTeamsClient(transport) {
       async remove(teamId, userId, options) {
         return transport.request({
           method: "DELETE",
-          path: `/v1/teams/${seg(teamId)}/memberships/${seg(userId)}`,
+          path: `/v1/teams/${seg2(teamId)}/memberships/${seg2(userId)}`,
           discardResponse: true,
           ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
         });
@@ -3806,6 +4241,7 @@ function makeTenantClient(transport) {
 function fromWire2(wire) {
   return {
     id: wire.tokenId,
+    ...wire.principal !== void 0 && { principal: wire.principal },
     role: wire.role,
     capabilities: wire.capabilities,
     ...wire.label !== void 0 && { label: wire.label },
@@ -3823,6 +4259,7 @@ function makeTokensClient(transport) {
   return {
     async create(spec, options) {
       const body = {};
+      if (spec?.for !== void 0) body.for = { kind: spec.for.kind, id: spec.for.id };
       if (spec?.role !== void 0) body.role = spec.role;
       if (spec?.capabilities !== void 0) body.capabilities = spec.capabilities;
       if (spec?.label !== void 0) body.label = spec.label;
@@ -3845,7 +4282,10 @@ function makeTokensClient(transport) {
         path: "/v1/tokens",
         query: {
           ...filter?.limit !== void 0 && { limit: filter.limit },
-          ...filter?.cursor !== void 0 && { cursor: filter.cursor }
+          ...filter?.cursor !== void 0 && { cursor: filter.cursor },
+          ...filter?.principal !== void 0 && {
+            principal: `${filter.principal.kind}:${filter.principal.id}`
+          }
         }
       });
       return listPage({ ...page, data: page.data.map(fromWire2) });
@@ -3988,13 +4428,24 @@ function makeToolsClient(transport) {
 // src/resources/users.ts
 function makeUsersClient(transport) {
   return {
-    async create(_spec) {
-      throw new KindgiApiError(
-        notYetWired(
-          "users.create",
-          "no user-creation route on the wire \u2014 framework does NOT own user persistence (deployments plug LDAP / SCIM / bespoke stores via IdentityDirectoryBinding)"
-        )
-      );
+    async create(spec, options) {
+      if (spec.orgId !== void 0 || spec.metadata !== void 0) {
+        throw new KindgiApiError(
+          notYetWired("users.create", "`orgId` and `metadata` are not on the wire")
+        );
+      }
+      const created = await transport.request({
+        method: "POST",
+        path: "/v1/identity/users",
+        body: {
+          displayName: spec.displayName,
+          ...spec.email !== void 0 && { primaryEmail: spec.email }
+        },
+        ...options?.idempotencyKey !== void 0 && {
+          idempotencyKey: options.idempotencyKey
+        }
+      });
+      return created.userId;
     },
     async get(id) {
       return transport.request({
@@ -4015,11 +4466,42 @@ function makeUsersClient(transport) {
         query: {
           ...filter?.limit !== void 0 && { limit: filter.limit },
           ...filter?.cursor !== void 0 && { cursor: filter.cursor },
-          ...filter?.query !== void 0 && { query: filter.query }
+          ...filter?.query !== void 0 && { query: filter.query },
+          ...filter?.includeUnregistered === true && { includeUnregistered: "true" }
         }
       });
       return listPage(page);
     },
+    async grants(id) {
+      return transport.request({
+        method: "GET",
+        path: `/v1/identity/users/${encodeURIComponent(id)}/grants`
+      });
+    },
+    async grant(id, grant, options) {
+      return transport.request({
+        method: "POST",
+        path: `/v1/identity/users/${encodeURIComponent(id)}/grant`,
+        body: grant,
+        ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
+      });
+    },
+    async ungrant(id, grant, options) {
+      return transport.request({
+        method: "POST",
+        path: `/v1/identity/users/${encodeURIComponent(id)}/ungrant`,
+        body: grant,
+        ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
+      });
+    },
+    async unregister(id, options) {
+      return transport.request({
+        method: "POST",
+        path: `/v1/identity/users/${encodeURIComponent(id)}/unregister`,
+        body: {},
+        ...options?.idempotencyKey !== void 0 && { idempotencyKey: options.idempotencyKey }
+      });
+    },
     async update(_id, _patch) {
       throw new KindgiApiError(
         notYetWired(
@@ -4216,7 +4698,9 @@ function createClient(options) {
     conversations: makeConversationsClient(transport),
     memory: makeMemoryClient(transport),
     provenance: makeProvenanceClient(transport),
-    supervisor: makeSupervisorClient(transport),
+    supervisor: makeSupervisorClient(),
+    proposals: makeProposalsClient(transport),
+    improvementPasses: makeImprovementPassesClient(transport),
     observations: makeObservationsClient(transport),
     approvals: makeApprovalsClient(transport),
     tenant: makeTenantClient(transport),
@@ -4244,7 +4728,9 @@ function createClient(options) {
     teams: makeTeamsClient(transport),
     orgs: makeOrgsClient(transport),
     signingKeys: makeSigningKeysClient(transport),
+    exportSigningKeys: makeExportSigningKeysClient(transport),
     tokens: makeTokensClient(transport),
+    serviceAccounts: makeServiceAccountsClient(transport),
     mcp: makeMcpClient(transport),
     events: makeEventsClient(),
     eventTriggers: makeEventTriggersClient(transport),
@@ -4255,6 +4741,6 @@ function createClient(options) {
   };
 }
 
-export { KindgiApiError, SseHttpError, comparisonOf, createClient, followRun, fromWire, notImplementedInPreview, notYetWired, readSse, subscribeToRun, unwrapSseData };
+export { KindgiApiError, SIGNED_EXPORT_ALGORITHMS, SseHttpError, comparisonOf, createClient, followRun, fromWire, notImplementedInPreview, notYetWired, readSse, subscribeToRun, unwrapSseData, verifySignedExport };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map