@m8tes/sdk 0.1.0-alpha.7 → 0.1.0-alpha.8

package/CHANGELOG.md

@@ -13,6 +13,19 @@ All notable changes to `@m8tes/sdk`.
 > While the version is a `-alpha.N` prerelease, publish with dist-tag `alpha`.
 > The first stable release is published with `--tag latest` deliberately.
 
+## [0.1.0-alpha.8] - 2026-09-06
+
+### Added
+
+- **`client.groups` for recursive shared Teams.** Create and move nested groups, inspect visible
+  ancestor paths and management capabilities, manage direct and inherited viewer, runner, or
+  editor roles, and run the verified-email invitation lifecycle. New invitations default to
+  editor, while migrated grants remain viewer. Membership calls are account-scoped and independent
+  of organization membership and the legacy bulk Mate visibility operation exposed by
+  `groups.share()`.
+- Agent responses expose `can_manage`, `can_execute`, and owner-only `can_share` so clients can
+  present the effective capabilities of a scoped Team member.
+
 ## [0.1.0-alpha.7] - 2026-09-06
 
 ### Fixed
@@ -34,7 +47,6 @@ All notable changes to `@m8tes/sdk`.
   "the run already finished, fall back to `get()`" — true for `GET /runs/{id}/stream`,
   false for POST reply/create. Callers pinning `human_in_the_loop: false` mid-turn would
   have been told the run ended while it was still executing under the old settings.
-
 ## [0.1.0-alpha.6] - 2026-09-05
 
 ### Fixed

package/README.md

@@ -109,6 +109,35 @@ await client.tasks.triggers.create(task.id, { type: "app", app: "github", trigge
 const { url } = await client.tasks.enableWebhook(task.id);
 ```
 
+## Recursive Teams
+
+Organize agents into nested Teams and grant a role across one subtree:
+
+```ts
+const marketing = await client.groups.create({ name: "Marketing" });
+const paidAds = await client.groups.create({ name: "Paid Ads", parent_id: marketing.id });
+const google = await client.groups.create({ name: "Google", parent_id: paidAds.id });
+await client.agents.update(agent.id, { group_id: google.id });
+
+const invite = await client.groups.invite(marketing.id, {
+  email: "ada@example.com",
+  role: "runner",
+});
+const members = await client.groups.members(google.id); // includes inherited roles
+await client.groups.updateMember(marketing.id, members.data[0]!.member_id, { role: "editor" });
+```
+
+New invitations default to `editor`; choose `viewer` for read access or `runner` for read plus
+run/chat/reply/cancel/approve. Editors can also edit Mates, tasks, documents, and work inside the
+subtree. Existing grants remain `viewer`. Roles inherit through child Teams. Editors cannot manage
+members or roles, self-escalate, reorganize Teams, or move a Mate out of the shared scope.
+
+Team sharing is account-scoped and does not make someone an organization member. Runs use the
+shared Mate owner's bound tools and billing while auditing the human requester separately;
+credentials stay opaque. Group CRUD still accepts `user_id` for end-user isolation, while
+membership and invitation methods do not. `groups.share()` remains the separate legacy bulk
+operation for direct Mates' visibility.
+
 ## Human-in-the-loop
 
 When a run pauses, the stream emits an `approval-request` or `question` event. Answer it and the run resumes.

package/dist/index.cjs

@@ -1334,19 +1334,19 @@ var Page = class {
    * it did see rather than a hung process.
    */
   async *[Symbol.asyncIterator]() {
-    let page = this;
+    let page2 = this;
     const seen = /* @__PURE__ */ new Set();
     for (; ; ) {
-      yield* page.data;
-      const last = page.data.at(-1);
-      if (!page.hasMore || !last || !page.fetchNext) return;
-      let cursor = page.nextStartingAfter === null || page.nextStartingAfter === void 0 ? void 0 : page.nextStartingAfter;
+      yield* page2.data;
+      const last = page2.data.at(-1);
+      if (!page2.hasMore || !last || !page2.fetchNext) return;
+      let cursor = page2.nextStartingAfter === null || page2.nextStartingAfter === void 0 ? void 0 : page2.nextStartingAfter;
       if (cursor === void 0) {
         cursor = typeof last.id === "number" || typeof last.id === "string" ? last.id : typeof last.name === "string" ? last.name : void 0;
       }
       if (cursor === void 0 || seen.has(cursor)) return;
       seen.add(cursor);
-      page = await page.fetchNext(cursor);
+      page2 = await page2.fetchNext(cursor);
     }
   }
   /** Every item across every page, collected. Prefer iteration for large sets. */
@@ -1629,6 +1629,69 @@ function createMemoriesResource(http) {
   };
 }
 
+// src/resources/groups.ts
+var page = (res) => new Page(res.data ?? [], res.has_more ?? false, void 0, res.next_starting_after);
+function createGroupsResource(http) {
+  const members = async (groupId) => page(await http.request("GET", `/groups/${seg(groupId)}/members`));
+  const invites = async (groupId) => page(await http.request("GET", `/groups/${seg(groupId)}/invites`));
+  return {
+    create(params) {
+      return http.request("POST", "/groups", { body: toBody({ ...params }) });
+    },
+    async list(params = {}) {
+      return page(await http.request("GET", "/groups", { query: toQuery(params) }));
+    },
+    get(groupId, params = {}) {
+      return http.request("GET", `/groups/${seg(groupId)}`, { query: toQuery(params) });
+    },
+    update(groupId, params) {
+      const { user_id, ...body } = params;
+      return http.request("PATCH", `/groups/${seg(groupId)}`, {
+        query: toQuery({ user_id }),
+        body: toBody(body)
+      });
+    },
+    async delete(groupId, params = {}) {
+      await http.request("DELETE", `/groups/${seg(groupId)}`, { query: toQuery(params) });
+    },
+    share(groupId, params) {
+      const { user_id, ...body } = params;
+      return http.request("POST", `/groups/${seg(groupId)}/share`, {
+        query: toQuery({ user_id }),
+        body: toBody(body)
+      });
+    },
+    members,
+    listMembers: members,
+    updateMember(groupId, memberId, params) {
+      return http.request(
+        "PATCH",
+        `/groups/${seg(groupId)}/members/${seg(memberId)}`,
+        { body: toBody(params) }
+      );
+    },
+    async removeMember(groupId, memberId) {
+      await http.request("DELETE", `/groups/${seg(groupId)}/members/${seg(memberId)}`);
+    },
+    invites,
+    listInvites: invites,
+    invite(groupId, params) {
+      return http.request("POST", `/groups/${seg(groupId)}/invites`, {
+        body: toBody({ role: "editor", ...params })
+      });
+    },
+    async cancelInvite(inviteId) {
+      await http.request("DELETE", `/groups/invites/${seg(inviteId)}`);
+    },
+    previewInvite(token) {
+      return http.request("GET", `/groups/invites/${seg(token)}`);
+    },
+    acceptInvite(token) {
+      return http.request("POST", "/groups/invites/accept", { body: { token } });
+    }
+  };
+}
+
 // src/resources/models.ts
 function createModelsResource(http) {
   return {
@@ -2415,7 +2478,7 @@ function createWebhooksResource(http) {
 }
 
 // src/index.ts
-var M8TES_SDK_VERSION = "0.1.0-alpha.7";
+var M8TES_SDK_VERSION = "0.1.0-alpha.8";
 var M8tes = class {
   runs;
   agents;
@@ -2427,6 +2490,7 @@ var M8tes = class {
   webhooks;
   settings;
   memories;
+  groups;
   permissions;
   models;
   modelConnections;
@@ -2445,6 +2509,7 @@ var M8tes = class {
     this.webhooks = createWebhooksResource(this.http);
     this.settings = createSettingsResource(this.http);
     this.memories = createMemoriesResource(this.http);
+    this.groups = createGroupsResource(this.http);
     this.permissions = createPermissionsResource(this.http);
     this.models = createModelsResource(this.http);
     this.modelConnections = createModelConnectionsResource(this.http);