@myapihq/sdk 2.27.3 → 2.27.4

package/dist/hq.d.ts

@@ -45,7 +45,22 @@ export interface AccountInfo {
 }
 export type GrantAccess = 'read' | 'write';
 export type Grants = Record<string, GrantAccess>;
-export declare const GRANTABLE_SLOTS: readonly ["domain", "email", "funnel", "storage", "image", "webhook", "workflow", "function", "url", "people", "company", "audience", "llm", "database", "crm"];
+/**
+ * Slots a key's grants can name. Mirrors `iam.GrantableSlots` in the backend.
+ *
+ * A second copy of somebody else's vocabulary, so it drifts: this list was
+ * missing `payments`, which the API accepts. The CLI refuses what it cannot
+ * name, so `keys create --grant payments:write` failed and the only way to
+ * mint a payments key was to omit --grant — an UNRESTRICTED key, which for
+ * payments is precisely backwards.
+ *
+ * Slots absent from BOTH lists — queue, container, task, git, pixel, feedback,
+ * auth — cannot be granted at all, so a key that needs them has to be
+ * unrestricted. That gap is the backend's and is filed; do not paper over it
+ * by adding names here that `iam.GrantableSlots` does not have, because a
+ * grant the API rejects is worse than one the CLI refuses.
+ */
+export declare const GRANTABLE_SLOTS: readonly ["domain", "email", "funnel", "storage", "image", "webhook", "workflow", "function", "url", "people", "company", "audience", "llm", "database", "crm", "payments"];
 export type KeyKind = 'account' | 'function' | 'manual';
 export type SpendCapPeriod = 'month' | 'day' | 'none';
 export interface ApiKey {

package/dist/hq.js

@@ -77,9 +77,25 @@ exports.EXPOSES = [
 // The closed grantable-slot vocabulary. Mirrors `iam.GrantableSlots` in the
 // backend — keep in sync. Used to validate `--grant` client-side before the
 // network call. "*" is also valid in a Grants map but is not a slot name.
+/**
+ * Slots a key's grants can name. Mirrors `iam.GrantableSlots` in the backend.
+ *
+ * A second copy of somebody else's vocabulary, so it drifts: this list was
+ * missing `payments`, which the API accepts. The CLI refuses what it cannot
+ * name, so `keys create --grant payments:write` failed and the only way to
+ * mint a payments key was to omit --grant — an UNRESTRICTED key, which for
+ * payments is precisely backwards.
+ *
+ * Slots absent from BOTH lists — queue, container, task, git, pixel, feedback,
+ * auth — cannot be granted at all, so a key that needs them has to be
+ * unrestricted. That gap is the backend's and is filed; do not paper over it
+ * by adding names here that `iam.GrantableSlots` does not have, because a
+ * grant the API rejects is worse than one the CLI refuses.
+ */
 exports.GRANTABLE_SLOTS = [
     'domain', 'email', 'funnel', 'storage', 'image', 'webhook', 'workflow',
     'function', 'url', 'people', 'company', 'audience', 'llm', 'database', 'crm',
+    'payments',
 ];
 async function createAnonymousAccount() {
     return (0, client_1.request)('POST', `${config_1.HQ_BASE}/hq/account/anonymous`, undefined, {});

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const SDK_VERSION = "2.27.3";
+export declare const SDK_VERSION = "2.27.4";

package/dist/version.js

@@ -8,4 +8,4 @@ exports.SDK_VERSION = void 0;
 // Why a constant and not a package.json read: the SDK runs inside edge
 // functions (Cloudflare Workers), so it must not import node:fs. A literal
 // is the only version source that works in every runtime we ship to.
-exports.SDK_VERSION = '2.27.3';
+exports.SDK_VERSION = '2.27.4';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/sdk",
   "license": "Apache-2.0",
-  "version": "2.27.3",
+  "version": "2.27.4",
   "description": "TypeScript SDK for the MyAPI ecosystem",
   "repository": {
     "type": "git",