@naturali/cli 0.210.2 → 0.211.0

package/dist/index.mjs

@@ -17,7 +17,7 @@ var __exportAll = (all, no_symbols) => {
 };
 //#endregion
 //#region package.json
-var version = "0.210.2";
+var version = "0.211.0";
 //#endregion
 //#region ../sdk/src/generated/core/bodySerializer.gen.ts
 const serializeFormDataPair = (data, key, value) => {
@@ -1608,7 +1608,8 @@ var ApiKeys = class {
 	/**
 	* Create an API key
 	*
-	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
+	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows the key to the operations whose capability it names; empty, the key reaches whatever its holder's membership reaches. Omitted, it is empty, or the caller's own set when the caller is a narrowed key. An unknown capability is `400`. The raw `key` (nat_sk_…) is returned only in this response.
+	* A narrowed key may grant only a non-empty subset of its own set: a wider or empty set is `403`, on update too, and so is rotating a key wider than it.
 	* A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
 	* A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
 	*
@@ -1653,7 +1654,8 @@ var ApiKeys = class {
 	/**
 	* Update an API key
 	*
-	* Rename an API key or replace its capability set. The scope (project vs account) is immutable.
+	* Rename an API key or replace its capability set; the change holds from the key's next call. The scope (project vs account) is immutable. A narrowed caller may set only a non-empty subset of its own set (`403`).
+	*
 	*/
 	static updateApiKey(options) {
 		return (options.client ?? client).patch({
@@ -9834,7 +9836,7 @@ const routes = {
 	"create-api-key": {
 		serviceClass: "APIKeys",
 		operationId: "createApiKey",
-		description: "Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response. A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project. A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.",
+		description: "Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows the key to the operations whose capability it names; empty, the key reaches whatever its holder's membership reaches. Omitted, it is empty, or the caller's own set when the caller is a narrowed key. An unknown capability is `400`. The raw `key` (nat_sk_…) is returned only in this response. A narrowed key may grant only a non-empty subset of its own set: a wider or empty set is `403`, on update too, and so is rotating a key wider than it. A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project. A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.",
 		moduleDocsUrl: "https://naturali.ai/docs/modules/api-keys",
 		httpMethod: "post",
 		pathParams: [],
@@ -9858,7 +9860,7 @@ const routes = {
 			},
 			{
 				"name": "capabilities",
-				"description": "Capabilities to grant. Omit to inherit the creator's capabilities.",
+				"description": "Capabilities to narrow the key to. Omit for none, or for the caller's own set when the caller is a narrowed key.\n",
 				"required": false,
 				"type": "array",
 				"in": "body"
@@ -9886,7 +9888,7 @@ const routes = {
 	"update-api-key": {
 		serviceClass: "APIKeys",
 		operationId: "updateApiKey",
-		description: "Rename an API key or replace its capability set. The scope (project vs account) is immutable.",
+		description: "Rename an API key or replace its capability set; the change holds from the key's next call. The scope (project vs account) is immutable. A narrowed caller may set only a non-empty subset of its own set (`403`).",
 		moduleDocsUrl: "https://naturali.ai/docs/modules/api-keys",
 		httpMethod: "patch",
 		pathParams: ["api_key_id"],
@@ -9910,7 +9912,7 @@ const routes = {
 			},
 			{
 				"name": "capabilities",
-				"description": "Replace the capability set (empty array clears all).",
+				"description": "Replace the capability set; an empty array removes the narrowing.",
 				"required": false,
 				"type": "array",
 				"in": "body"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/cli",
-  "version": "0.210.2",
+  "version": "0.211.0",
   "description": "Command-line interface for the naturali.ai API, generated from its OpenAPI specs",
   "keywords": [
     "naturali",
@@ -31,7 +31,7 @@
     "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@naturali/sdk": "0.210.2",
+    "@naturali/sdk": "0.211.0",
     "@ttoss/openapi-codegen": "^0.10.0",
     "@types/node": "^26.5.1",
     "tsdown": "^0.23.0",