@naturali/sdk 0.111.0 → 0.111.1

package/dist/index.cjs

@@ -1435,6 +1435,7 @@ var ApiKeys = class {
 	*
 	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
 	* A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+	* A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
 	*
 	*/
 	static createApiKey(options) {
@@ -1488,6 +1489,7 @@ var ApiKeys = class {
 	* Rotate an API key
 	*
 	* Issues a new secret for the same key record (same id, scope and capabilities) and invalidates the previous secret. The new raw `key` is returned only in this response.
+	* Refused for a connected app, like creation: rotation returns a raw secret for a key the caller need never have held, so it reaches the same place by another door.
 	*
 	*/
 	static rotateApiKey(options) {

package/dist/index.d.cts

@@ -19277,6 +19277,7 @@ declare class ApiKeys {
    *
    * Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
    * A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+   * A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
    *
    */
   static createApiKey<ThrowOnError extends boolean = false>(options: Options<CreateApiKeyData, ThrowOnError>): RequestResult<CreateApiKeyResponses, CreateApiKeyErrors, ThrowOnError>;
@@ -19302,6 +19303,7 @@ declare class ApiKeys {
    * Rotate an API key
    *
    * Issues a new secret for the same key record (same id, scope and capabilities) and invalidates the previous secret. The new raw `key` is returned only in this response.
+   * Refused for a connected app, like creation: rotation returns a raw secret for a key the caller need never have held, so it reaches the same place by another door.
    *
    */
   static rotateApiKey<ThrowOnError extends boolean = false>(options: Options<RotateApiKeyData, ThrowOnError>): RequestResult<RotateApiKeyResponses, RotateApiKeyErrors, ThrowOnError>;

package/dist/index.d.mts

@@ -19277,6 +19277,7 @@ declare class ApiKeys {
    *
    * Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
    * A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+   * A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
    *
    */
   static createApiKey<ThrowOnError extends boolean = false>(options: Options<CreateApiKeyData, ThrowOnError>): RequestResult<CreateApiKeyResponses, CreateApiKeyErrors, ThrowOnError>;
@@ -19302,6 +19303,7 @@ declare class ApiKeys {
    * Rotate an API key
    *
    * Issues a new secret for the same key record (same id, scope and capabilities) and invalidates the previous secret. The new raw `key` is returned only in this response.
+   * Refused for a connected app, like creation: rotation returns a raw secret for a key the caller need never have held, so it reaches the same place by another door.
    *
    */
   static rotateApiKey<ThrowOnError extends boolean = false>(options: Options<RotateApiKeyData, ThrowOnError>): RequestResult<RotateApiKeyResponses, RotateApiKeyErrors, ThrowOnError>;

package/dist/index.mjs

@@ -1434,6 +1434,7 @@ var ApiKeys = class {
 	*
 	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
 	* A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+	* A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
 	*
 	*/
 	static createApiKey(options) {
@@ -1487,6 +1488,7 @@ var ApiKeys = class {
 	* Rotate an API key
 	*
 	* Issues a new secret for the same key record (same id, scope and capabilities) and invalidates the previous secret. The new raw `key` is returned only in this response.
+	* Refused for a connected app, like creation: rotation returns a raw secret for a key the caller need never have held, so it reaches the same place by another door.
 	*
 	*/
 	static rotateApiKey(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/sdk",
-  "version": "0.111.0",
+  "version": "0.111.1",
   "description": "TypeScript SDK for the naturali.ai API, generated from its OpenAPI specs",
   "type": "module",
   "sideEffects": false,
@@ -37,7 +37,7 @@
     "tsx": "^4.23.1",
     "typescript": "~6.0.3",
     "vitest": "^4.1.10",
-    "@naturali/api": "0.111.0"
+    "@naturali/api": "0.111.1"
   },
   "scripts": {
     "generate": "tsx scripts/generate.ts",