@naturali/sdk 0.134.0 → 0.135.0

package/dist/index.cjs

@@ -1472,7 +1472,7 @@ var ApiKeys = class {
 	* Create an API key
 	*
 	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
-	* A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+	* A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
 	* A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
 	*
 	*/
@@ -3726,7 +3726,7 @@ var Projects = class {
 	* Update a project
 	*
 	* Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`), its execution ceilings (`max_concurrent_runs`, `max_chain_generations`, `max_orchestration_run_depth`) and its priced-model gate (`require_priced_model`). Archiving is reversible; resources are retained.
-	* Requires the `admin` role in the project (an `owner` has it too).
+	* Requires the `admin` role in the project (an `owner` has it too). These are the terms every member works under, which is why setting them sits above the role that works under them.
 	* The ceilings and the priced-model gate are uncapped by plan: each one only ever narrows what the project may spend, so setting one takes on a restriction rather than claiming an entitlement. On the three ceilings `null` clears the project's own bound and omission leaves it alone — they are different instructions.
 	* The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup.
 	*
@@ -3746,7 +3746,7 @@ var Projects = class {
 	/**
 	* List project members
 	*
-	* Lists who may act in the project, and with what role. Readable by every member, including a read-only `member`: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
+	* Lists who may act in the project, and with what role. Readable by every member, whatever their role: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
 	* Somebody invited who has never signed in is listed too, with status `pending` — the invitation is already a grant, so hiding it until they arrive would hide access that exists.
 	*
 	*/
@@ -3783,7 +3783,7 @@ var Projects = class {
 	*
 	* Removes a member, or leaves the project yourself.
 	*
-	* **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a read-only `member` and not another `admin`.
+	* **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a `member` and not another `admin`.
 	*
 	* The owner's own row is refused: a project with no owner is unreachable, and the row names who pays.
 	*

package/dist/index.d.cts

@@ -5871,7 +5871,7 @@ type Project = {
   updated_at: Date;
 };
 /**
- * What the member may do in this project. `owner` — everything, including deleting it and paying for it; exactly one per project. `admin` — every read and write inside it, including minting project API keys, but not deleting the project. `member` — reads only.
+ * What the member may do in this project. `owner` — everything, including deleting it and paying for it; exactly one per project. `admin` — everything a `member` may do, plus managing who else is in the project and how the project itself is configured. `member` — every read and write on the project's own resources, including minting project API keys.
  * When returned on a `Project`, this is *your* role, not a property of the project: it is what lets a client hide an action the request would refuse.
  *
  */
@@ -17828,7 +17828,7 @@ type AddProjectMemberErrors = {
    */
   401: ErrorResponse;
   /**
-   * The caller is a read-only `member`, an `admin` granting `admin`, or a project-scoped credential.
+   * The caller is a `member`, an `admin` granting `admin`, or a project-scoped credential.
    *
    */
   403: ErrorResponse;
@@ -18256,7 +18256,7 @@ type CreateProjectUsageThresholdErrors = {
    */
   401: ErrorResponse;
   /**
-   * The caller is a read-only member.
+   * The caller is a `member`; an alerting rule needs `admin`.
    */
   403: ErrorResponse;
   /**
@@ -18290,7 +18290,7 @@ type DeleteProjectUsageThresholdErrors = {
    */
   401: ErrorResponse;
   /**
-   * The caller is a read-only member.
+   * The caller is a `member`; an alerting rule needs `admin`.
    */
   403: ErrorResponse;
   /**
@@ -21662,7 +21662,7 @@ export declare class ApiKeys {
    * Create an API key
    *
    * Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
-   * A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+   * A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
    * A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
    *
    */
@@ -22825,7 +22825,7 @@ export declare class Projects {
    * Update a project
    *
    * Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`), its execution ceilings (`max_concurrent_runs`, `max_chain_generations`, `max_orchestration_run_depth`) and its priced-model gate (`require_priced_model`). Archiving is reversible; resources are retained.
-   * Requires the `admin` role in the project (an `owner` has it too).
+   * Requires the `admin` role in the project (an `owner` has it too). These are the terms every member works under, which is why setting them sits above the role that works under them.
    * The ceilings and the priced-model gate are uncapped by plan: each one only ever narrows what the project may spend, so setting one takes on a restriction rather than claiming an entitlement. On the three ceilings `null` clears the project's own bound and omission leaves it alone — they are different instructions.
    * The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup.
    *
@@ -22836,7 +22836,7 @@ export declare class Projects {
   /**
    * List project members
    *
-   * Lists who may act in the project, and with what role. Readable by every member, including a read-only `member`: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
+   * Lists who may act in the project, and with what role. Readable by every member, whatever their role: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
    * Somebody invited who has never signed in is listed too, with status `pending` — the invitation is already a grant, so hiding it until they arrive would hide access that exists.
    *
    */
@@ -22859,7 +22859,7 @@ export declare class Projects {
    *
    * Removes a member, or leaves the project yourself.
    *
-   * **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a read-only `member` and not another `admin`.
+   * **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a `member` and not another `admin`.
    *
    * The owner's own row is refused: a project with no owner is unreachable, and the row names who pays.
    *

package/dist/index.d.mts

@@ -5871,7 +5871,7 @@ type Project = {
   updated_at: Date;
 };
 /**
- * What the member may do in this project. `owner` — everything, including deleting it and paying for it; exactly one per project. `admin` — every read and write inside it, including minting project API keys, but not deleting the project. `member` — reads only.
+ * What the member may do in this project. `owner` — everything, including deleting it and paying for it; exactly one per project. `admin` — everything a `member` may do, plus managing who else is in the project and how the project itself is configured. `member` — every read and write on the project's own resources, including minting project API keys.
  * When returned on a `Project`, this is *your* role, not a property of the project: it is what lets a client hide an action the request would refuse.
  *
  */
@@ -17828,7 +17828,7 @@ type AddProjectMemberErrors = {
    */
   401: ErrorResponse;
   /**
-   * The caller is a read-only `member`, an `admin` granting `admin`, or a project-scoped credential.
+   * The caller is a `member`, an `admin` granting `admin`, or a project-scoped credential.
    *
    */
   403: ErrorResponse;
@@ -18256,7 +18256,7 @@ type CreateProjectUsageThresholdErrors = {
    */
   401: ErrorResponse;
   /**
-   * The caller is a read-only member.
+   * The caller is a `member`; an alerting rule needs `admin`.
    */
   403: ErrorResponse;
   /**
@@ -18290,7 +18290,7 @@ type DeleteProjectUsageThresholdErrors = {
    */
   401: ErrorResponse;
   /**
-   * The caller is a read-only member.
+   * The caller is a `member`; an alerting rule needs `admin`.
    */
   403: ErrorResponse;
   /**
@@ -21662,7 +21662,7 @@ export declare class ApiKeys {
    * Create an API key
    *
    * Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
-   * A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+   * A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
    * A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
    *
    */
@@ -22825,7 +22825,7 @@ export declare class Projects {
    * Update a project
    *
    * Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`), its execution ceilings (`max_concurrent_runs`, `max_chain_generations`, `max_orchestration_run_depth`) and its priced-model gate (`require_priced_model`). Archiving is reversible; resources are retained.
-   * Requires the `admin` role in the project (an `owner` has it too).
+   * Requires the `admin` role in the project (an `owner` has it too). These are the terms every member works under, which is why setting them sits above the role that works under them.
    * The ceilings and the priced-model gate are uncapped by plan: each one only ever narrows what the project may spend, so setting one takes on a restriction rather than claiming an entitlement. On the three ceilings `null` clears the project's own bound and omission leaves it alone — they are different instructions.
    * The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup.
    *
@@ -22836,7 +22836,7 @@ export declare class Projects {
   /**
    * List project members
    *
-   * Lists who may act in the project, and with what role. Readable by every member, including a read-only `member`: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
+   * Lists who may act in the project, and with what role. Readable by every member, whatever their role: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
    * Somebody invited who has never signed in is listed too, with status `pending` — the invitation is already a grant, so hiding it until they arrive would hide access that exists.
    *
    */
@@ -22859,7 +22859,7 @@ export declare class Projects {
    *
    * Removes a member, or leaves the project yourself.
    *
-   * **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a read-only `member` and not another `admin`.
+   * **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a `member` and not another `admin`.
    *
    * The owner's own row is refused: a project with no owner is unreachable, and the row names who pays.
    *

package/dist/index.mjs

@@ -1471,7 +1471,7 @@ var ApiKeys = class {
 	* Create an API key
 	*
 	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
-	* A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+	* A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
 	* A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
 	*
 	*/
@@ -3725,7 +3725,7 @@ var Projects = class {
 	* Update a project
 	*
 	* Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`), its execution ceilings (`max_concurrent_runs`, `max_chain_generations`, `max_orchestration_run_depth`) and its priced-model gate (`require_priced_model`). Archiving is reversible; resources are retained.
-	* Requires the `admin` role in the project (an `owner` has it too).
+	* Requires the `admin` role in the project (an `owner` has it too). These are the terms every member works under, which is why setting them sits above the role that works under them.
 	* The ceilings and the priced-model gate are uncapped by plan: each one only ever narrows what the project may spend, so setting one takes on a restriction rather than claiming an entitlement. On the three ceilings `null` clears the project's own bound and omission leaves it alone — they are different instructions.
 	* The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup.
 	*
@@ -3745,7 +3745,7 @@ var Projects = class {
 	/**
 	* List project members
 	*
-	* Lists who may act in the project, and with what role. Readable by every member, including a read-only `member`: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
+	* Lists who may act in the project, and with what role. Readable by every member, whatever their role: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
 	* Somebody invited who has never signed in is listed too, with status `pending` — the invitation is already a grant, so hiding it until they arrive would hide access that exists.
 	*
 	*/
@@ -3782,7 +3782,7 @@ var Projects = class {
 	*
 	* Removes a member, or leaves the project yourself.
 	*
-	* **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a read-only `member` and not another `admin`.
+	* **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a `member` and not another `admin`.
 	*
 	* The owner's own row is refused: a project with no owner is unreachable, and the row names who pays.
 	*

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/sdk",
-  "version": "0.134.0",
+  "version": "0.135.0",
   "description": "TypeScript SDK for the naturali.ai API, generated from its OpenAPI specs",
   "type": "module",
   "sideEffects": false,
@@ -31,7 +31,7 @@
   },
   "devDependencies": {
     "@hey-api/openapi-ts": "^0.99.0",
-    "@naturali/api": "0.134.0",
+    "@naturali/api": "0.135.0",
     "@ttoss/openapi-codegen": "^0.3.1",
     "@types/node": "^26.5.1",
     "tsdown": "^0.23.0",