@naturali/sdk 0.210.1 → 0.211.0

package/dist/index.cjs

@@ -1588,7 +1588,8 @@ var ApiKeys = class {
 	/**
 	* Create an API key
 	*
-	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
+	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows the key to the operations whose capability it names; empty, the key reaches whatever its holder's membership reaches. Omitted, it is empty, or the caller's own set when the caller is a narrowed key. An unknown capability is `400`. The raw `key` (nat_sk_…) is returned only in this response.
+	* A narrowed key may grant only a non-empty subset of its own set: a wider or empty set is `403`, on update too, and so is rotating a key wider than it.
 	* A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
 	* A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
 	*
@@ -1633,7 +1634,8 @@ var ApiKeys = class {
 	/**
 	* Update an API key
 	*
-	* Rename an API key or replace its capability set. The scope (project vs account) is immutable.
+	* Rename an API key or replace its capability set; the change holds from the key's next call. The scope (project vs account) is immutable. A narrowed caller may set only a non-empty subset of its own set (`403`).
+	*
 	*/
 	static updateApiKey(options) {
 		return (options.client ?? client).patch({

package/dist/index.d.cts

@@ -2083,7 +2083,8 @@ type ApiKeyRecord = {
    */
   project_id?: string | null;
   /**
-   * Capabilities granted to this key. Empty means it inherits the creator's.
+   * The capabilities this key is narrowed to, each the one an operation needs (`<module>:<OperationId>`); a call outside them is `403`. Empty means the key reaches whatever its holder's membership reaches.
+   *
    */
   capabilities: Array<string>;
   created_at: Date;
@@ -2108,7 +2109,8 @@ type ApiKeyCreate = {
    */
   project_id?: string;
   /**
-   * Capabilities to grant. Omit to inherit the creator's capabilities.
+   * Capabilities to narrow the key to. Omit for none, or for the caller's own set when the caller is a narrowed key.
+   *
    */
   capabilities?: Array<string>;
 };
@@ -2118,7 +2120,7 @@ type ApiKeyCreate = {
 type ApiKeyUpdate = {
   name?: string;
   /**
-   * Replace the capability set (empty array clears all).
+   * Replace the capability set; an empty array removes the narrowing.
    */
   capabilities?: Array<string>;
 };
@@ -12744,7 +12746,7 @@ type CreateApiKeyErrors = {
    */
   401: ErrorResponse;
   /**
-   * Authenticated, but not permitted to act on this key.
+   * Authenticated, but not permitted to act on this key, or outside a narrowed key's capabilities.
    */
   403: ErrorResponse;
 };
@@ -12773,7 +12775,7 @@ type DeleteApiKeyErrors = {
    */
   401: ErrorResponse;
   /**
-   * Authenticated, but not permitted to act on this key.
+   * Authenticated, but not permitted to act on this key, or outside a narrowed key's capabilities.
    */
   403: ErrorResponse;
   /**
@@ -12806,7 +12808,7 @@ type GetApiKeyErrors = {
    */
   401: ErrorResponse;
   /**
-   * Authenticated, but not permitted to act on this key.
+   * Authenticated, but not permitted to act on this key, or outside a narrowed key's capabilities.
    */
   403: ErrorResponse;
   /**
@@ -12843,7 +12845,7 @@ type UpdateApiKeyErrors = {
    */
   401: ErrorResponse;
   /**
-   * Authenticated, but not permitted to act on this key.
+   * Authenticated, but not permitted to act on this key, or outside a narrowed key's capabilities.
    */
   403: ErrorResponse;
   /**
@@ -12876,7 +12878,7 @@ type RotateApiKeyErrors = {
    */
   401: ErrorResponse;
   /**
-   * Authenticated, but not permitted to act on this key.
+   * Authenticated, but not permitted to act on this key, or outside a narrowed key's capabilities.
    */
   403: ErrorResponse;
   /**
@@ -33015,7 +33017,8 @@ export declare class ApiKeys {
   /**
    * Create an API key
    *
-   * Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
+   * Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows the key to the operations whose capability it names; empty, the key reaches whatever its holder's membership reaches. Omitted, it is empty, or the caller's own set when the caller is a narrowed key. An unknown capability is `400`. The raw `key` (nat_sk_…) is returned only in this response.
+   * A narrowed key may grant only a non-empty subset of its own set: a wider or empty set is `403`, on update too, and so is rotating a key wider than it.
    * A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
    * A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
    *
@@ -33036,7 +33039,8 @@ export declare class ApiKeys {
   /**
    * Update an API key
    *
-   * Rename an API key or replace its capability set. The scope (project vs account) is immutable.
+   * Rename an API key or replace its capability set; the change holds from the key's next call. The scope (project vs account) is immutable. A narrowed caller may set only a non-empty subset of its own set (`403`).
+   *
    */
   static updateApiKey<ThrowOnError extends boolean = false>(options: Options<UpdateApiKeyData, ThrowOnError>): RequestResult<UpdateApiKeyResponses, UpdateApiKeyErrors, ThrowOnError>;
   /**

package/dist/index.d.mts

@@ -2083,7 +2083,8 @@ type ApiKeyRecord = {
    */
   project_id?: string | null;
   /**
-   * Capabilities granted to this key. Empty means it inherits the creator's.
+   * The capabilities this key is narrowed to, each the one an operation needs (`<module>:<OperationId>`); a call outside them is `403`. Empty means the key reaches whatever its holder's membership reaches.
+   *
    */
   capabilities: Array<string>;
   created_at: Date;
@@ -2108,7 +2109,8 @@ type ApiKeyCreate = {
    */
   project_id?: string;
   /**
-   * Capabilities to grant. Omit to inherit the creator's capabilities.
+   * Capabilities to narrow the key to. Omit for none, or for the caller's own set when the caller is a narrowed key.
+   *
    */
   capabilities?: Array<string>;
 };
@@ -2118,7 +2120,7 @@ type ApiKeyCreate = {
 type ApiKeyUpdate = {
   name?: string;
   /**
-   * Replace the capability set (empty array clears all).
+   * Replace the capability set; an empty array removes the narrowing.
    */
   capabilities?: Array<string>;
 };
@@ -12744,7 +12746,7 @@ type CreateApiKeyErrors = {
    */
   401: ErrorResponse;
   /**
-   * Authenticated, but not permitted to act on this key.
+   * Authenticated, but not permitted to act on this key, or outside a narrowed key's capabilities.
    */
   403: ErrorResponse;
 };
@@ -12773,7 +12775,7 @@ type DeleteApiKeyErrors = {
    */
   401: ErrorResponse;
   /**
-   * Authenticated, but not permitted to act on this key.
+   * Authenticated, but not permitted to act on this key, or outside a narrowed key's capabilities.
    */
   403: ErrorResponse;
   /**
@@ -12806,7 +12808,7 @@ type GetApiKeyErrors = {
    */
   401: ErrorResponse;
   /**
-   * Authenticated, but not permitted to act on this key.
+   * Authenticated, but not permitted to act on this key, or outside a narrowed key's capabilities.
    */
   403: ErrorResponse;
   /**
@@ -12843,7 +12845,7 @@ type UpdateApiKeyErrors = {
    */
   401: ErrorResponse;
   /**
-   * Authenticated, but not permitted to act on this key.
+   * Authenticated, but not permitted to act on this key, or outside a narrowed key's capabilities.
    */
   403: ErrorResponse;
   /**
@@ -12876,7 +12878,7 @@ type RotateApiKeyErrors = {
    */
   401: ErrorResponse;
   /**
-   * Authenticated, but not permitted to act on this key.
+   * Authenticated, but not permitted to act on this key, or outside a narrowed key's capabilities.
    */
   403: ErrorResponse;
   /**
@@ -33015,7 +33017,8 @@ export declare class ApiKeys {
   /**
    * Create an API key
    *
-   * Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
+   * Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows the key to the operations whose capability it names; empty, the key reaches whatever its holder's membership reaches. Omitted, it is empty, or the caller's own set when the caller is a narrowed key. An unknown capability is `400`. The raw `key` (nat_sk_…) is returned only in this response.
+   * A narrowed key may grant only a non-empty subset of its own set: a wider or empty set is `403`, on update too, and so is rotating a key wider than it.
    * A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
    * A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
    *
@@ -33036,7 +33039,8 @@ export declare class ApiKeys {
   /**
    * Update an API key
    *
-   * Rename an API key or replace its capability set. The scope (project vs account) is immutable.
+   * Rename an API key or replace its capability set; the change holds from the key's next call. The scope (project vs account) is immutable. A narrowed caller may set only a non-empty subset of its own set (`403`).
+   *
    */
   static updateApiKey<ThrowOnError extends boolean = false>(options: Options<UpdateApiKeyData, ThrowOnError>): RequestResult<UpdateApiKeyResponses, UpdateApiKeyErrors, ThrowOnError>;
   /**

package/dist/index.mjs

@@ -1587,7 +1587,8 @@ var ApiKeys = class {
 	/**
 	* Create an API key
 	*
-	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
+	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows the key to the operations whose capability it names; empty, the key reaches whatever its holder's membership reaches. Omitted, it is empty, or the caller's own set when the caller is a narrowed key. An unknown capability is `400`. The raw `key` (nat_sk_…) is returned only in this response.
+	* A narrowed key may grant only a non-empty subset of its own set: a wider or empty set is `403`, on update too, and so is rotating a key wider than it.
 	* A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
 	* A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
 	*
@@ -1632,7 +1633,8 @@ var ApiKeys = class {
 	/**
 	* Update an API key
 	*
-	* Rename an API key or replace its capability set. The scope (project vs account) is immutable.
+	* Rename an API key or replace its capability set; the change holds from the key's next call. The scope (project vs account) is immutable. A narrowed caller may set only a non-empty subset of its own set (`403`).
+	*
 	*/
 	static updateApiKey(options) {
 		return (options.client ?? client).patch({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/sdk",
-  "version": "0.210.1",
+  "version": "0.211.0",
   "description": "TypeScript SDK for the naturali.ai API, generated from its OpenAPI specs",
   "keywords": [
     "naturali",
@@ -38,7 +38,7 @@
   },
   "devDependencies": {
     "@hey-api/openapi-ts": "^0.99.0",
-    "@naturali/api": "0.210.1",
+    "@naturali/api": "0.211.0",
     "@ttoss/openapi-codegen": "^0.10.0",
     "@types/node": "^26.5.1",
     "tsdown": "^0.23.0",