@rosthq/cli 0.7.114 → 0.7.115

package/dist/index.js

@@ -39870,6 +39870,8 @@ var tenantCapabilityGrantDtoSchema = external_exports.object({
   default_agent_access_level: capabilityGrantAccessLevelSchema,
   compile_status: capabilityGrantCompileStatusSchema
 }).strict();
+var capabilityGrantGrantSourceSchema = external_exports.enum(["charter", "template"]);
+var capabilityGrantCeilingSourceSchema = external_exports.enum(["tenant_policy", "unset"]);
 var agentEffectiveCapabilityGrantDtoSchema = external_exports.object({
   tool_grant_id: uuidSchema5,
   agent_tool_grant_id: uuidSchema5.nullable(),
@@ -39879,6 +39881,8 @@ var agentEffectiveCapabilityGrantDtoSchema = external_exports.object({
   availability: capabilityGrantAvailabilitySchema,
   source: capabilityGrantSourceSchema,
   selection_source: capabilityGrantSourceSchema.nullable(),
+  grant_source: capabilityGrantGrantSourceSchema.nullable(),
+  ceiling_source: capabilityGrantCeilingSourceSchema,
   max_access_level: capabilityGrantAccessLevelSchema,
   default_agent_access_level: capabilityGrantAccessLevelSchema,
   selected_access_level: capabilityGrantAccessLevelSchema,
@@ -48853,7 +48857,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-20.1",
+    version: "2026-07-21.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -49593,7 +49597,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_list_tool_catalog\` | \`tool.catalog\` | List the discoverable tool catalog the agent builder reads \u2014 id, prescriptive description, scope tiers, credential requirement, access policy, and execution-boundary guidance. | Tenant | Call with \`{}\` or \`{"provider":"google"}\`. |
 | \`rost_list_tenant_capability_grants\` | \`tool_grants.tenant.list\` | List tenant capability ceilings/defaults with connection, availability, source, and compile status. | Tenant | Call with \`{}\`; no secrets or vault refs. |
 | \`rost_update_tenant_capability_policy\` | \`tool_grants.tenant.update\` | Change tenant-wide capability ceilings/defaults with optimistic policy version or digest protection. | Tenant-admin | Human-gated; call with \`expected_policy_version\` or \`expected_policy_digest\`, \`mode\`, and grant ceiling changes. Returns changed grants, clamped defaults, and affected live agents. |
-| \`rost_list_agent_effective_capability_grants\` | \`tool_grants.agent.effective\` | Read one agent's effective capability grants after tenant ceilings, agent selections, and compile availability are applied. | Tenant | Call with \`{"agent_id":"<agent-id>"}\`. |
+| \`rost_list_agent_effective_capability_grants\` | \`tool_grants.agent.effective\` | Read one agent's effective capability grants as a projection of the signed Charter manifest clamped by the tenant ceiling. Each grant carries provenance: \`grant_source\` (\`charter\` when the selected access comes from the signed manifest, else \`null\`) and \`ceiling_source\` (\`tenant_policy\`). This is the same computation the seat's Tools tab and the activation receipt project from, so the three agree \u2014 a charter-granted capability reads as granted, never a bare \`off\`. | Tenant | Call with \`{"agent_id":"<agent-id>"}\`. |
 | \`rost_update_agent_capability_grants\` | \`tool_grants.agent.update\` | Compile a Charter supersession proposal for agent capability grant reductions or expansions. | Tenant | Human steward/admin only; call with \`{"agent_id":"<agent-id>","grants":[{"tool_grant_id":"<grant-id>","access_level":"read"}]}\`; active authority changes only after the signed Charter is superseded. |
 | \`rost_build_agent_activation_receipt\` | \`agent.activation_receipt\` | Build the current activation receipt for an agent: capabilities, connection metadata, digest, budget, and always-human boundary. | Seat or tenant-admin | Call with \`{"agent_id":"<agent-id>"}\`; rebuild after Charter, connection, lane, schedule, or grant changes. |
 | \`rost_sign_agent_activation_receipt\` | \`agent.activation_sign\` | Human steward/admin sign-off for the exact activation receipt digest. | Tenant | Human-gated; call with \`{"agent_id":"<agent-id>","expected_scope_digest":"sha256:...","budget_cents":2500}\`. |