@run402/sdk 4.95.0 → 4.97.0

package/dist/namespaces/grants.d.ts

@@ -1,27 +1,61 @@
 /**
- * `grants` namespace — per-project capability grants for non-member
- * (agent / CI) principals (gateway `org-member-management`). Issue or revoke a
- * grant against `/projects/v1/:project_id/grants`. Mutations require the caller
- * to be an active owner of the project's owning org.
+ * `grants` namespace — per-project capability grants and the grant keys minted
+ * against them.
  *
+ * A grant is the permission row (this principal may do this capability on this
+ * project until this date). A grant key is a credential minted against exactly
+ * one grant: narrower than it, spend-capped, expiring, revocable on its own,
+ * never an owner. An agent with its own wallet needs only the grant (it signs
+ * via SIWX); an agent without one gets a grant key.
+ *
+ * The practical reason keys exist on the client: project API keys are
+ * stateless JWTs handed out once at create and never re-issued, so an agent
+ * that loses local state has no way back into its own project. The owner still
+ * holds a wallet, and SIWX is enough to mint a fresh grant key.
+ *
+ * Every call requires the caller to be an active owner of the project's org.
  * Exposed both unscoped (`r.grants.create(projectId, …)`) and project-scoped
  * (`r.project(id).grants.create(…)`), mirroring `r.functions` / `r.jobs`.
  */
 import type { Client } from "../kernel.js";
-import type { CreateGrantInput, GrantCreateResult, GrantRevokeResult } from "./grants.types.js";
+import type { CreateGrantInput, GrantCreateResult, GrantKeyCreateResult, GrantKeyInput, GrantKeyRevokeResult, GrantKeyRotateResult, GrantListResult, GrantRevokeResult } from "./grants.types.js";
 export declare class Grants {
     private readonly client;
     constructor(client: Client);
     /**
      * Issue a capability grant to a wallet for a project
-     * (`POST /projects/v1/:project_id/grants`). Requires owner of the project's org.
+     * (`POST /projects/v1/:project_id/grants`). With `key`, also mints the
+     * grant's first grant key in the same transaction; its `key.token` is
+     * returned **once** — persist it immediately, or rotate for a new one.
      */
     create(projectId: string, input: CreateGrantInput): Promise<GrantCreateResult>;
     /**
-     * Revoke a capability grant
-     * (`DELETE /projects/v1/:project_id/grants/:grant_id`). Requires owner of the
-     * project's org.
+     * List a project's grants with their grant keys nested
+     * (`GET /projects/v1/:project_id/grants`). Never returns a token or any
+     * secret material.
+     */
+    list(projectId: string): Promise<GrantListResult>;
+    /**
+     * Revoke a capability grant and every grant key minted against it
+     * (`DELETE /projects/v1/:project_id/grants/:grant_id`).
      */
     revoke(projectId: string, grantId: string): Promise<GrantRevokeResult>;
+    /**
+     * Mint another grant key against an existing grant
+     * (`POST /projects/v1/:project_id/grants/:grant_id/keys`). `key.token` is
+     * returned **once**.
+     */
+    createKey(projectId: string, grantId: string, input?: GrantKeyInput): Promise<GrantKeyCreateResult>;
+    /**
+     * Revoke one grant key (`DELETE /projects/v1/:project_id/grant-keys/:key_id`).
+     * The grant and its other keys stay.
+     */
+    revokeKey(projectId: string, keyId: string): Promise<GrantKeyRevokeResult>;
+    /**
+     * Replace a grant key (`POST /projects/v1/:project_id/grant-keys/:key_id/rotate`):
+     * revokes it and mints a fresh one against the same grant with the same
+     * kind, scope, cap and expiry. The new `key.token` is returned **once**.
+     */
+    rotateKey(projectId: string, keyId: string): Promise<GrantKeyRotateResult>;
 }
 //# sourceMappingURL=grants.d.ts.map

package/dist/namespaces/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/namespaces/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAE3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAsBpF;;;;OAIG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAY7E"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/namespaces/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAgB3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;;OAKG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAwBpF;;;;OAIG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAUvD;;;OAGG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAa5E;;;;OAIG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,aAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAa7G;;;OAGG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAahF;;;;OAIG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAYjF"}

package/dist/namespaces/grants.js

@@ -1,13 +1,40 @@
 /**
- * `grants` namespace — per-project capability grants for non-member
- * (agent / CI) principals (gateway `org-member-management`). Issue or revoke a
- * grant against `/projects/v1/:project_id/grants`. Mutations require the caller
- * to be an active owner of the project's owning org.
+ * `grants` namespace — per-project capability grants and the grant keys minted
+ * against them.
  *
+ * A grant is the permission row (this principal may do this capability on this
+ * project until this date). A grant key is a credential minted against exactly
+ * one grant: narrower than it, spend-capped, expiring, revocable on its own,
+ * never an owner. An agent with its own wallet needs only the grant (it signs
+ * via SIWX); an agent without one gets a grant key.
+ *
+ * The practical reason keys exist on the client: project API keys are
+ * stateless JWTs handed out once at create and never re-issued, so an agent
+ * that loses local state has no way back into its own project. The owner still
+ * holds a wallet, and SIWX is enough to mint a fresh grant key.
+ *
+ * Every call requires the caller to be an active owner of the project's org.
  * Exposed both unscoped (`r.grants.create(projectId, …)`) and project-scoped
  * (`r.project(id).grants.create(…)`), mirroring `r.functions` / `r.jobs`.
  */
 import { LocalError } from "../errors.js";
+function grantKeyBody(input) {
+    const body = {};
+    if (input.kind !== undefined)
+        body.kind = input.kind;
+    if (input.scope !== undefined)
+        body.scope = input.scope;
+    if (input.spendCap !== undefined)
+        body.spend_cap = input.spendCap;
+    if (input.expiresAt !== undefined)
+        body.expires_at = input.expiresAt;
+    if (input.publicSubject !== undefined)
+        body.public_subject = input.publicSubject;
+    return body;
+}
+function projectPath(projectId) {
+    return `/projects/v1/${encodeURIComponent(projectId)}`;
+}
 export class Grants {
     client;
     constructor(client) {
@@ -15,7 +42,9 @@ export class Grants {
     }
     /**
      * Issue a capability grant to a wallet for a project
-     * (`POST /projects/v1/:project_id/grants`). Requires owner of the project's org.
+     * (`POST /projects/v1/:project_id/grants`). With `key`, also mints the
+     * grant's first grant key in the same transaction; its `key.token` is
+     * returned **once** — persist it immediately, or rotate for a new one.
      */
     async create(projectId, input) {
         if (!projectId) {
@@ -35,12 +64,31 @@ export class Grants {
             body.policy = input.policy;
         if (input.expiresAt !== undefined)
             body.expires_at = input.expiresAt;
-        return this.client.request(`/projects/v1/${encodeURIComponent(projectId)}/grants`, { method: "POST", body, context: "creating project grant" });
+        if (input.key !== undefined)
+            body.key = grantKeyBody(input.key);
+        return this.client.request(`${projectPath(projectId)}/grants`, {
+            method: "POST",
+            body,
+            context: "creating project grant",
+        });
+    }
+    /**
+     * List a project's grants with their grant keys nested
+     * (`GET /projects/v1/:project_id/grants`). Never returns a token or any
+     * secret material.
+     */
+    async list(projectId) {
+        if (!projectId) {
+            throw new LocalError("grants.list requires a projectId", "listing project grants");
+        }
+        return this.client.request(`${projectPath(projectId)}/grants`, {
+            method: "GET",
+            context: "listing project grants",
+        });
     }
     /**
-     * Revoke a capability grant
-     * (`DELETE /projects/v1/:project_id/grants/:grant_id`). Requires owner of the
-     * project's org.
+     * Revoke a capability grant and every grant key minted against it
+     * (`DELETE /projects/v1/:project_id/grants/:grant_id`).
      */
     async revoke(projectId, grantId) {
         if (!projectId) {
@@ -49,7 +97,48 @@ export class Grants {
         if (!grantId) {
             throw new LocalError("grants.revoke requires a grantId", "revoking project grant");
         }
-        return this.client.request(`/projects/v1/${encodeURIComponent(projectId)}/grants/${encodeURIComponent(grantId)}`, { method: "DELETE", context: "revoking project grant" });
+        return this.client.request(`${projectPath(projectId)}/grants/${encodeURIComponent(grantId)}`, { method: "DELETE", context: "revoking project grant" });
+    }
+    /**
+     * Mint another grant key against an existing grant
+     * (`POST /projects/v1/:project_id/grants/:grant_id/keys`). `key.token` is
+     * returned **once**.
+     */
+    async createKey(projectId, grantId, input = {}) {
+        if (!projectId) {
+            throw new LocalError("grants.createKey requires a projectId", "minting grant key");
+        }
+        if (!grantId) {
+            throw new LocalError("grants.createKey requires a grantId", "minting grant key");
+        }
+        return this.client.request(`${projectPath(projectId)}/grants/${encodeURIComponent(grantId)}/keys`, { method: "POST", body: grantKeyBody(input), context: "minting grant key" });
+    }
+    /**
+     * Revoke one grant key (`DELETE /projects/v1/:project_id/grant-keys/:key_id`).
+     * The grant and its other keys stay.
+     */
+    async revokeKey(projectId, keyId) {
+        if (!projectId) {
+            throw new LocalError("grants.revokeKey requires a projectId", "revoking grant key");
+        }
+        if (!keyId) {
+            throw new LocalError("grants.revokeKey requires a keyId", "revoking grant key");
+        }
+        return this.client.request(`${projectPath(projectId)}/grant-keys/${encodeURIComponent(keyId)}`, { method: "DELETE", context: "revoking grant key" });
+    }
+    /**
+     * Replace a grant key (`POST /projects/v1/:project_id/grant-keys/:key_id/rotate`):
+     * revokes it and mints a fresh one against the same grant with the same
+     * kind, scope, cap and expiry. The new `key.token` is returned **once**.
+     */
+    async rotateKey(projectId, keyId) {
+        if (!projectId) {
+            throw new LocalError("grants.rotateKey requires a projectId", "rotating grant key");
+        }
+        if (!keyId) {
+            throw new LocalError("grants.rotateKey requires a keyId", "rotating grant key");
+        }
+        return this.client.request(`${projectPath(projectId)}/grant-keys/${encodeURIComponent(keyId)}/rotate`, { method: "POST", context: "rotating grant key" });
     }
 }
 //# sourceMappingURL=grants.js.map

package/dist/namespaces/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/namespaces/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAO1C,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,KAAuB;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,oCAAoC,EAAE,wBAAwB,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,UAAU,CAAC,mCAAmC,EAAE,wBAAwB,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,wBAAwB,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,IAAI,GAA4B;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3D,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACrE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,SAAS,EACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAC5D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,OAAe;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,oCAAoC,EAAE,wBAAwB,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,kCAAkC,EAAE,wBAAwB,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,WAAW,kBAAkB,CAAC,OAAO,CAAC,EAAE,EACrF,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE,CACxD,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/namespaces/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAY1C,SAAS,YAAY,CAAC,KAAoB;IACxC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACrD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;IAClE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IACrE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,aAAa,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,KAAuB;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,oCAAoC,EAAE,wBAAwB,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,UAAU,CAAC,mCAAmC,EAAE,wBAAwB,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,wBAAwB,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,IAAI,GAA4B;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3D,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACrE,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAoB,GAAG,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,OAAO,EAAE,wBAAwB;SAClC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,kCAAkC,EAAE,wBAAwB,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAkB,GAAG,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE;YAC9E,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,wBAAwB;SAClC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,OAAe;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,oCAAoC,EAAE,wBAAwB,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,kCAAkC,EAAE,wBAAwB,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,GAAG,WAAW,CAAC,SAAS,CAAC,WAAW,kBAAkB,CAAC,OAAO,CAAC,EAAE,EACjE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE,CACxD,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,OAAe,EAAE,QAAuB,EAAE;QAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,mBAAmB,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,qCAAqC,EAAE,mBAAmB,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,GAAG,WAAW,CAAC,SAAS,CAAC,WAAW,kBAAkB,CAAC,OAAO,CAAC,OAAO,EACtE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAC5E,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,KAAa;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,oBAAoB,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,UAAU,CAAC,mCAAmC,EAAE,oBAAoB,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,GAAG,WAAW,CAAC,SAAS,CAAC,eAAe,kBAAkB,CAAC,KAAK,CAAC,EAAE,EACnE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,CACpD,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,KAAa;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,oBAAoB,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,UAAU,CAAC,mCAAmC,EAAE,oBAAoB,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,GAAG,WAAW,CAAC,SAAS,CAAC,eAAe,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAC1E,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAClD,CAAC;IACJ,CAAC;CACF"}

package/dist/namespaces/grants.types.d.ts

@@ -1,22 +1,55 @@
 /**
  * Request/response types for the `grants` namespace — per-project capability
- * grants for non-member (agent / CI) principals (gateway `org-member-management`).
- * Maps to `POST` / `DELETE /projects/v1/:project_id/grants`. Mutations require
- * the caller to be an active owner of the project's org.
+ * grants and the grant keys minted against them.
+ *
+ * A **grant** is the permission row: this principal may do this capability on
+ * this project until this date. A **grant key** is a credential minted against
+ * exactly one grant, narrower than it (scope, spend cap, expiry), revocable on
+ * its own, and never an owner. A grant may hold no key (the agent signs with
+ * its own wallet via SIWX), one, or several. Revoking a key leaves the grant;
+ * revoking the grant kills every key.
+ *
+ * Maps to `/projects/v1/:project_id/grants[...]` and
+ * `/projects/v1/:project_id/grant-keys/:key_id[...]`. Every call requires the
+ * caller to be an active owner of the project's org.
  */
-/** A per-project capability grant (`internal.project_grants`). */
-export interface ProjectGrant {
-    id: string;
-    project_id: string;
-    principal_id: string;
-    /** e.g. `"deploy"`, `"functions:write"`. */
-    capability: string;
-    policy: Record<string, unknown>;
-    expires_at: string | null;
-    revoked_at: string | null;
-    created_at: string;
+/** Grant-key kinds. Only `run402_agent_key` returns a bearer `token`. */
+export type GrantKeyKind = "run402_agent_key" | "ci_oidc" | "tempo_access_key" | "base_disposable_eoa" | "erc7710";
+/**
+ * Grant-key scope (`scope` JSONB). Always a subset of the grant: a key never
+ * widens it. Omit to take the grant's own capability.
+ */
+export interface GrantKeyScope {
+    /** Schema version. Must be `1`. */
+    v: 1;
+    /** Non-empty capability list, e.g. `["deploy"]`. */
+    capabilities: string[];
+    /** Optional project allowlist. Defaults to the issuing project. */
+    projects?: string[];
     [key: string]: unknown;
 }
+/** Spend cap (`spend_cap` JSONB). Required for the payment-rail kinds; enforced at send time. */
+export interface GrantKeySpendCap {
+    v: 1;
+    currency: "usd_micros";
+    period?: "day" | "week" | "month";
+    per_tx?: number;
+    per_period?: number;
+    [key: string]: unknown;
+}
+/** A grant-key request: every field optional; `{}` takes every default. */
+export interface GrantKeyInput {
+    /** Defaults to `"run402_agent_key"` (the bearer an agent holds). */
+    kind?: GrantKeyKind;
+    /** Defaults to the grant's own capability. */
+    scope?: GrantKeyScope;
+    /** Spend cap (payment-rail kinds). */
+    spendCap?: GrantKeySpendCap | null;
+    /** ISO-8601 expiry; omit or `null` for none beyond the grant's. */
+    expiresAt?: string | null;
+    /** Rail-specific public subject. */
+    publicSubject?: string;
+}
 /** Input to {@link Grants.create}. */
 export interface CreateGrantInput {
     /** EVM address (or named wallet) the grant is issued to. */
@@ -27,12 +60,63 @@ export interface CreateGrantInput {
     policy?: Record<string, unknown>;
     /** Optional ISO-8601 expiry. Omit for a non-expiring grant. */
     expiresAt?: string;
+    /**
+     * Also mint the grant's first grant key in the same transaction. The key's
+     * `token` is returned ONCE in `key.token`.
+     */
+    key?: GrantKeyInput;
 }
-/** Result of {@link Grants.create} (`{ status:"ok", grant_id, principal_id }`). */
+/**
+ * A freshly minted grant key. `token` is the `run402_agent_key` bearer,
+ * returned **once** and never again; `null` for kinds that carry no bearer.
+ */
+export interface MintedGrantKey {
+    key_id: string;
+    kind: GrantKeyKind | (string & {});
+    token: string | null;
+    expires_at: string | null;
+    [key: string]: unknown;
+}
+/** Result of {@link Grants.create} (`{ status:"ok", grant_id, principal_id, key? }`). */
 export interface GrantCreateResult {
     status: string;
     grant_id: string;
     principal_id: string;
+    /** Present when a key was requested. */
+    key?: MintedGrantKey;
+    [key: string]: unknown;
+}
+/** A grant key as listed — never a token or secret material. */
+export interface GrantKey {
+    key_id: string;
+    grant_id: string;
+    kind: GrantKeyKind;
+    principal_id: string;
+    public_subject: string | null;
+    scope: Record<string, unknown>;
+    spend_cap: Record<string, unknown> | null;
+    expires_at: string | null;
+    revoked_at: string | null;
+    created_at: string;
+    [key: string]: unknown;
+}
+/** A per-project capability grant with its grant keys nested. */
+export interface ProjectGrant {
+    grant_id: string;
+    principal_id: string;
+    wallet: string | null;
+    /** e.g. `"deploy"`, `"functions:write"`. */
+    capability: string;
+    policy: Record<string, unknown>;
+    expires_at: string | null;
+    revoked_at: string | null;
+    created_at: string;
+    keys: GrantKey[];
+    [key: string]: unknown;
+}
+/** Result of {@link Grants.list}. */
+export interface GrantListResult {
+    grants: ProjectGrant[];
     [key: string]: unknown;
 }
 /** Result of {@link Grants.revoke} (`{ status:"revoked", grant_id }`). */
@@ -41,4 +125,25 @@ export interface GrantRevokeResult {
     grant_id: string;
     [key: string]: unknown;
 }
+/** Result of {@link Grants.createKey} (`{ status:"ok", grant_id, key }`). */
+export interface GrantKeyCreateResult {
+    status: string;
+    grant_id: string;
+    key: MintedGrantKey;
+    [key: string]: unknown;
+}
+/** Result of {@link Grants.revokeKey} (`{ status:"revoked", key_id }`). */
+export interface GrantKeyRevokeResult {
+    status: string;
+    key_id: string;
+    [key: string]: unknown;
+}
+/** Result of {@link Grants.rotateKey} (`{ status:"rotated", replaced_key_id, grant_id, key }`). */
+export interface GrantKeyRotateResult {
+    status: string;
+    replaced_key_id: string;
+    grant_id: string;
+    key: MintedGrantKey;
+    [key: string]: unknown;
+}
 //# sourceMappingURL=grants.types.d.ts.map

package/dist/namespaces/grants.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.types.d.ts","sourceRoot":"","sources":["../../src/namespaces/grants.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}
+{"version":3,"file":"grants.types.d.ts","sourceRoot":"","sources":["../../src/namespaces/grants.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,yEAAyE;AACzE,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,SAAS,GACT,kBAAkB,GAClB,qBAAqB,GACrB,SAAS,CAAC;AAEd;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,oDAAoD;IACpD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnC,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oCAAoC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,GAAG,CAAC,EAAE,aAAa,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,yFAAyF;AACzF,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,cAAc,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,mGAAmG;AACnG,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,cAAc,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/dist/namespaces/grants.types.js

@@ -1,8 +1,17 @@
 /**
  * Request/response types for the `grants` namespace — per-project capability
- * grants for non-member (agent / CI) principals (gateway `org-member-management`).
- * Maps to `POST` / `DELETE /projects/v1/:project_id/grants`. Mutations require
- * the caller to be an active owner of the project's org.
+ * grants and the grant keys minted against them.
+ *
+ * A **grant** is the permission row: this principal may do this capability on
+ * this project until this date. A **grant key** is a credential minted against
+ * exactly one grant, narrower than it (scope, spend cap, expiry), revocable on
+ * its own, and never an owner. A grant may hold no key (the agent signs with
+ * its own wallet via SIWX), one, or several. Revoking a key leaves the grant;
+ * revoking the grant kills every key.
+ *
+ * Maps to `/projects/v1/:project_id/grants[...]` and
+ * `/projects/v1/:project_id/grant-keys/:key_id[...]`. Every call requires the
+ * caller to be an active owner of the project's org.
  */
 export {};
 //# sourceMappingURL=grants.types.js.map

package/dist/namespaces/grants.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.types.js","sourceRoot":"","sources":["../../src/namespaces/grants.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}
+{"version":3,"file":"grants.types.js","sourceRoot":"","sources":["../../src/namespaces/grants.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/namespaces/identity-links.types.d.ts

@@ -51,11 +51,11 @@ export type AuthoritySnapshot = {
     grant_id: string;
     scope: string[];
 } | {
-    kind: "delegate";
+    kind: "grant_key";
     organization_id: string;
     project_id: string;
     grant_id: string;
-    delegate_id: string;
+    grant_key_id: string;
     scope: string[];
 } | {
     kind: "ci";

package/dist/namespaces/identity-links.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-links.types.d.ts","sourceRoot":"","sources":["../../src/namespaces/identity-links.types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,4BAA4B;IAC3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EACV,+BAA+B,GAC/B,qCAAqC,GACrC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAClB,IAAI,EAAE,aAAa,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,oBAAoB,CAAC;IAC9D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,iCAAiC;IAChD,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,QAAQ,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpE,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,4BAA4B,EAAE,sBAAsB,EAAE,CAAC;CACxD;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,yBAAyB,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjG;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACzG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACzH;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAClF;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAE7C,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,CAAC,CAAC;IAClB,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC5C,SAAS,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,qBAAqB;IACpC,0BAA0B,EAAE,MAAM,CAAC;IACnC,cAAc,EAAE,+BAA+B,CAAC;IAChD,UAAU,EAAE,QAAQ,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE;QACV,UAAU,EAAE,oBAAoB,CAAC;QACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,oBAAoB,CAAC;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;KACrE,CAAC;IACF,mBAAmB,EAAE;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;KACrE,CAAC;IACF,WAAW,EAAE,YAAY,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACrE,cAAc,EAAE,+BAA+B,CAAC;IAChD,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,sCAAsC;IACrD,cAAc,EAAE,CAAC,CAAC;IAClB,kBAAkB,EAAE,uBAAuB,GAAG,qBAAqB,CAAC;IACpE,kBAAkB,EAAE,iBAAiB,CAAC;IACtC,cAAc,EAAE,iBAAiB,GAAG,wBAAwB,CAAC;IAC7D,aAAa,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACrE,cAAc,EAAE,qCAAqC,CAAC;IACtD,cAAc,EAAE,IAAI,CAAC;IACrB,gBAAgB,EAAE,IAAI,CAAC;IACvB,sBAAsB,EAAE,sCAAsC,CAAC;CAChE;AAED,sFAAsF;AACtF,MAAM,MAAM,iBAAiB,GAAG,sBAAsB,GAAG,sBAAsB,CAAC;AAEhF,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,4BAA4B,EAAE,CAAC;IAC/C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B"}
+{"version":3,"file":"identity-links.types.d.ts","sourceRoot":"","sources":["../../src/namespaces/identity-links.types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,4BAA4B;IAC3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EACV,+BAA+B,GAC/B,qCAAqC,GACrC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAClB,IAAI,EAAE,aAAa,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,oBAAoB,CAAC;IAC9D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,iCAAiC;IAChD,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,QAAQ,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpE,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,4BAA4B,EAAE,sBAAsB,EAAE,CAAC;CACxD;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,yBAAyB,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjG;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACzG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3H;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAClF;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAE7C,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,CAAC,CAAC;IAClB,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC5C,SAAS,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,qBAAqB;IACpC,0BAA0B,EAAE,MAAM,CAAC;IACnC,cAAc,EAAE,+BAA+B,CAAC;IAChD,UAAU,EAAE,QAAQ,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE;QACV,UAAU,EAAE,oBAAoB,CAAC;QACjC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;IAC1E,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,oBAAoB,CAAC;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;KACrE,CAAC;IACF,mBAAmB,EAAE;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;KACrE,CAAC;IACF,WAAW,EAAE,YAAY,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACrE,cAAc,EAAE,+BAA+B,CAAC;IAChD,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,sCAAsC;IACrD,cAAc,EAAE,CAAC,CAAC;IAClB,kBAAkB,EAAE,uBAAuB,GAAG,qBAAqB,CAAC;IACpE,kBAAkB,EAAE,iBAAiB,CAAC;IACtC,cAAc,EAAE,iBAAiB,GAAG,wBAAwB,CAAC;IAC7D,aAAa,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACrE,cAAc,EAAE,qCAAqC,CAAC;IACtD,cAAc,EAAE,IAAI,CAAC;IACrB,gBAAgB,EAAE,IAAI,CAAC;IACvB,sBAAsB,EAAE,sCAAsC,CAAC;CAChE;AAED,sFAAsF;AACtF,MAAM,MAAM,iBAAiB,GAAG,sBAAsB,GAAG,sBAAsB,CAAC;AAEhF,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,4BAA4B,EAAE,CAAC;IAC/C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B"}

package/dist/namespaces/org.d.ts

@@ -38,11 +38,11 @@ export declare class OrgMembers {
      */
     revoke(principalId: string): Promise<MemberRevokeResult>;
     /**
-     * gitvault-agent-envelopes D3 — an OWNER revokes a member's current gitvault
+     * vault-agent-envelopes D3 — an OWNER revokes a member's current vault
      * encryption key (`DELETE /orgs/v1/:org_id/members/:principal_id/encryption-key`,
      * owner + step-up). The independent-credential rotation path: a member whose
      * keystore was lost or rebuilt cannot self-rotate (the asking credential is
-     * the one a thief would hold); after this, the member's next gitvault
+     * the one a thief would hold); after this, the member's next vault
      * operation enrolls its current keystore key afresh and a key-holder's next
      * operation wraps each vault to it. Audited, org-feed row + mandatory
      * security notification (`gitvault_encryption_key_revoked`).
@@ -254,7 +254,7 @@ export declare class Orgs {
      * Set the caller's own display name (`PATCH /agent/v1/me`) — the name
      * promotion credit (`hand_to_member.credited_as`), `up`'s room presence,
      * and audit surfaces show for this principal. 1–64 characters after
-     * trimming, no control characters. Self-only: a delegate names the
+     * trimming, no control characters. Self-only: a grant key names the
      * principal it acts for. Returns the same body `whoami()` returns.
      */
     setDisplayName(displayName: string): Promise<WhoAmIResult>;

package/dist/namespaces/org.js

@@ -75,11 +75,11 @@ export class OrgMembers {
         return this.client.request(`/orgs/v1/${encodeURIComponent(this.orgId)}/members/${encodeURIComponent(principalId)}`, { method: "DELETE", context: "revoking org member" });
     }
     /**
-     * gitvault-agent-envelopes D3 — an OWNER revokes a member's current gitvault
+     * vault-agent-envelopes D3 — an OWNER revokes a member's current vault
      * encryption key (`DELETE /orgs/v1/:org_id/members/:principal_id/encryption-key`,
      * owner + step-up). The independent-credential rotation path: a member whose
      * keystore was lost or rebuilt cannot self-rotate (the asking credential is
-     * the one a thief would hold); after this, the member's next gitvault
+     * the one a thief would hold); after this, the member's next vault
      * operation enrolls its current keystore key afresh and a key-holder's next
      * operation wraps each vault to it. Audited, org-feed row + mandatory
      * security notification (`gitvault_encryption_key_revoked`).
@@ -336,7 +336,7 @@ export class Orgs {
      * Set the caller's own display name (`PATCH /agent/v1/me`) — the name
      * promotion credit (`hand_to_member.credited_as`), `up`'s room presence,
      * and audit surfaces show for this principal. 1–64 characters after
-     * trimming, no control characters. Self-only: a delegate names the
+     * trimming, no control characters. Self-only: a grant key names the
      * principal it acts for. Returns the same body `whoami()` returns.
      */
     async setDisplayName(displayName) {

package/dist/namespaces/org.types.d.ts

@@ -199,10 +199,10 @@ export interface MemberMutationResult {
     principal_id: string;
     role: OrgRole;
     /**
-     * gitvault-agent-envelopes D6 — the new member's vault-custody state,
+     * vault-agent-envelopes D6 — the new member's vault-custody state,
      * folded in so the caller never has to ask: `enrolled_pending_wrap` (an
-     * active key; a key-holder's next gitvault operation wraps each vault),
-     * `not_enrolled` (the MEMBER's next gitvault operation enrolls its
+     * active key; a key-holder's next vault operation wraps each vault),
+     * `not_enrolled` (the MEMBER's next vault operation enrolls its
      * keystore key), `not_applicable` (`ci`).
      */
     envelope?: {

package/dist/namespaces/pay.js

@@ -196,7 +196,7 @@ export function isPaymentBuyerError(error) {
 }
 /**
  * Duck-typed Response check: the buyer's transport may hand back npm
- * undici's Response (gitvault-owned-dispatcher), which is not an instance
+ * undici's Response (vault-owned-dispatcher), which is not an instance
  * of the GLOBAL Response class even though it satisfies the same contract.
  */
 function isResponseLike(value) {

package/dist/namespaces/projects.d.ts

@@ -100,7 +100,7 @@ export declare class Projects {
      * List redacted tenant x402 payment records for priced function web routes
      * (`GET /projects/v1/:project_id/tenant-payments`). Requires
      * project.tenant_payments.read server-side: org developer+ or read-scoped
-     * project grant/delegate.
+     * project grant or grant key.
      */
     listTenantPayments(projectId: string, opts?: ListTenantPaymentsOptions): Promise<TenantPaymentListResult>;
     /**

package/dist/namespaces/projects.js

@@ -232,7 +232,7 @@ export class Projects {
      * List redacted tenant x402 payment records for priced function web routes
      * (`GET /projects/v1/:project_id/tenant-payments`). Requires
      * project.tenant_payments.read server-side: org developer+ or read-scoped
-     * project grant/delegate.
+     * project grant or grant key.
      */
     async listTenantPayments(projectId, opts = {}) {
         const qs = new URLSearchParams();