@vibiz/sdk 0.2.0 → 0.2.1

package/dist/client.d.ts

@@ -1,4 +1,9 @@
 import type { ActionInfo, ActionResult, ActionRun, ActionRunList, ActionRunsQuery, ActionUsage, AdminMetrics, AiJob, AiModelInfo, AiProviderKey, AiProviderKeyInput, AiProviderKeyList, AiSettings, AnalyticsPeriod, AnalyticsReport, ApiKey, AppKeyInfo, AuthEnvironment, AuthProviderId, AuthProviderInput, AuthSettings, AuthSettingsPatch, Automation, AutomationEnrollment, AutomationInput, AutomationTrigger, Billing, BillingCharge, BillingCheckout, BillingEntry, BillingEntryKind, BillingList, BillingUpdate, Broadcast, BroadcastInput, BroadcastRecipient, BroadcastReview, BroadcastStatus, ChatChunk, ChatCompletion, ChatRequest, Checkout, CheckoutInput, Company, CompanyAddressFields, CompanyCatalog, CompanyDraft, CompanyEnvironment, CompanyLink, Connector, ConnectorApproval, ConnectorCall, ConnectorCallInput, ConnectorCheck, ConnectorEnvironment, ConnectorImport, ConnectorInput, ConnectorPatch, ConnectorResponse, ContactPropertyValue, ContactStatus, DashboardLink, DeployFile, Deployment, DesignSpec, DevEnvironment, Domain, DomainBuyInput, DomainList, DomainOwnerContact, DomainOwnerDetails, DomainQuote, DomainSearch, EmailContact, EmailContactInput, EmailContactList, EmailContactPatch, EmailForwarding, EmailForwardingLog, EmailForwardingRule, EmailImportInput, EmailImportReport, EmailList, EmailMarketing, EmailMarketingPatch, EmailPage, EmailPreview, EmailSegment, EmailTestResult, EnvTargetInfo, ExportInput, FileEnvironment, FileList, FileListOptions, FileUploadOptions, HostKind, ImageRequest, ImageResult, InboxSettings, KeyAccess, LedgerEntry, Mailbox, MailboxInput, MailDomain, MailFolder, MailReplyInput, MailSendInput, MailThreadDetail, MailThreadList, MailView, MetricsReport, Operation, OwnAccountLink, OwnedDomain, OwnedDomainList, Payment, PaymentPrice, PaymentPriceInput, PaymentProduct, PaymentSubscription, PaymentsAccount, PaymentsEnvironment, PaymentsList, PaymentsSimulation, Project, ProjectExport, ReplayDetail, ReplayInsights, ReplayListOptions, ReplayPeriod, ReplayStatus, ReplaySummary, Resource, ResourceType, SegmentFilter, SendEmailInput, SendEmailOutput, SocialAccount, SocialAccountAnalytics, SocialAdCampaign, SocialAdChange, SocialAdChangeInput, SocialConnectLink, SocialEnvironment, SocialMedia, SocialOverview, SocialPost, SocialPostAnalytics, SocialPostInput, SpeechRequest, Transcription, UsageOptions, UsagePeriod, UsageReport, VibizFile, WebDesignInput, WebhookDelivery, WebhookEventType, Withdrawal } from './types.js';
+/**
+ * An error status with no Vibiz error body: a proxy, a load balancer or the
+ * network answered instead of the API. Say so, and what to do.
+ */
+export declare function noBodyMessage(status: number): string;
 export declare class VibizApiError extends Error {
     readonly status: number;
     readonly code: string;
@@ -16,6 +21,8 @@ export interface VibizOptions {
      * not an email.
      */
     user?: string;
+    /** Who is calling, sent as `X-Vibiz-Client` (the CLI: `vibiz-cli/<version>`), so the API can ask an old one to update. */
+    client?: string;
 }
 /**
  * The typed client for the Vibiz Stack API. Used by the CLI, by Principia's
@@ -67,7 +74,7 @@ export declare class Vibiz {
             project_id: string;
             usage: ActionUsage | null;
         }>;
-        /** The production env. Owner keys only: an agent key gets `forbidden` (use `dev`). */
+        /** The production env. Full-access keys only: a Limited key gets `forbidden` (use `dev`). */
         env: (id: string) => Promise<Record<string, string>>;
         /** The production env's variable names, without values. Any key. */
         envNames: (id: string) => Promise<string[]>;
@@ -100,13 +107,13 @@ export declare class Vibiz {
         /** The app key (`vz_app_…`), per environment. The secret itself only ever travels in the env. */
         appKeys: {
             list: (id: string) => Promise<AppKeyInfo[]>;
-            /** Production's needs an owner key. The old key works for `grace_seconds` (default 3600). */
+            /** Production's needs a full-access key. The old key works for `grace_seconds` (default 3600). */
             rotate: (id: string, opts?: {
                 environment?: "production" | "development";
                 grace_seconds?: number;
             }) => Promise<AppKeyInfo>;
         };
-        /** Hosts outside Vibiz that receive the env server to server. Connecting needs an owner key. */
+        /** Hosts outside Vibiz that receive the env server to server. Connecting needs a full-access key. */
         hosts: {
             list: (id: string) => Promise<EnvTargetInfo[]>;
             add: (id: string, input: {
@@ -125,7 +132,7 @@ export declare class Vibiz {
             }) => Promise<EnvTargetInfo>;
         };
         /**
-         * The app's own database. `production` needs an owner key (it holds the
+         * The app's own database. `production` needs a full-access key (it holds the
          * app's users' data); agents read `development`, the default for them.
          */
         database: {
@@ -143,7 +150,7 @@ export declare class Vibiz {
         };
         /**
          * How people sign in to the app (docs/SIGN-IN.md). `production` needs an
-         * owner key; agents work on `development`, the default for them.
+         * full-access key; agents work on `development`, the default for them.
          */
         auth: {
             get: (id: string, env?: AuthEnvironment) => Promise<AuthSettings>;
@@ -160,7 +167,7 @@ export declare class Vibiz {
         /**
          * The business behind the project (docs/COMPANY.md). `env` defaults like
          * the API: production for owners, development for agents. Production
-         * submit, signing, actions and documents need an owner key.
+         * submit, signing, actions and documents need a full-access key.
          */
         company: {
             get: (id: string, env?: CompanyEnvironment) => Promise<Company>;
@@ -174,7 +181,7 @@ export declare class Vibiz {
                 deleted: true;
             }>;
             /**
-             * Production files for real and charges the price: an owner key, `confirm: true`,
+             * Production files for real and charges the price: a full-access key, `confirm: true`,
              * and the `quote.total_cents` and `updated_at` of the draft that was reviewed
              * (a draft or price changed since is refused with a 409, not filed).
              */
@@ -185,7 +192,7 @@ export declare class Vibiz {
                 expected_updated_at?: string;
             }, env?: CompanyEnvironment) => Promise<Company>;
             /**
-             * Pay a live filing by card instead of from the balance (owner keys): the same
+             * Pay a live filing by card instead of from the balance (full-access keys): the same
              * body as `submit`; it is filed when the payment arrives (docs/BILLING.md "Company").
              */
             checkout: (id: string, input: {
@@ -318,7 +325,7 @@ export declare class Vibiz {
          * Payments (docs/PAYMENTS.md): Vibiz is the merchant, so an app sells from
          * its first call. `env` defaults like the API: production for owners,
          * development for agents. On production, refunds, cancels, withdrawing,
-         * payout setup and webhook settings need an owner key.
+         * payout setup and webhook settings need a full-access key.
          */
         payments: {
             get: (id: string, env?: PaymentsEnvironment) => Promise<PaymentsAccount>;
@@ -412,7 +419,7 @@ export declare class Vibiz {
          * Custom connectors (docs/CONNECTORS.md): any HTTP API from one manifest,
          * called through Vibiz, which holds the key. `env` defaults like the API:
          * production for owners, development for agents. Production keys, and
-         * approving an agent's dangerous call, need an owner key.
+         * approving an agent's dangerous call, need a full-access key.
          */
         connectors: {
             list: (id: string) => Promise<Connector[]>;
@@ -429,10 +436,10 @@ export declare class Vibiz {
             }) => Promise<ConnectorImport>;
             update: (id: string, name: string, patch: ConnectorPatch) => Promise<Connector>;
             delete: (id: string, name: string) => Promise<Connector>;
-            /** Set values (`null` removes). Production: owner keys. Values are never read back. */
+            /** Set values (`null` removes). Production: full-access keys. Values are never read back. */
             setSecrets: (id: string, name: string, values: Record<string, string | null>, env?: ConnectorEnvironment) => Promise<Connector>;
             check: (id: string, name: string, env?: ConnectorEnvironment) => Promise<ConnectorCheck>;
-            /** One operation. A dangerous one (or a production write) by an agent key answers 403 approval_required. */
+            /** One operation. A dangerous one (or a production write) by a Limited key answers 403 approval_required. */
             call: <T = unknown>(id: string, name: string, input: ConnectorCallInput, opts?: {
                 env?: ConnectorEnvironment;
                 idempotencyKey?: string;
@@ -446,15 +453,15 @@ export declare class Vibiz {
                 status?: ConnectorApproval["status"];
             }) => Promise<ConnectorApproval[]>;
             approval: (id: string, approvalId: string) => Promise<ConnectorApproval>;
-            /** Owner keys. */
+            /** Full-access keys. */
             approve: (id: string, approvalId: string) => Promise<ConnectorApproval>;
-            /** Owner keys. */
+            /** Full-access keys. */
             deny: (id: string, approvalId: string) => Promise<ConnectorApproval>;
         };
         /**
          * The owner's own domains: served by Vibiz hosting (with HTTPS once DNS
          * points at it) or trusted for a host elsewhere. Adding and removing need
-         * an owner key; any key reads status and asks for a re-check.
+         * a full-access key; any key reads status and asks for a re-check.
          */
         domains: {
             list: (id: string) => Promise<DomainList>;
@@ -468,8 +475,8 @@ export declare class Vibiz {
             verify: (id: string, domain: string) => Promise<Domain>;
             remove: (id: string, domain: string) => Promise<DomainList>;
             /**
-             * Owner keys: buy a domain from the account's credits; it serves on this
-             * project once registered. An agent key answers `owner_only` with the
+             * Full-access keys: buy a domain from the account's credits; it serves on this
+             * project once registered. A Limited key answers `owner_only` with the
              * console link to hand the owner.
              */
             buy: (id: string, input: DomainBuyInput) => Promise<OwnedDomain>;
@@ -546,7 +553,7 @@ export declare class Vibiz {
         /** One of its files, from its signed link (no key sent). */
         download: (url: string) => Promise<Response>;
         /**
-         * The environment's secret values as `.env` text. Owner keys only; the
+         * The environment's secret values as `.env` text. Full-access keys only; the
          * call itself is the confirmation, so only make it when the person asked.
          */
         envFile: (projectId: string, exportId: string) => Promise<string>;
@@ -906,7 +913,7 @@ export declare class Vibiz {
      * Your own AI provider keys (docs/AI.md "Your own keys"): calls they can
      * serve run only on them (never falling back to Vibiz) and cost 0 here.
      * Pass `projectId` for a project's override. Setting and removing need an
-     * owner key. Secrets are write-only: no method returns one.
+     * full-access key. Secrets are write-only: no method returns one.
      */
     readonly aiKeys: {
         list: (opts?: {
@@ -940,7 +947,7 @@ export declare class Vibiz {
     /**
      * Buying domains (docs: buying a domain): search and quote with any key;
      * the domains the account owns, auto-renew, renewals, the transfer code and
-     * the owner details (the registrant, saved once) need an owner key.
+     * the owner details (the registrant, saved once) need a full-access key.
      */
     readonly domains: {
         search: (q: string, opts?: {
@@ -970,7 +977,7 @@ export declare class Vibiz {
         /**
          * Email forwarding (docs: email ▸ Forwarding): `hello@<domain>` → the
          * owner's inbox, sent "via Vibiz". Anyone reads and verifies; `set` and
-         * `off` need an owner key (an agent gets `owner_only` with a console link
+         * `off` need a full-access key (an agent gets `owner_only` with a console link
          * that has its proposal filled in).
          */
         forwarding: {
@@ -1034,7 +1041,7 @@ export declare class Vibiz {
                 folder?: MailFolder;
                 labels?: string[];
             }) => Promise<MailThreadDetail>;
-            /** Owner keys; only from trash or spam. */
+            /** Full-access keys; only from trash or spam. */
             delete: (id: string) => Promise<{
                 object: "mail_thread";
                 id: string;
@@ -1068,7 +1075,7 @@ export declare class Vibiz {
         }>;
         settings: {
             get: () => Promise<InboxSettings>;
-            /** Owner keys: the new-mail digest. */
+            /** Full-access keys: the new-mail digest. */
             update: (input: {
                 digest?: boolean;
             }) => Promise<InboxSettings>;
@@ -1080,7 +1087,7 @@ export declare class Vibiz {
      */
     readonly billing: {
         get: () => Promise<Billing>;
-        /** Owner keys: auto-recharge and the daily safety cap. */
+        /** Full-access keys: auto-recharge and the daily safety cap. */
         update: (input: BillingUpdate) => Promise<Billing>;
         /** A payment page for `amount_cents` (500–100000); hand its `url` to a person. */
         checkout: (input: {
@@ -1088,7 +1095,7 @@ export declare class Vibiz {
             save_card?: boolean;
         }) => Promise<BillingCheckout>;
         checkoutStatus: (id: string) => Promise<BillingCheckout>;
-        /** Owner keys: a page to save or replace the card. */
+        /** Full-access keys: a page to save or replace the card. */
         saveCard: () => Promise<BillingCheckout>;
         removeCard: () => Promise<Billing>;
         ledger: (opts?: {
@@ -1111,13 +1118,18 @@ export declare class Vibiz {
     /** Named keys, one per teammate or agent, so spend shows per person. */
     readonly apiKeys: {
         list: () => Promise<ApiKey[]>;
-        /** The secret is returned once, here. */
-        /** `agent` by default: builds and runs, never reads production secrets. Needs an owner key. */
+        /**
+         * The secret is returned once, here. Full access (`owner`) by default;
+         * `access: 'agent'` makes it Limited (builds and runs, never reads
+         * production secrets nor moves live money). Needs a full-access key.
+         */
         create: (name: string, opts?: {
             access?: KeyAccess;
         }) => Promise<ApiKey & {
             secret: string;
         }>;
+        /** Full access (`owner`) or Limited (`agent`), afterwards. Needs a full-access key, not this one. */
+        setAccess: (id: string, access: KeyAccess) => Promise<ApiKey>;
         revoke: (id: string) => Promise<ApiKey>;
     };
     /** A short-lived link to the hosted usage dashboard (admin scope needs an admin key). */

package/dist/index.js

@@ -1,4 +1,14 @@
 // packages/sdk/src/client.ts
+function noBodyMessage(status) {
+  if (status === 401) return "Not signed in (401): the API key is missing or was revoked.";
+  if (status === 404) return "Not found (404): check the API URL and the id.";
+  if (status === 413) return "Too large (413): send less at once.";
+  if (status === 429) return "Too many requests (429): wait a moment and retry.";
+  if (status >= 500) {
+    return `The Vibiz API did not answer properly (${status}). It is usually brief: retry in a minute.`;
+  }
+  return `The request failed with ${status} and no explanation from the API.`;
+}
 var VibizApiError = class extends Error {
   constructor(status, code, message, details) {
     super(message);
@@ -30,6 +40,7 @@ var Vibiz = class {
     if (init.raw) headers["content-type"] = init.contentType ?? "application/octet-stream";
     if (init.idempotencyKey) headers["idempotency-key"] = init.idempotencyKey;
     if (this.options.user) headers["x-vibiz-user"] = endUserHeader(this.options.user);
+    if (this.options.client) headers["x-vibiz-client"] = this.options.client;
     return this.fetchImpl(`${this.baseUrl}/v1${path}`, {
       method: init.method ?? "GET",
       headers,
@@ -42,7 +53,7 @@ var Vibiz = class {
     throw new VibizApiError(
       res.status,
       e?.code ?? "http_error",
-      e?.message ?? `HTTP ${res.status}`,
+      e?.message ?? noBodyMessage(res.status),
       e?.details
     );
   }
@@ -61,7 +72,7 @@ var Vibiz = class {
       throw new VibizApiError(
         res.status,
         e?.code ?? "http_error",
-        e?.message ?? `HTTP ${res.status}`,
+        e?.message ?? noBodyMessage(res.status),
         e?.details
       );
     }
@@ -102,7 +113,7 @@ var Vibiz = class {
       `/projects/${id}/actions/${name}`,
       { method: "POST", body: { input }, ...opts }
     ),
-    /** The production env. Owner keys only: an agent key gets `forbidden` (use `dev`). */
+    /** The production env. Full-access keys only: a Limited key gets `forbidden` (use `dev`). */
     env: (id) => this.request(`/projects/${id}/env`).then((r) => r.env),
     /** The production env's variable names, without values. Any key. */
     envNames: (id) => this.request(`/projects/${id}/env?names=1`).then((r) => r.names),
@@ -154,10 +165,10 @@ var Vibiz = class {
     /** The app key (`vz_app_…`), per environment. The secret itself only ever travels in the env. */
     appKeys: {
       list: (id) => this.request(`/projects/${id}/app-keys`).then((r) => r.data),
-      /** Production's needs an owner key. The old key works for `grace_seconds` (default 3600). */
+      /** Production's needs a full-access key. The old key works for `grace_seconds` (default 3600). */
       rotate: (id, opts = {}) => this.request(`/projects/${id}/app-keys/rotate`, { method: "POST", body: opts })
     },
-    /** Hosts outside Vibiz that receive the env server to server. Connecting needs an owner key. */
+    /** Hosts outside Vibiz that receive the env server to server. Connecting needs a full-access key. */
     hosts: {
       list: (id) => this.request(`/projects/${id}/hosts`).then((r) => r.data),
       add: (id, input) => this.request(`/projects/${id}/hosts`, { method: "POST", body: input }),
@@ -171,7 +182,7 @@ var Vibiz = class {
       )
     },
     /**
-     * The app's own database. `production` needs an owner key (it holds the
+     * The app's own database. `production` needs a full-access key (it holds the
      * app's users' data); agents read `development`, the default for them.
      */
     database: {
@@ -186,7 +197,7 @@ var Vibiz = class {
     },
     /**
      * How people sign in to the app (docs/SIGN-IN.md). `production` needs an
-     * owner key; agents work on `development`, the default for them.
+     * full-access key; agents work on `development`, the default for them.
      */
     auth: {
       get: (id, env) => this.request(`/projects/${id}/auth/settings${env ? `?env=${env}` : ""}`),
@@ -212,7 +223,7 @@ var Vibiz = class {
     /**
      * The business behind the project (docs/COMPANY.md). `env` defaults like
      * the API: production for owners, development for agents. Production
-     * submit, signing, actions and documents need an owner key.
+     * submit, signing, actions and documents need a full-access key.
      */
     company: {
       get: (id, env) => this.request(`/projects/${id}/company${envQuery(env)}`),
@@ -231,7 +242,7 @@ var Vibiz = class {
         { method: "DELETE" }
       ),
       /**
-       * Production files for real and charges the price: an owner key, `confirm: true`,
+       * Production files for real and charges the price: a full-access key, `confirm: true`,
        * and the `quote.total_cents` and `updated_at` of the draft that was reviewed
        * (a draft or price changed since is refused with a 409, not filed).
        */
@@ -240,7 +251,7 @@ var Vibiz = class {
         body: input
       }),
       /**
-       * Pay a live filing by card instead of from the balance (owner keys): the same
+       * Pay a live filing by card instead of from the balance (full-access keys): the same
        * body as `submit`; it is filed when the payment arrives (docs/BILLING.md "Company").
        */
       checkout: (id, input) => this.request(`/projects/${id}/company/checkout?env=production`, {
@@ -354,7 +365,7 @@ var Vibiz = class {
      * Payments (docs/PAYMENTS.md): Vibiz is the merchant, so an app sells from
      * its first call. `env` defaults like the API: production for owners,
      * development for agents. On production, refunds, cancels, withdrawing,
-     * payout setup and webhook settings need an owner key.
+     * payout setup and webhook settings need a full-access key.
      */
     payments: {
       get: (id, env) => this.request(`/projects/${id}/payments${envQuery(env)}`),
@@ -466,7 +477,7 @@ var Vibiz = class {
      * Custom connectors (docs/CONNECTORS.md): any HTTP API from one manifest,
      * called through Vibiz, which holds the key. `env` defaults like the API:
      * production for owners, development for agents. Production keys, and
-     * approving an agent's dangerous call, need an owner key.
+     * approving an agent's dangerous call, need a full-access key.
      */
     connectors: {
       list: (id) => this.request(`/projects/${id}/connectors`).then((r) => r.data),
@@ -485,7 +496,7 @@ var Vibiz = class {
       delete: (id, name) => this.request(`/projects/${id}/connectors/${encodeURIComponent(name)}`, {
         method: "DELETE"
       }),
-      /** Set values (`null` removes). Production: owner keys. Values are never read back. */
+      /** Set values (`null` removes). Production: full-access keys. Values are never read back. */
       setSecrets: (id, name, values, env) => this.request(
         `/projects/${id}/connectors/${encodeURIComponent(name)}/secrets${envQuery(env)}`,
         { method: "PUT", body: { values } }
@@ -494,7 +505,7 @@ var Vibiz = class {
         `/projects/${id}/connectors/${encodeURIComponent(name)}/check${envQuery(env)}`,
         { method: "POST", body: {} }
       ),
-      /** One operation. A dangerous one (or a production write) by an agent key answers 403 approval_required. */
+      /** One operation. A dangerous one (or a production write) by a Limited key answers 403 approval_required. */
       call: (id, name, input, opts = {}) => this.request(
         `/projects/${id}/connectors/${encodeURIComponent(name)}/call${envQuery(opts.env)}`,
         {
@@ -512,12 +523,12 @@ var Vibiz = class {
       approval: (id, approvalId) => this.request(
         `/projects/${id}/connectors/approvals/${encodeURIComponent(approvalId)}`
       ),
-      /** Owner keys. */
+      /** Full-access keys. */
       approve: (id, approvalId) => this.request(
         `/projects/${id}/connectors/approvals/${encodeURIComponent(approvalId)}/approve`,
         { method: "POST", body: {} }
       ),
-      /** Owner keys. */
+      /** Full-access keys. */
       deny: (id, approvalId) => this.request(
         `/projects/${id}/connectors/approvals/${encodeURIComponent(approvalId)}/deny`,
         { method: "POST", body: {} }
@@ -526,7 +537,7 @@ var Vibiz = class {
     /**
      * The owner's own domains: served by Vibiz hosting (with HTTPS once DNS
      * points at it) or trusted for a host elsewhere. Adding and removing need
-     * an owner key; any key reads status and asks for a re-check.
+     * a full-access key; any key reads status and asks for a re-check.
      */
     domains: {
       list: (id) => this.request(`/projects/${id}/domains`),
@@ -544,8 +555,8 @@ var Vibiz = class {
         method: "DELETE"
       }),
       /**
-       * Owner keys: buy a domain from the account's credits; it serves on this
-       * project once registered. An agent key answers `owner_only` with the
+       * Full-access keys: buy a domain from the account's credits; it serves on this
+       * project once registered. A Limited key answers `owner_only` with the
        * console link to hand the owner.
        */
       buy: (id, input) => this.request(`/projects/${id}/domains/buy`, { method: "POST", body: input })
@@ -653,7 +664,7 @@ var Vibiz = class {
       return res;
     },
     /**
-     * The environment's secret values as `.env` text. Owner keys only; the
+     * The environment's secret values as `.env` text. Full-access keys only; the
      * call itself is the confirmation, so only make it when the person asked.
      */
     envFile: async (projectId, exportId) => {
@@ -1034,7 +1045,7 @@ var Vibiz = class {
    * Your own AI provider keys (docs/AI.md "Your own keys"): calls they can
    * serve run only on them (never falling back to Vibiz) and cost 0 here.
    * Pass `projectId` for a project's override. Setting and removing need an
-   * owner key. Secrets are write-only: no method returns one.
+   * full-access key. Secrets are write-only: no method returns one.
    */
   aiKeys = {
     list: (opts = {}) => this.request(`${aiKeysBase(opts.projectId)}`),
@@ -1065,7 +1076,7 @@ var Vibiz = class {
   /**
    * Buying domains (docs: buying a domain): search and quote with any key;
    * the domains the account owns, auto-renew, renewals, the transfer code and
-   * the owner details (the registrant, saved once) need an owner key.
+   * the owner details (the registrant, saved once) need a full-access key.
    */
   domains = {
     search: (q, opts = {}) => this.request(`/domains/search${qs({ q, project_id: opts.projectId })}`),
@@ -1088,7 +1099,7 @@ var Vibiz = class {
     /**
      * Email forwarding (docs: email ▸ Forwarding): `hello@<domain>` → the
      * owner's inbox, sent "via Vibiz". Anyone reads and verifies; `set` and
-     * `off` need an owner key (an agent gets `owner_only` with a console link
+     * `off` need a full-access key (an agent gets `owner_only` with a console link
      * that has its proposal filled in).
      */
     forwarding: {
@@ -1147,7 +1158,7 @@ var Vibiz = class {
         method: "PATCH",
         body: input
       }),
-      /** Owner keys; only from trash or spam. */
+      /** Full-access keys; only from trash or spam. */
       delete: (id) => this.request(
         `/inbox/threads/${encodeURIComponent(id)}`,
         { method: "DELETE" }
@@ -1178,7 +1189,7 @@ var Vibiz = class {
     }),
     settings: {
       get: () => this.request("/inbox/settings"),
-      /** Owner keys: the new-mail digest. */
+      /** Full-access keys: the new-mail digest. */
       update: (input) => this.request("/inbox/settings", { method: "PATCH", body: input })
     }
   };
@@ -1188,12 +1199,12 @@ var Vibiz = class {
    */
   billing = {
     get: () => this.request("/billing"),
-    /** Owner keys: auto-recharge and the daily safety cap. */
+    /** Full-access keys: auto-recharge and the daily safety cap. */
     update: (input) => this.request("/billing", { method: "PATCH", body: input }),
     /** A payment page for `amount_cents` (500–100000); hand its `url` to a person. */
     checkout: (input) => this.request("/billing/checkout", { method: "POST", body: input }),
     checkoutStatus: (id) => this.request(`/billing/checkout/${encodeURIComponent(id)}`),
-    /** Owner keys: a page to save or replace the card. */
+    /** Full-access keys: a page to save or replace the card. */
     saveCard: () => this.request("/billing/card", { method: "POST", body: {} }),
     removeCard: () => this.request("/billing/card", { method: "DELETE" }),
     ledger: (opts = {}) => this.request(
@@ -1208,12 +1219,20 @@ var Vibiz = class {
   /** Named keys, one per teammate or agent, so spend shows per person. */
   apiKeys = {
     list: () => this.request("/api-keys").then((r) => r.data),
-    /** The secret is returned once, here. */
-    /** `agent` by default: builds and runs, never reads production secrets. Needs an owner key. */
+    /**
+     * The secret is returned once, here. Full access (`owner`) by default;
+     * `access: 'agent'` makes it Limited (builds and runs, never reads
+     * production secrets nor moves live money). Needs a full-access key.
+     */
     create: (name, opts = {}) => this.request("/api-keys", {
       method: "POST",
       body: { name, ...opts.access ? { access: opts.access } : {} }
     }),
+    /** Full access (`owner`) or Limited (`agent`), afterwards. Needs a full-access key, not this one. */
+    setAccess: (id, access) => this.request(`/api-keys/${encodeURIComponent(id)}`, {
+      method: "PATCH",
+      body: { access }
+    }),
     revoke: (id) => this.request(`/api-keys/${id}`, { method: "DELETE" })
   };
   /** A short-lived link to the hosted usage dashboard (admin scope needs an admin key). */

package/dist/types.d.ts

@@ -143,7 +143,7 @@ export interface DomainQuote {
         fields_needed: DomainOwnerField[];
     };
     buy_url?: string;
-    /** This key may buy it directly (an agent key: the owner allowed agents, up to `agent_limit_cents`). */
+    /** This key may buy it directly (a Limited key: the owner allowed agents, up to `agent_limit_cents`). */
     can_buy?: boolean;
     agent_limit_cents?: number | null;
     next_step: string;
@@ -311,7 +311,7 @@ export interface Mailbox {
     display_name: string | null;
     signature: string | null;
     project_id: string | null;
-    /** Agent keys may read and reply here (the owner decides). */
+    /** Limited keys may read and reply here (the owner decides). */
     agent_access: boolean;
     daily_send_cap: number;
     sent_today: number;
@@ -1343,7 +1343,10 @@ export interface MetricsReport {
         capability: string;
     }>;
 }
-/** `owner`: everything. `agent`: builds and runs, never reads production secrets. */
+/**
+ * `owner` (Full access, the default): everything the account's owner can do.
+ * `agent` (Limited): builds and runs, never reads production secrets nor moves live money.
+ */
 export type KeyAccess = 'owner' | 'agent';
 export interface ApiKey {
     object: 'api_key';
@@ -1521,7 +1524,7 @@ export interface CompanyPerson {
     roles: CompanyRole[];
     responsible_party: boolean;
     has_tax_id: boolean;
-    /** Owner keys only; null for agents. */
+    /** Full-access keys only; null for agents. */
     tax_id_last4: string | null;
 }
 export interface CompanyPrice {
@@ -1611,7 +1614,7 @@ export interface CompanyDraft {
         ownership_percent?: number | null;
         roles?: CompanyRole[];
         responsible_party?: boolean;
-        /** SSN or ITIN. Owner keys only. Write-only. */
+        /** SSN or ITIN. Full-access keys only. Write-only. */
         tax_id?: string | null;
         /** Keep the stored tax id of the person with this id. */
         id?: string;
@@ -1795,7 +1798,10 @@ export interface PaymentsAccount {
     };
     statement_descriptor: string;
     fees: {
+        /** The Vibiz fee on this project's sales now, in basis points (200 = 2%), set per account. */
         platform_bps: number;
+        /** The Vibiz fee on sales charged on the owner's own account (what connecting it would mean). */
+        own_account_bps: number;
         /** The card fee for most US cards: card_fee_bps / 100 % + card_fee_fixed_cents. */
         card_fee_bps: number;
         card_fee_fixed_cents: number;
@@ -2648,7 +2654,7 @@ export interface ProjectExport {
 export interface ExportInput {
     /** Default: code, database (when there is one) and env_guide. */
     include?: ExportPart[];
-    /** Default: production for owner keys, development for agent keys. */
+    /** Default: production for full-access keys, development for Limited keys. */
     env?: 'production' | 'development';
     /** Default: the live deployment. */
     deployment_id?: string;
@@ -3032,7 +3038,7 @@ export interface BroadcastReview {
         estimated_days: number;
         paced: boolean;
     };
-    /** Agent keys: the owner's monthly allowance. */
+    /** Limited keys: the owner's monthly allowance. */
     agent?: {
         monthly_limit: number | null;
         used_this_month: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibiz/sdk",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Typed client for the Vibiz Stack API: projects, hosting, databases, sign-in, email, AI, payments and more.",
   "keywords": [
     "vibiz",