@whittlelabs/sifter 0.18.0 → 0.19.1

package/bin.js

@@ -3158,7 +3158,6 @@ var require_device_code = __commonJS({
         const device = await startDeviceCode({
           keepApiUrl: reg.keepApiUrl,
           oauthClientId: reg.oauthClientId,
-          scopes: reg.scopes,
           fetcher,
           brand: opts.brand
         });
@@ -3207,7 +3206,7 @@ var require_device_code = __commonJS({
       };
     }
     async function discoverMemberPools(opts) {
-      const tokenUrl = `${opts.keepApiUrl.replace(/\/$/, "")}/api/service-tokens`;
+      const tokenUrl = `${opts.keepApiUrl.replace(/\/$/, "")}/api/agent-tokens`;
       const tokenRes = await opts.fetcher(tokenUrl, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -3241,8 +3240,7 @@ var require_device_code = __commonJS({
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
-          client_id: opts.oauthClientId,
-          scope: opts.scopes.join(" ")
+          client_id: opts.oauthClientId
         })
       });
       (0, version_check_1.checkResponseMinVersion)({
@@ -18569,7 +18567,7 @@ var require_client2 = __commonJS({
       /**
        * Mint a short-lived `act_` token for an end user, with this client's
        * service identity recorded as the conduit. Requires this client to be
-       * constructed with a service token holding `keep:actor-tokens:mint`.
+       * constructed with a service token holding `keep:actor-tokens:write`.
        */
       async mintActorToken(actor) {
         return this.request("POST", "/api/actor-tokens", { actor });
@@ -18691,7 +18689,7 @@ var require_client2 = __commonJS({
       /**
        * Reveal a hosted-Sifter customer's plaintext Anthropic API key for
        * one dispatch. Service-token only; requires the
-       * `keep:managed-sifter-keys:reveal` scope, granted only to the
+       * `keep:managed-sifter-key-material:read` scope, granted only to the
        * `whittle-hosted-sifter` service identity.
        *
        * Callers must use the returned key for a single Anthropic request
@@ -18706,9 +18704,9 @@ var require_client2 = __commonJS({
        * Read a user's hosted-Sifter opt-in status. Returns `{enabled:
        * false}` for users who never opted in (no row) and users who
        * opted in then disabled. Service-to-service only; requires the
-       * `keep:managed-sifter-keys:read-status` scope, which is distinct
-       * from `:reveal` so a service identity can hold one without the
-       * other.
+       * `keep:managed-sifter-enrollments:read` scope, which is distinct
+       * from `keep:managed-sifter-key-material:read` so a service identity
+       * can hold one without the other.
        */
       async getManagedSifterStatus(userId) {
         return this.request("GET", `/api/users/${encodeURIComponent(userId)}/managed-sifter-status`);
@@ -20980,7 +20978,6 @@ var require_defaults2 = __commonJS({
         oauthClientId: "shuttle-dev",
         orgSlug: "whittle-labs",
         roleSlug: "shuttle-dev",
-        scopes: ["jobs:subscribe", "jobs:submit"],
         serviceIdentityDisplayName: "{user}'s Shuttle on {hostname}"
       },
       defaultCaps: {
@@ -21998,7 +21995,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.18.0" : pkg.version;
+var buildVersion = true ? "0.19.1" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",
@@ -22036,7 +22033,6 @@ var sifterBrand = {
     oauthClientId: process.env.SIFTER_OAUTH_CLIENT_ID ?? "sifter",
     orgSlug: "whittle-labs",
     roleSlug: "sift-sifter",
-    scopes: ["jobs:subscribe", "jobs:submit"],
     serviceIdentityDisplayName: "{user}'s Sifter on {hostname}"
   },
   defaultCaps: {