@whittlelabs/sifter 0.42.2 → 0.42.4

package/bin.js

@@ -9811,9 +9811,6 @@ var require_seed_workflows = __commonJS({
           ownerClass = "org";
           ownerId = opts.platformOrgId;
           visibility = "published";
-        } else if ("service" in workflow.owner) {
-          ownerClass = "service";
-          ownerId = workflow.owner.service;
         } else {
           const orgId = opts.ownerSlugToOrgId[workflow.owner.orgSlug];
           if (orgId === void 0) {
@@ -58644,8 +58641,8 @@ var require_client = __commonJS({
        * service identity recorded as the conduit. Requires this client to be
        * constructed with a service token holding `keep:actor-tokens:write`.
        */
-      async mintActorToken(actor) {
-        return this.request("POST", "/api/actor-tokens", { actor });
+      async mintActorToken(principal) {
+        return this.request("POST", "/api/actor-tokens", { principal });
       }
       // ── Identity ────────────────────────────────────────────────────
       /**
@@ -58753,18 +58750,17 @@ var require_client = __commonJS({
       // ── Substrate Provisioning ──────────────────────────────────────
       /**
        * Find-or-create a Keep agent (service identity) on behalf of the
-       * given principal. Idempotent on `(ownerPrincipalId, name)`; returns
+       * given principal. Idempotent on `(owner, name)`; returns
        * `clientSecret: null` on re-find.
        *
        * Requires `keep:service-identities:write`.
        */
       async findOrCreateServiceIdentity(request) {
-        return this.request("POST", `/api/users/${request.ownerPrincipalId}/service-identities`, request);
+        return this.request("POST", `/api/users/${request.owner.principalId}/service-identities`, request);
       }
       /**
-       * Bind a role (by name) to a service identity, anchored to a
-       * structural principal: user-owned Sifters pass `userId`;
-       * team/org-anchored bindings pass `teamId`/`orgId`.
+       * Bind a role (by name) to a service identity, held at a structural
+       * principal (`anchor`): a user-owned Sifter's own user, or a team or org.
        *
        * Requires `keep:role-bindings:write`.
        */
@@ -68197,19 +68193,22 @@ var require_client2 = __commonJS({
         return this.request("POST", "/api/job-pools", options);
       }
       /**
-       * Idempotent upsert by `(principal_class, principal_id, name)`. When the
+       * Idempotent upsert by owner and name. When the
        * pool exists, returns the existing row without modifying membership
        * constraints. The Sift provisioning hook relies on this semantics.
        */
       async findOrCreateJobPool(options) {
         return this.request("POST", "/api/job-pools?idempotent=true", options);
       }
+      /**
+       * Every tenant's pools, which needs jobs:job-pools:read at operator context
+       * (a service's operator grant). `owner` narrows to one owner and `name` to
+       * one exact name; neither confers standing (BE-035).
+       */
       async listJobPools(filters) {
         const params = new URLSearchParams();
-        if (filters?.principalClass)
-          params.set("principalClass", filters.principalClass);
-        if (filters?.principalId)
-          params.set("principalId", filters.principalId);
+        if (filters?.owner)
+          params.set("owner", `${filters.owner.principalClass}:${filters.owner.principalId}`);
         if (filters?.name)
           params.set("name", filters.name);
         const qs = params.toString();
@@ -68226,15 +68225,15 @@ var require_client2 = __commonJS({
        * reference is inherently ambiguous — and silently picking one (the old
        * behavior took the server's newest-first ordering) is exactly the
        * capture vector the per-owner constraint closed, re-opened cross-owner.
-       * So it refuses instead: reference the pool by id, or list with explicit
-       * principal filters, when more than one owner holds the name.
+       * So it refuses instead: reference the pool by id, or list with an explicit
+       * owner filter, when more than one owner holds the name.
        */
       async resolveJobPoolByName(name2) {
         const pools = await this.listJobPools({ name: name2 });
         const matches = pools.filter((p) => p.name === name2);
-        const owners = new Set(matches.map((p) => `${p.principalClass ?? ""}/${p.principalId ?? ""}`));
+        const owners = new Set(matches.map((p) => `${p.owner?.principalClass ?? ""}:${p.owner?.principalId ?? ""}`));
         if (owners.size > 1) {
-          const error = new Error(`Job pool name "${name2}" is ambiguous: ${matches.length} pools under ${owners.size} different owners hold it. Reference the pool by id, or resolve it with explicit principal filters (listJobPools).`);
+          const error = new Error(`Job pool name "${name2}" is ambiguous: ${matches.length} pools under ${owners.size} different owners hold it. Reference the pool by id, or resolve it with an explicit owner filter (listJobPools).`);
           error.code = "JOB_POOL_NAME_AMBIGUOUS";
           throw error;
         }
@@ -76003,7 +76002,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist5());
 var import_shuttle = __toESM(require_dist8());
-var buildVersion = true ? "0.42.2" : pkg.version;
+var buildVersion = true ? "0.42.4" : pkg.version;
 var AGENT_EXECUTORS = ["claude-code", "codex", "copilot"];
 var sifterBrand = {
   product: {