@whittlelabs/sifter 0.42.3 → 0.42.5

package/bin.js

@@ -58641,8 +58641,8 @@ var require_client = __commonJS({
        * service identity recorded as the conduit. Requires this client to be
        * constructed with a service token holding `keep:actor-tokens:write`.
        */
-      async mintActorToken(actor) {
-        return this.request("POST", "/api/actor-tokens", { actor });
+      async mintActorToken(principal) {
+        return this.request("POST", "/api/actor-tokens", { principal });
       }
       // ── Identity ────────────────────────────────────────────────────
       /**
@@ -58705,41 +58705,41 @@ var require_client = __commonJS({
       }
       // ── Organizations ───────────────────────────────────────────────
       async listOrganizations() {
-        const { organizations } = await this.request("GET", "/api/organizations");
+        const { organizations } = await this.request("GET", "/api/orgs");
         return organizations;
       }
       async getOrganization(orgId) {
-        return this.request("GET", `/api/organizations/${orgId}`);
+        return this.request("GET", `/api/orgs/${orgId}`);
       }
       async createOrganization(name2, description) {
-        return this.request("POST", "/api/organizations", { name: name2, description });
+        return this.request("POST", "/api/orgs", { name: name2, description });
       }
       async updateOrganization(orgId, updates) {
-        return this.request("PATCH", `/api/organizations/${orgId}`, updates);
+        return this.request("PATCH", `/api/orgs/${orgId}`, updates);
       }
       async deleteOrganization(orgId) {
-        await this.request("DELETE", `/api/organizations/${orgId}`);
+        await this.request("DELETE", `/api/orgs/${orgId}`);
       }
       async listMembers(orgId) {
-        return this.request("GET", `/api/organizations/${orgId}/members`);
+        return this.request("GET", `/api/orgs/${orgId}/members`);
       }
       async removeMember(orgId, userId) {
-        await this.request("DELETE", `/api/organizations/${orgId}/members/${userId}`);
+        await this.request("DELETE", `/api/orgs/${orgId}/members/${userId}`);
       }
       async listTeams(orgId) {
-        return this.request("GET", `/api/organizations/${orgId}/teams`);
+        return this.request("GET", `/api/orgs/${orgId}/teams`);
       }
       async createTeam(orgId, name2, description) {
-        return this.request("POST", `/api/organizations/${orgId}/teams`, { name: name2, description });
+        return this.request("POST", `/api/orgs/${orgId}/teams`, { name: name2, description });
       }
       async listTeamMembers(orgId, teamId) {
-        return this.request("GET", `/api/organizations/${orgId}/teams/${teamId}/members`);
+        return this.request("GET", `/api/orgs/${orgId}/teams/${teamId}/members`);
       }
       async addTeamMember(orgId, teamId, userId) {
-        return this.request("POST", `/api/organizations/${orgId}/teams/${teamId}/members`, { userId });
+        return this.request("POST", `/api/orgs/${orgId}/teams/${teamId}/members`, { userId });
       }
       async createInvitation(orgId, email, roleGrants) {
-        return this.request("POST", `/api/organizations/${orgId}/invitations`, { email, roleGrants });
+        return this.request("POST", `/api/orgs/${orgId}/invitations`, { email, roleGrants });
       }
       async getInvitation(token) {
         return this.request("GET", `/api/invitations/${token}`);
@@ -58750,18 +58750,17 @@ var require_client = __commonJS({
       // ── Substrate Provisioning ──────────────────────────────────────
       /**
        * Find-or-create a Keep agent (service identity) on behalf of the
-       * given principal. Idempotent on `(ownerPrincipalId, name)`; returns
+       * given principal. Idempotent on `(owner, name)`; returns
        * `clientSecret: null` on re-find.
        *
        * Requires `keep:service-identities:write`.
        */
       async findOrCreateServiceIdentity(request) {
-        return this.request("POST", `/api/users/${request.ownerPrincipalId}/service-identities`, request);
+        return this.request("POST", `/api/users/${request.owner.principalId}/service-identities`, request);
       }
       /**
-       * Bind a role (by name) to a service identity, anchored to a
-       * structural principal: user-owned Sifters pass `userId`;
-       * team/org-anchored bindings pass `teamId`/`orgId`.
+       * Bind a role (by name) to a service identity, held at a structural
+       * principal (`anchor`): a user-owned Sifter's own user, or a team or org.
        *
        * Requires `keep:role-bindings:write`.
        */
@@ -68194,19 +68193,22 @@ var require_client2 = __commonJS({
         return this.request("POST", "/api/job-pools", options);
       }
       /**
-       * Idempotent upsert by `(principal_class, principal_id, name)`. When the
+       * Idempotent upsert by owner and name. When the
        * pool exists, returns the existing row without modifying membership
        * constraints. The Sift provisioning hook relies on this semantics.
        */
       async findOrCreateJobPool(options) {
         return this.request("POST", "/api/job-pools?idempotent=true", options);
       }
+      /**
+       * Every tenant's pools, which needs jobs:job-pools:read at operator context
+       * (a service's operator grant). `owner` narrows to one owner and `name` to
+       * one exact name; neither confers standing (BE-035).
+       */
       async listJobPools(filters) {
         const params = new URLSearchParams();
-        if (filters?.principalClass)
-          params.set("principalClass", filters.principalClass);
-        if (filters?.principalId)
-          params.set("principalId", filters.principalId);
+        if (filters?.owner)
+          params.set("owner", `${filters.owner.principalClass}:${filters.owner.principalId}`);
         if (filters?.name)
           params.set("name", filters.name);
         const qs = params.toString();
@@ -68223,15 +68225,15 @@ var require_client2 = __commonJS({
        * reference is inherently ambiguous — and silently picking one (the old
        * behavior took the server's newest-first ordering) is exactly the
        * capture vector the per-owner constraint closed, re-opened cross-owner.
-       * So it refuses instead: reference the pool by id, or list with explicit
-       * principal filters, when more than one owner holds the name.
+       * So it refuses instead: reference the pool by id, or list with an explicit
+       * owner filter, when more than one owner holds the name.
        */
       async resolveJobPoolByName(name2) {
         const pools = await this.listJobPools({ name: name2 });
         const matches = pools.filter((p) => p.name === name2);
-        const owners = new Set(matches.map((p) => `${p.principalClass ?? ""}/${p.principalId ?? ""}`));
+        const owners = new Set(matches.map((p) => `${p.owner?.principalClass ?? ""}:${p.owner?.principalId ?? ""}`));
         if (owners.size > 1) {
-          const error = new Error(`Job pool name "${name2}" is ambiguous: ${matches.length} pools under ${owners.size} different owners hold it. Reference the pool by id, or resolve it with explicit principal filters (listJobPools).`);
+          const error = new Error(`Job pool name "${name2}" is ambiguous: ${matches.length} pools under ${owners.size} different owners hold it. Reference the pool by id, or resolve it with an explicit owner filter (listJobPools).`);
           error.code = "JOB_POOL_NAME_AMBIGUOUS";
           throw error;
         }
@@ -76000,7 +76002,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist5());
 var import_shuttle = __toESM(require_dist8());
-var buildVersion = true ? "0.42.3" : pkg.version;
+var buildVersion = true ? "0.42.5" : pkg.version;
 var AGENT_EXECUTORS = ["claude-code", "codex", "copilot"];
 var sifterBrand = {
   product: {