@zarel-ai/sdk 0.6.0

package/dist/resources/audit.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditResource = void 0;
+const pagination_1 = require("../_internal/pagination");
+/**
+ * Audit tamper-evidence resource (ADR-0108).
+ *
+ *   client.audit.evidence(log)          → GET /runtime/audit/{log}/evidence
+ *   client.audit.evidence(log, {from,to}) → …?from=&to= (bounded slice)
+ *
+ * Downloads a signed evidence bundle (the event hash-chain + covering signed
+ * checkpoints + any external RFC 3161 TSA anchors over them, ADR-0115, + a signed
+ * manifest) for offline verification with `zarel verify`. Mirrors
+ * `traces.bundle()` — the body is a binary `application/gzip` stream, so it
+ * returns a generic `ArrayBuffer` the caller writes to disk. The anchors ride
+ * INSIDE the bundle: no SDK-call change — verify them offline with `--tsa-roots`.
+ */
+class AuditResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    list(log, params, options) {
+        const path = `/runtime/audit/${encodeURIComponent(log)}`;
+        const buildQuery = (cursor, limit) => {
+            const query = {};
+            if (params?.from !== undefined)
+                query.from = params.from;
+            if (params?.to !== undefined)
+                query.to = params.to;
+            if (params?.entity !== undefined)
+                query.entity = params.entity;
+            if (params?.field !== undefined)
+                query.field = params.field;
+            if (params?.bindingMode !== undefined)
+                query.binding_mode = params.bindingMode;
+            if (params?.category !== undefined)
+                query.category = params.category;
+            if (params?.reason !== undefined)
+                query.reason = params.reason;
+            if (params?.verdict !== undefined)
+                query.verdict = params.verdict;
+            if (limit !== undefined)
+                query.limit = limit;
+            if (cursor !== undefined)
+                query.cursor = cursor;
+            return query;
+        };
+        const signal = options?.signal;
+        const fetchPage = (p) => this.client.get(path, buildQuery(p.cursor, p.limit), {
+            operationId: 'listAuditLog',
+            ...(signal ? { signal } : {}),
+        });
+        return new pagination_1.PagePromise(fetchPage, (0, pagination_1.cursorBased)((page) => page.items, (page) => page.next_cursor), {
+            ...(params?.limit !== undefined ? { limit: params.limit } : {}),
+            ...(params?.cursor !== undefined ? { cursor: params.cursor } : {}),
+        });
+    }
+    async evidence(log, range) {
+        const qs = [];
+        if (range?.from !== undefined)
+            qs.push(`from=${encodeURIComponent(String(range.from))}`);
+        if (range?.to !== undefined)
+            qs.push(`to=${encodeURIComponent(String(range.to))}`);
+        const query = qs.length > 0 ? `?${qs.join('&')}` : '';
+        const path = `/runtime/audit/${encodeURIComponent(log)}/evidence${query}`;
+        const client = this.client;
+        if (client !== null
+            && typeof client === 'object'
+            && 'fetchRaw' in client
+            && typeof client.fetchRaw === 'function') {
+            const fetchRaw = client.fetchRaw;
+            const res = await fetchRaw(path);
+            if (!res.ok) {
+                throw new Error(`Audit evidence download failed (status ${res.status})`);
+            }
+            return res.arrayBuffer();
+        }
+        const got = await this.client.get(path, undefined, { operationId: 'getAuditEvidenceBundle' });
+        if (got instanceof ArrayBuffer)
+            return got;
+        throw new Error('FetchClient does not support binary downloads — wire `fetchRaw(path)` on your custom client.');
+    }
+}
+exports.AuditResource = AuditResource;
+//# sourceMappingURL=audit.js.map

package/dist/resources/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/resources/audit.ts"],"names":[],"mappings":";;;AACA,wDAAoF;AA0BpF;;;;;;;;;;;;GAYG;AACH,MAAa,aAAa;IACc;IAApC,YAAoC,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAyBpD,IAAI,CACP,GAAoB,EACpB,MAA2B,EAC3B,OAAkC;QAElC,MAAM,IAAI,GAAG,kBAAkB,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,CAAC,MAAe,EAAE,KAAc,EAAyD,EAAE;YAC1G,MAAM,KAAK,GAA0D,EAAE,CAAC;YACxE,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzD,IAAI,MAAM,EAAE,EAAE,KAAK,SAAS;gBAAE,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/D,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;gBAAE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5D,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS;gBAAE,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;YAC/E,IAAI,MAAM,EAAE,QAAQ,KAAK,SAAS;gBAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACrE,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/D,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS;gBAAE,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAClE,IAAI,KAAK,KAAK,SAAS;gBAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;YAChD,OAAO,KAAK,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAa,EAA2C,EAAE,CACzE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAiC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE;YACjF,WAAW,EAAE,cAAc;YAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAC;QAEP,OAAO,IAAI,wBAAW,CAClB,SAAS,EACT,IAAA,wBAAW,EAA8C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAC1G;YACI,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CACJ,CAAC;IACN,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,GAAiB,EAAE,KAA0B;QAC/D,MAAM,EAAE,GAAa,EAAE,CAAC;QACxB,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;YAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,IAAI,KAAK,EAAE,EAAE,KAAK,SAAS;YAAE,EAAE,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,kBAAkB,kBAAkB,CAAC,GAAG,CAAC,YAAY,KAAK,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAY,IAAI,CAAC,MAAM,CAAC;QACpC,IACI,MAAM,KAAK,IAAI;eACZ,OAAO,MAAM,KAAK,QAAQ;eAC1B,UAAU,IAAI,MAAM;eACpB,OAAQ,MAAgC,CAAC,QAAQ,KAAK,UAAU,EACrE,CAAC;YACC,MAAM,QAAQ,GAAI,MAAyD,CAAC,QAAQ,CAAC;YACrF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAU,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACvG,IAAI,GAAG,YAAY,WAAW;YAAE,OAAO,GAAG,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IACpH,CAAC;CACJ;AAxFD,sCAwFC"}

package/dist/resources/authorization-ceiling.d.ts

@@ -0,0 +1,25 @@
+import type { FetchClient } from '../_internal/fetch-client';
+export type EnvelopeGrantKind = 'section' | 'system';
+export interface EnvelopeGrant {
+    readonly kind: EnvelopeGrantKind;
+    /** Section name for kind='section'; null for kind='system'. */
+    readonly target: string | null;
+    readonly action: string;
+    /** Bounds only (S5b-a, system grants) — not part of grant identity. */
+    readonly conditions?: unknown;
+}
+export interface OwnerCeilingEnvelope {
+    readonly ownerRoleNames: ReadonlyArray<string>;
+    readonly grants: ReadonlyArray<EnvelopeGrant>;
+}
+export declare class AuthorizationCeilingResource {
+    private readonly client;
+    constructor(client: FetchClient);
+    /**
+     * GET /contract/authorizations/ceiling — the tenant's owner/ceiling envelope.
+     * This endpoint returns the BARE `{ownerRoleNames, grants}` body (no
+     * {success,data} wrapper), so it opts out of the transport unwrap (G1).
+     */
+    get(): Promise<OwnerCeilingEnvelope>;
+}
+//# sourceMappingURL=authorization-ceiling.d.ts.map

package/dist/resources/authorization-ceiling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-ceiling.d.ts","sourceRoot":"","sources":["../../src/resources/authorization-ceiling.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,aAAa;IAC1B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACjD;AAED,qBAAa,4BAA4B;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEhD;;;;OAIG;IACG,GAAG,IAAI,OAAO,CAAC,oBAAoB,CAAC;CAO7C"}

package/dist/resources/authorization-ceiling.js

@@ -0,0 +1,26 @@
+"use strict";
+// Sub-spec C — owner/ceiling envelope introspection (ADR-0102 §6).
+//
+// Read-only mirror of `GET /contract/authorizations/ceiling`. The envelope is
+// the platform-seeded owner role names + the contract-section/system grants they
+// hold — the ceiling against which the dashboard derives owner-row locks and
+// cat-① "beyond-ceiling" cells. Derived server-side by `DbOwnerEnvelopeReader`;
+// the SDK only reads it.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationCeilingResource = void 0;
+class AuthorizationCeilingResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * GET /contract/authorizations/ceiling — the tenant's owner/ceiling envelope.
+     * This endpoint returns the BARE `{ownerRoleNames, grants}` body (no
+     * {success,data} wrapper), so it opts out of the transport unwrap (G1).
+     */
+    async get() {
+        return this.client.get('/contract/authorizations/ceiling', undefined, { operationId: 'getAuthorizationCeiling' });
+    }
+}
+exports.AuthorizationCeilingResource = AuthorizationCeilingResource;
+//# sourceMappingURL=authorization-ceiling.js.map

package/dist/resources/authorization-ceiling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-ceiling.js","sourceRoot":"","sources":["../../src/resources/authorization-ceiling.ts"],"names":[],"mappings":";AAAA,mEAAmE;AACnE,EAAE;AACF,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,gFAAgF;AAChF,yBAAyB;;;AAoBzB,MAAa,4BAA4B;IACR;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD;;;;OAIG;IACH,KAAK,CAAC,GAAG;QACL,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAClB,kCAAkC,EAClC,SAAS,EACT,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAC7C,CAAC;IACN,CAAC;CACJ;AAfD,oEAeC"}

package/dist/resources/authorization-operation-ids.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The operationId suffix for an on-path — mirrors the OpenAPI generator exactly.
+ *
+ * ADR-0109 A1 makes the operationId the SINGLE unwrap authority, so every call
+ * must name its operation. The SDK carries zero runtime dependencies, so it
+ * cannot import the canonical derivation from `@zarel-ai/contract`; it mirrors
+ * it here instead, and `authorization-operation-ids.test.ts` asserts every
+ * derived id exists in the GENERATED unwrap map, so the mirror cannot drift
+ * silently.
+ *
+ * Dynamic families are SINGULAR (`OnFlow`, not `OnFlows`) because the config
+ * section `flows` and the per-flow grant `flows/{name}` would otherwise collide.
+ */
+export declare function authorizationOperationSuffix(onPath: string): string;
+//# sourceMappingURL=authorization-operation-ids.d.ts.map

package/dist/resources/authorization-operation-ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-operation-ids.d.ts","sourceRoot":"","sources":["../../src/resources/authorization-operation-ids.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAUnE"}

package/dist/resources/authorization-operation-ids.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizationOperationSuffix = authorizationOperationSuffix;
+/**
+ * The operationId suffix for an on-path — mirrors the OpenAPI generator exactly.
+ *
+ * ADR-0109 A1 makes the operationId the SINGLE unwrap authority, so every call
+ * must name its operation. The SDK carries zero runtime dependencies, so it
+ * cannot import the canonical derivation from `@zarel-ai/contract`; it mirrors
+ * it here instead, and `authorization-operation-ids.test.ts` asserts every
+ * derived id exists in the GENERATED unwrap map, so the mirror cannot drift
+ * silently.
+ *
+ * Dynamic families are SINGULAR (`OnFlow`, not `OnFlows`) because the config
+ * section `flows` and the per-flow grant `flows/{name}` would otherwise collide.
+ */
+function authorizationOperationSuffix(onPath) {
+    if (onPath.startsWith('records/'))
+        return 'OnRecord';
+    if (onPath.startsWith('flows/'))
+        return 'OnFlow';
+    if (onPath.startsWith('llm/services/'))
+        return 'OnLlmService';
+    const pascal = onPath
+        .split(/[^a-zA-Z0-9]+/)
+        .filter(Boolean)
+        .map((w) => w[0].toUpperCase() + w.slice(1))
+        .join('');
+    return `On${pascal}`;
+}
+//# sourceMappingURL=authorization-operation-ids.js.map

package/dist/resources/authorization-operation-ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-operation-ids.js","sourceRoot":"","sources":["../../src/resources/authorization-operation-ids.ts"],"names":[],"mappings":";;AAaA,oEAUC;AAvBD;;;;;;;;;;;;GAYG;AACH,SAAgB,4BAA4B,CAAC,MAAc;IACvD,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACrD,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjD,IAAI,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,cAAc,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM;SAChB,KAAK,CAAC,eAAe,CAAC;SACtB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC5C,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,OAAO,KAAK,MAAM,EAAE,CAAC;AACzB,CAAC"}

package/dist/resources/authorization.d.ts

@@ -0,0 +1,60 @@
+import { type FetchClient } from '../_internal/fetch-client';
+import type { LocaleOptions } from '../types/locale';
+/**
+ * The authorization surface — spec `20260722-185941-authz-structural-keys`, T034.
+ *
+ * Replaces `contract-policies`, `entity-policies`, `flow-policies` and
+ * `authorization-llm-services`. Those four existed only because the HTTP surface
+ * was partitioned by plane and by family; the surface is now one path-addressed
+ * resource, so the SDK is one resource too.
+ *
+ * `encodeURIComponent` on the on-path is GONE. There is nothing to encode: the
+ * on-path travels as real path segments (ADR-0077 P2). Encoding it was the bug —
+ * nginx decodes `%2F` before the router sees it, so `channels` was
+ * unreachable end-to-end. `{role}` is still encoded: it is a single segment and
+ * a user-supplied value.
+ */
+/** A grant statement: a bare action, or one attenuated by `fields` / `scope` / `when`. */
+export type AuthorizationStatement = string | Readonly<Record<string, {
+    readonly fields?: ReadonlyArray<string>;
+    readonly scope?: ReadonlyArray<'contract' | 'runtime'>;
+    readonly when?: Readonly<Record<string, unknown>>;
+}>>;
+/** The permissions a role holds on one on-path — the addressable unit. */
+export interface AuthorizationGrant {
+    /** e.g. `entities`, `channels`, `records/orders`, `llm/services/primary`. */
+    readonly on: string;
+    readonly actions: ReadonlyArray<AuthorizationStatement>;
+}
+/** A role's complete grant set. */
+export interface RoleAuthorization {
+    readonly role: string;
+    readonly grants: ReadonlyArray<AuthorizationGrant>;
+}
+/**
+ * Authorization grants, addressed the way the contract declares them:
+ * `/contract/authorization/{role}/<on-path>`.
+ */
+export declare class AuthorizationResource {
+    private readonly client;
+    constructor(client: FetchClient);
+    private base;
+    /** The on-path is a PATH, not a value to encode — that is the whole point. */
+    private item;
+    private op;
+    /** Every grant a role holds, in canonical order. */
+    list(role: string, options?: LocaleOptions): Promise<RoleAuthorization>;
+    /** Read one grant. */
+    get(role: string, onPath: string, options?: LocaleOptions): Promise<AuthorizationGrant>;
+    /** Create a grant. Rejects with 409 when one already exists on that on-path — use {@link put} to replace. */
+    create(role: string, grant: AuthorizationGrant): Promise<AuthorizationGrant>;
+    /** Create or replace a grant. Idempotent. */
+    put(role: string, onPath: string, actions: ReadonlyArray<AuthorizationStatement>): Promise<AuthorizationGrant>;
+    /** Merge actions into an existing grant — adds or re-attenuates, never drops. */
+    patch(role: string, onPath: string, actions: ReadonlyArray<AuthorizationStatement>): Promise<AuthorizationGrant>;
+    /** Remove a grant entirely. */
+    del(role: string, onPath: string): Promise<{
+        readonly message: string;
+    }>;
+}
+//# sourceMappingURL=authorization.d.ts.map

package/dist/resources/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/resources/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAA0B,MAAM,2BAA2B,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD;;;;;;;;;;;;;GAaG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,sBAAsB,GAC5B,MAAM,GACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD,CAAC,CAAC,CAAC;AAER,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CAC3D;AAED,mCAAmC;AACnC,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,qBAAa,qBAAqB;IAClB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEhD,OAAO,CAAC,IAAI;IAIZ,8EAA8E;IAC9E,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,EAAE;IAIV,oDAAoD;IAC9C,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAQ7E,sBAAsB;IAChB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ7F,6GAA6G;IACvG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIlF,6CAA6C;IACvC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAMpH,iFAAiF;IAC3E,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAMtH,+BAA+B;IACzB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAKjF"}

package/dist/resources/authorization.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationResource = void 0;
+const fetch_client_1 = require("../_internal/fetch-client");
+const authorization_operation_ids_1 = require("./authorization-operation-ids");
+/**
+ * Authorization grants, addressed the way the contract declares them:
+ * `/contract/authorization/{role}/<on-path>`.
+ */
+class AuthorizationResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    base(role) {
+        return `/contract/authorization/${encodeURIComponent(role)}`;
+    }
+    /** The on-path is a PATH, not a value to encode — that is the whole point. */
+    item(role, onPath) {
+        return `${this.base(role)}/${onPath}`;
+    }
+    op(verb, onPath) {
+        return `${verb}Grant${(0, authorization_operation_ids_1.authorizationOperationSuffix)(onPath)}`;
+    }
+    /** Every grant a role holds, in canonical order. */
+    async list(role, options) {
+        return this.client.get(this.base(role), (0, fetch_client_1.localeQueryOrUndefined)(options), { operationId: 'listRoleGrants' });
+    }
+    /** Read one grant. */
+    async get(role, onPath, options) {
+        return this.client.get(this.item(role, onPath), (0, fetch_client_1.localeQueryOrUndefined)(options), { operationId: this.op('get', onPath) });
+    }
+    /** Create a grant. Rejects with 409 when one already exists on that on-path — use {@link put} to replace. */
+    async create(role, grant) {
+        return this.client.post(this.base(role), grant, { operationId: 'createRoleGrant' });
+    }
+    /** Create or replace a grant. Idempotent. */
+    async put(role, onPath, actions) {
+        return this.client.put(this.item(role, onPath), { actions }, { operationId: this.op('put', onPath) });
+    }
+    /** Merge actions into an existing grant — adds or re-attenuates, never drops. */
+    async patch(role, onPath, actions) {
+        return this.client.patch(this.item(role, onPath), { actions }, { operationId: this.op('patch', onPath) });
+    }
+    /** Remove a grant entirely. */
+    async del(role, onPath) {
+        return this.client.del(this.item(role, onPath), { operationId: this.op('delete', onPath) });
+    }
+}
+exports.AuthorizationResource = AuthorizationResource;
+//# sourceMappingURL=authorization.js.map

package/dist/resources/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/resources/authorization.ts"],"names":[],"mappings":";;;AAAA,4DAAqF;AAErF,+EAA6E;AAuC7E;;;GAGG;AACH,MAAa,qBAAqB;IACD;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAE5C,IAAI,CAAC,IAAY;QACrB,OAAO,2BAA2B,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;IACjE,CAAC;IAED,8EAA8E;IACtE,IAAI,CAAC,IAAY,EAAE,MAAc;QACrC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;IAC1C,CAAC;IAEO,EAAE,CAAC,IAAwC,EAAE,MAAc;QAC/D,OAAO,GAAG,IAAI,QAAQ,IAAA,0DAA4B,EAAC,MAAM,CAAC,EAAE,CAAC;IACjE,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,OAAuB;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAClB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EACf,IAAA,qCAAsB,EAAC,OAAO,CAAC,EAC/B,EAAE,WAAW,EAAE,gBAAgB,EAAE,CACpC,CAAC;IACN,CAAC;IAED,sBAAsB;IACtB,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,OAAuB;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAClB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EACvB,IAAA,qCAAsB,EAAC,OAAO,CAAC,EAC/B,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAC1C,CAAC;IACN,CAAC;IAED,6GAA6G;IAC7G,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,KAAyB;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAqB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,6CAA6C;IAC7C,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,OAA8C;QAClF,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAClB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAChF,CAAC;IACN,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,MAAc,EAAE,OAA8C;QACpF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAClF,CAAC;IACN,CAAC;IAED,+BAA+B;IAC/B,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,MAAc;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAClB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CACtE,CAAC;IACN,CAAC;CACJ;AA3DD,sDA2DC"}

package/dist/resources/authorizations.d.ts

@@ -0,0 +1,38 @@
+import type { FetchClient } from '../_internal/fetch-client';
+export interface EntityPermissionEntry {
+    readonly entity: string;
+    readonly actions: ReadonlyArray<string>;
+    /**
+     * The scope the write floor will enforce, per reported action. `full` reaches every row;
+     * `owner` reaches only rows the caller owns.
+     *
+     * An owner-scoped action used to be ABSENT from `actions` entirely — the endpoint derived
+     * its answer from a policy read filtered by role name, and `owner` is a pseudo-role no role
+     * list contains. Callers gating an affordance on `actions.includes(...)` were therefore
+     * under-told, and should now gate the ROW-level affordance on this too.
+     */
+    readonly scope_by_action: Readonly<Record<string, 'full' | 'owner'>>;
+    /**
+     * Per-action writable field restriction, ON A ROW THE CALLER OWNS — the widest set any
+     * single row admits. **Absent = all fields**; it never means none.
+     */
+    readonly fields_by_action: Readonly<Record<string, ReadonlyArray<string> | null>>;
+}
+export interface EffectiveAuthorizationsResponse {
+    readonly tenant_name: string;
+    readonly user_name: string;
+    readonly user_roles: ReadonlyArray<string>;
+    readonly admin_sections: ReadonlyArray<string>;
+    readonly system_actions: ReadonlyArray<string>;
+    readonly entity_permissions: ReadonlyArray<EntityPermissionEntry>;
+}
+export declare class AuthorizationsResource {
+    private readonly client;
+    constructor(client: FetchClient);
+    /**
+     * GET /runtime/authorizations/effective — what the authorization engine
+     * decides for the CALLING actor (self-scope; no actor parameter exists).
+     */
+    effective(): Promise<EffectiveAuthorizationsResponse>;
+}
+//# sourceMappingURL=authorizations.d.ts.map

package/dist/resources/authorizations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizations.d.ts","sourceRoot":"","sources":["../../src/resources/authorizations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,MAAM,WAAW,qBAAqB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IACrE;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,+BAA+B;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CACrE;AAED,qBAAa,sBAAsB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEhD;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,+BAA+B,CAAC;CAG9D"}

package/dist/resources/authorizations.js

@@ -0,0 +1,19 @@
+"use strict";
+// ADR-0102 §6 (S3b) — self-scoped effective-authorizations introspection.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationsResource = void 0;
+class AuthorizationsResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * GET /runtime/authorizations/effective — what the authorization engine
+     * decides for the CALLING actor (self-scope; no actor parameter exists).
+     */
+    async effective() {
+        return this.client.get('/runtime/authorizations/effective', undefined, { operationId: 'runtimeEffectiveAuthorizations' });
+    }
+}
+exports.AuthorizationsResource = AuthorizationsResource;
+//# sourceMappingURL=authorizations.js.map

package/dist/resources/authorizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizations.js","sourceRoot":"","sources":["../../src/resources/authorizations.ts"],"names":[],"mappings":";AAAA,0EAA0E;;;AAiC1E,MAAa,sBAAsB;IACF;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD;;;OAGG;IACH,KAAK,CAAC,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAkC,mCAAmC,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC,CAAC;IAC/J,CAAC;CACJ;AAVD,wDAUC"}

package/dist/resources/channels.d.ts

@@ -0,0 +1,36 @@
+import { type FetchClient } from '../_internal/fetch-client';
+import type { EventStreamHandle, EventStreamOptions } from '../types/events-stream';
+import type { MintPartyTokenRequest, PartyToken, ChannelDirectiveContent, ChannelSendResult, ChannelDirectiveStreamEvent } from '../types/channels';
+/**
+ * ADR-0133 §B.4 decision 5 — the four channel operations the channel-ingress
+ * credential grants: mint / subscribe / fetch(=claim) / report. The client MUST be
+ * configured with a `channel`-class credential as its runtime token; these are the
+ * ONLY routes that accept it (asymmetric acceptance). QI-002: this is the closed
+ * SDK duplex surface `@zarel-ai/channels` is allowed to import.
+ */
+export declare class ChannelsResource {
+    private readonly client;
+    constructor(client: FetchClient);
+    /** Mint a short-TTL anonymous party token bound to (credential channel, party_ref). */
+    mint(request: MintPartyTokenRequest): Promise<PartyToken>;
+    /**
+     * fetch(=claim): take the delivery lease AND read the reply body. The lease is keyed
+     * by the credential; re-fetch by the holder refreshes it, a foreign live lease is 409.
+     */
+    fetch(directiveId: string): Promise<ChannelDirectiveContent>;
+    /** report(=ack): terminal send-result + lease release. */
+    report(directiveId: string, result: ChannelSendResult): Promise<{
+        status: string;
+    }>;
+    /**
+     * subscribe: open the SSE stream of new directives for the credential's own channel
+     * (server-side filtered, QI-006). `onDirective` fires per `channel.directive_created`
+     * frame with the directive id to fetch. Returns a teardown handle. Uses the SDK's
+     * dep-free reconnecting SSE client (ADR-0109) — no runtime deps added.
+     */
+    subscribe(onDirective: (event: ChannelDirectiveStreamEvent) => void, options?: EventStreamOptions & {
+        onError?: (err: unknown) => void;
+        onOpen?: () => void;
+    }): EventStreamHandle;
+}
+//# sourceMappingURL=channels.d.ts.map

package/dist/resources/channels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channels.d.ts","sourceRoot":"","sources":["../../src/resources/channels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,KAAK,EACR,qBAAqB,EACrB,UAAU,EACV,uBAAuB,EACvB,iBAAiB,EACjB,2BAA2B,EAC9B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,qBAAa,gBAAgB;IACb,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEhD,uFAAuF;IACjF,IAAI,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/D;;;OAGG;IACG,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQlE,0DAA0D;IACpD,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAQzF;;;;;OAKG;IACH,SAAS,CACL,WAAW,EAAE,CAAC,KAAK,EAAE,2BAA2B,KAAK,IAAI,EACzD,OAAO,GAAE,kBAAkB,GAAG;QAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAA;KAAO,GAC7F,iBAAiB;CAwBvB"}

package/dist/resources/channels.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChannelsResource = void 0;
+/**
+ * ADR-0133 §B.4 decision 5 — the four channel operations the channel-ingress
+ * credential grants: mint / subscribe / fetch(=claim) / report. The client MUST be
+ * configured with a `channel`-class credential as its runtime token; these are the
+ * ONLY routes that accept it (asymmetric acceptance). QI-002: this is the closed
+ * SDK duplex surface `@zarel-ai/channels` is allowed to import.
+ */
+class ChannelsResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /** Mint a short-TTL anonymous party token bound to (credential channel, party_ref). */
+    async mint(request) {
+        return this.client.post('/runtime/channels/mint', request, { operationId: 'runtimeChannelsMint' });
+    }
+    /**
+     * fetch(=claim): take the delivery lease AND read the reply body. The lease is keyed
+     * by the credential; re-fetch by the holder refreshes it, a foreign live lease is 409.
+     */
+    async fetch(directiveId) {
+        return this.client.get(`/runtime/channels/directives/${encodeURIComponent(directiveId)}/content`, undefined, { operationId: 'runtimeChannelsFetch' });
+    }
+    /** report(=ack): terminal send-result + lease release. */
+    async report(directiveId, result) {
+        return this.client.post(`/runtime/channels/directives/${encodeURIComponent(directiveId)}/send-result`, result, { operationId: 'runtimeChannelsReport' });
+    }
+    /**
+     * subscribe: open the SSE stream of new directives for the credential's own channel
+     * (server-side filtered, QI-006). `onDirective` fires per `channel.directive_created`
+     * frame with the directive id to fetch. Returns a teardown handle. Uses the SDK's
+     * dep-free reconnecting SSE client (ADR-0109) — no runtime deps added.
+     */
+    subscribe(onDirective, options = {}) {
+        return this.client.openEventStream('/runtime/channels/directives/stream', {
+            onEvent: (event) => {
+                if (event.event !== 'channel.directive_created')
+                    return;
+                let data;
+                try {
+                    data = typeof event.data === 'string'
+                        ? JSON.parse(event.data)
+                        : event.data;
+                }
+                catch {
+                    return; // malformed frame — drop, never throw into onEvent
+                }
+                if (data && typeof data.directive_id === 'string') {
+                    onDirective({ directive_id: data.directive_id });
+                }
+            },
+            ...(options.onError ? { onError: options.onError } : {}),
+            ...(options.onOpen ? { onOpen: options.onOpen } : {}),
+        }, options);
+    }
+}
+exports.ChannelsResource = ChannelsResource;
+//# sourceMappingURL=channels.js.map

package/dist/resources/channels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channels.js","sourceRoot":"","sources":["../../src/resources/channels.ts"],"names":[],"mappings":";;;AAUA;;;;;;GAMG;AACH,MAAa,gBAAgB;IACI;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,uFAAuF;IACvF,KAAK,CAAC,IAAI,CAAC,OAA8B;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAa,wBAAwB,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACnH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,WAAmB;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAClB,gCAAgC,kBAAkB,CAAC,WAAW,CAAC,UAAU,EACzE,SAAS,EACT,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAC1C,CAAC;IACN,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,MAAyB;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,gCAAgC,kBAAkB,CAAC,WAAW,CAAC,cAAc,EAC7E,MAAM,EACN,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAC3C,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACH,SAAS,CACL,WAAyD,EACzD,UAA0F,EAAE;QAE5F,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAC9B,qCAAqC,EACrC;YACI,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACf,IAAI,KAAK,CAAC,KAAK,KAAK,2BAA2B;oBAAE,OAAO;gBACxD,IAAI,IAA4C,CAAC;gBACjD,IAAI,CAAC;oBACD,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;wBACjC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAA+B;wBACtD,CAAC,CAAE,KAAK,CAAC,IAA+C,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACL,OAAO,CAAC,mDAAmD;gBAC/D,CAAC;gBACD,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;oBAChD,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;gBACrD,CAAC;YACL,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,EACD,OAAO,CACV,CAAC;IACN,CAAC;CACJ;AA9DD,4CA8DC"}

package/dist/resources/contracts.d.ts

@@ -0,0 +1,46 @@
+import { type FetchClient } from '../_internal/fetch-client';
+import type { SpecDiff, SpecPublishRequest, SpecPublishResponse, SpecDiffRequest, SpecApplyRequest, SpecApplyResponse, SpecSnapshotV1Response, SpecDryRunSubmitRequest, SpecDryRunSubmitResponse, SpecDryRunJob } from '../types/spec';
+import type { LocaleOptions } from '../types/locale';
+/**
+ * Spec resource (spec-051 US2; renamed from ContractsResource).
+ *
+ * Canonical surface (URLs are bare canonical paths per ADR-0077 D14'):
+ *   - publish(req)    → POST /contract/spec/publish
+ *   - diff(req)       → POST /contract/spec/diff
+ *   - apply(req)      → POST /contract/spec/apply
+ *   - snapshot()      → GET  /contract/spec/snapshot
+ *   - dryRun(req)     → POST /contract/spec/dry-run
+ *   - dryRunReport()  → GET  /contract/spec/dry-run/:id
+ *   - dryRunCancel()  → DELETE /contract/spec/dry-run/:id
+ */
+export declare class SpecResource {
+    private readonly client;
+    constructor(client: FetchClient);
+    publish(request: SpecPublishRequest): Promise<SpecPublishResponse>;
+    diff(request: SpecDiffRequest): Promise<SpecDiff>;
+    apply(request: SpecApplyRequest): Promise<SpecApplyResponse>;
+    snapshot(options?: LocaleOptions): Promise<SpecSnapshotV1Response>;
+    /** GET /contract/spec/snapshot/locale-coverage — i18n coverage report for the published snapshot. */
+    snapshotLocaleCoverage(options?: LocaleOptions): Promise<Record<string, unknown>>;
+    /**
+     * GET /contract/spec/snapshot/semantic-diff — semantic diff between two published
+     * contract versions. `from`/`to` are REQUIRED (contract versions, ≥ 1).
+     */
+    snapshotSemanticDiff(input: {
+        from: number;
+        to: number;
+    } & LocaleOptions): Promise<Record<string, unknown>>;
+    /**
+     * Submit an async dry-run.
+     */
+    dryRun(request: SpecDryRunSubmitRequest): Promise<SpecDryRunSubmitResponse>;
+    /**
+     * Poll the dry-run job for status / report.
+     */
+    dryRunReport(reportId: string, options?: LocaleOptions): Promise<SpecDryRunJob>;
+    /**
+     * Cancel a queued / running dry-run job.
+     */
+    dryRunCancel(reportId: string): Promise<void>;
+}
+//# sourceMappingURL=contracts.d.ts.map

package/dist/resources/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/resources/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAA0B,MAAM,2BAA2B,CAAC;AACrF,OAAO,KAAK,EACR,QAAQ,EACR,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,EAChB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAY;IACF,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAE1C,OAAO,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIlE,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIjD,KAAK,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAI5D,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAsB/E,qGAAqG;IACxF,sBAAsB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ9F;;;OAGG;IACU,oBAAoB,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAUxH;;OAEG;IACU,MAAM,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAIxF;;OAEG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAQ5F;;OAEG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG7D"}