@zarel-ai/sdk 0.6.0

package/dist/resources/llm-services.d.ts

@@ -0,0 +1,46 @@
+/**
+ * LLM service catalog resource (T074, SpecKit 010 / ADR-0087).
+ *
+ * Read-only over the LLM service catalog, ALWAYS actor-filtered (FR-B02
+ * no-leak). The wire surface returns only services for which the actor has
+ * a `use` policy in the requested scope; privileged roles see everything
+ * because their YAML policies grant them `use` on every service (no code-
+ * level role bypass — ADR-0001 §6).
+ */
+import type { FetchClient } from '../_internal/fetch-client';
+import type { LocaleOptions } from '../types/locale';
+export type LlmServiceProvider = 'anthropic' | 'bedrock' | 'gemini' | 'openai';
+export type LlmServiceScope = 'runtime' | 'contract';
+export interface LlmService {
+    name: string;
+    provider: LlmServiceProvider;
+    model: string;
+    priority: number;
+    position: number;
+    /** Per-service override; absent when null (drops null per FR-A06). */
+    temperature?: number;
+    /** Per-service override; absent when null. */
+    max_tokens?: number;
+}
+export type LlmServicesListResponse = LlmService[];
+export type LlmServiceResponse = LlmService;
+export interface LlmServiceQuery {
+    /** REQUIRED — `runtime` or `contract`. The actor's allowlist for that scope. */
+    scope: LlmServiceScope;
+}
+export declare class LlmServicesResource {
+    private readonly client;
+    constructor(client: FetchClient);
+    /**
+     * List the LLM services the actor is authorized to `use` in `scope`.
+     * Privileged operators see the full catalog because their YAML policies
+     * grant them `use` on every service.
+     */
+    list(query: LlmServiceQuery, options?: LocaleOptions): Promise<LlmServicesListResponse>;
+    /**
+     * Fetch a single service by name in `scope`. Returns 404 indistinguishable
+     * from "doesn't exist" when the actor is not authorized (FR-B02 no-leak).
+     */
+    get(name: string, query: LlmServiceQuery, options?: LocaleOptions): Promise<LlmServiceResponse>;
+}
+//# sourceMappingURL=llm-services.d.ts.map

package/dist/resources/llm-services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-services.d.ts","sourceRoot":"","sources":["../../src/resources/llm-services.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAC/E,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,UAAU;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,uBAAuB,GAAG,UAAU,EAAE,CAAC;AAEnD,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC5B,gFAAgF;IAChF,KAAK,EAAE,eAAe,CAAC;CAC1B;AAED,qBAAa,mBAAmB;IAChB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEhD;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAM7F;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;CASxG"}

package/dist/resources/llm-services.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * LLM service catalog resource (T074, SpecKit 010 / ADR-0087).
+ *
+ * Read-only over the LLM service catalog, ALWAYS actor-filtered (FR-B02
+ * no-leak). The wire surface returns only services for which the actor has
+ * a `use` policy in the requested scope; privileged roles see everything
+ * because their YAML policies grant them `use` on every service (no code-
+ * level role bypass — ADR-0001 §6).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LlmServicesResource = void 0;
+class LlmServicesResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * List the LLM services the actor is authorized to `use` in `scope`.
+     * Privileged operators see the full catalog because their YAML policies
+     * grant them `use` on every service.
+     */
+    async list(query, options) {
+        const params = new URLSearchParams({ scope: query.scope });
+        if (options?.locale)
+            params.set('locale', options.locale);
+        return this.client.get(`/runtime/llm/services?${params.toString()}`, undefined, { operationId: 'listLlmServices' });
+    }
+    /**
+     * Fetch a single service by name in `scope`. Returns 404 indistinguishable
+     * from "doesn't exist" when the actor is not authorized (FR-B02 no-leak).
+     */
+    async get(name, query, options) {
+        const params = new URLSearchParams({ scope: query.scope });
+        if (options?.locale)
+            params.set('locale', options.locale);
+        return this.client.get(`/runtime/llm/services/${encodeURIComponent(name)}?${params.toString()}`, undefined, { operationId: 'getLlmService' });
+    }
+}
+exports.LlmServicesResource = LlmServicesResource;
+//# sourceMappingURL=llm-services.js.map

package/dist/resources/llm-services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-services.js","sourceRoot":"","sources":["../../src/resources/llm-services.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AA8BH,MAAa,mBAAmB;IACC;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,KAAsB,EAAE,OAAuB;QACtD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAA0B,yBAAyB,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACjJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAsB,EAAE,OAAuB;QACnE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAClB,yBAAyB,kBAAkB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EACxE,SAAS,EACT,EAAE,WAAW,EAAE,eAAe,EAAE,CACnC,CAAC;IACN,CAAC;CACJ;AA3BD,kDA2BC"}

package/dist/resources/mcp.d.ts

@@ -0,0 +1,8 @@
+import type { FetchClient } from '../_internal/fetch-client';
+import type { McpJsonRpcRequest, McpJsonRpcResponse } from '../types/mcp';
+export declare class McpResource {
+    private readonly client;
+    constructor(client: FetchClient);
+    call(message: McpJsonRpcRequest): Promise<McpJsonRpcResponse>;
+}
+//# sourceMappingURL=mcp.d.ts.map

package/dist/resources/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/resources/mcp.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE1E,qBAAa,WAAW;IACR,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEhD,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAGhE"}

package/dist/resources/mcp.js

@@ -0,0 +1,25 @@
+"use strict";
+// Spec 2 (track G) — runtime.mcp.call.
+//
+// Types the now-real MCP "Streamable HTTP" transport (POST /runtime/mcp,
+// stateless JSON-RPC; Spec 1 = PR #133). Sends one MCP JSON-RPC message and
+// returns the typed response, de-framing either an application/json body or a
+// single text/event-stream frame. Bare JSON-RPC — NOT the {success,data}
+// envelope. A protocol-level JSON-RPC error is returned in the union (callers
+// discriminate with `'error' in res`); transport failures throw. Single
+// attempt — no retry (tools/call may be a non-idempotent mutation). For a full
+// MCP client (sessions, server-push) use @modelcontextprotocol/sdk; this is a
+// thin, zero-dependency one-shot call.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpResource = void 0;
+class McpResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    call(message) {
+        return this.client.postMcp('/runtime/mcp', message);
+    }
+}
+exports.McpResource = McpResource;
+//# sourceMappingURL=mcp.js.map

package/dist/resources/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/resources/mcp.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAC9E,wEAAwE;AACxE,+EAA+E;AAC/E,8EAA8E;AAC9E,uCAAuC;;;AAKvC,MAAa,WAAW;IACS;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,IAAI,CAAC,OAA0B;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CACJ;AAND,kCAMC"}

package/dist/resources/receipts.d.ts

@@ -0,0 +1,25 @@
+import type { FetchClient } from '../_internal/fetch-client';
+import { PagePromise } from '../_internal/pagination';
+import type { Receipt, ReceiptListParams, ReceiptListResponse } from '../types/receipt';
+/**
+ * End-user verifiable receipts resource (Desk Spec 3).
+ *
+ *   client.runtime.receipts.list()                    → GET /runtime/receipts
+ *   client.runtime.receipts.list({ signal: 'refusal' })
+ *   client.runtime.receipts.list({ trace_id })
+ *
+ * Returns a {@link PagePromise}: `await` it for the first page
+ * (`{ items, next_cursor }`), or `for await (… of …)` to auto-paginate over
+ * every receipt to exhaustion. Each `Receipt` is the CALLER'S OWN governance
+ * event (scoped server-side to the token actor — no `view_traces`), carrying
+ * only a non-reversible proof (hash + masked value), never the raw value.
+ * Mirrors `client.runtime.audit.list` (the operator, tenant-wide surface).
+ */
+export declare class ReceiptsResource {
+    private readonly client;
+    constructor(client: FetchClient);
+    list(params?: ReceiptListParams, options?: {
+        signal?: AbortSignal;
+    }): PagePromise<ReceiptListResponse, Receipt>;
+}
+//# sourceMappingURL=receipts.d.ts.map

package/dist/resources/receipts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipts.d.ts","sourceRoot":"","sources":["../../src/resources/receipts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAgC,MAAM,yBAAyB,CAAC;AACpF,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAExF;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAgB;IACN,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEhD,IAAI,CACP,MAAM,CAAC,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACnC,WAAW,CAAC,mBAAmB,EAAE,OAAO,CAAC;CA6B/C"}

package/dist/resources/receipts.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReceiptsResource = void 0;
+const pagination_1 = require("../_internal/pagination");
+/**
+ * End-user verifiable receipts resource (Desk Spec 3).
+ *
+ *   client.runtime.receipts.list()                    → GET /runtime/receipts
+ *   client.runtime.receipts.list({ signal: 'refusal' })
+ *   client.runtime.receipts.list({ trace_id })
+ *
+ * Returns a {@link PagePromise}: `await` it for the first page
+ * (`{ items, next_cursor }`), or `for await (… of …)` to auto-paginate over
+ * every receipt to exhaustion. Each `Receipt` is the CALLER'S OWN governance
+ * event (scoped server-side to the token actor — no `view_traces`), carrying
+ * only a non-reversible proof (hash + masked value), never the raw value.
+ * Mirrors `client.runtime.audit.list` (the operator, tenant-wide surface).
+ */
+class ReceiptsResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    list(params, options) {
+        const path = '/runtime/receipts';
+        const buildQuery = (cursor, limit) => {
+            const query = {};
+            if (params?.signal !== undefined)
+                query.signal = params.signal;
+            if (params?.trace_id !== undefined)
+                query.trace_id = params.trace_id;
+            if (params?.from !== undefined)
+                query.from = params.from;
+            if (params?.to !== undefined)
+                query.to = params.to;
+            if (limit !== undefined)
+                query.limit = limit;
+            if (cursor !== undefined)
+                query.cursor = cursor;
+            return query;
+        };
+        const signal = options?.signal;
+        const fetchPage = (p) => this.client.get(path, buildQuery(p.cursor, p.limit), {
+            operationId: 'listReceipts',
+            ...(signal ? { signal } : {}),
+        });
+        return new pagination_1.PagePromise(fetchPage, (0, pagination_1.cursorBased)((page) => page.items, (page) => page.next_cursor), {
+            ...(params?.limit !== undefined ? { limit: params.limit } : {}),
+            ...(params?.cursor !== undefined ? { cursor: params.cursor } : {}),
+        });
+    }
+}
+exports.ReceiptsResource = ReceiptsResource;
+//# sourceMappingURL=receipts.js.map

package/dist/resources/receipts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipts.js","sourceRoot":"","sources":["../../src/resources/receipts.ts"],"names":[],"mappings":";;;AACA,wDAAoF;AAGpF;;;;;;;;;;;;;GAaG;AACH,MAAa,gBAAgB;IACW;IAApC,YAAoC,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,IAAI,CACP,MAA0B,EAC1B,OAAkC;QAElC,MAAM,IAAI,GAAG,mBAAmB,CAAC;QACjC,MAAM,UAAU,GAAG,CAAC,MAAe,EAAE,KAAc,EAAyD,EAAE;YAC1G,MAAM,KAAK,GAA0D,EAAE,CAAC;YACxE,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/D,IAAI,MAAM,EAAE,QAAQ,KAAK,SAAS;gBAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACrE,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzD,IAAI,MAAM,EAAE,EAAE,KAAK,SAAS;gBAAE,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,KAAK,SAAS;gBAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;YAChD,OAAO,KAAK,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAa,EAAgC,EAAE,CAC9D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAsB,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE;YACtE,WAAW,EAAE,cAAc;YAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAC;QAEP,OAAO,IAAI,wBAAW,CAClB,SAAS,EACT,IAAA,wBAAW,EAA+B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAC3F;YACI,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CACJ,CAAC;IACN,CAAC;CACJ;AAnCD,4CAmCC"}

package/dist/resources/records.d.ts

@@ -0,0 +1,51 @@
+import { type FetchClient } from '../_internal/fetch-client';
+import { PagePromise } from '../_internal/pagination';
+import type { ConfirmationRetryOptions } from '../types/confirmation';
+import type { BulkImportRequest, BulkImportResponse } from '../types/imports';
+import type { RecordData, RecordListParams, RecordListResponse, RecordResponse } from '../types/records';
+import type { LocaleOptions } from '../types/locale';
+/** Options for paginated list calls — locale plus an optional cancellation signal. */
+type ListOptions = LocaleOptions & {
+    signal?: AbortSignal;
+};
+export declare class RecordsResource {
+    private readonly client;
+    constructor(client: FetchClient);
+    /**
+     * List and filter records for a given entity.
+     *
+     * Returns a {@link PagePromise}: `await` it for the first page
+     * (`{ records, total }` — unchanged), or `for await (… of …)` to
+     * auto-paginate over every record across all pages. Pass `{ signal }` to
+     * cancel an in-flight page; `break` also stops further fetches.
+     */
+    list(entityName: string, params?: RecordListParams, options?: ListOptions): PagePromise<RecordListResponse, RecordData>;
+    /**
+     * Get a single record by ID.
+     */
+    get(entityName: string, recordId: string | number, options?: LocaleOptions): Promise<RecordResponse>;
+    /**
+     * Create a new record for the specified entity.
+     *
+     * A `confirm` guard can pause this write: the thrown `ZarelAPIError` carries
+     * `.confirmation` (ADR-0127 US3). Show every `guards[].prompt`, then call
+     * again with the IDENTICAL `data` plus `{ confirmationToken }`.
+     */
+    create(entityName: string, data: Record<string, unknown>, options?: ConfirmationRetryOptions): Promise<RecordResponse>;
+    /**
+     * Create multiple records for the specified entity in a single request.
+     */
+    bulk(entityName: string, request: BulkImportRequest): Promise<BulkImportResponse>;
+    /**
+     * Update an existing record. See {@link create} for the confirmation
+     * round-trip `options.confirmationToken` completes.
+     */
+    update(entityName: string, recordId: string | number, data: Partial<RecordData>, options?: ConfirmationRetryOptions): Promise<RecordResponse>;
+    /**
+     * Delete a record. See {@link create} for the confirmation round-trip
+     * `options.confirmationToken` completes.
+     */
+    delete(entityName: string, recordId: string | number, options?: ConfirmationRetryOptions): Promise<void>;
+}
+export {};
+//# sourceMappingURL=records.d.ts.map

package/dist/resources/records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../src/resources/records.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAe,MAAM,2BAA2B,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAoC,MAAM,yBAAyB,CAAC;AACxF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EACR,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,sFAAsF;AACtF,KAAK,WAAW,GAAG,aAAa,GAAG;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,CAAC;AAE5D,qBAAa,eAAe;IACZ,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEhD;;;;;;;OAOG;IACH,IAAI,CACA,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,WAAW,GACtB,WAAW,CAAC,kBAAkB,EAAE,UAAU,CAAC;IAyC9C;;OAEG;IACG,GAAG,CACL,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GAAG,MAAM,EACzB,OAAO,CAAC,EAAE,aAAa,GACxB,OAAO,CAAC,cAAc,CAAC;IAQ1B;;;;;;OAMG;IACG,MAAM,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,wBAAwB,GACnC,OAAO,CAAC,cAAc,CAAC;IAO1B;;OAEG;IACG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIvF;;;OAGG;IACG,MAAM,CACR,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GAAG,MAAM,EACzB,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EACzB,OAAO,CAAC,EAAE,wBAAwB,GACnC,OAAO,CAAC,cAAc,CAAC;IAO1B;;;OAGG;IACG,MAAM,CACR,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GAAG,MAAM,EACzB,OAAO,CAAC,EAAE,wBAAwB,GACnC,OAAO,CAAC,IAAI,CAAC;CAMnB"}

package/dist/resources/records.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RecordsResource = void 0;
+const fetch_client_1 = require("../_internal/fetch-client");
+const confirmation_1 = require("../_internal/confirmation");
+const pagination_1 = require("../_internal/pagination");
+class RecordsResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * List and filter records for a given entity.
+     *
+     * Returns a {@link PagePromise}: `await` it for the first page
+     * (`{ records, total }` — unchanged), or `for await (… of …)` to
+     * auto-paginate over every record across all pages. Pass `{ signal }` to
+     * cancel an in-flight page; `break` also stops further fetches.
+     */
+    list(entityName, params, options) {
+        const buildQuery = (offset, limit) => {
+            const query = {};
+            if (limit !== undefined)
+                query.limit = limit;
+            if (offset !== undefined)
+                query.offset = offset;
+            if (params?.filters) {
+                for (const [key, value] of Object.entries(params.filters)) {
+                    if (value === null || value === undefined)
+                        continue;
+                    if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
+                        query[`filters[${key}]`] = value;
+                    }
+                    else {
+                        query[`filters[${key}]`] = JSON.stringify(value);
+                    }
+                }
+            }
+            if (params?.sort && params.sort.length > 0) {
+                query.sort = JSON.stringify(params.sort);
+            }
+            if (options?.locale)
+                query.locale = options.locale;
+            return query;
+        };
+        const signal = options?.signal;
+        const fetchPage = (p) => {
+            const query = buildQuery(p.offset, p.limit);
+            return this.client.get(`/runtime/records/${entityName}`, query, { operationId: 'listRuntimeRecords', ...(signal ? { signal } : {}) });
+        };
+        return new pagination_1.PagePromise(fetchPage, (0, pagination_1.offsetWithTotal)((page) => page.records, (page) => page.total), {
+            ...(params?.limit !== undefined ? { limit: params.limit } : {}),
+            ...(params?.offset !== undefined ? { offset: params.offset } : {}),
+        });
+    }
+    /**
+     * Get a single record by ID.
+     */
+    async get(entityName, recordId, options) {
+        return this.client.get(`/runtime/records/${entityName}/${recordId}`, (0, fetch_client_1.localeQuery)(options), { operationId: 'getRuntimeRecord' });
+    }
+    /**
+     * Create a new record for the specified entity.
+     *
+     * A `confirm` guard can pause this write: the thrown `ZarelAPIError` carries
+     * `.confirmation` (ADR-0127 US3). Show every `guards[].prompt`, then call
+     * again with the IDENTICAL `data` plus `{ confirmationToken }`.
+     */
+    async create(entityName, data, options) {
+        return this.client.post(`/runtime/records/${entityName}`, data, {
+            operationId: 'createRuntimeRecord',
+            headers: (0, confirmation_1.confirmationHeaders)(options?.confirmationToken),
+        });
+    }
+    /**
+     * Create multiple records for the specified entity in a single request.
+     */
+    async bulk(entityName, request) {
+        return this.client.post(`/runtime/records/${entityName}/bulk`, request, { operationId: 'bulkImportRuntimeRecords' });
+    }
+    /**
+     * Update an existing record. See {@link create} for the confirmation
+     * round-trip `options.confirmationToken` completes.
+     */
+    async update(entityName, recordId, data, options) {
+        return this.client.patch(`/runtime/records/${entityName}/${recordId}`, data, {
+            operationId: 'patchRuntimeRecord',
+            headers: (0, confirmation_1.confirmationHeaders)(options?.confirmationToken),
+        });
+    }
+    /**
+     * Delete a record. See {@link create} for the confirmation round-trip
+     * `options.confirmationToken` completes.
+     */
+    async delete(entityName, recordId, options) {
+        await this.client.del(`/runtime/records/${entityName}/${recordId}`, {
+            operationId: 'deleteRuntimeRecord',
+            headers: (0, confirmation_1.confirmationHeaders)(options?.confirmationToken),
+        });
+    }
+}
+exports.RecordsResource = RecordsResource;
+//# sourceMappingURL=records.js.map

package/dist/resources/records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.js","sourceRoot":"","sources":["../../src/resources/records.ts"],"names":[],"mappings":";;;AAAA,4DAA0E;AAC1E,4DAAgE;AAChE,wDAAwF;AAcxF,MAAa,eAAe;IACK;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD;;;;;;;OAOG;IACH,IAAI,CACA,UAAkB,EAClB,MAAyB,EACzB,OAAqB;QAErB,MAAM,UAAU,GAAG,CAAC,MAAe,EAAE,KAAc,EAAyD,EAAE;YAC1G,MAAM,KAAK,GAA0D,EAAE,CAAC;YACxE,IAAI,KAAK,KAAK,SAAS;gBAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;YAEhD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBAClB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;wBAAE,SAAS;oBACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;wBACvF,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC;oBACrC,CAAC;yBAAM,CAAC;wBACJ,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;oBACrD,CAAC;gBACL,CAAC;YACL,CAAC;YAED,IAAI,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,OAAO,EAAE,MAAM;gBAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YACnD,OAAO,KAAK,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAa,EAA+B,EAAE;YAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAqB,oBAAoB,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9J,CAAC,CAAC;QAEF,OAAO,IAAI,wBAAW,CAClB,SAAS,EACT,IAAA,4BAAe,EAAiC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAC7F;YACI,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CACJ,CAAC;IACN,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CACL,UAAkB,EAClB,QAAyB,EACzB,OAAuB;QAEvB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAClB,oBAAoB,UAAU,IAAI,QAAQ,EAAE,EAC5C,IAAA,0BAAW,EAAC,OAAO,CAAC,EACpB,EAAE,WAAW,EAAE,kBAAkB,EAAE,CACtC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACR,UAAkB,EAClB,IAA6B,EAC7B,OAAkC;QAElC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAiB,oBAAoB,UAAU,EAAE,EAAE,IAAI,EAAE;YAC5E,WAAW,EAAE,qBAAqB;YAClC,OAAO,EAAE,IAAA,kCAAmB,EAAC,OAAO,EAAE,iBAAiB,CAAC;SAC3D,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,OAA0B;QACrD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAqB,oBAAoB,UAAU,OAAO,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAC7I,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACR,UAAkB,EAClB,QAAyB,EACzB,IAAyB,EACzB,OAAkC;QAElC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAiB,oBAAoB,UAAU,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE;YACzF,WAAW,EAAE,oBAAoB;YACjC,OAAO,EAAE,IAAA,kCAAmB,EAAC,OAAO,EAAE,iBAAiB,CAAC;SAC3D,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACR,UAAkB,EAClB,QAAyB,EACzB,OAAkC;QAElC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,UAAU,IAAI,QAAQ,EAAE,EAAE;YAChE,WAAW,EAAE,qBAAqB;YAClC,OAAO,EAAE,IAAA,kCAAmB,EAAC,OAAO,EAAE,iBAAiB,CAAC;SAC3D,CAAC,CAAC;IACP,CAAC;CACJ;AA9HD,0CA8HC"}

package/dist/resources/role-assignments.d.ts

@@ -0,0 +1,27 @@
+import { type FetchClient } from '../_internal/fetch-client';
+import type { RoleAssignRequest } from '../types/platform';
+import type { LocaleOptions } from '../types/locale';
+import type { RoleAssignmentListPayload, RoleAssignmentPayload } from '../generated';
+/**
+ * Role assignments (runtime-scope, resource-shaped). Replaces the pre-P12
+ * action-style `RolesResource.assign/revoke` with canonical CRUD that
+ * mirrors `/runtime/roles/assignments`.
+ */
+export declare class RoleAssignmentsResource {
+    private readonly client;
+    constructor(client: FetchClient);
+    list(options?: LocaleOptions): Promise<RoleAssignmentListPayload>;
+    /**
+     * Assign a role to a user (canonical POST).
+     *
+     * The SDK input shape uses `target_user_name` to distinguish the
+     * grantee from the calling actor; the api-service collection takes
+     * `user_name`, so the body is mapped here at the wire boundary.
+     */
+    create(request: RoleAssignRequest): Promise<RoleAssignmentPayload>;
+    /**
+     * Revoke a role assignment (canonical DELETE by composite natural key).
+     */
+    delete(userName: string, roleName: string): Promise<void>;
+}
+//# sourceMappingURL=role-assignments.d.ts.map

package/dist/resources/role-assignments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-assignments.d.ts","sourceRoot":"","sources":["../../src/resources/role-assignments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAe,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErF;;;;GAIG;AACH,qBAAa,uBAAuB;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAE1C,IAAI,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIvE;;;;;;OAMG;IACG,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQxE;;OAEG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlE"}

package/dist/resources/role-assignments.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleAssignmentsResource = void 0;
+const fetch_client_1 = require("../_internal/fetch-client");
+/**
+ * Role assignments (runtime-scope, resource-shaped). Replaces the pre-P12
+ * action-style `RolesResource.assign/revoke` with canonical CRUD that
+ * mirrors `/runtime/roles/assignments`.
+ */
+class RoleAssignmentsResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async list(options) {
+        return this.client.get('/runtime/roles/assignments', (0, fetch_client_1.localeQuery)(options), { operationId: 'listRoleAssignments' });
+    }
+    /**
+     * Assign a role to a user (canonical POST).
+     *
+     * The SDK input shape uses `target_user_name` to distinguish the
+     * grantee from the calling actor; the api-service collection takes
+     * `user_name`, so the body is mapped here at the wire boundary.
+     */
+    async create(request) {
+        return this.client.post('/runtime/roles/assignments', {
+            user_name: request.target_user_name,
+            role_name: request.role_name,
+            ...(request.expires_at !== undefined ? { expires_at: request.expires_at } : {}),
+        }, { operationId: 'createRoleAssignment' });
+    }
+    /**
+     * Revoke a role assignment (canonical DELETE by composite natural key).
+     */
+    async delete(userName, roleName) {
+        await this.client.del(`/runtime/roles/assignments/${encodeURIComponent(userName)}/${encodeURIComponent(roleName)}`, { operationId: 'deleteRoleAssignment' });
+    }
+}
+exports.RoleAssignmentsResource = RoleAssignmentsResource;
+//# sourceMappingURL=role-assignments.js.map

package/dist/resources/role-assignments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-assignments.js","sourceRoot":"","sources":["../../src/resources/role-assignments.ts"],"names":[],"mappings":";;;AAAA,4DAA0E;AAK1E;;;;GAIG;AACH,MAAa,uBAAuB;IACH;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,IAAI,CAAC,OAAuB;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAA4B,4BAA4B,EAAE,IAAA,0BAAW,EAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAClJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,OAA0B;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAwB,4BAA4B,EAAE;YACzE,SAAS,EAAE,OAAO,CAAC,gBAAgB;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,QAAgB;QAC3C,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CACjB,8BAA8B,kBAAkB,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAC5F,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAC1C,CAAC;IACN,CAAC;CACJ;AA/BD,0DA+BC"}

package/dist/resources/roles.d.ts

@@ -0,0 +1,39 @@
+import { type FetchClient } from '../_internal/fetch-client';
+import type { LocaleOptions } from '../types/locale';
+import type { RolePayload } from '../generated';
+export interface RoleCreateInput {
+    readonly name: string;
+    readonly label: string;
+    readonly description?: string;
+    readonly auto_assign?: boolean;
+}
+export interface RoleUpdatePatch {
+    readonly label?: string;
+    readonly description?: string;
+    readonly auto_assign?: boolean;
+}
+/** Codegen-derived (ADR-0109); the stable consumer-facing name is kept. */
+export type RoleRecord = RolePayload;
+/**
+ * CRUD over `contract.roles` — the role definitions the tenant declares
+ * outside (or alongside) a YAML import. Maps to api-service `/roles` per
+ * ADR-0077 canonical routes; class name follows ADR-0080 §1
+ * (`contract.roles` → `RoleRepository` → `RolesResource`).
+ *
+ * Role assignments live on `runtime."roles/assignments"` and are exposed
+ * via `RoleAssignmentsResource` — they are a separate table, not a
+ * sub-method of this resource (see role-assignments.ts).
+ */
+export declare class RolesResource {
+    private readonly client;
+    constructor(client: FetchClient);
+    list(options?: LocaleOptions): Promise<RoleRecord[]>;
+    /** Read a single role definition by name. Sub-spec A (A4) gap-fill. */
+    get(name: string, options?: LocaleOptions): Promise<RoleRecord>;
+    create(input: RoleCreateInput): Promise<RoleRecord>;
+    /** Replace a role definition wholesale (PUT). {@link update} is the partial (PATCH) counterpart. */
+    put(name: string, input: RoleCreateInput): Promise<RoleRecord>;
+    update(name: string, patch: RoleUpdatePatch): Promise<RoleRecord>;
+    delete(name: string): Promise<void>;
+}
+//# sourceMappingURL=roles.d.ts.map

package/dist/resources/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/resources/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAe,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,eAAe;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,2EAA2E;AAC3E,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;;;;GASG;AACH,qBAAa,aAAa;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAE1C,IAAI,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAI1D,uEAAuE;IACjE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/D,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAIzD,oGAAoG;IAC9F,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAI9D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAIjE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG5C"}

package/dist/resources/roles.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RolesResource = void 0;
+const fetch_client_1 = require("../_internal/fetch-client");
+/**
+ * CRUD over `contract.roles` — the role definitions the tenant declares
+ * outside (or alongside) a YAML import. Maps to api-service `/roles` per
+ * ADR-0077 canonical routes; class name follows ADR-0080 §1
+ * (`contract.roles` → `RoleRepository` → `RolesResource`).
+ *
+ * Role assignments live on `runtime."roles/assignments"` and are exposed
+ * via `RoleAssignmentsResource` — they are a separate table, not a
+ * sub-method of this resource (see role-assignments.ts).
+ */
+class RolesResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async list(options) {
+        return this.client.get('/contract/roles', (0, fetch_client_1.localeQuery)(options), { operationId: 'listRoles' });
+    }
+    /** Read a single role definition by name. Sub-spec A (A4) gap-fill. */
+    async get(name, options) {
+        return this.client.get(`/contract/roles/${encodeURIComponent(name)}`, (0, fetch_client_1.localeQuery)(options), { operationId: 'getRole' });
+    }
+    async create(input) {
+        return this.client.post('/contract/roles', input, { operationId: 'createRole' });
+    }
+    /** Replace a role definition wholesale (PUT). {@link update} is the partial (PATCH) counterpart. */
+    async put(name, input) {
+        return this.client.put(`/contract/roles/${encodeURIComponent(name)}`, input, { operationId: 'replaceRole' });
+    }
+    async update(name, patch) {
+        return this.client.patch(`/contract/roles/${encodeURIComponent(name)}`, patch, { operationId: 'patchRole' });
+    }
+    async delete(name) {
+        await this.client.del(`/contract/roles/${encodeURIComponent(name)}`, { operationId: 'deleteRole' });
+    }
+}
+exports.RolesResource = RolesResource;
+//# sourceMappingURL=roles.js.map

package/dist/resources/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/resources/roles.ts"],"names":[],"mappings":";;;AAAA,4DAA0E;AAoB1E;;;;;;;;;GASG;AACH,MAAa,aAAa;IACO;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,IAAI,CAAC,OAAuB;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAe,iBAAiB,EAAE,IAAA,0BAAW,EAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,OAAuB;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAa,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAA,0BAAW,EAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IACxI,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAsB;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAa,iBAAiB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAsB;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAa,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;IAC7H,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,KAAsB;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAa,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7H,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;IACxG,CAAC;CACJ;AA5BD,sCA4BC"}

package/dist/resources/runtime-entities.d.ts

@@ -0,0 +1,23 @@
+import type { FetchClient } from '../_internal/fetch-client';
+import type { EntityMutationPayload } from '../generated';
+/**
+ * Runtime-plane entity operations.
+ *
+ * Only `recompute` lives here, and deliberately so: ADR-0098 D9 puts entity and
+ * field AUTHORING on the contract plane (`client.contract.entities`), because
+ * those mutate contract state. Recompute mutates `runtime.records`, so it is a
+ * runtime-plane verb and shares both implementation and authority with the MCP
+ * `recompute_entity` tool.
+ *
+ * It moved here from `contract.entities.recompute`, where serving it required
+ * the contract binary to spawn a runtime writer.
+ */
+export declare class RuntimeEntitiesResource {
+    private readonly client;
+    constructor(client: FetchClient);
+    /**
+     * Recompute the derived fields of every record of an entity.
+     */
+    recompute(entityName: string): Promise<EntityMutationPayload>;
+}
+//# sourceMappingURL=runtime-entities.d.ts.map

package/dist/resources/runtime-entities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-entities.d.ts","sourceRoot":"","sources":["../../src/resources/runtime-entities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,qBAAa,uBAAuB;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEhD;;OAEG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAOtE"}

package/dist/resources/runtime-entities.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeEntitiesResource = void 0;
+/**
+ * Runtime-plane entity operations.
+ *
+ * Only `recompute` lives here, and deliberately so: ADR-0098 D9 puts entity and
+ * field AUTHORING on the contract plane (`client.contract.entities`), because
+ * those mutate contract state. Recompute mutates `runtime.records`, so it is a
+ * runtime-plane verb and shares both implementation and authority with the MCP
+ * `recompute_entity` tool.
+ *
+ * It moved here from `contract.entities.recompute`, where serving it required
+ * the contract binary to spawn a runtime writer.
+ */
+class RuntimeEntitiesResource {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Recompute the derived fields of every record of an entity.
+     */
+    async recompute(entityName) {
+        return this.client.post(`/runtime/entities/${encodeURIComponent(entityName)}/recompute`, undefined, { operationId: 'recomputeEntity' });
+    }
+}
+exports.RuntimeEntitiesResource = RuntimeEntitiesResource;
+//# sourceMappingURL=runtime-entities.js.map

package/dist/resources/runtime-entities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-entities.js","sourceRoot":"","sources":["../../src/resources/runtime-entities.ts"],"names":[],"mappings":";;;AAGA;;;;;;;;;;;GAWG;AACH,MAAa,uBAAuB;IACH;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,UAAkB;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,qBAAqB,kBAAkB,CAAC,UAAU,CAAC,YAAY,EAC/D,SAAS,EACT,EAAE,WAAW,EAAE,iBAAiB,EAAE,CACrC,CAAC;IACN,CAAC;CACJ;AAbD,0DAaC"}