@ziggs-ai/agent-sdk 0.2.1 → 0.2.2

package/dist/server/tools/tier2/contextTools.js

@@ -1,16 +1,78 @@
 import { defineTool } from '../../../tools/defineTool.js';
-import { ZiggsContextClient } from '../../ziggscontext/ZiggsContextClient.js';
-function clientFor(ctx) {
+import { ContextDiscoveryClient, ContextGrantsClient, ContextReadClient, } from '@ziggs-ai/api-client';
+/**
+ * Context grant calls impersonate the grant holder, so both operatorKey (fleet
+ * or agent-scoped key) and agentId (X-Agent-Id) must be on the tool context.
+ * The same api-client clients back ziggs-mcp — one wire contract, no fork
+ * (ZIG-869 / ZIG-775).
+ */
+function creds(ctx) {
     const operatorKey = ctx?.['operatorKey'];
+    const agentId = ctx?.['agentId'];
     if (!operatorKey)
         throw new Error('operatorKey missing from tool context');
-    return new ZiggsContextClient({
-        operatorKey,
-        actAsAgentId: ctx?.['agentId'] || undefined,
-    });
+    if (!agentId)
+        throw new Error('agentId missing from tool context');
+    return { operatorKey, agentId };
 }
-export const contextDiscoverTool = defineTool('context_discover', {}, async (_args, ctx) => clientFor(ctx).discover(), {
-    description: 'List every context grant this agent holds, as scope descriptors — grantId, scope, temporal, watermarkAt, expiresAt (no message or artifact content).',
+const CONTEXT_READ_TYPES = [
+    'messages',
+    'artifacts',
+    'agreements',
+    'tasks',
+];
+export const contextReadTool = defineTool('context_read', {
+    type: {
+        type: 'string',
+        required: true,
+        enum: [...CONTEXT_READ_TYPES],
+        description: 'Resource type to read from the scope',
+    },
+    via: {
+        type: 'string',
+        required: true,
+        description: 'Scope entry you hold, e.g. chat:<id>, agreement:<id>, task:<id>',
+    },
+    cursor: { type: 'string', description: 'Opaque cursor from a prior nextCursor to page' },
+    after: {
+        type: 'string',
+        description: 'ISO timestamp for forward-delta (messages/artifacts)',
+    },
+    direction: {
+        type: 'string',
+        enum: ['forward'],
+        description: 'Use "forward" with after for a message forward-delta',
+    },
+    limit: { type: 'number', description: 'Page size (server default when omitted)' },
+    state: { type: 'string', description: 'Task state filter (tasks only)' },
+    contextGrantId: {
+        type: 'string',
+        description: 'Pin a specific grant when you hold several over the same scope',
+    },
+}, async (args, ctx) => {
+    const { operatorKey, agentId } = creds(ctx);
+    const type = args['type'];
+    if (!CONTEXT_READ_TYPES.includes(type)) {
+        throw new Error(`type must be one of ${CONTEXT_READ_TYPES.join(', ')}`);
+    }
+    const via = args['via'];
+    if (!via)
+        throw new Error('via is required');
+    const direction = args['direction'];
+    if (direction !== undefined && direction !== 'forward') {
+        throw new Error('direction must be "forward"');
+    }
+    return new ContextReadClient(operatorKey, agentId).read(type, {
+        via,
+        cursor: args['cursor'],
+        after: args['after'],
+        direction: direction,
+        limit: typeof args['limit'] === 'number' ? args['limit'] : undefined,
+        state: args['state'],
+        contextGrantId: args['contextGrantId'],
+    });
+}, {
+    description: 'Read the contents of a scope you already hold a grant for: messages | artifacts | agreements | tasks. Use list_grants first to see which scopes your grants cover, then read through any of them. Cursored; all access is grant-fenced server-side.',
 });
 export const contextDelegateTool = defineTool('context_delegate', {
     parentGrantId: { type: 'string', required: true },
@@ -29,8 +91,8 @@ export const contextDelegateTool = defineTool('context_delegate', {
     if (scopeKind !== 'chat' && scopeKind !== 'agreement' && scopeKind !== 'org') {
         throw new Error('scopeKind must be chat, agreement, or org');
     }
-    return clientFor(ctx).delegate({
-        parentGrantId: args['parentGrantId'],
+    const { operatorKey, agentId } = creds(ctx);
+    return new ContextGrantsClient(operatorKey, agentId).delegateGrant(args['parentGrantId'], {
         holderId: args['holderId'],
         scope: { kind: scopeKind, id: args['scopeId'] },
         temporal,
@@ -38,9 +100,40 @@ export const contextDelegateTool = defineTool('context_delegate', {
         watermarkAt: args['watermarkAt'],
     });
 }, {
-    description: 'Delegate a narrower child context grant (tighter scope, shorter expiry, or from-now). Holder-only.',
+    description: 'Delegate a narrower child context grant (tighter scope, shorter expiry, or from-now). Holder-only. Delegating a grant whose original owner is another party opens an approval request rather than minting immediately (status: pending_approval).',
+});
+export const contextExpandReachTool = defineTool('context_expand_reach', {
+    grantId: {
+        type: 'string',
+        required: true,
+        description: 'A grant you hold (grantId from list_grants) to expand',
+    },
+}, async (args, ctx) => {
+    const { operatorKey, agentId } = creds(ctx);
+    const grantId = args['grantId'];
+    if (!grantId)
+        throw new Error('grantId is required');
+    return new ContextGrantsClient(operatorKey, agentId).getReach(grantId);
+}, {
+    description: 'Expand a grant you hold into the chat/agreement ids inside its scope, so you can read through it. list_grants tells you that you hold e.g. org:acme or agreement:x; this returns the actual { chats, agreements } (ids + labels only, no content) that scope covers — feed an id to context_read (via=chat:<id> / agreement:<id>). Org scope is capped: truncatedChats/truncatedAgreements say how many were left off. Holder-only, grant-fenced.',
+});
+// ZIG-754 — the negative-space complement to the reach tools. list_grants /
+// context_expand_reach answer "what CAN I read?"; this answers "what exists
+// just outside my fence that I CAN'T read yet?" so the agent can flag missing
+// context and make an informed widen request instead of silently
+// under-delivering on partial context. The MCP surface has had this as
+// ziggs_discover_grantable; this is its SDK/legibility complement, backed by
+// the same ContextDiscoveryClient (one wire contract, no fork).
+export const contextDiscoverGrantableTool = defineTool('context_discover_grantable', {}, async (_args, ctx) => {
+    const { operatorKey, agentId } = creds(ctx);
+    const items = await new ContextDiscoveryClient(operatorKey, agentId).discoverGrantable();
+    return { count: items.length, items };
+}, {
+    description: 'See what context EXISTS in your orgs that you CANNOT read yet — the inverse of list_grants. Returns labels only ({ type, label, scopeRef, orgId } per item), never content, member names, tokens, or money. Bounded to orgs you have an active agreement in, and excludes anything you already hold a grant for. Use it to notice you may be missing context, then either ask your human to grant a scopeRef, or (if you hold a broader grant) context_delegate using that scopeRef. Pair with list_grants (what you hold) and context_expand_reach (what a held grant covers).',
 });
 export const CONTEXT_TOOLS = [
-    contextDiscoverTool,
+    contextReadTool,
     contextDelegateTool,
+    contextExpandReachTool,
+    contextDiscoverGrantableTool,
 ];

package/dist/server/tools/tier2/grantsTools.d.ts

@@ -0,0 +1,3 @@
+import { type ToolDefinition } from '../../../tools/defineTool.js';
+export declare const listGrantsTool: ToolDefinition;
+export declare const GRANTS_TOOLS: ToolDefinition[];

package/dist/server/tools/tier2/grantsTools.js

@@ -0,0 +1,81 @@
+import { defineTool } from '../../../tools/defineTool.js';
+import { GrantsClient, unreadableGrantRails, } from '@ziggs-ai/api-client';
+/**
+ * ZIG-893 — the single "what authority do I hold?" tool. One name, every rail
+ * (context chat/agreement/org, connection, wallet), holder-scoped, cross-session.
+ * Wraps the unified `GET /grants` (GrantsClient) that already replaced the three
+ * per-rail listers server-side; this lifts that unification up to the tool layer
+ * so an agent no longer has to know three tool names — or, as in the 2026-07-20
+ * incident, tell its principal grant lookup doesn't exist because its config
+ * happened to omit the one rail's lister.
+ */
+function creds(ctx) {
+    const operatorKey = ctx?.['operatorKey'];
+    const agentId = ctx?.['agentId'];
+    if (!operatorKey)
+        throw new Error('operatorKey missing from tool context');
+    if (!agentId)
+        throw new Error('agentId missing from tool context');
+    return { operatorKey, agentId };
+}
+const SCOPE_KINDS = [
+    'chat',
+    'agreement',
+    'org',
+    'connection',
+    'wallet',
+];
+const HEALTHS = ['active', 'expired', 'revoked'];
+function parseScopeKinds(raw) {
+    if (raw == null)
+        return undefined;
+    const list = Array.isArray(raw) ? raw : [raw];
+    const out = [];
+    for (const r of list) {
+        if (!SCOPE_KINDS.includes(r)) {
+            throw new Error(`scopeKind must be one of ${SCOPE_KINDS.join(', ')}`);
+        }
+        if (!out.includes(r))
+            out.push(r);
+    }
+    return out.length ? out : undefined;
+}
+export const listGrantsTool = defineTool('list_grants', {
+    scopeKind: {
+        type: 'array',
+        items: { type: 'string', enum: [...SCOPE_KINDS] },
+        description: 'Rail filter (repeatable): chat | agreement | org (context) | connection | wallet. Omit for every rail you can read.',
+    },
+    health: {
+        type: 'string',
+        enum: [...HEALTHS],
+        description: 'Grant health filter. Defaults to active (live grants only).',
+    },
+    cursor: { type: 'string', description: 'Opaque cursor from a prior nextCursor to page' },
+    limit: { type: 'number', description: 'Page size (server default when omitted)' },
+}, async (args, ctx) => {
+    const { operatorKey, agentId } = creds(ctx);
+    const scopeKind = parseScopeKinds(args['scopeKind']);
+    const healthArg = args['health'];
+    if (healthArg !== undefined && !HEALTHS.includes(healthArg)) {
+        throw new Error(`health must be one of ${HEALTHS.join(', ')}`);
+    }
+    const { items, nextCursor } = await new GrantsClient(operatorKey, agentId).listGrants({
+        scopeKind,
+        // Reach = live grants only by default; pass health to see expired/revoked.
+        health: healthArg ?? 'active',
+        cursor: args['cursor'],
+        limit: typeof args['limit'] === 'number' ? args['limit'] : undefined,
+    });
+    const unreadable = unreadableGrantRails(operatorKey, scopeKind);
+    return {
+        count: items.length,
+        grants: items,
+        nextCursor,
+        ...(unreadable && unreadable.length ? { unreadableRails: unreadable } : {}),
+    };
+}, {
+    description: 'List every grant this agent holds across all rails in one call — context (chat/agreement/org), connection, and wallet — as canonical grants (grantId, scope, caveats, expiresAt, health; no message/artifact content or credentials). The single answer to "what grants of mine do you hold?", holder-scoped and cross-session. Filter by scopeKind (rail) and health (defaults to active). Rails you lack the operator-key read scope for are named in unreadableRails, not silently dropped. Cursor-paginated: pass cursor from a prior nextCursor. Pair with context_read to read through a context grant, or context_expand_reach to enumerate a scope.',
+    isGenericFallback: true,
+});
+export const GRANTS_TOOLS = [listGrantsTool];

package/dist/server/tools/tier2/linkTools.d.ts

@@ -0,0 +1,7 @@
+import { type ToolDefinition } from '../../../tools/defineTool.js';
+export declare const requestLinkTool: ToolDefinition;
+export declare const createLinkInviteTool: ToolDefinition;
+export declare const claimLinkInviteTool: ToolDefinition;
+export declare const listLinksTool: ToolDefinition;
+export declare const revokeLinkTool: ToolDefinition;
+export declare const LINK_TOOLS: ToolDefinition[];

package/dist/server/tools/tier2/linkTools.js

@@ -0,0 +1,156 @@
+import { defineTool } from '../../../tools/defineTool.js';
+import { createAgreement, claimAgreement, listAgreements, revokeAgreement, } from '@ziggs-ai/api-client';
+/**
+ * ZIG-898 — link tools on the SDK surface, same base names as ziggs-mcp's
+ * trustTools (ziggs_request_link → request_link, …). Links are agreements with
+ * engagementKind 'link' — bilateral agent-to-agent trust that gives unpublished
+ * delegates cross-org reach. No new endpoints: everything rides the agreements
+ * rail exactly as the MCP tools do.
+ *
+ * A link is reach-only: it lets the peers find and message each other, never
+ * read context — grants stay separate (context_delegate / the owner's grant
+ * tools).
+ */
+function creds(ctx) {
+    const operatorKey = ctx?.['operatorKey'];
+    const agentId = ctx?.['agentId'];
+    if (!operatorKey)
+        throw new Error('operatorKey missing from tool context');
+    if (!agentId)
+        throw new Error('agentId missing from tool context');
+    return { operatorKey, agentId };
+}
+function webAppOrigin() {
+    return (process.env.ZIGGS_WEB_URL?.trim() || 'https://ziggsai.com').replace(/\/$/, '');
+}
+/**
+ * ZIG-670 rule carried over from the MCP tools: link-shaped summaries, not raw
+ * agreement documents — the money block, approvals array, and Mongo internals
+ * are noise on a trust relationship.
+ */
+function linkSummary(a) {
+    return {
+        agreementId: a.agreementId,
+        status: a.status,
+        proposalStatus: a.proposalStatus,
+        parties: {
+            creatorAgent: a.parties?.creatorAgent ?? null,
+            providerAgent: a.parties?.providerAgent ?? null,
+            creator: a.parties?.creator ?? null,
+            proposedTo: a.parties?.proposedTo ?? null,
+        },
+        ...(a.description ? { description: a.description } : {}),
+        createdAt: a.createdAt,
+    };
+}
+const LINK_IS_REACH_ONLY = 'A link is reach-only: it does not grant context. Share a slice of a grant you hold with context_delegate, or ask the peer owner to issue one, before reading.';
+export const requestLinkTool = defineTool('request_link', {
+    providerId: {
+        type: 'string',
+        required: true,
+        description: 'Bare agent id to link with (the target delegate). Use agent_search or a known delegate id — do not guess.',
+    },
+    message: {
+        type: 'string',
+        description: 'Optional note shown to the counterparty human on approval (agreement description)',
+    },
+}, async (args, ctx) => {
+    const { agreement } = await createAgreement({
+        engagementKind: 'link',
+        providerId: args['providerId'],
+        description: args['message'],
+    }, creds(ctx));
+    return {
+        status: 'pending',
+        message: 'Link agreement created — the counterparty owner must approve (agreement_respond on their side) before cross-org reach. Surface pending state to your principal.',
+        agreement: linkSummary(agreement),
+    };
+}, {
+    description: 'Request a bilateral trust link with another agent before cross-org reach (party-to-party, NOT a third-party service connection — that is the connection rail). A link is just an agreement (engagementKind "link"). The target OWNER must approve it before unpublished delegates can message each other.',
+    isAgreementCreation: true,
+});
+export const createLinkInviteTool = defineTool('create_link_invite', {
+    message: {
+        type: 'string',
+        description: 'Optional note shown to whoever opens the invite (agreement description)',
+    },
+}, async (args, ctx) => {
+    const { agreement } = await createAgreement({ engagementKind: 'link', description: args['message'] }, creds(ctx));
+    return {
+        status: 'open',
+        inviteId: agreement.agreementId,
+        claimUrl: `${webAppOrigin()}/app/link-invites/${agreement.agreementId}`,
+        message: 'Open link invite created. Share claimUrl (or the inviteId) with the counterparty — they claim it in the Ziggs web app or via their claim_link_invite tool. No agent id needed on either side. Revoke with revoke_link to disable.',
+        agreement: linkSummary(agreement),
+    };
+}, {
+    description: "Create a shareable OPEN link invite (bilateral agent-to-agent trust) when you do NOT have the counterparty's agent id (e.g. connecting across orgs). Creates an open link agreement proposed to everyone; the recipient forms the link by claiming the returned inviteId.",
+    isAgreementCreation: true,
+});
+export const claimLinkInviteTool = defineTool('claim_link_invite', {
+    agreementId: {
+        type: 'string',
+        required: true,
+        description: 'The invite id (agreementId) shared by the issuer',
+    },
+}, async (args, ctx) => {
+    const { agreement } = await claimAgreement(args['agreementId'], creds(ctx));
+    return {
+        status: 'linked',
+        message: `Link invite claimed — you are now linked. ${LINK_IS_REACH_ONLY}`,
+        agreement: linkSummary(agreement),
+    };
+}, {
+    description: 'Claim an open link invite by its id to form a bilateral link. You become the counterparty and the link activates immediately (cross-org reach). You cannot claim your own invite.',
+});
+export const listLinksTool = defineTool('list_links', {
+    status: {
+        type: 'string',
+        enum: ['active', 'open', 'cancelled', 'all'],
+        description: 'active (default) = established links; open = pending proposals/invites awaiting approval or claim; cancelled = revoked; all = every link regardless of status',
+    },
+}, async (args, ctx) => {
+    const status = args['status'] ?? 'active';
+    if (!['active', 'open', 'cancelled', 'all'].includes(status)) {
+        throw new Error('status must be one of active, open, cancelled, all');
+    }
+    const links = await listAgreements({
+        engagementKind: 'link',
+        ...(status === 'all' ? {} : { status }),
+    }, creds(ctx));
+    const summaries = links.map(linkSummary);
+    const hasActive = links.some((a) => a.status === 'active');
+    return {
+        count: summaries.length,
+        status,
+        links: summaries,
+        ...(hasActive ? { nextSteps: LINK_IS_REACH_ONLY } : {}),
+    };
+}, {
+    description: 'List link agreements for this agent — bilateral agent-to-agent trust relationships (GET /agreements?engagementKind=link). Defaults to ACTIVE links only; pass status to see pending proposals ("open") or revoked ones ("cancelled"). Each item is a link summary: agreementId, status, proposalStatus, parties.',
+    isGenericFallback: true,
+});
+export const revokeLinkTool = defineTool('revoke_link', {
+    agreementId: {
+        type: 'string',
+        required: true,
+        description: 'agreementId of the link agreement (from list_links)',
+    },
+}, async (args, ctx) => {
+    const result = await revokeAgreement(args['agreementId'], creds(ctx));
+    return {
+        status: 'revoked',
+        message: 'Link revoked — unpublished cross-org reach to this peer is blocked again.',
+        agreementId: args['agreementId'],
+        agreement: result.agreement ? linkSummary(result.agreement) : null,
+    };
+}, {
+    description: 'Revoke a bilateral link agreement (DELETE /agreements/:agreementId). Either party may revoke; cross-org reach ends immediately. For non-link agreements (hire/service/quest), use agreement_revoke — same endpoint, different messaging.',
+});
+export const LINK_TOOLS = [
+    requestLinkTool,
+    createLinkInviteTool,
+    claimLinkInviteTool,
+    listLinksTool,
+    revokeLinkTool,
+];

package/dist/server/tools/tier2/paymentTools.d.ts

@@ -8,5 +8,4 @@ export declare const paymentReleaseTool: ToolDefinition;
 export declare const paymentIssueGrantTool: ToolDefinition;
 export declare const paymentAttenuateGrantTool: ToolDefinition;
 export declare const paymentRevokeGrantTool: ToolDefinition;
-export declare const paymentListGrantsTool: ToolDefinition;
 export declare const PAYMENT_TOOLS: ToolDefinition[];

package/dist/server/tools/tier2/paymentTools.js

@@ -1,10 +1,13 @@
 import { defineTool } from '../../../tools/defineTool.js';
-import { ZiggsPayClient } from '../../ziggspay/ZiggsPayClient.js';
+import { PaymentsClient } from '@ziggs-ai/api-client';
 function clientFor(ctx) {
     const operatorKey = ctx?.['operatorKey'];
     if (!operatorKey)
         throw new Error('operatorKey missing from tool context');
-    return new ZiggsPayClient({ operatorKey, actAsAgentId: ctx?.['agentId'] || undefined });
+    // BACKEND_URL / ZIGGS_BACKEND_URL are the SDK runner's overrides; the shared
+    // client defaults to HTTP_URL (api-client convention) when neither is set.
+    const baseUrl = process.env.BACKEND_URL || process.env.ZIGGS_BACKEND_URL || undefined;
+    return new PaymentsClient(operatorKey, ctx?.['agentId'] || undefined, baseUrl);
 }
 function rethrowWithContext(error, prefix) {
     const e = error;
@@ -148,18 +151,11 @@ const revokeGrantHandler = async (args, ctx) => {
     }
 };
 export const paymentRevokeGrantTool = defineTool('payment_revoke_grant', { grantId: { type: 'string', required: true } }, revokeGrantHandler);
-const listGrantsHandler = async (_args, ctx) => {
-    try {
-        const result = await clientFor(ctx).listGrants();
-        return { grants: result || [] };
-    }
-    catch (e) {
-        rethrowWithContext(e, 'Failed to list payment grants');
-    }
-};
-export const paymentListGrantsTool = defineTool('payment_list_grants', {}, listGrantsHandler);
+// ZIG-893 — payment_list_grants retired; the wallet rail is now part of the
+// unified list_grants tool (scopeKind: 'wallet'). Grant *mutations* stay on the
+// payment rail (issue/attenuate/revoke below).
 export const PAYMENT_TOOLS = [
     paymentBalanceTool, paymentTransferTool, paymentWaitForApprovalTool,
     paymentHoldTool, paymentReleaseTool, paymentResolveWalletTool,
-    paymentIssueGrantTool, paymentAttenuateGrantTool, paymentRevokeGrantTool, paymentListGrantsTool,
+    paymentIssueGrantTool, paymentAttenuateGrantTool, paymentRevokeGrantTool,
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ziggs-ai/agent-sdk",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Agent framework SDK for building autonomous agents on the Ziggs platform",
   "type": "module",
   "main": "dist/index.js",
@@ -26,7 +26,7 @@
     "@anthropic-ai/claude-agent-sdk": "^0.3.204",
     "@anthropic-ai/sdk": "^0.110.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@ziggs-ai/api-client": "^0.1.29",
+    "@ziggs-ai/api-client": "^0.1.30",
     "ajv": "^8.17.1",
     "dotenv": "^17.2.3",
     "openai": "^4.0.0",

package/dist/server/ziggsconnect/ZiggsConnectClient.d.ts

@@ -1,35 +0,0 @@
-import 'dotenv/config';
-export interface ZiggsConnectClientOptions {
-    operatorKey: string;
-    actAsAgentId?: string;
-    baseUrl?: string;
-}
-export interface ProxyParams {
-    connectionId: string;
-    grantId: string;
-    action: string;
-    payload?: unknown;
-}
-export declare class ZiggsConnectClient {
-    private operatorKey;
-    private actAsAgentId;
-    private baseUrl;
-    constructor({ operatorKey, actAsAgentId, baseUrl }: ZiggsConnectClientOptions);
-    /**
-     * Present a ConnectionGrant to the broker and perform a provider action.
-     * Returns the provider result — never the raw OAuth token.
-     */
-    proxy({ connectionId, grantId, action, payload }: ProxyParams): Promise<unknown>;
-    /**
-     * List ConnectionGrants held by this agent for a connection.
-     * Requires actAsAgentId; filters server rows to holderId === agent.
-     */
-    listGrants({ connectionId }: {
-        connectionId: string;
-    }): Promise<unknown[]>;
-    private _buildHeaders;
-    private _request;
-    private _get;
-    private _post;
-}
-export declare function createZiggsConnectClient(opts: ZiggsConnectClientOptions): ZiggsConnectClient;

package/dist/server/ziggsconnect/ZiggsConnectClient.js

@@ -1,95 +0,0 @@
-import 'dotenv/config';
-function getDefaultBaseUrl() {
-    return process.env.BACKEND_URL || process.env.ZIGGS_BACKEND_URL || 'http://localhost:3000';
-}
-function parseError(text, fallback) {
-    if (!text)
-        return fallback;
-    try {
-        const parsed = JSON.parse(text);
-        return parsed['message'] || parsed['error'] || text;
-    }
-    catch {
-        return text;
-    }
-}
-export class ZiggsConnectClient {
-    operatorKey;
-    actAsAgentId;
-    baseUrl;
-    constructor({ operatorKey, actAsAgentId, baseUrl }) {
-        if (!operatorKey || typeof operatorKey !== 'string') {
-            throw new Error('ZiggsConnectClient requires an operatorKey');
-        }
-        this.operatorKey = operatorKey;
-        this.actAsAgentId = actAsAgentId || null;
-        this.baseUrl = baseUrl || getDefaultBaseUrl();
-    }
-    /**
-     * Present a ConnectionGrant to the broker and perform a provider action.
-     * Returns the provider result — never the raw OAuth token.
-     */
-    async proxy({ connectionId, grantId, action, payload }) {
-        if (!connectionId)
-            throw new Error('proxy: connectionId is required');
-        if (!grantId)
-            throw new Error('proxy: grantId is required');
-        if (!action)
-            throw new Error('proxy: action is required');
-        if (!this.actAsAgentId) {
-            throw new Error('proxy: actAsAgentId is required — connection broker calls must impersonate the grant holder agent');
-        }
-        const res = (await this._post(`/connections/${encodeURIComponent(connectionId)}/proxy`, {
-            grantId,
-            action,
-            payload: payload ?? {},
-        }));
-        return res['result'] ?? res;
-    }
-    /**
-     * List ConnectionGrants held by this agent for a connection.
-     * Requires actAsAgentId; filters server rows to holderId === agent.
-     */
-    async listGrants({ connectionId }) {
-        if (!connectionId)
-            throw new Error('listGrants: connectionId is required');
-        if (!this.actAsAgentId) {
-            throw new Error('listGrants: actAsAgentId is required — grants are scoped to the impersonated agent');
-        }
-        const res = (await this._get(`/connections/${encodeURIComponent(connectionId)}/grants`));
-        const grants = res['grants'] || [];
-        return grants.filter((g) => g['holderId'] === this.actAsAgentId);
-    }
-    _buildHeaders(extra = {}) {
-        const h = { Authorization: `Bearer ${this.operatorKey}`, ...extra };
-        if (this.actAsAgentId)
-            h['X-Agent-Id'] = this.actAsAgentId;
-        return h;
-    }
-    async _request(method, path, body) {
-        const init = {
-            method,
-            headers: this._buildHeaders(body !== undefined ? { 'content-type': 'application/json' } : {}),
-        };
-        if (body !== undefined)
-            init.body = JSON.stringify(body);
-        const response = await fetch(`${this.baseUrl}${path}`, init);
-        const text = await response.text();
-        if (!response.ok) {
-            const err = new Error(parseError(text, `HTTP ${response.status}`));
-            err.status = response.status;
-            err.body = text;
-            throw err;
-        }
-        return text ? JSON.parse(text) : null;
-    }
-    _get(path) {
-        return this._request('GET', path, undefined);
-    }
-    _post(path, body) {
-        return this._request('POST', path, body ?? {});
-    }
-}
-export function createZiggsConnectClient(opts) {
-    return new ZiggsConnectClient(opts);
-}

package/dist/server/ziggscontext/ZiggsContextClient.d.ts

@@ -1,53 +0,0 @@
-import 'dotenv/config';
-export interface ZiggsContextClientOptions {
-    operatorKey: string;
-    actAsAgentId?: string;
-    baseUrl?: string;
-}
-export interface ContextReachDescriptor {
-    grantId: string;
-    scope: {
-        kind: 'chat' | 'agreement' | 'org';
-        id: string;
-    };
-    temporal: 'from-now' | 'from-start';
-    watermarkAt: string;
-    expiresAt: string | null;
-    parentGrantId: string | null;
-    createdAt: string;
-}
-export interface DelegateContextGrantParams {
-    parentGrantId: string;
-    holderId: string;
-    scope: {
-        kind: 'chat' | 'agreement' | 'org';
-        id: string;
-    };
-    temporal: 'from-now' | 'from-start';
-    expiresAt?: string | null;
-    watermarkAt?: string;
-}
-/**
- * HTTP client for context grants (ZIG-413).
- * Presentation model (signed bytes vs grant id) is intentionally not baked in here.
- */
-export declare class ZiggsContextClient {
-    private operatorKey;
-    private actAsAgentId;
-    private baseUrl;
-    constructor({ operatorKey, actAsAgentId, baseUrl }: ZiggsContextClientOptions);
-    /**
-     * Scope descriptors for what this agent can reach (no content). GET
-     * /context/discovery was retired (ZIG-648); reach is now the agent's live
-     * context grants from the unified GET /grants, mapped back to the reach shape
-     * (temporal/watermark ride in caveats). Follows the cursor for completeness.
-     */
-    discover(): Promise<ContextReachDescriptor[]>;
-    /** Holder delegates a narrower child grant. */
-    delegate(params: DelegateContextGrantParams): Promise<unknown>;
-    private requireActAsAgent;
-    private _buildHeaders;
-    private _request;
-    private _get;
-    private _post;
-}