@ziggs-ai/agent-sdk 0.2.1 → 0.3.0

package/dist/server/tools/tier2/linkTools.js

@@ -0,0 +1,156 @@
+import { defineTool } from '../../../tools/defineTool.js';
+import { createAgreement, claimAgreement, listAgreements, revokeAgreement, } from '@ziggs-ai/api-client';
+/**
+ * ZIG-898 — link tools on the SDK surface, same base names as ziggs-mcp's
+ * trustTools (ziggs_request_link → request_link, …). Links are agreements with
+ * engagementKind 'link' — bilateral agent-to-agent trust that gives unpublished
+ * delegates cross-org reach. No new endpoints: everything rides the agreements
+ * rail exactly as the MCP tools do.
+ *
+ * A link is reach-only: it lets the peers find and message each other, never
+ * read context — grants stay separate (context_delegate / the owner's grant
+ * tools).
+ */
+function creds(ctx) {
+    const operatorKey = ctx?.['operatorKey'];
+    const agentId = ctx?.['agentId'];
+    if (!operatorKey)
+        throw new Error('operatorKey missing from tool context');
+    if (!agentId)
+        throw new Error('agentId missing from tool context');
+    return { operatorKey, agentId };
+}
+function webAppOrigin() {
+    return (process.env.ZIGGS_WEB_URL?.trim() || 'https://ziggsai.com').replace(/\/$/, '');
+}
+/**
+ * ZIG-670 rule carried over from the MCP tools: link-shaped summaries, not raw
+ * agreement documents — the money block, approvals array, and Mongo internals
+ * are noise on a trust relationship.
+ */
+function linkSummary(a) {
+    return {
+        agreementId: a.agreementId,
+        status: a.status,
+        proposalStatus: a.proposalStatus,
+        parties: {
+            creatorAgent: a.parties?.creatorAgent ?? null,
+            providerAgent: a.parties?.providerAgent ?? null,
+            creator: a.parties?.creator ?? null,
+            proposedTo: a.parties?.proposedTo ?? null,
+        },
+        ...(a.description ? { description: a.description } : {}),
+        createdAt: a.createdAt,
+    };
+}
+const LINK_IS_REACH_ONLY = 'A link is reach-only: it does not grant context. Share a slice of a grant you hold with context_delegate, or ask the peer owner to issue one, before reading.';
+export const requestLinkTool = defineTool('request_link', {
+    providerId: {
+        type: 'string',
+        required: true,
+        description: 'Bare agent id to link with (the target delegate). Use agent_search or a known delegate id — do not guess.',
+    },
+    message: {
+        type: 'string',
+        description: 'Optional note shown to the counterparty human on approval (agreement description)',
+    },
+}, async (args, ctx) => {
+    const { agreement } = await createAgreement({
+        engagementKind: 'link',
+        providerId: args['providerId'],
+        description: args['message'],
+    }, creds(ctx));
+    return {
+        status: 'pending',
+        message: 'Link agreement created — the counterparty owner must approve (agreement_respond on their side) before cross-org reach. Surface pending state to your principal.',
+        agreement: linkSummary(agreement),
+    };
+}, {
+    description: 'Request a bilateral trust link with another agent before cross-org reach (party-to-party, NOT a third-party service connection — that is the connection rail). A link is just an agreement (engagementKind "link"). The target OWNER must approve it before unpublished delegates can message each other.',
+    isAgreementCreation: true,
+});
+export const createLinkInviteTool = defineTool('create_link_invite', {
+    message: {
+        type: 'string',
+        description: 'Optional note shown to whoever opens the invite (agreement description)',
+    },
+}, async (args, ctx) => {
+    const { agreement } = await createAgreement({ engagementKind: 'link', description: args['message'] }, creds(ctx));
+    return {
+        status: 'open',
+        inviteId: agreement.agreementId,
+        claimUrl: `${webAppOrigin()}/app/link-invites/${agreement.agreementId}`,
+        message: 'Open link invite created. Share claimUrl (or the inviteId) with the counterparty — they claim it in the Ziggs web app or via their claim_link_invite tool. No agent id needed on either side. Revoke with revoke_link to disable.',
+        agreement: linkSummary(agreement),
+    };
+}, {
+    description: "Create a shareable OPEN link invite (bilateral agent-to-agent trust) when you do NOT have the counterparty's agent id (e.g. connecting across orgs). Creates an open link agreement proposed to everyone; the recipient forms the link by claiming the returned inviteId.",
+    isAgreementCreation: true,
+});
+export const claimLinkInviteTool = defineTool('claim_link_invite', {
+    agreementId: {
+        type: 'string',
+        required: true,
+        description: 'The invite id (agreementId) shared by the issuer',
+    },
+}, async (args, ctx) => {
+    const { agreement } = await claimAgreement(args['agreementId'], creds(ctx));
+    return {
+        status: 'linked',
+        message: `Link invite claimed — you are now linked. ${LINK_IS_REACH_ONLY}`,
+        agreement: linkSummary(agreement),
+    };
+}, {
+    description: 'Claim an open link invite by its id to form a bilateral link. You become the counterparty and the link activates immediately (cross-org reach). You cannot claim your own invite.',
+});
+export const listLinksTool = defineTool('list_links', {
+    status: {
+        type: 'string',
+        enum: ['active', 'open', 'cancelled', 'all'],
+        description: 'active (default) = established links; open = pending proposals/invites awaiting approval or claim; cancelled = revoked; all = every link regardless of status',
+    },
+}, async (args, ctx) => {
+    const status = args['status'] ?? 'active';
+    if (!['active', 'open', 'cancelled', 'all'].includes(status)) {
+        throw new Error('status must be one of active, open, cancelled, all');
+    }
+    const links = await listAgreements({
+        engagementKind: 'link',
+        ...(status === 'all' ? {} : { status }),
+    }, creds(ctx));
+    const summaries = links.map(linkSummary);
+    const hasActive = links.some((a) => a.status === 'active');
+    return {
+        count: summaries.length,
+        status,
+        links: summaries,
+        ...(hasActive ? { nextSteps: LINK_IS_REACH_ONLY } : {}),
+    };
+}, {
+    description: 'List link agreements for this agent — bilateral agent-to-agent trust relationships (GET /agreements?engagementKind=link). Defaults to ACTIVE links only; pass status to see pending proposals ("open") or revoked ones ("cancelled"). Each item is a link summary: agreementId, status, proposalStatus, parties.',
+    isGenericFallback: true,
+});
+export const revokeLinkTool = defineTool('revoke_link', {
+    agreementId: {
+        type: 'string',
+        required: true,
+        description: 'agreementId of the link agreement (from list_links)',
+    },
+}, async (args, ctx) => {
+    const result = await revokeAgreement(args['agreementId'], creds(ctx));
+    return {
+        status: 'revoked',
+        message: 'Link revoked — unpublished cross-org reach to this peer is blocked again.',
+        agreementId: args['agreementId'],
+        agreement: result.agreement ? linkSummary(result.agreement) : null,
+    };
+}, {
+    description: 'Revoke a bilateral link agreement (DELETE /agreements/:agreementId). Either party may revoke; cross-org reach ends immediately. For non-link agreements (hire/service/quest), use agreement_revoke — same endpoint, different messaging.',
+});
+export const LINK_TOOLS = [
+    requestLinkTool,
+    createLinkInviteTool,
+    claimLinkInviteTool,
+    listLinksTool,
+    revokeLinkTool,
+];

package/dist/server/tools/tier2/paymentTools.d.ts

@@ -8,5 +8,4 @@ export declare const paymentReleaseTool: ToolDefinition;
 export declare const paymentIssueGrantTool: ToolDefinition;
 export declare const paymentAttenuateGrantTool: ToolDefinition;
 export declare const paymentRevokeGrantTool: ToolDefinition;
-export declare const paymentListGrantsTool: ToolDefinition;
 export declare const PAYMENT_TOOLS: ToolDefinition[];

package/dist/server/tools/tier2/paymentTools.js

@@ -1,10 +1,13 @@
 import { defineTool } from '../../../tools/defineTool.js';
-import { ZiggsPayClient } from '../../ziggspay/ZiggsPayClient.js';
+import { PaymentsClient } from '@ziggs-ai/api-client';
 function clientFor(ctx) {
     const operatorKey = ctx?.['operatorKey'];
     if (!operatorKey)
         throw new Error('operatorKey missing from tool context');
-    return new ZiggsPayClient({ operatorKey, actAsAgentId: ctx?.['agentId'] || undefined });
+    // BACKEND_URL / ZIGGS_BACKEND_URL are the SDK runner's overrides; the shared
+    // client defaults to HTTP_URL (api-client convention) when neither is set.
+    const baseUrl = process.env.BACKEND_URL || process.env.ZIGGS_BACKEND_URL || undefined;
+    return new PaymentsClient(operatorKey, ctx?.['agentId'] || undefined, baseUrl);
 }
 function rethrowWithContext(error, prefix) {
     const e = error;
@@ -148,18 +151,11 @@ const revokeGrantHandler = async (args, ctx) => {
     }
 };
 export const paymentRevokeGrantTool = defineTool('payment_revoke_grant', { grantId: { type: 'string', required: true } }, revokeGrantHandler);
-const listGrantsHandler = async (_args, ctx) => {
-    try {
-        const result = await clientFor(ctx).listGrants();
-        return { grants: result || [] };
-    }
-    catch (e) {
-        rethrowWithContext(e, 'Failed to list payment grants');
-    }
-};
-export const paymentListGrantsTool = defineTool('payment_list_grants', {}, listGrantsHandler);
+// ZIG-893 — payment_list_grants retired; the wallet rail is now part of the
+// unified list_grants tool (scopeKind: 'wallet'). Grant *mutations* stay on the
+// payment rail (issue/attenuate/revoke below).
 export const PAYMENT_TOOLS = [
     paymentBalanceTool, paymentTransferTool, paymentWaitForApprovalTool,
     paymentHoldTool, paymentReleaseTool, paymentResolveWalletTool,
-    paymentIssueGrantTool, paymentAttenuateGrantTool, paymentRevokeGrantTool, paymentListGrantsTool,
+    paymentIssueGrantTool, paymentAttenuateGrantTool, paymentRevokeGrantTool,
 ];

package/dist/types.d.ts

@@ -346,6 +346,43 @@ export interface RecordedEntry {
     text?: string;
     [k: string]: unknown;
 }
+/**
+ * Deterministic idempotency keys for one wake's writes (delivery law, item 2).
+ * Created once per tick from (laneKey, triggering event) — see
+ * `createWakeWriteKeys` — and threaded to every artifact / task-state write the
+ * wake performs, so a crash-replay of the same wake reproduces the same keys
+ * and the backend drops the duplicates. Never LLM-supplied, never random.
+ */
+export interface WakeWriteKeys {
+    /** Stable id of this wake, or null when its trigger has no durable delivery identity (timer/synthetic frames) — null means writes go keyless, as before. */
+    readonly wakeKey: string | null;
+    /** Key for the next artifact write of this wake. Draws a per-wake ordinal — call exactly once per write, at the call site. */
+    artifactKey(): string | undefined;
+    /** Key for a task state transition. Derived from (taskId, state), so it is stable regardless of tool-call order within the wake. */
+    taskStateKey(taskId: string, state: string): string | undefined;
+    /** Default messageId for the next chat-message send of this wake — the backend dedups on (chatId, messageId). Draws the same per-wake ordinal as artifactKey — call exactly once per send, at the call site. */
+    messageKey(): string | undefined;
+    /** Key for a task spawn. Derived from what the spawn writes (agreement, description, assignee, parent), so it is stable regardless of tool-call order within the wake. */
+    taskSpawnKey(fields: {
+        agreementId: string;
+        description: string;
+        assigneeId?: string;
+        parentTaskId?: string;
+    }): string | undefined;
+    /** Key for an agreement proposal (`agreement_propose`). Derived from what the proposal writes (proposedTo, provider, description, parent), so a crash-replay dedups the row instead of minting a duplicate proposal — and multiple proposals in one wake stay distinct. */
+    agreementProposeKey(fields: {
+        proposedTo: string;
+        providerId?: string;
+        description: string;
+        parentAgreementId?: string;
+    }): string | undefined;
+    /** Key for a sub-agreement (`agreement_subcontract`). Derived from what the subcontract writes (executor, description, parent), so a replay dedups the row. */
+    agreementSubcontractKey(fields: {
+        executorId: string;
+        description: string;
+        parentAgreementId: string;
+    }): string | undefined;
+}
 import type { MemoryStore } from './memory/MemoryStore.js';
 export type EffectKind = 'read-context' | 'llm-call' | 'stream-text' | 'tool-call' | 'send-message' | 'record-event';
 export type Effect = {
@@ -388,6 +425,8 @@ export type Effect = {
     runId?: string;
     /** FSM state name (ZIG-440). */
     stateId?: string;
+    /** Replay-stable write keys for this wake — write-capable tools derive their idempotency key from here, never from the LLM. */
+    wakeKeys?: WakeWriteKeys;
 } | {
     kind: 'send-message';
     sessionId: string;
@@ -398,6 +437,7 @@ export type Effect = {
     kind: 'record-event';
     sessionId: string;
     entry: RecordedEntry;
+    idempotencyKey?: string;
 };
 /**
  * Typed result map. With this shape, `await eff({ kind: 'read-context', ... })`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ziggs-ai/agent-sdk",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Agent framework SDK for building autonomous agents on the Ziggs platform",
   "type": "module",
   "main": "dist/index.js",
@@ -26,7 +26,7 @@
     "@anthropic-ai/claude-agent-sdk": "^0.3.204",
     "@anthropic-ai/sdk": "^0.110.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@ziggs-ai/api-client": "^0.1.29",
+    "@ziggs-ai/api-client": "^0.2.0",
     "ajv": "^8.17.1",
     "dotenv": "^17.2.3",
     "openai": "^4.0.0",

package/dist/server/InboxCatchUp.d.ts

@@ -1,24 +0,0 @@
-import { type Creds } from '@ziggs-ai/api-client';
-import { SeenMessages } from './SeenMessages.js';
-export interface InboxCatchUpDeps {
-    creds: Creds;
-    ownAgentId: string;
-    baseUrl?: string;
-    seen: SeenMessages;
-    onMessage: (text: string, metadata: Record<string, unknown>) => Promise<void>;
-    onResourceEvent: (event: Record<string, unknown>) => Promise<void>;
-    label?: string;
-}
-export interface InboxCatchUpResult {
-    scopes: number;
-    messagesDelivered: number;
-    resourceEvents: number;
-    acked: number;
-    truncated: boolean;
-}
-/**
- * Pull-based recovery after reconnect (ZIG-434 / ZIG-446 / ZIG-454).
- * Inbox → read message deltas → deliver → ack. Push remains a hint;
- * this path survives backend restarts that drop in-memory pending queues.
- */
-export declare function runInboxCatchUp(deps: InboxCatchUpDeps): Promise<InboxCatchUpResult>;

package/dist/server/ziggsconnect/ZiggsConnectClient.d.ts

@@ -1,35 +0,0 @@
-import 'dotenv/config';
-export interface ZiggsConnectClientOptions {
-    operatorKey: string;
-    actAsAgentId?: string;
-    baseUrl?: string;
-}
-export interface ProxyParams {
-    connectionId: string;
-    grantId: string;
-    action: string;
-    payload?: unknown;
-}
-export declare class ZiggsConnectClient {
-    private operatorKey;
-    private actAsAgentId;
-    private baseUrl;
-    constructor({ operatorKey, actAsAgentId, baseUrl }: ZiggsConnectClientOptions);
-    /**
-     * Present a ConnectionGrant to the broker and perform a provider action.
-     * Returns the provider result — never the raw OAuth token.
-     */
-    proxy({ connectionId, grantId, action, payload }: ProxyParams): Promise<unknown>;
-    /**
-     * List ConnectionGrants held by this agent for a connection.
-     * Requires actAsAgentId; filters server rows to holderId === agent.
-     */
-    listGrants({ connectionId }: {
-        connectionId: string;
-    }): Promise<unknown[]>;
-    private _buildHeaders;
-    private _request;
-    private _get;
-    private _post;
-}
-export declare function createZiggsConnectClient(opts: ZiggsConnectClientOptions): ZiggsConnectClient;

package/dist/server/ziggsconnect/ZiggsConnectClient.js

@@ -1,95 +0,0 @@
-import 'dotenv/config';
-function getDefaultBaseUrl() {
-    return process.env.BACKEND_URL || process.env.ZIGGS_BACKEND_URL || 'http://localhost:3000';
-}
-function parseError(text, fallback) {
-    if (!text)
-        return fallback;
-    try {
-        const parsed = JSON.parse(text);
-        return parsed['message'] || parsed['error'] || text;
-    }
-    catch {
-        return text;
-    }
-}
-export class ZiggsConnectClient {
-    operatorKey;
-    actAsAgentId;
-    baseUrl;
-    constructor({ operatorKey, actAsAgentId, baseUrl }) {
-        if (!operatorKey || typeof operatorKey !== 'string') {
-            throw new Error('ZiggsConnectClient requires an operatorKey');
-        }
-        this.operatorKey = operatorKey;
-        this.actAsAgentId = actAsAgentId || null;
-        this.baseUrl = baseUrl || getDefaultBaseUrl();
-    }
-    /**
-     * Present a ConnectionGrant to the broker and perform a provider action.
-     * Returns the provider result — never the raw OAuth token.
-     */
-    async proxy({ connectionId, grantId, action, payload }) {
-        if (!connectionId)
-            throw new Error('proxy: connectionId is required');
-        if (!grantId)
-            throw new Error('proxy: grantId is required');
-        if (!action)
-            throw new Error('proxy: action is required');
-        if (!this.actAsAgentId) {
-            throw new Error('proxy: actAsAgentId is required — connection broker calls must impersonate the grant holder agent');
-        }
-        const res = (await this._post(`/connections/${encodeURIComponent(connectionId)}/proxy`, {
-            grantId,
-            action,
-            payload: payload ?? {},
-        }));
-        return res['result'] ?? res;
-    }
-    /**
-     * List ConnectionGrants held by this agent for a connection.
-     * Requires actAsAgentId; filters server rows to holderId === agent.
-     */
-    async listGrants({ connectionId }) {
-        if (!connectionId)
-            throw new Error('listGrants: connectionId is required');
-        if (!this.actAsAgentId) {
-            throw new Error('listGrants: actAsAgentId is required — grants are scoped to the impersonated agent');
-        }
-        const res = (await this._get(`/connections/${encodeURIComponent(connectionId)}/grants`));
-        const grants = res['grants'] || [];
-        return grants.filter((g) => g['holderId'] === this.actAsAgentId);
-    }
-    _buildHeaders(extra = {}) {
-        const h = { Authorization: `Bearer ${this.operatorKey}`, ...extra };
-        if (this.actAsAgentId)
-            h['X-Agent-Id'] = this.actAsAgentId;
-        return h;
-    }
-    async _request(method, path, body) {
-        const init = {
-            method,
-            headers: this._buildHeaders(body !== undefined ? { 'content-type': 'application/json' } : {}),
-        };
-        if (body !== undefined)
-            init.body = JSON.stringify(body);
-        const response = await fetch(`${this.baseUrl}${path}`, init);
-        const text = await response.text();
-        if (!response.ok) {
-            const err = new Error(parseError(text, `HTTP ${response.status}`));
-            err.status = response.status;
-            err.body = text;
-            throw err;
-        }
-        return text ? JSON.parse(text) : null;
-    }
-    _get(path) {
-        return this._request('GET', path, undefined);
-    }
-    _post(path, body) {
-        return this._request('POST', path, body ?? {});
-    }
-}
-export function createZiggsConnectClient(opts) {
-    return new ZiggsConnectClient(opts);
-}

package/dist/server/ziggscontext/ZiggsContextClient.d.ts

@@ -1,53 +0,0 @@
-import 'dotenv/config';
-export interface ZiggsContextClientOptions {
-    operatorKey: string;
-    actAsAgentId?: string;
-    baseUrl?: string;
-}
-export interface ContextReachDescriptor {
-    grantId: string;
-    scope: {
-        kind: 'chat' | 'agreement' | 'org';
-        id: string;
-    };
-    temporal: 'from-now' | 'from-start';
-    watermarkAt: string;
-    expiresAt: string | null;
-    parentGrantId: string | null;
-    createdAt: string;
-}
-export interface DelegateContextGrantParams {
-    parentGrantId: string;
-    holderId: string;
-    scope: {
-        kind: 'chat' | 'agreement' | 'org';
-        id: string;
-    };
-    temporal: 'from-now' | 'from-start';
-    expiresAt?: string | null;
-    watermarkAt?: string;
-}
-/**
- * HTTP client for context grants (ZIG-413).
- * Presentation model (signed bytes vs grant id) is intentionally not baked in here.
- */
-export declare class ZiggsContextClient {
-    private operatorKey;
-    private actAsAgentId;
-    private baseUrl;
-    constructor({ operatorKey, actAsAgentId, baseUrl }: ZiggsContextClientOptions);
-    /**
-     * Scope descriptors for what this agent can reach (no content). GET
-     * /context/discovery was retired (ZIG-648); reach is now the agent's live
-     * context grants from the unified GET /grants, mapped back to the reach shape
-     * (temporal/watermark ride in caveats). Follows the cursor for completeness.
-     */
-    discover(): Promise<ContextReachDescriptor[]>;
-    /** Holder delegates a narrower child grant. */
-    delegate(params: DelegateContextGrantParams): Promise<unknown>;
-    private requireActAsAgent;
-    private _buildHeaders;
-    private _request;
-    private _get;
-    private _post;
-}

package/dist/server/ziggscontext/ZiggsContextClient.js

@@ -1,124 +0,0 @@
-import 'dotenv/config';
-function getDefaultBaseUrl() {
-    return process.env.BACKEND_URL || process.env.ZIGGS_BACKEND_URL || 'http://localhost:3000';
-}
-function parseError(text, fallback) {
-    if (!text)
-        return fallback;
-    try {
-        const parsed = JSON.parse(text);
-        return parsed['message'] || parsed['error'] || text;
-    }
-    catch {
-        return text;
-    }
-}
-/**
- * HTTP client for context grants (ZIG-413).
- * Presentation model (signed bytes vs grant id) is intentionally not baked in here.
- */
-export class ZiggsContextClient {
-    operatorKey;
-    actAsAgentId;
-    baseUrl;
-    constructor({ operatorKey, actAsAgentId, baseUrl }) {
-        if (!operatorKey || typeof operatorKey !== 'string') {
-            throw new Error('ZiggsContextClient requires an operatorKey');
-        }
-        this.operatorKey = operatorKey;
-        this.actAsAgentId = actAsAgentId || null;
-        this.baseUrl = baseUrl || getDefaultBaseUrl();
-    }
-    /**
-     * Scope descriptors for what this agent can reach (no content). GET
-     * /context/discovery was retired (ZIG-648); reach is now the agent's live
-     * context grants from the unified GET /grants, mapped back to the reach shape
-     * (temporal/watermark ride in caveats). Follows the cursor for completeness.
-     */
-    async discover() {
-        this.requireActAsAgent('discover');
-        const out = [];
-        let cursor;
-        for (let page = 0; page < 50; page++) {
-            const q = new URLSearchParams();
-            for (const k of ['chat', 'agreement', 'org'])
-                q.append('scopeKind', k);
-            q.set('health', 'active');
-            if (cursor)
-                q.set('cursor', cursor);
-            const res = (await this._get(`/grants?${q.toString()}`));
-            const items = res['items'] || [];
-            for (const g of items) {
-                const caveats = g['caveats'] || [];
-                const caveat = (t) => caveats.find((c) => c.type === t)?.value;
-                const scope = g['scope'];
-                out.push({
-                    grantId: g['grantId'],
-                    scope: { kind: scope.kind, id: scope.id },
-                    temporal: caveat('temporal') ?? 'from-now',
-                    watermarkAt: caveat('watermark_at') ?? '',
-                    expiresAt: g['expiresAt'] ?? null,
-                    parentGrantId: g['parentGrantId'] ?? null,
-                    createdAt: g['createdAt'],
-                });
-            }
-            const next = res['nextCursor'];
-            if (!next)
-                break;
-            cursor = next;
-        }
-        return out;
-    }
-    /** Holder delegates a narrower child grant. */
-    async delegate(params) {
-        this.requireActAsAgent('delegate');
-        if (!params.parentGrantId)
-            throw new Error('delegate: parentGrantId is required');
-        if (!params.holderId)
-            throw new Error('delegate: holderId is required');
-        if (!params.scope?.kind || !params.scope?.id) {
-            throw new Error('delegate: scope { kind, id } is required');
-        }
-        return this._post(`/context/grants/${encodeURIComponent(params.parentGrantId)}/delegate`, {
-            holderId: params.holderId,
-            scope: params.scope,
-            temporal: params.temporal,
-            expiresAt: params.expiresAt,
-            watermarkAt: params.watermarkAt,
-        });
-    }
-    requireActAsAgent(method) {
-        if (!this.actAsAgentId) {
-            throw new Error(`${method}: actAsAgentId is required — context grant calls must impersonate the grant holder agent`);
-        }
-    }
-    _buildHeaders(extra = {}) {
-        const h = { Authorization: `Bearer ${this.operatorKey}`, ...extra };
-        if (this.actAsAgentId)
-            h['X-Agent-Id'] = this.actAsAgentId;
-        return h;
-    }
-    async _request(method, path, body) {
-        const init = {
-            method,
-            headers: this._buildHeaders(body !== undefined ? { 'content-type': 'application/json' } : {}),
-        };
-        if (body !== undefined)
-            init.body = JSON.stringify(body);
-        const res = await fetch(`${this.baseUrl}${path}`, init);
-        const text = await res.text();
-        if (!res.ok) {
-            const err = new Error(parseError(text, `${method} ${path} failed (${res.status})`));
-            err.status = res.status;
-            err.body = text;
-            throw err;
-        }
-        return text ? JSON.parse(text) : {};
-    }
-    _get(path) {
-        return this._request('GET', path, undefined);
-    }
-    _post(path, body) {
-        return this._request('POST', path, body);
-    }
-}