@ziggs-ai/api-client 0.1.23 → 0.1.25

package/dist/http/AgreementClient.js

@@ -126,8 +126,15 @@ export async function respondToAgreement(agreementId, action, creds, opts = {})
     }
     const proposedTo = agreement.parties?.proposedTo;
     if (isBroadcastTarget(proposedTo)) {
-        if (action === 'reject')
-            return agreement;
+        if (action === 'reject') {
+            // ZIG-719: an open/broadcast proposal is offered to many via a sentinel
+            // `proposedTo` ('everyone' | 'org'), so there is no per-recipient party
+            // slot for one recipient to reject and nothing a single reject could
+            // change server-side. Returning the agreement here reported a fake
+            // success while the item stayed claimable. Fail honestly instead — the
+            // caller either claims it (action=approve → POST /claim) or ignores it.
+            throw new Error(`Agreement ${agreementId} is an open/broadcast proposal (proposedTo="${String(proposedTo)}") and cannot be rejected by a single recipient — it has no personal approval slot. Ignore it to pass on it, or use action=approve to claim it.`);
+        }
         const { agreement: updated } = await claimAgreement(agreementId, creds);
         return updated;
     }

package/dist/http/ContextDiscoveryClient.d.ts

@@ -11,6 +11,16 @@ export interface ContextReachDescriptor {
     parentGrantId: string | null;
     createdAt: string;
 }
+/** Labels-only pointer to context the agent could request access to (P4). */
+export interface DiscoverableItem {
+    type: 'chat';
+    label: string;
+    scopeRef: {
+        kind: 'chat' | 'agreement' | 'org';
+        id: string;
+    };
+    orgId: string;
+}
 /**
  * ZIG-412 discovery — scope descriptors only, no content.
  */
@@ -24,4 +34,11 @@ export declare class ContextDiscoveryClient {
      */
     constructor(operatorKey: string, agentId?: string, baseUrl?: string);
     discover(): Promise<ContextReachDescriptor[]>;
+    /**
+     * P4: what context EXISTS in the agent's engaged orgs that it does NOT hold
+     * a grant for — so it can request access rather than fail blind. Labels only.
+     * Defensively re-shapes each row to the whitelist (type/label/scopeRef/orgId)
+     * so an over-broad server response can never leak content/tokens through here.
+     */
+    discoverGrantable(): Promise<DiscoverableItem[]>;
 }

package/dist/http/ContextDiscoveryClient.js

@@ -31,4 +31,26 @@ export class ContextDiscoveryClient {
         const parsed = JSON.parse(body);
         return parsed.reach ?? [];
     }
+    /**
+     * P4: what context EXISTS in the agent's engaged orgs that it does NOT hold
+     * a grant for — so it can request access rather than fail blind. Labels only.
+     * Defensively re-shapes each row to the whitelist (type/label/scopeRef/orgId)
+     * so an over-broad server response can never leak content/tokens through here.
+     */
+    async discoverGrantable() {
+        const res = await fetch(`${this.baseUrl}/context/discovery/available`, {
+            headers: buildOperatorHeaders(this.operatorKey, this.agentId),
+        });
+        const body = await res.text().catch(() => '');
+        if (!res.ok) {
+            throw new Error(`ContextDiscoveryClient.discoverGrantable ${res.status} ${body.slice(0, 200)}`);
+        }
+        const parsed = JSON.parse(body);
+        return (parsed.items ?? []).map((i) => ({
+            type: i.type,
+            label: i.label,
+            scopeRef: { kind: i.scopeRef.kind, id: i.scopeRef.id },
+            orgId: i.orgId,
+        }));
+    }
 }

package/dist/http/ContextGrantsClient.d.ts

@@ -31,6 +31,17 @@ export interface DelegateContextGrantInput {
     expiresAt?: string | null;
     watermarkAt?: string;
 }
+/** Delegating your own principal's grant mints immediately; passing a grant
+ *  whose original owner is a different party opens a request that owner
+ *  approves — no grant is minted until then. */
+export type DelegateContextGrantResult = {
+    status: 'granted';
+    grant: ContextGrantRecord;
+} | {
+    status: 'pending_approval';
+    agreementId: string;
+    ownerId?: string;
+};
 /**
  * ZIG-411 context grant management — list / issue / delegate / revoke.
  */
@@ -44,7 +55,7 @@ export declare class ContextGrantsClient {
      */
     constructor(operatorKey: string, agentId?: string, baseUrl?: string);
     issueGrant(input: IssueContextGrantInput): Promise<ContextGrantRecord>;
-    delegateGrant(parentGrantId: string, input: DelegateContextGrantInput): Promise<ContextGrantRecord>;
+    delegateGrant(parentGrantId: string, input: DelegateContextGrantInput): Promise<DelegateContextGrantResult>;
     revokeGrant(grantId: string): Promise<{
         status: string;
         revokedCount?: number;

package/dist/http/ContextGrantsClient.js

@@ -74,10 +74,19 @@ export class ContextGrantsClient {
             throwApiError(res, body, `delegateGrant failed: ${res.status} ${res.statusText}`);
         }
         const parsed = JSON.parse(body);
+        // Re-granting a grant whose original owner is a different party does not
+        // mint — it opens a request that owner must approve.
+        if (parsed.status === 'pending_approval' && parsed.agreementId) {
+            return {
+                status: 'pending_approval',
+                agreementId: parsed.agreementId,
+                ownerId: parsed.ownerId,
+            };
+        }
         if (!parsed.grant?.grantId) {
-            throw new Error('Invalid response: expected { grant } from POST /context/grants/:id/delegate');
+            throw new Error('Invalid response: expected { grant } or { status: "pending_approval" } from POST /context/grants/:id/delegate');
         }
-        return parsed.grant;
+        return { status: 'granted', grant: parsed.grant };
     }
     async revokeGrant(grantId) {
         const res = await fetch(`${this.baseUrl}/context/grants/${encodeURIComponent(grantId)}`, {

package/dist/http/TaskClient.d.ts

@@ -8,6 +8,8 @@ export interface CreateTaskData {
     idempotencyKey?: string;
     /** Explicit delegation target (ZIG-586) — must be a party to the agreement; validated server-side. */
     assigneeId?: string;
+    /** ZIG-734: prior-step artifact handles consumed as structured input links. */
+    inputArtifactIds?: string[];
 }
 export declare function createTask(taskData: CreateTaskData, creds: Creds): Promise<Task>;
 export declare function getTask(taskId: string, creds: Creds): Promise<Task>;
@@ -26,6 +28,7 @@ export interface PlanReplaceStep {
     order: number;
 }
 export declare function replaceTaskPlan(taskId: string, steps: PlanReplaceStep[], creds: Creds): Promise<Task>;
+export declare function updateTaskPlanStep(taskId: string, stepId: string, status: string, result: unknown, creds: Creds): Promise<Task>;
 export declare function reportTask(taskId: string, message: string | undefined, creds: Creds): Promise<Task>;
 export declare function setTaskSatisfaction(taskId: string, satisfaction: 'positive' | 'negative', creds: Creds): Promise<Task>;
 export interface ListTasksOptions {
@@ -63,6 +66,7 @@ export declare class TaskClient {
     cancelTask(taskId: string): Promise<Task>;
     getSubtasks(parentTaskId: string): Promise<Task[]>;
     replaceTaskPlan(taskId: string, steps: PlanReplaceStep[]): Promise<Task>;
+    updateTaskPlanStep(taskId: string, stepId: string, status: string, result?: unknown): Promise<Task>;
     reportTask(taskId: string, message?: string): Promise<Task>;
     setTaskSatisfaction(taskId: string, satisfaction: 'positive' | 'negative'): Promise<Task>;
     listTasks(options?: ListTasksOptions): Promise<ListTasksResult>;

package/dist/http/TaskClient.js

@@ -205,6 +205,29 @@ export async function replaceTaskPlan(taskId, steps, creds) {
         throw new Error('Invalid response: task data not found');
     return task;
 }
+export async function updateTaskPlanStep(taskId, stepId, status, result, creds) {
+    if (!taskId)
+        throw new Error('updateTaskPlanStep: taskId is required');
+    if (!stepId)
+        throw new Error('updateTaskPlanStep: stepId is required');
+    if (!status)
+        throw new Error('updateTaskPlanStep: status is required');
+    assertCreds(creds, 'plan step update');
+    const res = await fetch(`${getTaskBaseUrl()}/${taskId}/plan`, {
+        method: 'PATCH',
+        headers: buildHeaders(creds),
+        body: JSON.stringify({ stepId, status, ...(result !== undefined && { result }) }),
+    });
+    if (!res.ok) {
+        const responseBody = await res.text().catch(() => '');
+        throwApiError(res, responseBody, `Plan step update failed: ${res.status} ${res.statusText}`);
+    }
+    const data = await res.json().catch(() => null);
+    const task = extractTask(data);
+    if (!task)
+        throw new Error('Invalid response: task data not found');
+    return task;
+}
 // ---------------------------------------------------------------------------
 // Reporting & satisfaction
 // ---------------------------------------------------------------------------
@@ -322,6 +345,7 @@ export class TaskClient {
     cancelTask(taskId) { return cancelTask(taskId, this.creds); }
     getSubtasks(parentTaskId) { return getSubtasks(parentTaskId, this.creds); }
     replaceTaskPlan(taskId, steps) { return replaceTaskPlan(taskId, steps, this.creds); }
+    updateTaskPlanStep(taskId, stepId, status, result) { return updateTaskPlanStep(taskId, stepId, status, result, this.creds); }
     reportTask(taskId, message) { return reportTask(taskId, message, this.creds); }
     setTaskSatisfaction(taskId, satisfaction) { return setTaskSatisfaction(taskId, satisfaction, this.creds); }
     listTasks(options) { return listTasks(options ?? {}, this.creds); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ziggs-ai/api-client",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "HTTP and WebSocket client for the Ziggs backend API",
   "type": "module",
   "main": "dist/index.js",