@ziggs-ai/api-client 0.9.10 → 0.9.11

package/dist/http/AgreementClient.js

@@ -13,7 +13,7 @@ function buildHeaders(creds) {
         'content-type': 'application/json',
         Authorization: `Bearer ${creds.operatorKey}`,
         'X-Agent-Id': creds.agentId,
-        // ZIG-1092 — the wake's lane, so the backend can fence this call to the
+        // the wake's lane, so the backend can fence this call to the
         // engagement it belongs to rather than the agent's whole authority.
         ...(creds.laneId ? { 'X-Ziggs-Lane': creds.laneId } : {}),
     };
@@ -29,10 +29,10 @@ function assertCreds(creds, op) {
  *
  * A link is reach, not commerce: it carries no money, no escrow, no execution
  * state and no approvals ledger. Handing the raw document over anyway put Mongo
- * bookkeeping in front of an LLM, which is what ZIG-957 forbade.
+ * bookkeeping in front of an LLM, which is what forbade.
  *
  * Lives here rather than in `capabilities/links.ts` because this is where the
- * rule is applied (ZIG-1111); that module re-exports it so the public name is
+ * rule is applied; that module re-exports it so the public name is
  * unchanged.
  */
 export function linkSummary(a) {
@@ -62,7 +62,7 @@ export function linkSummary(a) {
  * be written out at six call sites across the SDK runner, the MCP tools and the
  * capability layer, and three verbs never got it: `agreement_counter`,
  * `agreement_fulfill` and `agreement_subcontract` returned the raw document
- * (ZIG-1111). Applying it at the parse boundary means a new verb inherits the
+ *. Applying it at the parse boundary means a new verb inherits the
  * rule instead of remembering to opt in, and no surface can word its own verdict.
  *
  * Typed as `Agreement` on the way out: every key the summary keeps IS an
@@ -80,7 +80,7 @@ export async function proposeAgreement(proposalData, creds) {
     const headers = buildHeaders(creds);
     if (idempotencyKey)
         headers['Idempotency-Key'] = idempotencyKey;
-    // ZIG-207: canonical REST path. Backend keeps /propose serving the
+    // canonical REST path. Backend keeps /propose serving the
     // identical handler with a Deprecation/Sunset header until PR-F removes it.
     const res = await fetch(`${getAgreementBaseUrl()}/proposals`, {
         method: 'POST',
@@ -121,11 +121,11 @@ export async function delegateAgreement(proposalData, creds) {
     const headers = buildHeaders(creds);
     if (idempotencyKey)
         headers['Idempotency-Key'] = idempotencyKey;
-    // ZIG-207 / ZIG-270: parentAgreementId in path AND body. Backend's
+    // parentAgreementId in path AND body. Backend's
     // `DelegateTaskDto` validates `parentAgreementId` as a required string;
     // controller (`POST /agreements/:parentAgreementId/delegations`) merges
     // path over body, so duplicating the value is harmless. Stripping it
-    // from the body (as ZIG-207 #72 did) trips DTO validation and returns
+    // from the body (as #72 did) trips DTO validation and returns
     // `400: parentAgreementId must be a string` → infinite retry loop in
     // `agreement_subcontract`. Send both, let the path win.
     const bodyWithParent = { ...proposalData };
@@ -146,7 +146,7 @@ export async function delegateAgreement(proposalData, creds) {
     return shapeAgreement(data['agreement']);
 }
 /**
- * Approve or reject a pending agreement (ZIG-524 canonical client path).
+ * Approve or reject a pending agreement (canonical client path).
  *
  * Routes to `POST /claim` (open or org-scoped broadcast) or
  * `PUT /approvals/:partyId` (ledger). Legacy rows without approvals[] are
@@ -170,14 +170,14 @@ export async function respondToAgreement(agreementId, action, creds, opts = {})
     });
     const proposedTo = agreement.parties?.proposedTo;
     if (isBroadcastTarget(proposedTo) || isBroadcastTarget(agreement.parties?.payer)) {
-        // ZIG-1021: respond is approve/reject on DIRECT proposals only. An open
+        // respond is approve/reject on DIRECT proposals only. An open
         // broadcast (quest, standing offer, link invite) has no per-recipient
         // approval slot — a BYSTANDER can neither approve nor reject it
-        // (ZIG-719); their move is to claim it, which has its own verb.
+        //; their move is to claim it, which has its own verb.
         //
-        // ZIG-1077: with one exception — the caller who HOLDS a pending approval
+        // with one exception — the caller who HOLDS a pending approval
         // on the row. A hand-off pins its provider and that provider's consent
-        // is a real ledger slot even on an open broadcast (ZIG-1059); this guard
+        // is a real ledger slot even on an open broadcast; this guard
         // used to reject before looking, so the provider could not consent
         // through ANY surface and the hand-off sat unclaimable forever. The
         // backend keeps a consented broadcast OPEN for claims.
@@ -188,20 +188,9 @@ export async function respondToAgreement(agreementId, action, creds, opts = {})
     else if (!partyId) {
         throw new Error(`No pending approval entry for this operator on agreement ${agreementId}`);
     }
-    // ZIG-1087 — the slot resolved to the principal, not to us. Every call from
-    // this client impersonates `creds.agentId` (X-Agent-Id on every request), and
-    // `PUT /approvals/:partyId` takes a decision only from the party itself, so
-    // sending this would 403 with "You can only submit your own approval" —
-    // a condition, from which the caller cannot tell that no retry will ever
-    // work. Withholding consent from delegates is deliberate; being silent about
-    // it is not.
-    if (partyId && partyId !== creds.agentId) {
-        throw new Error(`Agreement ${agreementId} is waiting on ${partyId} — your principal, not you. ` +
-            `Consent is the human's to give: a delegate can submit its own approval slot and never its principal's, ` +
-            `so there is nothing to retry here and no tool that changes it. ` +
-            `Ask your human to approve or reject it${opts.appUrl ? ` at ${opts.appUrl}` : ' in the Ziggs app, under Agreements'}, ` +
-            `then read the agreement again to see the outcome.`);
-    }
+    // ZIG-1087 / ZIG-1316 — if the slot is the principal's, the server accepts
+    // only under a live approval-authority grant (else 403). Do not pre-refuse
+    // here; the PUT is the source of truth.
     return approveAgreementAsParty(agreementId, partyId, action === 'approve' ? 'approved' : 'rejected', creds);
 }
 /**
@@ -215,7 +204,7 @@ export function resolvePendingApprovalPartyId(facts, candidateIds) {
             return id;
     }
     // A row with no pending ledger entries is a legacy one (approvals[] predates
-    // ZIG-244), and there the named responder slot IS the decision.
+    //), and there the named responder slot IS the decision.
     const proposedTo = facts.proposedTo ?? null;
     if (proposedTo &&
         actorIds.includes(proposedTo) &&
@@ -225,7 +214,7 @@ export function resolvePendingApprovalPartyId(facts, candidateIds) {
     return null;
 }
 /**
- * ZIG-524 — resolve which approvals.partyId the current operator may submit.
+ * resolve which approvals.partyId the current operator may submit.
  * Checks pending ledger entries against impersonated agent id and owner principal.
  */
 export function resolveMyPendingApprovalPartyId(agreement, opts) {
@@ -242,7 +231,7 @@ export function resolveMyPendingApprovalPartyId(agreement, opts) {
  *
  * `partyId` MUST match the authenticated actor (`actor.id === partyId`): owner
  * principal when approving as human, delegate agent id when impersonating.
- * Canonical for hire, service, link, and quest proposals (ZIG-524).
+ * Canonical for hire, service, link, and quest proposals.
  */
 export async function approveAgreementAsParty(agreementId, partyId, status, creds) {
     if (!agreementId)
@@ -309,10 +298,10 @@ export async function getAgreementStatus(agreementId, creds) {
 }
 export async function listAgreements(filters = {}, creds) {
     assertCreds(creds, 'list agreements');
-    // ZIG-699 — return an empty array only for a genuine empty 200 result. Any
+    // return an empty array only for a genuine empty 200 result. Any
     // failure (non-2xx / network) throws so the MCP tool reports a real error
-    // instead of "you have no agreements". ZIG-1124 — HTTP failures are ApiError.
-    // Canonical query path: GET /agreements?scope=&status=&engagementKind=&...
+    // instead of "you have no agreements". HTTP failures are ApiError.
+    // Canonical query path: GET /agreements?scope=&status=&engagementKind=&..
     const url = new URL(getAgreementBaseUrl());
     if (filters.status)
         url.searchParams.set('status', filters.status);
@@ -342,7 +331,7 @@ export async function listAgreements(filters = {}, creds) {
 }
 export async function getMyAgreements(filters = {}, creds) {
     assertCreds(creds, 'get my agreements');
-    // ZIG-699 — empty array only for a genuine empty 200; any failure throws so
+    // empty array only for a genuine empty 200; any failure throws so
     // the tool surfaces a real error rather than "no agreements" (see listAgreements).
     // Canonical query path: GET /agreements?scope=mine returns the enriched
     // shape (tasks + originChatId + isYou flags).
@@ -386,10 +375,10 @@ async function getAgreementDocument(agreementId, creds) {
     if (!agreementId)
         return null;
     assertCreds(creds, 'get agreement');
-    // ZIG-698 — a genuine 404 (and 200-with-no-agreement) is a real "not found"
+    // a genuine 404 (and 200-with-no-agreement) is a real "not found"
     // and returns null. Every other failure (403/5xx/network) must throw so the
     // caller can tell "does not exist" from "could not fetch" instead of a 403
-    // masquerading as not-found. ZIG-1124 — thrown as ApiError for toolError.
+    // masquerading as not-found. thrown as ApiError for toolError.
     let res;
     try {
         res = await fetch(`${getAgreementBaseUrl()}/${agreementId}`, {
@@ -441,7 +430,7 @@ export async function revokeAgreement(agreementId, creds) {
     if (!agreementId)
         throw new Error('agreementId is required for revocation');
     assertCreds(creds, 'agreement revocation');
-    // ZIG-207: canonical REST verb. Legacy POST /agreements/:id/revoke stays
+    // canonical REST verb. Legacy POST /agreements/:id/revoke stays
     // serving the identical handler (with Deprecation headers) until PR-F.
     const res = await fetch(`${getAgreementBaseUrl()}/${encodeURIComponent(agreementId)}`, {
         method: 'DELETE',
@@ -458,7 +447,7 @@ export async function revokeAgreement(agreementId, creds) {
     const envelope = data;
     return { ...envelope, agreement: shapeAgreement(envelope.agreement) };
 }
-/** ZIG-832: mark an agreement fulfilled (complete). A provider closing its own
+/** mark an agreement fulfilled (complete). A provider closing its own
  * delivered work — party-gated server-side. */
 export async function fulfillAgreement(agreementId, creds) {
     if (!agreementId)
@@ -480,7 +469,7 @@ export async function fulfillAgreement(agreementId, creds) {
     return { ...envelope, agreement: shapeAgreement(envelope.agreement) };
 }
 /**
- * Claim an open agreement (ZIG-524 phase 2 / ZIG-525):
+ * Claim an open agreement. Three shapes are claimable:
  * - open link invite (`engagementKind: link`, proposedTo everyone)
  * - open broadcast quest (proposedTo 'everyone', status open)
  * - org-scoped broadcast quest (proposedTo 'org') — the server rejects the
@@ -501,7 +490,7 @@ export async function claimAgreement(agreementId, creds) {
     if (!data?.['agreement']) {
         throw new Error('Invalid response: expected { ok, agreement } from POST /agreements/:id/claim');
     }
-    // ZIG-1155: the route reports which kind of broadcast this turned out to be.
+    // the route reports which kind of broadcast this turned out to be.
     // A caller cannot work it out from the row — post-claim no sentinel is left,
     // and a quest (you do the work) reads the same shape as a standing offer (you
     // pay for it) unless you know which slot you landed in.
@@ -568,24 +557,6 @@ export async function getChatsForAgreement(agreementId, creds) {
         return [];
     }
 }
-export async function joinAgreement(agreementId, creds) {
-    if (!agreementId)
-        throw new Error('agreementId is required for join');
-    assertCreds(creds, 'join agreement');
-    const res = await fetch(`${getAgreementBaseUrl()}/${agreementId}/join`, {
-        method: 'POST',
-        headers: buildHeaders(creds),
-    });
-    if (!res.ok) {
-        const body = await res.text().catch(() => '');
-        throwApiError(res, body, `Join agreement failed: ${res.status} ${res.statusText}`);
-    }
-    const data = await res.json().catch(() => null);
-    if (!data?.['chatId']) {
-        throw new Error('Invalid response: expected { chatId } from /agreements/:id/join');
-    }
-    return data;
-}
 // ---------------------------------------------------------------------------
 // Artifact links
 // ---------------------------------------------------------------------------
@@ -696,7 +667,7 @@ export class AgreementClient {
     constructor(operatorKey, agentId) {
         if (!operatorKey)
             throw new Error('AgreementClient: operatorKey is required');
-        // agentId may be absent for agent-scoped keys (ZIG-642); the Creds-based
+        // agentId may be absent for agent-scoped keys; the Creds-based
         // standalone functions still assert it per call.
         this.creds = { operatorKey, agentId };
     }
@@ -717,7 +688,6 @@ export class AgreementClient {
     claimAgreement(id) { return claimAgreement(id, this.creds); }
     linkToChat(id, chatId, linkType) { return linkAgreementToChat(id, chatId, linkType ?? 'mention', this.creds); }
     listChats(id) { return getChatsForAgreement(id, this.creds); }
-    join(id) { return joinAgreement(id, this.creds); }
     linkArtifact(id, artifactId, linkType) { return linkArtifactToAgreement(id, artifactId, linkType ?? 'produced', this.creds); }
     listArtifacts(id) { return getArtifactsForAgreement(id, this.creds); }
     linkUser(id, userId, role) { return linkUserToAgreement(id, userId, role, this.creds); }

package/dist/http/ArtifactsClient.d.ts

@@ -8,7 +8,7 @@ export interface ListArtifactsQuery {
     agreementId?: string;
     taskId?: string;
     /**
-     * ZIG-1037 — `'me'` lists artifacts YOU authored, in any scope or none. The
+     * `'me'` lists artifacts YOU authored, in any scope or none. The
      * only listing that surfaces a free-standing artifact, since the others read
      * attach tables. Mutually exclusive with the scope filters.
      */
@@ -80,14 +80,14 @@ export type ArtifactFileView = Record<string, unknown> & {
  * they persist, are searchable, but are not visible to other chat parties.
  */
 /**
- * ZIG-1032 — turn a runtime lane id into a scope the backend can accept.
+ * turn a runtime lane id into a scope the backend can accept.
  *
  * A task with no origin chat runs on the lane `agrn-<agreementId>` (see
  * AgentHost.laneSessionIdForTask). That is a routing key, not a chat: no such
  * chat row exists, so passing it as `chatId` made every breadcrumb and recorded
  * thought on an agreement lane come back 403 "not authorized for this scope" —
  * a fictional scope reading like an auth failure. The work is agreement-scoped,
- * so say so; same rule ZIG-924 settled for deliverables.
+ * so say so; same rule settled for deliverables.
  */
 export declare const AGREEMENT_LANE_PREFIX = "agrn-";
 export declare function artifactScopeForSession(sessionId: string): {
@@ -102,7 +102,7 @@ export declare class ArtifactsClient {
     /**
      * @param operatorKey Agent-scoped or fleet operator key.
      * @param agentId Required for fleet keys (sent as X-Agent-Id). Omit for agent-scoped keys.
-     * @param laneId ZIG-1092 — the wake's lane (chat id, or `agrn-<agreementId>`),
+     * @param laneId the wake's lane (chat id, or `agrn-<agreementId>`),
      *   sent as X-Ziggs-Lane so `authoredBy=me` is fenced to this engagement
      *   instead of returning every customer's deliverables in one call.
      */
@@ -122,7 +122,7 @@ export declare class ArtifactsClient {
     }): Promise<void>;
     write(input: WriteArtifactInput): Promise<void>;
     /**
-     * ZIG-899 — the deliberate-record variant: a deliverable the model chose to
+     * the deliberate-record variant: a deliverable the model chose to
      * record must fail loudly and hand back the artifactId, unlike `write`'s
      * soft-fail breadcrumb contract. This is the one wire call for both agent
      * surfaces (the SDK artifact_record tool and ziggs-mcp's
@@ -132,7 +132,7 @@ export declare class ArtifactsClient {
         artifactId?: string;
     }>;
     /**
-     * ZIG-1037 — attach an existing artifact to a chat or a task.
+     * attach an existing artifact to a chat or a task.
      *
      * Attaching confers nothing on its own: it places the artifact inside the
      * container, and that container's audience (chat members / task parties) can
@@ -160,12 +160,12 @@ export declare class ArtifactsClient {
         filename: string;
     }>;
     reExtract(artifactId: string): Promise<ArtifactFileView>;
-    /** ZIG-1262 — shared fetch → text → throwApiError → JSON parse for file rail. */
+    /** shared fetch → text → throwApiError → JSON parse for file rail. */
     private _post;
     private _get;
     private _attach;
     /**
-     * ZIG-1037 — at most one container, and none is fine.
+     * at most one container, and none is fine.
      *
      * This used to demand exactly one, which is what made a deliverable fail at the
      * last step when the model had not worked out which container it was standing

package/dist/http/ArtifactsClient.js

@@ -19,14 +19,14 @@ function resolveUploadBytes(input) {
  * they persist, are searchable, but are not visible to other chat parties.
  */
 /**
- * ZIG-1032 — turn a runtime lane id into a scope the backend can accept.
+ * turn a runtime lane id into a scope the backend can accept.
  *
  * A task with no origin chat runs on the lane `agrn-<agreementId>` (see
  * AgentHost.laneSessionIdForTask). That is a routing key, not a chat: no such
  * chat row exists, so passing it as `chatId` made every breadcrumb and recorded
  * thought on an agreement lane come back 403 "not authorized for this scope" —
  * a fictional scope reading like an auth failure. The work is agreement-scoped,
- * so say so; same rule ZIG-924 settled for deliverables.
+ * so say so; same rule settled for deliverables.
  */
 export const AGREEMENT_LANE_PREFIX = 'agrn-';
 export function artifactScopeForSession(sessionId) {
@@ -42,7 +42,7 @@ export class ArtifactsClient {
     /**
      * @param operatorKey Agent-scoped or fleet operator key.
      * @param agentId Required for fleet keys (sent as X-Agent-Id). Omit for agent-scoped keys.
-     * @param laneId ZIG-1092 — the wake's lane (chat id, or `agrn-<agreementId>`),
+     * @param laneId the wake's lane (chat id, or `agrn-<agreementId>`),
      *   sent as X-Ziggs-Lane so `authoredBy=me` is fenced to this engagement
      *   instead of returning every customer's deliverables in one call.
      */
@@ -88,7 +88,7 @@ export class ArtifactsClient {
      * locally (operators can still wire their own sink).
      */
     async recordThought(sessionId, text, opts = {}) {
-        // ZIG-1032: `sessionId` may be an agreement lane, which is not a chat.
+        // `sessionId` may be an agreement lane, which is not a chat.
         return this.write({
             ...artifactScopeForSession(sessionId),
             text,
@@ -111,7 +111,7 @@ export class ArtifactsClient {
         }
     }
     /**
-     * ZIG-899 — the deliberate-record variant: a deliverable the model chose to
+     * the deliberate-record variant: a deliverable the model chose to
      * record must fail loudly and hand back the artifactId, unlike `write`'s
      * soft-fail breadcrumb contract. This is the one wire call for both agent
      * surfaces (the SDK artifact_record tool and ziggs-mcp's
@@ -150,7 +150,7 @@ export class ArtifactsClient {
         }
     }
     /**
-     * ZIG-1037 — attach an existing artifact to a chat or a task.
+     * attach an existing artifact to a chat or a task.
      *
      * Attaching confers nothing on its own: it places the artifact inside the
      * container, and that container's audience (chat members / task parties) can
@@ -252,7 +252,7 @@ export class ArtifactsClient {
             throw new Error('ArtifactsClient.reExtract: artifactId is required');
         return this._post(`/artifacts/${encodeURIComponent(artifactId)}/re-extract`, {}, 'artifact re-extract');
     }
-    /** ZIG-1262 — shared fetch → text → throwApiError → JSON parse for file rail. */
+    /** shared fetch → text → throwApiError → JSON parse for file rail. */
     async _post(path, body, label) {
         const res = await fetch(`${getBackendUrl()}${path}`, {
             method: 'POST',
@@ -280,7 +280,7 @@ export class ArtifactsClient {
         return { success: true };
     }
     /**
-     * ZIG-1037 — at most one container, and none is fine.
+     * at most one container, and none is fine.
      *
      * This used to demand exactly one, which is what made a deliverable fail at the
      * last step when the model had not worked out which container it was standing
@@ -290,12 +290,12 @@ export class ArtifactsClient {
      */
     _assertScopeXor(input) {
         if (input.chatId && input.agreementId) {
-            // ZIG-1075: the refusal names the recovery, because this is the one gate
+            // the refusal names the recovery, because this is the one gate
             // for every caller — the exposed tool surfaces inherit it rather than each
             // wording their own, and a caller that used to have chatId silently
             // dropped here now learns what to do instead. Wording matters: a bare
             // "pick one" at the last step of a finished task is what the drop was
-            // added to avoid (ZIG-924 dogfood).
+            // added to avoid (dogfood).
             throw new Error('pass at most one of chatId or agreementId — a deliverable under an ' +
                 'agreement wants agreementId alone (its parties see it); use chatId ' +
                 'only for a chat-scoped note. To put it in both places, record it ' +

package/dist/http/ChatClient.d.ts

@@ -1,5 +1,5 @@
 import { type Creds } from '../types.js';
-/** Shape of GET /chats/mine items — the backend's ChatReadDto (ZIG-665). */
+/** Shape of GET /chats/mine items — the backend's ChatReadDto. */
 export interface ChatSummary {
     chatId: string;
     members: Array<{
@@ -18,7 +18,7 @@ export declare function openConversation(participantId: string, creds: Creds, {
 export interface SendChatMessageInput {
     chatId: string;
     /**
-     * Recipient id. Optional (ZIG-548): when omitted, the backend infers the
+     * Recipient id. Optional: when omitted, the backend infers the
      * receiver if the chat has exactly one other member (one agent, or one
      * other human). Provide it explicitly in chats with multiple members.
      */
@@ -62,7 +62,7 @@ export type AddChatMemberResult = {
     chat?: unknown;
 };
 /**
- * POST /chats/:chatId/members — add user/agent; agent-invite may return pending admission (ZIG-426).
+ * POST /chats/:chatId/members — add user/agent; agent-invite may return pending admission.
  */
 export declare function addChatMember(input: AddChatMemberInput, creds: Creds): Promise<AddChatMemberResult>;
 /**

package/dist/http/ChatClient.js

@@ -6,7 +6,7 @@ function buildHeaders(creds) {
         'content-type': 'application/json',
         Authorization: `Bearer ${creds.operatorKey}`,
         'X-Agent-Id': creds.agentId,
-        // ZIG-1092 — the wake's lane, so the backend can fence this call to the
+        // the wake's lane, so the backend can fence this call to the
         // engagement it belongs to rather than the agent's whole authority.
         ...(creds.laneId ? { 'X-Ziggs-Lane': creds.laneId } : {}),
     };
@@ -36,7 +36,7 @@ export async function openConversation(participantId, creds, { newChat = false }
     if (!data?.['chatId'] || typeof data['chatId'] !== 'string') {
         throw new Error('Invalid response: expected { chatId } from POST /chats');
     }
-    // ZIG-1216: left UNDEFINED rather than defaulted when the backend does not
+    // left UNDEFINED rather than defaulted when the backend does not
     // send it. A backend from before this field cannot be assumed to have created
     // the room — defaulting to false would report a reused conversation as fresh,
     // which is worse than saying nothing.
@@ -47,7 +47,7 @@ export async function openConversation(participantId, creds, { newChat = false }
     };
 }
 /**
- * POST /chats/:chatId/members — add user/agent; agent-invite may return pending admission (ZIG-426).
+ * POST /chats/:chatId/members — add user/agent; agent-invite may return pending admission.
  */
 export async function addChatMember(input, creds) {
     assertCreds(creds, 'add chat member');
@@ -111,9 +111,9 @@ export async function sendChatMessage(input, creds) {
 }
 export async function listMyChats(creds) {
     assertCreds(creds, 'list my chats');
-    // ZIG-699 — empty array only for a genuine empty 200; any failure (non-2xx /
+    // empty array only for a genuine empty 200; any failure (non-2xx /
     // network) throws so ziggs_chat_list reports a real error instead of "you
-    // have no chats". ZIG-1124 — HTTP failures are ApiError (status/body/code).
+    // have no chats". HTTP failures are ApiError (status/body/code).
     let res;
     try {
         res = await fetch(`${getBackendUrl()}/chats/mine`, {
@@ -142,7 +142,7 @@ export class ChatClient {
     constructor(operatorKey, agentId) {
         if (!operatorKey)
             throw new Error('ChatClient: operatorKey is required');
-        // agentId may be absent for agent-scoped keys (ZIG-642); the Creds-based
+        // agentId may be absent for agent-scoped keys; the Creds-based
         // standalone functions still assert it per call.
         this.creds = { operatorKey, agentId };
     }

package/dist/http/ConnectionsClient.d.ts

@@ -19,7 +19,7 @@ export interface ConnectionGrant {
     [key: string]: unknown;
 }
 /**
- * ZIG-641 / ZIG-648 — every connection grant the acting agent holds, grouped by
+ * every connection grant the acting agent holds, grouped by
  * connection, via the unified GET /grants. `provider` comes from the grant's
  * resolved scope label.
  */
@@ -34,17 +34,17 @@ export interface McpConnectionRequestParams {
     reason?: string;
     /**
      * Working chat the consent card is opened into. Required by the backend for
-     * the agent-tool path; the per-user gateway trigger (ZIG-771) omits it.
+     * the agent-tool path; the per-user gateway trigger omits it.
      */
     chatId?: string;
     /**
      * Target the consent request at this end-user (X-On-Behalf-Of-User) instead
-     * of the operator — the per-user MCP gateway's connect prompt (ZIG-771).
+     * of the operator — the per-user MCP gateway's connect prompt.
      */
     onBehalfOfUserId?: string;
 }
 /**
- * ZIG-894 — the one connections client for every surface. Consolidates the
+ * the one connections client for every surface. Consolidates the
  * former agent-sdk private ZiggsConnectClient and ziggs-mcp's inline fetches
  * (proxy, requestMcpConnection). Proxied provider calls never
  * return the raw OAuth token; every proxy response is additionally scanned by
@@ -72,7 +72,7 @@ export declare class ConnectionsClient {
         connectionId: string;
     }): Promise<ConnectionGrant[]>;
     /**
-     * ZIG-641 / ZIG-956 — cross-connection discovery over the unified GET /grants:
+     * cross-connection discovery over the unified GET /grants:
      * every live connection grant this agent holds, grouped by connection, so a
      * proxy caller's connectionId/grantId no longer has to arrive out of band.
      * Moved here from ziggs-mcp's inline helper. The response is scanned
@@ -89,7 +89,7 @@ export declare class ConnectionsClient {
      * Attenuate (re-delegate) a connection grant with tighter caveats. Narrowing
      * a grant whose connection you own mints immediately; a grant whose owner is
      * a different party returns `{ status: 'pending_approval', agreementId }`
-     * (ZIG-701 consent flow) and no grant is minted yet.
+     * (consent flow) and no grant is minted yet.
      */
     attenuateGrant({ connectionId, grantId, holderId, caveats, }: {
         connectionId: string;
@@ -103,9 +103,9 @@ export declare class ConnectionsClient {
         grantId: string;
     }): Promise<unknown>;
     /**
-     * ZIG-686 — agent-initiated MCP connection request: ask the principal to
+     * agent-initiated MCP connection request: ask the principal to
      * connect a remote MCP server and grant this agent the listed tools. Opens a
-     * connection-consent agreement in the working chat (ZIG-798); on approval the
+     * connection-consent agreement in the working chat; on approval the
      * server is connected (if needed) and the agent is granted the tools.
      */
     requestMcpConnection({ serverUrl, tools, reason, chatId, onBehalfOfUserId, }: McpConnectionRequestParams): Promise<Record<string, unknown>>;

package/dist/http/ConnectionsClient.js

@@ -2,7 +2,7 @@ import { getBackendUrl } from '../utils/urlUtils.js';
 import { throwApiError } from '../shared/apiError.js';
 import { buildOperatorHeaders } from './operatorHeaders.js';
 import { GrantsClient } from './GrantsClient.js';
-// ZIG-569 — defense-in-depth mirror of the backend leak-guard
+// defense-in-depth mirror of the backend leak-guard
 // (assertProxyResponseDoesNotLeakTokens). The backend strips the *specific*
 // vault token from the response; clients never see that token, so this layer
 // instead pattern-scans the proxied body for high-signal provider credential
@@ -22,7 +22,7 @@ export function assertNoLeakedConnectionSecret(serialized) {
     }
 }
 /**
- * ZIG-894 — the one connections client for every surface. Consolidates the
+ * the one connections client for every surface. Consolidates the
  * former agent-sdk private ZiggsConnectClient and ziggs-mcp's inline fetches
  * (proxy, requestMcpConnection). Proxied provider calls never
  * return the raw OAuth token; every proxy response is additionally scanned by
@@ -84,7 +84,7 @@ export class ConnectionsClient {
         return grants.filter((g) => g['holderId'] === this.agentId);
     }
     /**
-     * ZIG-641 / ZIG-956 — cross-connection discovery over the unified GET /grants:
+     * cross-connection discovery over the unified GET /grants:
      * every live connection grant this agent holds, grouped by connection, so a
      * proxy caller's connectionId/grantId no longer has to arrive out of band.
      * Moved here from ziggs-mcp's inline helper. The response is scanned
@@ -126,7 +126,7 @@ export class ConnectionsClient {
      * Attenuate (re-delegate) a connection grant with tighter caveats. Narrowing
      * a grant whose connection you own mints immediately; a grant whose owner is
      * a different party returns `{ status: 'pending_approval', agreementId }`
-     * (ZIG-701 consent flow) and no grant is minted yet.
+     * (consent flow) and no grant is minted yet.
      */
     async attenuateGrant({ connectionId, grantId, holderId, caveats, }) {
         if (!connectionId)
@@ -146,9 +146,9 @@ export class ConnectionsClient {
         return this._request('DELETE', `/connections/${encodeURIComponent(connectionId)}/grants/${encodeURIComponent(grantId)}`, undefined);
     }
     /**
-     * ZIG-686 — agent-initiated MCP connection request: ask the principal to
+     * agent-initiated MCP connection request: ask the principal to
      * connect a remote MCP server and grant this agent the listed tools. Opens a
-     * connection-consent agreement in the working chat (ZIG-798); on approval the
+     * connection-consent agreement in the working chat; on approval the
      * server is connected (if needed) and the agent is granted the tools.
      */
     async requestMcpConnection({ serverUrl, tools, reason, chatId, onBehalfOfUserId, }) {
@@ -169,7 +169,7 @@ export class ConnectionsClient {
         const response = await fetch(`${this.baseUrl}${path}`, init);
         const text = await response.text().catch(() => '');
         if (!response.ok) {
-            // ZIG-1124 — ApiError (status/body/code); ConnectionsError remains the
+            // ApiError (status/body/code); ConnectionsError remains the
             // documented duck type for callers that branch on `.status`.
             throwApiError(response, text, `${method} ${path} failed: ${response.status}`);
         }

package/dist/http/ContextDiscoveryClient.d.ts

@@ -1,6 +1,6 @@
 /**
  * Labels-only pointer to context the agent could request access to (P4).
- * ZIG-927: covers chats, agreements, and connections; connection labels are the
+ * covers chats, agreements, and connections; connection labels are the
  * provider name only (never tokens/account labels).
  */
 export interface DiscoverableItem {

package/dist/http/ContextGrantsClient.d.ts

@@ -1,6 +1,6 @@
 import type { GrantView } from './grants.js';
 /**
- * ZIG-1037 added `artifact` — the narrowest context scope: one specific artifact,
+ * added `artifact` — the narrowest context scope: one specific artifact,
  * shared without sharing any chat or agreement it sits in. Still the context
  * rail, not a new grant primitive.
  */
@@ -11,7 +11,7 @@ export interface ContextGrantScope {
     id: string;
 }
 /**
- * @deprecated ZIG-646 — context grants now serialise to the canonical
+ * @deprecated context grants now serialise to the canonical
  * {@link GrantView} like every other rail. This alias previously declared a
  * flat `scopeKind`/`scopeId` + `revoked` shape that the backend never actually
  * emitted (it sends nested `scope: { kind, id }` and folds temporal/watermark
@@ -43,13 +43,13 @@ export type DelegateContextGrantResult = {
     agreementId: string;
     ownerId?: string;
 };
-/** A single readable entry inside a grant's scope — id + label only (ZIG-870). */
+/** A single readable entry inside a grant's scope — id + label only. */
 export interface ReachEntry {
     id: string;
     label: string;
 }
 /**
- * ZIG-870 reach expansion — the chat/agreement ids a grant you hold actually
+ * reach expansion — the chat/agreement ids a grant you hold actually
  * covers, so an org/agreement-scoped grant becomes a concrete list you can
  * `context_read` through (via=chat:<id> / agreement:<id>). Ids + labels only,
  * never content. Org scope is capped; `truncatedChats`/`truncatedAgreements`
@@ -64,7 +64,7 @@ export interface GrantReachResult {
     truncatedAgreements: number;
 }
 /**
- * ZIG-411 context grant management — list / issue / delegate / revoke.
+ * context grant management — list / issue / delegate / revoke.
  */
 export declare class ContextGrantsClient {
     private readonly operatorKey;
@@ -78,14 +78,14 @@ export declare class ContextGrantsClient {
     issueGrant(input: IssueContextGrantInput): Promise<GrantView>;
     delegateGrant(parentGrantId: string, input: DelegateContextGrantInput): Promise<DelegateContextGrantResult>;
     /**
-     * ZIG-870 — expand a grant you hold into the chat/agreement ids inside its
+     * expand a grant you hold into the chat/agreement ids inside its
      * scope. A grant is a fence, not a listing: discovery says "you hold
      * org:acme", this says which chats/agreements that covers. Holder-only,
      * labels-only, grant-fenced server-side.
      */
     getReach(grantId: string): Promise<GrantReachResult>;
     /**
-     * ZIG-1037 — share an artifact THIS agent authored with another agent.
+     * share an artifact THIS agent authored with another agent.
      *
      * Not a delegation: an agent holds no grant over its own output, so there is
      * no parent to attenuate. Authorship is the authority, held by the agent's