[purpshell]

Organization keys and project tokens can no longer list or revoke long-lived credentials through the public API. Remove Client.apiKeys and Client.projectTokens, their resources/types/exports, and all associated examples and documentation. Client-token operations remain.

API source for the removal: polymorfa/polymorfa commit cdc3d8dd2770693f1d319ecf5d0fa1a058717a0d. contracts/credential-management.json pins the exact narrow delta and source spec hash; existing full snapshots retain their baseline provenance. Analytics source hashes remain the original source hashes; SDK snapshot hashes reflect only the credential-removal delta. No unrelated API parity is claimed.

Six-part impact:

• API updated in the companion monorepo PR (linked below): public routes removed; Console/account human routes retained.
• SDK updated: TypeScript is the only server language present on target dev. Remove methods/types and packed exports; browser/client-token code unchanged.
• CLI updated in companion PR (linked below): remove key list/revoke and project-token list; no new SDK method/dependency is needed.
• Docs updated: READMEs, example route/UI/fixtures and contract provenance here; Mintlify/changelog in monorepo.
• Feature releases updated in monorepo release record; unconditional credential authority correction, no flag/entitlement change. Registry publication and API deployment remain unverified.
• Admin unaffected: staff admin-api-keys v1 remains a separate capability through named functions and Temporal.

Validation: typecheck, build, lint (two existing unused eslint-disable warnings), 47 affected coverage/export/resource/clean-packed-consumer tests pass. Full Node 24 suite passed 1544/1546 before updating the two changed inventory expectations; both corrected suites pass. Strict coverage reports 605 operations: 451 covered, 140 excluded, 14 pre-existing Campaigns gaps, zero changed. The gate is unchanged; these are explicitly recorded baseline gaps, so they do not fail strict drift validation. Initial Node 26 full-suite composer/TLS environment failures disappear with Node 24.

Blocked delivery: polymorfa/sdks repository secrets SDK_COVERAGE_CLIENT_ID and SDK_COVERAGE_APP_PRIVATE_KEY are absent. The main publication workflow requires them for its App token step, so publication remains blocked; no secret or workflow workaround is included. dev and main are distinct: this PR targets dev as explicitly requested; default main publication needs a deliberate forward-port/accepted release. No published package, registry-only install or deployed acceptance is claimed. This remains draft while required delivery gates are blocked.

Companion delivery: https://github.com/polymorfa/polymorfa/pull/641 · #354 · polymorfa/cli#83

Publication blocker reproduced in the existing main workflow run: https://github.com/polymorfa/sdks/actions/runs/39010443783 fails with “client-id (or deprecated app-id) input must be set to a non-empty string.” Credentials were not changed or exercised.

[coderabbitai]

Warning

Review limit reached

The included review limit has been reached and this organization has disabled usage-based review continuation. Wait for reviews to reset or ask a billing admin to change After included review limits.

• Ask an admin to enable usage-based reviews

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Next included review available in 1 minute.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 67 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Team
• Run ID: 196b96b2-0231-4a35-9b07-37e13c0e9cc5

📥 Commits

Reviewing files that changed from the base of the PR and between bf3c52e and 0b1dbf4.

📒 Files selected for processing: 21

• README.md
• contracts/README.md
• contracts/coverage.json
• contracts/credential-management.json
• contracts/openapi.platform.json
• contracts/source.json
• examples/full-platform/README.md
• examples/full-platform/app/api/admin/organization/route.ts
• examples/full-platform/lib/desk/demo-fixtures.ts
• examples/full-platform/ui/pages/admin.tsx
• packages/typescript/README.md
• packages/typescript/src/client.ts
• packages/typescript/src/index.ts
• packages/typescript/src/platform/api-keys.ts
• packages/typescript/src/platform/project-tokens.ts
• packages/typescript/src/platform/types.ts
• packages/typescript/test/coverage-reconciliation.test.ts
• packages/typescript/test/coverage.test.ts
• packages/typescript/test/exports.test.ts
• packages/typescript/test/package.test.ts
• packages/typescript/test/platform-access.test.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T18:20:26.982958Z	0b1dbf4	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-17T18:20:57.272125Z	0b1dbf4	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.