feat(auth): add scoped application and webhook signing for Durable Streams

docs/api/content/tokens/create.mdx

@@ -53,8 +53,8 @@ Content type: `application/json`.
 | --- | --- | --- | --- |
 | `duration` | `integer \| null` | No | Lifetime in seconds. Omit for the default lifetime. |
 | `grants` | `object[]` | Yes | Permissions the token carries. |
-| `grants[].operations` | `("read" \| "update" \| "list" \| "create" \| "delete")[]` | Yes | Operations the token may perform on the target. |
-| `grants[].resource` | `"namespace" \| "actor" \| "runner" \| "runner_config" \| "datacenter" \| "actor_gateway" \| "actor_kv"` | Yes | Resource type the grant applies to. |
+| `grants[].operations` | `("read" \| "update" \| "list" \| "create" \| "delete" \| "append" \| "close")[]` | Yes | Operations the token may perform on the target. |
+| `grants[].resource` | `"namespace" \| "actor" \| "runner" \| "runner_config" \| "datacenter" \| "actor_gateway" \| "actor_kv" \| "actor_stream" \| "durable_stream" \| "application_token" \| "webhook_signing"` | Yes | Resource type the grant applies to. |
 | `grants[].target` | `"any" \| object` | Yes | `"any"` for every resource of this type, or `{ "id": "..." }` for one resource. |
 | `namespace` | `string` | Yes | Namespace the token is valid in. |
 | `subject` | `string \| null` | No | Free-form subject to attach to the token, such as a user ID. |

docs/api/content/tokens/inspect.mdx

@@ -34,8 +34,8 @@ Send your namespace token as a bearer token in the `Authorization` header. Every
 | --- | --- | --- |
 | `expires_ts` | `integer` | When the token expires, in Unix milliseconds. |
 | `grants` | `object[]` | Permissions the token carries. |
-| `grants[].operations` | `("read" \| "update" \| "list" \| "create" \| "delete")[]` | Operations the token may perform on the target. |
-| `grants[].resource` | `"namespace" \| "actor" \| "runner" \| "runner_config" \| "datacenter" \| "actor_gateway" \| "actor_kv"` | Resource type the grant applies to. |
+| `grants[].operations` | `("read" \| "update" \| "list" \| "create" \| "delete" \| "append" \| "close")[]` | Operations the token may perform on the target. |
+| `grants[].resource` | `"namespace" \| "actor" \| "runner" \| "runner_config" \| "datacenter" \| "actor_gateway" \| "actor_kv" \| "actor_stream" \| "durable_stream" \| "application_token" \| "webhook_signing"` | Resource type the grant applies to. |
 | `grants[].target` | `"any" \| object` | `"any"` for every resource of this type, or `{ "id": "..." }` for one resource. |
 | `issued_ts` | `integer` | When the token was issued, in Unix milliseconds. |
 | `namespace_id` | `string` | ID of the namespace the token is scoped to. |

docs/api/error-registry.json

@@ -1478,6 +1478,42 @@
 				}
 			]
 		},
+		{
+			"name": "signing",
+			"description": null,
+			"errors": [
+				{
+					"code": "conflict",
+					"message": "The signing key generation or request ID conflicts with current state.",
+					"statuses": []
+				},
+				{
+					"code": "invalid_input",
+					"message": "Invalid signing request.",
+					"statuses": []
+				},
+				{
+					"code": "not_found",
+					"message": "The namespace signing keys have not been provisioned.",
+					"statuses": []
+				},
+				{
+					"code": "payload_too_large",
+					"message": "The signing payload or token exceeds its size limit.",
+					"statuses": []
+				},
+				{
+					"code": "throttled",
+					"message": "The namespace signing quota or service capacity is exhausted.",
+					"statuses": []
+				},
+				{
+					"code": "unavailable",
+					"message": "The signing service is temporarily unavailable.",
+					"statuses": []
+				}
+			]
+		},
 		{
 			"name": "sqlite",
 			"description": null,