@fusebase/fusebase-gate-sdk 2.11.5 → 2.11.6

package/dist/apis/AppApisApi.d.ts

@@ -11,7 +11,7 @@ export declare class AppApisApi {
     constructor(client: Client);
     /**
      * Call app API operation
-     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context. Pass `onBehalfOfUserToken` (a platform app token, i.e. the user's `fbsfeaturetoken`) to run the call on behalf of an end user: Gate verifies it fail-closed and forwards the resolved user to the runtime as `X-Fusebase-Verified-User-Id` / `X-Fusebase-Verified-User-Source: obo`, so apps no longer need to hand-roll dual-token forwarding. The operation's `allowedCallers` / `requiredPermissions` are still evaluated against the calling identity, not the on-behalf-of user.
+     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context. Pass `onBehalfOfUserToken` (a platform app token, i.e. the user's `fbsfeaturetoken`) to run the call on behalf of an end user: Gate verifies it fail-closed and forwards the resolved user to the runtime as `X-Fusebase-Verified-User-Id` / `X-Fusebase-Verified-User-Source: obo`, so apps no longer need to hand-roll dual-token forwarding. The operation's `allowedCallers` / `requiredPermissions` are still evaluated against the calling identity, not the on-behalf-of user. Pass `headers` to forward extra request headers to the runtime, for operations that require one such as `Idempotency-Key`; headers Gate sets itself (auth and `X-Fusebase-*` identity headers) are reserved and rejected with 400.
      */
     callAppApi(params: {
         path: {

package/dist/apis/AppApisApi.js

@@ -13,7 +13,7 @@ class AppApisApi {
     }
     /**
      * Call app API operation
-     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context. Pass `onBehalfOfUserToken` (a platform app token, i.e. the user's `fbsfeaturetoken`) to run the call on behalf of an end user: Gate verifies it fail-closed and forwards the resolved user to the runtime as `X-Fusebase-Verified-User-Id` / `X-Fusebase-Verified-User-Source: obo`, so apps no longer need to hand-roll dual-token forwarding. The operation's `allowedCallers` / `requiredPermissions` are still evaluated against the calling identity, not the on-behalf-of user.
+     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context. Pass `onBehalfOfUserToken` (a platform app token, i.e. the user's `fbsfeaturetoken`) to run the call on behalf of an end user: Gate verifies it fail-closed and forwards the resolved user to the runtime as `X-Fusebase-Verified-User-Id` / `X-Fusebase-Verified-User-Source: obo`, so apps no longer need to hand-roll dual-token forwarding. The operation's `allowedCallers` / `requiredPermissions` are still evaluated against the calling identity, not the on-behalf-of user. Pass `headers` to forward extra request headers to the runtime, for operations that require one such as `Idempotency-Key`; headers Gate sets itself (auth and `X-Fusebase-*` identity headers) are reserved and rejected with 400.
      */
     async callAppApi(params) {
         return this.client.request({

package/dist/apis/AppMagicLinksApi.d.ts

@@ -11,7 +11,7 @@ export declare class AppMagicLinksApi {
     constructor(client: Client);
     /**
      * Activate an app magic link
-     * Unauthenticated activation: exchange a magic-link globalId for a session token (used to set the eversessionid cookie on the app subdomain), a Gate feature token, and a Dashboard feature token, all scoped to the magic link's app and target user. Re-evaluates accessPrincipals at activation time so a link issued before access was revoked can no longer be redeemed. Within the 24h TTL the link can be activated more than once.
+     * Unauthenticated activation: exchange a magic-link globalId for a session token (a raw FuseBase session id: forward it to Gate as `EverHelper-Session-ID` when a legacy call needs it, never set it as a cookie on the app host), a Gate feature token, and a Dashboard feature token, all scoped to the magic link's app and target user. Re-evaluates accessPrincipals at activation time so a link issued before access was revoked can no longer be redeemed. Within the 24h TTL the link can be activated more than once.
      */
     activateAppMagicLink(params: {
         path: {

package/dist/apis/AppMagicLinksApi.js

@@ -13,7 +13,7 @@ class AppMagicLinksApi {
     }
     /**
      * Activate an app magic link
-     * Unauthenticated activation: exchange a magic-link globalId for a session token (used to set the eversessionid cookie on the app subdomain), a Gate feature token, and a Dashboard feature token, all scoped to the magic link's app and target user. Re-evaluates accessPrincipals at activation time so a link issued before access was revoked can no longer be redeemed. Within the 24h TTL the link can be activated more than once.
+     * Unauthenticated activation: exchange a magic-link globalId for a session token (a raw FuseBase session id: forward it to Gate as `EverHelper-Session-ID` when a legacy call needs it, never set it as a cookie on the app host), a Gate feature token, and a Dashboard feature token, all scoped to the magic link's app and target user. Re-evaluates accessPrincipals at activation time so a link issued before access was revoked can no longer be redeemed. Within the 24h TTL the link can be activated more than once.
      */
     async activateAppMagicLink(params) {
         return this.client.request({

package/dist/apis/FusebaseAuthApi.d.ts

@@ -21,7 +21,7 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthPasswordRestoreKeyResponseContract>;
     /**
      * Complete Fusebase auth challenge
-     * Visitor-safe challenge completion endpoint for CAPTCHA, OTP, mail OTP, and MFA flows returned by register/login.
+     * Visitor-safe challenge completion endpoint for CAPTCHA, OTP, mail OTP, and MFA flows returned by register/login. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it.
      */
     completeFusebaseAuthChallenge(params: {
         headers?: Record<string, string>;
@@ -29,7 +29,7 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthChallengeResponseContract>;
     /**
      * Login a Fusebase user
-     * Visitor-safe email/password login proxy for AI App auth. Forwards to auth-form `/auth/api/auth` server-side and returns sessionId for the app backend to set as its own cookie. Never provisions org membership.
+     * Visitor-safe email/password login proxy for AI App auth. Forwards to auth-form `/auth/api/auth` server-side. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it. Never provisions org membership.
      */
     loginFusebaseUser(params: {
         headers?: Record<string, string>;
@@ -44,7 +44,7 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthLogoutResponseContract>;
     /**
      * Register a Fusebase user and add org membership
-     * Protected AI App onboarding flow. Creates a Fusebase account through auth-form, then adds the newly created user to the path org with the requested role. Requires org.members.write and org access. This endpoint is for registration only; do not call it on login because that can overwrite or duplicate existing membership intent. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
+     * Protected AI App onboarding flow. Creates a Fusebase account through auth-form, then adds the newly created user to the path org with the requested role. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it. Requires org.members.write and org access. This endpoint is for registration only; do not call it on login because that can overwrite or duplicate existing membership intent. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
      */
     registerFusebaseOrgMember(params: {
         path: {
@@ -55,7 +55,7 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthRegisterMemberResponseContract>;
     /**
      * Register a Fusebase user
-     * Visitor-safe email/password Fusebase registration proxy for AI App auth. Forwards to auth-form `/auth/api/register` server-side and returns the Fusebase sessionId for the app backend to set as its own cookie. Does not add org membership. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
+     * Visitor-safe email/password Fusebase registration proxy for AI App auth. Forwards to auth-form `/auth/api/register` server-side. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it. Does not add org membership. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
      */
     registerFusebaseUser(params: {
         headers?: Record<string, string>;

package/dist/apis/FusebaseAuthApi.js

@@ -27,7 +27,7 @@ class FusebaseAuthApi {
     }
     /**
      * Complete Fusebase auth challenge
-     * Visitor-safe challenge completion endpoint for CAPTCHA, OTP, mail OTP, and MFA flows returned by register/login.
+     * Visitor-safe challenge completion endpoint for CAPTCHA, OTP, mail OTP, and MFA flows returned by register/login. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it.
      */
     async completeFusebaseAuthChallenge(params) {
         return this.client.request({
@@ -41,7 +41,7 @@ class FusebaseAuthApi {
     }
     /**
      * Login a Fusebase user
-     * Visitor-safe email/password login proxy for AI App auth. Forwards to auth-form `/auth/api/auth` server-side and returns sessionId for the app backend to set as its own cookie. Never provisions org membership.
+     * Visitor-safe email/password login proxy for AI App auth. Forwards to auth-form `/auth/api/auth` server-side. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it. Never provisions org membership.
      */
     async loginFusebaseUser(params) {
         return this.client.request({
@@ -68,7 +68,7 @@ class FusebaseAuthApi {
     }
     /**
      * Register a Fusebase user and add org membership
-     * Protected AI App onboarding flow. Creates a Fusebase account through auth-form, then adds the newly created user to the path org with the requested role. Requires org.members.write and org access. This endpoint is for registration only; do not call it on login because that can overwrite or duplicate existing membership intent. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
+     * Protected AI App onboarding flow. Creates a Fusebase account through auth-form, then adds the newly created user to the path org with the requested role. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it. Requires org.members.write and org access. This endpoint is for registration only; do not call it on login because that can overwrite or duplicate existing membership intent. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
      */
     async registerFusebaseOrgMember(params) {
         return this.client.request({
@@ -83,7 +83,7 @@ class FusebaseAuthApi {
     }
     /**
      * Register a Fusebase user
-     * Visitor-safe email/password Fusebase registration proxy for AI App auth. Forwards to auth-form `/auth/api/register` server-side and returns the Fusebase sessionId for the app backend to set as its own cookie. Does not add org membership. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
+     * Visitor-safe email/password Fusebase registration proxy for AI App auth. Forwards to auth-form `/auth/api/register` server-side. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it. Does not add org membership. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
      */
     async registerFusebaseUser(params) {
         return this.client.request({

package/dist/types/app-api/app-api.d.ts

@@ -76,6 +76,12 @@ export interface CallAppApiRequestContract {
     path?: Record<string, string>;
     query?: Record<string, string | number | boolean>;
     body?: unknown;
+    /**
+     * Extra request headers forwarded verbatim to the app runtime, for operations
+     * that require one (e.g. `Idempotency-Key`). Headers Gate sets itself to prove
+     * the caller's identity to the runtime are reserved and rejected with 400.
+     */
+    headers?: Record<string, string>;
     /**
      * On-behalf-of: a platform app token (`fbsfeaturetoken` / `x-app-feature-token`)
      * identifying the end user this call runs for. Gate verifies it fail-closed and

package/dist/types/app-magic-link/app-magic-link.d.ts

@@ -137,7 +137,10 @@ export interface ActivateAppMagicLinkResponseContract {
      */
     id: string;
     /**
-     * Session id usable as the `eversessionid` cookie value.
+     * Raw FuseBase session id. Do not set it as a cookie on the app host: the
+     * app runtime token (`fbsfeaturetoken`) is the only credential an app host
+     * carries. Forward it to Gate as `EverHelper-Session-ID` when a legacy call
+     * needs it.
      */
     sessionToken: string;
     /**

package/dist/types/fusebase-auth/fusebase-auth.d.ts

@@ -1,7 +1,40 @@
+/**
+ * Deprecated. A raw FuseBase session id, which an app has no business holding:
+ * it is the FuseBase login itself, not an app-scoped credential. Gate omits it
+ * when it runs with the `app_login_no_session_id` feature flag (NIM-43689).
+ * Use `appAuth` instead.
+ *
+ * @deprecated Use `appAuth`.
+ */
 export interface FusebaseAuthSessionContract {
     sessionId: string;
     userId: number;
 }
+/**
+ * Login handoff for an authenticated result (NIM-43689). Spend `authPath` on
+ * the app's own origin — a same-origin `fetch` with `Accept: application/json`
+ * from the running page, or a plain navigation — and the platform resolves
+ * `exchangeToken` there into the app runtime token (`fbsfeaturetoken`).
+ *
+ * The token is not bound to the app it was minted for: the platform takes the
+ * app identity from the request host, so whoever holds it can mint a runtime
+ * token for that user on any app host that user can open.
+ */
+export interface FusebaseAuthAppAuthContract {
+    /**
+     * Session-exchange token. Spend it on `authPath`. It stays valid for the
+     * whole `expiresInSeconds` window and is not invalidated by being spent, so
+     * treat it as a credential: keep it out of logs and out of shared links.
+     */
+    exchangeToken: string;
+    /** Lifetime of `exchangeToken` in seconds, counted from this response. */
+    expiresInSeconds: number;
+    /**
+     * Relative URL on the app's own host, built from the `redirectPath` the app
+     * sent. Pass it through; do not assemble it yourself.
+     */
+    authPath: string;
+}
 export interface FusebaseAuthChallengeContract {
     type: string;
     state: string;
@@ -31,7 +64,17 @@ export interface FusebaseAuthRegisterRequestContract {
 }
 export interface FusebaseAuthRegisterResponseContract {
     status: "authenticated" | "challenge_required";
+    /**
+     * Deprecated. A raw FuseBase session id, which an app has no business
+     * holding: it is the FuseBase login itself, not an app-scoped credential.
+     * Gate stops returning it when it runs with the `app_login_no_session_id`
+     * feature flag (NIM-43689). Use `appAuth` instead.
+     *
+     * @deprecated Use `appAuth`.
+     */
     session?: FusebaseAuthSessionContract;
+    /** Present on an authenticated result, unless the mint failed. */
+    appAuth?: FusebaseAuthAppAuthContract;
     challenge?: FusebaseAuthChallengeContract;
     redirectPath: string;
 }
@@ -83,6 +126,28 @@ export interface FusebaseAuthUnauthorizedErrorBodyContract {
         errorCode: string;
     };
 }
+/**
+ * Body returned with HTTP 422 when gate runs with the `app_login_no_session_id`
+ * feature flag and the `appAuth` mint failed. `data.errorCode` is
+ * `app_auth_exchange_unavailable`.
+ *
+ * The credentials were accepted — only the handoff could not be issued. The
+ * status is 4xx and not 5xx on purpose: the generated SDK retries every 5xx
+ * three times with no method exclusion, and the register ops are not
+ * idempotent, so a retried mint failure would surface as 409
+ * `fusebase_account_already_exists` and this error would never reach the app.
+ * Start a fresh sign-in instead of replaying the call. Never returned without
+ * the flag: there `session` is still a working fallback and the response stays
+ * a 200.
+ */
+export interface FusebaseAuthAppAuthUnavailableErrorBodyContract {
+    success: false;
+    message: string;
+    data: {
+        code: string;
+        errorCode: string;
+    };
+}
 export interface FusebaseAuthLoginRequestContract {
     /**
      * User email. Forwarded to auth-form as `login`.
@@ -95,7 +160,17 @@ export interface FusebaseAuthLoginRequestContract {
 }
 export interface FusebaseAuthLoginResponseContract {
     status: "authenticated" | "challenge_required";
+    /**
+     * Deprecated. A raw FuseBase session id, which an app has no business
+     * holding: it is the FuseBase login itself, not an app-scoped credential.
+     * Gate stops returning it when it runs with the `app_login_no_session_id`
+     * feature flag (NIM-43689). Use `appAuth` instead.
+     *
+     * @deprecated Use `appAuth`.
+     */
     session?: FusebaseAuthSessionContract;
+    /** Present on an authenticated result, unless the mint failed. */
+    appAuth?: FusebaseAuthAppAuthContract;
     challenge?: FusebaseAuthChallengeContract;
     redirectPath: string;
 }
@@ -106,7 +181,17 @@ export interface FusebaseAuthChallengeRequestContract {
 }
 export interface FusebaseAuthChallengeResponseContract {
     status: "authenticated" | "challenge_required";
+    /**
+     * Deprecated. A raw FuseBase session id, which an app has no business
+     * holding: it is the FuseBase login itself, not an app-scoped credential.
+     * Gate stops returning it when it runs with the `app_login_no_session_id`
+     * feature flag (NIM-43689). Use `appAuth` instead.
+     *
+     * @deprecated Use `appAuth`.
+     */
     session?: FusebaseAuthSessionContract;
+    /** Present on an authenticated result, unless the mint failed. */
+    appAuth?: FusebaseAuthAppAuthContract;
     challenge?: FusebaseAuthChallengeContract;
     redirectPath: string;
 }

package/dist/types/index.d.ts

@@ -12,7 +12,7 @@ export type { ActivateAppMagicLinkResponseContract, AppMagicLinkSummaryContract,
 export * from "./billing/billing";
 export type { OrgEmailSendRequestContract, OrgEmailSendResponseContract } from "./email/email";
 export * from "./file/file";
-export type { FusebaseAuthChallengeContract, FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthConflictErrorBodyContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthRestoreKeyRequestContract, FusebaseAuthRestoreKeyResponseContract, FusebaseAuthSessionContract, FusebaseAuthSetInitialPasswordRequestContract, FusebaseAuthSetInitialPasswordResponseContract, FusebaseAuthUnauthorizedErrorBodyContract } from "./fusebase-auth/fusebase-auth";
+export type { FusebaseAuthAppAuthContract, FusebaseAuthAppAuthUnavailableErrorBodyContract, FusebaseAuthChallengeContract, FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthConflictErrorBodyContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthRestoreKeyRequestContract, FusebaseAuthRestoreKeyResponseContract, FusebaseAuthSessionContract, FusebaseAuthSetInitialPasswordRequestContract, FusebaseAuthSetInitialPasswordResponseContract, FusebaseAuthUnauthorizedErrorBodyContract } from "./fusebase-auth/fusebase-auth";
 export * from "./isolated-store/isolated-store";
 export * from "./mcp-manager/mcp-manager";
 export type { MeAuthContract, MeOrgGroupContract, MePreferencesContract, MeResponseContract, MeScopeContract, MeUserContract } from "./me/me";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusebase/fusebase-gate-sdk",
-  "version": "2.11.5",
+  "version": "2.11.6",
   "description": "TypeScript SDK for Fusebase Gate APIs - Generated from contract introspection",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/release-notes/2.11.6-sdk.0.md

@@ -0,0 +1,61 @@
+# Release Notes 2.11.6-sdk.0
+
+- Current ref: `HEAD`
+- Previous tag: `v2.11.6-sdk.0`
+- Generated at: 2026-09-08T12:29:57.106Z
+
+## Included Drafts
+
+- `docs/release-notes/2026-09-07-app-auth-handoff.md` - Login handoff for the fusebase-auth ops
+
+## Summary
+
+### Login handoff for the fusebase-auth ops
+
+The four fusebase-auth operations that can end in an authenticated result now
+return an `appAuth` handoff beside `session`, so an app can obtain its own
+runtime token without holding a raw FuseBase session id.
+
+
+## API / SDK Changes
+
+### Login handoff for the fusebase-auth ops
+
+- Added `appAuth` (`exchangeToken`, `expiresInSeconds`, `authPath`) to the
+  authenticated responses of `registerFusebaseUser`,
+  `registerFusebaseOrgMember`, `loginFusebaseUser` and
+  `completeFusebaseAuthChallenge`.
+- `authPath` is a relative URL on the app's own host, built from the
+  `redirectPath` the app sent. Apps pass it through rather than assembling it.
+- Operation descriptions now point at the handoff instead of at
+  `session.sessionId`.
+- `session` is deprecated. Gate omits it from all four responses when it runs
+  with the `app_login_no_session_id` feature flag, which is off everywhere
+  until deployed apps have moved to `appAuth`.
+- With that flag on, a failed handoff mint answers 422 with `data.errorCode` =
+  `app_auth_exchange_unavailable` instead of degrading to the legacy response.
+
+
+## Consumer Impact
+
+### Login handoff for the fusebase-auth ops
+
+Purely additive: `session` is returned exactly as before, so no deployed app
+changes behaviour. Spend `appAuth.authPath` on the app's own origin, either
+with a same-origin `fetch` sending `Accept: application/json` or with a plain
+navigation. `exchangeToken` stays valid for its whole `expiresInSeconds`
+window, is not invalidated by being spent, and is not bound to the app it was
+minted for, so treat it as a credential.
+A challenge result is unchanged. If the mint fails the response is the legacy
+one, without `appAuth` — until the `app_login_no_session_id` flag is turned on,
+where the same failure is a 422 that should be answered with a fresh sign-in
+rather than a replay of the call.
+
+
+## Verification
+
+### Login handoff for the fusebase-auth ops
+
+- Unit tests over all four operations, the handoff URL encoding, the mint
+  failure paths and the relative-path guard.
+- Generated contract/OpenAPI validation and service build.

package/release-notes/2.11.6.md

@@ -0,0 +1,9 @@
+# Release Notes 2.11.6
+
+- Current ref: `HEAD`
+- Previous tag: `v2.11.6`
+- Generated at: 2026-09-09T09:28:57.596Z
+
+## Included Drafts
+
+- None

package/release-notes/latest.md

@@ -1,8 +1,8 @@
-# Release Notes 2.11.5
+# Release Notes 2.11.6
 
 - Current ref: `HEAD`
-- Previous tag: `v2.11.5`
-- Generated at: 2026-09-04T07:08:20.261Z
+- Previous tag: `v2.11.6`
+- Generated at: 2026-09-09T09:28:57.596Z
 
 ## Included Drafts
 

package/release-notes/2.11.3.md

@@ -1,116 +0,0 @@
-# Release Notes 2.11.3
-
-- Current ref: `HEAD`
-- Previous tag: `v2.11.3`
-- Generated at: 2026-09-03T11:31:56.879Z
-
-## Included Drafts
-
-- `docs/release-notes/2026-09-02-portal-style-colors-font.md` - Portal branding: color roles and web font (NIM-42204)
-- `docs/release-notes/2026-09-03-firecrawl-proxy-forwarding.md` - Firecrawl proxy settings forwarding
-
-## Summary
-
-### Portal branding: color roles and web font (NIM-42204)
-
-`updatePortalStyle` now also takes `colors` and `font`, the two field groups the
-first round left out. Colors are expressed the way the portal actually renders
-them — as **Tailwind palette tokens** written into the theme's own color slots,
-not as hex. The font is delivered through the portal's custom code, since the
-theme model has no font field.
-
-### Firecrawl proxy settings forwarding
-
-Fusebase Gate now exposes the organization-scoped Paperclip Services routes
-needed to read and update Firecrawl proxy settings.
-
-
-## API / SDK Changes
-
-### Portal branding: color roles and web font (NIM-42204)
-
-- `updatePortalStyle` body gained:
-  - `colors` — five semantic roles, each one palette token (`transparent`,
-    `white`, `black` or `<hue>-<shade>`, e.g. `indigo-600`):
-
-    | Role | Theme slots written |
-    | --- | --- |
-    | `primary` | `bg_primary`, `bg_primary_hover`, `primary` |
-    | `background` | `bg_body` |
-    | `surface` | `bg_surface` |
-    | `text` | `text_surface` |
-    | `accent` | `bg_secondary`, `bg_secondary_hover` |
-
-  - `font` — `{ family, source: "google" }`. The family is spelled as Google
-    Fonts spells it; letters, digits and spaces only.
-- `getPortal` → `style` gained `colors` (the roles the portal overrides) and
-  `fontFamily`.
-- A body touching both the theme fields and `font` stages **two** events (one
-  `updateThemeSettings`, one `updateCustomCodeSettings`); `seq` is the first.
-- The error for an empty body is now
-  `At least one of theme, colors, font, logo, or favicon is required`.
-
-### Firecrawl proxy settings forwarding
-
-- Added `GET /:orgId/paperclip-services/installations/:appKey/proxy`.
-- Added `PUT /:orgId/paperclip-services/installations/:appKey/proxy`.
-- Added typed redacted settings and write-only configuration contracts for
-  direct, custom gateway, uploaded list, and HTTPS list/API modes.
-- Added `firecrawlProxyManagement` to the Paperclip Services capabilities
-  contract.
-- The `paperclip-services` tag remains excluded from the public SDK surface.
-
-
-## Consumer Impact
-
-### Portal branding: color roles and web font (NIM-42204)
-
-An agent can now recolor a portal past the 13 named themes without writing
-custom CSS, and the recolor works on any domain.
-
-**Hex is still rejected, on purpose.** The renderer interpolates the stored
-token straight into a class name (`bg-neutral-900`), and
-`apps/portals/tailwind.config.js` safelists palette names only, so `#2563eb`
-would be stored, published, and style nothing. `stone` and `violet` are rejected
-for the same reason: they are missing from that safelist. Convert a hex to the
-nearest token before calling.
-
-**Where the font lives.** The theme DTO has no font field, so `font` stages one
-marked `<style>` block inside the portal's `customStyle`:
-
-```html
-<!--fusebase-font--><style>@import url("https://fonts.googleapis.com/css2?family=Fraunces&display=swap");#main-scrolling-container{font-family:'Fraunces',sans-serif}</style><!--/fusebase-font-->
-```
-
-The markers make it replaceable: a second `font` call swaps the block rather
-than appending one, and `updatePortalCustomCode` carries it through when the
-agent rewrites the surrounding CSS. Because it is custom code, it renders
-wherever custom code renders — the customizer only offers the custom-code editor
-on portals served from a custom CNAME domain.
-
-**Hover slots take the same token as their base.** No shade is derived, so a
-recolored hover never lands on an unrelated preset color. An agent that wants a
-distinct hover uses `updatePortalCustomCode`.
-
-### Firecrawl proxy settings forwarding
-
-Deployed Paperclip instances can open and save Firecrawl proxy settings through
-Fusebase Gate. Reads require `paperclip_services.read`; updates require
-`paperclip_services.write`. Credentials and proxy-list contents are forwarded
-only in the request body and are not included in responses.
-
-
-## Verification
-
-### Firecrawl proxy settings forwarding
-
-- Paperclip Services route authorization tests.
-- Nimbus AI client forwarding tests for GET and PUT.
-- Generated contract/OpenAPI validation and service build.
-
-
-## Follow-ups
-
-### Firecrawl proxy settings forwarding
-
-- Verify the dev Gate rollout before running Firecrawl proxy acceptance tests.

package/release-notes/2.11.5.md

@@ -1,9 +0,0 @@
-# Release Notes 2.11.5
-
-- Current ref: `HEAD`
-- Previous tag: `v2.11.5`
-- Generated at: 2026-09-04T07:08:20.261Z
-
-## Included Drafts
-
-- None