@fusebase/fusebase-gate-sdk 2.3.34-sdk.3 → 2.3.34-sdk.4

package/dist/apis/AppMagicLinksApi.d.ts

@@ -5,7 +5,7 @@
  * Domain: app-magic-links
  */
 import type { Client } from "../runtime/transport";
-import type { ActivateAppMagicLinkResponseContract, BulkCreateAppMagicLinksRequestContract, BulkCreateAppMagicLinksResponseContract, CreateAppMagicLinkRequestContract, CreateAppMagicLinkResponseContract, ListAppMagicLinksResponseContract, orgIdInPathRequired, RequestAppMagicLinkRequestContract, RequestAppMagicLinkResponseContract, RevokeAppMagicLinkResponseContract } from "../types";
+import type { ActivateAppMagicLinkResponseContract, BulkCreateAppMagicLinksRequestContract, BulkCreateAppMagicLinksResponseContract, CreateAppMagicLinkRequestContract, CreateAppMagicLinkResponseContract, ListAppMagicLinksResponseContract, orgIdInPathRequired, RemoveAppAccessPrincipalRequestContract, RemoveAppAccessPrincipalResponseContract, RequestAppMagicLinkRequestContract, RequestAppMagicLinkResponseContract, RevokeAppMagicLinkResponseContract } from "../types";
 export declare class AppMagicLinksApi {
     private client;
     constructor(client: Client);
@@ -57,6 +57,18 @@ export declare class AppMagicLinksApi {
         };
         headers?: Record<string, string>;
     }): Promise<ListAppMagicLinksResponseContract>;
+    /**
+     * Remove an app access principal
+     * Owner/admin flow. Removes an access principal from every feature (App) of the product — the symmetric inverse of the invite grant that appends a principal to every feature. appId is the Product id. Idempotent: removing a principal that is not present returns removed=false. Returns 404 when the product has no apps. Requires app_magic_link.write and org access.
+     */
+    removeAppAccessPrincipal(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            appId: string;
+        };
+        headers?: Record<string, string>;
+        body: RemoveAppAccessPrincipalRequestContract;
+    }): Promise<RemoveAppAccessPrincipalResponseContract>;
     /**
      * Request an app magic link (visitor self-service flow)
      * Unauthenticated visitor flow. The link is dispatched only when the email already has access to the app under its current accessPrincipals; otherwise the call is a no-op. Always returns 200 with `{ ok: true }` so the response cannot be used to enumerate emails or access. Apply per-IP rate limiting upstream of this call.
@@ -68,6 +80,18 @@ export declare class AppMagicLinksApi {
         headers?: Record<string, string>;
         body: RequestAppMagicLinkRequestContract;
     }): Promise<RequestAppMagicLinkResponseContract>;
+    /**
+     * Create an app magic link without sending the platform email
+     * No-email sibling of createAppMagicLink. Same input/output and side effects (user provisioning, principal + org-member grants), but the platform does NOT send the magic_link_app email — the response carries magicLinkUrl so a white-label app can deliver its own branded email. Requires app_magic_link.write and org access. appId is the Product id.
+     */
+    requestAppMagicLinkURL(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            appId: string;
+        };
+        headers?: Record<string, string>;
+        body: CreateAppMagicLinkRequestContract;
+    }): Promise<CreateAppMagicLinkResponseContract>;
     /**
      * Revoke an app magic link
      * Owner/admin revoke flow. Soft-deletes the magic link identified by globalId so it can no longer be activated (activation then returns 404) and the recipient email can be invited again — the fix for orphaned invites that block re-invites for 24h. Returns 404 when the link does not exist under the org/app on the path or is already revoked. Requires app_magic_link.write and org access. appId is the Product id.

package/dist/apis/AppMagicLinksApi.js

@@ -70,6 +70,21 @@ class AppMagicLinksApi {
             expectedContentType: "application/json",
         });
     }
+    /**
+     * Remove an app access principal
+     * Owner/admin flow. Removes an access principal from every feature (App) of the product — the symmetric inverse of the invite grant that appends a principal to every feature. appId is the Product id. Idempotent: removing a principal that is not present returns removed=false. Returns 404 when the product has no apps. Requires app_magic_link.write and org access.
+     */
+    async removeAppAccessPrincipal(params) {
+        return this.client.request({
+            method: "POST",
+            path: "/:orgId/apps/:appId/access-principals/remove",
+            pathParams: params.path,
+            headers: params.headers,
+            body: params.body,
+            opId: "removeAppAccessPrincipal",
+            expectedContentType: "application/json",
+        });
+    }
     /**
      * Request an app magic link (visitor self-service flow)
      * Unauthenticated visitor flow. The link is dispatched only when the email already has access to the app under its current accessPrincipals; otherwise the call is a no-op. Always returns 200 with `{ ok: true }` so the response cannot be used to enumerate emails or access. Apply per-IP rate limiting upstream of this call.
@@ -85,6 +100,21 @@ class AppMagicLinksApi {
             expectedContentType: "application/json",
         });
     }
+    /**
+     * Create an app magic link without sending the platform email
+     * No-email sibling of createAppMagicLink. Same input/output and side effects (user provisioning, principal + org-member grants), but the platform does NOT send the magic_link_app email — the response carries magicLinkUrl so a white-label app can deliver its own branded email. Requires app_magic_link.write and org access. appId is the Product id.
+     */
+    async requestAppMagicLinkURL(params) {
+        return this.client.request({
+            method: "POST",
+            path: "/:orgId/apps/:appId/magic-link-url",
+            pathParams: params.path,
+            headers: params.headers,
+            body: params.body,
+            opId: "requestAppMagicLinkURL",
+            expectedContentType: "application/json",
+        });
+    }
     /**
      * Revoke an app magic link
      * Owner/admin revoke flow. Soft-deletes the magic link identified by globalId so it can no longer be activated (activation then returns 404) and the recipient email can be invited again — the fix for orphaned invites that block re-invites for 24h. Returns 404 when the link does not exist under the org/app on the path or is already revoked. Requires app_magic_link.write and org access. appId is the Product id.

package/dist/apis/FusebaseAuthApi.d.ts

@@ -5,7 +5,7 @@
  * Domain: fusebase-auth
  */
 import type { Client } from "../runtime/transport";
-import type { FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, orgIdInPathRequired } from "../types";
+import type { FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthRestoreKeyRequestContract, FusebaseAuthRestoreKeyResponseContract, orgIdInPathRequired } from "../types";
 export declare class FusebaseAuthApi {
     private client;
     constructor(client: Client);
@@ -63,12 +63,23 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthRegisterResponseContract>;
     /**
      * Request Fusebase password restore
-     * Visitor-safe password restore request. Forwards to auth-form `/auth/api/remind` and always returns a generic success shape so the route does not enumerate accounts.
+     * Visitor-safe password restore request. Forwards to auth-form `/auth/api/remind` and always returns a generic success shape so the route does not enumerate accounts. The email link is `${customAuthUrl}/resetpass?key=<key>` (platform appends `/resetpass` and puts the key in query param `key`). When both `portalId` and `workspaceId` are set, user-service applies portal white-label branding (overrides `customAuthUrl` to the portal domain and uses the `restore_portal_password` template).
      */
     requestFusebasePasswordRestore(params: {
         headers?: Record<string, string>;
         body: FusebaseAuthPasswordRestoreRequestContract;
     }): Promise<FusebaseAuthPasswordRestoreResponseContract>;
+    /**
+     * Mint a Fusebase password-restore key (no email)
+     * Protected white-label flow. Creates a password-restore session for the email through user-service WITHOUT sending the platform email, and returns the raw key so a trusted AI App backend can send its own branded reset mail. The key passes `checkFusebasePasswordRestoreKey` / `resetFusebasePassword` with the same TTL and one-time-use as the email flow. `resetUrl` is `${customAuthUrl}/resetpass?key=<key>` when `customAuthUrl` is provided. Requires `auth.restore_key.write` and org access (same trust level as `registerFusebaseOrgMember`/`addOrgUser`); visitor/anonymous callers get 403. A key resets the target's GLOBAL FuseBase password, so it is only minted when the path `orgId` is the user's ONLY organization — a user with any footprint elsewhere (another org, or a private org from self-registration) is an independent account the app must not hijack, even if it was just added to this org. Otherwise 404 (also for unknown emails, so it does not leak global account existence). Unlike `requestFusebasePasswordRestore` this is NOT visitor-safe — it exposes the key.
+     */
+    requestFusebaseRestoreKey(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: FusebaseAuthRestoreKeyRequestContract;
+    }): Promise<FusebaseAuthRestoreKeyResponseContract>;
     /**
      * Reset Fusebase password
      * Completes a password restore session by setting a new password through user-service.

package/dist/apis/FusebaseAuthApi.js

@@ -97,7 +97,7 @@ class FusebaseAuthApi {
     }
     /**
      * Request Fusebase password restore
-     * Visitor-safe password restore request. Forwards to auth-form `/auth/api/remind` and always returns a generic success shape so the route does not enumerate accounts.
+     * Visitor-safe password restore request. Forwards to auth-form `/auth/api/remind` and always returns a generic success shape so the route does not enumerate accounts. The email link is `${customAuthUrl}/resetpass?key=<key>` (platform appends `/resetpass` and puts the key in query param `key`). When both `portalId` and `workspaceId` are set, user-service applies portal white-label branding (overrides `customAuthUrl` to the portal domain and uses the `restore_portal_password` template).
      */
     async requestFusebasePasswordRestore(params) {
         return this.client.request({
@@ -109,6 +109,21 @@ class FusebaseAuthApi {
             expectedContentType: "application/json",
         });
     }
+    /**
+     * Mint a Fusebase password-restore key (no email)
+     * Protected white-label flow. Creates a password-restore session for the email through user-service WITHOUT sending the platform email, and returns the raw key so a trusted AI App backend can send its own branded reset mail. The key passes `checkFusebasePasswordRestoreKey` / `resetFusebasePassword` with the same TTL and one-time-use as the email flow. `resetUrl` is `${customAuthUrl}/resetpass?key=<key>` when `customAuthUrl` is provided. Requires `auth.restore_key.write` and org access (same trust level as `registerFusebaseOrgMember`/`addOrgUser`); visitor/anonymous callers get 403. A key resets the target's GLOBAL FuseBase password, so it is only minted when the path `orgId` is the user's ONLY organization — a user with any footprint elsewhere (another org, or a private org from self-registration) is an independent account the app must not hijack, even if it was just added to this org. Otherwise 404 (also for unknown emails, so it does not leak global account existence). Unlike `requestFusebasePasswordRestore` this is NOT visitor-safe — it exposes the key.
+     */
+    async requestFusebaseRestoreKey(params) {
+        return this.client.request({
+            method: "POST",
+            path: "/:orgId/auth/fusebase/restore-key",
+            pathParams: params.path,
+            headers: params.headers,
+            body: params.body,
+            opId: "requestFusebaseRestoreKey",
+            expectedContentType: "application/json",
+        });
+    }
     /**
      * Reset Fusebase password
      * Completes a password restore session by setting a new password through user-service.

package/dist/types/app-access-principal/app-access-principal.d.ts

@@ -0,0 +1,28 @@
+/**
+ * An access principal on an AI App's features. Mirrors nimbus-ai's
+ * `AppAccessPrincipal` (`type` + `id`). `id` is required for
+ * user/orgRole/orgGroup and optional (ignored) for visitor.
+ */
+export interface AppAccessPrincipalContract {
+    type: "user" | "orgRole" | "orgGroup" | "visitor";
+    /**
+     * Principal id: the user id, org role name, or org group id. Optional for
+     * visitor.
+     * @nullable true
+     */
+    id?: string | null;
+}
+/**
+ * Request body for removeAppAccessPrincipal. The principal to strip from every
+ * feature (App) of the product.
+ */
+export type RemoveAppAccessPrincipalRequestContract = AppAccessPrincipalContract;
+/**
+ * Response body for removeAppAccessPrincipal.
+ */
+export interface RemoveAppAccessPrincipalResponseContract {
+    /** True when the principal was present on at least one App and removed. */
+    removed: boolean;
+    /** Number of Apps (features) the principal was removed from. */
+    appsAffected: number;
+}

package/dist/types/app-access-principal/app-access-principal.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/types/app-magic-link/app-magic-link.d.ts

@@ -19,6 +19,22 @@ export interface CreateAppMagicLinkRequestContract {
      * When false, the user must already exist or the call rejects with NotFound.
      */
     addToAccessPrincipals?: boolean;
+    /**
+     * Opaque app payload (not interpreted by the platform) stored on the link and
+     * echoed back byte-for-byte at activation. Use it to bind the link to an
+     * app-side entity (e.g. an invitation id) instead of overloading redirectPath.
+     * @maxLength 4096
+     * @nullable true
+     */
+    meta?: string | null;
+    /**
+     * Optional child App (feature) globalId the link should target, so a
+     * multi-app product can route sign-in per app. The email URL and activation
+     * tokens are scoped to this App's host. Omit to fall back to the product's
+     * first App (no behavior change).
+     * @nullable true
+     */
+    appFeatureId?: string | null;
 }
 /**
  * Response body for createAppMagicLink.
@@ -121,6 +137,12 @@ export interface ActivateAppMagicLinkResponseContract {
      * globalId of the resolved app feature whose access the tokens are scoped to.
      */
     appFeatureId: string;
+    /**
+     * Opaque app payload supplied when the link was created, echoed back
+     * byte-for-byte. Null for links created without `meta` (backward compatible).
+     * @nullable true
+     */
+    meta?: string | null;
 }
 /**
  * Response body for revokeAppMagicLink.
@@ -174,6 +196,11 @@ export interface AppMagicLinkSummaryContract {
     usedAt?: number | null;
     /** Unix timestamp (seconds) when the link was created. */
     createdAt: number;
+    /**
+     * Opaque app payload stored on the link, or null when none was supplied.
+     * @nullable true
+     */
+    meta?: string | null;
 }
 /**
  * Response body for listAppMagicLinks (support/debug).
@@ -201,6 +228,20 @@ export interface BulkAppMagicLinkInvitationContract {
      * When false, the user must already exist or the invite fails with NotFound.
      */
     addToAccessPrincipals?: boolean;
+    /**
+     * Opaque app payload (not interpreted by the platform) stored on the link and
+     * echoed back byte-for-byte at activation.
+     * @maxLength 4096
+     * @nullable true
+     */
+    meta?: string | null;
+    /**
+     * Optional child App (feature) globalId the link should target, so a
+     * multi-app product can route sign-in per app. Omit to fall back to the
+     * product's first App (no behavior change).
+     * @nullable true
+     */
+    appFeatureId?: string | null;
 }
 export interface BulkCreateAppMagicLinksRequestContract {
     /** Users to invite to the app in a single call. */

package/dist/types/email/email.d.ts

@@ -1,5 +1,10 @@
 export interface OrgEmailSendRequestContract {
     subject: string;
+    /**
+     * Email body as HTML or plain text. Bare URLs are auto-linked and the
+     * content is sanitized before delivery. Sent through the unbranded app
+     * layout with a noreply sender — no FuseBase logo, footer, or branding.
+     */
     body: string;
     /**
      * Recipient user id or email.
@@ -8,16 +13,6 @@ export interface OrgEmailSendRequestContract {
      * The resolved user must already belong to the organization.
      */
     recipient: string;
-    /**
-     * Optional variables that the mail rendering layer may use.
-     * Currently accepted for forward compatibility and not yet applied during sending.
-     */
-    variables?: Record<string, string>;
-    /**
-     * Optional link variables that the mail rendering layer may use.
-     * Currently accepted for forward compatibility and not yet applied during sending.
-     */
-    links?: Record<string, string>;
 }
 export interface OrgEmailSendResponseContract {
     requestId: string;

package/dist/types/fusebase-auth/fusebase-auth.d.ts

@@ -101,13 +101,44 @@ export interface FusebaseAuthPasswordRestoreRequestContract {
      * @format email
      */
     email: string;
+    /**
+     * Base URL of the app's own reset page. The platform appends `/resetpass` and
+     * puts the restore key in query param `key`, so the email link is
+     * `${customAuthUrl}/resetpass?key=<key>`. Omit to use the default Fusebase host.
+     */
     customAuthUrl?: string;
+    /**
+     * Portal white-label branding. When BOTH `portalId` and `workspaceId` are set,
+     * user-service switches to portal branding: it overrides `customAuthUrl` with
+     * the portal domain, uses the portal name, and sends the `restore_portal_password`
+     * template instead of the default one.
+     */
     portalId?: string;
     workspaceId?: string;
 }
 export interface FusebaseAuthPasswordRestoreResponseContract {
     ok: true;
 }
+export interface FusebaseAuthRestoreKeyRequestContract {
+    /**
+     * User email whose password-restore key to mint.
+     * @format email
+     */
+    email: string;
+    /**
+     * Base URL of the app's own reset page. When present the response `resetUrl` is
+     * `${customAuthUrl}/resetpass?key=<key>` (same format as the platform email link).
+     */
+    customAuthUrl?: string;
+}
+export interface FusebaseAuthRestoreKeyResponseContract {
+    /** Raw restore key. Passes `checkFusebasePasswordRestoreKey` / `resetFusebasePassword`. */
+    key: string;
+    /** Ready-to-use reset link, present only when `customAuthUrl` was provided. */
+    resetUrl?: string;
+    /** Session expiry as a Unix epoch in milliseconds. */
+    expiresAt: number;
+}
 export interface FusebaseAuthPasswordRestoreKeyResponseContract {
     valid: boolean;
 }

package/dist/types/index.d.ts

@@ -5,13 +5,14 @@
  * Generated by SDK codegen
  */
 export type { AuthenticatedUserSummaryContract, MyOrgAccessResponseContract } from "./access/access";
+export type { AppAccessPrincipalContract, RemoveAppAccessPrincipalRequestContract, RemoveAppAccessPrincipalResponseContract } from "./app-access-principal/app-access-principal";
 export type { AppApiOperationContract, AppApiOperationListResponseContract, CallAppApiRequestContract, CallAppApiResponseContract, PublishedAppContract, PublishedAppListResponseContract, VerifyAppApiContractsRequestContract, VerifyAppApiContractsResponseContract, VerifyCaseResultContract } from "./app-api/app-api";
 export type { AppPortalEmbedContract, ListAppPortalEmbedsResponseContract } from "./app-embed-targets/app-embed-targets";
 export type { ActivateAppMagicLinkResponseContract, AppMagicLinkSummaryContract, BulkAppMagicLinkInvitationContract, BulkAppMagicLinkResultItemContract, BulkCreateAppMagicLinksRequestContract, BulkCreateAppMagicLinksResponseContract, CreateAppClientInviteRequestContract, CreateAppMagicLinkRequestContract, CreateAppMagicLinkResponseContract, ListAppMagicLinksResponseContract, RequestAppMagicLinkRequestContract, RequestAppMagicLinkResponseContract, RevokeAppMagicLinkResponseContract } from "./app-magic-link/app-magic-link";
 export * from "./billing/billing";
 export type { OrgEmailSendRequestContract, OrgEmailSendResponseContract } from "./email/email";
 export * from "./file/file";
-export type { FusebaseAuthChallengeContract, FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthConflictErrorBodyContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthSessionContract } from "./fusebase-auth/fusebase-auth";
+export type { FusebaseAuthChallengeContract, FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthConflictErrorBodyContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthRestoreKeyRequestContract, FusebaseAuthRestoreKeyResponseContract, FusebaseAuthSessionContract } from "./fusebase-auth/fusebase-auth";
 export * from "./isolated-store/isolated-store";
 export * from "./mcp-manager/mcp-manager";
 export type { MeAuthContract, MeOrgGroupContract, MePreferencesContract, MeResponseContract, MeScopeContract, MeUserContract } from "./me/me";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusebase/fusebase-gate-sdk",
-  "version": "2.3.34-sdk.3",
+  "version": "2.3.34-sdk.4",
   "description": "TypeScript SDK for Fusebase Gate APIs - Generated from contract introspection",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/release-notes/2.3.34-sdk.3.md

@@ -1,8 +1,8 @@
 # Release Notes 2.3.34-sdk.3
 
 - Current ref: `HEAD`
-- Previous tag: `v2.3.34-sdk.3`
-- Generated at: 2026-07-21T14:27:05.038Z
+- Previous tag: `v2.3.34-sdk.2`
+- Generated at: 2026-07-21T14:24:27.829Z
 
 ## Included Drafts
 

package/release-notes/2.3.34-sdk.4.md

@@ -0,0 +1,82 @@
+# Release Notes 2.3.34-sdk.4
+
+- Current ref: `HEAD`
+- Previous tag: `v2.3.28-sdk.3`
+- Generated at: 2026-07-23T05:48:58.238Z
+
+## Included Drafts
+
+- `docs/release-notes/2026-07-02-markdown-notes-crud.md` - Markdown (v3) notes CRUD
+- `docs/release-notes/2026-07-13-getme-no-health-read.md` - getMe no longer requires health.read
+
+## Summary
+
+### Markdown (v3) notes CRUD
+
+Add Gate contracts, controllers, and MCP-visible operations for v3 markdown notes: create, read, replace, and append markdown stored as the source of truth in note-service (no editor-service involved). Part of Notes v3 Iteration 1 (NIM-42034, NIM-42042).
+
+### getMe no longer requires health.read
+
+`GET /me` (`getMe`) no longer declares a required Gate permission. Any authenticated **user** or **token** subject may call it with a valid session, without `health.read` in the grant.
+
+
+## API / SDK Changes
+
+### Markdown (v3) notes CRUD
+
+- Added `createWorkspaceMarkdownNote` (`POST /:orgId/workspaces/:workspaceId/markdown-notes`).
+- Added `getWorkspaceMarkdownNote` (`GET .../markdown-notes/:noteId`) returning the markdown source of truth plus `revision`.
+- Added `updateWorkspaceMarkdownNoteContent` (`PUT .../markdown-notes/:noteId/content`) replacing the full markdown document with a required optimistic `revision` lock.
+- Added `appendWorkspaceMarkdownNoteContent` (`POST .../markdown-notes/:noteId/content/append`) with an optional `revision` lock.
+- Stale-revision writes return HTTP 409 with `data.errorCode = markdown_note_revision_conflict` and `data.currentRevision`.
+- Regenerated SDK/OpenAPI artifacts include the new Notes API methods and contracts.
+
+
+## Consumer Impact
+
+### Markdown (v3) notes CRUD
+
+AI/MCP callers can manage markdown-native (v3) notes end-to-end without HTML conversion. Classic (v2) notes are untouched and keep using the existing notes operations. The operations depend on the note-service markdown API (NIM-42040/NIM-42041); until note-service ships it, calls fail upstream.
+
+
+## Verification
+
+### Markdown (v3) notes CRUD
+
+- `npm run build`
+- `npm run build:sdk`
+- `npm run mcp:skills:generate`
+- `npm run mcp:skills:validate`
+- `npm test` (unit suites for the new controller, client, and contracts)
+
+### getMe no longer requires health.read
+
+- `npm run test:unit -- tests/unit/authz-op-registry-bridge.test.ts`
+- `npm run build`
+
+
+## Follow-ups
+
+### Markdown (v3) notes CRUD
+
+- Switch the plain-HTTP note-service markdown client to the generated `@internal/note-service` SDK once note-service publishes the markdown endpoints.
+- Add e2e-sdk/mcp-e2e coverage once the note-service contract is live (fake-note-service markdown routes should mirror the real service).
+
+
+## Consumer impact
+
+### getMe no longer requires health.read
+
+- **Apps without `health.read` in the published grant** can call `getMe` again (service tokens, visitor browser tokens).
+- **Apps that already include `health.read`** are unchanged.
+- Do **not** remove `health.read` from grants solely because of this change — other ops may still require it.
+- Continue using `FBS_ORG_ID` / `getMyOrgAccess` for org resolution; do not rely on `getMe().auth.scopes` for visitor sessions.
+
+
+## Why
+
+### getMe no longer requires health.read
+
+- `getMe` is the primary identity introspection op for Fusebase Apps.
+- Requiring `health.read` caused production lockouts when app grants omitted it after `fusebase analyze gate` / `--sync-gate-permissions` (see issue `041-benchmarking-app`, escalation `2026-07-13-platform-gate-2.3.29-auth-breaking-changes.md`).
+- `resolveOperationPermissions` now reports `required_permission: null` for `getMe`, aligned with `getHealth`.

package/release-notes/latest.md

@@ -1,9 +1,82 @@
-# Release Notes 2.3.34-sdk.3
+# Release Notes 2.3.34-sdk.4
 
 - Current ref: `HEAD`
-- Previous tag: `v2.3.34-sdk.3`
-- Generated at: 2026-07-21T14:27:05.038Z
+- Previous tag: `v2.3.28-sdk.3`
+- Generated at: 2026-07-23T05:48:58.238Z
 
 ## Included Drafts
 
-- None
+- `docs/release-notes/2026-07-02-markdown-notes-crud.md` - Markdown (v3) notes CRUD
+- `docs/release-notes/2026-07-13-getme-no-health-read.md` - getMe no longer requires health.read
+
+## Summary
+
+### Markdown (v3) notes CRUD
+
+Add Gate contracts, controllers, and MCP-visible operations for v3 markdown notes: create, read, replace, and append markdown stored as the source of truth in note-service (no editor-service involved). Part of Notes v3 Iteration 1 (NIM-42034, NIM-42042).
+
+### getMe no longer requires health.read
+
+`GET /me` (`getMe`) no longer declares a required Gate permission. Any authenticated **user** or **token** subject may call it with a valid session, without `health.read` in the grant.
+
+
+## API / SDK Changes
+
+### Markdown (v3) notes CRUD
+
+- Added `createWorkspaceMarkdownNote` (`POST /:orgId/workspaces/:workspaceId/markdown-notes`).
+- Added `getWorkspaceMarkdownNote` (`GET .../markdown-notes/:noteId`) returning the markdown source of truth plus `revision`.
+- Added `updateWorkspaceMarkdownNoteContent` (`PUT .../markdown-notes/:noteId/content`) replacing the full markdown document with a required optimistic `revision` lock.
+- Added `appendWorkspaceMarkdownNoteContent` (`POST .../markdown-notes/:noteId/content/append`) with an optional `revision` lock.
+- Stale-revision writes return HTTP 409 with `data.errorCode = markdown_note_revision_conflict` and `data.currentRevision`.
+- Regenerated SDK/OpenAPI artifacts include the new Notes API methods and contracts.
+
+
+## Consumer Impact
+
+### Markdown (v3) notes CRUD
+
+AI/MCP callers can manage markdown-native (v3) notes end-to-end without HTML conversion. Classic (v2) notes are untouched and keep using the existing notes operations. The operations depend on the note-service markdown API (NIM-42040/NIM-42041); until note-service ships it, calls fail upstream.
+
+
+## Verification
+
+### Markdown (v3) notes CRUD
+
+- `npm run build`
+- `npm run build:sdk`
+- `npm run mcp:skills:generate`
+- `npm run mcp:skills:validate`
+- `npm test` (unit suites for the new controller, client, and contracts)
+
+### getMe no longer requires health.read
+
+- `npm run test:unit -- tests/unit/authz-op-registry-bridge.test.ts`
+- `npm run build`
+
+
+## Follow-ups
+
+### Markdown (v3) notes CRUD
+
+- Switch the plain-HTTP note-service markdown client to the generated `@internal/note-service` SDK once note-service publishes the markdown endpoints.
+- Add e2e-sdk/mcp-e2e coverage once the note-service contract is live (fake-note-service markdown routes should mirror the real service).
+
+
+## Consumer impact
+
+### getMe no longer requires health.read
+
+- **Apps without `health.read` in the published grant** can call `getMe` again (service tokens, visitor browser tokens).
+- **Apps that already include `health.read`** are unchanged.
+- Do **not** remove `health.read` from grants solely because of this change — other ops may still require it.
+- Continue using `FBS_ORG_ID` / `getMyOrgAccess` for org resolution; do not rely on `getMe().auth.scopes` for visitor sessions.
+
+
+## Why
+
+### getMe no longer requires health.read
+
+- `getMe` is the primary identity introspection op for Fusebase Apps.
+- Requiring `health.read` caused production lockouts when app grants omitted it after `fusebase analyze gate` / `--sync-gate-permissions` (see issue `041-benchmarking-app`, escalation `2026-07-13-platform-gate-2.3.29-auth-breaking-changes.md`).
+- `resolveOperationPermissions` now reports `required_permission: null` for `getMe`, aligned with `getHealth`.