@fusebase/fusebase-gate-sdk 2.3.34-sdk.4 → 2.3.34-sdk.9

package/dist/apis/AppApisApi.d.ts

@@ -11,7 +11,7 @@ export declare class AppApisApi {
     constructor(client: Client);
     /**
      * Call app API operation
-     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context.
+     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context. Pass `onBehalfOfUserToken` (a platform app token, i.e. the user's `fbsfeaturetoken`) to run the call on behalf of an end user: Gate verifies it fail-closed and forwards the resolved user to the runtime as `X-Fusebase-Verified-User-Id` / `X-Fusebase-Verified-User-Source: obo`, so apps no longer need to hand-roll dual-token forwarding. The operation's `allowedCallers` / `requiredPermissions` are still evaluated against the calling identity, not the on-behalf-of user.
      */
     callAppApi(params: {
         path: {

package/dist/apis/AppApisApi.js

@@ -13,7 +13,7 @@ class AppApisApi {
     }
     /**
      * Call app API operation
-     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context.
+     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context. Pass `onBehalfOfUserToken` (a platform app token, i.e. the user's `fbsfeaturetoken`) to run the call on behalf of an end user: Gate verifies it fail-closed and forwards the resolved user to the runtime as `X-Fusebase-Verified-User-Id` / `X-Fusebase-Verified-User-Source: obo`, so apps no longer need to hand-roll dual-token forwarding. The operation's `allowedCallers` / `requiredPermissions` are still evaluated against the calling identity, not the on-behalf-of user.
      */
     async callAppApi(params) {
         return this.client.request({

package/dist/apis/OrgUsersApi.d.ts

@@ -5,7 +5,7 @@
  * Domain: org-users
  */
 import type { Client } from "../runtime/transport";
-import type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, orgIdInPathRequired, OrgMemberRemoveResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "../types";
+import type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, orgIdInPathRequired, OrgMemberExpectedJoinedAfterInQueryOptional, OrgMemberExpectedRoleInQueryOptional, OrgMemberRemoveResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "../types";
 export declare class OrgUsersApi {
     private client;
     constructor(client: Client);
@@ -54,13 +54,17 @@ export declare class OrgUsersApi {
     }): Promise<OrgWorkspaceMemberListResponseContract>;
     /**
      * Remove organization member
-     * Removes an organization member by numeric userId. Gate resolves the internal orgMember.globalId before calling org-service, and org-service cleans up workspace/group memberships for that org. Requires org.members.write and org access.
+     * Removes an organization member by numeric userId. Gate resolves the internal orgMember.globalId before calling org-service, and org-service cleans up workspace/group memberships for that org. Optional query preconditions make the removal conditional instead of unconditional: `expectedRole` requires the member to still hold that org role, and `expectedJoinedAfter` (unix seconds) requires the membership to have been created at or after that moment — use it when cancelling an invite so a pre-existing member is never dropped. Either mismatch fails with 409 and removes nothing; a precondition sent with an empty or unparsable value fails with 400 rather than degrading into an unconditional removal. Requires org.members.write and org access.
      */
     removeOrgMember(params: {
         path: {
             orgId: orgIdInPathRequired;
             userId: OrgUserIdInPathRequired;
         };
+        query?: {
+            expectedRole?: OrgMemberExpectedRoleInQueryOptional;
+            expectedJoinedAfter?: OrgMemberExpectedJoinedAfterInQueryOptional;
+        };
         headers?: Record<string, string>;
     }): Promise<OrgMemberRemoveResponseContract>;
     /**

package/dist/apis/OrgUsersApi.js

@@ -70,13 +70,14 @@ class OrgUsersApi {
     }
     /**
      * Remove organization member
-     * Removes an organization member by numeric userId. Gate resolves the internal orgMember.globalId before calling org-service, and org-service cleans up workspace/group memberships for that org. Requires org.members.write and org access.
+     * Removes an organization member by numeric userId. Gate resolves the internal orgMember.globalId before calling org-service, and org-service cleans up workspace/group memberships for that org. Optional query preconditions make the removal conditional instead of unconditional: `expectedRole` requires the member to still hold that org role, and `expectedJoinedAfter` (unix seconds) requires the membership to have been created at or after that moment — use it when cancelling an invite so a pre-existing member is never dropped. Either mismatch fails with 409 and removes nothing; a precondition sent with an empty or unparsable value fails with 400 rather than degrading into an unconditional removal. Requires org.members.write and org access.
      */
     async removeOrgMember(params) {
         return this.client.request({
             method: "DELETE",
             path: "/:orgId/users/:userId",
             pathParams: params.path,
+            query: params.query,
             headers: params.headers,
             opId: "removeOrgMember",
             expectedContentType: "application/json",

package/dist/types/app-api/app-api.d.ts

@@ -37,6 +37,13 @@ export interface CallAppApiRequestContract {
     path?: Record<string, string>;
     query?: Record<string, string | number | boolean>;
     body?: unknown;
+    /**
+     * On-behalf-of: a platform app token (`fbsfeaturetoken` / `x-app-feature-token`)
+     * identifying the end user this call runs for. Gate verifies it fail-closed and
+     * forwards the resolved user to the runtime as `X-Fusebase-Verified-User-*`
+     * headers; the calling identity still governs the operation's access policy.
+     */
+    onBehalfOfUserToken?: string;
 }
 export interface CallAppApiResponseContract {
     ok: boolean;

package/dist/types/app-magic-link/app-magic-link.d.ts

@@ -19,6 +19,18 @@ export interface CreateAppMagicLinkRequestContract {
      * When false, the user must already exist or the call rejects with NotFound.
      */
     addToAccessPrincipals?: boolean;
+    /**
+     * Optional link lifetime in seconds. Omit for the 24h (86400) default.
+     * A provided value is clamped server-side to the 3600 (1h)..604800 (7d)
+     * range rather than rejected, so a slightly out-of-range value still yields
+     * a usable link.
+     * `0` or a negative value is NOT "no expiry" and does NOT expire the link
+     * immediately — it clamps UP to the 3600 (1h) minimum, so 1h is the
+     * shortest lifetime you can create.
+     * Whole seconds: a fractional value is floored server-side.
+     * @TJS-type integer
+     */
+    ttlSeconds?: number;
     /**
      * Opaque app payload (not interpreted by the platform) stored on the link and
      * echoed back byte-for-byte at activation. Use it to bind the link to an
@@ -51,7 +63,8 @@ export interface CreateAppMagicLinkResponseContract {
      */
     magicLinkUrl: string;
     /**
-     * Unix timestamp (seconds) when the link expires (createdAt + 24h).
+     * Unix timestamp (seconds) when the link expires (createdAt + ttlSeconds,
+     * defaulting to 24h when ttlSeconds is omitted).
      */
     expiresAt: number;
 }
@@ -228,6 +241,17 @@ export interface BulkAppMagicLinkInvitationContract {
      * When false, the user must already exist or the invite fails with NotFound.
      */
     addToAccessPrincipals?: boolean;
+    /**
+     * Optional link lifetime in seconds. Omit for the 24h (86400) default.
+     * A provided value is clamped server-side to the 3600 (1h)..604800 (7d)
+     * range rather than rejected.
+     * `0` or a negative value is NOT "no expiry" and does NOT expire the link
+     * immediately — it clamps UP to the 3600 (1h) minimum, so 1h is the
+     * shortest lifetime you can create.
+     * Whole seconds: a fractional value is floored server-side.
+     * @TJS-type integer
+     */
+    ttlSeconds?: number;
     /**
      * Opaque app payload (not interpreted by the platform) stored on the link and
      * echoed back byte-for-byte at activation.

package/dist/types/index.d.ts

@@ -18,7 +18,7 @@ export * from "./mcp-manager/mcp-manager";
 export type { MeAuthContract, MeOrgGroupContract, MePreferencesContract, MeResponseContract, MeScopeContract, MeUserContract } from "./me/me";
 export * from "./note/note";
 export * from "./org-group/org-group";
-export type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, CreateWorkspaceRequestContract, OrgInviteContract, OrgMagicLinkContract, OrgMemberRemoveResponseContract, OrgPortalContract, OrgPortalListResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceContract, OrgWorkspaceInviteContract, OrgWorkspaceListResponseContract, OrgWorkspaceMemberContract, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "./org-user/org-user";
+export type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, CreateWorkspaceRequestContract, OrgInviteContract, OrgMagicLinkContract, OrgMemberExpectedJoinedAfterInQueryOptional, OrgMemberExpectedRoleInQueryOptional, OrgMemberRemoveResponseContract, OrgPortalContract, OrgPortalListResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceContract, OrgWorkspaceInviteContract, OrgWorkspaceListResponseContract, OrgWorkspaceMemberContract, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "./org-user/org-user";
 export * from "./orgs/orgs";
 export type { VerifyPortalFeatureContextTokenRequestContract, VerifyPortalFeatureContextTokenResponseContract } from "./portal-feature-context/portal-feature-context";
 export type { AddPortalAppPageRequestContract, AddPortalAppPageResponseContract, AddPortalBlockRequestContract, AddPortalBlockResponseContract, AddPortalNoteBlockRequestContract, AddPortalNoteBlockResponseContract, BulkInviteResultItemContract, BulkInviteToPortalRequestContract, BulkInviteToPortalResponseContract, BulkPortalInvitationContract, CreatePortalFolderRequestContract, CreatePortalFolderResponseContract, CreatePortalPageWithNoteRequestContract, CreatePortalPageWithNoteResponseContract, CreatePortalRequestContract, CreatePortalResponseContract, DuplicatePortalItemRequestContract, DuplicatePortalItemResponseContract, DuplicatePortalRequestContract, InvitePortalManagerRequestContract, InvitePortalManagerResponseContract, InviteToPortalRequestContract, InviteToPortalResponseContract, ListPortalContentResponseContract, PortalContentItemContract, PortalDetailContract, PublishPortalDraftResponseContract, UpdatePortalAccessRequestContract, UpdatePortalAccessResponseContract, UpdatePortalCustomCodeRequestContract, UpdatePortalCustomCodeResponseContract, globalIdInPathRequired } from "./portals/portals";

package/dist/types/org-user/org-user.d.ts

@@ -146,6 +146,17 @@ export interface OrgUserAddResponseContract {
     workspaceMember?: OrgWorkspaceMemberContract;
     magicLink?: OrgMagicLinkContract;
 }
+/**
+ * Optional CAS guard for removeOrgMember: the membership is only removed when
+ * its current org role still equals this value.
+ */
+export type OrgMemberExpectedRoleInQueryOptional = string;
+/**
+ * Optional provenance guard for removeOrgMember (unix timestamp in seconds):
+ * the membership is only removed when it was created at or after this moment,
+ * so cancelling an invite can never drop a pre-existing member.
+ */
+export type OrgMemberExpectedJoinedAfterInQueryOptional = number;
 export interface OrgMemberRemoveResponseContract {
     ok: true;
     userId: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusebase/fusebase-gate-sdk",
-  "version": "2.3.34-sdk.4",
+  "version": "2.3.34-sdk.9",
   "description": "TypeScript SDK for Fusebase Gate APIs - Generated from contract introspection",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/release-notes/2.3.34-sdk.9.md

@@ -0,0 +1,9 @@
+# Release Notes 2.3.34-sdk.9
+
+- Current ref: `HEAD`
+- Previous tag: `v2.3.34-sdk.9`
+- Generated at: 2026-07-23T15:54:33.520Z
+
+## Included Drafts
+
+- None

package/release-notes/latest.md

@@ -1,82 +1,9 @@
-# Release Notes 2.3.34-sdk.4
+# Release Notes 2.3.34-sdk.9
 
 - Current ref: `HEAD`
-- Previous tag: `v2.3.28-sdk.3`
-- Generated at: 2026-07-23T05:48:58.238Z
+- Previous tag: `v2.3.34-sdk.9`
+- Generated at: 2026-07-23T15:54:33.520Z
 
 ## Included Drafts
 
-- `docs/release-notes/2026-07-02-markdown-notes-crud.md` - Markdown (v3) notes CRUD
-- `docs/release-notes/2026-07-13-getme-no-health-read.md` - getMe no longer requires health.read
-
-## Summary
-
-### Markdown (v3) notes CRUD
-
-Add Gate contracts, controllers, and MCP-visible operations for v3 markdown notes: create, read, replace, and append markdown stored as the source of truth in note-service (no editor-service involved). Part of Notes v3 Iteration 1 (NIM-42034, NIM-42042).
-
-### getMe no longer requires health.read
-
-`GET /me` (`getMe`) no longer declares a required Gate permission. Any authenticated **user** or **token** subject may call it with a valid session, without `health.read` in the grant.
-
-
-## API / SDK Changes
-
-### Markdown (v3) notes CRUD
-
-- Added `createWorkspaceMarkdownNote` (`POST /:orgId/workspaces/:workspaceId/markdown-notes`).
-- Added `getWorkspaceMarkdownNote` (`GET .../markdown-notes/:noteId`) returning the markdown source of truth plus `revision`.
-- Added `updateWorkspaceMarkdownNoteContent` (`PUT .../markdown-notes/:noteId/content`) replacing the full markdown document with a required optimistic `revision` lock.
-- Added `appendWorkspaceMarkdownNoteContent` (`POST .../markdown-notes/:noteId/content/append`) with an optional `revision` lock.
-- Stale-revision writes return HTTP 409 with `data.errorCode = markdown_note_revision_conflict` and `data.currentRevision`.
-- Regenerated SDK/OpenAPI artifacts include the new Notes API methods and contracts.
-
-
-## Consumer Impact
-
-### Markdown (v3) notes CRUD
-
-AI/MCP callers can manage markdown-native (v3) notes end-to-end without HTML conversion. Classic (v2) notes are untouched and keep using the existing notes operations. The operations depend on the note-service markdown API (NIM-42040/NIM-42041); until note-service ships it, calls fail upstream.
-
-
-## Verification
-
-### Markdown (v3) notes CRUD
-
-- `npm run build`
-- `npm run build:sdk`
-- `npm run mcp:skills:generate`
-- `npm run mcp:skills:validate`
-- `npm test` (unit suites for the new controller, client, and contracts)
-
-### getMe no longer requires health.read
-
-- `npm run test:unit -- tests/unit/authz-op-registry-bridge.test.ts`
-- `npm run build`
-
-
-## Follow-ups
-
-### Markdown (v3) notes CRUD
-
-- Switch the plain-HTTP note-service markdown client to the generated `@internal/note-service` SDK once note-service publishes the markdown endpoints.
-- Add e2e-sdk/mcp-e2e coverage once the note-service contract is live (fake-note-service markdown routes should mirror the real service).
-
-
-## Consumer impact
-
-### getMe no longer requires health.read
-
-- **Apps without `health.read` in the published grant** can call `getMe` again (service tokens, visitor browser tokens).
-- **Apps that already include `health.read`** are unchanged.
-- Do **not** remove `health.read` from grants solely because of this change — other ops may still require it.
-- Continue using `FBS_ORG_ID` / `getMyOrgAccess` for org resolution; do not rely on `getMe().auth.scopes` for visitor sessions.
-
-
-## Why
-
-### getMe no longer requires health.read
-
-- `getMe` is the primary identity introspection op for Fusebase Apps.
-- Requiring `health.read` caused production lockouts when app grants omitted it after `fusebase analyze gate` / `--sync-gate-permissions` (see issue `041-benchmarking-app`, escalation `2026-07-13-platform-gate-2.3.29-auth-breaking-changes.md`).
-- `resolveOperationPermissions` now reports `required_permission: null` for `getMe`, aligned with `getHealth`.
+- None

package/release-notes/2.3.34-sdk.3.md

@@ -1,9 +0,0 @@
-# Release Notes 2.3.34-sdk.3
-
-- Current ref: `HEAD`
-- Previous tag: `v2.3.34-sdk.2`
-- Generated at: 2026-07-21T14:24:27.829Z
-
-## Included Drafts
-
-- None

package/release-notes/2.3.34-sdk.4.md

@@ -1,82 +0,0 @@
-# Release Notes 2.3.34-sdk.4
-
-- Current ref: `HEAD`
-- Previous tag: `v2.3.28-sdk.3`
-- Generated at: 2026-07-23T05:48:58.238Z
-
-## Included Drafts
-
-- `docs/release-notes/2026-07-02-markdown-notes-crud.md` - Markdown (v3) notes CRUD
-- `docs/release-notes/2026-07-13-getme-no-health-read.md` - getMe no longer requires health.read
-
-## Summary
-
-### Markdown (v3) notes CRUD
-
-Add Gate contracts, controllers, and MCP-visible operations for v3 markdown notes: create, read, replace, and append markdown stored as the source of truth in note-service (no editor-service involved). Part of Notes v3 Iteration 1 (NIM-42034, NIM-42042).
-
-### getMe no longer requires health.read
-
-`GET /me` (`getMe`) no longer declares a required Gate permission. Any authenticated **user** or **token** subject may call it with a valid session, without `health.read` in the grant.
-
-
-## API / SDK Changes
-
-### Markdown (v3) notes CRUD
-
-- Added `createWorkspaceMarkdownNote` (`POST /:orgId/workspaces/:workspaceId/markdown-notes`).
-- Added `getWorkspaceMarkdownNote` (`GET .../markdown-notes/:noteId`) returning the markdown source of truth plus `revision`.
-- Added `updateWorkspaceMarkdownNoteContent` (`PUT .../markdown-notes/:noteId/content`) replacing the full markdown document with a required optimistic `revision` lock.
-- Added `appendWorkspaceMarkdownNoteContent` (`POST .../markdown-notes/:noteId/content/append`) with an optional `revision` lock.
-- Stale-revision writes return HTTP 409 with `data.errorCode = markdown_note_revision_conflict` and `data.currentRevision`.
-- Regenerated SDK/OpenAPI artifacts include the new Notes API methods and contracts.
-
-
-## Consumer Impact
-
-### Markdown (v3) notes CRUD
-
-AI/MCP callers can manage markdown-native (v3) notes end-to-end without HTML conversion. Classic (v2) notes are untouched and keep using the existing notes operations. The operations depend on the note-service markdown API (NIM-42040/NIM-42041); until note-service ships it, calls fail upstream.
-
-
-## Verification
-
-### Markdown (v3) notes CRUD
-
-- `npm run build`
-- `npm run build:sdk`
-- `npm run mcp:skills:generate`
-- `npm run mcp:skills:validate`
-- `npm test` (unit suites for the new controller, client, and contracts)
-
-### getMe no longer requires health.read
-
-- `npm run test:unit -- tests/unit/authz-op-registry-bridge.test.ts`
-- `npm run build`
-
-
-## Follow-ups
-
-### Markdown (v3) notes CRUD
-
-- Switch the plain-HTTP note-service markdown client to the generated `@internal/note-service` SDK once note-service publishes the markdown endpoints.
-- Add e2e-sdk/mcp-e2e coverage once the note-service contract is live (fake-note-service markdown routes should mirror the real service).
-
-
-## Consumer impact
-
-### getMe no longer requires health.read
-
-- **Apps without `health.read` in the published grant** can call `getMe` again (service tokens, visitor browser tokens).
-- **Apps that already include `health.read`** are unchanged.
-- Do **not** remove `health.read` from grants solely because of this change — other ops may still require it.
-- Continue using `FBS_ORG_ID` / `getMyOrgAccess` for org resolution; do not rely on `getMe().auth.scopes` for visitor sessions.
-
-
-## Why
-
-### getMe no longer requires health.read
-
-- `getMe` is the primary identity introspection op for Fusebase Apps.
-- Requiring `health.read` caused production lockouts when app grants omitted it after `fusebase analyze gate` / `--sync-gate-permissions` (see issue `041-benchmarking-app`, escalation `2026-07-13-platform-gate-2.3.29-auth-breaking-changes.md`).
-- `resolveOperationPermissions` now reports `required_permission: null` for `getMe`, aligned with `getHealth`.