@fusebase/fusebase-gate-sdk 2.3.34-sdk.8 → 2.3.34-sdk.9

package/dist/apis/AppApisApi.d.ts

@@ -11,7 +11,7 @@ export declare class AppApisApi {
     constructor(client: Client);
     /**
      * Call app API operation
-     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context.
+     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context. Pass `onBehalfOfUserToken` (a platform app token, i.e. the user's `fbsfeaturetoken`) to run the call on behalf of an end user: Gate verifies it fail-closed and forwards the resolved user to the runtime as `X-Fusebase-Verified-User-Id` / `X-Fusebase-Verified-User-Source: obo`, so apps no longer need to hand-roll dual-token forwarding. The operation's `allowedCallers` / `requiredPermissions` are still evaluated against the calling identity, not the on-behalf-of user.
      */
     callAppApi(params: {
         path: {

package/dist/apis/AppApisApi.js

@@ -13,7 +13,7 @@ class AppApisApi {
     }
     /**
      * Call app API operation
-     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context.
+     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context. Pass `onBehalfOfUserToken` (a platform app token, i.e. the user's `fbsfeaturetoken`) to run the call on behalf of an end user: Gate verifies it fail-closed and forwards the resolved user to the runtime as `X-Fusebase-Verified-User-Id` / `X-Fusebase-Verified-User-Source: obo`, so apps no longer need to hand-roll dual-token forwarding. The operation's `allowedCallers` / `requiredPermissions` are still evaluated against the calling identity, not the on-behalf-of user.
      */
     async callAppApi(params) {
         return this.client.request({

package/dist/apis/OrgUsersApi.d.ts

@@ -5,7 +5,7 @@
  * Domain: org-users
  */
 import type { Client } from "../runtime/transport";
-import type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, orgIdInPathRequired, OrgMemberRemoveResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "../types";
+import type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, orgIdInPathRequired, OrgMemberExpectedJoinedAfterInQueryOptional, OrgMemberExpectedRoleInQueryOptional, OrgMemberRemoveResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "../types";
 export declare class OrgUsersApi {
     private client;
     constructor(client: Client);
@@ -54,13 +54,17 @@ export declare class OrgUsersApi {
     }): Promise<OrgWorkspaceMemberListResponseContract>;
     /**
      * Remove organization member
-     * Removes an organization member by numeric userId. Gate resolves the internal orgMember.globalId before calling org-service, and org-service cleans up workspace/group memberships for that org. Requires org.members.write and org access.
+     * Removes an organization member by numeric userId. Gate resolves the internal orgMember.globalId before calling org-service, and org-service cleans up workspace/group memberships for that org. Optional query preconditions make the removal conditional instead of unconditional: `expectedRole` requires the member to still hold that org role, and `expectedJoinedAfter` (unix seconds) requires the membership to have been created at or after that moment — use it when cancelling an invite so a pre-existing member is never dropped. Either mismatch fails with 409 and removes nothing; a precondition sent with an empty or unparsable value fails with 400 rather than degrading into an unconditional removal. Requires org.members.write and org access.
      */
     removeOrgMember(params: {
         path: {
             orgId: orgIdInPathRequired;
             userId: OrgUserIdInPathRequired;
         };
+        query?: {
+            expectedRole?: OrgMemberExpectedRoleInQueryOptional;
+            expectedJoinedAfter?: OrgMemberExpectedJoinedAfterInQueryOptional;
+        };
         headers?: Record<string, string>;
     }): Promise<OrgMemberRemoveResponseContract>;
     /**

package/dist/apis/OrgUsersApi.js

@@ -70,13 +70,14 @@ class OrgUsersApi {
     }
     /**
      * Remove organization member
-     * Removes an organization member by numeric userId. Gate resolves the internal orgMember.globalId before calling org-service, and org-service cleans up workspace/group memberships for that org. Requires org.members.write and org access.
+     * Removes an organization member by numeric userId. Gate resolves the internal orgMember.globalId before calling org-service, and org-service cleans up workspace/group memberships for that org. Optional query preconditions make the removal conditional instead of unconditional: `expectedRole` requires the member to still hold that org role, and `expectedJoinedAfter` (unix seconds) requires the membership to have been created at or after that moment — use it when cancelling an invite so a pre-existing member is never dropped. Either mismatch fails with 409 and removes nothing; a precondition sent with an empty or unparsable value fails with 400 rather than degrading into an unconditional removal. Requires org.members.write and org access.
      */
     async removeOrgMember(params) {
         return this.client.request({
             method: "DELETE",
             path: "/:orgId/users/:userId",
             pathParams: params.path,
+            query: params.query,
             headers: params.headers,
             opId: "removeOrgMember",
             expectedContentType: "application/json",

package/dist/types/app-api/app-api.d.ts

@@ -37,6 +37,13 @@ export interface CallAppApiRequestContract {
     path?: Record<string, string>;
     query?: Record<string, string | number | boolean>;
     body?: unknown;
+    /**
+     * On-behalf-of: a platform app token (`fbsfeaturetoken` / `x-app-feature-token`)
+     * identifying the end user this call runs for. Gate verifies it fail-closed and
+     * forwards the resolved user to the runtime as `X-Fusebase-Verified-User-*`
+     * headers; the calling identity still governs the operation's access policy.
+     */
+    onBehalfOfUserToken?: string;
 }
 export interface CallAppApiResponseContract {
     ok: boolean;

package/dist/types/index.d.ts

@@ -18,7 +18,7 @@ export * from "./mcp-manager/mcp-manager";
 export type { MeAuthContract, MeOrgGroupContract, MePreferencesContract, MeResponseContract, MeScopeContract, MeUserContract } from "./me/me";
 export * from "./note/note";
 export * from "./org-group/org-group";
-export type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, CreateWorkspaceRequestContract, OrgInviteContract, OrgMagicLinkContract, OrgMemberRemoveResponseContract, OrgPortalContract, OrgPortalListResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceContract, OrgWorkspaceInviteContract, OrgWorkspaceListResponseContract, OrgWorkspaceMemberContract, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "./org-user/org-user";
+export type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, CreateWorkspaceRequestContract, OrgInviteContract, OrgMagicLinkContract, OrgMemberExpectedJoinedAfterInQueryOptional, OrgMemberExpectedRoleInQueryOptional, OrgMemberRemoveResponseContract, OrgPortalContract, OrgPortalListResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceContract, OrgWorkspaceInviteContract, OrgWorkspaceListResponseContract, OrgWorkspaceMemberContract, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "./org-user/org-user";
 export * from "./orgs/orgs";
 export type { VerifyPortalFeatureContextTokenRequestContract, VerifyPortalFeatureContextTokenResponseContract } from "./portal-feature-context/portal-feature-context";
 export type { AddPortalAppPageRequestContract, AddPortalAppPageResponseContract, AddPortalBlockRequestContract, AddPortalBlockResponseContract, AddPortalNoteBlockRequestContract, AddPortalNoteBlockResponseContract, BulkInviteResultItemContract, BulkInviteToPortalRequestContract, BulkInviteToPortalResponseContract, BulkPortalInvitationContract, CreatePortalFolderRequestContract, CreatePortalFolderResponseContract, CreatePortalPageWithNoteRequestContract, CreatePortalPageWithNoteResponseContract, CreatePortalRequestContract, CreatePortalResponseContract, DuplicatePortalItemRequestContract, DuplicatePortalItemResponseContract, DuplicatePortalRequestContract, InvitePortalManagerRequestContract, InvitePortalManagerResponseContract, InviteToPortalRequestContract, InviteToPortalResponseContract, ListPortalContentResponseContract, PortalContentItemContract, PortalDetailContract, PublishPortalDraftResponseContract, UpdatePortalAccessRequestContract, UpdatePortalAccessResponseContract, UpdatePortalCustomCodeRequestContract, UpdatePortalCustomCodeResponseContract, globalIdInPathRequired } from "./portals/portals";

package/dist/types/org-user/org-user.d.ts

@@ -146,6 +146,17 @@ export interface OrgUserAddResponseContract {
     workspaceMember?: OrgWorkspaceMemberContract;
     magicLink?: OrgMagicLinkContract;
 }
+/**
+ * Optional CAS guard for removeOrgMember: the membership is only removed when
+ * its current org role still equals this value.
+ */
+export type OrgMemberExpectedRoleInQueryOptional = string;
+/**
+ * Optional provenance guard for removeOrgMember (unix timestamp in seconds):
+ * the membership is only removed when it was created at or after this moment,
+ * so cancelling an invite can never drop a pre-existing member.
+ */
+export type OrgMemberExpectedJoinedAfterInQueryOptional = number;
 export interface OrgMemberRemoveResponseContract {
     ok: true;
     userId: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusebase/fusebase-gate-sdk",
-  "version": "2.3.34-sdk.8",
+  "version": "2.3.34-sdk.9",
   "description": "TypeScript SDK for Fusebase Gate APIs - Generated from contract introspection",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/release-notes/2.3.34-sdk.9.md

@@ -0,0 +1,9 @@
+# Release Notes 2.3.34-sdk.9
+
+- Current ref: `HEAD`
+- Previous tag: `v2.3.34-sdk.9`
+- Generated at: 2026-07-23T15:54:33.520Z
+
+## Included Drafts
+
+- None

package/release-notes/latest.md

@@ -1,8 +1,8 @@
-# Release Notes 2.3.34-sdk.8
+# Release Notes 2.3.34-sdk.9
 
 - Current ref: `HEAD`
-- Previous tag: `v2.3.34-sdk.8`
-- Generated at: 2026-07-23T10:56:17.288Z
+- Previous tag: `v2.3.34-sdk.9`
+- Generated at: 2026-07-23T15:54:33.520Z
 
 ## Included Drafts
 

package/release-notes/2.3.34-sdk.8.md

@@ -1,9 +0,0 @@
-# Release Notes 2.3.34-sdk.8
-
-- Current ref: `HEAD`
-- Previous tag: `v2.3.34-sdk.8`
-- Generated at: 2026-07-23T10:56:17.288Z
-
-## Included Drafts
-
-- None