@fusebase/fusebase-gate-sdk 2.3.34-sdk.8 → 2.4.0

package/dist/apis/AppApisApi.d.ts

@@ -11,7 +11,7 @@ export declare class AppApisApi {
     constructor(client: Client);
     /**
      * Call app API operation
-     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context.
+     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context. Pass `onBehalfOfUserToken` (a platform app token, i.e. the user's `fbsfeaturetoken`) to run the call on behalf of an end user: Gate verifies it fail-closed and forwards the resolved user to the runtime as `X-Fusebase-Verified-User-Id` / `X-Fusebase-Verified-User-Source: obo`, so apps no longer need to hand-roll dual-token forwarding. The operation's `allowedCallers` / `requiredPermissions` are still evaluated against the calling identity, not the on-behalf-of user.
      */
     callAppApi(params: {
         path: {

package/dist/apis/AppApisApi.js

@@ -13,7 +13,7 @@ class AppApisApi {
     }
     /**
      * Call app API operation
-     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context.
+     * Invokes a published app API operation through the owner app runtime using a runtime app token minted for the current authenticated caller context. Pass `onBehalfOfUserToken` (a platform app token, i.e. the user's `fbsfeaturetoken`) to run the call on behalf of an end user: Gate verifies it fail-closed and forwards the resolved user to the runtime as `X-Fusebase-Verified-User-Id` / `X-Fusebase-Verified-User-Source: obo`, so apps no longer need to hand-roll dual-token forwarding. The operation's `allowedCallers` / `requiredPermissions` are still evaluated against the calling identity, not the on-behalf-of user.
      */
     async callAppApi(params) {
         return this.client.request({

package/dist/apis/FusebaseAuthApi.d.ts

@@ -63,7 +63,7 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthRegisterResponseContract>;
     /**
      * Request Fusebase password restore
-     * Visitor-safe password restore request. Forwards to auth-form `/auth/api/remind` and always returns a generic success shape so the route does not enumerate accounts. The email link is `${customAuthUrl}/resetpass?key=<key>` (platform appends `/resetpass` and puts the key in query param `key`). When both `portalId` and `workspaceId` are set, user-service applies portal white-label branding (overrides `customAuthUrl` to the portal domain and uses the `restore_portal_password` template).
+     * Visitor-safe password restore request. Forwards to auth-form `/auth/api/remind` and always returns a generic success shape so the route does not enumerate accounts. The email and its reset link are rendered by the platform mail template; the link is not part of this contract. Set BOTH `portalId` and `workspaceId` for portal white-label branding. To control the reset URL yourself, use `requestFusebaseRestoreKey` and send your own email.
      */
     requestFusebasePasswordRestore(params: {
         headers?: Record<string, string>;
@@ -71,7 +71,7 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthPasswordRestoreResponseContract>;
     /**
      * Mint a Fusebase password-restore key (no email)
-     * Protected white-label flow. Creates a password-restore session for the email through user-service WITHOUT sending the platform email, and returns the raw key so a trusted AI App backend can send its own branded reset mail. The key passes `checkFusebasePasswordRestoreKey` / `resetFusebasePassword` with the same TTL and one-time-use as the email flow. `resetUrl` is `${customAuthUrl}/resetpass?key=<key>` when `customAuthUrl` is provided. Requires `auth.restore_key.write` and org access (same trust level as `registerFusebaseOrgMember`/`addOrgUser`); visitor/anonymous callers get 403. A key resets the target's GLOBAL FuseBase password, so it is only minted when the path `orgId` is the user's ONLY organization — a user with any footprint elsewhere (another org, or a private org from self-registration) is an independent account the app must not hijack, even if it was just added to this org. Otherwise 404 (also for unknown emails, so it does not leak global account existence). Unlike `requestFusebasePasswordRestore` this is NOT visitor-safe — it exposes the key.
+     * Mints a password-restore key without sending the platform email, so an app backend can send its own branded reset mail. The key works with `checkFusebasePasswordRestoreKey` / `resetFusebasePassword` at the same TTL and one-time-use as the email flow, and is not bound to any URL — build whatever reset link you want around it, or use the returned `platformResetUrl` if the app has no reset page of its own. Requires `auth.restore_key.write` and an app service token scoped to the path `orgId`; user, visitor and anonymous callers get 403, as does a token scoped to another org. Backend only — the app-wrapper `fbsfeaturetoken` cookie also resolves as a token subject, so the calling credential must never be reachable from frontend code. A key resets the target's GLOBAL FuseBase password, so it is minted only when the path `orgId` is the user's ONLY org; any footprint elsewhere is an independent account and 404s, as do unknown emails. NOT visitor-safe — it exposes the key.
      */
     requestFusebaseRestoreKey(params: {
         path: {

package/dist/apis/FusebaseAuthApi.js

@@ -97,7 +97,7 @@ class FusebaseAuthApi {
     }
     /**
      * Request Fusebase password restore
-     * Visitor-safe password restore request. Forwards to auth-form `/auth/api/remind` and always returns a generic success shape so the route does not enumerate accounts. The email link is `${customAuthUrl}/resetpass?key=<key>` (platform appends `/resetpass` and puts the key in query param `key`). When both `portalId` and `workspaceId` are set, user-service applies portal white-label branding (overrides `customAuthUrl` to the portal domain and uses the `restore_portal_password` template).
+     * Visitor-safe password restore request. Forwards to auth-form `/auth/api/remind` and always returns a generic success shape so the route does not enumerate accounts. The email and its reset link are rendered by the platform mail template; the link is not part of this contract. Set BOTH `portalId` and `workspaceId` for portal white-label branding. To control the reset URL yourself, use `requestFusebaseRestoreKey` and send your own email.
      */
     async requestFusebasePasswordRestore(params) {
         return this.client.request({
@@ -111,7 +111,7 @@ class FusebaseAuthApi {
     }
     /**
      * Mint a Fusebase password-restore key (no email)
-     * Protected white-label flow. Creates a password-restore session for the email through user-service WITHOUT sending the platform email, and returns the raw key so a trusted AI App backend can send its own branded reset mail. The key passes `checkFusebasePasswordRestoreKey` / `resetFusebasePassword` with the same TTL and one-time-use as the email flow. `resetUrl` is `${customAuthUrl}/resetpass?key=<key>` when `customAuthUrl` is provided. Requires `auth.restore_key.write` and org access (same trust level as `registerFusebaseOrgMember`/`addOrgUser`); visitor/anonymous callers get 403. A key resets the target's GLOBAL FuseBase password, so it is only minted when the path `orgId` is the user's ONLY organization — a user with any footprint elsewhere (another org, or a private org from self-registration) is an independent account the app must not hijack, even if it was just added to this org. Otherwise 404 (also for unknown emails, so it does not leak global account existence). Unlike `requestFusebasePasswordRestore` this is NOT visitor-safe — it exposes the key.
+     * Mints a password-restore key without sending the platform email, so an app backend can send its own branded reset mail. The key works with `checkFusebasePasswordRestoreKey` / `resetFusebasePassword` at the same TTL and one-time-use as the email flow, and is not bound to any URL — build whatever reset link you want around it, or use the returned `platformResetUrl` if the app has no reset page of its own. Requires `auth.restore_key.write` and an app service token scoped to the path `orgId`; user, visitor and anonymous callers get 403, as does a token scoped to another org. Backend only — the app-wrapper `fbsfeaturetoken` cookie also resolves as a token subject, so the calling credential must never be reachable from frontend code. A key resets the target's GLOBAL FuseBase password, so it is minted only when the path `orgId` is the user's ONLY org; any footprint elsewhere is an independent account and 404s, as do unknown emails. NOT visitor-safe — it exposes the key.
      */
     async requestFusebaseRestoreKey(params) {
         return this.client.request({

package/dist/apis/OrgUsersApi.d.ts

@@ -5,7 +5,7 @@
  * Domain: org-users
  */
 import type { Client } from "../runtime/transport";
-import type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, orgIdInPathRequired, OrgMemberRemoveResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "../types";
+import type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, orgIdInPathRequired, OrgMemberExpectedJoinedAfterInQueryOptional, OrgMemberExpectedRoleInQueryOptional, OrgMemberRemoveResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "../types";
 export declare class OrgUsersApi {
     private client;
     constructor(client: Client);
@@ -32,7 +32,7 @@ export declare class OrgUsersApi {
     }): Promise<OrgUserListResponseContract>;
     /**
      * List portal members
-     * Returns the members of a portal by its underlying workspaceId. Portal membership is currently represented by workspace membership (same semantics as removePortalMember), so Gate validates the workspace belongs to `orgId` and returns its members, each including the workspaceMember `id` (globalId). Requires org.members.read and org access.
+     * Returns the members of a portal by its underlying workspaceId. Portal membership is currently represented by workspace membership (same semantics as removePortalMember), so Gate validates the workspace belongs to `orgId` and returns its members, each including the workspaceMember `id` (globalId). Each member is enriched from org membership (joined by `userId`) with `orgRole` (guest|client|member|manager|owner), `email`, `firstname`, `lastname`, and `isPortalManager`. `isPortalManager` is the official flag for a portal manager (org role `manager`, what invitePortalManager grants, or `owner`); use it — plus `orgRole === 'client'` for clients — to answer 'client vs portal manager' and to build a 'Chat with <name | email>' channel name in one call, without a separate listOrgUsers roundtrip. Requires org.members.read and org access.
      */
     listPortalMembers(params: {
         path: {
@@ -43,7 +43,7 @@ export declare class OrgUsersApi {
     }): Promise<OrgWorkspaceMemberListResponseContract>;
     /**
      * List workspace members
-     * Returns the members of a single workspace scoped to the organization. Gate validates that the workspace belongs to `orgId`, then calls org-service. Each member includes the workspaceMember `id` (globalId) needed by removeWorkspaceMember. Requires org.members.read and org access.
+     * Returns the members of a single workspace scoped to the organization. Gate validates that the workspace belongs to `orgId`, then calls org-service. Each member includes the workspaceMember `id` (globalId) needed by removeWorkspaceMember. Each member is enriched from org membership (joined by `userId`) with `orgRole` (guest|client|member|manager|owner), `email`, `firstname`, `lastname`, and `isPortalManager` — the official flag for a portal manager (org role `manager`, what invitePortalManager grants, or `owner`); prefer it over re-deriving the formula. Requires org.members.read and org access.
      */
     listWorkspaceMembers(params: {
         path: {
@@ -54,13 +54,17 @@ export declare class OrgUsersApi {
     }): Promise<OrgWorkspaceMemberListResponseContract>;
     /**
      * Remove organization member
-     * Removes an organization member by numeric userId. Gate resolves the internal orgMember.globalId before calling org-service, and org-service cleans up workspace/group memberships for that org. Requires org.members.write and org access.
+     * Removes an organization member by numeric userId. Gate resolves the internal orgMember.globalId before calling org-service, and org-service cleans up workspace/group memberships for that org. Optional query preconditions make the removal conditional instead of unconditional: `expectedRole` requires the member to still hold that org role, and `expectedJoinedAfter` (unix seconds) requires the membership to have been created at or after that moment — use it when cancelling an invite so a pre-existing member is never dropped. Either mismatch fails with 409 and removes nothing; a precondition sent with an empty or unparsable value fails with 400 rather than degrading into an unconditional removal. Requires org.members.write and org access.
      */
     removeOrgMember(params: {
         path: {
             orgId: orgIdInPathRequired;
             userId: OrgUserIdInPathRequired;
         };
+        query?: {
+            expectedRole?: OrgMemberExpectedRoleInQueryOptional;
+            expectedJoinedAfter?: OrgMemberExpectedJoinedAfterInQueryOptional;
+        };
         headers?: Record<string, string>;
     }): Promise<OrgMemberRemoveResponseContract>;
     /**

package/dist/apis/OrgUsersApi.js

@@ -42,7 +42,7 @@ class OrgUsersApi {
     }
     /**
      * List portal members
-     * Returns the members of a portal by its underlying workspaceId. Portal membership is currently represented by workspace membership (same semantics as removePortalMember), so Gate validates the workspace belongs to `orgId` and returns its members, each including the workspaceMember `id` (globalId). Requires org.members.read and org access.
+     * Returns the members of a portal by its underlying workspaceId. Portal membership is currently represented by workspace membership (same semantics as removePortalMember), so Gate validates the workspace belongs to `orgId` and returns its members, each including the workspaceMember `id` (globalId). Each member is enriched from org membership (joined by `userId`) with `orgRole` (guest|client|member|manager|owner), `email`, `firstname`, `lastname`, and `isPortalManager`. `isPortalManager` is the official flag for a portal manager (org role `manager`, what invitePortalManager grants, or `owner`); use it — plus `orgRole === 'client'` for clients — to answer 'client vs portal manager' and to build a 'Chat with <name | email>' channel name in one call, without a separate listOrgUsers roundtrip. Requires org.members.read and org access.
      */
     async listPortalMembers(params) {
         return this.client.request({
@@ -56,7 +56,7 @@ class OrgUsersApi {
     }
     /**
      * List workspace members
-     * Returns the members of a single workspace scoped to the organization. Gate validates that the workspace belongs to `orgId`, then calls org-service. Each member includes the workspaceMember `id` (globalId) needed by removeWorkspaceMember. Requires org.members.read and org access.
+     * Returns the members of a single workspace scoped to the organization. Gate validates that the workspace belongs to `orgId`, then calls org-service. Each member includes the workspaceMember `id` (globalId) needed by removeWorkspaceMember. Each member is enriched from org membership (joined by `userId`) with `orgRole` (guest|client|member|manager|owner), `email`, `firstname`, `lastname`, and `isPortalManager` — the official flag for a portal manager (org role `manager`, what invitePortalManager grants, or `owner`); prefer it over re-deriving the formula. Requires org.members.read and org access.
      */
     async listWorkspaceMembers(params) {
         return this.client.request({
@@ -70,13 +70,14 @@ class OrgUsersApi {
     }
     /**
      * Remove organization member
-     * Removes an organization member by numeric userId. Gate resolves the internal orgMember.globalId before calling org-service, and org-service cleans up workspace/group memberships for that org. Requires org.members.write and org access.
+     * Removes an organization member by numeric userId. Gate resolves the internal orgMember.globalId before calling org-service, and org-service cleans up workspace/group memberships for that org. Optional query preconditions make the removal conditional instead of unconditional: `expectedRole` requires the member to still hold that org role, and `expectedJoinedAfter` (unix seconds) requires the membership to have been created at or after that moment — use it when cancelling an invite so a pre-existing member is never dropped. Either mismatch fails with 409 and removes nothing; a precondition sent with an empty or unparsable value fails with 400 rather than degrading into an unconditional removal. Requires org.members.write and org access.
      */
     async removeOrgMember(params) {
         return this.client.request({
             method: "DELETE",
             path: "/:orgId/users/:userId",
             pathParams: params.path,
+            query: params.query,
             headers: params.headers,
             opId: "removeOrgMember",
             expectedContentType: "application/json",

package/dist/apis/PortalsApi.d.ts

@@ -5,13 +5,26 @@
  * Domain: portals
  */
 import type { Client } from "../runtime/transport";
-import type { AddPortalAppPageRequestContract, AddPortalAppPageResponseContract, AddPortalBlockRequestContract, AddPortalBlockResponseContract, AddPortalNoteBlockRequestContract, AddPortalNoteBlockResponseContract, BulkInviteToPortalRequestContract, BulkInviteToPortalResponseContract, CreatePortalFolderRequestContract, CreatePortalFolderResponseContract, CreatePortalPageWithNoteRequestContract, CreatePortalPageWithNoteResponseContract, CreatePortalRequestContract, CreatePortalResponseContract, DuplicatePortalItemRequestContract, DuplicatePortalItemResponseContract, DuplicatePortalRequestContract, globalIdInPathRequired, InvitePortalManagerRequestContract, InvitePortalManagerResponseContract, InviteToPortalRequestContract, InviteToPortalResponseContract, ListPortalContentResponseContract, orgIdInPathRequired, OrgPortalListResponseContract, PortalDetailContract, PublishPortalDraftResponseContract, UpdatePortalAccessRequestContract, UpdatePortalAccessResponseContract, UpdatePortalCustomCodeRequestContract, UpdatePortalCustomCodeResponseContract } from "../types";
+import type { AddPortalAppBlockRequestContract, AddPortalAppBlockResponseContract, AddPortalAppPageRequestContract, AddPortalAppPageResponseContract, AddPortalBlankNoteBlockRequestContract, AddPortalBlankNoteBlockResponseContract, AddPortalBlockRequestContract, AddPortalBlockResponseContract, AddPortalChatBlockRequestContract, AddPortalChatBlockResponseContract, AddPortalEmbedBlockRequestContract, AddPortalEmbedBlockResponseContract, AddPortalNoteBlockRequestContract, AddPortalNoteBlockResponseContract, BulkInviteToPortalRequestContract, BulkInviteToPortalResponseContract, CreatePortalFolderRequestContract, CreatePortalFolderResponseContract, CreatePortalPageRequestContract, CreatePortalPageResponseContract, CreatePortalPageWithNoteRequestContract, CreatePortalPageWithNoteResponseContract, CreatePortalRequestContract, CreatePortalResponseContract, DuplicatePortalItemRequestContract, DuplicatePortalItemResponseContract, DuplicatePortalRequestContract, globalIdInPathRequired, InvitePortalManagerRequestContract, InvitePortalManagerResponseContract, InviteToPortalRequestContract, InviteToPortalResponseContract, ListPortalChatChannelsResponseContract, ListPortalChatUsersResponseContract, ListPortalContentResponseContract, orgIdInPathRequired, OrgPortalListResponseContract, PortalDetailContract, PublishPortalDraftResponseContract, UpdatePortalAccessRequestContract, UpdatePortalAccessResponseContract, UpdatePortalCustomCodeRequestContract, UpdatePortalCustomCodeResponseContract } from "../types";
 export declare class PortalsApi {
     private client;
     constructor(client: Client);
+    /**
+     * Add a published app as a block on an existing portal page
+     * Stages one published Fusebase app as a flexible app-feature block on an EXISTING portal page. No new page and no sidebar menu item is created — use addPortalAppPage when the app should get its own sidebar page. Pass productId (the product that owns the app) and appId (the app to embed); resolve both, plus productType and productOrgId, with findPublishedApps. For a managed product (Customizer "Managed Products") also pass productType='managed' and productOrgId. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. The block is staged in the portal's customizer draft (not published immediately). Returns the block id, the page the block was staged on, and the draft branch/seqs. Requires portals.write access.
+     */
+    addPortalAppBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalAppBlockRequestContract;
+    }): Promise<AddPortalAppBlockResponseContract>;
     /**
      * Add a published app as a portal page (embed)
-     * Creates a new sidebar page in the portal that embeds a published Fusebase app (a flexible block with an app-feature brick). Pass productId (the product that owns the app) and appId (the app to embed) — typically the app you just built and published via the CLI. The app's URL is resolved by the portal at render time from these ids; nothing is hard-coded. Pass parentId to nest the page under an existing folder. The page is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending page, and publishes it. Returns the page/menu-item/block ids, the page url, and the draft branch/seqs. Requires portals.write access.
+     * Creates a new sidebar page in the portal that embeds a published Fusebase app (a flexible block with an app-feature brick). Pass productId (the product that owns the app) and appId (the app to embed) — typically the app you just built and published via the CLI. For a managed product (Customizer "Managed Products") also pass productType='managed' and productOrgId from findPublishedApps. The app's URL is resolved by the portal at render time from these ids; nothing is hard-coded. Pass parentId to nest the page under an existing folder. The page is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending page, and publishes it. Returns the page/menu-item/block ids, the page url, and the draft branch/seqs. Requires portals.write access.
      */
     addPortalAppPage(params: {
         path: {
@@ -21,9 +34,22 @@ export declare class PortalsApi {
         headers?: Record<string, string>;
         body: AddPortalAppPageRequestContract;
     }): Promise<AddPortalAppPageResponseContract>;
+    /**
+     * Add an empty Fusebase note as a block to a portal page
+     * Creates a new EMPTY Fusebase note, shares it into the portal and adds it as a note block to an existing portal page — the programmatic equivalent of the customizer's "Blank Block" action. No new page and no sidebar menu item is created. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. The block is appended after the last block of the page body and is staged in the portal's customizer draft (not published immediately). Use addPortalNoteBlock when the note already exists and is already shared into the portal, and createPortalPageWithNote when a new sidebar page backed by a note is wanted. Returns the note/block ids and the draft branch/seqs. Requires portals.write access.
+     */
+    addPortalBlankNoteBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body?: AddPortalBlankNoteBlockRequestContract;
+    }): Promise<AddPortalBlankNoteBlockResponseContract>;
     /**
      * Add a block of any palette type to a portal page
-     * Stages a single block of any supported type onto an existing portal page — the universal building block behind the customizer's 'Add new block' palette (no new page or sidebar item is created). Pass pageId (the target page node id from listPortalContent) and type. Supported types: note, content, embed, chat, info, docs, help, request, meetings, links, task-list, projection, files-dashboard, tasks-dashboard, chats-dashboard, files-recent, files-bucket, flexible. Type-specific fields: note/content require noteId; flexible requires template (e.g. {type:'text'|'image'|'title'|'code'|'form'|'dashboard'|'ai-agent'|'app-feature'|...}) and may carry bricks; embed/info/projection/task-list and others take their fields via the free-form `properties` object (e.g. embedType/content/contentUrl, image/link, sourcePortalId/sourcePageId/sourceBlockId, taskListIds). Use addPortalNoteBlock for the common note case or addPortalAppPage for an app on its own page. Note: a `content` block renames the page to its title, so leave title empty for content blocks. The block is staged in the portal's customizer draft (not published immediately); the owner reviews and publishes it. Returns the block id and the draft branch/seqs. Requires portals.write access.
+     * Stages a single block of any supported type onto an existing portal page — the universal building block behind the customizer's 'Add new block' palette (no new page or sidebar item is created). Pass pageId (the target page node id from listPortalContent) and type. Supported types: note, content, info, docs, help, request, meetings, links, task-list, projection, files-dashboard, tasks-dashboard, chats-dashboard, files-recent, files-bucket, flexible. Type-specific fields: note/content require noteId; flexible requires template (e.g. {type:'text'|'image'|'title'|'code'|'form'|'dashboard'|'ai-agent'|'app-feature'|...}) and may carry bricks; info/projection/task-list and others take their fields via the free-form `properties` object (e.g. image/link, sourcePortalId/sourcePageId/sourceBlockId, taskListIds). This op does NOT accept type='embed' or type='chat' — use addPortalEmbedBlock for Embed blocks and addPortalChatBlock for Chat blocks. Use addPortalNoteBlock for the common note case or addPortalAppPage for an app on its own page. Note: a `content` block renames the page to its title, so leave title empty for content blocks. The block is staged in the portal's customizer draft (not published immediately); the owner reviews and publishes it. Returns the block id and the draft branch/seqs. Requires portals.write access.
      */
     addPortalBlock(params: {
         path: {
@@ -33,6 +59,32 @@ export declare class PortalsApi {
         headers?: Record<string, string>;
         body: AddPortalBlockRequestContract;
     }): Promise<AddPortalBlockResponseContract>;
+    /**
+     * Add a Chat block to a portal page
+     * Stages one Customizer-compatible Chat block on an EXISTING portal page — the programmatic equivalent of the customizer's "Chat" action. Pass exactly one target: { type: 'channel', channelId } (id from listPortalChatChannels) or { type: 'dm', userId } (an active org member's userId). membersOnly is channel-only (default true; a private channel requires true; forbidden for dm). One active Chat block is allowed per page — a second returns 409. Creates one chat widget configuration and stages the block in the customizer draft (not published immediately). This is a Chat WIDGET on a page, distinct from the portal's system chat menu item and the chats-dashboard block. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. Returns the block id and the draft branch/seqs. Requires portals.write access.
+     */
+    addPortalChatBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalChatBlockRequestContract;
+    }): Promise<AddPortalChatBlockResponseContract>;
+    /**
+     * Add an Embeds & Integrations block to a portal page
+     * Stages one Customizer-compatible Embed block on an EXISTING portal page — the programmatic equivalent of the customizer's "Embeds & Integrations" action. No new page and no sidebar menu item is created. embedType is one of the 11 chooser variants (custom, youtube, google-drive, ms-doc, calendly, hubspot, airtable, loom, data-studio, figma, miro). For `custom` pass `content` (URL or embed code) and NOT `url`; for every named variant pass `url` and NOT `content` — the service builds the canonical iframe. hubspot here is an iframe Embed block, not a Flexible Block integration brick. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. The block is staged in the portal's customizer draft (not published immediately). Returns the block id and the draft branch/seqs. Requires portals.write access.
+     */
+    addPortalEmbedBlock(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+            pageId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: AddPortalEmbedBlockRequestContract;
+    }): Promise<AddPortalEmbedBlockResponseContract>;
     /**
      * Add an existing Fusebase note as a block to a portal page
      * Embeds an existing Fusebase note as a content block on an existing portal page (no new page or sidebar item is created). The note must already exist in the portal's workspace and be shared into the portal (e.g. created via createPortalPageWithNote). Pass pageId (the target page node id, obtained from listPortalContent) and noteId. The block is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending block, and publishes it. Returns the created block id and the draft branch/seqs. Requires portals.write access.
@@ -80,6 +132,18 @@ export declare class PortalsApi {
         headers?: Record<string, string>;
         body: CreatePortalFolderRequestContract;
     }): Promise<CreatePortalFolderResponseContract>;
+    /**
+     * Create an empty portal page
+     * Creates a new EMPTY sidebar page in the portal — a page node plus its sidebar menu item, with no Fusebase note and no block. The page is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending page, and publishes it. Pass parentId to nest the page under an existing published or active-draft folder. The returned pageId can immediately be passed to semantic block operations to add content before publishing. Use createPortalPageWithNote instead when a page backed by a new Fusebase note is wanted. Returns the page/menu-item ids, the page url, and the draft branch/seqs. Requires portals.write access.
+     */
+    createPortalPage(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+        body: CreatePortalPageRequestContract;
+    }): Promise<CreatePortalPageResponseContract>;
     /**
      * Create a portal page backed by a Fusebase note
      * Creates a new sidebar page in the portal backed by a freshly created Fusebase note. The note is created in the portal's workspace and shared into the portal; optional initial text or html can be appended to it. The page (page node + note menu item + note content block) is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending page, and publishes it. Pass parentId to nest the page under an existing folder. Returns the note/page/menu-item ids, the page url, and the draft branch/seqs. Requires portals.write access.
@@ -152,6 +216,33 @@ export declare class PortalsApi {
         headers?: Record<string, string>;
         body: InviteToPortalRequestContract;
     }): Promise<InviteToPortalResponseContract>;
+    /**
+     * List a portal's chat channels for the Chat block picker
+     * Lists the real, listable chat channels of a portal so a Chat block can target one by exact id. DMs, group DMs and hidden channels are excluded; the default channel is returned first. ALWAYS call this before addPortalChatBlock with a channel target — never guess a channel id and never assume `general` exists. This is the Chat widget's channel list, distinct from the portal's system chat menu item and the chats-dashboard block. Requires portals.write access.
+     */
+    listPortalChatChannels(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+        };
+        headers?: Record<string, string>;
+    }): Promise<ListPortalChatChannelsResponseContract>;
+    /**
+     * Search or browse a portal's DM target users for the Chat block picker
+     * Searches a portal org's active members + owner by name, username or email so a Chat block can target a DM by exact user id. Call this before addPortalChatBlock with a `dm` target — never guess a user id. `query` is optional: omit it to browse the first bounded page. Returns a single page of { id, displayName, username?, email? }, the matching `total`, and an opaque nextCursor when more pages exist. Show one page at a time and ask before fetching the next; never request or aggregate the full org user list. Requires portals.write access.
+     */
+    listPortalChatUsers(params: {
+        path: {
+            orgId: orgIdInPathRequired;
+            portalId: globalIdInPathRequired;
+        };
+        query?: {
+            query?: string;
+            limit?: number;
+            cursor?: string;
+        };
+        headers?: Record<string, string>;
+    }): Promise<ListPortalChatUsersResponseContract>;
     /**
      * List portal content (folders and pages)
      * Returns the menu tree of a portal: folders, note pages, portal pages, and system items. Use this operation to discover existing content before creating new folders or pages. Item types match portal-service values: notesFolder, note, portalPage, home, link, etc. For items of type 'note', the noteId field contains the Fusebase note id. Requires portals.read access.

package/dist/apis/PortalsApi.js

@@ -11,9 +11,24 @@ class PortalsApi {
     constructor(client) {
         this.client = client;
     }
+    /**
+     * Add a published app as a block on an existing portal page
+     * Stages one published Fusebase app as a flexible app-feature block on an EXISTING portal page. No new page and no sidebar menu item is created — use addPortalAppPage when the app should get its own sidebar page. Pass productId (the product that owns the app) and appId (the app to embed); resolve both, plus productType and productOrgId, with findPublishedApps. For a managed product (Customizer "Managed Products") also pass productType='managed' and productOrgId. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. The block is staged in the portal's customizer draft (not published immediately). Returns the block id, the page the block was staged on, and the draft branch/seqs. Requires portals.write access.
+     */
+    async addPortalAppBlock(params) {
+        return this.client.request({
+            method: "POST",
+            path: "/:orgId/portals/:portalId/pages/:pageId/blocks/app",
+            pathParams: params.path,
+            headers: params.headers,
+            body: params.body,
+            opId: "addPortalAppBlock",
+            expectedContentType: "application/json",
+        });
+    }
     /**
      * Add a published app as a portal page (embed)
-     * Creates a new sidebar page in the portal that embeds a published Fusebase app (a flexible block with an app-feature brick). Pass productId (the product that owns the app) and appId (the app to embed) — typically the app you just built and published via the CLI. The app's URL is resolved by the portal at render time from these ids; nothing is hard-coded. Pass parentId to nest the page under an existing folder. The page is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending page, and publishes it. Returns the page/menu-item/block ids, the page url, and the draft branch/seqs. Requires portals.write access.
+     * Creates a new sidebar page in the portal that embeds a published Fusebase app (a flexible block with an app-feature brick). Pass productId (the product that owns the app) and appId (the app to embed) — typically the app you just built and published via the CLI. For a managed product (Customizer "Managed Products") also pass productType='managed' and productOrgId from findPublishedApps. The app's URL is resolved by the portal at render time from these ids; nothing is hard-coded. Pass parentId to nest the page under an existing folder. The page is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending page, and publishes it. Returns the page/menu-item/block ids, the page url, and the draft branch/seqs. Requires portals.write access.
      */
     async addPortalAppPage(params) {
         return this.client.request({
@@ -26,9 +41,24 @@ class PortalsApi {
             expectedContentType: "application/json",
         });
     }
+    /**
+     * Add an empty Fusebase note as a block to a portal page
+     * Creates a new EMPTY Fusebase note, shares it into the portal and adds it as a note block to an existing portal page — the programmatic equivalent of the customizer's "Blank Block" action. No new page and no sidebar menu item is created. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. The block is appended after the last block of the page body and is staged in the portal's customizer draft (not published immediately). Use addPortalNoteBlock when the note already exists and is already shared into the portal, and createPortalPageWithNote when a new sidebar page backed by a note is wanted. Returns the note/block ids and the draft branch/seqs. Requires portals.write access.
+     */
+    async addPortalBlankNoteBlock(params) {
+        return this.client.request({
+            method: "POST",
+            path: "/:orgId/portals/:portalId/pages/:pageId/blocks/blank-note",
+            pathParams: params.path,
+            headers: params.headers,
+            body: params.body,
+            opId: "addPortalBlankNoteBlock",
+            expectedContentType: "application/json",
+        });
+    }
     /**
      * Add a block of any palette type to a portal page
-     * Stages a single block of any supported type onto an existing portal page — the universal building block behind the customizer's 'Add new block' palette (no new page or sidebar item is created). Pass pageId (the target page node id from listPortalContent) and type. Supported types: note, content, embed, chat, info, docs, help, request, meetings, links, task-list, projection, files-dashboard, tasks-dashboard, chats-dashboard, files-recent, files-bucket, flexible. Type-specific fields: note/content require noteId; flexible requires template (e.g. {type:'text'|'image'|'title'|'code'|'form'|'dashboard'|'ai-agent'|'app-feature'|...}) and may carry bricks; embed/info/projection/task-list and others take their fields via the free-form `properties` object (e.g. embedType/content/contentUrl, image/link, sourcePortalId/sourcePageId/sourceBlockId, taskListIds). Use addPortalNoteBlock for the common note case or addPortalAppPage for an app on its own page. Note: a `content` block renames the page to its title, so leave title empty for content blocks. The block is staged in the portal's customizer draft (not published immediately); the owner reviews and publishes it. Returns the block id and the draft branch/seqs. Requires portals.write access.
+     * Stages a single block of any supported type onto an existing portal page — the universal building block behind the customizer's 'Add new block' palette (no new page or sidebar item is created). Pass pageId (the target page node id from listPortalContent) and type. Supported types: note, content, info, docs, help, request, meetings, links, task-list, projection, files-dashboard, tasks-dashboard, chats-dashboard, files-recent, files-bucket, flexible. Type-specific fields: note/content require noteId; flexible requires template (e.g. {type:'text'|'image'|'title'|'code'|'form'|'dashboard'|'ai-agent'|'app-feature'|...}) and may carry bricks; info/projection/task-list and others take their fields via the free-form `properties` object (e.g. image/link, sourcePortalId/sourcePageId/sourceBlockId, taskListIds). This op does NOT accept type='embed' or type='chat' — use addPortalEmbedBlock for Embed blocks and addPortalChatBlock for Chat blocks. Use addPortalNoteBlock for the common note case or addPortalAppPage for an app on its own page. Note: a `content` block renames the page to its title, so leave title empty for content blocks. The block is staged in the portal's customizer draft (not published immediately); the owner reviews and publishes it. Returns the block id and the draft branch/seqs. Requires portals.write access.
      */
     async addPortalBlock(params) {
         return this.client.request({
@@ -41,6 +71,36 @@ class PortalsApi {
             expectedContentType: "application/json",
         });
     }
+    /**
+     * Add a Chat block to a portal page
+     * Stages one Customizer-compatible Chat block on an EXISTING portal page — the programmatic equivalent of the customizer's "Chat" action. Pass exactly one target: { type: 'channel', channelId } (id from listPortalChatChannels) or { type: 'dm', userId } (an active org member's userId). membersOnly is channel-only (default true; a private channel requires true; forbidden for dm). One active Chat block is allowed per page — a second returns 409. Creates one chat widget configuration and stages the block in the customizer draft (not published immediately). This is a Chat WIDGET on a page, distinct from the portal's system chat menu item and the chats-dashboard block. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. Returns the block id and the draft branch/seqs. Requires portals.write access.
+     */
+    async addPortalChatBlock(params) {
+        return this.client.request({
+            method: "POST",
+            path: "/:orgId/portals/:portalId/pages/:pageId/blocks/chat",
+            pathParams: params.path,
+            headers: params.headers,
+            body: params.body,
+            opId: "addPortalChatBlock",
+            expectedContentType: "application/json",
+        });
+    }
+    /**
+     * Add an Embeds & Integrations block to a portal page
+     * Stages one Customizer-compatible Embed block on an EXISTING portal page — the programmatic equivalent of the customizer's "Embeds & Integrations" action. No new page and no sidebar menu item is created. embedType is one of the 11 chooser variants (custom, youtube, google-drive, ms-doc, calendly, hubspot, airtable, loom, data-studio, figma, miro). For `custom` pass `content` (URL or embed code) and NOT `url`; for every named variant pass `url` and NOT `content` — the service builds the canonical iframe. hubspot here is an iframe Embed block, not a Flexible Block integration brick. For a published page resolve pageId from listPortalContent; for a page created earlier in the active draft use the pageId that operation returned. The block is staged in the portal's customizer draft (not published immediately). Returns the block id and the draft branch/seqs. Requires portals.write access.
+     */
+    async addPortalEmbedBlock(params) {
+        return this.client.request({
+            method: "POST",
+            path: "/:orgId/portals/:portalId/pages/:pageId/blocks/embed",
+            pathParams: params.path,
+            headers: params.headers,
+            body: params.body,
+            opId: "addPortalEmbedBlock",
+            expectedContentType: "application/json",
+        });
+    }
     /**
      * Add an existing Fusebase note as a block to a portal page
      * Embeds an existing Fusebase note as a content block on an existing portal page (no new page or sidebar item is created). The note must already exist in the portal's workspace and be shared into the portal (e.g. created via createPortalPageWithNote). Pass pageId (the target page node id, obtained from listPortalContent) and noteId. The block is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending block, and publishes it. Returns the created block id and the draft branch/seqs. Requires portals.write access.
@@ -101,6 +161,21 @@ class PortalsApi {
             expectedContentType: "application/json",
         });
     }
+    /**
+     * Create an empty portal page
+     * Creates a new EMPTY sidebar page in the portal — a page node plus its sidebar menu item, with no Fusebase note and no block. The page is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending page, and publishes it. Pass parentId to nest the page under an existing published or active-draft folder. The returned pageId can immediately be passed to semantic block operations to add content before publishing. Use createPortalPageWithNote instead when a page backed by a new Fusebase note is wanted. Returns the page/menu-item ids, the page url, and the draft branch/seqs. Requires portals.write access.
+     */
+    async createPortalPage(params) {
+        return this.client.request({
+            method: "POST",
+            path: "/:orgId/portals/:portalId/pages",
+            pathParams: params.path,
+            headers: params.headers,
+            body: params.body,
+            opId: "createPortalPage",
+            expectedContentType: "application/json",
+        });
+    }
     /**
      * Create a portal page backed by a Fusebase note
      * Creates a new sidebar page in the portal backed by a freshly created Fusebase note. The note is created in the portal's workspace and shared into the portal; optional initial text or html can be appended to it. The page (page node + note menu item + note content block) is staged in the portal's customizer draft (not published immediately): the portal owner opens the customizer, reviews the pending page, and publishes it. Pass parentId to nest the page under an existing folder. Returns the note/page/menu-item ids, the page url, and the draft branch/seqs. Requires portals.write access.
@@ -190,6 +265,35 @@ class PortalsApi {
             expectedContentType: "application/json",
         });
     }
+    /**
+     * List a portal's chat channels for the Chat block picker
+     * Lists the real, listable chat channels of a portal so a Chat block can target one by exact id. DMs, group DMs and hidden channels are excluded; the default channel is returned first. ALWAYS call this before addPortalChatBlock with a channel target — never guess a channel id and never assume `general` exists. This is the Chat widget's channel list, distinct from the portal's system chat menu item and the chats-dashboard block. Requires portals.write access.
+     */
+    async listPortalChatChannels(params) {
+        return this.client.request({
+            method: "GET",
+            path: "/:orgId/portals/:portalId/chat/channels",
+            pathParams: params.path,
+            headers: params.headers,
+            opId: "listPortalChatChannels",
+            expectedContentType: "application/json",
+        });
+    }
+    /**
+     * Search or browse a portal's DM target users for the Chat block picker
+     * Searches a portal org's active members + owner by name, username or email so a Chat block can target a DM by exact user id. Call this before addPortalChatBlock with a `dm` target — never guess a user id. `query` is optional: omit it to browse the first bounded page. Returns a single page of { id, displayName, username?, email? }, the matching `total`, and an opaque nextCursor when more pages exist. Show one page at a time and ask before fetching the next; never request or aggregate the full org user list. Requires portals.write access.
+     */
+    async listPortalChatUsers(params) {
+        return this.client.request({
+            method: "GET",
+            path: "/:orgId/portals/:portalId/chat/users",
+            pathParams: params.path,
+            query: params.query,
+            headers: params.headers,
+            opId: "listPortalChatUsers",
+            expectedContentType: "application/json",
+        });
+    }
     /**
      * List portal content (folders and pages)
      * Returns the menu tree of a portal: folders, note pages, portal pages, and system items. Use this operation to discover existing content before creating new folders or pages. Item types match portal-service values: notesFolder, note, portalPage, home, link, etc. For items of type 'note', the noteId field contains the Fusebase note id. Requires portals.read access.

package/dist/types/app-api/app-api.d.ts

@@ -28,6 +28,13 @@ export interface PublishedAppContract {
     title: string;
     productTitle: string;
     status: "published" | "draft";
+    /** Product owner organization. Managed products are owned by another org. */
+    productOrgId: string;
+    /**
+     * private -> Customizer "Your Products/Apps"
+     * managed -> Customizer "Managed Products"
+     */
+    productType: "private" | "managed";
 }
 export interface PublishedAppListResponseContract {
     apps: PublishedAppContract[];
@@ -37,6 +44,13 @@ export interface CallAppApiRequestContract {
     path?: Record<string, string>;
     query?: Record<string, string | number | boolean>;
     body?: unknown;
+    /**
+     * On-behalf-of: a platform app token (`fbsfeaturetoken` / `x-app-feature-token`)
+     * identifying the end user this call runs for. Gate verifies it fail-closed and
+     * forwards the resolved user to the runtime as `X-Fusebase-Verified-User-*`
+     * headers; the calling identity still governs the operation's access policy.
+     */
+    onBehalfOfUserToken?: string;
 }
 export interface CallAppApiResponseContract {
     ok: boolean;

package/dist/types/fusebase-auth/fusebase-auth.d.ts

@@ -68,6 +68,21 @@ export interface FusebaseAuthConflictErrorBodyContract {
         upstreamErrorCode?: number;
     };
 }
+/**
+ * Body returned with HTTP 401 when auth-form rejects the supplied credentials
+ * or challenge answer. `data.errorCode` says which:
+ * `fusebase_auth_invalid_credentials` (wrong email/password — do not retry),
+ * `fusebase_auth_challenge_failed` (wrong verification code — re-prompt) or
+ * `fusebase_auth_challenge_expired` (restart the sign-in).
+ */
+export interface FusebaseAuthUnauthorizedErrorBodyContract {
+    success: false;
+    message: string;
+    data: {
+        code: string;
+        errorCode: string;
+    };
+}
 export interface FusebaseAuthLoginRequestContract {
     /**
      * User email. Forwarded to auth-form as `login`.
@@ -101,16 +116,10 @@ export interface FusebaseAuthPasswordRestoreRequestContract {
      * @format email
      */
     email: string;
-    /**
-     * Base URL of the app's own reset page. The platform appends `/resetpass` and
-     * puts the restore key in query param `key`, so the email link is
-     * `${customAuthUrl}/resetpass?key=<key>`. Omit to use the default Fusebase host.
-     */
-    customAuthUrl?: string;
     /**
      * Portal white-label branding. When BOTH `portalId` and `workspaceId` are set,
-     * user-service switches to portal branding: it overrides `customAuthUrl` with
-     * the portal domain, uses the portal name, and sends the `restore_portal_password`
+     * user-service switches to portal branding: it resolves the portal domain
+     * itself, uses the portal name, and sends the `restore_portal_password`
      * template instead of the default one.
      */
     portalId?: string;
@@ -125,17 +134,21 @@ export interface FusebaseAuthRestoreKeyRequestContract {
      * @format email
      */
     email: string;
-    /**
-     * Base URL of the app's own reset page. When present the response `resetUrl` is
-     * `${customAuthUrl}/resetpass?key=<key>` (same format as the platform email link).
-     */
-    customAuthUrl?: string;
 }
 export interface FusebaseAuthRestoreKeyResponseContract {
-    /** Raw restore key. Passes `checkFusebasePasswordRestoreKey` / `resetFusebasePassword`. */
+    /**
+     * Raw restore key. Passes `checkFusebasePasswordRestoreKey` /
+     * `resetFusebasePassword`. Not bound to any URL — an app hosting its own reset
+     * page puts this key wherever it likes and reads it back from there.
+     */
     key: string;
-    /** Ready-to-use reset link, present only when `customAuthUrl` was provided. */
-    resetUrl?: string;
+    /**
+     * Reset link on the platform auth-form page,
+     * `https://app.<fusebase-host>/auth/?f=resetpass&key=<key>&parentOrigin=`.
+     * Use it when the app has no reset page of its own; it saves callers from
+     * hardcoding the per-environment host.
+     */
+    platformResetUrl: string;
     /** Session expiry as a Unix epoch in milliseconds. */
     expiresAt: number;
 }

package/dist/types/index.d.ts

@@ -12,16 +12,16 @@ export type { ActivateAppMagicLinkResponseContract, AppMagicLinkSummaryContract,
 export * from "./billing/billing";
 export type { OrgEmailSendRequestContract, OrgEmailSendResponseContract } from "./email/email";
 export * from "./file/file";
-export type { FusebaseAuthChallengeContract, FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthConflictErrorBodyContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthRestoreKeyRequestContract, FusebaseAuthRestoreKeyResponseContract, FusebaseAuthSessionContract } from "./fusebase-auth/fusebase-auth";
+export type { FusebaseAuthChallengeContract, FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthConflictErrorBodyContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthRestoreKeyRequestContract, FusebaseAuthRestoreKeyResponseContract, FusebaseAuthSessionContract, FusebaseAuthUnauthorizedErrorBodyContract } from "./fusebase-auth/fusebase-auth";
 export * from "./isolated-store/isolated-store";
 export * from "./mcp-manager/mcp-manager";
 export type { MeAuthContract, MeOrgGroupContract, MePreferencesContract, MeResponseContract, MeScopeContract, MeUserContract } from "./me/me";
 export * from "./note/note";
 export * from "./org-group/org-group";
-export type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, CreateWorkspaceRequestContract, OrgInviteContract, OrgMagicLinkContract, OrgMemberRemoveResponseContract, OrgPortalContract, OrgPortalListResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceContract, OrgWorkspaceInviteContract, OrgWorkspaceListResponseContract, OrgWorkspaceMemberContract, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "./org-user/org-user";
+export type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, CreateWorkspaceRequestContract, OrgInviteContract, OrgMagicLinkContract, OrgMemberExpectedJoinedAfterInQueryOptional, OrgMemberExpectedRoleInQueryOptional, OrgMemberRemoveResponseContract, OrgPortalContract, OrgPortalListResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceContract, OrgWorkspaceInviteContract, OrgWorkspaceListResponseContract, OrgWorkspaceMemberContract, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "./org-user/org-user";
 export * from "./orgs/orgs";
 export type { VerifyPortalFeatureContextTokenRequestContract, VerifyPortalFeatureContextTokenResponseContract } from "./portal-feature-context/portal-feature-context";
-export type { AddPortalAppPageRequestContract, AddPortalAppPageResponseContract, AddPortalBlockRequestContract, AddPortalBlockResponseContract, AddPortalNoteBlockRequestContract, AddPortalNoteBlockResponseContract, BulkInviteResultItemContract, BulkInviteToPortalRequestContract, BulkInviteToPortalResponseContract, BulkPortalInvitationContract, CreatePortalFolderRequestContract, CreatePortalFolderResponseContract, CreatePortalPageWithNoteRequestContract, CreatePortalPageWithNoteResponseContract, CreatePortalRequestContract, CreatePortalResponseContract, DuplicatePortalItemRequestContract, DuplicatePortalItemResponseContract, DuplicatePortalRequestContract, InvitePortalManagerRequestContract, InvitePortalManagerResponseContract, InviteToPortalRequestContract, InviteToPortalResponseContract, ListPortalContentResponseContract, PortalContentItemContract, PortalDetailContract, PublishPortalDraftResponseContract, UpdatePortalAccessRequestContract, UpdatePortalAccessResponseContract, UpdatePortalCustomCodeRequestContract, UpdatePortalCustomCodeResponseContract, globalIdInPathRequired } from "./portals/portals";
+export type { AddPortalAppBlockRequestContract, AddPortalAppBlockResponseContract, AddPortalAppPageRequestContract, AddPortalAppPageResponseContract, AddPortalBlankNoteBlockRequestContract, AddPortalBlankNoteBlockResponseContract, AddPortalBlockRequestContract, AddPortalBlockResponseContract, AddPortalChatBlockRequestContract, AddPortalChatBlockResponseContract, AddPortalEmbedBlockRequestContract, AddPortalEmbedBlockResponseContract, AddPortalNoteBlockRequestContract, AddPortalNoteBlockResponseContract, BulkInviteResultItemContract, BulkInviteToPortalRequestContract, BulkInviteToPortalResponseContract, BulkPortalInvitationContract, CreatePortalFolderRequestContract, CreatePortalFolderResponseContract, CreatePortalPageRequestContract, CreatePortalPageResponseContract, CreatePortalPageWithNoteRequestContract, CreatePortalPageWithNoteResponseContract, CreatePortalRequestContract, CreatePortalResponseContract, DuplicatePortalItemRequestContract, DuplicatePortalItemResponseContract, DuplicatePortalRequestContract, InvitePortalManagerRequestContract, InvitePortalManagerResponseContract, InviteToPortalRequestContract, InviteToPortalResponseContract, ListPortalChatChannelsResponseContract, ListPortalChatUsersResponseContract, ListPortalContentResponseContract, PortalChatChannelContract, PortalChatUserContract, PortalContentItemContract, PortalDetailContract, PublishPortalDraftResponseContract, UpdatePortalAccessRequestContract, UpdatePortalAccessResponseContract, UpdatePortalCustomCodeRequestContract, UpdatePortalCustomCodeResponseContract, globalIdInPathRequired } from "./portals/portals";
 export * from "./shared/common";
 export * from "./shared/enums";
 export type { GetHealth200ResponseContract } from "./shared/health";