@hydradb/sdk 2.1.2 → 2.1.4

package/dist/api/resources/webhooks/client/Client.js

@@ -96,7 +96,7 @@ class WebhooksClient {
         return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "GET", "/webhooks/indexing");
     }
     /**
-     * Register the indexing webhook for this API key's org.
+     * Register the indexing webhook for this API key's org. Set `generate_signing_secret` to register and enable signing in one request; the secret is returned once on the response. Omitting `signing_secret` preserves any secret already configured - to disable signing, call DELETE /webhooks/indexing/signing-secret.
      *
      * @param {HydraDB.WebhooksWebhookRegisterRequest} request
      * @param {WebhooksClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -395,6 +395,132 @@ class WebhooksClient {
         }
         return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "POST", "/webhooks/indexing/deliveries/{delivery_id}/retry");
     }
+    /**
+     * Generates a signing secret, or stores one you supply. The plaintext is returned exactly once and cannot be retrieved afterwards. Takes effect immediately, so rotate only once your receiver accepts the new secret.
+     *
+     * @param {HydraDB.WebhooksSigningSecretRequest} request
+     * @param {WebhooksClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link HydraDB.NotFoundError}
+     * @throws {@link HydraDB.UnprocessableEntityError}
+     *
+     * @example
+     *     await client.webhooks.setSigningSecret()
+     */
+    setSigningSecret(request = {}, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__setSigningSecret(request, requestOptions));
+    }
+    async __setSigningSecret(request = {}, requestOptions) {
+        const _authRequest = await this._options.authProvider.getAuthRequest();
+        const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, this._options?.headers, (0, headers_js_1.mergeOnlyDefinedHeaders)({ "API-Version": requestOptions?.apiVersion ?? this._options?.apiVersion ?? "2" }), requestOptions?.headers);
+        const _response = await core.fetcher({
+            url: core.url.join((await core.Supplier.get(this._options.baseUrl)) ??
+                (await core.Supplier.get(this._options.environment)) ??
+                environments.HydraDBEnvironment.Default, "webhooks/indexing/signing-secret"),
+            method: "POST",
+            headers: _headers,
+            contentType: "application/json",
+            queryString: core.url.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+            requestType: "json",
+            body: serializers.WebhooksSigningSecretRequest.jsonOrThrow(request, {
+                unrecognizedObjectKeys: "strip",
+                omitUndefined: true,
+            }),
+            timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1000,
+            maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+            abortSignal: requestOptions?.abortSignal,
+            fetchFn: this._options?.fetch,
+            logging: this._options.logging,
+        });
+        if (_response.ok) {
+            return {
+                data: serializers.HandlerEnvelopeWebhooksSigningSecretResponse.parseOrThrow(_response.body, {
+                    unrecognizedObjectKeys: "passthrough",
+                    allowUnrecognizedUnionMembers: true,
+                    allowUnrecognizedEnumValues: true,
+                    skipValidation: true,
+                    breadcrumbsPrefix: ["response"],
+                }),
+                rawResponse: _response.rawResponse,
+            };
+        }
+        if (_response.error.reason === "status-code") {
+            switch (_response.error.statusCode) {
+                case 404:
+                    throw new HydraDB.NotFoundError(_response.error.body, _response.rawResponse);
+                case 422:
+                    throw new HydraDB.UnprocessableEntityError(serializers.HandlerErrorResponse.parseOrThrow(_response.error.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }), _response.rawResponse);
+                default:
+                    throw new errors.HydraDBError({
+                        statusCode: _response.error.statusCode,
+                        body: _response.error.body,
+                        rawResponse: _response.rawResponse,
+                    });
+            }
+        }
+        return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "POST", "/webhooks/indexing/signing-secret");
+    }
+    /**
+     * Removes the stored signing secret. Deliveries stop carrying the X-HydraDB-Signature header. This is the only way to disable signing - editing a registration never clears the secret.
+     *
+     * @param {WebhooksClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link HydraDB.NotFoundError}
+     *
+     * @example
+     *     await client.webhooks.clearSigningSecret()
+     */
+    clearSigningSecret(requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__clearSigningSecret(requestOptions));
+    }
+    async __clearSigningSecret(requestOptions) {
+        const _authRequest = await this._options.authProvider.getAuthRequest();
+        const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, this._options?.headers, (0, headers_js_1.mergeOnlyDefinedHeaders)({ "API-Version": requestOptions?.apiVersion ?? this._options?.apiVersion ?? "2" }), requestOptions?.headers);
+        const _response = await core.fetcher({
+            url: core.url.join((await core.Supplier.get(this._options.baseUrl)) ??
+                (await core.Supplier.get(this._options.environment)) ??
+                environments.HydraDBEnvironment.Default, "webhooks/indexing/signing-secret"),
+            method: "DELETE",
+            headers: _headers,
+            queryString: core.url.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+            timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1000,
+            maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+            abortSignal: requestOptions?.abortSignal,
+            fetchFn: this._options?.fetch,
+            logging: this._options.logging,
+        });
+        if (_response.ok) {
+            return {
+                data: serializers.HandlerEnvelopeWebhooksWebhookRegisterResponse.parseOrThrow(_response.body, {
+                    unrecognizedObjectKeys: "passthrough",
+                    allowUnrecognizedUnionMembers: true,
+                    allowUnrecognizedEnumValues: true,
+                    skipValidation: true,
+                    breadcrumbsPrefix: ["response"],
+                }),
+                rawResponse: _response.rawResponse,
+            };
+        }
+        if (_response.error.reason === "status-code") {
+            switch (_response.error.statusCode) {
+                case 404:
+                    throw new HydraDB.NotFoundError(_response.error.body, _response.rawResponse);
+                default:
+                    throw new errors.HydraDBError({
+                        statusCode: _response.error.statusCode,
+                        body: _response.error.body,
+                        rawResponse: _response.rawResponse,
+                    });
+            }
+        }
+        return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "DELETE", "/webhooks/indexing/signing-secret");
+    }
     /**
      * Send a test webhook event to the registered endpoint to verify connectivity.
      *
@@ -450,5 +576,85 @@ class WebhooksClient {
         }
         return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "POST", "/webhooks/indexing/test");
     }
+    /**
+     * Ingest a Supabase INSERT/UPDATE/DELETE row change into the graph.
+     *
+     * @param {HydraDB.PostWebhooksSupabaseRequest} request
+     * @param {WebhooksClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link HydraDB.BadRequestError}
+     * @throws {@link HydraDB.NotFoundError}
+     *
+     * @example
+     *     await client.webhooks.supabaseRowChangeWebhook({
+     *         hydraDbConnector: "X-HydraDB-Connector",
+     *         body: {
+     *             "key": "value"
+     *         }
+     *     })
+     */
+    supabaseRowChangeWebhook(request, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__supabaseRowChangeWebhook(request, requestOptions));
+    }
+    async __supabaseRowChangeWebhook(request, requestOptions) {
+        const { hydraDbConnector, body: _body } = request;
+        const _authRequest = await this._options.authProvider.getAuthRequest();
+        const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, this._options?.headers, (0, headers_js_1.mergeOnlyDefinedHeaders)({
+            "X-HydraDB-Connector": hydraDbConnector,
+            "API-Version": requestOptions?.apiVersion ?? this._options?.apiVersion ?? "2",
+        }), requestOptions?.headers);
+        const _response = await core.fetcher({
+            url: core.url.join((await core.Supplier.get(this._options.baseUrl)) ??
+                (await core.Supplier.get(this._options.environment)) ??
+                environments.HydraDBEnvironment.Default, "webhooks/supabase"),
+            method: "POST",
+            headers: _headers,
+            contentType: "application/json",
+            queryString: core.url.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+            requestType: "json",
+            body: serializers.webhooks.supabaseRowChangeWebhook.Request.jsonOrThrow(_body, {
+                unrecognizedObjectKeys: "strip",
+                omitUndefined: true,
+            }),
+            timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1000,
+            maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+            abortSignal: requestOptions?.abortSignal,
+            fetchFn: this._options?.fetch,
+            logging: this._options.logging,
+        });
+        if (_response.ok) {
+            return {
+                data: serializers.HandlerEnvelopeHandlerSupabaseWebhookAck.parseOrThrow(_response.body, {
+                    unrecognizedObjectKeys: "passthrough",
+                    allowUnrecognizedUnionMembers: true,
+                    allowUnrecognizedEnumValues: true,
+                    skipValidation: true,
+                    breadcrumbsPrefix: ["response"],
+                }),
+                rawResponse: _response.rawResponse,
+            };
+        }
+        if (_response.error.reason === "status-code") {
+            switch (_response.error.statusCode) {
+                case 400:
+                    throw new HydraDB.BadRequestError(serializers.HandlerErrorResponse.parseOrThrow(_response.error.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }), _response.rawResponse);
+                case 404:
+                    throw new HydraDB.NotFoundError(_response.error.body, _response.rawResponse);
+                default:
+                    throw new errors.HydraDBError({
+                        statusCode: _response.error.statusCode,
+                        body: _response.error.body,
+                        rawResponse: _response.rawResponse,
+                    });
+            }
+        }
+        return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "POST", "/webhooks/supabase");
+    }
 }
 exports.WebhooksClient = WebhooksClient;

package/dist/api/resources/webhooks/client/requests/PostWebhooksSupabaseRequest.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @example
+ *     {
+ *         hydraDbConnector: "X-HydraDB-Connector",
+ *         body: {
+ *             "key": "value"
+ *         }
+ *     }
+ */
+export interface PostWebhooksSupabaseRequest {
+    /** Connector id */
+    hydraDbConnector: string;
+    body: Record<string, unknown>;
+}

package/dist/api/resources/webhooks/client/requests/WebhooksSigningSecretRequest.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @example
+ *     {}
+ */
+export interface WebhooksSigningSecretRequest {
+    /** Secret used to sign webhook payloads. Deliveries carry `X-HydraDB-Signature: sha256=<hex>`, the HMAC-SHA256 of the raw request body keyed by this secret. Minimum 16 characters when you supply your own; omit it and one is generated for you. On registration, omitting this field preserves any existing secret - to disable signing, call DELETE /webhooks/indexing/signing-secret. */
+    signingSecret?: string;
+}

package/dist/api/resources/webhooks/client/requests/WebhooksWebhookRegisterRequest.d.ts

@@ -5,7 +5,9 @@
 export interface WebhooksWebhookRegisterRequest {
     /** Event types to subscribe to (e.g. `["indexing.status_changed"]`). */
     eventTypes?: string[];
-    /** Optional secret used to sign webhook payloads for verification. Minimum 32 characters. */
+    /** Generate a signing secret as part of this request, so registering and enabling signing are one atomic operation. The secret is returned once on the response and cannot be retrieved later. Mutually exclusive with `signing_secret`. */
+    generateSigningSecret?: boolean;
+    /** Secret used to sign webhook payloads. Deliveries carry `X-HydraDB-Signature: sha256=<hex>`, the HMAC-SHA256 of the raw request body keyed by this secret. Minimum 16 characters when you supply your own; omit it and one is generated for you. On registration, omitting this field preserves any existing secret - to disable signing, call DELETE /webhooks/indexing/signing-secret. */
     signingSecret?: string;
     /** Endpoint URL to deliver webhook events to. */
     url?: string;

package/dist/api/resources/webhooks/client/requests/index.d.ts

@@ -1,4 +1,6 @@
 export type { GetDeliveryWebhooksRequest } from "./GetDeliveryWebhooksRequest.js";
 export type { ListDeliveriesWebhooksRequest } from "./ListDeliveriesWebhooksRequest.js";
+export type { PostWebhooksSupabaseRequest } from "./PostWebhooksSupabaseRequest.js";
 export type { RetryDeliveryWebhooksRequest } from "./RetryDeliveryWebhooksRequest.js";
+export type { WebhooksSigningSecretRequest } from "./WebhooksSigningSecretRequest.js";
 export type { WebhooksWebhookRegisterRequest } from "./WebhooksWebhookRegisterRequest.js";

package/dist/api/types/ConnectorsResource.d.ts

@@ -1,4 +1,20 @@
 export interface ConnectorsResource {
+    /**
+     * ACL is the customer-declared access-control list stamped onto every
+     * object synced from this resource (PRO-1684; see internal/domain/acl).
+     * Stored in caller-supplied form and normalized at transform time. nil
+     * means no ACL, documents stay unrestricted. Provider-derived ACLs
+     * (Phase 2) take precedence over this when the provider supports them.
+     */
+    acl?: string[];
+    /**
+     * ACLFingerprint is the stable identity of the ACL last APPLIED to this
+     * resource's already-indexed documents (PRO-1684). The sync compares the
+     * freshly-resolved provider ACL against it: equal means nothing to do,
+     * different means fan the new ACL out to existing documents. Empty means
+     * nothing has been applied yet (first capture-enabled sync).
+     */
+    aclFingerprint?: string;
     /**
      * AdditionalMetadata is merged into the additional_metadata (document
      * metadata) layer of every object synced from this resource. User-supplied
@@ -34,6 +50,14 @@ export interface ConnectorsResource {
     collectionOverride?: string;
     /** Connector this resource belongs to. */
     connectorId?: string;
+    /**
+     * CustomInstructions is optional free-text ingestion guidance scoped to
+     * this resource. When set it replaces the connector-level
+     * custom_instructions for documents synced from this resource; empty means
+     * the resource inherits the connector's value. Max 4000 characters;
+     * changes apply from the next sync cycle.
+     */
+    customInstructions?: string;
     /**
      * DatabaseOverride/CollectionOverride are the canonical v2 names for the
      * deprecated tenant_id_override/sub_tenant_id_override wire fields. Empty
@@ -66,6 +90,25 @@ export interface ConnectorsResource {
     status?: string;
     /** Overrides the connector-level collection for objects synced from this resource. */
     subTenantIdOverride?: string;
+    /**
+     * SyncBlocked marks a resource the provider will go on refusing — a table
+     * that was dropped, a channel this credential was never invited to.
+     *
+     * Deliberately not a Status value. Status gates ListConnectorResources,
+     * which is what GET /connectors/{id}/status reads, so expressing this as a
+     * status would hide the resource from the one endpoint that explains why it
+     * stopped. The resource stays active and visible; this only takes it out of
+     * what gets synced.
+     */
+    syncBlocked?: boolean;
+    /** SyncBlockedAt is when the resource was stopped (RFC3339). */
+    syncBlockedAt?: string;
+    /**
+     * SyncBlockedReason is the provider's own explanation, carried forward from
+     * the health that triggered the block so it survives the next sync
+     * overwriting that health.
+     */
+    syncBlockedReason?: string;
     /** Overrides the connector-level database for objects synced from this resource. Deprecated. */
     tenantIdOverride?: string;
 }

package/dist/api/types/FeedbackGroundTruth.d.ts

@@ -0,0 +1,12 @@
+export interface FeedbackGroundTruth {
+    /**
+     * Answer is the response the caller expected — the text a correct system
+     * would have produced from the retrieved context.
+     */
+    answer?: string;
+    /**
+     * SourceIDs are the ingested source IDs that actually contain the answer,
+     * as returned in query results and accepted by /context endpoints.
+     */
+    sourceIds?: string[];
+}

package/dist/api/types/FeedbackGroundTruth.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/api/types/FeedbackRating.d.ts

@@ -0,0 +1,6 @@
+export declare const FeedbackRating: {
+    readonly Positive: "positive";
+    readonly Negative: "negative";
+    readonly Neutral: "neutral";
+};
+export type FeedbackRating = (typeof FeedbackRating)[keyof typeof FeedbackRating];

package/dist/api/types/FeedbackRating.js

@@ -0,0 +1,9 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FeedbackRating = void 0;
+exports.FeedbackRating = {
+    Positive: "positive",
+    Negative: "negative",
+    Neutral: "neutral",
+};

package/dist/api/types/FeedbackSource.d.ts

@@ -0,0 +1,5 @@
+export declare const FeedbackSource: {
+    readonly User: "user";
+    readonly Agent: "agent";
+};
+export type FeedbackSource = (typeof FeedbackSource)[keyof typeof FeedbackSource];

package/dist/api/types/FeedbackSource.js

@@ -0,0 +1,8 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FeedbackSource = void 0;
+exports.FeedbackSource = {
+    User: "user",
+    Agent: "agent",
+};

package/dist/api/types/FeedbackSubmitRequest.d.ts

@@ -0,0 +1,2 @@
+import type * as HydraDB from "../index.js";
+export type FeedbackSubmitRequest = HydraDB.FeedbackSubmitRequestFeedback | HydraDB.FeedbackSubmitRequestGroundTruth;

package/dist/api/types/FeedbackSubmitRequest.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/api/types/FeedbackSubmitRequestFeedback.d.ts

@@ -0,0 +1,3 @@
+export interface FeedbackSubmitRequestFeedback {
+    feedback?: unknown;
+}

package/dist/api/types/FeedbackSubmitRequestFeedback.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/api/types/FeedbackSubmitRequestGroundTruth.d.ts

@@ -0,0 +1,4 @@
+import type * as HydraDB from "../index.js";
+export interface FeedbackSubmitRequestGroundTruth {
+    groundTruth: HydraDB.FeedbackSubmitRequestGroundTruthGroundTruth;
+}

package/dist/api/types/FeedbackSubmitRequestGroundTruth.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/api/types/FeedbackSubmitRequestGroundTruthGroundTruth.d.ts

@@ -0,0 +1,2 @@
+import type * as HydraDB from "../index.js";
+export type FeedbackSubmitRequestGroundTruthGroundTruth = HydraDB.FeedbackSubmitRequestGroundTruthGroundTruthAnswer | HydraDB.FeedbackSubmitRequestGroundTruthGroundTruthSourceIds;

package/dist/api/types/FeedbackSubmitRequestGroundTruthGroundTruth.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/api/types/FeedbackSubmitRequestGroundTruthGroundTruthAnswer.d.ts

@@ -0,0 +1,3 @@
+export interface FeedbackSubmitRequestGroundTruthGroundTruthAnswer {
+    answer?: unknown;
+}

package/dist/api/types/FeedbackSubmitRequestGroundTruthGroundTruthAnswer.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/api/types/FeedbackSubmitRequestGroundTruthGroundTruthSourceIds.d.ts

@@ -0,0 +1,3 @@
+export interface FeedbackSubmitRequestGroundTruthGroundTruthSourceIds {
+    sourceIds?: unknown;
+}

package/dist/api/types/FeedbackSubmitRequestGroundTruthGroundTruthSourceIds.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/api/types/FeedbackSubmitResponse.d.ts

@@ -0,0 +1,12 @@
+export interface FeedbackSubmitResponse {
+    /** RFC3339 timestamp when the feedback was recorded. */
+    createdAt?: string;
+    /** Unique identifier assigned to this feedback submission. */
+    feedbackId?: string;
+    /** Human-readable result message. */
+    message?: string;
+    /** Whether the feedback was durably stored. */
+    recorded?: boolean;
+    /** The query request ID this feedback was recorded against. */
+    requestId?: string;
+}

package/dist/api/types/FeedbackSubmitResponse.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/api/types/FetchV2SourceFetchResponse.d.ts

@@ -17,6 +17,12 @@ export interface FetchV2SourceFetchResponse {
     presignedUrl?: string;
     /** File size in bytes. */
     sizeBytes?: number;
-    /** Whether the request succeeded. */
+    /**
+     * Deprecated for API clients: to decide whether the request succeeded,
+     * check the HTTP status code — 2xx is success — or equivalently the
+     * envelope's top-level `success`. This nested copy always carries the same
+     * value as that flag and never carries independent information. Still
+     * emitted unchanged for existing clients (PRO-1208).
+     */
     success?: boolean;
 }

package/dist/api/types/GithubComHydradbHydradbApplicationInternalServiceMetadataEditResult.d.ts

@@ -1,10 +1,23 @@
 export interface GithubComHydradbHydradbApplicationInternalServiceMetadataEditResult {
+    /**
+     * ACLDriftRecorded reports that a failed ACL mirror was durably recorded
+     * for reconciliation. Always true when vector_acl_synced is true. False
+     * beside acl_updated=true and vector_acl_synced=false is the one state
+     * the operator must act on (the error log names the document).
+     */
+    aclDriftRecorded?: boolean;
+    /** ACLUpdated reports that this edit replaced the source's ACL (PRO-1684). */
+    aclUpdated?: boolean;
     /** Additional metadata keys included in the update request. */
     additionalMetadataKeys?: string[];
     /** Number of MongoDB chunk rows matched by the source update. */
     chunkRowsMatched?: number;
     /** Number of MongoDB chunk rows modified by the source update. */
     chunkRowsModified?: number;
+    /** Collection that contained the source. Canonical name; mirrors the deprecated `sub_tenant_id` alias. */
+    collection?: string;
+    /** Owning database. Canonical name; mirrors the deprecated `tenant_id` alias. */
+    database?: string;
     /** Database metadata keys included in the update request. Canonical name; `tenant_metadata_keys` is a deprecated alias. */
     databaseMetadataKeys?: string[];
     /** Unique identifier for this resource. */
@@ -18,16 +31,37 @@ export interface GithubComHydradbHydradbApplicationInternalServiceMetadataEditRe
     milvusSyncRequired?: boolean;
     /** deprecated: use vector_synced */
     milvusSynced?: boolean;
-    /** Collection that contained the source. */
+    /**
+     * PartialCommit reports that the edit committed in at least one database
+     * of a shared deployment but a later write in another failed; the
+     * idempotent retry converges the database that fell behind.
+     */
+    partialCommit?: string;
+    /** deprecated: use collection */
     subTenantId?: string;
-    /** Owning database. */
+    /** deprecated: use database */
     tenantId?: string;
     /** deprecated: use database_metadata_keys */
     tenantMetadataKeys?: string[];
     /** Whether the source metadata was updated. */
     updated?: boolean;
+    /**
+     * VectorACLSynced reports that the ACL edit also reached the vector rows'
+     * pushdown columns (PRO-1740). False with ACLUpdated true means the
+     * document's own-ACL projection is stale until its next re-index: still
+     * enforced correctly from Mongo, but invisible to the pushdown lane for
+     * any principal the edit ADDED. Always false for collections created
+     * before PRO-1740, which carry no pushdown columns.
+     */
+    vectorAclSynced?: boolean;
     /** Number of chunk rows synced to the vector store when sync was required. */
     vectorRowsSynced?: number;
+    /**
+     * VectorSyncError explains a vector_synced=false when a sync was
+     * required: the authority (Mongo) committed, the vector metadata did
+     * not follow; the idempotent retry converges it.
+     */
+    vectorSyncError?: string;
     /**
      * Vendor-neutral vector-sync signal (PRO-1185): the canonical field must not
      * name the vector store. The milvus_* fields below are deprecated aliases kept

package/dist/api/types/GraphEntity.d.ts

@@ -1,6 +1,18 @@
 export interface GraphEntity {
     /** Unique identifier for this entity in the graph. */
     entityId?: string;
+    /**
+     * Hydration is set on Source nodes in AuxiliaryRelations only, and omitted
+     * everywhere else. RELATES_TO MERGEs its target by source_id, so a target
+     * that has not been ingested yet still exists as a node — callers must be
+     * able to tell a real document from a forward reference to one.
+     *
+     * 	resolved    — ingested; source_id and app_provider both present
+     * 	stub        — MERGE-created target; source_id present, no app_provider
+     * 	placeholder — source_id IS NULL, keyed by app_external_id, awaiting
+     * 	              builder.py's reconciliation pass
+     */
+    hydration?: string;
     /** NO omitempty — serialize as null */
     identifier?: string;
     /** Human-readable label for this resource. */

package/dist/api/types/GraphGraphRelationsResponse.d.ts

@@ -1,5 +1,28 @@
 import type * as HydraDB from "../index.js";
 export interface GraphGraphRelationsResponse {
+    /**
+     * AuxiliaryRelations carries the structural graph around the entity
+     * relations: Entity->Source presence, Source->Comment/Attachment,
+     * Actor->Source/Comment, and Source->Source links. Same item shape as
+     * Relations, so a caller wanting one graph concatenates the two.
+     *
+     * Deliberately a SEPARATE array rather than merged into Relations:
+     * capPreservingTies counts triplets against the caller's limit, and
+     * computeNextCursor keys on relation timestamps. Auxiliary edges carry
+     * created_at — a different clock — so merging them would both shrink the
+     * entity relations returned for a given limit and corrupt the cursor.
+     */
+    auxiliaryRelations?: HydraDB.GraphTripletWithEvidence[];
+    /**
+     * AuxiliaryTruncated reports that an aggregate row ceiling clipped the
+     * auxiliary graph. Distinct from the per-triplet Truncated flag, which only
+     * covers a single node exceeding its fan-out cap: a wide page can blow the
+     * aggregate ceiling with every individual node still under its own cap, and
+     * without this the caller would receive a subset presented as complete.
+     *
+     * Independent of IsTruncated, which describes Relations pagination only.
+     */
+    auxiliaryTruncated?: boolean;
     /** Whether the response was truncated due to the result limit. */
     isTruncated?: boolean;
     /** Human-readable result message. */
@@ -8,6 +31,12 @@ export interface GraphGraphRelationsResponse {
     nextCursor?: number;
     /** Array of triplet groups with evidence for each relationship. */
     relations?: HydraDB.GraphTripletWithEvidence[];
-    /** Whether the request succeeded. */
+    /**
+     * Deprecated for API clients: to decide whether the request succeeded,
+     * check the HTTP status code — 2xx is success — or equivalently the
+     * envelope's top-level `success`. This nested copy always carries the same
+     * value and never carries independent information. Still emitted unchanged
+     * for existing clients (PRO-1208).
+     */
     success?: boolean;
 }

package/dist/api/types/GraphRelationEvidence.d.ts

@@ -13,6 +13,14 @@ export interface GraphRelationEvidence {
     relationshipId?: string;
     /** NO omitempty */
     sourceEntityId?: string;
+    /**
+     * Synthesized marks a triplet with no stored edge behind it. Only
+     * `present_in` sets it: that edge is derived by collapsing
+     * Entity-PRESENT_IN->Chunk-HAS_CHUNK->Source, so its RelationshipID is a
+     * deterministic synthetic id rather than a graph relationship id. Omitted
+     * (false) on every stored edge.
+     */
+    synthesized?: boolean;
     /** NO omitempty */
     targetEntityId?: string;
     /** NO omitempty */