@hydradb/sdk 2.1.3 → 2.1.4

package/dist/api/client/requests/SearchQueryRequest.d.ts

@@ -4,6 +4,18 @@ import type * as HydraDB from "../../index.js";
  *     {}
  */
 export interface SearchQueryRequest {
+    /**
+     * ACL scopes retrieval to documents the given principals may access
+     * (PRO-1684 document ACLs): a document matches when its stored ACL is
+     * empty (unrestricted, pre-RBAC content and connectors without permission
+     * support), contains __public__, or intersects these principals. Entries
+     * are bare emails or prefixed principals (user_email:/group:/domain:).
+     * Omitted, empty, or ["*"] disables ACL filtering entirely, today's
+     * behavior. Like IDs, the resulting clause survives the metadata
+     * zero-result retry. An entry that is not a known principal fails CLOSED:
+     * it matches only public and unrestricted documents, never restricted.
+     */
+    acl?: string[];
     /** Optional context string prepended to the query to improve retrieval relevance. */
     additionalContext?: string;
     /** Weighting balance between dense and sparse retrieval in hybrid mode. `"auto"` lets HydraDB choose; a number from 0 (full BM25) to 1 (full dense) sets it explicitly. */

package/dist/api/resources/connectors/client/Client.d.ts

@@ -94,7 +94,7 @@ export declare class ConnectorsClient {
     delete(request: HydraDB.DeleteConnectorsRequest, requestOptions?: ConnectorsClient.RequestOptions): core.HttpResponsePromise<HydraDB.HandlerConnectorDeleteResponse>;
     private __delete;
     /**
-     * Update a connector's mutable settings. `sync_interval_seconds` sets the cadence at which the scheduler starts incremental syncs: the allowed range is provider-aware and returned in the response; values outside it are rejected rather than clamped; 0 resets to the provider default; changing it re-anchors the next sync so a shorter cadence takes effect immediately. `credentials` reconnects the connector in place: send the provider's full credential set (what create accepts); supplied keys replace their stored values, other stored keys survive, the bundle is re-validated against the provider's credential schema, and a pending needs-reauth flag is cleared — the connector keeps its id, resources, and sync cursors.
+     * Update a connector's mutable settings. `sync_interval_seconds` sets the cadence at which the scheduler starts incremental syncs: the allowed range is provider-aware and returned in the response; values outside it are rejected rather than clamped; 0 resets to the provider default; changing it re-anchors the next sync so a shorter cadence takes effect immediately. `credentials` reconnects the connector in place: send the provider's full credential set (what create accepts); supplied keys replace their stored values, other stored keys survive, the bundle is re-validated against the provider's credential schema, and a pending needs-reauth flag is cleared — the connector keeps its id, resources, and sync cursors. `custom_instructions` replaces the free-text steering applied when this connector's documents are ingested (an explicit empty string clears it); the change applies from the next sync cycle and does not re-process already-ingested documents. When several fields are supplied together they are validated up front and applied atomically: an invalid value rejects the whole request with nothing changed.
      *
      * @param {HydraDB.HandlerConnectorUpdateReq} request
      * @param {ConnectorsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -234,6 +234,27 @@ export declare class ConnectorsClient {
      */
     deleteResource(request: HydraDB.DeleteResourceConnectorsRequest, requestOptions?: ConnectorsClient.RequestOptions): core.HttpResponsePromise<HydraDB.HandlerResourceDeleteResponse>;
     private __deleteResource;
+    /**
+     * Updates per-resource settings. `acl` sets the customer-declared ACL for one connector resource (PRO-1684): the rule is normalized (emails prefixed, __public__ dominates, explicit-empty becomes __private__), persisted on the resource, and applied to enforcement immediately via the resource's ACL row, every already-indexed document of the resource is governed by it on the next query, with no re-sync. For providers with provider-derived ACL capture enabled, the provider's own ACL takes precedence again at the next sync; the rule is the standing fallback. `custom_instructions` sets the resource-level ingestion-instructions override (max 4000 characters): when set it replaces the connector-level custom_instructions for documents synced from this resource, an explicit empty string clears the override back to inheriting the connector's value, and changes apply from the next sync cycle. At least one field must be supplied; omitted fields are left unchanged.
+     *
+     * @param {HydraDB.UpdateResourceAclConnectorsRequest} request
+     * @param {ConnectorsClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link HydraDB.BadRequestError}
+     * @throws {@link HydraDB.NotFoundError}
+     * @throws {@link HydraDB.InternalServerError}
+     *
+     * @example
+     *     await client.connectors.updateResourceAcl({
+     *         id: "HydraDoc1234",
+     *         resourceId: "C0123456789",
+     *         body: {
+     *             "key": "value"
+     *         }
+     *     })
+     */
+    updateResourceAcl(request: HydraDB.UpdateResourceAclConnectorsRequest, requestOptions?: ConnectorsClient.RequestOptions): core.HttpResponsePromise<Record<string, unknown>>;
+    private __updateResourceAcl;
     /**
      * Report whether a connector is working, in one call: a rollup status (healthy, degraded, failed, checking) plus per-resource detail. `degraded` means the connector is syncing but at least one configured resource is failing — the state that is otherwise invisible, because a connector whose resources partly fail still reports an idle sync status and no error.
      *

package/dist/api/resources/connectors/client/Client.js

@@ -411,7 +411,7 @@ class ConnectorsClient {
         return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "DELETE", "/connectors/{id}");
     }
     /**
-     * Update a connector's mutable settings. `sync_interval_seconds` sets the cadence at which the scheduler starts incremental syncs: the allowed range is provider-aware and returned in the response; values outside it are rejected rather than clamped; 0 resets to the provider default; changing it re-anchors the next sync so a shorter cadence takes effect immediately. `credentials` reconnects the connector in place: send the provider's full credential set (what create accepts); supplied keys replace their stored values, other stored keys survive, the bundle is re-validated against the provider's credential schema, and a pending needs-reauth flag is cleared — the connector keeps its id, resources, and sync cursors.
+     * Update a connector's mutable settings. `sync_interval_seconds` sets the cadence at which the scheduler starts incremental syncs: the allowed range is provider-aware and returned in the response; values outside it are rejected rather than clamped; 0 resets to the provider default; changing it re-anchors the next sync so a shorter cadence takes effect immediately. `credentials` reconnects the connector in place: send the provider's full credential set (what create accepts); supplied keys replace their stored values, other stored keys survive, the bundle is re-validated against the provider's credential schema, and a pending needs-reauth flag is cleared — the connector keeps its id, resources, and sync cursors. `custom_instructions` replaces the free-text steering applied when this connector's documents are ingested (an explicit empty string clears it); the change applies from the next sync cycle and does not re-process already-ingested documents. When several fields are supplied together they are validated up front and applied atomically: an invalid value rejects the whole request with nothing changed.
      *
      * @param {HydraDB.HandlerConnectorUpdateReq} request
      * @param {ConnectorsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -973,6 +973,87 @@ class ConnectorsClient {
         }
         return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "DELETE", "/connectors/{id}/resources/{resource_id}");
     }
+    /**
+     * Updates per-resource settings. `acl` sets the customer-declared ACL for one connector resource (PRO-1684): the rule is normalized (emails prefixed, __public__ dominates, explicit-empty becomes __private__), persisted on the resource, and applied to enforcement immediately via the resource's ACL row, every already-indexed document of the resource is governed by it on the next query, with no re-sync. For providers with provider-derived ACL capture enabled, the provider's own ACL takes precedence again at the next sync; the rule is the standing fallback. `custom_instructions` sets the resource-level ingestion-instructions override (max 4000 characters): when set it replaces the connector-level custom_instructions for documents synced from this resource, an explicit empty string clears the override back to inheriting the connector's value, and changes apply from the next sync cycle. At least one field must be supplied; omitted fields are left unchanged.
+     *
+     * @param {HydraDB.UpdateResourceAclConnectorsRequest} request
+     * @param {ConnectorsClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link HydraDB.BadRequestError}
+     * @throws {@link HydraDB.NotFoundError}
+     * @throws {@link HydraDB.InternalServerError}
+     *
+     * @example
+     *     await client.connectors.updateResourceAcl({
+     *         id: "HydraDoc1234",
+     *         resourceId: "C0123456789",
+     *         body: {
+     *             "key": "value"
+     *         }
+     *     })
+     */
+    updateResourceAcl(request, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__updateResourceAcl(request, requestOptions));
+    }
+    async __updateResourceAcl(request, requestOptions) {
+        const { id, resourceId, body: _body } = request;
+        const _authRequest = await this._options.authProvider.getAuthRequest();
+        const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, this._options?.headers, (0, headers_js_1.mergeOnlyDefinedHeaders)({ "API-Version": requestOptions?.apiVersion ?? this._options?.apiVersion ?? "2" }), requestOptions?.headers);
+        const _response = await core.fetcher({
+            url: core.url.join((await core.Supplier.get(this._options.baseUrl)) ??
+                (await core.Supplier.get(this._options.environment)) ??
+                environments.HydraDBEnvironment.Default, `connectors/${core.url.encodePathParam(id)}/resources/${core.url.encodePathParam(resourceId)}`),
+            method: "PATCH",
+            headers: _headers,
+            contentType: "application/json",
+            queryString: core.url.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+            requestType: "json",
+            body: serializers.connectors.updateResourceAcl.Request.jsonOrThrow(_body, {
+                unrecognizedObjectKeys: "strip",
+                omitUndefined: true,
+            }),
+            timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1000,
+            maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+            abortSignal: requestOptions?.abortSignal,
+            fetchFn: this._options?.fetch,
+            logging: this._options.logging,
+        });
+        if (_response.ok) {
+            return {
+                data: serializers.connectors.updateResourceAcl.Response.parseOrThrow(_response.body, {
+                    unrecognizedObjectKeys: "passthrough",
+                    allowUnrecognizedUnionMembers: true,
+                    allowUnrecognizedEnumValues: true,
+                    skipValidation: true,
+                    breadcrumbsPrefix: ["response"],
+                }),
+                rawResponse: _response.rawResponse,
+            };
+        }
+        if (_response.error.reason === "status-code") {
+            switch (_response.error.statusCode) {
+                case 400:
+                    throw new HydraDB.BadRequestError(serializers.HandlerErrorResponse.parseOrThrow(_response.error.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }), _response.rawResponse);
+                case 404:
+                    throw new HydraDB.NotFoundError(_response.error.body, _response.rawResponse);
+                case 500:
+                    throw new HydraDB.InternalServerError(_response.error.body, _response.rawResponse);
+                default:
+                    throw new errors.HydraDBError({
+                        statusCode: _response.error.statusCode,
+                        body: _response.error.body,
+                        rawResponse: _response.rawResponse,
+                    });
+            }
+        }
+        return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "PATCH", "/connectors/{id}/resources/{resource_id}");
+    }
     /**
      * Report whether a connector is working, in one call: a rollup status (healthy, degraded, failed, checking) plus per-resource detail. `degraded` means the connector is syncing but at least one configured resource is failing — the state that is otherwise invisible, because a connector whose resources partly fail still reports an idle sync status and no error.
      *

package/dist/api/resources/connectors/client/requests/HandlerConnectorCreateReq.d.ts

@@ -11,6 +11,12 @@ export interface HandlerConnectorCreateReq {
     collection?: string;
     /** Provider-specific credentials (typically `{"api_token": "..."}` or `{"access_token": "..."}`). */
     credentials?: Record<string, unknown>;
+    /**
+     * CustomInstructions optionally steers how this connector's synced
+     * documents are ingested and indexed. Max 4000 characters; editable later
+     * via PATCH.
+     */
+    customInstructions?: string;
     /**
      * Database/Collection are the canonical v2 names; TenantID/SubTenantID are
      * their deprecated aliases, reconciled by the TenantAliases middleware before

package/dist/api/resources/connectors/client/requests/HandlerConnectorUpdateReq.d.ts

@@ -9,6 +9,12 @@ export interface HandlerConnectorUpdateReq {
     id: string;
     /** Provider-specific credentials (typically `{"api_token": "..."}` or `{"access_token": "..."}`). */
     credentials?: Record<string, unknown>;
+    /**
+     * CustomInstructions replaces the guidance applied when this connector's
+     * documents are ingested. Omitted leaves it unchanged; an explicit empty
+     * string clears it. Max 4000 characters; applies from the next sync cycle.
+     */
+    customInstructions?: string;
     /** How frequently the scheduler triggers incremental syncs, in seconds. Bounded per provider; send 0 or omit to use the provider default. Change it later with PATCH /connectors/{id}. */
     syncIntervalSeconds?: number;
 }

package/dist/api/resources/connectors/client/requests/HandlerResourceCreateReq.d.ts

@@ -8,9 +8,21 @@
 export interface HandlerResourceCreateReq {
     /** Connector ID */
     id: string;
+    /**
+     * ACL restricts every object synced from this resource to the listed
+     * principals (see resourceMapping.ACL). Omitted means unrestricted.
+     */
+    acl?: string[];
     /** Key-value pairs merged into document metadata on every synced object from this resource. Capped at 1 KiB, measured on the compact JSON encoding of the whole map in UTF-8 bytes — keys, quotes, commas and braces count toward the budget. The cap is applied when synced objects are ingested, not to this request. */
     additionalMetadata?: Record<string, unknown>;
     collectionOverride?: string;
+    /**
+     * CustomInstructions optionally steers how documents synced from this
+     * resource are ingested and indexed. When set it replaces the
+     * connector-level custom_instructions for this resource; empty inherits
+     * the connector's value. Max 4000 characters.
+     */
+    customInstructions?: string;
     databaseOverride?: string;
     /** Human-readable name for this resource. */
     displayName?: string;

package/dist/api/resources/connectors/client/requests/UpdateResourceAclConnectorsRequest.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @example
+ *     {
+ *         id: "HydraDoc1234",
+ *         resourceId: "C0123456789",
+ *         body: {
+ *             "key": "value"
+ *         }
+ *     }
+ */
+export interface UpdateResourceAclConnectorsRequest {
+    /** Connector ID */
+    id: string;
+    /** Resource ID */
+    resourceId: string;
+    body: Record<string, unknown>;
+}

package/dist/api/resources/connectors/client/requests/UpdateResourceAclConnectorsRequest.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/api/resources/connectors/client/requests/index.d.ts

@@ -12,3 +12,4 @@ export type { ListResourcesConnectorsRequest } from "./ListResourcesConnectorsRe
 export type { PatchConnectorsIdCredentialsRequest } from "./PatchConnectorsIdCredentialsRequest.js";
 export type { StatusConnectorsRequest } from "./StatusConnectorsRequest.js";
 export type { SyncConnectorsRequest } from "./SyncConnectorsRequest.js";
+export type { UpdateResourceAclConnectorsRequest } from "./UpdateResourceAclConnectorsRequest.js";

package/dist/api/resources/context/client/Client.d.ts

@@ -131,6 +131,25 @@ export declare class ContextClient {
      */
     status(request: HydraDB.StatusContextRequest, requestOptions?: ContextClient.RequestOptions): core.HttpResponsePromise<HydraDB.HandlerEnvelopeIngestionV2BatchProcessingStatus>;
     private __status;
+    /**
+     * Return the connected subgraph of a source: every source reachable from it through source-level relations (RELATES_TO edges, shared thread, parent/child hierarchy, traversed BFS), the relations among them, and the auxiliary graph around them (entities, comments, attachments, actors). Chunk-level entity relations are not included.
+     *
+     * @param {HydraDB.SubgraphContextRequest} request
+     * @param {ContextClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link HydraDB.BadRequestError}
+     *
+     * @example
+     *     await client.context.subgraph({
+     *         database: "acme_corp",
+     *         collection: "team_docs",
+     *         tenantId: "tenant_1234",
+     *         subTenantId: "sub_tenant_4567",
+     *         id: "HydraDoc1234"
+     *     })
+     */
+    subgraph(request: HydraDB.SubgraphContextRequest, requestOptions?: ContextClient.RequestOptions): core.HttpResponsePromise<HydraDB.HandlerEnvelopeGraphSourceSubgraphResponse>;
+    private __subgraph;
     /**
      * Merge/upsert database_metadata and additional_metadata for one source. collection is required.
      *

package/dist/api/resources/context/client/Client.js

@@ -299,7 +299,7 @@ class ContextClient {
         return core.HttpResponsePromise.fromPromise(this.__inspect(request, requestOptions));
     }
     async __inspect(request, requestOptions) {
-        const { id, database, collection, tenantId, subTenantId, expirySeconds, mode } = request;
+        const { id, database, collection, tenantId, subTenantId, expirySeconds, mode, acl } = request;
         const _queryParams = {
             id,
             database,
@@ -308,6 +308,7 @@ class ContextClient {
             sub_tenant_id: subTenantId,
             expiry_seconds: expirySeconds,
             mode,
+            acl,
         };
         const _authRequest = await this._options.authProvider.getAuthRequest();
         const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, this._options?.headers, (0, headers_js_1.mergeOnlyDefinedHeaders)({ "API-Version": requestOptions?.apiVersion ?? this._options?.apiVersion ?? "2" }), requestOptions?.headers);
@@ -451,7 +452,7 @@ class ContextClient {
         return core.HttpResponsePromise.fromPromise(this.__relations(request, requestOptions));
     }
     async __relations(request, requestOptions) {
-        const { database, collection, tenantId, subTenantId, id, type: type_, limit, cursor } = request;
+        const { database, collection, tenantId, subTenantId, id, type: type_, limit, cursor, acl } = request;
         const _queryParams = {
             database,
             collection,
@@ -466,6 +467,7 @@ class ContextClient {
                 : undefined,
             limit,
             cursor,
+            acl,
         };
         const _authRequest = await this._options.authProvider.getAuthRequest();
         const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, this._options?.headers, (0, headers_js_1.mergeOnlyDefinedHeaders)({ "API-Version": requestOptions?.apiVersion ?? this._options?.apiVersion ?? "2" }), requestOptions?.headers);
@@ -599,6 +601,95 @@ class ContextClient {
         }
         return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "GET", "/context/status");
     }
+    /**
+     * Return the connected subgraph of a source: every source reachable from it through source-level relations (RELATES_TO edges, shared thread, parent/child hierarchy, traversed BFS), the relations among them, and the auxiliary graph around them (entities, comments, attachments, actors). Chunk-level entity relations are not included.
+     *
+     * @param {HydraDB.SubgraphContextRequest} request
+     * @param {ContextClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link HydraDB.BadRequestError}
+     *
+     * @example
+     *     await client.context.subgraph({
+     *         database: "acme_corp",
+     *         collection: "team_docs",
+     *         tenantId: "tenant_1234",
+     *         subTenantId: "sub_tenant_4567",
+     *         id: "HydraDoc1234"
+     *     })
+     */
+    subgraph(request, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__subgraph(request, requestOptions));
+    }
+    async __subgraph(request, requestOptions) {
+        const { database, collection, tenantId, subTenantId, id, type: type_, depth, maxSources, acl } = request;
+        const _queryParams = {
+            database,
+            collection,
+            tenant_id: tenantId,
+            sub_tenant_id: subTenantId,
+            id,
+            type: type_ != null
+                ? serializers.SubgraphContextRequestType.jsonOrThrow(type_, {
+                    unrecognizedObjectKeys: "strip",
+                    omitUndefined: true,
+                })
+                : undefined,
+            depth,
+            max_sources: maxSources,
+            acl,
+        };
+        const _authRequest = await this._options.authProvider.getAuthRequest();
+        const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, this._options?.headers, (0, headers_js_1.mergeOnlyDefinedHeaders)({ "API-Version": requestOptions?.apiVersion ?? this._options?.apiVersion ?? "2" }), requestOptions?.headers);
+        const _response = await core.fetcher({
+            url: core.url.join((await core.Supplier.get(this._options.baseUrl)) ??
+                (await core.Supplier.get(this._options.environment)) ??
+                environments.HydraDBEnvironment.Default, "context/subgraph"),
+            method: "GET",
+            headers: _headers,
+            queryString: core.url
+                .queryBuilder()
+                .addMany(_queryParams)
+                .mergeAdditional(requestOptions?.queryParams)
+                .build(),
+            timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1000,
+            maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+            abortSignal: requestOptions?.abortSignal,
+            fetchFn: this._options?.fetch,
+            logging: this._options.logging,
+        });
+        if (_response.ok) {
+            return {
+                data: serializers.HandlerEnvelopeGraphSourceSubgraphResponse.parseOrThrow(_response.body, {
+                    unrecognizedObjectKeys: "passthrough",
+                    allowUnrecognizedUnionMembers: true,
+                    allowUnrecognizedEnumValues: true,
+                    skipValidation: true,
+                    breadcrumbsPrefix: ["response"],
+                }),
+                rawResponse: _response.rawResponse,
+            };
+        }
+        if (_response.error.reason === "status-code") {
+            switch (_response.error.statusCode) {
+                case 400:
+                    throw new HydraDB.BadRequestError(serializers.HandlerErrorResponse.parseOrThrow(_response.error.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }), _response.rawResponse);
+                default:
+                    throw new errors.HydraDBError({
+                        statusCode: _response.error.statusCode,
+                        body: _response.error.body,
+                        rawResponse: _response.rawResponse,
+                    });
+            }
+        }
+        return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "GET", "/context/subgraph");
+    }
     /**
      * Merge/upsert database_metadata and additional_metadata for one source. collection is required.
      *

package/dist/api/resources/context/client/requests/HandlerContextMetadataUpdateRequest.d.ts

@@ -7,6 +7,20 @@
 export interface HandlerContextMetadataUpdateRequest {
     /** Source ID */
     id: string;
+    /**
+     * ACL, when present, REPLACES the source's access-control list without
+     * re-ingestion (PRO-1684): pass the COMPLETE new allow-list (adding a
+     * third user means sending all three), an empty list to make the source
+     * private, or ["__public__"] to open it to every identified caller. A
+     * pointer so omitted (nil, ACL untouched) is distinguishable from an
+     * explicit empty list (private).
+     * ACL uses RawMessage so the handler can tell three wire states apart:
+     * absent (leave the stored ACL untouched), explicit null (revoke to
+     * nobody, JSON-merge-patch semantics), and a list (replace). A plain
+     * *[]string cannot: encoding/json leaves the pointer nil for BOTH
+     * absent and null, which silently ignored an explicit null revocation.
+     */
+    acl?: string[];
     /** Free-form key-value pairs to merge into the source's `additional_metadata`. The only accepted spelling for document metadata on this endpoint. Capped at 1 KiB, measured on the compact JSON encoding of the whole map in UTF-8 bytes — keys, quotes, commas and braces count toward the budget. Over-cap returns 400 with the actual byte count. */
     additionalMetadata?: Record<string, unknown>;
     /** Collection scope. Defaults to the default collection when omitted. Formerly `sub_tenant_id`; the `sub_tenant_id` alias is still accepted (deprecated). */

package/dist/api/resources/context/client/requests/IngestContextRequest.d.ts

@@ -7,7 +7,7 @@ import type * as HydraDB from "../../../../index.js";
  *     }
  */
 export interface IngestContextRequest {
-    /** App-knowledge items as a JSON array (type=knowledge). Per item, `metadata` is capped at 16 KiB and `additional_metadata` at 1 KiB, measured on the compact JSON encoding of the whole map in UTF-8 bytes (keys and punctuation count). The deprecated `tenant_metadata` / `document_metadata` spellings are accepted here and held to the same caps. Over-cap returns 400 with the actual byte count. */
+    /** App-knowledge items as a JSON array (type=knowledge). Per item, `metadata` is capped at 16 KiB and `additional_metadata` at 1 KiB, measured on the compact JSON encoding of the whole map in UTF-8 bytes (keys and punctuation count). The deprecated `tenant_metadata` / `document_metadata` spellings are accepted here and held to the same caps. Over-cap returns 400 with the actual byte count. Each item may also carry `acl`, a list of principals (`user_email:<email>`, a bare email, `group:<provider>:<id>`, `domain:<domain>`, or `__public__`) restricting who may retrieve it; omit it to leave the document unrestricted, and send an empty list to restrict it to nobody. A malformed principal rejects the whole request with 400. */
     appKnowledge?: string;
     collection?: string;
     database: string;

package/dist/api/resources/context/client/requests/InspectContextRequest.d.ts

@@ -24,4 +24,6 @@ export interface InspectContextRequest {
     expirySeconds?: number;
     /** Fetch mode */
     mode?: string;
+    /** Principals to answer as (PRO-1684 document ACLs): the source must be visible to them, or the response is 404. Repeated (acl=a&acl=b) or comma-separated. Omit for no ACL scoping. */
+    acl?: string | string[];
 }

package/dist/api/resources/context/client/requests/ListV2ListContentRequest.d.ts

@@ -4,6 +4,8 @@ import type * as HydraDB from "../../../../index.js";
  *     {}
  */
 export interface ListV2ListContentRequest {
+    /** ACL: see ListContentRequest.ACL (PRO-1684 document ACLs). */
+    acl?: string[];
     /** Collection scope. Defaults to the default collection when omitted. Formerly `sub_tenant_id`; the `sub_tenant_id` alias is still accepted (deprecated). */
     collection?: string;
     /**

package/dist/api/resources/context/client/requests/RelationsContextRequest.d.ts

@@ -26,4 +26,6 @@ export interface RelationsContextRequest {
     limit?: number;
     /** Pagination cursor */
     cursor?: number;
+    /** Principals to answer as (PRO-1684 document ACLs): only relations attributable to sources they may see are returned. Repeated (acl=a&acl=b) or comma-separated. Omit for no ACL scoping. */
+    acl?: string | string[];
 }

package/dist/api/resources/context/client/requests/SubgraphContextRequest.d.ts

@@ -0,0 +1,31 @@
+import type * as HydraDB from "../../../../index.js";
+/**
+ * @example
+ *     {
+ *         database: "acme_corp",
+ *         collection: "team_docs",
+ *         tenantId: "tenant_1234",
+ *         subTenantId: "sub_tenant_4567",
+ *         id: "HydraDoc1234"
+ *     }
+ */
+export interface SubgraphContextRequest {
+    /** Database (canonical name for the tenant scope) */
+    database: string;
+    /** Collection (canonical name for the sub-tenant scope) */
+    collection?: string;
+    /** Deprecated alias for database */
+    tenantId?: string;
+    /** Deprecated alias for collection */
+    subTenantId?: string;
+    /** Seed source ID */
+    id: string;
+    /** Corpus type: 'knowledge' or 'memory' */
+    type?: HydraDB.SubgraphContextRequestType;
+    /** Max BFS depth */
+    depth?: number;
+    /** Max subgraph members */
+    maxSources?: number;
+    /** Principals to answer as (PRO-1684 document ACLs): the subgraph contains only sources they may see, filtered at every hop. Repeated (acl=a&acl=b) or comma-separated. Omit for no ACL scoping. */
+    acl?: string | string[];
+}

package/dist/api/resources/context/client/requests/SubgraphContextRequest.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/api/resources/context/client/requests/index.d.ts

@@ -5,3 +5,4 @@ export type { ListV2ListContentRequest } from "./ListV2ListContentRequest.js";
 export type { RelationsContextRequest } from "./RelationsContextRequest.js";
 export type { SourcesV2SourceDeleteRequest } from "./SourcesV2SourceDeleteRequest.js";
 export type { StatusContextRequest } from "./StatusContextRequest.js";
+export type { SubgraphContextRequest } from "./SubgraphContextRequest.js";

package/dist/api/resources/context/types/SubgraphContextRequestType.d.ts

@@ -0,0 +1,5 @@
+export declare const SubgraphContextRequestType: {
+    readonly Knowledge: "knowledge";
+    readonly Memory: "memory";
+};
+export type SubgraphContextRequestType = (typeof SubgraphContextRequestType)[keyof typeof SubgraphContextRequestType];

package/dist/api/resources/context/types/SubgraphContextRequestType.js

@@ -0,0 +1,8 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SubgraphContextRequestType = void 0;
+exports.SubgraphContextRequestType = {
+    Knowledge: "knowledge",
+    Memory: "memory",
+};

package/dist/api/resources/context/types/index.d.ts

@@ -3,3 +3,4 @@ export * from "./IngestContextRequestType.js";
 export * from "./ListV2ListContentRequestType.js";
 export * from "./RelationsContextRequestType.js";
 export * from "./SourcesV2SourceDeleteRequestType.js";
+export * from "./SubgraphContextRequestType.js";

package/dist/api/resources/context/types/index.js

@@ -19,3 +19,4 @@ __exportStar(require("./IngestContextRequestType.js"), exports);
 __exportStar(require("./ListV2ListContentRequestType.js"), exports);
 __exportStar(require("./RelationsContextRequestType.js"), exports);
 __exportStar(require("./SourcesV2SourceDeleteRequestType.js"), exports);
+__exportStar(require("./SubgraphContextRequestType.js"), exports);

package/dist/api/resources/webhooks/client/Client.d.ts

@@ -124,4 +124,23 @@ export declare class WebhooksClient {
      */
     test(requestOptions?: WebhooksClient.RequestOptions): core.HttpResponsePromise<HydraDB.HandlerEnvelopeWebhooksWebhookTestResponse>;
     private __test;
+    /**
+     * Ingest a Supabase INSERT/UPDATE/DELETE row change into the graph.
+     *
+     * @param {HydraDB.PostWebhooksSupabaseRequest} request
+     * @param {WebhooksClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link HydraDB.BadRequestError}
+     * @throws {@link HydraDB.NotFoundError}
+     *
+     * @example
+     *     await client.webhooks.supabaseRowChangeWebhook({
+     *         hydraDbConnector: "X-HydraDB-Connector",
+     *         body: {
+     *             "key": "value"
+     *         }
+     *     })
+     */
+    supabaseRowChangeWebhook(request: HydraDB.PostWebhooksSupabaseRequest, requestOptions?: WebhooksClient.RequestOptions): core.HttpResponsePromise<HydraDB.HandlerEnvelopeHandlerSupabaseWebhookAck>;
+    private __supabaseRowChangeWebhook;
 }

package/dist/api/resources/webhooks/client/Client.js

@@ -576,5 +576,85 @@ class WebhooksClient {
         }
         return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "POST", "/webhooks/indexing/test");
     }
+    /**
+     * Ingest a Supabase INSERT/UPDATE/DELETE row change into the graph.
+     *
+     * @param {HydraDB.PostWebhooksSupabaseRequest} request
+     * @param {WebhooksClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link HydraDB.BadRequestError}
+     * @throws {@link HydraDB.NotFoundError}
+     *
+     * @example
+     *     await client.webhooks.supabaseRowChangeWebhook({
+     *         hydraDbConnector: "X-HydraDB-Connector",
+     *         body: {
+     *             "key": "value"
+     *         }
+     *     })
+     */
+    supabaseRowChangeWebhook(request, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__supabaseRowChangeWebhook(request, requestOptions));
+    }
+    async __supabaseRowChangeWebhook(request, requestOptions) {
+        const { hydraDbConnector, body: _body } = request;
+        const _authRequest = await this._options.authProvider.getAuthRequest();
+        const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, this._options?.headers, (0, headers_js_1.mergeOnlyDefinedHeaders)({
+            "X-HydraDB-Connector": hydraDbConnector,
+            "API-Version": requestOptions?.apiVersion ?? this._options?.apiVersion ?? "2",
+        }), requestOptions?.headers);
+        const _response = await core.fetcher({
+            url: core.url.join((await core.Supplier.get(this._options.baseUrl)) ??
+                (await core.Supplier.get(this._options.environment)) ??
+                environments.HydraDBEnvironment.Default, "webhooks/supabase"),
+            method: "POST",
+            headers: _headers,
+            contentType: "application/json",
+            queryString: core.url.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+            requestType: "json",
+            body: serializers.webhooks.supabaseRowChangeWebhook.Request.jsonOrThrow(_body, {
+                unrecognizedObjectKeys: "strip",
+                omitUndefined: true,
+            }),
+            timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1000,
+            maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+            abortSignal: requestOptions?.abortSignal,
+            fetchFn: this._options?.fetch,
+            logging: this._options.logging,
+        });
+        if (_response.ok) {
+            return {
+                data: serializers.HandlerEnvelopeHandlerSupabaseWebhookAck.parseOrThrow(_response.body, {
+                    unrecognizedObjectKeys: "passthrough",
+                    allowUnrecognizedUnionMembers: true,
+                    allowUnrecognizedEnumValues: true,
+                    skipValidation: true,
+                    breadcrumbsPrefix: ["response"],
+                }),
+                rawResponse: _response.rawResponse,
+            };
+        }
+        if (_response.error.reason === "status-code") {
+            switch (_response.error.statusCode) {
+                case 400:
+                    throw new HydraDB.BadRequestError(serializers.HandlerErrorResponse.parseOrThrow(_response.error.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }), _response.rawResponse);
+                case 404:
+                    throw new HydraDB.NotFoundError(_response.error.body, _response.rawResponse);
+                default:
+                    throw new errors.HydraDBError({
+                        statusCode: _response.error.statusCode,
+                        body: _response.error.body,
+                        rawResponse: _response.rawResponse,
+                    });
+            }
+        }
+        return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "POST", "/webhooks/supabase");
+    }
 }
 exports.WebhooksClient = WebhooksClient;