@opengeni/sdk 0.29.0 → 0.33.1

package/README.md

@@ -8,6 +8,11 @@ helpers for proxying the stream through your own API.
 Zero runtime dependencies. Needs only WHATWG `fetch` and streams, so it runs in
 Node 18+, Bun, Deno, browsers, and edge runtimes.
 
+Browser clients may call the public API from any origin with an API key or
+other bearer credential. Browser cookies are accepted cross-origin only from
+operator-configured trusted origins; arbitrary embedding origins never receive
+credentialed CORS responses.
+
 ## Quick start
 
 ```ts
@@ -32,7 +37,37 @@ for await (const event of client.streamEvents(workspaceId, session.id)) {
 }
 ```
 
-Omit `firstPartyMcpTools` for the minimal self-management default. An explicit
+## Workspace artifacts
+
+Workspace artifacts are generic, immutable HTML publications. The SDK does not
+assign product types such as app, page, dashboard, or gallery. List pages are
+bounded and expose both `truncated` and an opaque `nextCursor` so callers never
+mistake a partial page for the complete workspace catalog.
+
+The initial web renderer supports semantic HTML, inline CSS, CSS-only
+interactions, and inline SVG. It removes JavaScript, event handlers, forms,
+embeds, external URLs, and other active or navigation-capable markup before
+rendering. Executable artifacts require a later, stronger isolation boundary.
+
+```ts
+let cursor: string | undefined;
+do {
+  const page = await client.listWorkspaceArtifacts(workspaceId, {
+    limit: 50,
+    ...(cursor ? { cursor } : {}),
+  });
+  for (const artifact of page.artifacts) console.log(artifact.title);
+  cursor = page.nextCursor ?? undefined;
+} while (cursor);
+```
+
+Creation and publication require a caller-supplied idempotency key. Reuse the
+same key only to retry the same logical mutation. Agent-authored versions also
+return the exact source session, turn, attempt, and execution generation that
+published them. Version and event history are bounded; inspect
+`versionsTruncated` and `eventsTruncated` on the detail response.
+
+Omit `firstPartyMcpTools` for the complete OpenGeni tool catalog. An explicit
 `[]` exposes no broad first-party tools; attached resources and separately
 selected `files`/`docs` MCP servers are unaffected.
 
@@ -210,9 +245,12 @@ await client.sendApprovalDecision(workspaceId, sessionId, { approvalId, decision
 ## Session tool policy and native web search
 
 Omitting `tools` when creating a top-level session selects the current
-workspace-default capability policy. Supported Responses providers can then
-attach their native bounded web-search tool without requiring a sandbox.
-Passing `tools`, including `[]`, is an intentional fixed narrowing.
+workspace-default capability policy, including the built-in `files` server.
+Passing `tools`, including `[]`, is an intentional fixed narrowing and can
+therefore disable file-download access for that session. OpenGeni's own web UI
+keeps `files` enabled as a hidden default, while API and embedded clients retain
+exact control over the explicit list. Supported Responses providers attach
+their native bounded web-search tool independently of this MCP policy.
 
 Existing explicit sessions are not widened when a new default capability is
 introduced. Opt one in explicitly with the current optimistic-concurrency
@@ -255,6 +293,11 @@ await client.resumeGoal(workspaceId, sessionId); // resets counters, re-arms con
 `uploadFile` wraps the three-step flow (begin → signed PUT → complete) in one
 call; the lower-level steps are exported for resumable/custom flows.
 
+Browser hosts need no storage credentials or per-application registration.
+OpenGeni authorizes the workspace request and returns a short-lived,
+object-scoped signed URL; operators must configure the private object store to
+allow CORS from `*` so any product embedding the SDK can use that URL.
+
 ```ts
 const file = await client.uploadFile(workspaceId, {
   filename: "incident-notes.md",

package/dist/artifact-client.d.ts

@@ -0,0 +1,11 @@
+import { OpenGeniClient as OpenGeniCoreClient } from "./client";
+import type { CreateWorkspaceArtifactRequest, PublishWorkspaceArtifactVersionRequest, RollbackWorkspaceArtifactRequest, WorkspaceArtifactContentResponse, WorkspaceArtifactDetailResponse, WorkspaceArtifactListOptions, WorkspaceArtifactListResponse, WorkspaceArtifactMutationResponse } from "./workspace-artifacts";
+/** Public SDK client. Artifact operations stay out of the console's eager core graph. */
+export declare class OpenGeniClient extends OpenGeniCoreClient {
+    listWorkspaceArtifacts(workspaceId: string, options?: WorkspaceArtifactListOptions): Promise<WorkspaceArtifactListResponse>;
+    getWorkspaceArtifact(workspaceId: string, artifactId: string): Promise<WorkspaceArtifactDetailResponse>;
+    getWorkspaceArtifactContent(workspaceId: string, artifactId: string, versionId?: string): Promise<WorkspaceArtifactContentResponse>;
+    createWorkspaceArtifact(workspaceId: string, request: CreateWorkspaceArtifactRequest): Promise<WorkspaceArtifactMutationResponse>;
+    publishWorkspaceArtifactVersion(workspaceId: string, artifactId: string, request: PublishWorkspaceArtifactVersionRequest): Promise<WorkspaceArtifactMutationResponse>;
+    rollbackWorkspaceArtifact(workspaceId: string, artifactId: string, request: RollbackWorkspaceArtifactRequest): Promise<WorkspaceArtifactMutationResponse>;
+}