@opengeni/sdk 0.52.1 → 1.0.0

package/dist/chunk-LY2K6ELJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/chat/ids.ts","../src/tenant-workspaces.ts"],"sourcesContent":["/**\n * Deterministic chat identities. A conversation id maps to exactly one\n * session id per workspace, so any process can address the same session\n * without storing a mapping, and a double-submitted create collapses through\n * the idempotency key. The optional legacy label argument is retained only to\n * reproduce historical addresses. New chat calls do not use it: authorization\n * is independent of addressing, so collaborators can share a conversation.\n */\n\n/** The end-user label a conversation is namespaced to: the product `source` plus the opaque user id. */\nexport type ChatUserLabel = { source: string; id: string };\n\n/** Fixed RFC 4122 namespace for chat session ids. Never change it. */\nexport const CHAT_SESSION_NAMESPACE = \"7c1e6d3a-5b2f-4e8a-9d4c-0f3b6a8e2c17\";\n\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\n/** RFC 4122 version 5 (SHA-1) UUID of `name` inside `namespace`. */\nexport async function uuidV5(name: string, namespace: string): Promise<string> {\n  const namespaceBytes = parseUuid(namespace);\n  const nameBytes = new TextEncoder().encode(name);\n  const input = new Uint8Array(namespaceBytes.length + nameBytes.length);\n  input.set(namespaceBytes, 0);\n  input.set(nameBytes, namespaceBytes.length);\n  const digest = new Uint8Array(await crypto.subtle.digest(\"SHA-1\", input)).slice(0, 16);\n  digest[6] = ((digest[6] ?? 0) & 0x0f) | 0x50;\n  digest[8] = ((digest[8] ?? 0) & 0x3f) | 0x80;\n  return formatUuid(digest);\n}\n\n/**\n * The session id of `conversation` in `workspaceId`: RFC 4122 v5 of the JSON\n * tuple `[workspaceId, conversation]`, or `[workspaceId, source, id, conversation]`\n * when the conversation belongs to an end user. JSON encoding keeps the tuple\n * unambiguous: an id containing `:` or any other delimiter can never make two\n * different (user, conversation) pairs share a session.\n */\nexport async function chatSessionId(\n  workspaceId: string,\n  conversation: string,\n  user?: ChatUserLabel | undefined,\n): Promise<string> {\n  return await uuidV5(chatIdentityName(workspaceId, conversation, user), CHAT_SESSION_NAMESPACE);\n}\n\n/** The exact v5 name behind {@link chatSessionId}; exported for tests and audits. */\nexport function chatIdentityName(\n  workspaceId: string,\n  conversation: string,\n  user?: ChatUserLabel | undefined,\n): string {\n  return JSON.stringify(\n    user ? [workspaceId, user.source, user.id, conversation] : [workspaceId, conversation],\n  );\n}\n\n/**\n * The create idempotency key for a chat session: `chat:<sessionId>`. The\n * session id already encodes the workspace, user label, and conversation as an\n * unambiguous tuple, so the key inherits that and stays bounded.\n */\nexport function chatIdempotencyKey(sessionId: string): string {\n  return `chat:${sessionId}`;\n}\n\nexport function isUuid(value: string): boolean {\n  return UUID_PATTERN.test(value);\n}\n\nfunction parseUuid(value: string): Uint8Array {\n  if (!UUID_PATTERN.test(value)) {\n    throw new TypeError(`Invalid UUID namespace: ${value}`);\n  }\n  const hex = value.replace(/-/g, \"\");\n  const bytes = new Uint8Array(16);\n  for (let index = 0; index < 16; index += 1) {\n    bytes[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);\n  }\n  return bytes;\n}\n\nfunction formatUuid(bytes: Uint8Array): string {\n  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;\n}\n","import type { OpenGeniEmbeddingClient } from \"./embedding-client\";\nimport type { Permission } from \"./types\";\nimport { OpenGeniApiError } from \"./errors\";\nimport { uuidV5 } from \"./chat/ids\";\n\nconst ISOLATION_NAMESPACE = \"fc398712-b4db-5b0b-8842-57cb4f2a65f9\";\n/**\n * Conversation-only member permissions. The API grants exactly this set when\n * an organization key first acts as a user on a workspace (keep equal to\n * `EXTERNAL_FIRST_USE_MEMBER_PERMISSIONS` in `packages/core/src/access`).\n */\nconst CONVERSATION_PERMISSIONS = [\n  \"workspace:read\",\n  \"sessions:create\",\n  \"sessions:read\",\n  \"sessions:control\",\n  \"files:upload\",\n  \"files:read\",\n  \"mcp_servers:attach\",\n] as const;\n\nexport type WorkspaceIdTarget = {\n  /**\n   * Your tenant id. With user isolation and no tenant, the user gets one\n   * workspace of their own, independent of any tenant.\n   */\n  tenant?: string | undefined;\n  user?: string | undefined;\n  /** External user identity source; defaults to the resolver's source. */\n  source?: string | undefined;\n};\n\nexport type WorkspaceIdOptions = {\n  /**\n   * `tenant`: one workspace per tenant. `user`: a separate workspace for the\n   * user (per tenant when a tenant is given, otherwise one per user).\n   */\n  isolation: \"tenant\" | \"user\";\n};\n\nexport type WorkspaceIdResolverOptions = {\n  /** The organization id, or a lazy lookup (for example derived from the API key). */\n  organizationId: string | (() => Promise<string>);\n  source: string;\n  /** Workspace display name; receives the tenant id, or the user id for a per-user workspace. */\n  workspaceName?: ((tenant: string) => string) | undefined;\n  /**\n   * Per-user workspaces only (user isolation): permissions for the one member\n   * this resolver adds explicitly, its owner. Replaces the defaults: workspace\n   * read, session create/read/control (including sending messages), file\n   * upload/read, and attaching the host's per-session MCP servers. No admin\n   * permissions are granted by default. Tenant workspaces rely on the API,\n   * which adds a missing member with those defaults on their first request.\n   * Existing grants are never changed here; change them with\n   * `updateExternalWorkspaceMember`. The organization API key must also allow\n   * the selected permissions.\n   */\n  memberPermissions?: readonly Permission[] | undefined;\n};\n\n/**\n * Server-only workspace resolution using external workspace provisioning.\n * Workspaces are created on first use and cached. A tenant workspace's members\n * are added by the API on their first `asUser` request (the organization key\n * needs `members:manage`). A per-user workspace stays single-user: the API\n * never auto-admits anyone there, and this resolver adds its owner with a\n * stable onboarding key, so retries never restore a revoked grant.\n */\nexport function createWorkspaceIdResolver(\n  client: Pick<OpenGeniEmbeddingClient, \"ensureWorkspace\" | \"addExternalWorkspaceMember\">,\n  options: WorkspaceIdResolverOptions,\n): (target: WorkspaceIdTarget, resolution: WorkspaceIdOptions) => Promise<string> {\n  const memberPermissions = [...(options.memberPermissions ?? CONVERSATION_PERMISSIONS)];\n  const cache = new Map<string, Promise<string>>();\n  const organizationId = async () =>\n    typeof options.organizationId === \"function\"\n      ? await options.organizationId()\n      : options.organizationId;\n  return async (target, resolution) => {\n    const isolated = resolution.isolation === \"user\";\n    if (!isolated && !target.tenant) throw new TypeError(\"workspaceIdFor requires a tenant.\");\n    if (isolated && !target.user) {\n      throw new TypeError(\"User isolation requires an authenticated product user.\");\n    }\n    const source = target.source ?? options.source;\n    // A per-user workspace without a tenant has its own key shape, so it can\n    // never alias a tenant-scoped isolated workspace.\n    const key = target.tenant\n      ? JSON.stringify([\n          resolution.isolation,\n          options.source,\n          source,\n          target.tenant,\n          isolated ? target.user : null,\n        ])\n      : JSON.stringify([\"user\", options.source, source, target.user]);\n    let pending = cache.get(key);\n    if (!pending) {\n      pending = (async () => {\n        const productSource = options.source.trim();\n        const isolatedSource = `opengeni-sdk:user-isolation:${await uuidV5(productSource, ISOLATION_NAMESPACE)}`;\n        const label = target.tenant ?? target.user!;\n        const { workspace } = await client.ensureWorkspace({\n          accountId: await organizationId(),\n          externalSource: isolated\n            ? isolatedSource === productSource\n              ? `${isolatedSource}:user`\n              : isolatedSource\n            : options.source,\n          externalId: isolated ? await uuidV5(key, ISOLATION_NAMESPACE) : target.tenant!,\n          name: options.workspaceName?.(label) ?? label,\n        });\n        if (isolated) {\n          try {\n            await client.addExternalWorkspaceMember(workspace.id, {\n              identity: { source, externalId: target.user! },\n              permissions: [...memberPermissions],\n              operationId: await uuidV5(\n                JSON.stringify([\"member\", workspace.id, source, target.user]),\n                ISOLATION_NAMESPACE,\n              ),\n            });\n          } catch (error) {\n            // Defaults/custom permissions may have changed since this stable\n            // onboarding key committed, or the grant may have been cancelled.\n            // A definitive conflict must never mint a new key or update access.\n            // Return only the address: every asUser operation still checks the\n            // live membership, including reduced or withdrawn permissions.\n            if (\n              !(error instanceof OpenGeniApiError) ||\n              error.status !== 409 ||\n              error.code !== \"conflict\" ||\n              error.outcomeUnknown\n            )\n              throw error;\n          }\n        }\n        return workspace.id;\n      })();\n      pending.catch(() => {\n        if (cache.get(key) === pending) cache.delete(key);\n      });\n      if (cache.size >= 1_000) cache.delete(cache.keys().next().value!);\n      cache.set(key, pending);\n    }\n    return await pending;\n  };\n}\n"],"mappings":";;;;;AAaO,IAAM,yBAAyB;AAEtC,IAAM,eAAe;AAGrB,eAAsB,OAAO,MAAc,WAAoC;AAC7E,QAAM,iBAAiB,UAAU,SAAS;AAC1C,QAAM,YAAY,IAAI,YAAY,EAAE,OAAO,IAAI;AAC/C,QAAM,QAAQ,IAAI,WAAW,eAAe,SAAS,UAAU,MAAM;AACrE,QAAM,IAAI,gBAAgB,CAAC;AAC3B,QAAM,IAAI,WAAW,eAAe,MAAM;AAC1C,QAAM,SAAS,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,SAAS,KAAK,CAAC,EAAE,MAAM,GAAG,EAAE;AACrF,SAAO,CAAC,KAAM,OAAO,CAAC,KAAK,KAAK,KAAQ;AACxC,SAAO,CAAC,KAAM,OAAO,CAAC,KAAK,KAAK,KAAQ;AACxC,SAAO,WAAW,MAAM;AAC1B;AASA,eAAsB,cACpB,aACA,cACA,MACiB;AACjB,SAAO,MAAM,OAAO,iBAAiB,aAAa,cAAc,IAAI,GAAG,sBAAsB;AAC/F;AAGO,SAAS,iBACd,aACA,cACA,MACQ;AACR,SAAO,KAAK;AAAA,IACV,OAAO,CAAC,aAAa,KAAK,QAAQ,KAAK,IAAI,YAAY,IAAI,CAAC,aAAa,YAAY;AAAA,EACvF;AACF;AAOO,SAAS,mBAAmB,WAA2B;AAC5D,SAAO,QAAQ,SAAS;AAC1B;AAEO,SAAS,OAAO,OAAwB;AAC7C,SAAO,aAAa,KAAK,KAAK;AAChC;AAEA,SAAS,UAAU,OAA2B;AAC5C,MAAI,CAAC,aAAa,KAAK,KAAK,GAAG;AAC7B,UAAM,IAAI,UAAU,2BAA2B,KAAK,EAAE;AAAA,EACxD;AACA,QAAM,MAAM,MAAM,QAAQ,MAAM,EAAE;AAClC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,WAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS,GAAG;AAC1C,UAAM,KAAK,IAAI,OAAO,SAAS,IAAI,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAA2B;AAC7C,QAAM,MAAM,MAAM,KAAK,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACnF,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;AAC9G;;;AC/EA,IAAM,sBAAsB;AAM5B,IAAM,2BAA2B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAiDO,SAAS,0BACd,QACA,SACgF;AAChF,QAAM,oBAAoB,CAAC,GAAI,QAAQ,qBAAqB,wBAAyB;AACrF,QAAM,QAAQ,oBAAI,IAA6B;AAC/C,QAAM,iBAAiB,YACrB,OAAO,QAAQ,mBAAmB,aAC9B,MAAM,QAAQ,eAAe,IAC7B,QAAQ;AACd,SAAO,OAAO,QAAQ,eAAe;AACnC,UAAM,WAAW,WAAW,cAAc;AAC1C,QAAI,CAAC,YAAY,CAAC,OAAO,OAAQ,OAAM,IAAI,UAAU,mCAAmC;AACxF,QAAI,YAAY,CAAC,OAAO,MAAM;AAC5B,YAAM,IAAI,UAAU,wDAAwD;AAAA,IAC9E;AACA,UAAM,SAAS,OAAO,UAAU,QAAQ;AAGxC,UAAM,MAAM,OAAO,SACf,KAAK,UAAU;AAAA,MACb,WAAW;AAAA,MACX,QAAQ;AAAA,MACR;AAAA,MACA,OAAO;AAAA,MACP,WAAW,OAAO,OAAO;AAAA,IAC3B,CAAC,IACD,KAAK,UAAU,CAAC,QAAQ,QAAQ,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAChE,QAAI,UAAU,MAAM,IAAI,GAAG;AAC3B,QAAI,CAAC,SAAS;AACZ,iBAAW,YAAY;AACrB,cAAM,gBAAgB,QAAQ,OAAO,KAAK;AAC1C,cAAM,iBAAiB,+BAA+B,MAAM,OAAO,eAAe,mBAAmB,CAAC;AACtG,cAAM,QAAQ,OAAO,UAAU,OAAO;AACtC,cAAM,EAAE,UAAU,IAAI,MAAM,OAAO,gBAAgB;AAAA,UACjD,WAAW,MAAM,eAAe;AAAA,UAChC,gBAAgB,WACZ,mBAAmB,gBACjB,GAAG,cAAc,UACjB,iBACF,QAAQ;AAAA,UACZ,YAAY,WAAW,MAAM,OAAO,KAAK,mBAAmB,IAAI,OAAO;AAAA,UACvE,MAAM,QAAQ,gBAAgB,KAAK,KAAK;AAAA,QAC1C,CAAC;AACD,YAAI,UAAU;AACZ,cAAI;AACF,kBAAM,OAAO,2BAA2B,UAAU,IAAI;AAAA,cACpD,UAAU,EAAE,QAAQ,YAAY,OAAO,KAAM;AAAA,cAC7C,aAAa,CAAC,GAAG,iBAAiB;AAAA,cAClC,aAAa,MAAM;AAAA,gBACjB,KAAK,UAAU,CAAC,UAAU,UAAU,IAAI,QAAQ,OAAO,IAAI,CAAC;AAAA,gBAC5D;AAAA,cACF;AAAA,YACF,CAAC;AAAA,UACH,SAAS,OAAO;AAMd,gBACE,EAAE,iBAAiB,qBACnB,MAAM,WAAW,OACjB,MAAM,SAAS,cACf,MAAM;AAEN,oBAAM;AAAA,UACV;AAAA,QACF;AACA,eAAO,UAAU;AAAA,MACnB,GAAG;AACH,cAAQ,MAAM,MAAM;AAClB,YAAI,MAAM,IAAI,GAAG,MAAM,QAAS,OAAM,OAAO,GAAG;AAAA,MAClD,CAAC;AACD,UAAI,MAAM,QAAQ,IAAO,OAAM,OAAO,MAAM,KAAK,EAAE,KAAK,EAAE,KAAM;AAChE,YAAM,IAAI,KAAK,OAAO;AAAA,IACxB;AACA,WAAO,MAAM;AAAA,EACf;AACF;","names":[]}

package/dist/chunk-MOTJYIYL.js

@@ -0,0 +1,340 @@
+import {
+  OpenGeniClient
+} from "./chunk-AH5D5Q5V.js";
+
+// src/embedding-client.ts
+function hasStaticHeader(options, names) {
+  return typeof options.headers !== "function" && Object.keys(options.headers ?? {}).some((key) => names.includes(key.toLowerCase()));
+}
+function serializeServiceContext(context) {
+  if (!context || typeof context !== "object" || Array.isArray(context) || Object.getPrototypeOf(context) !== Object.prototype && Object.getPrototypeOf(context) !== null)
+    throw new Error("Invalid service context: expected a flat JSON object");
+  const snapshot = /* @__PURE__ */ Object.create(null);
+  for (const [key, value] of Object.entries(context)) {
+    if (typeof value !== "string" && typeof value !== "boolean" && !(typeof value === "number" && Number.isFinite(value)))
+      throw new Error(
+        "Invalid service context: values must be strings, finite numbers, or booleans"
+      );
+    snapshot[key] = value;
+  }
+  const json = JSON.stringify(snapshot).replace(
+    /[\u007f-\uffff]/g,
+    (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`
+  );
+  if (new TextEncoder().encode(json).byteLength > 2048)
+    throw new Error("Invalid service context: serialized JSON must not exceed 2 KiB");
+  return json;
+}
+var OpenGeniEmbeddingClient = class extends OpenGeniClient {
+  /** Read configuration (null means no configured ceiling). Requires admin or organization-key read authority. */
+  async getWorkspaceAllowance(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance`);
+  }
+  /**
+   * Read the lifecycle version even after clear (config=null). version=0 means
+   * never configured. Use the returned version to recreate or reconcile a 409;
+   * do not guess a CAS version or silently retry a new mutation.
+   * Requires the same budget-read authority as getWorkspaceAllowance.
+   */
+  async getWorkspaceAllowanceState(workspaceId) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance/state`
+    );
+  }
+  /**
+   * Set a USD-micro ceiling with exact-version CAS (0 only for first creation;
+   * after clear reuse its returned version or getWorkspaceAllowanceState). Requires
+   * organization key-control authority or account:admin, never workspace admin
+   * alone. Shares may oversubscribe the pool; actual post-call settlement can
+   * overshoot before the next admission check.
+   */
+  async setWorkspaceAllowance(workspaceId, request) {
+    return this.requestJson(
+      "PUT",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance`,
+      request
+    );
+  }
+  /**
+   * Clear with the exact version; grants and settled usage are not a billing
+   * refund. Supply operationId and replay the exact request after a lost response.
+   * Replays recheck authority and conflict after a later lifecycle change.
+   * On 409 read getWorkspaceAllowanceState before deciding on a new operation.
+   */
+  async clearWorkspaceAllowance(workspaceId, request) {
+    return this.requestJson(
+      "DELETE",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance`,
+      request
+    );
+  }
+  /** Grant USD micros once. Reuse the operationId and exact request after an uncertain response. */
+  async grantWorkspaceCredits(workspaceId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance/grants`,
+      request
+    );
+  }
+  /**
+   * Administer an existing member by canonical subject or external identity.
+   * null restores memberDefault; shares >1 are valid ceilings, not reservations.
+   * Concurrent calls may exceed the ceiling until their actual cost settles.
+   */
+  async setMemberAllowance(workspaceId, member, request) {
+    const path = typeof member === "string" ? encodeURIComponent(member) : `external/${encodeURIComponent(member.source)}/${encodeURIComponent(member.externalId)}`;
+    return this.requestJson(
+      "PUT",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/members/${path}/allowance`,
+      request
+    );
+  }
+  /** Paginated settled usage, current or YYYY-MM. Requires admin or organization-key read authority. */
+  async getUsage(workspaceId, query = {}, options = {}) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/usage`,
+      void 0,
+      usageQuery(query),
+      options
+    );
+  }
+  /** Own usage only. On your backend use asUser(authenticatedUser); subject selectors are not accepted. */
+  async getMyUsage(workspaceId, query = {}, options = {}) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/usage/me`,
+      void 0,
+      usageQuery(query),
+      options
+    );
+  }
+  /** Recover this actor's connection creation result without resending secrets.
+   * A 404 means no visible committed result, not proof that an in-flight write failed. */
+  async getConnectionCreationResult(workspaceId, operationId) {
+    const response = await this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/connections/operations/${encodeURIComponent(operationId)}`
+    );
+    return response.connection;
+  }
+  /** Rotate existing inline credentials only while no credential-consuming work
+   * is pending or active. Reuse the operation key and exact request to reconcile
+   * a lost response. This operation never schedules or retries model work. */
+  async rotateSessionMcpCredentials(workspaceId, sessionId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/mcp-credentials/rotate`,
+      request
+    );
+  }
+  /** Contract-checked successful JSON GET with its headers intact, for same-origin
+   * proxies that must forward paging metadata. Non-2xx responses throw. */
+  async requestJsonResponse(path, query = {}, options = {}) {
+    return await this.requestResponse("GET", path, query, {
+      ...options,
+      accept: "application/json"
+    });
+  }
+  /** Server-side organization-key client scoped to one host-authenticated user.
+   * Does not mutate this client, provision workspace membership, or link native
+   * identities. The API verifies key and membership authority on each request. */
+  asUser(externalId, options = {}) {
+    if (typeof window !== "undefined")
+      throw new Error("asUser is a server-side API; keep organization keys on your backend");
+    if (this.serviceInitiatorHeader !== void 0 || hasStaticHeader(this.options, ["x-opengeni-service-initiator", "x-opengeni-service-context"]))
+      throw new Error(
+        "asUser and asService are mutually exclusive; start from the unscoped client"
+      );
+    const source = options.source ?? "default";
+    const validOpaqueText = (value, maxBytes) => typeof value === "string" && value.length > 0 && value.length <= maxBytes && !value.includes("\0") && !/[\uD800-\uDFFF]/u.test(value) && new TextEncoder().encode(value).byteLength <= maxBytes;
+    if (!validOpaqueText(externalId, 1024) || !validOpaqueText(source, 200)) {
+      throw new Error("Invalid external identity reference");
+    }
+    const Client = this.constructor;
+    const client = new Client({ ...this.options });
+    client.externalActorHeader = encodeURIComponent(
+      JSON.stringify({ mode: "external", identity: { externalId, source } })
+    );
+    return client;
+  }
+  /** Server-side automation attribution under this client's existing credential.
+   * Returns a new client of the same class; grants no permissions or human/personal
+   * resource authority. Cannot be combined with asUser or asLinkedUser.
+   * Reapplying asService replaces the name and context rather than merging them. */
+  asService(name, context) {
+    if (typeof window !== "undefined")
+      throw new Error("asService is a server-side API; keep API keys on your backend");
+    if (this.externalActorHeader !== void 0 || hasStaticHeader(this.options, ["x-opengeni-external-actor"]))
+      throw new Error(
+        "asUser and asService are mutually exclusive; start from the unscoped client"
+      );
+    if (typeof name !== "string" || !/^[a-z0-9][a-z0-9:._-]{0,63}$/.test(name) || name.trim() !== name)
+      throw new Error("Invalid service initiator name");
+    const serializedContext = context === void 0 ? void 0 : serializeServiceContext(context);
+    const Client = this.constructor;
+    const client = new Client({ ...this.options });
+    client.serviceInitiatorHeader = name;
+    client.serviceContextHeader = serializedContext;
+    return client;
+  }
+  /** Explicitly use a confirmed native delegation. Unlike asUser, new resources
+   * belong to the native user. Existing external resources are never reassigned.
+   * A stale, expired or revoked link is rejected by the server on every request. */
+  asLinkedUser(externalId, options) {
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(options.linkId) || !Number.isSafeInteger(options.expectedLinkRevision) || options.expectedLinkRevision < 1)
+      throw new Error("A confirmed identity link and its exact revision are required");
+    const client = this.asUser(
+      externalId,
+      options.source === void 0 ? {} : { source: options.source }
+    );
+    const identity = JSON.parse(decodeURIComponent(client.externalActorHeader)).identity;
+    client.externalActorHeader = encodeURIComponent(
+      JSON.stringify({
+        mode: "linked_native",
+        identity,
+        linkId: options.linkId,
+        expectedLinkRevision: options.expectedLinkRevision
+      })
+    );
+    return client;
+  }
+  /** Optional native-account delegation. Invoke on a server-side asUser client.
+   * Pass the one-time challenge to the native consent screen, never a URL query
+   * or analytics event. Ordinary external embedding needs none of this. */
+  async beginIdentityLink(workspaceId, input) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links`,
+      input
+    );
+  }
+  async getIdentityLink(workspaceId, linkId) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}`
+    );
+  }
+  /** Only links belonging to the effective participant; no organization-wide directory. */
+  async listIdentityLinks(workspaceId, cursor) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`
+    );
+  }
+  /** Requires a canonical native browser session, not an organization API key. */
+  async previewIdentityLink(workspaceId, linkId, challenge) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/preview`,
+      { challenge }
+    );
+  }
+  async confirmIdentityLink(workspaceId, linkId, input) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/confirm`,
+      input
+    );
+  }
+  async revokeIdentityLink(workspaceId, linkId, expectedRevision) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/revoke`,
+      { expectedRevision }
+    );
+  }
+  /** Service-only lifecycle for an external actor's organization membership.
+   * A successful reactivation does not restore revoked workspace grants. */
+  async updateExternalIdentityMembership(organizationId, membershipId, request, options = {}) {
+    return this.requestJson(
+      "PATCH",
+      `/v1/organizations/${encodeURIComponent(organizationId)}/external-members/${encodeURIComponent(membershipId)}`,
+      request,
+      void 0,
+      options
+    );
+  }
+  /** Non-provisioning, content-free service lookup, including inactive identities. */
+  async lookupExternalIdentity(organizationId, identity) {
+    return this.requestJson(
+      "POST",
+      `/v1/organizations/${encodeURIComponent(organizationId)}/external-identities/lookup`,
+      identity
+    );
+  }
+  /** Withdraw an external member's shared-workspace access and fence an exact
+   * pending keyed grant. Reuse the exact cancellation body after response loss. */
+  async cancelExternalWorkspaceMemberGrant(organizationId, workspaceId, membershipId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/organizations/${encodeURIComponent(organizationId)}/workspaces/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(membershipId)}/revoke`,
+      request
+    );
+  }
+  /** Replace an existing external member's permissions in one shared
+   * workspace. Keyed by `operationId`: reuse the exact body after response
+   * loss. Narrowing makes live authority re-check; nothing is cancelled. */
+  async updateExternalWorkspaceMember(organizationId, workspaceId, membershipId, request) {
+    return this.requestJson(
+      "PATCH",
+      `/v1/organizations/${encodeURIComponent(organizationId)}/workspaces/${encodeURIComponent(workspaceId)}/external-members/${encodeURIComponent(membershipId)}`,
+      request
+    );
+  }
+  async listConnectProviders(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/connect/catalog`);
+  }
+  async listConnectAccounts(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/connect/accounts`);
+  }
+  async getConnectAttempt(workspaceId, attemptId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}`);
+  }
+  async listPendingConnectAttempts(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/connect/attempts`);
+  }
+  async advanceConnectAttempt(workspaceId, attemptId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}/advance`,
+      request
+    );
+  }
+  /** Stops setup; does not revoke already committed provider credentials. */
+  async cancelConnectAttempt(workspaceId, attemptId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}/cancel`,
+      request
+    );
+  }
+  /**
+   * Explicit organization-service-key onboarding with chosen permissions. Not
+   * needed for the default path: an `asUser` request through a key with
+   * `members:manage` adds a missing member with conversation permissions on
+   * first use. Change an existing member with `updateExternalWorkspaceMember`.
+   */
+  async addExternalWorkspaceMember(workspaceId, request) {
+    return this.requestJson("POST", `/v1/workspaces/${workspaceId}/external-members`, request);
+  }
+};
+function usageQuery(query) {
+  return Object.fromEntries(
+    Object.entries(query).filter(([, value]) => value !== void 0).map(([key, value]) => [key, String(value)])
+  );
+}
+
+// ../contracts/src/session-final-reply.ts
+var EMPTY_FINAL_REPLY_NOTICE = "The model returned no final reply after a reply reminder. Completed work is preserved; the goal and later updates are unaffected.";
+function turnCompletedWithEmptyFinalReply(payload) {
+  return payload !== null && typeof payload === "object" && !Array.isArray(payload) && payload.emptyFinalReply === true;
+}
+
+export {
+  OpenGeniEmbeddingClient,
+  EMPTY_FINAL_REPLY_NOTICE,
+  turnCompletedWithEmptyFinalReply
+};
+//# sourceMappingURL=chunk-MOTJYIYL.js.map

package/dist/chunk-MOTJYIYL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/embedding-client.ts","../../contracts/src/session-final-reply.ts"],"sourcesContent":["import { OpenGeniClient as OpenGeniArtifactClient } from \"./artifact-client\";\nimport type { OpenGeniClientOptions } from \"./client\";\nimport type { AddWorkspaceMemberRequest } from \"./types\";\nimport type {\n  ExternalIdentityLink,\n  BeginExternalIdentityLinkRequest,\n  BeginExternalIdentityLinkResponse,\n  ConfirmExternalIdentityLinkRequest,\n  ExternalIdentityLinkPreview,\n  ExternalIdentityLinkPage,\n} from \"@opengeni/contracts/external-identities\";\n\n/** Non-secret service attribution, serialized as a flat JSON object of at most 2 KiB. */\nexport type ServiceContext = Record<string, string | number | boolean>;\n\nfunction hasStaticHeader(options: OpenGeniClientOptions, names: string[]): boolean {\n  return (\n    typeof options.headers !== \"function\" &&\n    Object.keys(options.headers ?? {}).some((key) => names.includes(key.toLowerCase()))\n  );\n}\n\nfunction serializeServiceContext(context: ServiceContext): string {\n  if (\n    !context ||\n    typeof context !== \"object\" ||\n    Array.isArray(context) ||\n    (Object.getPrototypeOf(context) !== Object.prototype && Object.getPrototypeOf(context) !== null)\n  )\n    throw new Error(\"Invalid service context: expected a flat JSON object\");\n  const snapshot: ServiceContext = Object.create(null);\n  for (const [key, value] of Object.entries(context)) {\n    if (\n      typeof value !== \"string\" &&\n      typeof value !== \"boolean\" &&\n      !(typeof value === \"number\" && Number.isFinite(value))\n    )\n      throw new Error(\n        \"Invalid service context: values must be strings, finite numbers, or booleans\",\n      );\n    snapshot[key] = value;\n  }\n  // HTTP Headers require byte strings. JSON escapes preserve Unicode without\n  // percent-encoding the object or passing non-byte characters to fetch.\n  const json = JSON.stringify(snapshot).replace(\n    /[\\u007f-\\uffff]/g,\n    (character) => `\\\\u${character.charCodeAt(0).toString(16).padStart(4, \"0\")}`,\n  );\n  if (new TextEncoder().encode(json).byteLength > 2048)\n    throw new Error(\"Invalid service context: serialized JSON must not exceed 2 KiB\");\n  return json;\n}\n\n/** Public product embedding administration, kept out of the native browser client. */\nexport class OpenGeniEmbeddingClient extends OpenGeniArtifactClient {\n  /** Read configuration (null means no configured ceiling). Requires admin or organization-key read authority. */\n  async getWorkspaceAllowance(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").WorkspaceAllowance | null> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance`);\n  }\n\n  /**\n   * Read the lifecycle version even after clear (config=null). version=0 means\n   * never configured. Use the returned version to recreate or reconcile a 409;\n   * do not guess a CAS version or silently retry a new mutation.\n   * Requires the same budget-read authority as getWorkspaceAllowance.\n   */\n  async getWorkspaceAllowanceState(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").WorkspaceAllowanceState> {\n    return this.requestJson(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance/state`,\n    );\n  }\n\n  /**\n   * Set a USD-micro ceiling with exact-version CAS (0 only for first creation;\n   * after clear reuse its returned version or getWorkspaceAllowanceState). Requires\n   * organization key-control authority or account:admin, never workspace admin\n   * alone. Shares may oversubscribe the pool; actual post-call settlement can\n   * overshoot before the next admission check.\n   */\n  async setWorkspaceAllowance(\n    workspaceId: string,\n    request: import(\"@opengeni/contracts/usage-allowances\").SetWorkspaceAllowanceRequest,\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").WorkspaceAllowance> {\n    return this.requestJson(\n      \"PUT\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance`,\n      request,\n    );\n  }\n\n  /**\n   * Clear with the exact version; grants and settled usage are not a billing\n   * refund. Supply operationId and replay the exact request after a lost response.\n   * Replays recheck authority and conflict after a later lifecycle change.\n   * On 409 read getWorkspaceAllowanceState before deciding on a new operation.\n   */\n  async clearWorkspaceAllowance(\n    workspaceId: string,\n    request: import(\"@opengeni/contracts/usage-allowances\").ClearWorkspaceAllowanceRequest,\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").ClearWorkspaceAllowanceResponse> {\n    return this.requestJson(\n      \"DELETE\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance`,\n      request,\n    );\n  }\n\n  /** Grant USD micros once. Reuse the operationId and exact request after an uncertain response. */\n  async grantWorkspaceCredits(\n    workspaceId: string,\n    request: import(\"@opengeni/contracts/usage-allowances\").GrantWorkspaceCreditsRequest,\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").WorkspaceCreditGrant> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance/grants`,\n      request,\n    );\n  }\n\n  /**\n   * Administer an existing member by canonical subject or external identity.\n   * null restores memberDefault; shares >1 are valid ceilings, not reservations.\n   * Concurrent calls may exceed the ceiling until their actual cost settles.\n   */\n  async setMemberAllowance(\n    workspaceId: string,\n    member: string | { source: string; externalId: string },\n    request: import(\"@opengeni/contracts/usage-allowances\").SetMemberAllowanceRequest,\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").MemberAllowance> {\n    const path =\n      typeof member === \"string\"\n        ? encodeURIComponent(member)\n        : `external/${encodeURIComponent(member.source)}/${encodeURIComponent(member.externalId)}`;\n    return this.requestJson(\n      \"PUT\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/members/${path}/allowance`,\n      request,\n    );\n  }\n\n  /** Paginated settled usage, current or YYYY-MM. Requires admin or organization-key read authority. */\n  async getUsage(\n    workspaceId: string,\n    query: import(\"@opengeni/contracts/usage-allowances\").GetUsageRequest = {},\n    options: import(\"./client\").OpenGeniRequestOptions = {},\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").WorkspaceUsageResponse> {\n    return this.requestJson(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/usage`,\n      undefined,\n      usageQuery(query),\n      options,\n    );\n  }\n\n  /** Own usage only. On your backend use asUser(authenticatedUser); subject selectors are not accepted. */\n  async getMyUsage(\n    workspaceId: string,\n    query: import(\"@opengeni/contracts/usage-allowances\").GetMyUsageRequest = {},\n    options: import(\"./client\").OpenGeniRequestOptions = {},\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").WorkspaceUsageResponse> {\n    return this.requestJson(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/usage/me`,\n      undefined,\n      usageQuery(query),\n      options,\n    );\n  }\n\n  /** Recover this actor's connection creation result without resending secrets.\n   * A 404 means no visible committed result, not proof that an in-flight write failed. */\n  async getConnectionCreationResult(\n    workspaceId: string,\n    operationId: string,\n  ): Promise<import(\"./types\").ConnectionMetadata> {\n    const response = await this.requestJson<import(\"./types\").ConnectionResponse>(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/connections/operations/${encodeURIComponent(operationId)}`,\n    );\n    return response.connection;\n  }\n\n  /** Rotate existing inline credentials only while no credential-consuming work\n   * is pending or active. Reuse the operation key and exact request to reconcile\n   * a lost response. This operation never schedules or retries model work. */\n  async rotateSessionMcpCredentials(\n    workspaceId: string,\n    sessionId: string,\n    request: import(\"./types\").RotateSessionMcpCredentialsRequest,\n  ): Promise<import(\"./types\").RotateSessionMcpCredentialsReceipt> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/mcp-credentials/rotate`,\n      request,\n    );\n  }\n\n  /** Contract-checked successful JSON GET with its headers intact, for same-origin\n   * proxies that must forward paging metadata. Non-2xx responses throw. */\n  async requestJsonResponse(\n    path: string,\n    query: Record<string, string> = {},\n    options: import(\"./client\").OpenGeniRequestOptions = {},\n  ): Promise<import(\"./client\").FetchResponse> {\n    return await this.requestResponse(\"GET\", path, query, {\n      ...options,\n      accept: \"application/json\",\n    });\n  }\n\n  /** Server-side organization-key client scoped to one host-authenticated user.\n   * Does not mutate this client, provision workspace membership, or link native\n   * identities. The API verifies key and membership authority on each request. */\n  asUser(externalId: string, options: { source?: string } = {}): this {\n    if (typeof window !== \"undefined\")\n      throw new Error(\"asUser is a server-side API; keep organization keys on your backend\");\n    if (\n      this.serviceInitiatorHeader !== undefined ||\n      hasStaticHeader(this.options, [\"x-opengeni-service-initiator\", \"x-opengeni-service-context\"])\n    )\n      throw new Error(\n        \"asUser and asService are mutually exclusive; start from the unscoped client\",\n      );\n    const source = options.source ?? \"default\";\n    const validOpaqueText = (value: unknown, maxBytes: number): value is string =>\n      typeof value === \"string\" &&\n      value.length > 0 &&\n      value.length <= maxBytes &&\n      !value.includes(\"\\0\") &&\n      !/[\\uD800-\\uDFFF]/u.test(value) &&\n      new TextEncoder().encode(value).byteLength <= maxBytes;\n    if (!validOpaqueText(externalId, 1024) || !validOpaqueText(source, 200)) {\n      throw new Error(\"Invalid external identity reference\");\n    }\n    const Client = this.constructor as new (options: OpenGeniClientOptions) => this;\n    const client = new Client({ ...this.options });\n    client.externalActorHeader = encodeURIComponent(\n      JSON.stringify({ mode: \"external\", identity: { externalId, source } }),\n    );\n    return client;\n  }\n\n  /** Server-side automation attribution under this client's existing credential.\n   * Returns a new client of the same class; grants no permissions or human/personal\n   * resource authority. Cannot be combined with asUser or asLinkedUser.\n   * Reapplying asService replaces the name and context rather than merging them. */\n  asService(name: string, context?: ServiceContext): this {\n    if (typeof window !== \"undefined\")\n      throw new Error(\"asService is a server-side API; keep API keys on your backend\");\n    if (\n      this.externalActorHeader !== undefined ||\n      hasStaticHeader(this.options, [\"x-opengeni-external-actor\"])\n    )\n      throw new Error(\n        \"asUser and asService are mutually exclusive; start from the unscoped client\",\n      );\n    if (\n      typeof name !== \"string\" ||\n      !/^[a-z0-9][a-z0-9:._-]{0,63}$/.test(name) ||\n      name.trim() !== name\n    )\n      throw new Error(\"Invalid service initiator name\");\n    const serializedContext = context === undefined ? undefined : serializeServiceContext(context);\n    const Client = this.constructor as new (options: OpenGeniClientOptions) => this;\n    const client = new Client({ ...this.options });\n    client.serviceInitiatorHeader = name;\n    client.serviceContextHeader = serializedContext;\n    return client;\n  }\n\n  /** Explicitly use a confirmed native delegation. Unlike asUser, new resources\n   * belong to the native user. Existing external resources are never reassigned.\n   * A stale, expired or revoked link is rejected by the server on every request. */\n  asLinkedUser(\n    externalId: string,\n    options: { source?: string; linkId: string; expectedLinkRevision: number },\n  ): this {\n    if (\n      !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(options.linkId) ||\n      !Number.isSafeInteger(options.expectedLinkRevision) ||\n      options.expectedLinkRevision < 1\n    )\n      throw new Error(\"A confirmed identity link and its exact revision are required\");\n    const client = this.asUser(\n      externalId,\n      options.source === undefined ? {} : { source: options.source },\n    );\n    const identity = JSON.parse(decodeURIComponent(client.externalActorHeader!)).identity;\n    client.externalActorHeader = encodeURIComponent(\n      JSON.stringify({\n        mode: \"linked_native\",\n        identity,\n        linkId: options.linkId,\n        expectedLinkRevision: options.expectedLinkRevision,\n      }),\n    );\n    return client;\n  }\n\n  /** Optional native-account delegation. Invoke on a server-side asUser client.\n   * Pass the one-time challenge to the native consent screen, never a URL query\n   * or analytics event. Ordinary external embedding needs none of this. */\n  async beginIdentityLink(\n    workspaceId: string,\n    input: BeginExternalIdentityLinkRequest,\n  ): Promise<BeginExternalIdentityLinkResponse> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links`,\n      input,\n    );\n  }\n\n  async getIdentityLink(workspaceId: string, linkId: string): Promise<ExternalIdentityLink> {\n    return this.requestJson(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}`,\n    );\n  }\n\n  /** Only links belonging to the effective participant; no organization-wide directory. */\n  async listIdentityLinks(workspaceId: string, cursor?: string): Promise<ExternalIdentityLinkPage> {\n    return this.requestJson(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links${cursor ? `?cursor=${encodeURIComponent(cursor)}` : \"\"}`,\n    );\n  }\n\n  /** Requires a canonical native browser session, not an organization API key. */\n  async previewIdentityLink(\n    workspaceId: string,\n    linkId: string,\n    challenge: string,\n  ): Promise<ExternalIdentityLinkPreview> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/preview`,\n      { challenge },\n    );\n  }\n\n  async confirmIdentityLink(\n    workspaceId: string,\n    linkId: string,\n    input: ConfirmExternalIdentityLinkRequest,\n  ): Promise<ExternalIdentityLink> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/confirm`,\n      input,\n    );\n  }\n\n  async revokeIdentityLink(\n    workspaceId: string,\n    linkId: string,\n    expectedRevision: number,\n  ): Promise<ExternalIdentityLink> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/revoke`,\n      { expectedRevision },\n    );\n  }\n\n  /** Service-only lifecycle for an external actor's organization membership.\n   * A successful reactivation does not restore revoked workspace grants. */\n  async updateExternalIdentityMembership(\n    organizationId: string,\n    membershipId: string,\n    request: import(\"@opengeni/contracts/external-identities\").UpdateExternalIdentityMembershipRequest,\n    options: { signal?: AbortSignal } = {},\n  ): Promise<import(\"@opengeni/contracts\").OrganizationMember> {\n    return this.requestJson(\n      \"PATCH\",\n      `/v1/organizations/${encodeURIComponent(organizationId)}/external-members/${encodeURIComponent(membershipId)}`,\n      request,\n      undefined,\n      options,\n    );\n  }\n\n  /** Non-provisioning, content-free service lookup, including inactive identities. */\n  async lookupExternalIdentity(\n    organizationId: string,\n    identity: import(\"@opengeni/contracts/external-identities\").ExternalIdentityReference,\n  ): Promise<import(\"@opengeni/contracts/external-identities\").ExternalIdentityLookup> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/organizations/${encodeURIComponent(organizationId)}/external-identities/lookup`,\n      identity,\n    );\n  }\n\n  /** Withdraw an external member's shared-workspace access and fence an exact\n   * pending keyed grant. Reuse the exact cancellation body after response loss. */\n  async cancelExternalWorkspaceMemberGrant(\n    organizationId: string,\n    workspaceId: string,\n    membershipId: string,\n    request: import(\"@opengeni/contracts/external-identities\").CancelExternalWorkspaceMemberGrantRequest,\n  ): Promise<\n    import(\"@opengeni/contracts/external-identities\").CancelExternalWorkspaceMemberGrantResponse\n  > {\n    return this.requestJson(\n      \"POST\",\n      `/v1/organizations/${encodeURIComponent(organizationId)}/workspaces/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(membershipId)}/revoke`,\n      request,\n    );\n  }\n\n  /** Replace an existing external member's permissions in one shared\n   * workspace. Keyed by `operationId`: reuse the exact body after response\n   * loss. Narrowing makes live authority re-check; nothing is cancelled. */\n  async updateExternalWorkspaceMember(\n    organizationId: string,\n    workspaceId: string,\n    membershipId: string,\n    request: import(\"@opengeni/contracts/external-identities\").UpdateExternalWorkspaceMemberRequest,\n  ): Promise<\n    import(\"@opengeni/contracts/external-identities\").UpdateExternalWorkspaceMemberResponse\n  > {\n    return this.requestJson(\n      \"PATCH\",\n      `/v1/organizations/${encodeURIComponent(organizationId)}/workspaces/${encodeURIComponent(workspaceId)}/external-members/${encodeURIComponent(membershipId)}`,\n      request,\n    );\n  }\n\n  async listConnectProviders(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectProvider[]> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/connect/catalog`);\n  }\n\n  async listConnectAccounts(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAccount[]> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/connect/accounts`);\n  }\n\n  async getConnectAttempt(\n    workspaceId: string,\n    attemptId: string,\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAttempt> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}`);\n  }\n\n  async listPendingConnectAttempts(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAttempt[]> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/connect/attempts`);\n  }\n\n  async advanceConnectAttempt(\n    workspaceId: string,\n    attemptId: string,\n    request: {\n      expectedRevision: number;\n      idempotencyKey: string;\n      action: import(\"@opengeni/contracts/connect\").ConnectAdvance;\n    },\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAttempt> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}/advance`,\n      request,\n    );\n  }\n\n  /** Stops setup; does not revoke already committed provider credentials. */\n  async cancelConnectAttempt(\n    workspaceId: string,\n    attemptId: string,\n    request: {\n      expectedRevision: number;\n      idempotencyKey: string;\n    },\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAttempt> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}/cancel`,\n      request,\n    );\n  }\n\n  /**\n   * Explicit organization-service-key onboarding with chosen permissions. Not\n   * needed for the default path: an `asUser` request through a key with\n   * `members:manage` adds a missing member with conversation permissions on\n   * first use. Change an existing member with `updateExternalWorkspaceMember`.\n   */\n  async addExternalWorkspaceMember(\n    workspaceId: string,\n    request: {\n      identity: { externalId: string; source?: string };\n      permissions: AddWorkspaceMemberRequest[\"permissions\"];\n      operationId?: string;\n    },\n  ): Promise<import(\"@opengeni/contracts/external-identities\").ExternalIdentity> {\n    return this.requestJson(\"POST\", `/v1/workspaces/${workspaceId}/external-members`, request);\n  }\n}\n\nfunction usageQuery(\n  query: import(\"@opengeni/contracts/usage-allowances\").GetUsageRequest,\n): Record<string, string> {\n  return Object.fromEntries(\n    Object.entries(query)\n      .filter(([, value]) => value !== undefined)\n      .map(([key, value]) => [key, String(value)]),\n  );\n}\n","/** A response-quality notice, not a failed turn or a completed deliverable. */\nexport const EMPTY_FINAL_REPLY_NOTICE =\n  \"The model returned no final reply after a reply reminder. Completed work is preserved; the goal and later updates are unaffected.\";\n\nexport type EmptyFinalReplyCompletion = {\n  emptyFinalReply: true;\n};\n\nexport function turnCompletedWithEmptyFinalReply(payload: unknown): boolean {\n  return (\n    payload !== null &&\n    typeof payload === \"object\" &&\n    !Array.isArray(payload) &&\n    (payload as { emptyFinalReply?: unknown }).emptyFinalReply === true\n  );\n}\n"],"mappings":";;;;;AAeA,SAAS,gBAAgB,SAAgC,OAA0B;AACjF,SACE,OAAO,QAAQ,YAAY,cAC3B,OAAO,KAAK,QAAQ,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,MAAM,SAAS,IAAI,YAAY,CAAC,CAAC;AAEtF;AAEA,SAAS,wBAAwB,SAAiC;AAChE,MACE,CAAC,WACD,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,KACpB,OAAO,eAAe,OAAO,MAAM,OAAO,aAAa,OAAO,eAAe,OAAO,MAAM;AAE3F,UAAM,IAAI,MAAM,sDAAsD;AACxE,QAAM,WAA2B,uBAAO,OAAO,IAAI;AACnD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QACE,OAAO,UAAU,YACjB,OAAO,UAAU,aACjB,EAAE,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AAEpD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AACF,aAAS,GAAG,IAAI;AAAA,EAClB;AAGA,QAAM,OAAO,KAAK,UAAU,QAAQ,EAAE;AAAA,IACpC;AAAA,IACA,CAAC,cAAc,MAAM,UAAU,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,EAC5E;AACA,MAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa;AAC9C,UAAM,IAAI,MAAM,gEAAgE;AAClF,SAAO;AACT;AAGO,IAAM,0BAAN,cAAsC,eAAuB;AAAA;AAAA,EAElE,MAAM,sBACJ,aACmF;AACnF,WAAO,KAAK,YAAY,OAAO,kBAAkB,mBAAmB,WAAW,CAAC,YAAY;AAAA,EAC9F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,2BACJ,aACiF;AACjF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,IACnD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,sBACJ,aACA,SAC4E;AAC5E,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,wBACJ,aACA,SACyF;AACzF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,sBACJ,aACA,SAC8E;AAC9E,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,mBACJ,aACA,QACA,SACyE;AACzE,UAAM,OACJ,OAAO,WAAW,WACd,mBAAmB,MAAM,IACzB,YAAY,mBAAmB,OAAO,MAAM,CAAC,IAAI,mBAAmB,OAAO,UAAU,CAAC;AAC5F,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,YAAY,IAAI;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SACJ,aACA,QAAwE,CAAC,GACzE,UAAqD,CAAC,GAC0B;AAChF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,MACA,WAAW,KAAK;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,WACJ,aACA,QAA0E,CAAC,GAC3E,UAAqD,CAAC,GAC0B;AAChF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,MACA,WAAW,KAAK;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,4BACJ,aACA,aAC+C;AAC/C,UAAM,WAAW,MAAM,KAAK;AAAA,MAC1B;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,2BAA2B,mBAAmB,WAAW,CAAC;AAAA,IAC7G;AACA,WAAO,SAAS;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,4BACJ,aACA,WACA,SAC+D;AAC/D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,WAAW,aAAa,SAAS;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,oBACJ,MACA,QAAgC,CAAC,GACjC,UAAqD,CAAC,GACX;AAC3C,WAAO,MAAM,KAAK,gBAAgB,OAAO,MAAM,OAAO;AAAA,MACpD,GAAG;AAAA,MACH,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,YAAoB,UAA+B,CAAC,GAAS;AAClE,QAAI,OAAO,WAAW;AACpB,YAAM,IAAI,MAAM,qEAAqE;AACvF,QACE,KAAK,2BAA2B,UAChC,gBAAgB,KAAK,SAAS,CAAC,gCAAgC,4BAA4B,CAAC;AAE5F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AACF,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,kBAAkB,CAAC,OAAgB,aACvC,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,YAChB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,mBAAmB,KAAK,KAAK,KAC9B,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,cAAc;AAChD,QAAI,CAAC,gBAAgB,YAAY,IAAI,KAAK,CAAC,gBAAgB,QAAQ,GAAG,GAAG;AACvE,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AACA,UAAM,SAAS,KAAK;AACpB,UAAM,SAAS,IAAI,OAAO,EAAE,GAAG,KAAK,QAAQ,CAAC;AAC7C,WAAO,sBAAsB;AAAA,MAC3B,KAAK,UAAU,EAAE,MAAM,YAAY,UAAU,EAAE,YAAY,OAAO,EAAE,CAAC;AAAA,IACvE;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,UAAU,MAAc,SAAgC;AACtD,QAAI,OAAO,WAAW;AACpB,YAAM,IAAI,MAAM,+DAA+D;AACjF,QACE,KAAK,wBAAwB,UAC7B,gBAAgB,KAAK,SAAS,CAAC,2BAA2B,CAAC;AAE3D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AACF,QACE,OAAO,SAAS,YAChB,CAAC,+BAA+B,KAAK,IAAI,KACzC,KAAK,KAAK,MAAM;AAEhB,YAAM,IAAI,MAAM,gCAAgC;AAClD,UAAM,oBAAoB,YAAY,SAAY,SAAY,wBAAwB,OAAO;AAC7F,UAAM,SAAS,KAAK;AACpB,UAAM,SAAS,IAAI,OAAO,EAAE,GAAG,KAAK,QAAQ,CAAC;AAC7C,WAAO,yBAAyB;AAChC,WAAO,uBAAuB;AAC9B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,aACE,YACA,SACM;AACN,QACE,CAAC,kEAAkE,KAAK,QAAQ,MAAM,KACtF,CAAC,OAAO,cAAc,QAAQ,oBAAoB,KAClD,QAAQ,uBAAuB;AAE/B,YAAM,IAAI,MAAM,+DAA+D;AACjF,UAAM,SAAS,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,IAC/D;AACA,UAAM,WAAW,KAAK,MAAM,mBAAmB,OAAO,mBAAoB,CAAC,EAAE;AAC7E,WAAO,sBAAsB;AAAA,MAC3B,KAAK,UAAU;AAAA,QACb,MAAM;AAAA,QACN;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,sBAAsB,QAAQ;AAAA,MAChC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBACJ,aACA,OAC4C;AAC5C,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,aAAqB,QAA+C;AACxF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,mBAAmB,mBAAmB,MAAM,CAAC;AAAA,IAChG;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,kBAAkB,aAAqB,QAAoD;AAC/F,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,kBAAkB,SAAS,WAAW,mBAAmB,MAAM,CAAC,KAAK,EAAE;AAAA,IAC1H;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,oBACJ,aACA,QACA,WACsC;AACtC,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,mBAAmB,mBAAmB,MAAM,CAAC;AAAA,MAC9F,EAAE,UAAU;AAAA,IACd;AAAA,EACF;AAAA,EAEA,MAAM,oBACJ,aACA,QACA,OAC+B;AAC/B,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,mBAAmB,mBAAmB,MAAM,CAAC;AAAA,MAC9F;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,mBACJ,aACA,QACA,kBAC+B;AAC/B,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,mBAAmB,mBAAmB,MAAM,CAAC;AAAA,MAC9F,EAAE,iBAAiB;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,iCACJ,gBACA,cACA,SACA,UAAoC,CAAC,GACsB;AAC3D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qBAAqB,mBAAmB,cAAc,CAAC,qBAAqB,mBAAmB,YAAY,CAAC;AAAA,MAC5G;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,uBACJ,gBACA,UACmF;AACnF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,mCACJ,gBACA,aACA,cACA,SAGA;AACA,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qBAAqB,mBAAmB,cAAc,CAAC,eAAe,mBAAmB,WAAW,CAAC,YAAY,mBAAmB,YAAY,CAAC;AAAA,MACjJ;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,8BACJ,gBACA,aACA,cACA,SAGA;AACA,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qBAAqB,mBAAmB,cAAc,CAAC,eAAe,mBAAmB,WAAW,CAAC,qBAAqB,mBAAmB,YAAY,CAAC;AAAA,MAC1J;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,qBACJ,aACkE;AAClE,WAAO,KAAK,YAAY,OAAO,kBAAkB,WAAW,kBAAkB;AAAA,EAChF;AAAA,EAEA,MAAM,oBACJ,aACiE;AACjE,WAAO,KAAK,YAAY,OAAO,kBAAkB,WAAW,mBAAmB;AAAA,EACjF;AAAA,EAEA,MAAM,kBACJ,aACA,WAC+D;AAC/D,WAAO,KAAK,YAAY,OAAO,kBAAkB,WAAW,qBAAqB,SAAS,EAAE;AAAA,EAC9F;AAAA,EAEA,MAAM,2BACJ,aACiE;AACjE,WAAO,KAAK,YAAY,OAAO,kBAAkB,WAAW,mBAAmB;AAAA,EACjF;AAAA,EAEA,MAAM,sBACJ,aACA,WACA,SAK+D;AAC/D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,WAAW,qBAAqB,SAAS;AAAA,MAC3D;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,qBACJ,aACA,WACA,SAI+D;AAC/D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,WAAW,qBAAqB,SAAS;AAAA,MAC3D;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,2BACJ,aACA,SAK6E;AAC7E,WAAO,KAAK,YAAY,QAAQ,kBAAkB,WAAW,qBAAqB,OAAO;AAAA,EAC3F;AACF;AAEA,SAAS,WACP,OACwB;AACxB,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAK,EACjB,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,EACzC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC;AAAA,EAC/C;AACF;;;ACrgBO,IAAM,2BACX;AAMK,SAAS,iCAAiC,SAA2B;AAC1E,SACE,YAAY,QACZ,OAAO,YAAY,YACnB,CAAC,MAAM,QAAQ,OAAO,KACrB,QAA0C,oBAAoB;AAEnE;","names":[]}