@opengeni/sdk 0.57.0 → 1.0.0

package/dist/chunk-MOTJYIYL.js

@@ -0,0 +1,340 @@
+import {
+  OpenGeniClient
+} from "./chunk-AH5D5Q5V.js";
+
+// src/embedding-client.ts
+function hasStaticHeader(options, names) {
+  return typeof options.headers !== "function" && Object.keys(options.headers ?? {}).some((key) => names.includes(key.toLowerCase()));
+}
+function serializeServiceContext(context) {
+  if (!context || typeof context !== "object" || Array.isArray(context) || Object.getPrototypeOf(context) !== Object.prototype && Object.getPrototypeOf(context) !== null)
+    throw new Error("Invalid service context: expected a flat JSON object");
+  const snapshot = /* @__PURE__ */ Object.create(null);
+  for (const [key, value] of Object.entries(context)) {
+    if (typeof value !== "string" && typeof value !== "boolean" && !(typeof value === "number" && Number.isFinite(value)))
+      throw new Error(
+        "Invalid service context: values must be strings, finite numbers, or booleans"
+      );
+    snapshot[key] = value;
+  }
+  const json = JSON.stringify(snapshot).replace(
+    /[\u007f-\uffff]/g,
+    (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`
+  );
+  if (new TextEncoder().encode(json).byteLength > 2048)
+    throw new Error("Invalid service context: serialized JSON must not exceed 2 KiB");
+  return json;
+}
+var OpenGeniEmbeddingClient = class extends OpenGeniClient {
+  /** Read configuration (null means no configured ceiling). Requires admin or organization-key read authority. */
+  async getWorkspaceAllowance(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance`);
+  }
+  /**
+   * Read the lifecycle version even after clear (config=null). version=0 means
+   * never configured. Use the returned version to recreate or reconcile a 409;
+   * do not guess a CAS version or silently retry a new mutation.
+   * Requires the same budget-read authority as getWorkspaceAllowance.
+   */
+  async getWorkspaceAllowanceState(workspaceId) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance/state`
+    );
+  }
+  /**
+   * Set a USD-micro ceiling with exact-version CAS (0 only for first creation;
+   * after clear reuse its returned version or getWorkspaceAllowanceState). Requires
+   * organization key-control authority or account:admin, never workspace admin
+   * alone. Shares may oversubscribe the pool; actual post-call settlement can
+   * overshoot before the next admission check.
+   */
+  async setWorkspaceAllowance(workspaceId, request) {
+    return this.requestJson(
+      "PUT",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance`,
+      request
+    );
+  }
+  /**
+   * Clear with the exact version; grants and settled usage are not a billing
+   * refund. Supply operationId and replay the exact request after a lost response.
+   * Replays recheck authority and conflict after a later lifecycle change.
+   * On 409 read getWorkspaceAllowanceState before deciding on a new operation.
+   */
+  async clearWorkspaceAllowance(workspaceId, request) {
+    return this.requestJson(
+      "DELETE",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance`,
+      request
+    );
+  }
+  /** Grant USD micros once. Reuse the operationId and exact request after an uncertain response. */
+  async grantWorkspaceCredits(workspaceId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance/grants`,
+      request
+    );
+  }
+  /**
+   * Administer an existing member by canonical subject or external identity.
+   * null restores memberDefault; shares >1 are valid ceilings, not reservations.
+   * Concurrent calls may exceed the ceiling until their actual cost settles.
+   */
+  async setMemberAllowance(workspaceId, member, request) {
+    const path = typeof member === "string" ? encodeURIComponent(member) : `external/${encodeURIComponent(member.source)}/${encodeURIComponent(member.externalId)}`;
+    return this.requestJson(
+      "PUT",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/members/${path}/allowance`,
+      request
+    );
+  }
+  /** Paginated settled usage, current or YYYY-MM. Requires admin or organization-key read authority. */
+  async getUsage(workspaceId, query = {}, options = {}) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/usage`,
+      void 0,
+      usageQuery(query),
+      options
+    );
+  }
+  /** Own usage only. On your backend use asUser(authenticatedUser); subject selectors are not accepted. */
+  async getMyUsage(workspaceId, query = {}, options = {}) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/usage/me`,
+      void 0,
+      usageQuery(query),
+      options
+    );
+  }
+  /** Recover this actor's connection creation result without resending secrets.
+   * A 404 means no visible committed result, not proof that an in-flight write failed. */
+  async getConnectionCreationResult(workspaceId, operationId) {
+    const response = await this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/connections/operations/${encodeURIComponent(operationId)}`
+    );
+    return response.connection;
+  }
+  /** Rotate existing inline credentials only while no credential-consuming work
+   * is pending or active. Reuse the operation key and exact request to reconcile
+   * a lost response. This operation never schedules or retries model work. */
+  async rotateSessionMcpCredentials(workspaceId, sessionId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/mcp-credentials/rotate`,
+      request
+    );
+  }
+  /** Contract-checked successful JSON GET with its headers intact, for same-origin
+   * proxies that must forward paging metadata. Non-2xx responses throw. */
+  async requestJsonResponse(path, query = {}, options = {}) {
+    return await this.requestResponse("GET", path, query, {
+      ...options,
+      accept: "application/json"
+    });
+  }
+  /** Server-side organization-key client scoped to one host-authenticated user.
+   * Does not mutate this client, provision workspace membership, or link native
+   * identities. The API verifies key and membership authority on each request. */
+  asUser(externalId, options = {}) {
+    if (typeof window !== "undefined")
+      throw new Error("asUser is a server-side API; keep organization keys on your backend");
+    if (this.serviceInitiatorHeader !== void 0 || hasStaticHeader(this.options, ["x-opengeni-service-initiator", "x-opengeni-service-context"]))
+      throw new Error(
+        "asUser and asService are mutually exclusive; start from the unscoped client"
+      );
+    const source = options.source ?? "default";
+    const validOpaqueText = (value, maxBytes) => typeof value === "string" && value.length > 0 && value.length <= maxBytes && !value.includes("\0") && !/[\uD800-\uDFFF]/u.test(value) && new TextEncoder().encode(value).byteLength <= maxBytes;
+    if (!validOpaqueText(externalId, 1024) || !validOpaqueText(source, 200)) {
+      throw new Error("Invalid external identity reference");
+    }
+    const Client = this.constructor;
+    const client = new Client({ ...this.options });
+    client.externalActorHeader = encodeURIComponent(
+      JSON.stringify({ mode: "external", identity: { externalId, source } })
+    );
+    return client;
+  }
+  /** Server-side automation attribution under this client's existing credential.
+   * Returns a new client of the same class; grants no permissions or human/personal
+   * resource authority. Cannot be combined with asUser or asLinkedUser.
+   * Reapplying asService replaces the name and context rather than merging them. */
+  asService(name, context) {
+    if (typeof window !== "undefined")
+      throw new Error("asService is a server-side API; keep API keys on your backend");
+    if (this.externalActorHeader !== void 0 || hasStaticHeader(this.options, ["x-opengeni-external-actor"]))
+      throw new Error(
+        "asUser and asService are mutually exclusive; start from the unscoped client"
+      );
+    if (typeof name !== "string" || !/^[a-z0-9][a-z0-9:._-]{0,63}$/.test(name) || name.trim() !== name)
+      throw new Error("Invalid service initiator name");
+    const serializedContext = context === void 0 ? void 0 : serializeServiceContext(context);
+    const Client = this.constructor;
+    const client = new Client({ ...this.options });
+    client.serviceInitiatorHeader = name;
+    client.serviceContextHeader = serializedContext;
+    return client;
+  }
+  /** Explicitly use a confirmed native delegation. Unlike asUser, new resources
+   * belong to the native user. Existing external resources are never reassigned.
+   * A stale, expired or revoked link is rejected by the server on every request. */
+  asLinkedUser(externalId, options) {
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(options.linkId) || !Number.isSafeInteger(options.expectedLinkRevision) || options.expectedLinkRevision < 1)
+      throw new Error("A confirmed identity link and its exact revision are required");
+    const client = this.asUser(
+      externalId,
+      options.source === void 0 ? {} : { source: options.source }
+    );
+    const identity = JSON.parse(decodeURIComponent(client.externalActorHeader)).identity;
+    client.externalActorHeader = encodeURIComponent(
+      JSON.stringify({
+        mode: "linked_native",
+        identity,
+        linkId: options.linkId,
+        expectedLinkRevision: options.expectedLinkRevision
+      })
+    );
+    return client;
+  }
+  /** Optional native-account delegation. Invoke on a server-side asUser client.
+   * Pass the one-time challenge to the native consent screen, never a URL query
+   * or analytics event. Ordinary external embedding needs none of this. */
+  async beginIdentityLink(workspaceId, input) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links`,
+      input
+    );
+  }
+  async getIdentityLink(workspaceId, linkId) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}`
+    );
+  }
+  /** Only links belonging to the effective participant; no organization-wide directory. */
+  async listIdentityLinks(workspaceId, cursor) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`
+    );
+  }
+  /** Requires a canonical native browser session, not an organization API key. */
+  async previewIdentityLink(workspaceId, linkId, challenge) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/preview`,
+      { challenge }
+    );
+  }
+  async confirmIdentityLink(workspaceId, linkId, input) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/confirm`,
+      input
+    );
+  }
+  async revokeIdentityLink(workspaceId, linkId, expectedRevision) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/revoke`,
+      { expectedRevision }
+    );
+  }
+  /** Service-only lifecycle for an external actor's organization membership.
+   * A successful reactivation does not restore revoked workspace grants. */
+  async updateExternalIdentityMembership(organizationId, membershipId, request, options = {}) {
+    return this.requestJson(
+      "PATCH",
+      `/v1/organizations/${encodeURIComponent(organizationId)}/external-members/${encodeURIComponent(membershipId)}`,
+      request,
+      void 0,
+      options
+    );
+  }
+  /** Non-provisioning, content-free service lookup, including inactive identities. */
+  async lookupExternalIdentity(organizationId, identity) {
+    return this.requestJson(
+      "POST",
+      `/v1/organizations/${encodeURIComponent(organizationId)}/external-identities/lookup`,
+      identity
+    );
+  }
+  /** Withdraw an external member's shared-workspace access and fence an exact
+   * pending keyed grant. Reuse the exact cancellation body after response loss. */
+  async cancelExternalWorkspaceMemberGrant(organizationId, workspaceId, membershipId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/organizations/${encodeURIComponent(organizationId)}/workspaces/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(membershipId)}/revoke`,
+      request
+    );
+  }
+  /** Replace an existing external member's permissions in one shared
+   * workspace. Keyed by `operationId`: reuse the exact body after response
+   * loss. Narrowing makes live authority re-check; nothing is cancelled. */
+  async updateExternalWorkspaceMember(organizationId, workspaceId, membershipId, request) {
+    return this.requestJson(
+      "PATCH",
+      `/v1/organizations/${encodeURIComponent(organizationId)}/workspaces/${encodeURIComponent(workspaceId)}/external-members/${encodeURIComponent(membershipId)}`,
+      request
+    );
+  }
+  async listConnectProviders(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/connect/catalog`);
+  }
+  async listConnectAccounts(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/connect/accounts`);
+  }
+  async getConnectAttempt(workspaceId, attemptId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}`);
+  }
+  async listPendingConnectAttempts(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/connect/attempts`);
+  }
+  async advanceConnectAttempt(workspaceId, attemptId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}/advance`,
+      request
+    );
+  }
+  /** Stops setup; does not revoke already committed provider credentials. */
+  async cancelConnectAttempt(workspaceId, attemptId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}/cancel`,
+      request
+    );
+  }
+  /**
+   * Explicit organization-service-key onboarding with chosen permissions. Not
+   * needed for the default path: an `asUser` request through a key with
+   * `members:manage` adds a missing member with conversation permissions on
+   * first use. Change an existing member with `updateExternalWorkspaceMember`.
+   */
+  async addExternalWorkspaceMember(workspaceId, request) {
+    return this.requestJson("POST", `/v1/workspaces/${workspaceId}/external-members`, request);
+  }
+};
+function usageQuery(query) {
+  return Object.fromEntries(
+    Object.entries(query).filter(([, value]) => value !== void 0).map(([key, value]) => [key, String(value)])
+  );
+}
+
+// ../contracts/src/session-final-reply.ts
+var EMPTY_FINAL_REPLY_NOTICE = "The model returned no final reply after a reply reminder. Completed work is preserved; the goal and later updates are unaffected.";
+function turnCompletedWithEmptyFinalReply(payload) {
+  return payload !== null && typeof payload === "object" && !Array.isArray(payload) && payload.emptyFinalReply === true;
+}
+
+export {
+  OpenGeniEmbeddingClient,
+  EMPTY_FINAL_REPLY_NOTICE,
+  turnCompletedWithEmptyFinalReply
+};
+//# sourceMappingURL=chunk-MOTJYIYL.js.map

package/dist/chunk-MOTJYIYL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/embedding-client.ts","../../contracts/src/session-final-reply.ts"],"sourcesContent":["import { OpenGeniClient as OpenGeniArtifactClient } from \"./artifact-client\";\nimport type { OpenGeniClientOptions } from \"./client\";\nimport type { AddWorkspaceMemberRequest } from \"./types\";\nimport type {\n  ExternalIdentityLink,\n  BeginExternalIdentityLinkRequest,\n  BeginExternalIdentityLinkResponse,\n  ConfirmExternalIdentityLinkRequest,\n  ExternalIdentityLinkPreview,\n  ExternalIdentityLinkPage,\n} from \"@opengeni/contracts/external-identities\";\n\n/** Non-secret service attribution, serialized as a flat JSON object of at most 2 KiB. */\nexport type ServiceContext = Record<string, string | number | boolean>;\n\nfunction hasStaticHeader(options: OpenGeniClientOptions, names: string[]): boolean {\n  return (\n    typeof options.headers !== \"function\" &&\n    Object.keys(options.headers ?? {}).some((key) => names.includes(key.toLowerCase()))\n  );\n}\n\nfunction serializeServiceContext(context: ServiceContext): string {\n  if (\n    !context ||\n    typeof context !== \"object\" ||\n    Array.isArray(context) ||\n    (Object.getPrototypeOf(context) !== Object.prototype && Object.getPrototypeOf(context) !== null)\n  )\n    throw new Error(\"Invalid service context: expected a flat JSON object\");\n  const snapshot: ServiceContext = Object.create(null);\n  for (const [key, value] of Object.entries(context)) {\n    if (\n      typeof value !== \"string\" &&\n      typeof value !== \"boolean\" &&\n      !(typeof value === \"number\" && Number.isFinite(value))\n    )\n      throw new Error(\n        \"Invalid service context: values must be strings, finite numbers, or booleans\",\n      );\n    snapshot[key] = value;\n  }\n  // HTTP Headers require byte strings. JSON escapes preserve Unicode without\n  // percent-encoding the object or passing non-byte characters to fetch.\n  const json = JSON.stringify(snapshot).replace(\n    /[\\u007f-\\uffff]/g,\n    (character) => `\\\\u${character.charCodeAt(0).toString(16).padStart(4, \"0\")}`,\n  );\n  if (new TextEncoder().encode(json).byteLength > 2048)\n    throw new Error(\"Invalid service context: serialized JSON must not exceed 2 KiB\");\n  return json;\n}\n\n/** Public product embedding administration, kept out of the native browser client. */\nexport class OpenGeniEmbeddingClient extends OpenGeniArtifactClient {\n  /** Read configuration (null means no configured ceiling). Requires admin or organization-key read authority. */\n  async getWorkspaceAllowance(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").WorkspaceAllowance | null> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance`);\n  }\n\n  /**\n   * Read the lifecycle version even after clear (config=null). version=0 means\n   * never configured. Use the returned version to recreate or reconcile a 409;\n   * do not guess a CAS version or silently retry a new mutation.\n   * Requires the same budget-read authority as getWorkspaceAllowance.\n   */\n  async getWorkspaceAllowanceState(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").WorkspaceAllowanceState> {\n    return this.requestJson(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance/state`,\n    );\n  }\n\n  /**\n   * Set a USD-micro ceiling with exact-version CAS (0 only for first creation;\n   * after clear reuse its returned version or getWorkspaceAllowanceState). Requires\n   * organization key-control authority or account:admin, never workspace admin\n   * alone. Shares may oversubscribe the pool; actual post-call settlement can\n   * overshoot before the next admission check.\n   */\n  async setWorkspaceAllowance(\n    workspaceId: string,\n    request: import(\"@opengeni/contracts/usage-allowances\").SetWorkspaceAllowanceRequest,\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").WorkspaceAllowance> {\n    return this.requestJson(\n      \"PUT\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance`,\n      request,\n    );\n  }\n\n  /**\n   * Clear with the exact version; grants and settled usage are not a billing\n   * refund. Supply operationId and replay the exact request after a lost response.\n   * Replays recheck authority and conflict after a later lifecycle change.\n   * On 409 read getWorkspaceAllowanceState before deciding on a new operation.\n   */\n  async clearWorkspaceAllowance(\n    workspaceId: string,\n    request: import(\"@opengeni/contracts/usage-allowances\").ClearWorkspaceAllowanceRequest,\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").ClearWorkspaceAllowanceResponse> {\n    return this.requestJson(\n      \"DELETE\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance`,\n      request,\n    );\n  }\n\n  /** Grant USD micros once. Reuse the operationId and exact request after an uncertain response. */\n  async grantWorkspaceCredits(\n    workspaceId: string,\n    request: import(\"@opengeni/contracts/usage-allowances\").GrantWorkspaceCreditsRequest,\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").WorkspaceCreditGrant> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/allowance/grants`,\n      request,\n    );\n  }\n\n  /**\n   * Administer an existing member by canonical subject or external identity.\n   * null restores memberDefault; shares >1 are valid ceilings, not reservations.\n   * Concurrent calls may exceed the ceiling until their actual cost settles.\n   */\n  async setMemberAllowance(\n    workspaceId: string,\n    member: string | { source: string; externalId: string },\n    request: import(\"@opengeni/contracts/usage-allowances\").SetMemberAllowanceRequest,\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").MemberAllowance> {\n    const path =\n      typeof member === \"string\"\n        ? encodeURIComponent(member)\n        : `external/${encodeURIComponent(member.source)}/${encodeURIComponent(member.externalId)}`;\n    return this.requestJson(\n      \"PUT\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/members/${path}/allowance`,\n      request,\n    );\n  }\n\n  /** Paginated settled usage, current or YYYY-MM. Requires admin or organization-key read authority. */\n  async getUsage(\n    workspaceId: string,\n    query: import(\"@opengeni/contracts/usage-allowances\").GetUsageRequest = {},\n    options: import(\"./client\").OpenGeniRequestOptions = {},\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").WorkspaceUsageResponse> {\n    return this.requestJson(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/usage`,\n      undefined,\n      usageQuery(query),\n      options,\n    );\n  }\n\n  /** Own usage only. On your backend use asUser(authenticatedUser); subject selectors are not accepted. */\n  async getMyUsage(\n    workspaceId: string,\n    query: import(\"@opengeni/contracts/usage-allowances\").GetMyUsageRequest = {},\n    options: import(\"./client\").OpenGeniRequestOptions = {},\n  ): Promise<import(\"@opengeni/contracts/usage-allowances\").WorkspaceUsageResponse> {\n    return this.requestJson(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/usage/me`,\n      undefined,\n      usageQuery(query),\n      options,\n    );\n  }\n\n  /** Recover this actor's connection creation result without resending secrets.\n   * A 404 means no visible committed result, not proof that an in-flight write failed. */\n  async getConnectionCreationResult(\n    workspaceId: string,\n    operationId: string,\n  ): Promise<import(\"./types\").ConnectionMetadata> {\n    const response = await this.requestJson<import(\"./types\").ConnectionResponse>(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/connections/operations/${encodeURIComponent(operationId)}`,\n    );\n    return response.connection;\n  }\n\n  /** Rotate existing inline credentials only while no credential-consuming work\n   * is pending or active. Reuse the operation key and exact request to reconcile\n   * a lost response. This operation never schedules or retries model work. */\n  async rotateSessionMcpCredentials(\n    workspaceId: string,\n    sessionId: string,\n    request: import(\"./types\").RotateSessionMcpCredentialsRequest,\n  ): Promise<import(\"./types\").RotateSessionMcpCredentialsReceipt> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/mcp-credentials/rotate`,\n      request,\n    );\n  }\n\n  /** Contract-checked successful JSON GET with its headers intact, for same-origin\n   * proxies that must forward paging metadata. Non-2xx responses throw. */\n  async requestJsonResponse(\n    path: string,\n    query: Record<string, string> = {},\n    options: import(\"./client\").OpenGeniRequestOptions = {},\n  ): Promise<import(\"./client\").FetchResponse> {\n    return await this.requestResponse(\"GET\", path, query, {\n      ...options,\n      accept: \"application/json\",\n    });\n  }\n\n  /** Server-side organization-key client scoped to one host-authenticated user.\n   * Does not mutate this client, provision workspace membership, or link native\n   * identities. The API verifies key and membership authority on each request. */\n  asUser(externalId: string, options: { source?: string } = {}): this {\n    if (typeof window !== \"undefined\")\n      throw new Error(\"asUser is a server-side API; keep organization keys on your backend\");\n    if (\n      this.serviceInitiatorHeader !== undefined ||\n      hasStaticHeader(this.options, [\"x-opengeni-service-initiator\", \"x-opengeni-service-context\"])\n    )\n      throw new Error(\n        \"asUser and asService are mutually exclusive; start from the unscoped client\",\n      );\n    const source = options.source ?? \"default\";\n    const validOpaqueText = (value: unknown, maxBytes: number): value is string =>\n      typeof value === \"string\" &&\n      value.length > 0 &&\n      value.length <= maxBytes &&\n      !value.includes(\"\\0\") &&\n      !/[\\uD800-\\uDFFF]/u.test(value) &&\n      new TextEncoder().encode(value).byteLength <= maxBytes;\n    if (!validOpaqueText(externalId, 1024) || !validOpaqueText(source, 200)) {\n      throw new Error(\"Invalid external identity reference\");\n    }\n    const Client = this.constructor as new (options: OpenGeniClientOptions) => this;\n    const client = new Client({ ...this.options });\n    client.externalActorHeader = encodeURIComponent(\n      JSON.stringify({ mode: \"external\", identity: { externalId, source } }),\n    );\n    return client;\n  }\n\n  /** Server-side automation attribution under this client's existing credential.\n   * Returns a new client of the same class; grants no permissions or human/personal\n   * resource authority. Cannot be combined with asUser or asLinkedUser.\n   * Reapplying asService replaces the name and context rather than merging them. */\n  asService(name: string, context?: ServiceContext): this {\n    if (typeof window !== \"undefined\")\n      throw new Error(\"asService is a server-side API; keep API keys on your backend\");\n    if (\n      this.externalActorHeader !== undefined ||\n      hasStaticHeader(this.options, [\"x-opengeni-external-actor\"])\n    )\n      throw new Error(\n        \"asUser and asService are mutually exclusive; start from the unscoped client\",\n      );\n    if (\n      typeof name !== \"string\" ||\n      !/^[a-z0-9][a-z0-9:._-]{0,63}$/.test(name) ||\n      name.trim() !== name\n    )\n      throw new Error(\"Invalid service initiator name\");\n    const serializedContext = context === undefined ? undefined : serializeServiceContext(context);\n    const Client = this.constructor as new (options: OpenGeniClientOptions) => this;\n    const client = new Client({ ...this.options });\n    client.serviceInitiatorHeader = name;\n    client.serviceContextHeader = serializedContext;\n    return client;\n  }\n\n  /** Explicitly use a confirmed native delegation. Unlike asUser, new resources\n   * belong to the native user. Existing external resources are never reassigned.\n   * A stale, expired or revoked link is rejected by the server on every request. */\n  asLinkedUser(\n    externalId: string,\n    options: { source?: string; linkId: string; expectedLinkRevision: number },\n  ): this {\n    if (\n      !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(options.linkId) ||\n      !Number.isSafeInteger(options.expectedLinkRevision) ||\n      options.expectedLinkRevision < 1\n    )\n      throw new Error(\"A confirmed identity link and its exact revision are required\");\n    const client = this.asUser(\n      externalId,\n      options.source === undefined ? {} : { source: options.source },\n    );\n    const identity = JSON.parse(decodeURIComponent(client.externalActorHeader!)).identity;\n    client.externalActorHeader = encodeURIComponent(\n      JSON.stringify({\n        mode: \"linked_native\",\n        identity,\n        linkId: options.linkId,\n        expectedLinkRevision: options.expectedLinkRevision,\n      }),\n    );\n    return client;\n  }\n\n  /** Optional native-account delegation. Invoke on a server-side asUser client.\n   * Pass the one-time challenge to the native consent screen, never a URL query\n   * or analytics event. Ordinary external embedding needs none of this. */\n  async beginIdentityLink(\n    workspaceId: string,\n    input: BeginExternalIdentityLinkRequest,\n  ): Promise<BeginExternalIdentityLinkResponse> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links`,\n      input,\n    );\n  }\n\n  async getIdentityLink(workspaceId: string, linkId: string): Promise<ExternalIdentityLink> {\n    return this.requestJson(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}`,\n    );\n  }\n\n  /** Only links belonging to the effective participant; no organization-wide directory. */\n  async listIdentityLinks(workspaceId: string, cursor?: string): Promise<ExternalIdentityLinkPage> {\n    return this.requestJson(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links${cursor ? `?cursor=${encodeURIComponent(cursor)}` : \"\"}`,\n    );\n  }\n\n  /** Requires a canonical native browser session, not an organization API key. */\n  async previewIdentityLink(\n    workspaceId: string,\n    linkId: string,\n    challenge: string,\n  ): Promise<ExternalIdentityLinkPreview> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/preview`,\n      { challenge },\n    );\n  }\n\n  async confirmIdentityLink(\n    workspaceId: string,\n    linkId: string,\n    input: ConfirmExternalIdentityLinkRequest,\n  ): Promise<ExternalIdentityLink> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/confirm`,\n      input,\n    );\n  }\n\n  async revokeIdentityLink(\n    workspaceId: string,\n    linkId: string,\n    expectedRevision: number,\n  ): Promise<ExternalIdentityLink> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/revoke`,\n      { expectedRevision },\n    );\n  }\n\n  /** Service-only lifecycle for an external actor's organization membership.\n   * A successful reactivation does not restore revoked workspace grants. */\n  async updateExternalIdentityMembership(\n    organizationId: string,\n    membershipId: string,\n    request: import(\"@opengeni/contracts/external-identities\").UpdateExternalIdentityMembershipRequest,\n    options: { signal?: AbortSignal } = {},\n  ): Promise<import(\"@opengeni/contracts\").OrganizationMember> {\n    return this.requestJson(\n      \"PATCH\",\n      `/v1/organizations/${encodeURIComponent(organizationId)}/external-members/${encodeURIComponent(membershipId)}`,\n      request,\n      undefined,\n      options,\n    );\n  }\n\n  /** Non-provisioning, content-free service lookup, including inactive identities. */\n  async lookupExternalIdentity(\n    organizationId: string,\n    identity: import(\"@opengeni/contracts/external-identities\").ExternalIdentityReference,\n  ): Promise<import(\"@opengeni/contracts/external-identities\").ExternalIdentityLookup> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/organizations/${encodeURIComponent(organizationId)}/external-identities/lookup`,\n      identity,\n    );\n  }\n\n  /** Withdraw an external member's shared-workspace access and fence an exact\n   * pending keyed grant. Reuse the exact cancellation body after response loss. */\n  async cancelExternalWorkspaceMemberGrant(\n    organizationId: string,\n    workspaceId: string,\n    membershipId: string,\n    request: import(\"@opengeni/contracts/external-identities\").CancelExternalWorkspaceMemberGrantRequest,\n  ): Promise<\n    import(\"@opengeni/contracts/external-identities\").CancelExternalWorkspaceMemberGrantResponse\n  > {\n    return this.requestJson(\n      \"POST\",\n      `/v1/organizations/${encodeURIComponent(organizationId)}/workspaces/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(membershipId)}/revoke`,\n      request,\n    );\n  }\n\n  /** Replace an existing external member's permissions in one shared\n   * workspace. Keyed by `operationId`: reuse the exact body after response\n   * loss. Narrowing makes live authority re-check; nothing is cancelled. */\n  async updateExternalWorkspaceMember(\n    organizationId: string,\n    workspaceId: string,\n    membershipId: string,\n    request: import(\"@opengeni/contracts/external-identities\").UpdateExternalWorkspaceMemberRequest,\n  ): Promise<\n    import(\"@opengeni/contracts/external-identities\").UpdateExternalWorkspaceMemberResponse\n  > {\n    return this.requestJson(\n      \"PATCH\",\n      `/v1/organizations/${encodeURIComponent(organizationId)}/workspaces/${encodeURIComponent(workspaceId)}/external-members/${encodeURIComponent(membershipId)}`,\n      request,\n    );\n  }\n\n  async listConnectProviders(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectProvider[]> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/connect/catalog`);\n  }\n\n  async listConnectAccounts(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAccount[]> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/connect/accounts`);\n  }\n\n  async getConnectAttempt(\n    workspaceId: string,\n    attemptId: string,\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAttempt> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}`);\n  }\n\n  async listPendingConnectAttempts(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAttempt[]> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/connect/attempts`);\n  }\n\n  async advanceConnectAttempt(\n    workspaceId: string,\n    attemptId: string,\n    request: {\n      expectedRevision: number;\n      idempotencyKey: string;\n      action: import(\"@opengeni/contracts/connect\").ConnectAdvance;\n    },\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAttempt> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}/advance`,\n      request,\n    );\n  }\n\n  /** Stops setup; does not revoke already committed provider credentials. */\n  async cancelConnectAttempt(\n    workspaceId: string,\n    attemptId: string,\n    request: {\n      expectedRevision: number;\n      idempotencyKey: string;\n    },\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAttempt> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}/cancel`,\n      request,\n    );\n  }\n\n  /**\n   * Explicit organization-service-key onboarding with chosen permissions. Not\n   * needed for the default path: an `asUser` request through a key with\n   * `members:manage` adds a missing member with conversation permissions on\n   * first use. Change an existing member with `updateExternalWorkspaceMember`.\n   */\n  async addExternalWorkspaceMember(\n    workspaceId: string,\n    request: {\n      identity: { externalId: string; source?: string };\n      permissions: AddWorkspaceMemberRequest[\"permissions\"];\n      operationId?: string;\n    },\n  ): Promise<import(\"@opengeni/contracts/external-identities\").ExternalIdentity> {\n    return this.requestJson(\"POST\", `/v1/workspaces/${workspaceId}/external-members`, request);\n  }\n}\n\nfunction usageQuery(\n  query: import(\"@opengeni/contracts/usage-allowances\").GetUsageRequest,\n): Record<string, string> {\n  return Object.fromEntries(\n    Object.entries(query)\n      .filter(([, value]) => value !== undefined)\n      .map(([key, value]) => [key, String(value)]),\n  );\n}\n","/** A response-quality notice, not a failed turn or a completed deliverable. */\nexport const EMPTY_FINAL_REPLY_NOTICE =\n  \"The model returned no final reply after a reply reminder. Completed work is preserved; the goal and later updates are unaffected.\";\n\nexport type EmptyFinalReplyCompletion = {\n  emptyFinalReply: true;\n};\n\nexport function turnCompletedWithEmptyFinalReply(payload: unknown): boolean {\n  return (\n    payload !== null &&\n    typeof payload === \"object\" &&\n    !Array.isArray(payload) &&\n    (payload as { emptyFinalReply?: unknown }).emptyFinalReply === true\n  );\n}\n"],"mappings":";;;;;AAeA,SAAS,gBAAgB,SAAgC,OAA0B;AACjF,SACE,OAAO,QAAQ,YAAY,cAC3B,OAAO,KAAK,QAAQ,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,MAAM,SAAS,IAAI,YAAY,CAAC,CAAC;AAEtF;AAEA,SAAS,wBAAwB,SAAiC;AAChE,MACE,CAAC,WACD,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,KACpB,OAAO,eAAe,OAAO,MAAM,OAAO,aAAa,OAAO,eAAe,OAAO,MAAM;AAE3F,UAAM,IAAI,MAAM,sDAAsD;AACxE,QAAM,WAA2B,uBAAO,OAAO,IAAI;AACnD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QACE,OAAO,UAAU,YACjB,OAAO,UAAU,aACjB,EAAE,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AAEpD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AACF,aAAS,GAAG,IAAI;AAAA,EAClB;AAGA,QAAM,OAAO,KAAK,UAAU,QAAQ,EAAE;AAAA,IACpC;AAAA,IACA,CAAC,cAAc,MAAM,UAAU,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,EAC5E;AACA,MAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa;AAC9C,UAAM,IAAI,MAAM,gEAAgE;AAClF,SAAO;AACT;AAGO,IAAM,0BAAN,cAAsC,eAAuB;AAAA;AAAA,EAElE,MAAM,sBACJ,aACmF;AACnF,WAAO,KAAK,YAAY,OAAO,kBAAkB,mBAAmB,WAAW,CAAC,YAAY;AAAA,EAC9F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,2BACJ,aACiF;AACjF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,IACnD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,sBACJ,aACA,SAC4E;AAC5E,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,wBACJ,aACA,SACyF;AACzF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,sBACJ,aACA,SAC8E;AAC9E,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,mBACJ,aACA,QACA,SACyE;AACzE,UAAM,OACJ,OAAO,WAAW,WACd,mBAAmB,MAAM,IACzB,YAAY,mBAAmB,OAAO,MAAM,CAAC,IAAI,mBAAmB,OAAO,UAAU,CAAC;AAC5F,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,YAAY,IAAI;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SACJ,aACA,QAAwE,CAAC,GACzE,UAAqD,CAAC,GAC0B;AAChF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,MACA,WAAW,KAAK;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,WACJ,aACA,QAA0E,CAAC,GAC3E,UAAqD,CAAC,GAC0B;AAChF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,MACA,WAAW,KAAK;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,4BACJ,aACA,aAC+C;AAC/C,UAAM,WAAW,MAAM,KAAK;AAAA,MAC1B;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,2BAA2B,mBAAmB,WAAW,CAAC;AAAA,IAC7G;AACA,WAAO,SAAS;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,4BACJ,aACA,WACA,SAC+D;AAC/D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,WAAW,aAAa,SAAS;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,oBACJ,MACA,QAAgC,CAAC,GACjC,UAAqD,CAAC,GACX;AAC3C,WAAO,MAAM,KAAK,gBAAgB,OAAO,MAAM,OAAO;AAAA,MACpD,GAAG;AAAA,MACH,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,YAAoB,UAA+B,CAAC,GAAS;AAClE,QAAI,OAAO,WAAW;AACpB,YAAM,IAAI,MAAM,qEAAqE;AACvF,QACE,KAAK,2BAA2B,UAChC,gBAAgB,KAAK,SAAS,CAAC,gCAAgC,4BAA4B,CAAC;AAE5F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AACF,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,kBAAkB,CAAC,OAAgB,aACvC,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,YAChB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,mBAAmB,KAAK,KAAK,KAC9B,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,cAAc;AAChD,QAAI,CAAC,gBAAgB,YAAY,IAAI,KAAK,CAAC,gBAAgB,QAAQ,GAAG,GAAG;AACvE,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AACA,UAAM,SAAS,KAAK;AACpB,UAAM,SAAS,IAAI,OAAO,EAAE,GAAG,KAAK,QAAQ,CAAC;AAC7C,WAAO,sBAAsB;AAAA,MAC3B,KAAK,UAAU,EAAE,MAAM,YAAY,UAAU,EAAE,YAAY,OAAO,EAAE,CAAC;AAAA,IACvE;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,UAAU,MAAc,SAAgC;AACtD,QAAI,OAAO,WAAW;AACpB,YAAM,IAAI,MAAM,+DAA+D;AACjF,QACE,KAAK,wBAAwB,UAC7B,gBAAgB,KAAK,SAAS,CAAC,2BAA2B,CAAC;AAE3D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AACF,QACE,OAAO,SAAS,YAChB,CAAC,+BAA+B,KAAK,IAAI,KACzC,KAAK,KAAK,MAAM;AAEhB,YAAM,IAAI,MAAM,gCAAgC;AAClD,UAAM,oBAAoB,YAAY,SAAY,SAAY,wBAAwB,OAAO;AAC7F,UAAM,SAAS,KAAK;AACpB,UAAM,SAAS,IAAI,OAAO,EAAE,GAAG,KAAK,QAAQ,CAAC;AAC7C,WAAO,yBAAyB;AAChC,WAAO,uBAAuB;AAC9B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,aACE,YACA,SACM;AACN,QACE,CAAC,kEAAkE,KAAK,QAAQ,MAAM,KACtF,CAAC,OAAO,cAAc,QAAQ,oBAAoB,KAClD,QAAQ,uBAAuB;AAE/B,YAAM,IAAI,MAAM,+DAA+D;AACjF,UAAM,SAAS,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,IAC/D;AACA,UAAM,WAAW,KAAK,MAAM,mBAAmB,OAAO,mBAAoB,CAAC,EAAE;AAC7E,WAAO,sBAAsB;AAAA,MAC3B,KAAK,UAAU;AAAA,QACb,MAAM;AAAA,QACN;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,sBAAsB,QAAQ;AAAA,MAChC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBACJ,aACA,OAC4C;AAC5C,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,aAAqB,QAA+C;AACxF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,mBAAmB,mBAAmB,MAAM,CAAC;AAAA,IAChG;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,kBAAkB,aAAqB,QAAoD;AAC/F,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,kBAAkB,SAAS,WAAW,mBAAmB,MAAM,CAAC,KAAK,EAAE;AAAA,IAC1H;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,oBACJ,aACA,QACA,WACsC;AACtC,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,mBAAmB,mBAAmB,MAAM,CAAC;AAAA,MAC9F,EAAE,UAAU;AAAA,IACd;AAAA,EACF;AAAA,EAEA,MAAM,oBACJ,aACA,QACA,OAC+B;AAC/B,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,mBAAmB,mBAAmB,MAAM,CAAC;AAAA,MAC9F;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,mBACJ,aACA,QACA,kBAC+B;AAC/B,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,mBAAmB,mBAAmB,MAAM,CAAC;AAAA,MAC9F,EAAE,iBAAiB;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,iCACJ,gBACA,cACA,SACA,UAAoC,CAAC,GACsB;AAC3D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qBAAqB,mBAAmB,cAAc,CAAC,qBAAqB,mBAAmB,YAAY,CAAC;AAAA,MAC5G;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,uBACJ,gBACA,UACmF;AACnF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,mCACJ,gBACA,aACA,cACA,SAGA;AACA,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qBAAqB,mBAAmB,cAAc,CAAC,eAAe,mBAAmB,WAAW,CAAC,YAAY,mBAAmB,YAAY,CAAC;AAAA,MACjJ;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,8BACJ,gBACA,aACA,cACA,SAGA;AACA,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qBAAqB,mBAAmB,cAAc,CAAC,eAAe,mBAAmB,WAAW,CAAC,qBAAqB,mBAAmB,YAAY,CAAC;AAAA,MAC1J;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,qBACJ,aACkE;AAClE,WAAO,KAAK,YAAY,OAAO,kBAAkB,WAAW,kBAAkB;AAAA,EAChF;AAAA,EAEA,MAAM,oBACJ,aACiE;AACjE,WAAO,KAAK,YAAY,OAAO,kBAAkB,WAAW,mBAAmB;AAAA,EACjF;AAAA,EAEA,MAAM,kBACJ,aACA,WAC+D;AAC/D,WAAO,KAAK,YAAY,OAAO,kBAAkB,WAAW,qBAAqB,SAAS,EAAE;AAAA,EAC9F;AAAA,EAEA,MAAM,2BACJ,aACiE;AACjE,WAAO,KAAK,YAAY,OAAO,kBAAkB,WAAW,mBAAmB;AAAA,EACjF;AAAA,EAEA,MAAM,sBACJ,aACA,WACA,SAK+D;AAC/D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,WAAW,qBAAqB,SAAS;AAAA,MAC3D;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,qBACJ,aACA,WACA,SAI+D;AAC/D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,WAAW,qBAAqB,SAAS;AAAA,MAC3D;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,2BACJ,aACA,SAK6E;AAC7E,WAAO,KAAK,YAAY,QAAQ,kBAAkB,WAAW,qBAAqB,OAAO;AAAA,EAC3F;AACF;AAEA,SAAS,WACP,OACwB;AACxB,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAK,EACjB,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,EACzC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC;AAAA,EAC/C;AACF;;;ACrgBO,IAAM,2BACX;AAMK,SAAS,iCAAiC,SAA2B;AAC1E,SACE,YAAY,QACZ,OAAO,YAAY,YACnB,CAAC,MAAM,QAAQ,OAAO,KACrB,QAA0C,oBAAoB;AAEnE;","names":[]}

package/dist/{chunk-ST5DDKJP.js → chunk-NC57YMUO.js}

@@ -1,3 +1,13 @@
+import {
+  OpenGeniApiError
+} from "./chunk-V6GIY62B.js";
+
+// ../contracts/src/browser-storage.ts
+var EPHEMERAL_CHROMIUM_DRIVER_ID = "opengeni.cdp.ephemeral-context.v1";
+function browserSessionStorageMode(session) {
+  return session.driverId === EPHEMERAL_CHROMIUM_DRIVER_ID ? "ephemeral_context" : "private_profile";
+}
+
 // src/interaction.ts
 var INTERACTION_PROTOCOL_VERSION = 1;
 var BROWSER_CONTROL_WEBSOCKET_PROTOCOL = "opengeni.browser.v1";
@@ -7,6 +17,46 @@ var BROWSER_CONTROL_MAX_FRAME_HEADER_BYTES = 64 * 1024;
 var BROWSER_FRAME_MAX_BYTES = 24 * 1024 * 1024;
 var BROWSER_FRAME_MAX_DIMENSION = 32768;
 var BROWSER_FRAME_MAX_PIXELS = 1e8;
+function interactionControlFailureFromError(error) {
+  if (!(error instanceof OpenGeniApiError)) return null;
+  const details = error.details;
+  if (!details || details.interactionLayer !== "connected_machine") return null;
+  const surface = details.interactionSurface;
+  const code = details.controlFailureCode;
+  if (surface !== "browser" && surface !== "computer" || !isControlFailureCode(code)) {
+    return null;
+  }
+  const controlRequestId = boundedOpaqueCorrelation(details.controlRequestId);
+  return {
+    layer: "connected_machine",
+    surface,
+    code,
+    retryable: error.retryable,
+    outcomeUnknown: error.outcomeUnknown,
+    requestId: error.correlationId,
+    controlRequestId,
+    message: error.message
+  };
+}
+function isControlFailureCode(value) {
+  return typeof value === "string" && [
+    "unknown",
+    "unsupported",
+    "os",
+    "not_found",
+    "consent_required",
+    "timeout",
+    "draining",
+    "protocol",
+    "stream",
+    "agent_offline",
+    "fenced",
+    "payload_too_large"
+  ].includes(value);
+}
+function boundedOpaqueCorrelation(value) {
+  return typeof value === "string" && value.length <= 128 && /^[A-Za-z0-9._:-]+$/u.test(value) ? value : void 0;
+}
 var OpenGeniInteractionClient = class {
   attachedBrowsers;
   authRuns;
@@ -294,7 +344,12 @@ var BrowserSessionCollection = class {
   async currentOrOpen(options) {
     const requestOptions = options.signal ? { signal: options.signal } : {};
     const listed = await this.list(options.workspaceId, requestOptions);
-    const current = newestRelevantBrowser(listed.sessions, options.associationSessionId);
+    const current = newestRelevantBrowser(
+      listed.sessions.filter(
+        (session) => browserSessionStorageMode(session) === (options.storageMode ?? "private_profile")
+      ),
+      options.associationSessionId
+    );
     if (current) {
       const resource = this.session(options.workspaceId, current.id);
       if (current.lifecycle === "suspended") {
@@ -313,6 +368,7 @@ var BrowserSessionCollection = class {
         ...options.name !== void 0 ? { name: options.name } : {},
         ...options.initialUrl !== void 0 ? { initialUrl: options.initialUrl } : {},
         ...options.headless !== void 0 ? { headless: options.headless } : {},
+        ...options.storageMode !== void 0 ? { storageMode: options.storageMode } : {},
         ...options.placement !== void 0 ? { placement: options.placement } : {},
         ...options.identityId !== void 0 ? { identityId: options.identityId } : {},
         ...options.baseRevisionId !== void 0 ? { baseRevisionId: options.baseRevisionId } : {},
@@ -346,6 +402,30 @@ var BrowserSessionResource = class {
   async observe(targetId, options = {}) {
     return await this.transport.observeBrowserTarget(this.workspaceId, this.id, targetId, options);
   }
+  async targetState(targetId, options = {}) {
+    return await this.transport.getBrowserTargetState(this.workspaceId, this.id, targetId, options);
+  }
+  async readDom(targetId, request, options = {}) {
+    return await this.transport.readBrowserDom(
+      this.workspaceId,
+      this.id,
+      targetId,
+      request,
+      options
+    );
+  }
+  async capture(targetId, options = {}, captureOptions = {}) {
+    return await this.transport.captureBrowserTarget(
+      this.workspaceId,
+      this.id,
+      targetId,
+      options,
+      captureOptions
+    );
+  }
+  async screenshot(targetId, captureOptions = {}, options = {}) {
+    return await this.capture(targetId, options, captureOptions);
+  }
   async act(request, options = {}) {
     return await this.transport.actInBrowser(this.workspaceId, this.id, request, options);
   }
@@ -557,6 +637,9 @@ var ComputerSessionResource = class {
   async observe(targetId, options = {}) {
     return await this.transport.observeComputerTarget(this.workspaceId, this.id, targetId, options);
   }
+  async capture(targetId, options = {}) {
+    return await this.transport.captureComputerTarget(this.workspaceId, this.id, targetId, options);
+  }
   async act(request, options = {}) {
     return await this.transport.actInComputer(this.workspaceId, this.id, request, options);
   }
@@ -571,6 +654,12 @@ var ComputerSessionResource = class {
   async attach(request, options = {}) {
     return await this.transport.attachComputerSession(this.workspaceId, this.id, request, options);
   }
+  async inputPosture(options = {}) {
+    if (!this.transport.getComputerInputPosture) {
+      throw new Error("Computer input posture requires a current interaction transport.");
+    }
+    return await this.transport.getComputerInputPosture(this.workspaceId, this.id, options);
+  }
   async heartbeat(options = {}) {
     return await this.transport.heartbeatComputerSession(this.workspaceId, this.id, options);
   }
@@ -620,6 +709,7 @@ function browserFrameSocketUrl(attachment, options = {}) {
   else if (url.protocol !== "ws:" && url.protocol !== "wss:") {
     throw new Error("browser frame attachment did not contain an HTTP or WebSocket URL");
   }
+  upgradeMixedContentWebSocket(url);
   if (options.format !== void 0) url.searchParams.set("format", options.format);
   setBoundedIntegerQuery(url, "quality", options.quality, 1, 100);
   setBoundedIntegerQuery(url, "maxWidth", options.maxWidth, 1, 4096);
@@ -637,6 +727,7 @@ function computerFrameSocketUrl(attachment, options = {}) {
   else if (url.protocol !== "ws:" && url.protocol !== "wss:") {
     throw new Error("computer frame attachment did not contain an HTTP or WebSocket URL");
   }
+  upgradeMixedContentWebSocket(url);
   if (options.format !== void 0) url.searchParams.set("format", options.format);
   setBoundedIntegerQuery(url, "quality", options.quality, 1, 100);
   setBoundedIntegerQuery(url, "maxWidth", options.maxWidth, 1, 4096);
@@ -837,6 +928,27 @@ function parseComputerFrameMetadata(value) {
   }
   return metadata;
 }
+function decodeComputerFrameMetadataHeader(value) {
+  if (!value || value.length > 32 * 1024 || !/^[A-Za-z0-9_-]+$/u.test(value)) {
+    throw new Error("computer frame metadata header is invalid");
+  }
+  const normalized = value.replace(/-/gu, "+").replace(/_/gu, "/");
+  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+  let decoded;
+  try {
+    decoded = atob(padded);
+  } catch {
+    throw new Error("computer frame metadata header is invalid");
+  }
+  const bytes = Uint8Array.from(decoded, (character) => character.charCodeAt(0));
+  let metadata;
+  try {
+    metadata = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    throw new Error("computer frame metadata header is invalid");
+  }
+  return parseComputerFrameMetadata(metadata);
+}
 function newestRelevantBrowser(sessions, associationSessionId) {
   const live = sessions.filter(
     (session) => !["ending", "ended", "failed", "lost"].includes(session.lifecycle) && session.associations.some((association) => association.sessionId === associationSessionId)
@@ -865,6 +977,10 @@ function computerRelevance(session, associationSessionId) {
   const used = Date.parse(session.lastUsedAt);
   return Math.max(association, Number.isFinite(used) ? used : 0);
 }
+function upgradeMixedContentWebSocket(url) {
+  const protocol = globalThis.location?.protocol;
+  if (protocol === "https:" && url.protocol === "ws:") url.protocol = "wss:";
+}
 function setBoundedIntegerQuery(url, name, value, min, max) {
   if (value === void 0) return;
   if (!Number.isSafeInteger(value) || value < min || value > max) {
@@ -953,6 +1069,7 @@ export {
   BROWSER_FRAME_MAX_BYTES,
   BROWSER_FRAME_MAX_DIMENSION,
   BROWSER_FRAME_MAX_PIXELS,
+  interactionControlFailureFromError,
   OpenGeniInteractionClient,
   NetworkRouteCollection,
   NetworkRouteResource,
@@ -982,6 +1099,7 @@ export {
   decodeBrowserFrameMessage,
   decodeComputerFrameMessage,
   parseBrowserFrameMetadata,
-  parseComputerFrameMetadata
+  parseComputerFrameMetadata,
+  decodeComputerFrameMetadataHeader
 };
-//# sourceMappingURL=chunk-ST5DDKJP.js.map
+//# sourceMappingURL=chunk-NC57YMUO.js.map