@opengeni/sdk 1.0.1 → 2.3.0-canary.0

package/src/editable-artifacts/worker/runtime.ts

@@ -5,9 +5,13 @@ import {
   decodeEditableArtifactMutationIntent,
   hashEditableArtifactMutationIntent,
 } from "@opengeni/contracts/editable-artifacts";
-import { decodeCommittedTransactionSummary } from "@opengeni/contracts/editable-artifact-committed-transaction";
+import {
+  COMMITTED_TRANSACTION_PROTOCOL_VERSION,
+  decodeCommittedTransactionSummary,
+} from "@opengeni/contracts/editable-artifact-committed-transaction";
 import { editableArtifactCodecFor } from "@opengeni/contracts/editable-artifact-codec-registry";
 import { decodeEditableArtifactSerializedCommit } from "@opengeni/contracts/editable-artifact-serialized-commit";
+import { SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION } from "@opengeni/contracts/editable-artifact-versions";
 import type {
   EditableArtifactBlockedPending,
   EditableArtifactCausalFrontier,
@@ -269,18 +273,20 @@ export class ArtifactWorkerRuntime {
       snapshot.modality !== initialization.modality ||
       snapshot.modality !== adapter.modality ||
       (snapshot.modality === "spreadsheet" &&
-        snapshot.protocolVersion !== adapter.protocolVersion) ||
-      snapshot.kernelVersion !== adapter.kernelVersion ||
+        (snapshot.operationProtocolVersion !== COMMITTED_TRANSACTION_PROTOCOL_VERSION ||
+          snapshot.snapshotVersion !== SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION)) ||
       snapshot.modelSchemaVersion !== adapter.modelSchemaVersion
     ) {
       throw runtimeError(
         "unsupported_protocol",
-        "snapshot protocol/kernel/schema is incompatible with the loaded collaboration kernel",
+        "snapshot protocol/schema is incompatible with the loaded collaboration kernel",
       );
     }
     const digest = await sha256Hex(ownedBytes);
     this.throwIfCancelled(frame.requestId);
-    requireMatchingHash(digest, snapshot.digest, "snapshot digest");
+    if (digest !== snapshot.digest) {
+      throw runtimeError("byte_corruption", "snapshot digest does not match its bytes");
+    }
     const canonical = requireBytesWithin(
       adapter.canonicalizeSnapshot(ownedBytes),
       initialization.maximumSnapshotBytes,
@@ -298,7 +304,12 @@ export class ArtifactWorkerRuntime {
     try {
       stateHash = await nextConfirmed.stateHash();
       this.throwIfCancelled(frame.requestId);
-      requireMatchingHash(stateHash, snapshot.stateHash, "snapshot state");
+      if (stateHash !== snapshot.stateHash) {
+        throw runtimeError(
+          "authored_causal_mismatch",
+          "snapshot authored state does not match its state hash",
+        );
+      }
       if (
         snapshot.modality !== "spreadsheet" &&
         nextConfirmed.nativeRevision() !== snapshot.nativeRevision
@@ -324,7 +335,7 @@ export class ArtifactWorkerRuntime {
             artifactId: snapshot.artifactId,
             modality: "spreadsheet",
             sequence: snapshot.sequence,
-            protocolVersion: snapshot.protocolVersion,
+            protocolVersion: adapter.protocolVersion,
             kernelVersion: snapshot.kernelVersion,
             modelSchemaVersion: snapshot.modelSchemaVersion,
             stateHash,
@@ -566,7 +577,7 @@ export class ArtifactWorkerRuntime {
     }
     if (
       transaction.modality === "spreadsheet" &&
-      transaction.protocolVersion !== installed.protocolVersion
+      transaction.operationProtocolVersion !== COMMITTED_TRANSACTION_PROTOCOL_VERSION
     )
       throw runtimeError("unsupported_protocol", "committed transaction protocol is incompatible");
     if (transaction.startSequence !== installed.sequence + 1) {
@@ -1046,12 +1057,12 @@ function assertCommittedEnvelopeMatchesOuter(
   } catch (error) {
     throw new ArtifactWorkerProtocolError(
       "invalid_committed_transaction",
-      "committed transaction is not canonical OGACO001",
+      "committed transaction is not canonical OGACO002",
       { cause: error },
     );
   }
   if (
-    summary.operationProtocolVersion !== transaction.protocolVersion ||
+    summary.operationProtocolVersion !== transaction.operationProtocolVersion ||
     summary.transactionId !== transaction.transactionId ||
     summary.priorStateHash !== transaction.priorStateHash ||
     summary.stateHash !== transaction.stateHash ||
@@ -1059,7 +1070,7 @@ function assertCommittedEnvelopeMatchesOuter(
   ) {
     throw runtimeError(
       "committed_metadata_mismatch",
-      "outer committed metadata disagrees with its exact OGACO001 envelope",
+      "outer committed metadata disagrees with its exact OGACO002 envelope",
     );
   }
 }
@@ -1156,8 +1167,9 @@ function asWorkerFailure(error: unknown): WorkerFailure {
     };
   }
   if (error instanceof Error) {
+    const rawCode = (error as Error & { code?: unknown }).code;
     return {
-      code: "kernel_failed",
+      code: typeof rawCode === "string" ? normalizeErrorCode(rawCode) : "kernel_failed",
       message: sanitizeErrorMessage(error.message || "artifact kernel failed"),
       retryable: false,
     };
@@ -1175,7 +1187,8 @@ function asProtocolError(error: unknown): ArtifactWorkerProtocolError {
 }
 
 function normalizeErrorCode(value: string): string {
-  return /^[a-z][a-z0-9_]{0,127}$/.test(value) ? value : "kernel_failed";
+  const normalized = value.toLowerCase();
+  return /^[a-z][a-z0-9_]{0,127}$/.test(normalized) ? normalized : "kernel_failed";
 }
 
 function sanitizeErrorMessage(value: string): string {

package/src/editable-artifacts/worker/wire-codec.ts

@@ -126,7 +126,10 @@ export function encodeSnapshotMetadata(snapshot: EditableArtifactSnapshot): Uint
   if (snapshot.modality === "spreadsheet") {
     writer
       .frontier(snapshot.causalFrontier)
-      .u32(positiveSafeInteger(snapshot.protocolVersion, "snapshot.protocolVersion"));
+      .u32(
+        positiveSafeInteger(snapshot.operationProtocolVersion, "snapshot.operationProtocolVersion"),
+      )
+      .u32(positiveSafeInteger(snapshot.snapshotVersion, "snapshot.snapshotVersion"));
   } else {
     writer.safeUint(nonNegativeSafeInteger(snapshot.nativeRevision, "snapshot.nativeRevision"));
   }
@@ -154,7 +157,11 @@ export function decodeSnapshotMetadata(
           ...common,
           modality,
           causalFrontier: reader.frontier(),
-          protocolVersion: positiveSafeInteger(reader.u32(), "snapshot.protocolVersion"),
+          operationProtocolVersion: positiveSafeInteger(
+            reader.u32(),
+            "snapshot.operationProtocolVersion",
+          ),
+          snapshotVersion: positiveSafeInteger(reader.u32(), "snapshot.snapshotVersion"),
         }
       : {
           ...common,
@@ -195,7 +202,10 @@ export function decodeCommittedMetadata(
           ...common,
           modality,
           causalFrontier: reader.frontier(),
-          protocolVersion: positiveSafeInteger(reader.u32(), "transaction.protocolVersion"),
+          operationProtocolVersion: positiveSafeInteger(
+            reader.u32(),
+            "transaction.operationProtocolVersion",
+          ),
         }
       : {
           ...common,
@@ -427,7 +437,12 @@ function encodeCommittedFields(
   if (transaction.modality === "spreadsheet") {
     writer
       .frontier(transaction.causalFrontier)
-      .u32(positiveSafeInteger(transaction.protocolVersion, "transaction.protocolVersion"));
+      .u32(
+        positiveSafeInteger(
+          transaction.operationProtocolVersion,
+          "transaction.operationProtocolVersion",
+        ),
+      );
   } else {
     writer
       .safeUint(
@@ -461,7 +476,10 @@ function decodeCommittedFields(
           ...common,
           modality,
           causalFrontier: reader.frontier(),
-          protocolVersion: positiveSafeInteger(reader.u32(), "transaction.protocolVersion"),
+          operationProtocolVersion: positiveSafeInteger(
+            reader.u32(),
+            "transaction.operationProtocolVersion",
+          ),
         }
       : {
           ...common,

package/src/errors.ts

@@ -128,7 +128,7 @@ function boundedCorrelationId(value: unknown): string | undefined {
   return value;
 }
 
-/** A short-lived session-list snapshot cursor can no longer be continued. */
+/** A legacy short-lived session-list snapshot cursor can no longer be continued. */
 export class OpenGeniSessionListCursorError extends OpenGeniApiError {}
 
 /** The browser bundle and API disagree about their state-changing wire contract. */

package/src/index.ts

@@ -48,6 +48,8 @@ export {
   parseMediaGenerationResult,
   parseRetainedGeneratedImageReference,
   parseRetainedGeneratedVideoReference,
+  parseRetainedWorkspaceFileReference,
+  parseSandboxFileArtifactReceipt,
 } from "./retained-artifacts";
 export {
   CodexRealtimeMicrophoneError,
@@ -158,6 +160,25 @@ export {
   normalizeWorkspaceInstructionPolicyRoleKey,
   WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS,
 } from "./workspace-instruction-policies";
+export type {
+  ActivateWorkspaceLearningPolicyRevisionRequest,
+  CreateWorkspaceLearningPolicyRevisionRequest,
+  GovernedLearningActivationReceipt,
+  GovernedLearningActivationUndoReceipt,
+  GovernedLearningDecisionReceipt,
+  RollbackWorkspaceLearningPolicyRevisionRequest,
+  WorkspaceLearningHistoryOptions,
+  WorkspaceLearningHistoryResponse,
+  WorkspaceLearningMode,
+  WorkspaceLearningOverrideMode,
+  WorkspaceLearningPolicyEvent,
+  WorkspaceLearningPolicyHead,
+  WorkspaceLearningPolicyMutationResponse,
+  WorkspaceLearningPolicyRevision,
+  WorkspaceLearningPolicyRevisionIdentity,
+  WorkspaceLearningSourceOverride,
+  WorkspaceLearningSourceOverrideInput,
+} from "./workspace-learning";
 export {
   COMPANY_PROFILE_ENTRY_MAX_CHARS,
   COMPANY_PROFILE_ENTRY_MAX_COUNT,
@@ -225,6 +246,28 @@ export type {
   WorkspaceStateResponse,
   WorkspaceStateSourceKindCounts,
 } from "./workspace-state";
+export type {
+  CompanyBrainContextReceiptListOptions,
+  CompanyBrainContextReceiptPage,
+  CompanyBrainInspectorTransport,
+  CompanyBrainKnowledgeBrowseRequest,
+  CompanyBrainKnowledgeBrowseResponse,
+  CompanyBrainKnowledgeGetResponse,
+  CompanyBrainKnowledgeRecord,
+  CompanyBrainKnowledgeProposalListOptions,
+  CompanyBrainKnowledgeProposalPage,
+  CompanyBrainKnowledgeSearchRequest,
+  CompanyBrainKnowledgeSearchResponse,
+  CompanyBrainOkfDownload,
+  CompanyBrainOkfPackage,
+} from "./company-brain";
+export {
+  browseCompanyBrainKnowledge,
+  getCompanyBrainKnowledge,
+  listCompanyBrainContextReceipts,
+  listCompanyBrainKnowledgeProposals,
+  searchCompanyBrainKnowledge,
+} from "./company-brain";
 export type {
   MemorySlackImportance,
   MemorySlackPublication,
@@ -250,6 +293,7 @@ export type {
   DeactivatePreferenceRegistryRequest,
   PreferenceRegistryConflictStrategy,
   PreferenceRegistryDescriptor,
+  PreferenceRegistryActivationAuthority,
   PreferenceRegistryDescriptorProvenance,
   PreferenceRegistryDetailResponse,
   PreferenceRegistryEvent,
@@ -305,9 +349,12 @@ export {
   OPENGENI_API_CONTRACT_HEADER,
   OPENGENI_API_CONTRACT_REVISION,
   OPENGENI_CORRELATION_HEADER,
+  PERSONAL_RESOURCE_SHARED_OUTPUT_WARNING,
+  PERSONAL_RESOURCE_SHARED_OUTPUT_WARNING_VERSION,
   GENERATED_VIDEO_MAX_BYTES,
   RETAINED_OUTPUT_DEFAULT_PAGE_BYTES,
   RETAINED_OUTPUT_MAX_PAGE_BYTES,
+  SANDBOX_FILE_ARTIFACT_MAX_BYTES,
   SESSION_EVENT_TYPES,
 } from "./types";
 export type {
@@ -330,10 +377,21 @@ export type {
   BillingSummary,
   ListManagedOrganizationMembershipsResponse,
   ManagedOrganizationMembership,
+  OrganizationAdministrationOverview,
+  OrganizationPrivateSessionSettings,
+  OrganizationSummary,
+  OrganizationWorkspaceAccess,
+  OrganizationWorkspaceAccessMember,
+  CreateOrganizationWorkspaceRequest,
+  UpdateOrganizationNameRequest,
+  UpdateOrganizationPrivateSessionSettingsRequest,
   BillingUsageResponse,
   InsightsRange,
   InsightsBillingPath,
   InsightsPricingSource,
+  ModelContextContributionSource,
+  InsightsPromptContributionRow,
+  InsightsPromptContributions,
   InsightsModelUsageRow,
   InsightsModelCallRow,
   InsightsSeriesPoint,
@@ -397,6 +455,7 @@ export type {
   SessionRealtimeState,
   WorkspaceModelCatalogModel,
   WorkspaceModelCatalogResponse,
+  WorkspaceModelAccessPolicy,
   WorkspaceRealtimeModelCatalogItem,
   WorkspaceRealtimeModelCatalogResponse,
   CodexAccount,
@@ -436,6 +495,22 @@ export type {
   ConnectionOwnership,
   ConnectionResponse,
   ConnectionStatus,
+  PersonalGitHubConnectionMetadata,
+  PersonalGitHubConnectionStatusResponse,
+  PersonalGitHubDisconnectRequest,
+  PersonalGitHubOAuthStartRequest,
+  PersonalGitHubOAuthStartResponse,
+  ListPersonalGitHubRepositoriesOptions,
+  ListPersonalGitHubRepositoriesResponse,
+  PersonalGitHubRepository,
+  PersonalGitHubRepositoryAccess,
+  PersonalGitHubRepositoryCatalogItem,
+  PersonalGitHubRepositoryPermissions,
+  PersonalGitHubRepositorySelectionInput,
+  PersonalGitHubRepositorySelectionState,
+  PersonalGitHubSelectedRepository,
+  ReplacePersonalGitHubRepositorySelectionsRequest,
+  VerifyPersonalGitHubRepositorySelectionsRequest,
   ConnectorDocumentDestination,
   ConnectorDocumentDestinationAuthority,
   ConnectorDocumentDestinationSelection,
@@ -451,9 +526,14 @@ export type {
   SlackInstallationBinding,
   SlackInstallationBindingState,
   ListSlackInstallationBindingsResponse,
+  SlackChannelRoute,
+  SlackChannelRouteListResponse,
+  UpdateSlackChannelRoutesRequest,
   SlackReactionChannel,
   SlackReactionChannelListResponse,
   CreateConnectionRequest,
+  CreateBillingPortalRequest,
+  CreateBillingPortalResponse,
   CreateCheckoutRequest,
   CreateCheckoutResponse,
   CreateDocumentBaseRequest,
@@ -552,6 +632,16 @@ export type {
   GitCredentialProvider,
   GitCredentialBindingId,
   GitRepositoryAccess,
+  PrReviewProvider,
+  PrReviewCredentialKind,
+  PrReviewWebhookAuthKind,
+  PrReviewAppRegistration,
+  PrReviewRepositoryBinding,
+  CreatePrReviewAppRegistrationRequest,
+  UpdatePrReviewAppRegistrationRequest,
+  CreatePrReviewRepositoryBindingRequest,
+  UpdatePrReviewRepositoryBindingRequest,
+  ListPrReviewConfigurationResponse,
   ListApiKeysResponse,
   ListConnectionsResponse,
   ListPacksResponse,
@@ -635,6 +725,17 @@ export type {
   ScheduledTaskStatus,
   ScheduledTaskTriggerType,
   Session,
+  SessionBackgroundCommand,
+  SessionBackgroundCommandActivity,
+  SessionBackgroundCommandListResponse,
+  CancelSessionBackgroundCommandResult,
+  SessionVisibility,
+  SessionTenancyCreateCapabilities,
+  SessionTenancyPublicProjection,
+  UpdateSessionVisibilityRequest,
+  UpdateSessionVisibilityResponse,
+  ForkSessionRequest,
+  ForkSessionResponse,
   SessionCapabilities,
   AgentTopologyPageResponse,
   AgentTopologySession,
@@ -653,9 +754,13 @@ export type {
   MoveSessionQueueItemRequest,
   NewSessionDraft,
   NewSessionDraftOptions,
+  NewSessionSelectionHistory,
   SaveComposerDraftRequest,
+  SubmitComposerDraftRequest,
+  SubmitComposerDraftResponse,
   SaveNewSessionDraftRequest,
   SessionCommandReceipt,
+  SessionPromptRouting,
   SteerSessionQueueItemRequest,
   WorkspaceInferenceControlResponse,
   SessionPendingInputPreview,
@@ -702,6 +807,12 @@ export type {
   SessionEventSemanticClass,
   SessionEventType,
   SessionGoal,
+  SessionGoalRevision,
+  ListSessionGoalRevisionsOptions,
+  ListSessionGoalRevisionsResponse,
+  RejectSessionGoalRevisionRequest,
+  RejectSessionGoalRevisionResponse,
+  RollbackSessionGoalRevisionRequest,
   SessionGoalCreatedBy,
   SessionGoalStatus,
   SessionHumanInputRequest,
@@ -741,6 +852,8 @@ export type {
   FsListBatchResponse,
   FsReadRequest,
   FsReadResponse,
+  PublishSandboxFileArtifactRequest,
+  SandboxFileArtifactReceipt,
   FsWriteRequest,
   FsWriteResponse,
   FsDeleteRequest,
@@ -795,6 +908,8 @@ export type {
   UpdateSessionGoalRequest,
   UpdateSessionMcpApprovalPolicyRequest,
   UpdateSessionMcpApprovalPolicyResponse,
+  UpdateSessionAttentionRequest,
+  UpdateSessionArchiveRequest,
   UpdateSessionPinRequest,
   UpdateSessionRequest,
   UpdateSessionToolPolicyRequest,
@@ -802,6 +917,7 @@ export type {
   UpdateWorkspaceEnvironmentRequest,
   UpdateWorkspaceMemberRequest,
   UpdateWorkspaceRequest,
+  UpdateWorkspaceModelAccessPolicyRequest,
   UpdateWorkspaceSettingsRequest,
   WorkspaceSlackReactionSummonSettings,
   TranscribeAudioResponse,
@@ -811,6 +927,13 @@ export type {
   UserApprovalDecisionEventInput,
   UserHumanInputResponseEventInput,
   UserMessageEventInput,
+  PersonalResourceAttachmentIntent,
+  PersonalResourceAttachmentSummary,
+  UserResourceAuthoritySummary,
+  UserResourceAuthorityGrant,
+  UserResourceKind,
+  ListUserResourceAuthoritiesOptions,
+  ListUserResourceAuthoritiesResponse,
   Workspace,
   WorkspaceControlEvent,
   VariableSet,
@@ -818,6 +941,7 @@ export type {
   VariableSetVariableMetadata,
   Channel,
   CreateChannelRequest,
+  ReorderChannelsRequest,
   UpdateChannelRequest,
   UpdateSessionChannelRequest,
   Rig,
@@ -887,6 +1011,7 @@ export type {
   WorkspaceMemorySearchRequest,
   WorkspaceMemorySearchResult,
   WorkspaceMemorySearchResponse,
+  WorkspaceSessionDefaults,
   WorkspaceSettings,
   WorkspaceVideoGenerationSettings,
   WorkspaceVoiceInputSettings,
@@ -895,6 +1020,14 @@ export type {
   MetricSample,
   MachineState,
   MachineKind,
+  MachineConnectionAuthority,
+  MachineRuntimeCapabilities,
+  MachineUpdateStatus,
+  MachineUpdateState,
+  MachineRuntime,
+  UpdateMachineAgentResponse,
+  MachineOperationPolicy,
+  UpdateMachineOperationPolicyRequest,
   MachineView,
   MachinesResponse,
   MachineMetricsSeriesResponse,
@@ -906,6 +1039,7 @@ export type {
   // Self-hosted enrollment UX (design 11): click-Grant approve-page lookup/deny +
   // headless enroll-token mint/exchange.
   EnrollmentOs,
+  ResourceAuthorityScope,
   DeviceEnrollmentLookupRequest,
   DeviceEnrollmentLookupResponse,
   DeviceEnrollmentLookupMachine,

package/src/interaction.ts

@@ -1,4 +1,5 @@
 import type { OpenGeniRequestOptions } from "./client";
+import { OpenGeniApiError } from "./errors";
 import type { RetainedArtifactReference } from "./types";
 
 /** Public Browser/Computer protocol version. Driver and provider details stay private. */
@@ -28,6 +29,83 @@ export type InteractionJsonValue =
   | InteractionJsonValue[]
   | { [key: string]: InteractionJsonValue };
 
+export type InteractionControlFailureCode =
+  | "unknown"
+  | "unsupported"
+  | "os"
+  | "not_found"
+  | "consent_required"
+  | "timeout"
+  | "draining"
+  | "protocol"
+  | "stream"
+  | "agent_offline"
+  | "fenced"
+  | "payload_too_large";
+
+export type InteractionControlFailure = {
+  layer: "connected_machine";
+  surface: "browser" | "computer";
+  code: InteractionControlFailureCode;
+  retryable: boolean;
+  outcomeUnknown: boolean;
+  requestId: string | undefined;
+  controlRequestId: string | undefined;
+  message: string;
+};
+
+/** Decodes the bounded typed control-failure details emitted by OpenGeni. Raw
+ * provider/OS detail is intentionally absent; both correlation ids are opaque. */
+export function interactionControlFailureFromError(
+  error: unknown,
+): InteractionControlFailure | null {
+  if (!(error instanceof OpenGeniApiError)) return null;
+  const details = error.details;
+  if (!details || details.interactionLayer !== "connected_machine") return null;
+  const surface = details.interactionSurface;
+  const code = details.controlFailureCode;
+  if ((surface !== "browser" && surface !== "computer") || !isControlFailureCode(code)) {
+    return null;
+  }
+  const controlRequestId = boundedOpaqueCorrelation(details.controlRequestId);
+  return {
+    layer: "connected_machine",
+    surface,
+    code,
+    retryable: error.retryable,
+    outcomeUnknown: error.outcomeUnknown,
+    requestId: error.correlationId,
+    controlRequestId,
+    message: error.message,
+  };
+}
+
+function isControlFailureCode(value: unknown): value is InteractionControlFailureCode {
+  return (
+    typeof value === "string" &&
+    [
+      "unknown",
+      "unsupported",
+      "os",
+      "not_found",
+      "consent_required",
+      "timeout",
+      "draining",
+      "protocol",
+      "stream",
+      "agent_offline",
+      "fenced",
+      "payload_too_large",
+    ].includes(value)
+  );
+}
+
+function boundedOpaqueCorrelation(value: unknown): string | undefined {
+  return typeof value === "string" && value.length <= 128 && /^[A-Za-z0-9._:-]+$/u.test(value)
+    ? value
+    : undefined;
+}
+
 export type InteractionPlacement =
   | { kind: "sandbox_group"; sandboxGroupId: string }
   | { kind: "connected_machine"; sandboxId: string }
@@ -71,8 +149,18 @@ export type AttachedBrowserDevice = {
   updatedAt: string;
 };
 
+export type AttachedBrowserBridge = {
+  enrollmentId: string;
+  state: "online" | "offline";
+  bridgeGeneration: string;
+  inventoryRevision: number;
+  connectedProfileCount: number;
+  lastSeenAt: string;
+};
+
 export type AttachedBrowserDeviceListResponse = {
   revision: number;
+  bridges: AttachedBrowserBridge[];
   devices: AttachedBrowserDevice[];
 };
 
@@ -2439,6 +2527,7 @@ export function browserFrameSocketUrl(
   else if (url.protocol !== "ws:" && url.protocol !== "wss:") {
     throw new Error("browser frame attachment did not contain an HTTP or WebSocket URL");
   }
+  upgradeMixedContentWebSocket(url);
   if (options.format !== undefined) url.searchParams.set("format", options.format);
   setBoundedIntegerQuery(url, "quality", options.quality, 1, 100);
   setBoundedIntegerQuery(url, "maxWidth", options.maxWidth, 1, 4_096);
@@ -2461,6 +2550,7 @@ export function computerFrameSocketUrl(
   else if (url.protocol !== "ws:" && url.protocol !== "wss:") {
     throw new Error("computer frame attachment did not contain an HTTP or WebSocket URL");
   }
+  upgradeMixedContentWebSocket(url);
   if (options.format !== undefined) url.searchParams.set("format", options.format);
   setBoundedIntegerQuery(url, "quality", options.quality, 1, 100);
   setBoundedIntegerQuery(url, "maxWidth", options.maxWidth, 1, 4_096);
@@ -2754,6 +2844,11 @@ function computerRelevance(session: ComputerSession, associationSessionId: strin
   return Math.max(association, Number.isFinite(used) ? used : 0);
 }
 
+function upgradeMixedContentWebSocket(url: URL): void {
+  const protocol = (globalThis as { location?: { protocol?: string } }).location?.protocol;
+  if (protocol === "https:" && url.protocol === "ws:") url.protocol = "wss:";
+}
+
 function setBoundedIntegerQuery(
   url: URL,
   name: string,

package/src/organization-private-session-settings.ts

@@ -0,0 +1,33 @@
+import type { OpenGeniClient } from "./client";
+import type {
+  OrganizationPrivateSessionSettings,
+  UpdateOrganizationPrivateSessionSettingsRequest,
+} from "./types";
+
+type OrganizationPrivateSessionSettingsClient = Pick<OpenGeniClient, "requestJson">;
+
+function settingsPath(organizationId: string): string {
+  return `/v1/organizations/${organizationId}/private-session-settings`;
+}
+
+export async function getOrganizationPrivateSessionSettings(
+  client: OrganizationPrivateSessionSettingsClient,
+  organizationId: string,
+): Promise<OrganizationPrivateSessionSettings> {
+  return await client.requestJson<OrganizationPrivateSessionSettings>(
+    "GET",
+    settingsPath(organizationId),
+  );
+}
+
+export async function updateOrganizationPrivateSessionSettings(
+  client: OrganizationPrivateSessionSettingsClient,
+  organizationId: string,
+  request: UpdateOrganizationPrivateSessionSettingsRequest,
+): Promise<OrganizationPrivateSessionSettings> {
+  return await client.requestJson<OrganizationPrivateSessionSettings>(
+    "PATCH",
+    settingsPath(organizationId),
+    request,
+  );
+}