@opengeni/sdk 1.2.1-canary.37222965366001 → 1.4.0

package/README.md

@@ -183,8 +183,16 @@ resolved user server-side, so each user sees only the chats they started;
 `sessionList: "visible"` lists every chat OpenGeni lets the user read in the
 workspace, and `false` disables listing. Archive and restore go through
 `updateSessionArchive` unless `archive: false`. A "New chat" in `OpenGeniChat`
-sends only `{ initialMessage, idempotencyKey }`, so it needs the
-`createSession` hook.
+sends `{ initialMessage, idempotencyKey }` plus any attached file `resources`
+and, unless `modelSelection: false`, the user's explicit model choices, so it
+needs the `createSession` hook. The hook sees them as input; the proxy adds the
+files and applies those choices to the request the hook returns. Voice input
+(`POST .../transcriptions`) is forwarded as the resolved user unless
+`voiceInput: false`. The client config the proxy serves reports what it can do:
+`sessionCreation` (a `createSession` hook exists), `archive`, and `artifacts`
+(`false` unless `artifacts: true`). The stock UI hides "New chat" and
+"Archive" when they are off, shows Site previews as unavailable without a
+request, and shows the composer microphone only when `voiceInput.available`.
 
 `listSessionPage` includes personal pinned details by default. A caller with a
 separate `pinsOnly: true` read can pass `includePinned: false` on ordinary pages
@@ -205,8 +213,14 @@ workspace. Only the native routes `OpenGeniProvider` and the conversation use
 are served: client config; workspace read, model catalog, live control stream,
 and workspace Resume; session read/rename, events (list and SSE with
 `Last-Event-ID` resume), send/steer/approval/human-input, queue, composer
-draft, pause/resume; and, unless `files: false`, attachment upload and download
-URLs. Every other route or method is a 404 (cancel and workspace Pause are
+draft, pause/resume, and the session goal (read; pause/resume, forwarding only
+`{ status: "paused" | "active" }`; and clear, the proxy's only `DELETE`); and, unless `files: false`, attachment upload and download
+URLs plus the media the session produced (generated images and video,
+published files, and browser or computer screenshots). Workspace-level
+artifact reads (`artifacts/:id/content` with `Range`, `artifacts/:id/playback-source`)
+must name their session in `x-opengeni-session-id`; the proxy runs
+`authorizeSession` and forwards only an artifact OpenGeni proves that session
+produced. Every other route or method is a 404 (cancel and workspace Pause are
 refused); unknown query parameters on served reads pass through. Browser session creation is disabled
 unless you supply `createSession`; the browser may then send only
 `initialMessage` and `idempotencyKey`, and your hook returns the full request
@@ -1605,3 +1619,20 @@ Hosts, test doubles, and same-origin proxies must import
 configuration or contract header. Do not copy its string value: the revision is
 an executable compatibility boundary, and `getClientConfig()` intentionally
 fails closed when server and SDK revisions differ.
+
+### Action review facts
+
+`getToolActionReview(workspaceId, sessionId, approvalId)` returns version 1 facts
+for an exact prepared connector action: title, selected account/count, material
+effects, optional provider-sourced examples, bounded fields, reason, status and
+available actions. Use `sendApprovalDecision` for the existing authenticated
+human decision. Facts never grant execution authority.
+
+`getToolReviewDetails(workspaceId, sessionId, approvalId, { actionDigest, path,
+offset })` pages through the saved selection/values (25 rows per page). The
+reference is tied to the original action digest and requires the same session
+visibility permission; it never re-runs a search. Secret/write-only fields stay
+hidden. A missing legacy snapshot may return 404; other authorization or transport
+failures must not be interpreted as permission to execute. Responses are private
+and non-cacheable. Review states distinguish waiting, execution, cancellation,
+failure and uncertain outcome. Exact stored arguments are never client-editable.

package/dist/adapters/next.js

@@ -1,10 +1,10 @@
 import {
   createSessionProxyHandler
-} from "../chunk-66AKEWV6.js";
+} from "../chunk-FYQAMXDW.js";
 import "../chunk-UM4ZXXJR.js";
 import "../chunk-U6CV2SXO.js";
 import "../chunk-APXVSSSY.js";
-import "../chunk-WIYAB33K.js";
+import "../chunk-GYM54GKM.js";
 import "../chunk-V6GIY62B.js";
 
 // src/adapters/next.ts

package/dist/artifacts.js

@@ -1,11 +1,11 @@
 import {
   OpenGeniClient
-} from "./chunk-2NIR4WBR.js";
-import "./chunk-2VPO6IQC.js";
-import "./chunk-5AN2FLNC.js";
+} from "./chunk-MXV5O25O.js";
+import "./chunk-CA2T7QT4.js";
+import "./chunk-BVIIRSJY.js";
 import "./chunk-VPVMLM7Q.js";
 import "./chunk-APXVSSSY.js";
-import "./chunk-WIYAB33K.js";
+import "./chunk-GYM54GKM.js";
 import "./chunk-NC57YMUO.js";
 import "./chunk-V6GIY62B.js";
 export {

package/dist/azure-live-transport.d.ts

@@ -0,0 +1,32 @@
+import { type StartCodexRealtimeWebrtcOptions } from "./codex-realtime.js";
+import type { RealtimeControllerTransportStarter } from "./codex-realtime-controller.js";
+/** Azure Live has timed transcript fragments, not provider-finalized turns. */
+export declare class AzureLiveDataChannel extends EventTarget {
+    private readonly raw;
+    private readonly drainTimeoutMs;
+    private pending;
+    private timer;
+    private ordinal;
+    private readonly prefix;
+    private closed;
+    private closeSent;
+    private providerClosed;
+    private readonly delegations;
+    private userSinceDelegation;
+    private draining;
+    private finishDrain;
+    private readonly onOpen;
+    private readonly onClose;
+    private readonly onError;
+    private readonly onMessage;
+    constructor(raw: RTCDataChannel, drainTimeoutMs?: number);
+    get readyState(): RTCDataChannelState;
+    asRtcDataChannel(): RTCDataChannel;
+    private emit;
+    private flush;
+    private receive;
+    send(payload: string): void;
+    drain(): Promise<void>;
+    close(): void;
+}
+export declare function createAzureLiveTransportStarter(options?: Pick<StartCodexRealtimeWebrtcOptions, "remoteAudio" | "createPeerConnection">): RealtimeControllerTransportStarter;

package/dist/browser.js

@@ -1,6 +1,6 @@
 import {
   resolveWorkspaceVoiceInputEnabled
-} from "./chunk-VYCTL62C.js";
+} from "./chunk-GZQSWAKD.js";
 import {
   OpenGeniToolCallError,
   OpenGeniToolReapprovalRequiredError,
@@ -8,13 +8,13 @@ import {
 } from "./chunk-4SMEOV3P.js";
 import {
   OpenGeniClient
-} from "./chunk-5AN2FLNC.js";
+} from "./chunk-BVIIRSJY.js";
 import "./chunk-VPVMLM7Q.js";
 import "./chunk-APXVSSSY.js";
 import {
   OPENGENI_API_CONTRACT_HEADER,
   OPENGENI_API_CONTRACT_REVISION
-} from "./chunk-WIYAB33K.js";
+} from "./chunk-GYM54GKM.js";
 import "./chunk-NC57YMUO.js";
 import {
   OpenGeniAllowanceExhaustedError,

package/dist/chat/index.js

@@ -11,18 +11,18 @@ import {
   EMPTY_FINAL_REPLY_NOTICE,
   OpenGeniEmbeddingClient,
   turnCompletedWithEmptyFinalReply
-} from "../chunk-TZFJUYCT.js";
-import "../chunk-2NIR4WBR.js";
-import "../chunk-2VPO6IQC.js";
+} from "../chunk-D534PIXF.js";
+import "../chunk-MXV5O25O.js";
+import "../chunk-CA2T7QT4.js";
 import {
   chatDefaults
 } from "../chunk-UM4ZXXJR.js";
-import "../chunk-5AN2FLNC.js";
+import "../chunk-BVIIRSJY.js";
 import "../chunk-VPVMLM7Q.js";
 import {
   parseSseStream
 } from "../chunk-APXVSSSY.js";
-import "../chunk-WIYAB33K.js";
+import "../chunk-GYM54GKM.js";
 import "../chunk-NC57YMUO.js";
 import {
   OpenGeniApiError,

package/dist/{chunk-5AN2FLNC.js → chunk-BVIIRSJY.js}

@@ -15,7 +15,7 @@ import {
   OPENGENI_API_CONTRACT_REVISION,
   OPENGENI_CORRELATION_HEADER,
   RETAINED_OUTPUT_MAX_PAGE_BYTES
-} from "./chunk-WIYAB33K.js";
+} from "./chunk-GYM54GKM.js";
 import {
   OpenGeniInteractionClient,
   decodeComputerFrameMetadataHeader,
@@ -1011,6 +1011,23 @@ var OpenGeniClient = class {
       options
     );
   }
+  async getToolActionReview(workspaceId, sessionId, approvalId) {
+    return await this.requestJson(
+      "GET",
+      `${sessionPath(workspaceId, sessionId)}/tool-reviews/${encodeURIComponent(approvalId)}`
+    );
+  }
+  async getToolReviewDetails(workspaceId, sessionId, approvalId, options) {
+    const query = new URLSearchParams({
+      actionDigest: options.actionDigest,
+      path: options.path ?? "",
+      offset: String(options.offset ?? 0)
+    });
+    return await this.requestJson(
+      "GET",
+      `${sessionPath(workspaceId, sessionId)}/tool-reviews/${encodeURIComponent(approvalId)}/details?${query}`
+    );
+  }
   /** Exact model-visible prefix captured from the latest provider request. */
   async getSessionModelContext(workspaceId, sessionId) {
     return await this.requestJson(
@@ -5079,9 +5096,12 @@ var OpenGeniClient = class {
     );
   }
   async getConnectorToolPermissions(workspaceId, capabilityId, options = {}) {
+    const query = new URLSearchParams();
+    if (options.connectionId) query.set("connectionId", options.connectionId);
+    if (options.instanceKey) query.set("instanceKey", options.instanceKey);
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/capabilities/${encodeURIComponent(capabilityId)}/tool-permissions`,
+      `/v1/workspaces/${workspaceId}/capabilities/${encodeURIComponent(capabilityId)}/tool-permissions${query.size ? `?${query}` : ""}`,
       void 0,
       {},
       options
@@ -5592,6 +5612,25 @@ var OpenGeniClient = class {
       request
     );
   }
+  /** List verified local and explicitly organization-shared bots, excluding personal accounts. */
+  async listAvailableOpenGeniSlackBots(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/connections/slack-bot/available`);
+  }
+  /** Read configured sharing independently of installation credential health. */
+  async getOpenGeniSlackBotOrganizationAccess(workspaceId, connectionId) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/connections/${connectionId}/slack-bot/organization-access`
+    );
+  }
+  /** An organization administrator may share an installed bot with authorized workspaces. */
+  async setOpenGeniSlackBotOrganizationAccess(workspaceId, connectionId, request) {
+    return this.requestJson(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/connections/${connectionId}/slack-bot/organization-access`,
+      request
+    );
+  }
   /** Start the public Slack installation flow for the workspace-shared OpenGeni bot. */
   async startOpenGeniSlackBotInstall(workspaceId, request = {}) {
     return await this.requestJson(
@@ -6801,4 +6840,4 @@ export {
   parseMediaGenerationResult,
   OpenGeniClient
 };
-//# sourceMappingURL=chunk-5AN2FLNC.js.map
+//# sourceMappingURL=chunk-BVIIRSJY.js.map