@opengeni/sdk 3.1.0 → 3.1.2

package/dist/usage-allowances.d.ts

@@ -0,0 +1,36 @@
+import type { OpenGeniClient, OpenGeniRequestOptions } from "./client.js";
+import type { ClearWorkspaceAllowanceRequest, ClearWorkspaceAllowanceResponse, GetMyUsageRequest, GetUsageRequest, GrantWorkspaceCreditsRequest, MemberAllowance, SetMemberAllowanceRequest, SetWorkspaceAllowanceRequest, WorkspaceAllowance, WorkspaceAllowanceState, WorkspaceCreditGrant, WorkspaceUsageResponse } from "@opengeni/contracts/usage-allowances";
+export type { AllowanceExhaustedRefusal, ClearWorkspaceAllowanceRequest, ClearWorkspaceAllowanceResponse, GetMyUsageRequest, GetUsageRequest, GrantWorkspaceCreditsRequest, MemberAllowance, MemberAllowanceDefault, MemberAllowanceRule, MemberAllowanceUsage, SetMemberAllowanceRequest, SetWorkspaceAllowanceRequest, UsageAllowancePeriod, UsageAllowanceStatus, UsageAllowanceWindow, WorkspaceAllowance, WorkspaceAllowanceConfig, WorkspaceAllowanceState, WorkspaceAllowanceUsage, WorkspaceCreditGrant, WorkspaceUsageResponse, } from "@opengeni/contracts/usage-allowances";
+/** The one client capability these functions need. */
+export type UsageAllowanceRequestClient = Pick<OpenGeniClient, "requestJson">;
+/** A member target: canonical subject id, or an external identity. */
+export type UsageAllowanceMemberTarget = string | {
+    source: string;
+    externalId: string;
+};
+/** Query strings for usage reads: only defined values, stringified. */
+export declare function usageAllowanceQuery(query: GetUsageRequest): Record<string, string>;
+/** Configuration, or null when no ceiling is configured. Budget-read authority. */
+export declare function getWorkspaceAllowance(client: UsageAllowanceRequestClient, workspaceId: string): Promise<WorkspaceAllowance | null>;
+/** Lifecycle version plus configuration; version survives a clear. Budget-read authority. */
+export declare function getWorkspaceAllowanceState(client: UsageAllowanceRequestClient, workspaceId: string): Promise<WorkspaceAllowanceState>;
+/**
+ * Set the workspace ceiling with exact-version compare-and-set. Requires a
+ * verified organization administrator or a full-access organization key.
+ */
+export declare function setWorkspaceAllowance(client: UsageAllowanceRequestClient, workspaceId: string, request: SetWorkspaceAllowanceRequest): Promise<WorkspaceAllowance>;
+/** Remove the ceiling (not a refund or counter reset). Returns the next lifecycle version. */
+export declare function clearWorkspaceAllowance(client: UsageAllowanceRequestClient, workspaceId: string, request: ClearWorkspaceAllowanceRequest): Promise<ClearWorkspaceAllowanceResponse>;
+/** One-off credits on top of the included amount. Reuse the operationId to retry. */
+export declare function grantWorkspaceCredits(client: UsageAllowanceRequestClient, workspaceId: string, request: GrantWorkspaceCreditsRequest): Promise<WorkspaceCreditGrant>;
+/**
+ * Set or restore (`rule: null`) one member's ceiling with exact-version CAS.
+ * Shares may oversubscribe the pool; the workspace ceiling still binds.
+ */
+export declare function setMemberAllowance(client: UsageAllowanceRequestClient, workspaceId: string, member: UsageAllowanceMemberTarget, request: SetMemberAllowanceRequest): Promise<MemberAllowance>;
+/** The paginated roster page. Workspace admin, organization admin, or org-key read. */
+export declare function getUsage(client: UsageAllowanceRequestClient, workspaceId: string, query?: GetUsageRequest, options?: OpenGeniRequestOptions): Promise<WorkspaceUsageResponse>;
+/** The caller's own row plus the workspace aggregate. Any authenticated member. */
+export declare function getMyUsage(client: UsageAllowanceRequestClient, workspaceId: string, query?: GetMyUsageRequest, options?: OpenGeniRequestOptions): Promise<WorkspaceUsageResponse>;
+/** Every roster page for one period (follows `nextCursor`). */
+export declare function getAllUsage(client: UsageAllowanceRequestClient, workspaceId: string, query?: Omit<GetUsageRequest, "cursor">, options?: OpenGeniRequestOptions): Promise<WorkspaceUsageResponse>;

package/dist/usage-allowances.js

@@ -0,0 +1,80 @@
+// src/usage-allowances.ts
+function workspacePath(workspaceId) {
+  return `/v1/workspaces/${encodeURIComponent(workspaceId)}`;
+}
+function usageAllowanceQuery(query) {
+  return Object.fromEntries(
+    Object.entries(query).filter(([, value]) => value !== void 0).map(([key, value]) => [key, String(value)])
+  );
+}
+async function getWorkspaceAllowance(client, workspaceId) {
+  return await client.requestJson("GET", `${workspacePath(workspaceId)}/allowance`);
+}
+async function getWorkspaceAllowanceState(client, workspaceId) {
+  return await client.requestJson("GET", `${workspacePath(workspaceId)}/allowance/state`);
+}
+async function setWorkspaceAllowance(client, workspaceId, request) {
+  return await client.requestJson("PUT", `${workspacePath(workspaceId)}/allowance`, request);
+}
+async function clearWorkspaceAllowance(client, workspaceId, request) {
+  return await client.requestJson("DELETE", `${workspacePath(workspaceId)}/allowance`, request);
+}
+async function grantWorkspaceCredits(client, workspaceId, request) {
+  return await client.requestJson(
+    "POST",
+    `${workspacePath(workspaceId)}/allowance/grants`,
+    request
+  );
+}
+async function setMemberAllowance(client, workspaceId, member, request) {
+  const path = typeof member === "string" ? encodeURIComponent(member) : `external/${encodeURIComponent(member.source)}/${encodeURIComponent(member.externalId)}`;
+  return await client.requestJson(
+    "PUT",
+    `${workspacePath(workspaceId)}/members/${path}/allowance`,
+    request
+  );
+}
+async function getUsage(client, workspaceId, query = {}, options = {}) {
+  return await client.requestJson(
+    "GET",
+    `${workspacePath(workspaceId)}/usage`,
+    void 0,
+    usageAllowanceQuery(query),
+    options
+  );
+}
+async function getMyUsage(client, workspaceId, query = {}, options = {}) {
+  return await client.requestJson(
+    "GET",
+    `${workspacePath(workspaceId)}/usage/me`,
+    void 0,
+    usageAllowanceQuery(query),
+    options
+  );
+}
+async function getAllUsage(client, workspaceId, query = {}, options = {}) {
+  const first = await getUsage(client, workspaceId, { limit: 200, ...query }, options);
+  const members = [...first.members];
+  let cursor = first.nextCursor;
+  const seen = /* @__PURE__ */ new Set();
+  while (cursor && !seen.has(cursor)) {
+    seen.add(cursor);
+    const page = await getUsage(client, workspaceId, { limit: 200, ...query, cursor }, options);
+    members.push(...page.members);
+    cursor = page.nextCursor;
+  }
+  return { ...first, members, nextCursor: null };
+}
+export {
+  clearWorkspaceAllowance,
+  getAllUsage,
+  getMyUsage,
+  getUsage,
+  getWorkspaceAllowance,
+  getWorkspaceAllowanceState,
+  grantWorkspaceCredits,
+  setMemberAllowance,
+  setWorkspaceAllowance,
+  usageAllowanceQuery
+};
+//# sourceMappingURL=usage-allowances.js.map

package/dist/usage-allowances.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/usage-allowances.ts"],"sourcesContent":["// @opengeni/sdk/usage-allowances — usage allowance reads and administration as\n// free functions over any client's `requestJson`, so a browser console can use\n// them without widening the native browser client. The root `OpenGeniClient`\n// methods of the same names call the same routes.\n//\n// Amounts are integer USD micros (1 USD = 1,000,000). Display `fraction` and\n// `status` in products that must not show money; see docs/usage-allowances.md.\nimport type { OpenGeniClient, OpenGeniRequestOptions } from \"./client\";\nimport type {\n  ClearWorkspaceAllowanceRequest,\n  ClearWorkspaceAllowanceResponse,\n  GetMyUsageRequest,\n  GetUsageRequest,\n  GrantWorkspaceCreditsRequest,\n  MemberAllowance,\n  SetMemberAllowanceRequest,\n  SetWorkspaceAllowanceRequest,\n  WorkspaceAllowance,\n  WorkspaceAllowanceState,\n  WorkspaceCreditGrant,\n  WorkspaceUsageResponse,\n} from \"@opengeni/contracts/usage-allowances\";\n\nexport type {\n  AllowanceExhaustedRefusal,\n  ClearWorkspaceAllowanceRequest,\n  ClearWorkspaceAllowanceResponse,\n  GetMyUsageRequest,\n  GetUsageRequest,\n  GrantWorkspaceCreditsRequest,\n  MemberAllowance,\n  MemberAllowanceDefault,\n  MemberAllowanceRule,\n  MemberAllowanceUsage,\n  SetMemberAllowanceRequest,\n  SetWorkspaceAllowanceRequest,\n  UsageAllowancePeriod,\n  UsageAllowanceStatus,\n  UsageAllowanceWindow,\n  WorkspaceAllowance,\n  WorkspaceAllowanceConfig,\n  WorkspaceAllowanceState,\n  WorkspaceAllowanceUsage,\n  WorkspaceCreditGrant,\n  WorkspaceUsageResponse,\n} from \"@opengeni/contracts/usage-allowances\";\n\n/** The one client capability these functions need. */\nexport type UsageAllowanceRequestClient = Pick<OpenGeniClient, \"requestJson\">;\n\n/** A member target: canonical subject id, or an external identity. */\nexport type UsageAllowanceMemberTarget = string | { source: string; externalId: string };\n\nfunction workspacePath(workspaceId: string): string {\n  return `/v1/workspaces/${encodeURIComponent(workspaceId)}`;\n}\n\n/** Query strings for usage reads: only defined values, stringified. */\nexport function usageAllowanceQuery(query: GetUsageRequest): Record<string, string> {\n  return Object.fromEntries(\n    Object.entries(query)\n      .filter(([, value]) => value !== undefined)\n      .map(([key, value]) => [key, String(value)]),\n  );\n}\n\n/** Configuration, or null when no ceiling is configured. Budget-read authority. */\nexport async function getWorkspaceAllowance(\n  client: UsageAllowanceRequestClient,\n  workspaceId: string,\n): Promise<WorkspaceAllowance | null> {\n  return await client.requestJson(\"GET\", `${workspacePath(workspaceId)}/allowance`);\n}\n\n/** Lifecycle version plus configuration; version survives a clear. Budget-read authority. */\nexport async function getWorkspaceAllowanceState(\n  client: UsageAllowanceRequestClient,\n  workspaceId: string,\n): Promise<WorkspaceAllowanceState> {\n  return await client.requestJson(\"GET\", `${workspacePath(workspaceId)}/allowance/state`);\n}\n\n/**\n * Set the workspace ceiling with exact-version compare-and-set. Requires a\n * verified organization administrator or a full-access organization key.\n */\nexport async function setWorkspaceAllowance(\n  client: UsageAllowanceRequestClient,\n  workspaceId: string,\n  request: SetWorkspaceAllowanceRequest,\n): Promise<WorkspaceAllowance> {\n  return await client.requestJson(\"PUT\", `${workspacePath(workspaceId)}/allowance`, request);\n}\n\n/** Remove the ceiling (not a refund or counter reset). Returns the next lifecycle version. */\nexport async function clearWorkspaceAllowance(\n  client: UsageAllowanceRequestClient,\n  workspaceId: string,\n  request: ClearWorkspaceAllowanceRequest,\n): Promise<ClearWorkspaceAllowanceResponse> {\n  return await client.requestJson(\"DELETE\", `${workspacePath(workspaceId)}/allowance`, request);\n}\n\n/** One-off credits on top of the included amount. Reuse the operationId to retry. */\nexport async function grantWorkspaceCredits(\n  client: UsageAllowanceRequestClient,\n  workspaceId: string,\n  request: GrantWorkspaceCreditsRequest,\n): Promise<WorkspaceCreditGrant> {\n  return await client.requestJson(\n    \"POST\",\n    `${workspacePath(workspaceId)}/allowance/grants`,\n    request,\n  );\n}\n\n/**\n * Set or restore (`rule: null`) one member's ceiling with exact-version CAS.\n * Shares may oversubscribe the pool; the workspace ceiling still binds.\n */\nexport async function setMemberAllowance(\n  client: UsageAllowanceRequestClient,\n  workspaceId: string,\n  member: UsageAllowanceMemberTarget,\n  request: SetMemberAllowanceRequest,\n): Promise<MemberAllowance> {\n  const path =\n    typeof member === \"string\"\n      ? encodeURIComponent(member)\n      : `external/${encodeURIComponent(member.source)}/${encodeURIComponent(member.externalId)}`;\n  return await client.requestJson(\n    \"PUT\",\n    `${workspacePath(workspaceId)}/members/${path}/allowance`,\n    request,\n  );\n}\n\n/** The paginated roster page. Workspace admin, organization admin, or org-key read. */\nexport async function getUsage(\n  client: UsageAllowanceRequestClient,\n  workspaceId: string,\n  query: GetUsageRequest = {},\n  options: OpenGeniRequestOptions = {},\n): Promise<WorkspaceUsageResponse> {\n  return await client.requestJson(\n    \"GET\",\n    `${workspacePath(workspaceId)}/usage`,\n    undefined,\n    usageAllowanceQuery(query),\n    options,\n  );\n}\n\n/** The caller's own row plus the workspace aggregate. Any authenticated member. */\nexport async function getMyUsage(\n  client: UsageAllowanceRequestClient,\n  workspaceId: string,\n  query: GetMyUsageRequest = {},\n  options: OpenGeniRequestOptions = {},\n): Promise<WorkspaceUsageResponse> {\n  return await client.requestJson(\n    \"GET\",\n    `${workspacePath(workspaceId)}/usage/me`,\n    undefined,\n    usageAllowanceQuery(query),\n    options,\n  );\n}\n\n/** Every roster page for one period (follows `nextCursor`). */\nexport async function getAllUsage(\n  client: UsageAllowanceRequestClient,\n  workspaceId: string,\n  query: Omit<GetUsageRequest, \"cursor\"> = {},\n  options: OpenGeniRequestOptions = {},\n): Promise<WorkspaceUsageResponse> {\n  const first = await getUsage(client, workspaceId, { limit: 200, ...query }, options);\n  const members = [...first.members];\n  let cursor = first.nextCursor;\n  // Bounded: a cursor that repeats would otherwise loop forever.\n  const seen = new Set<string>();\n  while (cursor && !seen.has(cursor)) {\n    seen.add(cursor);\n    const page = await getUsage(client, workspaceId, { limit: 200, ...query, cursor }, options);\n    members.push(...page.members);\n    cursor = page.nextCursor;\n  }\n  return { ...first, members, nextCursor: null };\n}\n"],"mappings":";AAqDA,SAAS,cAAc,aAA6B;AAClD,SAAO,kBAAkB,mBAAmB,WAAW,CAAC;AAC1D;AAGO,SAAS,oBAAoB,OAAgD;AAClF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAK,EACjB,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,EACzC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC;AAAA,EAC/C;AACF;AAGA,eAAsB,sBACpB,QACA,aACoC;AACpC,SAAO,MAAM,OAAO,YAAY,OAAO,GAAG,cAAc,WAAW,CAAC,YAAY;AAClF;AAGA,eAAsB,2BACpB,QACA,aACkC;AAClC,SAAO,MAAM,OAAO,YAAY,OAAO,GAAG,cAAc,WAAW,CAAC,kBAAkB;AACxF;AAMA,eAAsB,sBACpB,QACA,aACA,SAC6B;AAC7B,SAAO,MAAM,OAAO,YAAY,OAAO,GAAG,cAAc,WAAW,CAAC,cAAc,OAAO;AAC3F;AAGA,eAAsB,wBACpB,QACA,aACA,SAC0C;AAC1C,SAAO,MAAM,OAAO,YAAY,UAAU,GAAG,cAAc,WAAW,CAAC,cAAc,OAAO;AAC9F;AAGA,eAAsB,sBACpB,QACA,aACA,SAC+B;AAC/B,SAAO,MAAM,OAAO;AAAA,IAClB;AAAA,IACA,GAAG,cAAc,WAAW,CAAC;AAAA,IAC7B;AAAA,EACF;AACF;AAMA,eAAsB,mBACpB,QACA,aACA,QACA,SAC0B;AAC1B,QAAM,OACJ,OAAO,WAAW,WACd,mBAAmB,MAAM,IACzB,YAAY,mBAAmB,OAAO,MAAM,CAAC,IAAI,mBAAmB,OAAO,UAAU,CAAC;AAC5F,SAAO,MAAM,OAAO;AAAA,IAClB;AAAA,IACA,GAAG,cAAc,WAAW,CAAC,YAAY,IAAI;AAAA,IAC7C;AAAA,EACF;AACF;AAGA,eAAsB,SACpB,QACA,aACA,QAAyB,CAAC,GAC1B,UAAkC,CAAC,GACF;AACjC,SAAO,MAAM,OAAO;AAAA,IAClB;AAAA,IACA,GAAG,cAAc,WAAW,CAAC;AAAA,IAC7B;AAAA,IACA,oBAAoB,KAAK;AAAA,IACzB;AAAA,EACF;AACF;AAGA,eAAsB,WACpB,QACA,aACA,QAA2B,CAAC,GAC5B,UAAkC,CAAC,GACF;AACjC,SAAO,MAAM,OAAO;AAAA,IAClB;AAAA,IACA,GAAG,cAAc,WAAW,CAAC;AAAA,IAC7B;AAAA,IACA,oBAAoB,KAAK;AAAA,IACzB;AAAA,EACF;AACF;AAGA,eAAsB,YACpB,QACA,aACA,QAAyC,CAAC,GAC1C,UAAkC,CAAC,GACF;AACjC,QAAM,QAAQ,MAAM,SAAS,QAAQ,aAAa,EAAE,OAAO,KAAK,GAAG,MAAM,GAAG,OAAO;AACnF,QAAM,UAAU,CAAC,GAAG,MAAM,OAAO;AACjC,MAAI,SAAS,MAAM;AAEnB,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,UAAU,CAAC,KAAK,IAAI,MAAM,GAAG;AAClC,SAAK,IAAI,MAAM;AACf,UAAM,OAAO,MAAM,SAAS,QAAQ,aAAa,EAAE,OAAO,KAAK,GAAG,OAAO,OAAO,GAAG,OAAO;AAC1F,YAAQ,KAAK,GAAG,KAAK,OAAO;AAC5B,aAAS,KAAK;AAAA,EAChB;AACA,SAAO,EAAE,GAAG,OAAO,SAAS,YAAY,KAAK;AAC/C;","names":[]}

package/dist/vault-types.d.ts

@@ -0,0 +1,236 @@
+import type { VaultPolicy } from "./types.js";
+export type { VaultPolicy };
+export type VaultOwnerKind = "user" | "workspace" | "organization" | "task";
+export type VaultSource = "opengeni" | "onepassword" | "host";
+export type VaultMode = "read_write" | "read_only";
+export type VaultSyncStatus = "ok" | "syncing" | "error" | "auth_expired" | "rate_limited";
+export type VaultItemType = "login" | "api_key" | "note" | "file" | "passkey";
+export type VaultFieldKind = "text" | "concealed" | "totp" | "file";
+export type VaultAvailability = {
+    /** null = every workspace in the organization. */
+    allowedWorkspaceIds: string[] | null;
+    allowPersonalWorkspaces: boolean;
+};
+export type VaultSummary = {
+    id: string;
+    workspaceId: string;
+    ownerKind: VaultOwnerKind;
+    ownerLabel: string;
+    rootSessionId: string | null;
+    name: string;
+    description: string | null;
+    source: VaultSource;
+    mode: VaultMode;
+    syncStatus: VaultSyncStatus;
+    syncErrorCode: string | null;
+    syncErrorMessage: string | null;
+    lastSyncedAt: string | null;
+    rateLimitedUntil: string | null;
+    providerConnectionId: string | null;
+    availability: VaultAvailability | null;
+    isDefault: boolean;
+    itemCount: number;
+    canWrite: boolean;
+    canManage: boolean;
+    generation: number;
+    createdAt: string;
+    updatedAt: string;
+};
+export type VaultItemReferences = {
+    primary: string | null;
+    otp: string | null;
+    byField: Record<string, string>;
+};
+export type VaultItemSummary = {
+    id: string;
+    vaultId: string;
+    type: VaultItemType;
+    name: string;
+    websites: string[];
+    username: string | null;
+    hasTotp: boolean;
+    hasPasskey: boolean;
+    expiresAt: string | null;
+    archivedAt: string | null;
+    lastUsedAt: string | null;
+    updatedAt: string;
+    references: VaultItemReferences;
+};
+export type VaultItemField = {
+    id: string;
+    name: string;
+    kind: VaultFieldKind;
+    position: number;
+    /** null for provider fields. */
+    currentVersion: number | null;
+    /** Plaintext only for kind "text"; null otherwise. */
+    value: string | null;
+    fileName: string | null;
+    fileSize: number | null;
+    reference: string;
+    updatedAt: string;
+};
+export type PasskeySummary = {
+    rpId: string;
+    userName: string | null;
+    credentialIdSuffix: string;
+    signCount: number;
+    leasedUntil: string | null;
+    lastUsedAt: string | null;
+};
+export type VaultItem = VaultItemSummary & {
+    fields: VaultItemField[];
+    passkey: PasskeySummary | null;
+    aliases: string[];
+    primaryFieldId: string | null;
+    createdBySubjectId: string | null;
+    createdAt: string;
+    generation: number;
+};
+export type VaultVersionCreatedByKind = "human" | "agent" | "api_key" | "migration" | "provider" | "system";
+export type VaultFieldVersionMeta = {
+    version: number;
+    current: boolean;
+    createdAt: string;
+    createdByKind: VaultVersionCreatedByKind;
+    createdBySubjectId: string | null;
+};
+export type GeneratePasswordOptions = {
+    length?: number | undefined;
+    lowercase?: boolean | undefined;
+    uppercase?: boolean | undefined;
+    digits?: boolean | undefined;
+    symbols?: boolean | undefined;
+    symbolSet?: string | undefined;
+    excludeAmbiguous?: boolean | undefined;
+    requireEachClass?: boolean | undefined;
+};
+export type CreateVaultRequest = {
+    name: string;
+    description?: string | undefined;
+    ownerKind: "user" | "workspace" | "organization";
+    availability?: VaultAvailability | undefined;
+};
+export type UpdateVaultRequest = {
+    expectedGeneration: number;
+    name?: string | undefined;
+    description?: string | null | undefined;
+    availability?: VaultAvailability | undefined;
+};
+export type VaultFieldInput = {
+    fieldId?: string | undefined;
+    name: string;
+    kind?: VaultFieldKind | undefined;
+    value?: string | undefined;
+    generate?: GeneratePasswordOptions | undefined;
+    fromReference?: string | undefined;
+    fileBase64?: string | undefined;
+    fileName?: string | undefined;
+    restoreVersion?: number | undefined;
+    remove?: true | undefined;
+};
+export type CreateVaultItemRequest = {
+    type: VaultItemType;
+    name: string;
+    websites?: string[] | undefined;
+    expiresAt?: string | null | undefined;
+    fields: VaultFieldInput[];
+    primaryFieldName?: string | undefined;
+};
+export type UpdateVaultItemRequest = Partial<CreateVaultItemRequest> & {
+    expectedGeneration: number;
+};
+export type MoveVaultItemRequest = {
+    targetVaultId: string;
+    mode: "move" | "copy";
+    newName?: string | undefined;
+};
+export type RevealVaultFieldResponse = {
+    value: string;
+    encoding: "utf8" | "base64";
+    version: number | null;
+    totp: {
+        code: string;
+        periodSeconds: number;
+        expiresAt: string;
+    } | null;
+};
+export type ListVaultItemsQuery = {
+    q?: string | undefined;
+    type?: VaultItemType | undefined;
+    includeArchived?: boolean | undefined;
+    cursor?: string | undefined;
+    limit?: number | undefined;
+};
+export type SessionSecretsVault = VaultSummary & {
+    selected: boolean;
+    selectable: boolean;
+};
+export type SessionSecretsView = {
+    capabilityEnabled: boolean;
+    policy: VaultPolicy;
+    effectiveVaultIds: string[];
+    /** Nearest ancestor that narrowed, if any. */
+    narrowedBySessionId: string | null;
+    taskVault: VaultSummary | null;
+    taskItems: VaultItemSummary[];
+    reachableVaults: SessionSecretsVault[];
+};
+export type OnePasswordPlanTier = "family" | "teams" | "business";
+export type InstallOnePasswordRequest = {
+    token: string;
+    ownership: "user" | "workspace" | "organization";
+    planTier?: OnePasswordPlanTier | undefined;
+    label?: string | undefined;
+};
+export type ProviderVaultMeta = {
+    externalVaultId: string;
+    name: string;
+    itemCount: number | null;
+    linkedVaultId: string | null;
+};
+export type InstallOnePasswordResponse = {
+    connectionId: string;
+    accountName: string | null;
+    vaults: ProviderVaultMeta[];
+};
+/** A 1Password service account connected in a workspace. Never carries the token. */
+export type OnePasswordConnectionSummary = {
+    id: string;
+    /** Who can use the vaults linked through it. */
+    ownership: "user" | "workspace" | "organization";
+    /** Sign-in host from the token, for example "my.1password.com". */
+    accountName: string | null;
+    label: string | null;
+    planTier: OnePasswordPlanTier;
+    /** When the current token was last checked against 1Password. */
+    verifiedAt: string;
+    createdAt: string;
+    createdBySubjectId: string | null;
+    /** The caller can link vaults, replace the token and disconnect it. */
+    canManage: boolean;
+};
+/** A new token for an existing connection; its linked vaults keep working. */
+export type ReplaceOnePasswordTokenRequest = {
+    token: string;
+    planTier?: OnePasswordPlanTier | undefined;
+};
+export type DisconnectOnePasswordResponse = {
+    /** The Opengeni vaults that were unlinked. Nothing is deleted in 1Password. */
+    unlinkedVaultIds: string[];
+};
+export type LinkProviderVaultRequest = {
+    provider: "onepassword" | "host";
+    connectionId?: string | undefined;
+    externalVaultId: string;
+    ownerKind: "user" | "workspace" | "organization";
+    mode: VaultMode;
+    name?: string | undefined;
+    availability?: VaultAvailability | undefined;
+};
+export type CreateManagedProviderVaultRequest = {
+    name: string;
+    ownerKind: "user" | "workspace" | "organization";
+    groupId?: string | undefined;
+};
+export type VaultErrorCode = "vault_not_found" | "vault_item_not_found" | "vault_field_not_found" | "vault_name_conflict" | "vault_item_name_conflict" | "vault_limit_reached" | "vault_read_only" | "vault_generation_conflict" | "vault_permission_denied" | "vault_reveal_requires_human" | "vault_policy_outside_parent" | "encryption_key_missing" | "provider_auth_invalid" | "provider_auth_expired" | "provider_rate_limited" | "provider_unavailable" | "provider_conflict" | "variable_sets_removed" | "secret_save_forbidden" | "invalid_secret_name" | "secret_value_too_large" | "human_auth_required" | "secret_search_cursor_invalid";

package/dist/vaults-api.d.ts

@@ -0,0 +1,57 @@
+import type { OpenGeniClient } from "./client.js";
+import type { VaultPolicy } from "./types.js";
+import type { CreateManagedProviderVaultRequest, CreateVaultItemRequest, CreateVaultRequest, DisconnectOnePasswordResponse, InstallOnePasswordRequest, InstallOnePasswordResponse, LinkProviderVaultRequest, ListVaultItemsQuery, MoveVaultItemRequest, OnePasswordConnectionSummary, ProviderVaultMeta, ReplaceOnePasswordTokenRequest, RevealVaultFieldResponse, SessionSecretsView, UpdateVaultItemRequest, UpdateVaultRequest, VaultErrorCode, VaultFieldVersionMeta, VaultItem, VaultItemSummary, VaultSummary } from "./vault-types.js";
+/**
+ * Vault REST routes over the client's JSON transport. Responses carry metadata
+ * only; plaintext comes back only from `revealField`, and callers keep it in
+ * memory for as long as they need it, never in a cache.
+ */
+export type VaultClientLike = Pick<OpenGeniClient, "requestJson">;
+/**
+ * The client's JSON transport. A client without one still renders (a disabled
+ * hook never calls it); each request then fails with a clear error.
+ */
+export declare function asVaultClient(client: unknown): VaultClientLike;
+export declare function vaultsApi(client: VaultClientLike, workspaceId: string): {
+    listVaults: (signal?: AbortSignal) => Promise<VaultSummary[]>;
+    getVault: (vaultId: string, signal?: AbortSignal) => Promise<VaultSummary>;
+    createVault: (request: CreateVaultRequest) => Promise<VaultSummary>;
+    updateVault: (vaultId: string, request: UpdateVaultRequest) => Promise<VaultSummary>;
+    deleteVault: (vaultId: string, confirmName: string) => Promise<void>;
+    syncVault: (vaultId: string) => Promise<VaultSummary>;
+    listItems: (vaultId: string, query?: ListVaultItemsQuery, signal?: AbortSignal) => Promise<{
+        items: VaultItemSummary[];
+        nextCursor: string | null;
+    }>;
+    getItem: (vaultId: string, itemId: string, signal?: AbortSignal) => Promise<VaultItem>;
+    createItem: (vaultId: string, request: CreateVaultItemRequest) => Promise<VaultItem>;
+    updateItem: (vaultId: string, itemId: string, request: UpdateVaultItemRequest) => Promise<VaultItem>;
+    /** Archives; `permanent` deletes an archived item. */
+    deleteItem: (vaultId: string, itemId: string, permanent?: boolean) => Promise<void>;
+    restoreItem: (vaultId: string, itemId: string) => Promise<VaultItem>;
+    moveItem: (vaultId: string, itemId: string, request: MoveVaultItemRequest) => Promise<VaultItem>;
+    /** Plaintext. Audited server-side. Never cache the result. */
+    revealField: (vaultId: string, itemId: string, fieldId: string, version?: number) => Promise<RevealVaultFieldResponse>;
+    listFieldVersions: (vaultId: string, itemId: string, fieldId: string, signal?: AbortSignal) => Promise<VaultFieldVersionMeta[]>;
+    restoreFieldVersion: (vaultId: string, itemId: string, fieldId: string, version: number) => Promise<VaultItem>;
+    getSessionSecrets: (sessionId: string, signal?: AbortSignal) => Promise<SessionSecretsView>;
+    setSessionVaultPolicy: (sessionId: string, policy: VaultPolicy) => Promise<SessionSecretsView>;
+    installOnePassword: (request: InstallOnePasswordRequest) => Promise<InstallOnePasswordResponse>;
+    /** The 1Password connections the caller can see. */
+    listOnePasswordConnections: (signal?: AbortSignal) => Promise<OnePasswordConnectionSummary[]>;
+    /** Checks a new service account token and stores it on the same connection. */
+    replaceOnePasswordToken: (connectionId: string, request: ReplaceOnePasswordTokenRequest) => Promise<InstallOnePasswordResponse>;
+    /** Unlinks the connection's vaults (nothing is deleted in 1Password) and removes its token. */
+    disconnectOnePassword: (connectionId: string) => Promise<DisconnectOnePasswordResponse>;
+    listProviderVaults: (connectionId: string, signal?: AbortSignal) => Promise<ProviderVaultMeta[]>;
+    linkProviderVault: (request: LinkProviderVaultRequest) => Promise<VaultSummary>;
+    createManagedProviderVault: (connectionId: string, request: CreateManagedProviderVaultRequest) => Promise<VaultSummary>;
+};
+export type VaultsApi = ReturnType<typeof vaultsApi>;
+/**
+ * The vault error code of a failed call, from either `{error: {code}}` or the
+ * vault routes' `{error: "<code>", message}` body. Null for anything else.
+ */
+export declare function vaultErrorCode(error: unknown): VaultErrorCode | null;
+/** Server-side detail of a vault error (for example `retryAt` on a rate limit). */
+export declare function vaultErrorDetail(error: unknown, key: string): unknown;

package/dist/workspace-artifacts.d.ts

@@ -1,3 +1,12 @@
+import type { ToolGatewayIdentity } from "./types.js";
+export type WorkspaceArtifactSourceFile = {
+    path: string;
+    content: string;
+};
+export type WorkspaceArtifactSourceBundle = {
+    entrypoint: string;
+    files: WorkspaceArtifactSourceFile[];
+};
 export type WorkspaceArtifactVersion = {
     id: string;
     accountId: string;
@@ -5,8 +14,11 @@ export type WorkspaceArtifactVersion = {
     artifactId: string;
     revision: number;
     contentType: "text/html";
-    contentSha256: string;
+    contentSha256: string | null;
     sizeBytes: number;
+    sourceSha256: string | null;
+    sourceSizeBytes: number | null;
+    requestedTools: ToolGatewayIdentity[];
     sourceSessionId: string | null;
     sourceTurnId: string | null;
     sourceAttemptId: string | null;
@@ -14,6 +26,8 @@ export type WorkspaceArtifactVersion = {
     createdBySubjectId: string;
     createdAt: string;
 };
+/** Who can see a Site: everyone in the workspace, or only its owner ("Only me"). */
+export type WorkspaceArtifactVisibility = "private" | "workspace";
 export type WorkspaceArtifact = {
     id: string;
     accountId: string;
@@ -22,6 +36,10 @@ export type WorkspaceArtifact = {
     title: string;
     description: string | null;
     status: "active" | "archived";
+    /** Absent from older servers, where every Site is visible to the workspace. */
+    visibility?: WorkspaceArtifactVisibility;
+    /** The person the Site belongs to; only they can change its audience. */
+    ownerSubjectId?: string | null;
     currentVersion: WorkspaceArtifactVersion | null;
     createdBySubjectId: string;
     createdAt: string;
@@ -32,7 +50,7 @@ export type WorkspaceArtifactEvent = {
     accountId: string;
     workspaceId: string;
     artifactId: string;
-    type: "published" | "rolled_back";
+    type: "published" | "rolled_back" | "archived" | "restored";
     fromVersionId: string | null;
     toVersionId: string;
     sourceSessionId: string | null;
@@ -44,8 +62,10 @@ export type WorkspaceArtifactEvent = {
     createdAt: string;
 };
 export type WorkspaceArtifactListOptions = {
+    sourceSessionId?: string;
     limit?: number;
     cursor?: string;
+    status?: WorkspaceArtifact["status"];
 };
 export type WorkspaceArtifactListResponse = {
     artifacts: WorkspaceArtifact[];
@@ -63,8 +83,10 @@ export type WorkspaceArtifactContentResponse = {
     artifactId: string;
     versionId: string;
     contentType: "text/html";
-    contentSha256: string;
+    contentSha256: string | null;
     html: string;
+    source: WorkspaceArtifactSourceBundle;
+    requestedTools: ToolGatewayIdentity[];
 };
 export type WorkspaceArtifactMutationResponse = {
     artifact: WorkspaceArtifact;
@@ -76,13 +98,21 @@ export type CreateWorkspaceArtifactRequest = {
     slug?: string;
     title: string;
     description?: string | null;
-    html: string;
+    html?: string;
+    uploadId?: string;
+    source?: WorkspaceArtifactSourceBundle;
+    requestedTools?: ToolGatewayIdentity[];
+    /** Who can see the new Site. Omitted: the whole workspace. */
+    visibility?: WorkspaceArtifactVisibility;
     idempotencyKey: string;
 };
 export type PublishWorkspaceArtifactVersionRequest = {
     title?: string;
     description?: string | null;
-    html: string;
+    html?: string;
+    uploadId?: string;
+    source?: WorkspaceArtifactSourceBundle;
+    requestedTools?: ToolGatewayIdentity[];
     expectedCurrentVersionId: string;
     idempotencyKey: string;
 };
@@ -92,3 +122,15 @@ export type RollbackWorkspaceArtifactRequest = {
     reason: string;
     idempotencyKey: string;
 };
+export type SetWorkspaceArtifactStatusRequest = {
+    status: "active" | "archived";
+    expectedCurrentVersionId: string;
+    reason: string;
+    idempotencyKey: string;
+};
+export type UpdateWorkspaceArtifactVisibilityRequest = {
+    visibility: WorkspaceArtifactVisibility;
+};
+export type UpdateWorkspaceArtifactVisibilityResponse = {
+    artifact: WorkspaceArtifact;
+};

package/dist/workspace-instruction-policies.d.ts

@@ -1,8 +1,8 @@
 export declare const WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS = 262144;
 export type WorkspaceInstructionPolicyKind = "charter" | "policy";
 export type WorkspaceInstructionPolicyScope = "global" | "role";
-export type WorkspaceInstructionPolicyProvenanceSource = "human" | "onboarding" | "knowledge_proposal" | "legacy_import";
-export type WorkspaceInstructionPolicyDraftProvenanceSource = Exclude<WorkspaceInstructionPolicyProvenanceSource, "legacy_import">;
+export type WorkspaceInstructionPolicyProvenanceSource = "human" | "onboarding" | "agent_learning" | "knowledge_proposal" | "legacy_import";
+export type WorkspaceInstructionPolicyDraftProvenanceSource = Exclude<WorkspaceInstructionPolicyProvenanceSource, "legacy_import" | "agent_learning">;
 export type WorkspaceInstructionPolicyActivationType = "activate" | "rollback";
 export declare function normalizeWorkspaceInstructionPolicyRoleKey(value: string): string;
 export type WorkspaceInstructionPolicyTarget = {

package/dist/workspace-integrations.d.ts

@@ -0,0 +1,74 @@
+import type { CredentialProviderRequest, WorkspaceWebhookEvent } from "@opengeni/contracts";
+import type { OpenGeniClient } from "./client.js";
+import type { CreateOrganizationWebhookRequest, CreateOrganizationWebhookResponse, GetOrganizationCredentialProviderResponse, ListOrganizationWebhookDeliveriesResponse, ListOrganizationWebhooksResponse, OrganizationWebhook, OrganizationWebhookDelivery, PutOrganizationCredentialProviderRequest, PutOrganizationCredentialProviderResponse, RotateWorkspaceCredentialProviderSecretResponse, RotateOrganizationCredentialProviderSecretResponse, RotateWorkspaceWebhookSecretResponse, RotateOrganizationWebhookSecretResponse, TestWorkspaceCredentialProviderResponse, TestWorkspaceWebhookResponse, UpdateOrganizationWebhookRequest, WorkspaceInheritedIntegrationsResponse, WorkspaceWebhook } from "@opengeni/contracts";
+export type { CreateOrganizationWebhookRequest, CreateOrganizationWebhookResponse, CreateWorkspaceWebhookRequest, CreateWorkspaceWebhookResponse, CredentialProviderRequest, CredentialProviderInitiatorContext, CredentialProviderResponse, CredentialProviderMcpHeaders, CredentialProviderMcpMaterial, GetOrganizationCredentialProviderResponse, GetWorkspaceCredentialProviderResponse, InitiatingHuman, IntegrationEndpointTestResult, IntegrationWorkspaceFilter, ListOrganizationWebhookDeliveriesResponse, ListOrganizationWebhooksResponse, ListWorkspaceWebhookDeliveriesResponse, ListWorkspaceWebhooksResponse, PutWorkspaceCredentialProviderRequest, PutWorkspaceCredentialProviderResponse, PutOrganizationCredentialProviderRequest, PutOrganizationCredentialProviderResponse, RotateWorkspaceCredentialProviderSecretResponse, RotateOrganizationCredentialProviderSecretResponse, RotateWorkspaceWebhookSecretResponse, RotateOrganizationWebhookSecretResponse, TestWorkspaceCredentialProviderResponse, TestWorkspaceWebhookResponse, OrganizationCredentialProvider, OrganizationWebhook, OrganizationWebhookDelivery, UpdateOrganizationWebhookRequest, UpdateWorkspaceWebhookRequest, WorkspaceCredentialProvider, WorkspaceInheritedIntegrationsResponse, WorkspaceTestWebhookEvent, WorkspaceWebhook, WorkspaceWebhookDelivery, WorkspaceWebhookEvent, WorkspaceWebhookEventType, SessionWorkspaceWebhookEvent, WorkspaceUsageWebhookEvent, } from "@opengeni/contracts";
+export { OPENGENI_DELIVERY_ID_HEADER, OPENGENI_EVENT_ID_HEADER, OPENGENI_SIGNATURE_HEADER, OPENGENI_TEST_REQUEST_NIL_ID, OPENGENI_WEBHOOK_TEST_EVENT_TYPE, WORKSPACE_WEBHOOK_EVENT_TYPES, signOpenGeniPayload, verifyOpenGeniSignature, } from "@opengeni/contracts/workspace-integration-wire";
+export type WorkspaceSandboxImages = {
+    images: string[];
+    selected: string | null;
+};
+export declare class OpenGeniSignatureError extends Error {
+    constructor();
+}
+type SignedRequest = {
+    /** The exact raw request body. Parse it only after verification. */
+    body: string;
+    headers: Headers | Record<string, string | string[] | undefined>;
+    secret: string;
+    toleranceSeconds?: number;
+};
+/**
+ * Verify and parse one webhook delivery. Delivery is at least once: dedupe on
+ * `event.id` (also sent as the `OpenGeni-Event-Id` header). A `webhook.test`
+ * event (from "Send test event") names no session: acknowledge it with 2xx.
+ */
+export declare function verifyWebhookEvent(input: SignedRequest): Promise<{
+    event: WorkspaceWebhookEvent;
+    deliveryId: string | null;
+}>;
+/**
+ * Verify the exact bytes and parse a provider request, including its frozen
+ * initiatorContext when sent by an upgraded worker. Provenance grants no access.
+ */
+export declare function verifyCredentialProviderRequest(input: SignedRequest): Promise<CredentialProviderRequest>;
+/** Identity header names, for receivers that log or dedupe. */
+export declare const OPENGENI_WEBHOOK_HEADERS: {
+    readonly signature: "OpenGeni-Signature";
+    readonly eventId: "OpenGeni-Event-Id";
+    readonly deliveryId: "OpenGeni-Delivery-Id";
+};
+/** Server-side integration administration is opt-in, outside the eager browser client. */
+export declare function getOrganizationCredentialProvider(client: Pick<OpenGeniClient, "requestJson">, organizationId: string): Promise<GetOrganizationCredentialProviderResponse>;
+/** Replace configuration; explicit filter required. Store the first returned signing secret. */
+export declare function putOrganizationCredentialProvider(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, request: PutOrganizationCredentialProviderRequest): Promise<PutOrganizationCredentialProviderResponse>;
+export declare function deleteOrganizationCredentialProvider(client: Pick<OpenGeniClient, "requestJson">, organizationId: string): Promise<void>;
+export declare function listOrganizationWebhooks(client: Pick<OpenGeniClient, "requestJson">, organizationId: string): Promise<ListOrganizationWebhooksResponse>;
+/** Create a webhook and return its signing secret once. */
+export declare function createOrganizationWebhook(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, request: CreateOrganizationWebhookRequest): Promise<CreateOrganizationWebhookResponse>;
+export declare function getOrganizationWebhook(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, webhookId: string): Promise<OrganizationWebhook>;
+export declare function updateOrganizationWebhook(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, webhookId: string, request: UpdateOrganizationWebhookRequest): Promise<OrganizationWebhook>;
+export declare function deleteOrganizationWebhook(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, webhookId: string): Promise<void>;
+export declare function listOrganizationWebhookDeliveries(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, webhookId: string, options?: {
+    limit?: number;
+}): Promise<ListOrganizationWebhookDeliveriesResponse>;
+/** Requeue a settled delivery with a fresh attempt budget. */
+export declare function redeliverOrganizationWebhookDelivery(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, webhookId: string, deliveryId: string): Promise<OrganizationWebhookDelivery>;
+export declare function getWorkspaceWebhook(client: Pick<OpenGeniClient, "requestJson">, workspaceId: string, webhookId: string): Promise<WorkspaceWebhook>;
+/** Rotate immediately. Store the new secret; the old signing secret stops working. */
+export declare function rotateWorkspaceCredentialProviderSecret(client: Pick<OpenGeniClient, "requestJson">, workspaceId: string): Promise<RotateWorkspaceCredentialProviderSecretResponse>;
+export declare function rotateOrganizationCredentialProviderSecret(client: Pick<OpenGeniClient, "requestJson">, organizationId: string): Promise<RotateOrganizationCredentialProviderSecretResponse>;
+export declare function rotateOrganizationWebhookSecret(client: Pick<OpenGeniClient, "requestJson">, organizationId: string, webhookId: string): Promise<RotateOrganizationWebhookSecretResponse>;
+export declare function rotateWorkspaceWebhookSecret(client: Pick<OpenGeniClient, "requestJson">, workspaceId: string, webhookId: string): Promise<RotateWorkspaceWebhookSecretResponse>;
+/**
+ * Send one signed `webhook.test` event to a workspace webhook now and return
+ * what the endpoint answered. Nothing is queued or retried.
+ */
+export declare function testWorkspaceWebhook(client: Pick<OpenGeniClient, "requestJson">, workspaceId: string, webhookId: string): Promise<TestWorkspaceWebhookResponse>;
+/**
+ * Send one signed `purpose: "test"` request to the credential provider this
+ * workspace's runs use (its own, else the organization's). Only the names of
+ * returned credentials come back, never their values.
+ */
+export declare function testWorkspaceCredentialProvider(client: Pick<OpenGeniClient, "requestJson">, workspaceId: string): Promise<TestWorkspaceCredentialProviderResponse>;
+/** Organization registrations that reach this workspace. Workspace administrators only. */
+export declare function getWorkspaceInheritedIntegrations(client: Pick<OpenGeniClient, "requestJson">, workspaceId: string): Promise<WorkspaceInheritedIntegrationsResponse>;