@opengeni/sdk 3.1.0 → 3.3.2-canary.1

package/src/client.ts

@@ -1,6 +1,7 @@
 import {
   OpenGeniApiContractMismatchError,
   OpenGeniApiError,
+  OpenGeniSecureContextRequiredError,
   OpenGeniSessionListCursorError,
 } from "./errors";
 import {
@@ -23,6 +24,7 @@ import {
 } from "./workspace-live-stream";
 import {
   OpenGeniInteractionClient,
+  decodeComputerFrameMetadataHeader,
   type AuthRun,
   type AuthRunListOptions,
   type AuthRunListResponse,
@@ -57,6 +59,7 @@ import {
   type ComputerActionReceipt,
   type ComputerActionRequest,
   type ComputerClipboard,
+  type ComputerFrame,
   type ComputerObservation,
   type ComputerSession,
   type ComputerSessionAttachment,
@@ -167,6 +170,14 @@ import type {
   ClientConfig,
   WorkspaceModelAccessPolicy,
   WorkspaceModelCatalogResponse,
+  WorkspaceGatewayCustomModel,
+  WorkspaceGatewayCustomModelsResponse,
+  CreateWorkspaceGatewayCustomModelRequest,
+  DeleteWorkspaceGatewayCustomModelRequest,
+  WorkspaceOpenRouterCustomModel,
+  WorkspaceOpenRouterCustomModelsResponse,
+  CreateWorkspaceOpenRouterCustomModelRequest,
+  DeleteWorkspaceOpenRouterCustomModelRequest,
   WorkspaceRealtimeModelCatalogResponse,
   ClientSessionEventInput,
   UserMessageEventInput,
@@ -184,6 +195,7 @@ import type {
   VerifyPersonalGitHubRepositorySelectionsRequest,
   CreateApiKeyRequest,
   CreateApiKeyResponse,
+  CreateOrganizationApiKeyRequest,
   CreateCapabilityCatalogItemRequest,
   InstallSkillRequest,
   InstallLibrarySkillRequest,
@@ -216,6 +228,8 @@ import type {
   ResolveVariableSetAttachmentsResponse,
   CreateRigRequest,
   CreateWorkspaceRequest,
+  EnsureWorkspaceRequest,
+  EnsureWorkspaceResponse,
   // Enrollment UX (design 11): the click-Grant approve-page lookup/deny + headless
   // enroll-token mint.
   DeviceEnrollmentApproveRequest,
@@ -293,6 +307,7 @@ import type {
   SwapActiveSandboxRequest,
   SwapActiveSandboxResponse,
   ListWorkspaceMembersResponse,
+  ListWorkspaceMemberCandidatesResponse,
   InstallPackRequest,
   PackInstallationPreview,
   ListSlackUserLinkAccessRequestsResponse,
@@ -454,6 +469,7 @@ import type {
   RigChange,
   ProposeRigChangeRequest,
   WorkspaceMember,
+  WorkspaceMemberCandidate,
   WorkspaceMemorySearchRequest,
   WorkspaceMemorySearchResponse,
   WorkspaceRegisteredPack,
@@ -504,6 +520,7 @@ import type {
 } from "./workspace-learning";
 import type {
   ActivateCompanyProfileRevisionRequest,
+  CompanyProfileAgentPolicy,
   CompanyProfileDiffRequest,
   CompanyProfileDiffResponse,
   CompanyProfileListOptions,
@@ -512,6 +529,7 @@ import type {
   CompanyProfileRevision,
   RollbackCompanyProfileRequest,
   UpdateCompanyProfileRequest,
+  UpdateCompanyProfileAgentPolicyRequest,
 } from "./company-profile";
 import type {
   WorkspaceStateExportResponse,
@@ -594,6 +612,12 @@ export type SharedSessionReadOptions = {
    * client has a `beginSharedRead` clock.
    */
   onRequestStart?: ((readGeneration?: number) => void) | undefined;
+  /**
+   * Stop this caller's interest in the shared read. The native request is
+   * aborted only after every caller that joined the same generation has
+   * stopped waiting for it.
+   */
+  signal?: AbortSignal | undefined;
 };
 
 export type GetSessionOptions = SharedSessionReadOptions & {
@@ -607,6 +631,8 @@ export type GetSessionOptions = SharedSessionReadOptions & {
 export type GetSessionLineageOptions = SharedSessionReadOptions;
 
 type SingleFlightReadEntry = {
+  controller: AbortController;
+  consumers: number;
   generation: number;
   promise: Promise<unknown>;
   resolve: (value: unknown) => void;
@@ -627,6 +653,8 @@ function createSingleFlightReadEntry(
     reject = entryReject;
   });
   return {
+    controller: new AbortController(),
+    consumers: 0,
     generation,
     promise,
     resolve,
@@ -693,6 +721,29 @@ export type FinalizeTranscriptionRecordingInput = {
   signal?: AbortSignal | undefined;
 };
 
+function normalizeScheduledTaskMachineTarget<
+  T extends CreateScheduledTaskRequest | UpdateScheduledTaskRequest,
+>(request: T): T {
+  if (!("agentConfig" in request) || !request.agentConfig?.machineTarget) {
+    return request;
+  }
+  const { workingDir, ...machineTarget } = request.agentConfig.machineTarget;
+  if (workingDir === undefined) {
+    return request;
+  }
+  const normalizedWorkingDir = workingDir.trim();
+  return {
+    ...request,
+    agentConfig: {
+      ...request.agentConfig,
+      machineTarget: {
+        ...machineTarget,
+        ...(normalizedWorkingDir ? { workingDir: normalizedWorkingDir } : {}),
+      },
+    },
+  };
+}
+
 /**
  * Typed client for the OpenGeni public API. Framework-agnostic: only needs
  * WHATWG `fetch` + streams, so it runs in Node 18+, Bun, Deno, browsers, and
@@ -981,7 +1032,11 @@ export class OpenGeniClient {
     options: GetSessionOptions = {},
   ): Promise<Session> {
     const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}`;
-    return await this.sharedRead(path, () => this.requestJson<Session>("GET", path), options);
+    return await this.sharedRead(
+      path,
+      (signal) => this.requestJson<Session>("GET", path, undefined, {}, { signal }),
+      options,
+    );
   }
 
   async updateSession(
@@ -1135,6 +1190,8 @@ export class OpenGeniClient {
       pinsOnly?: boolean;
       /** Return archived root chats instead of the active session list. */
       archivedOnly?: boolean;
+      /** Stop this caller's finite page read when its owning route is abandoned. */
+      signal?: AbortSignal | undefined;
     } = {},
   ): Promise<SessionListResponse> {
     const search = options.search?.trim();
@@ -1152,6 +1209,7 @@ export class OpenGeniClient {
           ...(options.pinsOnly ? { pinsOnly: "true" } : {}),
           ...(options.archivedOnly ? { archivedOnly: "true" } : {}),
         },
+        { signal: options.signal },
       );
     } catch (error) {
       if (error instanceof OpenGeniApiError && error.status === 410) {
@@ -1303,30 +1361,35 @@ export class OpenGeniClient {
     const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/lineage`;
     return await this.sharedRead(
       path,
-      () => this.requestJson<SessionLineageResponse>("GET", path),
+      (signal) => this.requestJson<SessionLineageResponse>("GET", path, undefined, {}, { signal }),
       options,
     );
   }
 
   private sharedRead<T>(
     key: string,
-    read: () => Promise<T>,
+    read: (signal: AbortSignal) => Promise<T>,
     options: GetSessionOptions = {},
   ): Promise<T> {
+    if (options.signal?.aborted) {
+      return Promise.reject(
+        options.signal.reason ?? new DOMException("Request aborted", "AbortError"),
+      );
+    }
     const existing = this.active.get(key);
     if (existing) {
       if (!options.fresh) {
         this.observeRead(existing, options.onRequestStart);
-        return existing.promise as Promise<T>;
+        return this.consumeSharedRead(key, existing, options.signal);
       }
       const requiredGeneration = existing.generation + 1;
       const queued = this.queued.get(key);
       if (queued && queued.generation >= requiredGeneration) {
         this.observeRead(queued, options.onRequestStart);
-        return queued.promise as Promise<T>;
+        return this.consumeSharedRead(key, queued, options.signal);
       }
       const predecessor = queued?.promise ?? existing.promise;
-      return this.queueRead(key, predecessor, requiredGeneration, read, options.onRequestStart);
+      return this.queueRead(key, predecessor, requiredGeneration, read, options);
     }
     // The active entry clears in its finally before reactions on its public
     // promise run. During that settlement gap a successor may already be
@@ -1335,31 +1398,27 @@ export class OpenGeniClient {
     const queued = this.queued.get(key);
     if (queued && (!options.fresh || !queued.started)) {
       this.observeRead(queued, options.onRequestStart);
-      return queued.promise as Promise<T>;
+      return this.consumeSharedRead(key, queued, options.signal);
     }
     if (queued) {
-      return this.queueRead(
-        key,
-        queued.promise,
-        queued.generation + 1,
-        read,
-        options.onRequestStart,
-      );
+      return this.queueRead(key, queued.promise, queued.generation + 1, read, options);
     }
     const generation = (this.generations.get(key) ?? 0) + 1;
     const entry = createSingleFlightReadEntry(generation, options.onRequestStart);
+    const consumed = this.consumeSharedRead<T>(key, entry, options.signal);
     this.launchRead(key, entry, read);
-    return entry.promise as Promise<T>;
+    return consumed;
   }
 
   private queueRead<T>(
     key: string,
     predecessor: Promise<unknown>,
     generation: number,
-    read: () => Promise<T>,
-    onRequestStart?: (readGeneration?: number) => void,
+    read: (signal: AbortSignal) => Promise<T>,
+    options: GetSessionOptions,
   ): Promise<T> {
-    const entry = createSingleFlightReadEntry(generation, onRequestStart);
+    const entry = createSingleFlightReadEntry(generation, options.onRequestStart);
+    const consumed = this.consumeSharedRead<T>(key, entry, options.signal);
     this.queued.set(key, entry);
     const launch = () => this.launchRead(key, entry, read);
     void predecessor.then(launch, launch);
@@ -1369,10 +1428,15 @@ export class OpenGeniClient {
       if (!this.active.has(key)) this.generations.delete(key);
     };
     void entry.promise.then(clear, clear);
-    return entry.promise as Promise<T>;
+    return consumed;
   }
 
-  private launchRead<T>(key: string, entry: SingleFlightReadEntry, read: () => Promise<T>): void {
+  private launchRead<T>(
+    key: string,
+    entry: SingleFlightReadEntry,
+    read: (signal: AbortSignal) => Promise<T>,
+  ): void {
+    if (entry.controller.signal.aborted) return;
     entry.started = true;
     this.generations.set(key, entry.generation);
     this.active.set(key, entry);
@@ -1396,7 +1460,7 @@ export class OpenGeniClient {
     };
     let request: Promise<T>;
     try {
-      request = read();
+      request = read(entry.controller.signal);
     } catch (error) {
       settle();
       entry.reject(error);
@@ -1414,6 +1478,33 @@ export class OpenGeniClient {
     );
   }
 
+  private consumeSharedRead<T>(
+    key: string,
+    entry: SingleFlightReadEntry,
+    signal: AbortSignal | undefined,
+  ): Promise<T> {
+    entry.consumers += 1;
+    let released = false;
+    const release = () => {
+      if (released) return;
+      released = true;
+      entry.consumers -= 1;
+      if (!signal?.aborted || entry.consumers > 0) return;
+      const reason = signal.reason;
+      entry.controller.abort(reason);
+      if (this.active.get(key) === entry) this.active.delete(key);
+      if (this.queued.get(key) === entry) this.queued.delete(key);
+      if (!this.active.has(key) && !this.queued.has(key)) this.generations.delete(key);
+      entry.reject(reason);
+    };
+    signal?.addEventListener("abort", release, { once: true });
+    const consumed = awaitWithAbort(entry.promise as Promise<T>, signal);
+    return consumed.finally(() => {
+      signal?.removeEventListener("abort", release);
+      release();
+    });
+  }
+
   private observeRead(
     entry: SingleFlightReadEntry,
     listener: ((readGeneration?: number) => void) | undefined,
@@ -1557,7 +1648,7 @@ export class OpenGeniClient {
   async listTurns(
     workspaceId: string,
     sessionId: string,
-    options: { limit?: number; latestStarted?: boolean } = {},
+    options: { limit?: number; latestStarted?: boolean; signal?: AbortSignal | undefined } = {},
   ): Promise<SessionTurn[]> {
     return await this.requestJson<SessionTurn[]>(
       "GET",
@@ -1567,13 +1658,19 @@ export class OpenGeniClient {
         ...(options.limit !== undefined ? { limit: String(options.limit) } : {}),
         ...(options.latestStarted ? { latestStarted: "1" } : {}),
       },
+      { signal: options.signal },
     );
   }
 
   /** Newest turn that durably emitted `turn.started`, or null before any admission. */
-  async getLatestStartedTurn(workspaceId: string, sessionId: string): Promise<SessionTurn | null> {
+  async getLatestStartedTurn(
+    workspaceId: string,
+    sessionId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<SessionTurn | null> {
     const turns = await this.listTurns(workspaceId, sessionId, {
       latestStarted: true,
+      signal: options.signal,
     });
     return turns[0] ?? null;
   }
@@ -2147,10 +2244,16 @@ export class OpenGeniClient {
     );
   }
 
-  async getComposerDraft(workspaceId: string, sessionId: string): Promise<ComposerDraft> {
+  async getComposerDraft(
+    workspaceId: string,
+    sessionId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<ComposerDraft> {
     return await this.requestSessionCommand<ComposerDraft>(
       "GET",
       `/v1/workspaces/${workspaceId}/sessions/${sessionId}/composer-draft`,
+      undefined,
+      options,
     );
   }
 
@@ -2424,9 +2527,17 @@ export class OpenGeniClient {
   // --- Goals -------------------------------------------------------------------
 
   /** The session's goal. 404s when the session never had one. */
-  async getGoal(workspaceId: string, sessionId: string): Promise<SessionGoal> {
+  async getGoal(
+    workspaceId: string,
+    sessionId: string,
+    options: SharedSessionReadOptions = {},
+  ): Promise<SessionGoal> {
     const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal`;
-    return await this.sharedRead(path, () => this.requestJson<SessionGoal>("GET", path));
+    return await this.sharedRead(
+      path,
+      (signal) => this.requestJson<SessionGoal>("GET", path, undefined, {}, { signal }),
+      options,
+    );
   }
 
   async updateGoal(
@@ -3787,6 +3898,48 @@ export class OpenGeniClient {
     );
   }
 
+  async captureComputerTarget(
+    workspaceId: string,
+    computerSessionId: string,
+    targetId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<ComputerFrame> {
+    const response = await this.requestResponse(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/targets/${encodeURIComponent(targetId)}/screenshot`,
+      {},
+      options,
+    );
+    const mediaType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+    if (mediaType !== "image/jpeg" && mediaType !== "image/png") {
+      await cancelResponseBody(response, "computer frame media type is invalid");
+      throw new OpenGeniApiError(502, "computer frame media type is invalid");
+    }
+    const metadataHeader = response.headers.get("x-opengeni-computer-frame");
+    if (!metadataHeader || metadataHeader.length > 32 * 1024) {
+      await cancelResponseBody(response, "computer frame metadata is invalid");
+      throw new OpenGeniApiError(502, "computer frame metadata is invalid");
+    }
+    let metadata: ReturnType<typeof decodeComputerFrameMetadataHeader>;
+    try {
+      metadata = decodeComputerFrameMetadataHeader(metadataHeader);
+    } catch {
+      await cancelResponseBody(response, "computer frame metadata is invalid");
+      throw new OpenGeniApiError(502, "computer frame metadata is invalid");
+    }
+    const bytes = await readBoundedResponseBytes(response, 256 * 1024, null);
+    const mismatchReason = computerFrameEvidenceMismatchReason(metadata, {
+      computerSessionId,
+      targetId,
+      mediaType,
+      sha256: await sha256Hex(bytes),
+    });
+    if (mismatchReason) {
+      throw new OpenGeniApiError(502, "computer frame evidence does not match its request");
+    }
+    return { ...metadata, data: bytes };
+  }
+
   async actInComputer(
     workspaceId: string,
     computerSessionId: string,
@@ -3870,8 +4023,14 @@ export class OpenGeniClient {
    * expected to authenticate. Drives a composer's model picker without prior
    * knowledge of the host setup; safe to call before any auth is established.
    */
-  async getClientConfig(): Promise<ClientConfig> {
-    const config = await this.requestJson<ClientConfig>("GET", "/v1/config/client");
+  async getClientConfig(options: OpenGeniRequestOptions = {}): Promise<ClientConfig> {
+    const config = await this.requestJson<ClientConfig>(
+      "GET",
+      "/v1/config/client",
+      undefined,
+      {},
+      options,
+    );
     if (config.apiContractRevision !== OPENGENI_API_CONTRACT_REVISION) {
       throw new OpenGeniApiContractMismatchError(
         OPENGENI_API_CONTRACT_REVISION,
@@ -3882,10 +4041,100 @@ export class OpenGeniClient {
   }
 
   /** Authenticated model definitions plus workspace-specific selectability. */
-  async getWorkspaceModelCatalog(workspaceId: string): Promise<WorkspaceModelCatalogResponse> {
+  async getWorkspaceModelCatalog(
+    workspaceId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<WorkspaceModelCatalogResponse> {
     return await this.requestJson<WorkspaceModelCatalogResponse>(
       "GET",
       `/v1/workspaces/${workspaceId}/model-catalog`,
+      undefined,
+      {},
+      options,
+    );
+  }
+
+  /** List workspace-owned unpinned Vercel AI Gateway model slugs. */
+  async listWorkspaceGatewayCustomModels(
+    workspaceId: string,
+  ): Promise<WorkspaceGatewayCustomModelsResponse> {
+    return await this.requestJson<WorkspaceGatewayCustomModelsResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/gateway-custom-models`,
+    );
+  }
+
+  /** Add one exact upstream Vercel AI Gateway slug. */
+  async createWorkspaceGatewayCustomModel(
+    workspaceId: string,
+    request: CreateWorkspaceGatewayCustomModelRequest,
+  ): Promise<WorkspaceGatewayCustomModel> {
+    return await this.requestJson<WorkspaceGatewayCustomModel>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/gateway-custom-models`,
+      request,
+    );
+  }
+
+  /** Remove one workspace custom Gateway model by its stable row id. */
+  async deleteWorkspaceGatewayCustomModel(
+    workspaceId: string,
+    customModelId: string,
+    request: DeleteWorkspaceGatewayCustomModelRequest,
+  ): Promise<void> {
+    if (
+      !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+        customModelId,
+      )
+    ) {
+      throw new TypeError("customModelId must be a UUID");
+    }
+    await this.requestVoid(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/gateway-custom-models/${encodeURIComponent(customModelId)}`,
+      request,
+    );
+  }
+
+  /** List workspace-owned unpinned OpenRouter model slugs. */
+  async listWorkspaceOpenRouterCustomModels(
+    workspaceId: string,
+  ): Promise<WorkspaceOpenRouterCustomModelsResponse> {
+    return await this.requestJson<WorkspaceOpenRouterCustomModelsResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/openrouter-custom-models`,
+    );
+  }
+
+  /** Add one exact upstream OpenRouter slug. */
+  async createWorkspaceOpenRouterCustomModel(
+    workspaceId: string,
+    request: CreateWorkspaceOpenRouterCustomModelRequest,
+  ): Promise<WorkspaceOpenRouterCustomModel> {
+    return await this.requestJson<WorkspaceOpenRouterCustomModel>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/openrouter-custom-models`,
+      request,
+    );
+  }
+
+  /** Remove one workspace custom OpenRouter model by its stable row id. */
+  async deleteWorkspaceOpenRouterCustomModel(
+    workspaceId: string,
+    customModelId: string,
+    request: DeleteWorkspaceOpenRouterCustomModelRequest,
+  ): Promise<void> {
+    if (
+      !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+        customModelId,
+      )
+    ) {
+      throw new TypeError("customModelId must be a UUID");
+    }
+    await this.requestVoid(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/openrouter-custom-models/${encodeURIComponent(customModelId)}`,
+      request,
     );
   }
 
@@ -3912,10 +4161,14 @@ export class OpenGeniClient {
   /** Authenticated realtime voice models and credential readiness. */
   async getWorkspaceRealtimeModelCatalog(
     workspaceId: string,
+    options: OpenGeniRequestOptions = {},
   ): Promise<WorkspaceRealtimeModelCatalogResponse> {
     return await this.requestJson<WorkspaceRealtimeModelCatalogResponse>(
       "GET",
       `/v1/workspaces/${workspaceId}/realtime-model-catalog`,
+      undefined,
+      {},
+      options,
     );
   }
 
@@ -4271,6 +4524,18 @@ export class OpenGeniClient {
     return await this.requestJson<Workspace>("POST", "/v1/workspaces", request);
   }
 
+  /**
+   * Create an organization workspace once for a stable external tenant
+   * identity, or return the existing workspace without overwriting it.
+   */
+  async ensureWorkspace(request: EnsureWorkspaceRequest): Promise<EnsureWorkspaceResponse> {
+    return await this.requestJson<EnsureWorkspaceResponse>(
+      "PUT",
+      "/v1/workspaces/external",
+      request,
+    );
+  }
+
   async getWorkspace(workspaceId: string): Promise<Workspace> {
     return await this.requestJson<Workspace>("GET", `/v1/workspaces/${workspaceId}`);
   }
@@ -4531,6 +4796,24 @@ export class OpenGeniClient {
     );
   }
 
+  async getCompanyProfileAgentPolicy(workspaceId: string): Promise<CompanyProfileAgentPolicy> {
+    return await this.requestJson<CompanyProfileAgentPolicy>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/company-profile/agent-policy`,
+    );
+  }
+
+  async updateCompanyProfileAgentPolicy(
+    workspaceId: string,
+    request: UpdateCompanyProfileAgentPolicyRequest,
+  ): Promise<CompanyProfileAgentPolicy> {
+    return await this.requestJson<CompanyProfileAgentPolicy>(
+      "PATCH",
+      `/v1/workspaces/${workspaceId}/company-profile/agent-policy`,
+      request,
+    );
+  }
+
   async updateCompanyProfile(
     workspaceId: string,
     request: UpdateCompanyProfileRequest,
@@ -4721,9 +5004,17 @@ export class OpenGeniClient {
     return response.members;
   }
 
+  /** Active organization members who can be added to this workspace. */
+  async listWorkspaceMemberCandidates(workspaceId: string): Promise<WorkspaceMemberCandidate[]> {
+    const response = await this.requestJson<ListWorkspaceMemberCandidatesResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/member-candidates`,
+    );
+    return response.members;
+  }
+
   /**
-   * Add an already-registered user by email. 404s when no user with that email
-   * exists (email invites for unknown users are deferred).
+   * Add one active member selected from the workspace candidate inventory.
    */
   async addWorkspaceMember(
     workspaceId: string,
@@ -4848,7 +5139,7 @@ export class OpenGeniClient {
     return await this.requestJson<ScheduledTask>(
       "POST",
       `/v1/workspaces/${workspaceId}/scheduled-tasks`,
-      request,
+      normalizeScheduledTaskMachineTarget(request),
     );
   }
 
@@ -4860,7 +5151,7 @@ export class OpenGeniClient {
     return await this.requestJson<ScheduledTask>(
       "PATCH",
       `/v1/workspaces/${workspaceId}/scheduled-tasks/${taskId}`,
-      request,
+      normalizeScheduledTaskMachineTarget(request),
     );
   }
 
@@ -5280,6 +5571,7 @@ export class OpenGeniClient {
     ) {
       throw new Error("File upload timeout must be a positive number");
     }
+    assertBrowserFileUploadSecureContext();
     const withTimeout = async <T>(
       timeoutMs: number,
       operation: (signal: AbortSignal) => Promise<T>,
@@ -6755,6 +7047,34 @@ export class OpenGeniClient {
     );
   }
 
+  async listOrganizationApiKeys(organizationId: string): Promise<ApiKey[]> {
+    const response = await this.requestJson<ListApiKeysResponse>(
+      "GET",
+      `/v1/organizations/${organizationId}/api-keys`,
+    );
+    return response.apiKeys;
+  }
+
+  /** The returned `token` is shown once; only its prefix is stored. */
+  async createOrganizationApiKey(
+    organizationId: string,
+    request: CreateOrganizationApiKeyRequest,
+  ): Promise<CreateApiKeyResponse> {
+    return await this.requestJson<CreateApiKeyResponse>(
+      "POST",
+      `/v1/organizations/${organizationId}/api-keys`,
+      request,
+    );
+  }
+
+  /** Revoke an organization-scoped API key. Returns the revoked key. */
+  async deleteOrganizationApiKey(organizationId: string, apiKeyId: string): Promise<ApiKey> {
+    return await this.requestJson<ApiKey>(
+      "DELETE",
+      `/v1/organizations/${organizationId}/api-keys/${apiKeyId}`,
+    );
+  }
+
   // --- Billing (account-scoped) --------------------------------------------------------------------
 
   async getBilling(options: { accountId?: string } = {}): Promise<BillingSummary> {
@@ -7105,14 +7425,20 @@ export class OpenGeniClient {
   }
 
   /** Contract-checked JSON transport shared by opt-in typed SDK clients. */
-  private async requestSessionCommand<T>(method: string, path: string, body?: unknown): Promise<T> {
+  private async requestSessionCommand<T>(
+    method: string,
+    path: string,
+    body?: unknown,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<T> {
     return await this.requestJson<T>(
       method,
       path,
       body,
       {},
       {
-        timeoutMs: this.sessionCommandTimeoutMs,
+        signal: options.signal,
+        timeoutMs: options.timeoutMs ?? this.sessionCommandTimeoutMs,
       },
     );
   }
@@ -7469,6 +7795,28 @@ function mutationTransportError(correlationId: string): OpenGeniApiError {
   });
 }
 
+function assertBrowserFileUploadSecureContext(): void {
+  const secureContext =
+    typeof window !== "undefined"
+      ? window.isSecureContext
+      : typeof globalThis.isSecureContext === "boolean"
+        ? globalThis.isSecureContext
+        : undefined;
+  // The framework-agnostic SDK also runs in Node, Bun, Deno, and edge
+  // runtimes. Preserve their existing upload behavior; this typed HTTPS error
+  // is only meaningful where the browser exposes a secure-context state.
+  if (secureContext === undefined) return;
+  if (!secureContext) {
+    throw new OpenGeniSecureContextRequiredError("insecure_context");
+  }
+  if (
+    typeof globalThis.crypto === "undefined" ||
+    typeof globalThis.crypto.subtle?.digest !== "function"
+  ) {
+    throw new OpenGeniSecureContextRequiredError("web_crypto_unavailable");
+  }
+}
+
 async function sha256ForUpload(body: Blob | ArrayBuffer | string): Promise<string> {
   const bytes =
     typeof body === "string"
@@ -7486,6 +7834,30 @@ async function sha256Hex(bytes: Uint8Array): Promise<string> {
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
+type ComputerFrameEvidenceMismatchReason =
+  | "frame_session_mismatch"
+  | "frame_target_mismatch"
+  | "frame_media_mismatch"
+  | "frame_digest_mismatch";
+
+function computerFrameEvidenceMismatchReason(
+  metadata: ReturnType<typeof decodeComputerFrameMetadataHeader>,
+  expected: {
+    computerSessionId: string;
+    targetId: string;
+    mediaType: "image/jpeg" | "image/png";
+    sha256: string;
+  },
+): ComputerFrameEvidenceMismatchReason | null {
+  if (metadata.computerSessionId !== expected.computerSessionId) {
+    return "frame_session_mismatch";
+  }
+  if (metadata.targetId !== expected.targetId) return "frame_target_mismatch";
+  if (metadata.mediaType !== expected.mediaType) return "frame_media_mismatch";
+  if (metadata.sha256 !== expected.sha256) return "frame_digest_mismatch";
+  return null;
+}
+
 async function cancelResponseBody(response: Response, reason: string): Promise<void> {
   await response.body?.cancel(reason).catch(() => undefined);
 }