@opengeni/sdk 3.3.2 → 3.7.0-canary.0

package/src/artifact-client.ts

@@ -1,4 +1,5 @@
 import { OpenGeniDocumentAuthorityClient } from "./document-authority-client";
+import type { FetchResponse } from "./client";
 import type {
   CreateEditableArtifactMaterializationRequest,
   CreateEditableArtifactResourceRequest,
@@ -16,6 +17,7 @@ import type {
   CreateWorkspaceArtifactRequest,
   PublishWorkspaceArtifactVersionRequest,
   RollbackWorkspaceArtifactRequest,
+  SetWorkspaceArtifactStatusRequest,
   WorkspaceArtifactContentResponse,
   WorkspaceArtifactDetailResponse,
   WorkspaceArtifactListOptions,
@@ -132,7 +134,7 @@ export class OpenGeniClient extends OpenGeniDocumentAuthorityClient {
     artifactId: string,
     jobId: string,
     options: ReadEditableArtifactMaterializationOptions,
-  ): Promise<Response> {
+  ): Promise<FetchResponse> {
     return await this.requestResponse(
       "GET",
       `/v1/workspaces/${encodeURIComponent(workspaceId)}/editable-artifacts/${encodeURIComponent(artifactId)}/materializations/${encodeURIComponent(jobId)}/download`,
@@ -148,6 +150,7 @@ export class OpenGeniClient extends OpenGeniDocumentAuthorityClient {
     const query = new URLSearchParams();
     if (options.limit !== undefined) query.set("limit", String(options.limit));
     if (options.cursor) query.set("cursor", options.cursor);
+    if (options.status) query.set("status", options.status);
     const suffix = query.size > 0 ? `?${query.toString()}` : "";
     return await this.requestJson<WorkspaceArtifactListResponse>(
       "GET",
@@ -211,4 +214,16 @@ export class OpenGeniClient extends OpenGeniDocumentAuthorityClient {
       request,
     );
   }
+
+  async setWorkspaceArtifactStatus(
+    workspaceId: string,
+    artifactId: string,
+    request: SetWorkspaceArtifactStatusRequest,
+  ): Promise<WorkspaceArtifactMutationResponse> {
+    return await this.requestJson<WorkspaceArtifactMutationResponse>(
+      "PATCH",
+      `/v1/workspaces/${workspaceId}/published-artifacts/${encodeURIComponent(artifactId)}/status`,
+      request,
+    );
+  }
 }

package/src/artifacts.ts

@@ -16,6 +16,7 @@ export type {
 } from "./editable-artifact-resources";
 export type {
   FetchLike,
+  FetchResponse,
   GetSessionOptions,
   OpenGeniClientOptions,
   OpenGeniRequestOptions,

package/src/browser.ts

@@ -1,7 +1,21 @@
 /** Browser-console client. Optional SDK surfaces must not enter this eager graph. */
 export { OpenGeniClient as OpenGeniBrowserClient } from "./client";
+export {
+  OpenGeniToolCallError,
+  OpenGeniToolReapprovalRequiredError,
+  OpenGeniToolsClient,
+} from "./tools";
+export type {
+  OpenGeniGeneratedTools,
+  OpenGeniDynamicToolNode,
+  OpenGeniToolCallOptions,
+  OpenGeniToolFunction,
+  OpenGeniToolsFacade,
+  OpenGeniWorkspaceTools,
+} from "./tools";
 export type {
   FetchLike,
+  FetchResponse,
   GetSessionOptions,
   OpenGeniClientOptions,
   OpenGeniRequestOptions,
@@ -13,9 +27,11 @@ export type {
 export {
   OpenGeniApiContractMismatchError,
   OpenGeniApiError,
+  OpenGeniSecureContextRequiredError,
   OpenGeniSessionListCursorError,
   OpenGeniStreamError,
   isRetryableStreamError,
 } from "./errors";
+export type { OpenGeniSecureContextRequiredReason } from "./errors";
 export { resolveWorkspaceVoiceInputEnabled } from "./transcription";
 export { OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION } from "./types";

package/src/client.ts

@@ -1,13 +1,16 @@
 import {
   OpenGeniApiContractMismatchError,
   OpenGeniApiError,
+  OpenGeniSecureContextRequiredError,
   OpenGeniSessionListCursorError,
 } from "./errors";
+import type { OpenGeniToolsFacade, OpenGeniToolTransport, OpenGeniWorkspaceTools } from "./tools";
 import {
   streamSessionEvents,
   type SessionEventStreamTransport,
   type StreamSessionEventsOptions,
 } from "./stream";
+import type { SessionModelContextResponse } from "./model-context";
 import {
   streamWorkspaceControlEvents,
   type WorkspaceControlStreamTransport,
@@ -169,6 +172,22 @@ import type {
   ClientConfig,
   WorkspaceModelAccessPolicy,
   WorkspaceModelCatalogResponse,
+  WorkspaceGatewayCustomModel,
+  WorkspaceGatewayCustomModelsResponse,
+  CreateWorkspaceGatewayCustomModelRequest,
+  DeleteWorkspaceGatewayCustomModelRequest,
+  WorkspaceOpenRouterCustomModel,
+  WorkspaceOpenRouterCustomModelsResponse,
+  CreateWorkspaceOpenRouterCustomModelRequest,
+  DeleteWorkspaceOpenRouterCustomModelRequest,
+  OrganizationModelProviderKind,
+  OrganizationModelProviderConnection,
+  UpsertOrganizationModelProviderConnectionRequest,
+  RevokeOrganizationModelProviderConnectionRequest,
+  OrganizationProviderCustomModel,
+  OrganizationProviderCustomModelsResponse,
+  CreateOrganizationProviderCustomModelRequest,
+  DeleteOrganizationProviderCustomModelRequest,
   WorkspaceRealtimeModelCatalogResponse,
   ClientSessionEventInput,
   UserMessageEventInput,
@@ -261,6 +280,8 @@ import type {
   AcceptOrganizationRecoveryCustodyRequest,
   ConfigureOrganizationRecoveryPolicyRequest,
   CreateOrganizationInvitationRequest,
+  CreateAdditionalOrganizationRequest,
+  CreateAdditionalOrganizationResponse,
   CreateOrganizationRequest,
   CreateOrganizationResponse,
   CreateOrganizationWorkspaceRequest,
@@ -563,7 +584,22 @@ function sessionListQuery(options: {
   };
 }
 
-export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+/**
+ * Web-standard fetch response accepted by the SDK.
+ *
+ * The project global `Response` type includes Bun's non-standard `textStream()`
+ * method and the newer `bytes()` method. Fetch implementations such as Expo do
+ * not necessarily provide either member, and the SDK does not use them, so
+ * they must not be part of the adapter boundary.
+ */
+export type FetchResponse = Omit<Response, "bytes" | "clone" | "textStream"> & {
+  clone(): FetchResponse;
+};
+
+export type FetchLike = (
+  input: string | URL | Request,
+  init?: RequestInit,
+) => Promise<FetchResponse>;
 
 export type WorkspaceControlEventPage = {
   events: WorkspaceControlEvent[];
@@ -740,6 +776,46 @@ function normalizeScheduledTaskMachineTarget<
  * WHATWG `fetch` + streams, so it runs in Node 18+, Bun, Deno, browsers, and
  * edge runtimes.
  */
+function createLazyToolsFacade(transport: OpenGeniToolTransport): OpenGeniToolsFacade {
+  return {
+    forWorkspace(workspaceId: string): OpenGeniWorkspaceTools {
+      const normalizedWorkspaceId = workspaceId.trim();
+      if (!normalizedWorkspaceId) throw new TypeError("workspaceId is required");
+      let workspaceTools: Promise<OpenGeniWorkspaceTools> | undefined;
+      const load = (): Promise<OpenGeniWorkspaceTools> =>
+        (workspaceTools ??= import("./tools").then(({ OpenGeniToolsClient }) =>
+          new OpenGeniToolsClient(transport).forWorkspace(normalizedWorkspaceId),
+        ));
+      const node = (path: readonly string[]): OpenGeniWorkspaceTools =>
+        new Proxy(
+          (async (...args: unknown[]) => {
+            let target: unknown = await load();
+            for (const segment of path) {
+              target = (target as Record<string, unknown>)[segment];
+            }
+            if (typeof target !== "function")
+              throw new TypeError("OpenGeni tool path is not callable");
+            return await Reflect.apply(target, undefined, args);
+          }) as unknown as OpenGeniWorkspaceTools,
+          {
+            get: (_target, property) => {
+              if (property === "then") return undefined;
+              if (typeof property !== "string") return undefined;
+              return node([...path, property]);
+            },
+          },
+        );
+      return new Proxy(Object.create(null) as OpenGeniWorkspaceTools, {
+        get: (_target, property) => {
+          if (property === "then") return undefined;
+          if (typeof property !== "string") return undefined;
+          return node([property]);
+        },
+      });
+    },
+  };
+}
+
 export class OpenGeniClient {
   private readonly baseUrl: string;
   private readonly options: OpenGeniClientOptions;
@@ -750,6 +826,8 @@ export class OpenGeniClient {
   private readonly queued = new Map<string, SingleFlightReadEntry>();
   /** Resource-oriented Browser/Computer facade over this exact authenticated client. */
   readonly interaction: OpenGeniInteractionClient;
+  /** Dynamic typed tool facade backed by the canonical workspace gateway. */
+  readonly tools: OpenGeniToolsFacade;
 
   constructor(options: OpenGeniClientOptions) {
     this.baseUrl = options.baseUrl.replace(/\/+$/, "");
@@ -762,6 +840,7 @@ export class OpenGeniClient {
     }
     this.sessionCommandTimeoutMs = sessionCommandTimeoutMs;
     this.interaction = new OpenGeniInteractionClient(this);
+    this.tools = createLazyToolsFacade(this);
   }
 
   // --- Session lifecycle ---------------------------------------------------
@@ -789,7 +868,7 @@ export class OpenGeniClient {
     if (input.durationSeconds !== undefined) {
       form.append("durationSeconds", String(input.durationSeconds));
     }
-    let response: Response;
+    let response: FetchResponse;
     try {
       response = await this.fetchImpl(this.url(`/v1/workspaces/${workspaceId}/transcriptions`), {
         method: "POST",
@@ -888,7 +967,7 @@ export class OpenGeniClient {
     input: UploadTranscriptionRecordingChunkInput,
   ): Promise<UploadTranscriptionRecordingChunkResponse> {
     const correlationId = crypto.randomUUID();
-    let response: Response;
+    let response: FetchResponse;
     try {
       response = await this.fetchImpl(
         this.url(
@@ -1030,6 +1109,17 @@ export class OpenGeniClient {
     );
   }
 
+  /** Exact model-visible prefix captured from the latest provider request. */
+  async getSessionModelContext(
+    workspaceId: string,
+    sessionId: string,
+  ): Promise<SessionModelContextResponse> {
+    return await this.requestJson<SessionModelContextResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/model-context`,
+    );
+  }
+
   async updateSession(
     workspaceId: string,
     sessionId: string,
@@ -1639,7 +1729,11 @@ export class OpenGeniClient {
   async listTurns(
     workspaceId: string,
     sessionId: string,
-    options: { limit?: number; latestStarted?: boolean; signal?: AbortSignal | undefined } = {},
+    options: {
+      limit?: number;
+      latestStarted?: boolean;
+      signal?: AbortSignal | undefined;
+    } = {},
   ): Promise<SessionTurn[]> {
     return await this.requestJson<SessionTurn[]>(
       "GET",
@@ -4045,6 +4139,172 @@ export class OpenGeniClient {
     );
   }
 
+  /** List workspace-owned unpinned Vercel AI Gateway model slugs. */
+  async listWorkspaceGatewayCustomModels(
+    workspaceId: string,
+  ): Promise<WorkspaceGatewayCustomModelsResponse> {
+    return await this.requestJson<WorkspaceGatewayCustomModelsResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/gateway-custom-models`,
+    );
+  }
+
+  /** Add one exact upstream Vercel AI Gateway slug. */
+  async createWorkspaceGatewayCustomModel(
+    workspaceId: string,
+    request: CreateWorkspaceGatewayCustomModelRequest,
+  ): Promise<WorkspaceGatewayCustomModel> {
+    return await this.requestJson<WorkspaceGatewayCustomModel>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/gateway-custom-models`,
+      request,
+    );
+  }
+
+  /** Remove one workspace custom Gateway model by its stable row id. */
+  async deleteWorkspaceGatewayCustomModel(
+    workspaceId: string,
+    customModelId: string,
+    request: DeleteWorkspaceGatewayCustomModelRequest,
+  ): Promise<void> {
+    if (
+      !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+        customModelId,
+      )
+    ) {
+      throw new TypeError("customModelId must be a UUID");
+    }
+    await this.requestVoid(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/gateway-custom-models/${encodeURIComponent(customModelId)}`,
+      request,
+    );
+  }
+
+  /** List workspace-owned unpinned OpenRouter model slugs. */
+  async listWorkspaceOpenRouterCustomModels(
+    workspaceId: string,
+  ): Promise<WorkspaceOpenRouterCustomModelsResponse> {
+    return await this.requestJson<WorkspaceOpenRouterCustomModelsResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/openrouter-custom-models`,
+    );
+  }
+
+  /** Add one exact upstream OpenRouter slug. */
+  async createWorkspaceOpenRouterCustomModel(
+    workspaceId: string,
+    request: CreateWorkspaceOpenRouterCustomModelRequest,
+  ): Promise<WorkspaceOpenRouterCustomModel> {
+    return await this.requestJson<WorkspaceOpenRouterCustomModel>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/openrouter-custom-models`,
+      request,
+    );
+  }
+
+  /** Remove one workspace custom OpenRouter model by its stable row id. */
+  async deleteWorkspaceOpenRouterCustomModel(
+    workspaceId: string,
+    customModelId: string,
+    request: DeleteWorkspaceOpenRouterCustomModelRequest,
+  ): Promise<void> {
+    if (
+      !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+        customModelId,
+      )
+    ) {
+      throw new TypeError("customModelId must be a UUID");
+    }
+    await this.requestVoid(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/openrouter-custom-models/${encodeURIComponent(customModelId)}`,
+      request,
+    );
+  }
+
+  /** Read metadata for one organization-owned model-provider connection. */
+  async getOrganizationModelProviderConnection(
+    organizationId: string,
+    providerKind: OrganizationModelProviderKind,
+  ): Promise<OrganizationModelProviderConnection | null> {
+    return await this.requestJson<OrganizationModelProviderConnection | null>(
+      "GET",
+      `/v1/organizations/${organizationId}/model-providers/${providerKind}`,
+    );
+  }
+
+  /** Connect or rotate one organization-owned provider credential. */
+  async upsertOrganizationModelProviderConnection(
+    organizationId: string,
+    providerKind: OrganizationModelProviderKind,
+    request: UpsertOrganizationModelProviderConnectionRequest,
+  ): Promise<OrganizationModelProviderConnection> {
+    return await this.requestJson<OrganizationModelProviderConnection>(
+      "PUT",
+      `/v1/organizations/${organizationId}/model-providers/${providerKind}`,
+      request,
+    );
+  }
+
+  /** Revoke one organization-owned provider credential. */
+  async revokeOrganizationModelProviderConnection(
+    organizationId: string,
+    providerKind: OrganizationModelProviderKind,
+    request: RevokeOrganizationModelProviderConnectionRequest,
+  ): Promise<OrganizationModelProviderConnection> {
+    return await this.requestJson<OrganizationModelProviderConnection>(
+      "DELETE",
+      `/v1/organizations/${organizationId}/model-providers/${providerKind}`,
+      request,
+    );
+  }
+
+  /** List organization-owned exact upstream model slugs. */
+  async listOrganizationProviderCustomModels(
+    organizationId: string,
+    providerKind: OrganizationModelProviderKind,
+  ): Promise<OrganizationProviderCustomModelsResponse> {
+    return await this.requestJson<OrganizationProviderCustomModelsResponse>(
+      "GET",
+      `/v1/organizations/${organizationId}/model-providers/${providerKind}/custom-models`,
+    );
+  }
+
+  /** Add one organization-owned exact upstream model slug. */
+  async createOrganizationProviderCustomModel(
+    organizationId: string,
+    providerKind: OrganizationModelProviderKind,
+    request: CreateOrganizationProviderCustomModelRequest,
+  ): Promise<OrganizationProviderCustomModel> {
+    return await this.requestJson<OrganizationProviderCustomModel>(
+      "POST",
+      `/v1/organizations/${organizationId}/model-providers/${providerKind}/custom-models`,
+      request,
+    );
+  }
+
+  /** Retire one organization-owned custom model. */
+  async deleteOrganizationProviderCustomModel(
+    organizationId: string,
+    providerKind: OrganizationModelProviderKind,
+    customModelId: string,
+    request: DeleteOrganizationProviderCustomModelRequest,
+  ): Promise<OrganizationProviderCustomModel> {
+    if (
+      !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+        customModelId,
+      )
+    ) {
+      throw new TypeError("customModelId must be a UUID");
+    }
+    return await this.requestJson<OrganizationProviderCustomModel>(
+      "DELETE",
+      `/v1/organizations/${organizationId}/model-providers/${providerKind}/custom-models/${encodeURIComponent(customModelId)}`,
+      request,
+    );
+  }
+
   /** Read the workspace's hard provider/model allowlist. */
   async getWorkspaceModelAccessPolicy(workspaceId: string): Promise<WorkspaceModelAccessPolicy> {
     return await this.requestJson<WorkspaceModelAccessPolicy>(
@@ -4140,6 +4400,17 @@ export class OpenGeniClient {
     return await this.requestJson<CreateOrganizationResponse>("POST", "/v1/organizations", request);
   }
 
+  /** Create another organization owned by the current managed human. */
+  async createAdditionalOrganization(
+    request: CreateAdditionalOrganizationRequest,
+  ): Promise<CreateAdditionalOrganizationResponse> {
+    return await this.requestJson<CreateAdditionalOrganizationResponse>(
+      "POST",
+      "/v1/organizations/additional",
+      request,
+    );
+  }
+
   /** Pending and historical invitations addressed to the current managed human. */
   async listOrganizationInvitations(
     options: { cursor?: string; limit?: number } = {},
@@ -4229,7 +4500,7 @@ export class OpenGeniClient {
     );
   }
 
-  /** Create a shared workspace without implicitly granting the actor access. */
+  /** Create a shared workspace and grant its creator explicit workspace-admin access. */
   async createOrganizationWorkspace(
     organizationId: string,
     request: CreateOrganizationWorkspaceRequest,
@@ -4266,6 +4537,14 @@ export class OpenGeniClient {
     );
   }
 
+  /** Delete a shared workspace through organization-administrator authority. */
+  async deleteOrganizationWorkspace(organizationId: string, workspaceId: string): Promise<void> {
+    await this.requestVoid(
+      "DELETE",
+      `/v1/organizations/${organizationId}/workspaces/${workspaceId}`,
+    );
+  }
+
   async putOrganizationWorkspaceMember(
     organizationId: string,
     workspaceId: string,
@@ -4594,11 +4873,13 @@ export class OpenGeniClient {
   async createWorkspaceInstructionPolicyDraft(
     workspaceId: string,
     request: CreateWorkspaceInstructionPolicyDraftRequest,
+    options: OpenGeniRequestOptions = {},
   ): Promise<WorkspaceInstructionPolicyRevision> {
-    return await this.requestJson<WorkspaceInstructionPolicyRevision>(
+    return await this.requestSessionCommand<WorkspaceInstructionPolicyRevision>(
       "POST",
       `/v1/workspaces/${workspaceId}/instruction-policies/drafts`,
       request,
+      options,
     );
   }
 
@@ -4658,11 +4939,13 @@ export class OpenGeniClient {
     workspaceId: string,
     revisionId: string,
     request: ActivateWorkspaceInstructionPolicyRequest,
+    options: OpenGeniRequestOptions = {},
   ): Promise<WorkspaceInstructionPolicyActivationResponse> {
-    return await this.requestJson<WorkspaceInstructionPolicyActivationResponse>(
+    return await this.requestSessionCommand<WorkspaceInstructionPolicyActivationResponse>(
       "POST",
       `/v1/workspaces/${workspaceId}/instruction-policies/${encodeURIComponent(revisionId)}/activate`,
       request,
+      options,
     );
   }
 
@@ -5478,6 +5761,7 @@ export class OpenGeniClient {
     ) {
       throw new Error("File upload timeout must be a positive number");
     }
+    assertBrowserFileUploadSecureContext();
     const withTimeout = async <T>(
       timeoutMs: number,
       operation: (signal: AbortSignal) => Promise<T>,
@@ -7360,7 +7644,7 @@ export class OpenGeniClient {
     const correlationId = crypto.randomUUID();
     const abort = requestAbortSignal(options);
     try {
-      let response: Response;
+      let response: FetchResponse;
       try {
         response = await awaitWithAbort(
           this.fetchImpl(this.url(path, query), {
@@ -7383,14 +7667,18 @@ export class OpenGeniClient {
         throw error;
       }
       assertApiContractResponse(response);
-      if (!response.ok) {
-        throw await apiErrorFromResponse(response, { method, correlationId });
-      }
-      await assertJsonResponse(response, { method, correlationId });
       try {
-        return (await response.json()) as T;
+        if (!response.ok) {
+          throw await awaitWithAbort(
+            apiErrorFromResponse(response, { method, correlationId }),
+            abort.signal,
+          );
+        }
+        await awaitWithAbort(assertJsonResponse(response, { method, correlationId }), abort.signal);
+        return (await awaitWithAbort(response.json(), abort.signal)) as T;
       } catch (error) {
         if (options.signal?.aborted) throw error;
+        if (error instanceof OpenGeniApiError) throw error;
         if (isMutationMethod(method)) {
           throw mutationTransportError(correlationId);
         }
@@ -7407,9 +7695,9 @@ export class OpenGeniClient {
     path: string,
     query: Record<string, string> = {},
     options: OpenGeniRequestOptions = {},
-  ): Promise<Response> {
+  ): Promise<FetchResponse> {
     const correlationId = crypto.randomUUID();
-    let response: Response;
+    let response: FetchResponse;
     try {
       response = await this.fetchImpl(this.url(path, query), {
         method,
@@ -7433,7 +7721,7 @@ export class OpenGeniClient {
   /** Contract-checked transport shared by opt-in typed SDK clients for 204 responses. */
   async requestVoid(method: string, path: string, body?: unknown): Promise<void> {
     const correlationId = crypto.randomUUID();
-    let response: Response;
+    let response: FetchResponse;
     try {
       response = await this.fetchImpl(this.url(path), {
         method,
@@ -7457,7 +7745,7 @@ export class OpenGeniClient {
   }
 }
 
-function assertApiContractResponse(response: Response): void {
+function assertApiContractResponse(response: FetchResponse): void {
   const actual = response.headers.get(OPENGENI_API_CONTRACT_HEADER);
   if (actual && actual !== OPENGENI_API_CONTRACT_REVISION) {
     throw new OpenGeniApiContractMismatchError(OPENGENI_API_CONTRACT_REVISION, actual);
@@ -7640,7 +7928,7 @@ type ApiErrorRequestContext = {
 };
 
 async function apiErrorFromResponse(
-  response: Response,
+  response: FetchResponse,
   context: ApiErrorRequestContext,
 ): Promise<OpenGeniApiError> {
   return new OpenGeniApiError(response.status, await readBoundedJsonErrorBody(response), {
@@ -7650,7 +7938,7 @@ async function apiErrorFromResponse(
 }
 
 async function assertJsonResponse(
-  response: Response,
+  response: FetchResponse,
   context: ApiErrorRequestContext,
 ): Promise<void> {
   if (isJsonContentType(response.headers.get("content-type"))) return;
@@ -7664,7 +7952,7 @@ async function assertJsonResponse(
   });
 }
 
-async function readBoundedJsonErrorBody(response: Response): Promise<string> {
+async function readBoundedJsonErrorBody(response: FetchResponse): Promise<string> {
   if (!isJsonContentType(response.headers.get("content-type"))) {
     await cancelResponseBody(response, "discarding API error body");
     return "";
@@ -7701,6 +7989,28 @@ function mutationTransportError(correlationId: string): OpenGeniApiError {
   });
 }
 
+function assertBrowserFileUploadSecureContext(): void {
+  const secureContext =
+    typeof window !== "undefined"
+      ? window.isSecureContext
+      : typeof globalThis.isSecureContext === "boolean"
+        ? globalThis.isSecureContext
+        : undefined;
+  // The framework-agnostic SDK also runs in Node, Bun, Deno, and edge
+  // runtimes. Preserve their existing upload behavior; this typed HTTPS error
+  // is only meaningful where the browser exposes a secure-context state.
+  if (secureContext === undefined) return;
+  if (!secureContext) {
+    throw new OpenGeniSecureContextRequiredError("insecure_context");
+  }
+  if (
+    typeof globalThis.crypto === "undefined" ||
+    typeof globalThis.crypto.subtle?.digest !== "function"
+  ) {
+    throw new OpenGeniSecureContextRequiredError("web_crypto_unavailable");
+  }
+}
+
 async function sha256ForUpload(body: Blob | ArrayBuffer | string): Promise<string> {
   const bytes =
     typeof body === "string"
@@ -7742,7 +8052,7 @@ function computerFrameEvidenceMismatchReason(
   return null;
 }
 
-async function cancelResponseBody(response: Response, reason: string): Promise<void> {
+async function cancelResponseBody(response: FetchResponse, reason: string): Promise<void> {
   await response.body?.cancel(reason).catch(() => undefined);
 }
 
@@ -7811,7 +8121,7 @@ function parseBoundedContentLength(value: string | null): number | null {
 }
 
 async function readBoundedResponseBytes(
-  response: Response,
+  response: FetchResponse,
   maxBytes: number,
   expectedBytes: number | null,
 ): Promise<Uint8Array> {

package/src/core.ts

@@ -1,7 +1,21 @@
 /** Backward-compatible non-artifact client surface. */
 export { OpenGeniDocumentAuthorityClient as OpenGeniCoreClient } from "./document-authority-client";
+export {
+  OpenGeniToolCallError,
+  OpenGeniToolReapprovalRequiredError,
+  OpenGeniToolsClient,
+} from "./tools";
+export type {
+  OpenGeniGeneratedTools,
+  OpenGeniDynamicToolNode,
+  OpenGeniToolCallOptions,
+  OpenGeniToolFunction,
+  OpenGeniToolsFacade,
+  OpenGeniWorkspaceTools,
+} from "./tools";
 export type {
   FetchLike,
+  FetchResponse,
   GetSessionOptions,
   OpenGeniClientOptions,
   OpenGeniRequestOptions,
@@ -13,9 +27,11 @@ export type {
 export {
   OpenGeniApiContractMismatchError,
   OpenGeniApiError,
+  OpenGeniSecureContextRequiredError,
   OpenGeniSessionListCursorError,
   OpenGeniStreamError,
   isRetryableStreamError,
 } from "./errors";
+export type { OpenGeniSecureContextRequiredReason } from "./errors";
 export { resolveWorkspaceVoiceInputEnabled } from "./transcription";
 export { OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION } from "./types";