@opengeni/sdk 6.1.0 → 7.0.0

package/dist/{chunk-IZH5F7QC.js → chunk-L3MYVTPO.js}

@@ -1,9 +1,17 @@
 import {
   OpenGeniClient
-} from "./chunk-64S3VKJU.js";
+} from "./chunk-7ESHQLTB.js";
 
 // src/document-authority-client.ts
 var OpenGeniDocumentAuthorityClient = class extends OpenGeniClient {
+  /** Issue an exact-session or standing personal-resource grant. */
+  async issueUserResourceGrant(workspaceId, authorityId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/user-resource-authorities/${authorityId}/grants`,
+      request
+    );
+  }
   async listDocumentBases(workspaceId) {
     return await this.requestJson(
       "GET",
@@ -124,4 +132,4 @@ var OpenGeniDocumentAuthorityClient = class extends OpenGeniClient {
 export {
   OpenGeniDocumentAuthorityClient
 };
-//# sourceMappingURL=chunk-IZH5F7QC.js.map
+//# sourceMappingURL=chunk-L3MYVTPO.js.map

package/dist/chunk-L3MYVTPO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/document-authority-client.ts"],"sourcesContent":["import type { CompanyBrainOkfDownload, CompanyBrainOkfPackage } from \"./company-brain\";\nimport { OpenGeniClient as OpenGeniCoreClient } from \"./client\";\nimport type {\n  Document,\n  IssueUserResourceGrantRequest,\n  UserResourceGrantMutationResponse,\n  DocumentBase,\n  FileDownloadUrlResponse,\n  DocumentAuthorityReclassification,\n  DocumentDefaultCollectionBackfill,\n  DocumentDefaultCollectionBackfillAudit,\n  GetDocumentDefaultCollectionBackfillAuditOptions,\n  ListDocumentAuthorityReclassificationsOptions,\n  ListDocumentAuthorityReclassificationsResponse,\n  ListDocumentDefaultCollectionBackfillRunsResponse,\n  ListOrganizationDocumentAuthorityReclassificationsResponse,\n  ReclassifyDocumentAuthorityRequest,\n  RunDocumentDefaultCollectionBackfillRequest,\n} from \"./types\";\n\n/**\n * Operator-only Document authority and tenancy-backfill surface.\n *\n * The public root and legacy `core` clients extend this class for compatibility.\n * Browser consoles that import `@opengeni/sdk/browser` do not retain these\n * methods or their routes.\n */\nexport class OpenGeniDocumentAuthorityClient extends OpenGeniCoreClient {\n  /** Issue an exact-session or standing personal-resource grant. */\n  async issueUserResourceGrant(\n    workspaceId: string,\n    authorityId: string,\n    request: IssueUserResourceGrantRequest,\n  ): Promise<UserResourceGrantMutationResponse> {\n    return await this.requestJson<UserResourceGrantMutationResponse>(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/user-resource-authorities/${authorityId}/grants`,\n      request,\n    );\n  }\n\n  async listDocumentBases(workspaceId: string): Promise<DocumentBase[]> {\n    return await this.requestJson<DocumentBase[]>(\n      \"GET\",\n      `/v1/workspaces/${workspaceId}/document-bases`,\n    );\n  }\n\n  /**\n   * List every Document the current human can manage from this workspace,\n   * including portable personal and organization-scoped Documents whose\n   * immutable ingestion workspace is different.\n   */\n  async listAccessibleDocuments(workspaceId: string): Promise<Document[]> {\n    return await this.requestJson<Document[]>(\"GET\", `/v1/workspaces/${workspaceId}/documents`);\n  }\n\n  /** Mint a source-file URL through the Document's effective authority. */\n  async createDocumentOriginalFileDownloadUrl(\n    workspaceId: string,\n    documentId: string,\n  ): Promise<FileDownloadUrlResponse> {\n    return await this.requestJson<FileDownloadUrlResponse>(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/documents/${documentId}/original-file/download-url`,\n    );\n  }\n\n  /** Retry indexing for a failed document. */\n  async reindexDocument(\n    workspaceId: string,\n    baseId: string,\n    documentId: string,\n  ): Promise<Document> {\n    return await this.requestJson<Document>(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/document-bases/${baseId}/documents/${documentId}/reindex`,\n    );\n  }\n\n  /** Permission-filtered Company Brain package with authorized guidance bodies. */\n  getCompanyBrain(workspaceId: string): Promise<CompanyBrainOkfPackage> {\n    return this.requestJson<CompanyBrainOkfPackage>(\n      \"GET\",\n      `/v1/workspaces/${workspaceId}/company-brain`,\n    );\n  }\n\n  /** Download the deterministic Markdown/YAML Company Brain package. */\n  async exportCompanyBrainOkf(workspaceId: string): Promise<CompanyBrainOkfDownload> {\n    const response = await this.requestResponse(\n      \"GET\",\n      `/v1/workspaces/${workspaceId}/company-brain/export`,\n    );\n    const headers = response.headers;\n    return {\n      content: await response.text(),\n      contentType: headers.get(\"content-type\") ?? \"text/markdown\",\n      filename: headers.get(\"content-disposition\")?.split('\"')[1] ?? \"company-brain.okf.md\",\n    };\n  }\n\n  /**\n   * Atomically reclassify a Document's authority and every indexed chunk.\n   * The operation is replay-safe and rejects a stale expected authority tuple.\n   */\n  async reclassifyDocumentAuthority(\n    workspaceId: string,\n    documentId: string,\n    request: ReclassifyDocumentAuthorityRequest,\n  ): Promise<DocumentAuthorityReclassification> {\n    return await this.requestJson<DocumentAuthorityReclassification>(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/documents/${documentId}/authority-reclassifications`,\n      request,\n    );\n  }\n\n  /** List the current actor's durable authority-reclassification receipts. */\n  async listDocumentAuthorityReclassifications(\n    workspaceId: string,\n    documentId: string,\n    options: ListDocumentAuthorityReclassificationsOptions = {},\n  ): Promise<ListDocumentAuthorityReclassificationsResponse> {\n    const params = new URLSearchParams();\n    if (options.limit !== undefined) params.set(\"limit\", String(options.limit));\n    if (options.cursor) params.set(\"cursor\", options.cursor);\n    const query = params.size > 0 ? `?${params.toString()}` : \"\";\n    return await this.requestJson<ListDocumentAuthorityReclassificationsResponse>(\n      \"GET\",\n      `/v1/workspaces/${workspaceId}/documents/${documentId}/authority-reclassifications${query}`,\n    );\n  }\n\n  /**\n   * Advance one resumable, organization-scoped Default collection backfill.\n   * Reusing an operation ID is idempotent; keep the run ID across batches.\n   */\n  async runDocumentDefaultCollectionBackfill(\n    workspaceId: string,\n    request: RunDocumentDefaultCollectionBackfillRequest,\n  ): Promise<DocumentDefaultCollectionBackfill> {\n    return await this.requestJson<DocumentDefaultCollectionBackfill>(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/document-default-collection-backfills`,\n      request,\n    );\n  }\n\n  /** List organization-scoped Default collection backfill runs (organization admin only). */\n  async listDocumentDefaultCollectionBackfillRuns(\n    workspaceId: string,\n    options: ListDocumentAuthorityReclassificationsOptions = {},\n  ): Promise<ListDocumentDefaultCollectionBackfillRunsResponse> {\n    const params = new URLSearchParams();\n    if (options.limit !== undefined) params.set(\"limit\", String(options.limit));\n    if (options.cursor) params.set(\"cursor\", options.cursor);\n    const query = params.size > 0 ? `?${params.toString()}` : \"\";\n    return await this.requestJson<ListDocumentDefaultCollectionBackfillRunsResponse>(\n      \"GET\",\n      `/v1/workspaces/${workspaceId}/document-default-collection-backfills${query}`,\n    );\n  }\n\n  /** Read bounded operation and workspace receipts for one Default-collection backfill run. */\n  async getDocumentDefaultCollectionBackfillAudit(\n    workspaceId: string,\n    runId: string,\n    options: GetDocumentDefaultCollectionBackfillAuditOptions = {},\n  ): Promise<DocumentDefaultCollectionBackfillAudit> {\n    const params = new URLSearchParams();\n    if (options.limit !== undefined) params.set(\"limit\", String(options.limit));\n    if (options.operationCursor) params.set(\"operationCursor\", options.operationCursor);\n    if (options.receiptCursor) params.set(\"receiptCursor\", options.receiptCursor);\n    const query = params.size > 0 ? `?${params.toString()}` : \"\";\n    return await this.requestJson<DocumentDefaultCollectionBackfillAudit>(\n      \"GET\",\n      `/v1/workspaces/${workspaceId}/document-default-collection-backfills/${runId}${query}`,\n    );\n  }\n\n  /** List organization-wide Document authority changes (organization admin only). */\n  async listOrganizationDocumentAuthorityReclassifications(\n    workspaceId: string,\n    options: ListDocumentAuthorityReclassificationsOptions = {},\n  ): Promise<ListOrganizationDocumentAuthorityReclassificationsResponse> {\n    const params = new URLSearchParams();\n    if (options.limit !== undefined) params.set(\"limit\", String(options.limit));\n    if (options.cursor) params.set(\"cursor\", options.cursor);\n    const query = params.size > 0 ? `?${params.toString()}` : \"\";\n    return await this.requestJson<ListOrganizationDocumentAuthorityReclassificationsResponse>(\n      \"GET\",\n      `/v1/workspaces/${workspaceId}/document-authority-reclassifications${query}`,\n    );\n  }\n}\n"],"mappings":";;;;;AA2BO,IAAM,kCAAN,cAA8C,eAAmB;AAAA;AAAA,EAEtE,MAAM,uBACJ,aACA,aACA,SAC4C;AAC5C,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,kBAAkB,WAAW,8BAA8B,WAAW;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,aAA8C;AACpE,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,kBAAkB,WAAW;AAAA,IAC/B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,wBAAwB,aAA0C;AACtE,WAAO,MAAM,KAAK,YAAwB,OAAO,kBAAkB,WAAW,YAAY;AAAA,EAC5F;AAAA;AAAA,EAGA,MAAM,sCACJ,aACA,YACkC;AAClC,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,kBAAkB,WAAW,cAAc,UAAU;AAAA,IACvD;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,gBACJ,aACA,QACA,YACmB;AACnB,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,kBAAkB,WAAW,mBAAmB,MAAM,cAAc,UAAU;AAAA,IAChF;AAAA,EACF;AAAA;AAAA,EAGA,gBAAgB,aAAsD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,WAAW;AAAA,IAC/B;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,sBAAsB,aAAuD;AACjF,UAAM,WAAW,MAAM,KAAK;AAAA,MAC1B;AAAA,MACA,kBAAkB,WAAW;AAAA,IAC/B;AACA,UAAM,UAAU,SAAS;AACzB,WAAO;AAAA,MACL,SAAS,MAAM,SAAS,KAAK;AAAA,MAC7B,aAAa,QAAQ,IAAI,cAAc,KAAK;AAAA,MAC5C,UAAU,QAAQ,IAAI,qBAAqB,GAAG,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACjE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,4BACJ,aACA,YACA,SAC4C;AAC5C,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,kBAAkB,WAAW,cAAc,UAAU;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,uCACJ,aACA,YACA,UAAyD,CAAC,GACD;AACzD,UAAM,SAAS,IAAI,gBAAgB;AACnC,QAAI,QAAQ,UAAU,OAAW,QAAO,IAAI,SAAS,OAAO,QAAQ,KAAK,CAAC;AAC1E,QAAI,QAAQ,OAAQ,QAAO,IAAI,UAAU,QAAQ,MAAM;AACvD,UAAM,QAAQ,OAAO,OAAO,IAAI,IAAI,OAAO,SAAS,CAAC,KAAK;AAC1D,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,kBAAkB,WAAW,cAAc,UAAU,+BAA+B,KAAK;AAAA,IAC3F;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,qCACJ,aACA,SAC4C;AAC5C,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,kBAAkB,WAAW;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,0CACJ,aACA,UAAyD,CAAC,GACE;AAC5D,UAAM,SAAS,IAAI,gBAAgB;AACnC,QAAI,QAAQ,UAAU,OAAW,QAAO,IAAI,SAAS,OAAO,QAAQ,KAAK,CAAC;AAC1E,QAAI,QAAQ,OAAQ,QAAO,IAAI,UAAU,QAAQ,MAAM;AACvD,UAAM,QAAQ,OAAO,OAAO,IAAI,IAAI,OAAO,SAAS,CAAC,KAAK;AAC1D,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,kBAAkB,WAAW,yCAAyC,KAAK;AAAA,IAC7E;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,0CACJ,aACA,OACA,UAA4D,CAAC,GACZ;AACjD,UAAM,SAAS,IAAI,gBAAgB;AACnC,QAAI,QAAQ,UAAU,OAAW,QAAO,IAAI,SAAS,OAAO,QAAQ,KAAK,CAAC;AAC1E,QAAI,QAAQ,gBAAiB,QAAO,IAAI,mBAAmB,QAAQ,eAAe;AAClF,QAAI,QAAQ,cAAe,QAAO,IAAI,iBAAiB,QAAQ,aAAa;AAC5E,UAAM,QAAQ,OAAO,OAAO,IAAI,IAAI,OAAO,SAAS,CAAC,KAAK;AAC1D,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,kBAAkB,WAAW,0CAA0C,KAAK,GAAG,KAAK;AAAA,IACtF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,mDACJ,aACA,UAAyD,CAAC,GACW;AACrE,UAAM,SAAS,IAAI,gBAAgB;AACnC,QAAI,QAAQ,UAAU,OAAW,QAAO,IAAI,SAAS,OAAO,QAAQ,KAAK,CAAC;AAC1E,QAAI,QAAQ,OAAQ,QAAO,IAAI,UAAU,QAAQ,MAAM;AACvD,UAAM,QAAQ,OAAO,OAAO,IAAI,IAAI,OAAO,SAAS,CAAC,KAAK;AAC1D,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,kBAAkB,WAAW,wCAAwC,KAAK;AAAA,IAC5E;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-CFSYTYMA.js → chunk-MXQX4M36.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-FMLDFJ2Q.js";
 import {
   OpenGeniClient
-} from "./chunk-64S3VKJU.js";
+} from "./chunk-7ESHQLTB.js";
 import {
   OpenGeniApiError
 } from "./chunk-OO5LPTO7.js";
@@ -636,4 +636,4 @@ export {
   isOpenGeniSiteBridgeCancelMessage,
   sanitizeOpenGeniSiteToolCallRequest
 };
-//# sourceMappingURL=chunk-CFSYTYMA.js.map
+//# sourceMappingURL=chunk-MXQX4M36.js.map

package/dist/{chunk-VDACQXJZ.js → chunk-N76DIO4E.js}

@@ -1,39 +1,17 @@
 import {
   OpenGeniClient
-} from "./chunk-4ZQQQBOH.js";
+} from "./chunk-RCVWE6UR.js";
 
 // src/embedding-client.ts
 var OpenGeniEmbeddingClient = class extends OpenGeniClient {
-  /** Server-only organization administration. First registration opts the whole
-   * organization into exact namespace routing, including future workspaces. */
-  async putHostMcpResolver(organizationId, externalSource, request, options) {
-    return this.requestJson(
-      "PUT",
-      `/v1/organizations/${organizationId}/mcp-credential-resolvers/${encodeURIComponent(externalSource)}`,
-      request,
-      {},
-      options
-    );
-  }
-  async getHostMcpResolver(organizationId, externalSource, options) {
-    return this.requestJson(
+  /** Recover this actor's connection creation result without resending secrets.
+   * A 404 means no visible committed result, not proof that an in-flight write failed. */
+  async getConnectionCreationResult(workspaceId, operationId) {
+    const response = await this.requestJson(
       "GET",
-      `/v1/organizations/${organizationId}/mcp-credential-resolvers/${encodeURIComponent(externalSource)}`,
-      void 0,
-      {},
-      options
-    );
-  }
-  /** Retains registration identity and namespace opt-in. Replays never restore
-   * a previous endpoint/secret. Use put with the current generation to reactivate. */
-  async revokeHostMcpResolver(organizationId, externalSource, request, options) {
-    return this.requestJson(
-      "POST",
-      `/v1/organizations/${organizationId}/mcp-credential-resolvers/${encodeURIComponent(externalSource)}/revoke`,
-      request,
-      {},
-      options
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/connections/operations/${encodeURIComponent(operationId)}`
     );
+    return response.connection;
   }
   /** Rotate existing inline credentials only while no credential-consuming work
    * is pending or active. Reuse the operation key and exact request to reconcile
@@ -160,63 +138,6 @@ var OpenGeniEmbeddingClient = class extends OpenGeniClient {
   async listConnectProviders(workspaceId) {
     return this.requestJson("GET", `/v1/workspaces/${workspaceId}/connect/catalog`);
   }
-  /** Register credential-free, external-owner host authority. Does not itself
-   * authorize an execution or install MCP tools. */
-  async createHostMcpBinding(workspaceId, request, options = {}) {
-    return this.requestJson(
-      "POST",
-      `/v1/workspaces/${encodeURIComponent(workspaceId)}/host-mcp-bindings`,
-      request,
-      {},
-      options
-    );
-  }
-  async getHostMcpBinding(workspaceId, bindingId, options = {}) {
-    return this.requestJson(
-      "GET",
-      `/v1/workspaces/${encodeURIComponent(workspaceId)}/host-mcp-bindings/${encodeURIComponent(bindingId)}`,
-      void 0,
-      {},
-      options
-    );
-  }
-  async revokeHostMcpBinding(workspaceId, bindingId, request, options = {}) {
-    return this.requestJson(
-      "POST",
-      `/v1/workspaces/${encodeURIComponent(workspaceId)}/host-mcp-bindings/${encodeURIComponent(bindingId)}/revoke`,
-      request,
-      {},
-      options
-    );
-  }
-  /** Issue owner-scoped grant metadata; accepted execution must separately admit it. */
-  async issueHostMcpDelegation(workspaceId, request, options = {}) {
-    return this.requestJson(
-      "POST",
-      `/v1/workspaces/${encodeURIComponent(workspaceId)}/host-mcp-delegations`,
-      request,
-      {},
-      options
-    );
-  }
-  async getHostMcpDelegation(workspaceId, delegationId, options = {}) {
-    return this.requestJson(
-      "GET",
-      `/v1/workspaces/${encodeURIComponent(workspaceId)}/host-mcp-delegations/${encodeURIComponent(delegationId)}`,
-      void 0,
-      {},
-      options
-    );
-  }
-  async revokeHostMcpDelegation(workspaceId, delegationId, request, options = {}) {
-    return this.requestJson(
-      "POST",
-      `/v1/workspaces/${encodeURIComponent(workspaceId)}/host-mcp-delegations/${encodeURIComponent(delegationId)}/revoke`,
-      request,
-      {},
-      options
-    );
-  }
   async listConnectAccounts(workspaceId) {
     return this.requestJson("GET", `/v1/workspaces/${workspaceId}/connect/accounts`);
   }
@@ -250,4 +171,4 @@ var OpenGeniEmbeddingClient = class extends OpenGeniClient {
 export {
   OpenGeniEmbeddingClient
 };
-//# sourceMappingURL=chunk-VDACQXJZ.js.map
+//# sourceMappingURL=chunk-N76DIO4E.js.map

package/dist/chunk-N76DIO4E.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/embedding-client.ts"],"sourcesContent":["import { OpenGeniClient as OpenGeniArtifactClient } from \"./artifact-client\";\nimport type { OpenGeniClientOptions } from \"./client\";\nimport type { AddWorkspaceMemberRequest } from \"./types\";\nimport type {\n  ExternalIdentityLink,\n  BeginExternalIdentityLinkRequest,\n  BeginExternalIdentityLinkResponse,\n  ConfirmExternalIdentityLinkRequest,\n  ExternalIdentityLinkPreview,\n  ExternalIdentityLinkPage,\n} from \"@opengeni/contracts/external-identities\";\n\n/** Public product embedding administration, kept out of the native browser client. */\nexport class OpenGeniEmbeddingClient extends OpenGeniArtifactClient {\n  /** Recover this actor's connection creation result without resending secrets.\n   * A 404 means no visible committed result, not proof that an in-flight write failed. */\n  async getConnectionCreationResult(\n    workspaceId: string,\n    operationId: string,\n  ): Promise<import(\"./types\").ConnectionMetadata> {\n    const response = await this.requestJson<import(\"./types\").ConnectionResponse>(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/connections/operations/${encodeURIComponent(operationId)}`,\n    );\n    return response.connection;\n  }\n\n  /** Rotate existing inline credentials only while no credential-consuming work\n   * is pending or active. Reuse the operation key and exact request to reconcile\n   * a lost response. This operation never schedules or retries model work. */\n  async rotateSessionMcpCredentials(\n    workspaceId: string,\n    sessionId: string,\n    request: import(\"./types\").RotateSessionMcpCredentialsRequest,\n  ): Promise<import(\"./types\").RotateSessionMcpCredentialsReceipt> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/mcp-credentials/rotate`,\n      request,\n    );\n  }\n\n  /** Server-side organization-key client scoped to one host-authenticated user.\n   * Does not mutate this client, provision workspace membership, or link native\n   * identities. The API verifies key and membership authority on each request. */\n  asUser(externalId: string, options: { source?: string } = {}): this {\n    if (typeof window !== \"undefined\")\n      throw new Error(\"asUser is a server-side API; keep organization keys on your backend\");\n    const source = options.source ?? \"default\";\n    const validOpaqueText = (value: unknown, maxBytes: number): value is string =>\n      typeof value === \"string\" &&\n      value.length > 0 &&\n      value.length <= maxBytes &&\n      !value.includes(\"\\0\") &&\n      !/[\\uD800-\\uDFFF]/u.test(value) &&\n      new TextEncoder().encode(value).byteLength <= maxBytes;\n    if (!validOpaqueText(externalId, 1024) || !validOpaqueText(source, 200)) {\n      throw new Error(\"Invalid external identity reference\");\n    }\n    const Client = this.constructor as new (options: OpenGeniClientOptions) => this;\n    const client = new Client({ ...this.options });\n    client.externalActorHeader = encodeURIComponent(\n      JSON.stringify({ mode: \"external\", identity: { externalId, source } }),\n    );\n    return client;\n  }\n\n  /** Explicitly use a confirmed native delegation. Unlike asUser, new resources\n   * belong to the native user. Existing external resources are never reassigned.\n   * A stale, expired or revoked link is rejected by the server on every request. */\n  asLinkedUser(\n    externalId: string,\n    options: { source?: string; linkId: string; expectedLinkRevision: number },\n  ): this {\n    if (\n      !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(options.linkId) ||\n      !Number.isSafeInteger(options.expectedLinkRevision) ||\n      options.expectedLinkRevision < 1\n    )\n      throw new Error(\"A confirmed identity link and its exact revision are required\");\n    const client = this.asUser(\n      externalId,\n      options.source === undefined ? {} : { source: options.source },\n    );\n    const identity = JSON.parse(decodeURIComponent(client.externalActorHeader!)).identity;\n    client.externalActorHeader = encodeURIComponent(\n      JSON.stringify({\n        mode: \"linked_native\",\n        identity,\n        linkId: options.linkId,\n        expectedLinkRevision: options.expectedLinkRevision,\n      }),\n    );\n    return client;\n  }\n\n  /** Optional native-account delegation. Invoke on a server-side asUser client.\n   * Pass the one-time challenge to the native consent screen, never a URL query\n   * or analytics event. Ordinary external embedding needs none of this. */\n  async beginIdentityLink(\n    workspaceId: string,\n    input: BeginExternalIdentityLinkRequest,\n  ): Promise<BeginExternalIdentityLinkResponse> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links`,\n      input,\n    );\n  }\n\n  async getIdentityLink(workspaceId: string, linkId: string): Promise<ExternalIdentityLink> {\n    return this.requestJson(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}`,\n    );\n  }\n\n  /** Only links belonging to the effective participant; no organization-wide directory. */\n  async listIdentityLinks(workspaceId: string, cursor?: string): Promise<ExternalIdentityLinkPage> {\n    return this.requestJson(\n      \"GET\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links${cursor ? `?cursor=${encodeURIComponent(cursor)}` : \"\"}`,\n    );\n  }\n\n  /** Requires a canonical native browser session, not an organization API key. */\n  async previewIdentityLink(\n    workspaceId: string,\n    linkId: string,\n    challenge: string,\n  ): Promise<ExternalIdentityLinkPreview> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/preview`,\n      { challenge },\n    );\n  }\n\n  async confirmIdentityLink(\n    workspaceId: string,\n    linkId: string,\n    input: ConfirmExternalIdentityLinkRequest,\n  ): Promise<ExternalIdentityLink> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/confirm`,\n      input,\n    );\n  }\n\n  async revokeIdentityLink(\n    workspaceId: string,\n    linkId: string,\n    expectedRevision: number,\n  ): Promise<ExternalIdentityLink> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${encodeURIComponent(workspaceId)}/identity-links/${encodeURIComponent(linkId)}/revoke`,\n      { expectedRevision },\n    );\n  }\n\n  /** Service-only lifecycle for an external actor's organization membership.\n   * A successful reactivation does not restore revoked workspace grants. */\n  async updateExternalIdentityMembership(\n    organizationId: string,\n    membershipId: string,\n    request: import(\"@opengeni/contracts/external-identities\").UpdateExternalIdentityMembershipRequest,\n    options: { signal?: AbortSignal } = {},\n  ): Promise<import(\"@opengeni/contracts\").OrganizationMember> {\n    return this.requestJson(\n      \"PATCH\",\n      `/v1/organizations/${encodeURIComponent(organizationId)}/external-members/${encodeURIComponent(membershipId)}`,\n      request,\n      undefined,\n      options,\n    );\n  }\n\n  /** Non-provisioning, content-free service lookup, including inactive identities. */\n  async lookupExternalIdentity(\n    organizationId: string,\n    identity: import(\"@opengeni/contracts/external-identities\").ExternalIdentityReference,\n  ): Promise<import(\"@opengeni/contracts/external-identities\").ExternalIdentityLookup> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/organizations/${encodeURIComponent(organizationId)}/external-identities/lookup`,\n      identity,\n    );\n  }\n\n  /** Withdraw an external member's shared-workspace access and fence an exact\n   * pending keyed grant. Reuse the exact cancellation body after response loss. */\n  async cancelExternalWorkspaceMemberGrant(\n    organizationId: string,\n    workspaceId: string,\n    membershipId: string,\n    request: import(\"@opengeni/contracts/external-identities\").CancelExternalWorkspaceMemberGrantRequest,\n  ): Promise<\n    import(\"@opengeni/contracts/external-identities\").CancelExternalWorkspaceMemberGrantResponse\n  > {\n    return this.requestJson(\n      \"POST\",\n      `/v1/organizations/${encodeURIComponent(organizationId)}/workspaces/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(membershipId)}/revoke`,\n      request,\n    );\n  }\n\n  async listConnectProviders(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectProvider[]> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/connect/catalog`);\n  }\n\n  async listConnectAccounts(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAccount[]> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/connect/accounts`);\n  }\n\n  async getConnectAttempt(\n    workspaceId: string,\n    attemptId: string,\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAttempt> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}`);\n  }\n\n  async listPendingConnectAttempts(\n    workspaceId: string,\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAttempt[]> {\n    return this.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/connect/attempts`);\n  }\n\n  async advanceConnectAttempt(\n    workspaceId: string,\n    attemptId: string,\n    request: {\n      expectedRevision: number;\n      idempotencyKey: string;\n      action: import(\"@opengeni/contracts/connect\").ConnectAdvance;\n    },\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAttempt> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}/advance`,\n      request,\n    );\n  }\n\n  /** Stops setup; does not revoke already committed provider credentials. */\n  async cancelConnectAttempt(\n    workspaceId: string,\n    attemptId: string,\n    request: {\n      expectedRevision: number;\n      idempotencyKey: string;\n    },\n  ): Promise<import(\"@opengeni/contracts/connect\").ConnectAttempt> {\n    return this.requestJson(\n      \"POST\",\n      `/v1/workspaces/${workspaceId}/connect/attempts/${attemptId}/cancel`,\n      request,\n    );\n  }\n\n  /** Explicit organization-service-key onboarding; asUser never grants membership. */\n  async addExternalWorkspaceMember(\n    workspaceId: string,\n    request: {\n      identity: { externalId: string; source?: string };\n      permissions: AddWorkspaceMemberRequest[\"permissions\"];\n      operationId?: string;\n    },\n  ): Promise<import(\"@opengeni/contracts/external-identities\").ExternalIdentity> {\n    return this.requestJson(\"POST\", `/v1/workspaces/${workspaceId}/external-members`, request);\n  }\n}\n"],"mappings":";;;;;AAaO,IAAM,0BAAN,cAAsC,eAAuB;AAAA;AAAA;AAAA,EAGlE,MAAM,4BACJ,aACA,aAC+C;AAC/C,UAAM,WAAW,MAAM,KAAK;AAAA,MAC1B;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,2BAA2B,mBAAmB,WAAW,CAAC;AAAA,IAC7G;AACA,WAAO,SAAS;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,4BACJ,aACA,WACA,SAC+D;AAC/D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,WAAW,aAAa,SAAS;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,YAAoB,UAA+B,CAAC,GAAS;AAClE,QAAI,OAAO,WAAW;AACpB,YAAM,IAAI,MAAM,qEAAqE;AACvF,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,kBAAkB,CAAC,OAAgB,aACvC,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,YAChB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,mBAAmB,KAAK,KAAK,KAC9B,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,cAAc;AAChD,QAAI,CAAC,gBAAgB,YAAY,IAAI,KAAK,CAAC,gBAAgB,QAAQ,GAAG,GAAG;AACvE,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AACA,UAAM,SAAS,KAAK;AACpB,UAAM,SAAS,IAAI,OAAO,EAAE,GAAG,KAAK,QAAQ,CAAC;AAC7C,WAAO,sBAAsB;AAAA,MAC3B,KAAK,UAAU,EAAE,MAAM,YAAY,UAAU,EAAE,YAAY,OAAO,EAAE,CAAC;AAAA,IACvE;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,aACE,YACA,SACM;AACN,QACE,CAAC,kEAAkE,KAAK,QAAQ,MAAM,KACtF,CAAC,OAAO,cAAc,QAAQ,oBAAoB,KAClD,QAAQ,uBAAuB;AAE/B,YAAM,IAAI,MAAM,+DAA+D;AACjF,UAAM,SAAS,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,IAC/D;AACA,UAAM,WAAW,KAAK,MAAM,mBAAmB,OAAO,mBAAoB,CAAC,EAAE;AAC7E,WAAO,sBAAsB;AAAA,MAC3B,KAAK,UAAU;AAAA,QACb,MAAM;AAAA,QACN;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,sBAAsB,QAAQ;AAAA,MAChC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBACJ,aACA,OAC4C;AAC5C,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,aAAqB,QAA+C;AACxF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,mBAAmB,mBAAmB,MAAM,CAAC;AAAA,IAChG;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,kBAAkB,aAAqB,QAAoD;AAC/F,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,kBAAkB,SAAS,WAAW,mBAAmB,MAAM,CAAC,KAAK,EAAE;AAAA,IAC1H;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,oBACJ,aACA,QACA,WACsC;AACtC,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,mBAAmB,mBAAmB,MAAM,CAAC;AAAA,MAC9F,EAAE,UAAU;AAAA,IACd;AAAA,EACF;AAAA,EAEA,MAAM,oBACJ,aACA,QACA,OAC+B;AAC/B,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,mBAAmB,mBAAmB,MAAM,CAAC;AAAA,MAC9F;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,mBACJ,aACA,QACA,kBAC+B;AAC/B,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,WAAW,CAAC,mBAAmB,mBAAmB,MAAM,CAAC;AAAA,MAC9F,EAAE,iBAAiB;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,iCACJ,gBACA,cACA,SACA,UAAoC,CAAC,GACsB;AAC3D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qBAAqB,mBAAmB,cAAc,CAAC,qBAAqB,mBAAmB,YAAY,CAAC;AAAA,MAC5G;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,uBACJ,gBACA,UACmF;AACnF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA,EAIA,MAAM,mCACJ,gBACA,aACA,cACA,SAGA;AACA,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qBAAqB,mBAAmB,cAAc,CAAC,eAAe,mBAAmB,WAAW,CAAC,YAAY,mBAAmB,YAAY,CAAC;AAAA,MACjJ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,qBACJ,aACkE;AAClE,WAAO,KAAK,YAAY,OAAO,kBAAkB,WAAW,kBAAkB;AAAA,EAChF;AAAA,EAEA,MAAM,oBACJ,aACiE;AACjE,WAAO,KAAK,YAAY,OAAO,kBAAkB,WAAW,mBAAmB;AAAA,EACjF;AAAA,EAEA,MAAM,kBACJ,aACA,WAC+D;AAC/D,WAAO,KAAK,YAAY,OAAO,kBAAkB,WAAW,qBAAqB,SAAS,EAAE;AAAA,EAC9F;AAAA,EAEA,MAAM,2BACJ,aACiE;AACjE,WAAO,KAAK,YAAY,OAAO,kBAAkB,WAAW,mBAAmB;AAAA,EACjF;AAAA,EAEA,MAAM,sBACJ,aACA,WACA,SAK+D;AAC/D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,WAAW,qBAAqB,SAAS;AAAA,MAC3D;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,qBACJ,aACA,WACA,SAI+D;AAC/D,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,WAAW,qBAAqB,SAAS;AAAA,MAC3D;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,2BACJ,aACA,SAK6E;AAC7E,WAAO,KAAK,YAAY,QAAQ,kBAAkB,WAAW,qBAAqB,OAAO;AAAA,EAC3F;AACF;","names":[]}

package/dist/{chunk-CMEU67C4.js → chunk-P7OFNKCH.js}

@@ -200,7 +200,7 @@ var KNOWN_PERMISSIONS = [
   "artifacts:read",
   "artifacts:publish"
 ];
-var OPENGENI_API_CONTRACT_REVISION = "2026-08-organization-recovery-custody-v1";
+var OPENGENI_API_CONTRACT_REVISION = "2026-09-plugins-and-skills-v1";
 var OPENGENI_API_CONTRACT_HEADER = "x-opengeni-api-contract";
 var OPENGENI_CORRELATION_HEADER = "x-opengeni-correlation-id";
 var RETAINED_OUTPUT_DEFAULT_PAGE_BYTES = 256 * 1024;
@@ -243,4 +243,4 @@ export {
   GENERATED_VIDEO_MAX_BYTES,
   KNOWN_USAGE_EVENT_TYPES
 };
-//# sourceMappingURL=chunk-CMEU67C4.js.map
+//# sourceMappingURL=chunk-P7OFNKCH.js.map