@parall/daemon 1.55.4 → 1.55.5

package/bundle/manifest.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.55.4",
-  "built_at": "2026-08-15T12:55:26.423Z",
+  "version": "1.55.5",
+  "built_at": "2026-08-19T09:00:25.731Z",
   "min_node_version": "20.0.0",
   "files": {
     "bb-browser-daemon.js": {
@@ -16,29 +16,29 @@
       "size": 18
     },
     "parall-browser-pod.js": {
-      "sha256": "6480baf1924cccec2cfe8e93fecb5251f238de2c52b2b067e29875fa2b6f7db8",
-      "size": 2948318
+      "sha256": "d8e29aebf550cf44b7c8f88b78ce87e9a65ed278e0c54226d99e84ea5646e430",
+      "size": 2957682
     },
     "parall-channel-exec.js": {
       "sha256": "7c2a6e12483a45e9eb4a42cd7d4cdd3c4fa21dd09ac1347d9a3e177b4ddee930",
       "size": 7220
     },
     "parall-claude-agent.js": {
-      "sha256": "a340c800280fd7522f1ae9b5082776b6bc23e4e2d7cbab21077e209753b015bc",
-      "size": 2823377
+      "sha256": "f0ddfbcf097f1e337c1441f92c267b054fa1742cc8712d387ba71beb5748241f",
+      "size": 2833131
     },
     "parall-codex-agent.js": {
-      "sha256": "3f9ceb215129568c250b0687739a55f8cf4643259d47654dcb2ed2288b29ad89",
-      "size": 2855324
+      "sha256": "3cabe812d9db0d281b9962e1c086b377bb1d8fbd063f962450d0b0f1b1f4c56e",
+      "size": 2865078
     },
     "parall-daemon.js": {
-      "sha256": "571b05da902ead03fb76f6b634a0850d50776bd0c8f1cbc3482c88356256865e",
-      "size": 3014129
+      "sha256": "f808002af2072ee6e148e6c66145ee593a403e195d36501f6334c7a62e99083a",
+      "size": 3024616
     },
     "parall-openclaw-agent.js": {
       "sha256": "856a1c3a9ae0ffef8efe2481fa1171dbeb1d67cccb88616aa9bf16da96a69355",
       "size": 9923
     }
   },
-  "signature": "NzZ4HzOlAb7a8+sumoAejzCnXub6F3oQO684Q5Mnsw+LyQs92GsrvHUy0GmcH8/Ft+ZQOiZX7BPpPnATAz/FDg=="
+  "signature": "z3Biqj/B7cQM1ouwkrPkezIlKPIoOCzqmHBhf9eXdB2nPGpZWFPumTFI0i845pHcg6MH398RHxHq9SIrHX6JCQ=="
 }

package/bundle/parall-browser-pod.js

@@ -63533,6 +63533,16 @@ function browserViewerRequestOptions(command, opts) {
   };
 }
 
+// ts/sdk/dist/attachment-endpoints.js
+function attachmentEndpoints(apiBase) {
+  return {
+    UPLOAD_PRESIGN: (orgId) => `${apiBase}/orgs/${orgId}/upload/presign`,
+    UPLOAD_COMPLETE: (orgId) => `${apiBase}/orgs/${orgId}/upload/complete`,
+    UPLOAD_ABORT: (orgId) => `${apiBase}/orgs/${orgId}/upload/abort`,
+    FILE: (id) => `${apiBase}/files/${id}`
+  };
+}
+
 // ts/sdk/dist/constants.js
 var API_BASE = "/api/v1";
 var WIKI_BASE = "/wiki/v1";
@@ -63605,9 +63615,7 @@ var ENDPOINTS = {
   MESSAGE_REACTIONS: (id) => `${API_BASE}/messages/${id}/reactions`,
   MESSAGE_REACTION: (id, emoji) => `${API_BASE}/messages/${id}/reactions/${encodeURIComponent(emoji)}`,
   // Upload (org-scoped)
-  UPLOAD_PRESIGN: (orgId) => `${API_BASE}/orgs/${orgId}/upload/presign`,
-  UPLOAD_COMPLETE: (orgId) => `${API_BASE}/orgs/${orgId}/upload/complete`,
-  FILE: (id) => `${API_BASE}/files/${id}`,
+  ...attachmentEndpoints(API_BASE),
   // Approval requests (org-scoped)
   APPROVAL_REQUESTS: (orgId) => `${API_BASE}/orgs/${orgId}/approval-requests`,
   // Approvals (global)
@@ -63788,6 +63796,8 @@ var ENDPOINTS = {
   // backend router so `deleted` isn't captured as a {wikiId}; the SDK builder
   // is just a string.
   WIKIS_DELETED: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wikis/deleted`,
+  // Org-wide changeset listing across readable wikis (Working on tab).
+  WIKI_ORG_CHANGESETS: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wiki-changesets`,
   // Detail URL — also reused for DELETE (soft-delete) and `${WIKI}/restore`.
   WIKI: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}`,
   WIKI_RESTORE: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restore`,
@@ -63817,6 +63827,10 @@ var ENDPOINTS = {
   // Wiki Path Restrictions (AFCS narrowing ACL — private subtrees)
   WIKI_RESTRICTIONS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restrictions`,
   WIKI_RESTRICTION: (orgId, wikiId, restrictionId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restrictions/${restrictionId}`,
+  WIKI_ACCESS_POLICY: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-policy`,
+  WIKI_ACCESS_POLICY_MEMBERS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-policy/members`,
+  WIKI_MEMBERSHIP_SELF: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/membership/self`,
+  WIKI_MEMBERS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/members`,
   WIKI_ACCESS_STATUS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-status`,
   WIKI_ACCESS_REQUESTS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-requests`,
   // Wiki History (commits, file commits, blame)
@@ -63937,6 +63951,19 @@ var ENDPOINTS = {
   ORG_EDGE_DEVICE_UNREGISTER: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/unregister`,
   ORG_EDGE_ONBOARDING: (orgId) => `/api/v1/orgs/${orgId}/edge/onboarding`,
   ORG_EDGE_PROFILES: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles`,
+  ORG_EDGE_PROFILE_OPERATIONS: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations`,
+  ORG_EDGE_PROFILE_OPERATION: (orgId, edgeId, operationId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations/${operationId}`,
+  ORG_EDGE_PROFILE_OPERATION_CONFIRM: (orgId, edgeId, operationId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations/${operationId}/confirm`,
+  ORG_BROWSER_ALIASES: (orgId) => `/api/v1/orgs/${orgId}/browser-aliases`,
+  ORG_BROWSER_ALIAS: (orgId, aliasId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}`,
+  ORG_BROWSER_ALIAS_READINESS_CHECKS: (orgId, aliasId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}/readiness-checks`,
+  ORG_BROWSER_ALIAS_READINESS_CHECK: (orgId, aliasId, checkId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}/readiness-checks/${checkId}`,
+  ORG_API_KEY_BROWSER_ALIAS_GRANTS: (orgId, keyId) => `/api/v1/orgs/${orgId}/api-keys/${keyId}/browser-alias-grants`,
+  ORG_API_KEY_BROWSER_ALIAS_GRANT: (orgId, keyId, aliasId) => `/api/v1/orgs/${orgId}/api-keys/${keyId}/browser-alias-grants/${aliasId}`,
+  ORG_MANAGED_ALIASES: (orgId) => `/api/v1/orgs/${orgId}/aliases`,
+  ORG_MANAGED_ALIAS: (orgId, aliasName) => `/api/v1/orgs/${orgId}/aliases/${encodeURIComponent(aliasName)}`,
+  ORG_BROWSER_ALIAS_EXECUTIONS: (orgId) => `/api/v1/orgs/${orgId}/executions`,
+  ORG_BROWSER_ALIAS_EXECUTION: (orgId, requestId) => `/api/v1/orgs/${orgId}/executions/${encodeURIComponent(requestId)}`,
   // Per-profile egress proxy (hosted Cloud Profiles; manager-only, human-only).
   ORG_EDGE_PROFILE_PROXY: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/proxy`,
   // Per-profile one-shot cookie seed (hosted Cloud Profiles; manager-only,
@@ -64196,8 +64223,44 @@ var WechatClient = class extends TaskLabelClient {
   }
 };
 
+// ts/sdk/dist/attachment-client.js
+var COMPLETION_RETRY_DELAYS_MS = [250, 750];
+function isRetryableCompletionError(error2) {
+  if (!error2 || typeof error2 !== "object" || !("status" in error2))
+    return false;
+  const status = error2.status;
+  return status === 0 || typeof status === "number" && status >= 500;
+}
+var AttachmentClient = class extends WechatClient {
+  async getUploadPresignUrl(orgId, req) {
+    return this.request("POST", ENDPOINTS.UPLOAD_PRESIGN(orgId), req);
+  }
+  async completeUpload(orgId, attachmentId, parts) {
+    const body = {
+      attachment_id: attachmentId,
+      parts
+    };
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        return await this.request("POST", ENDPOINTS.UPLOAD_COMPLETE(orgId), body);
+      } catch (error2) {
+        const delay = COMPLETION_RETRY_DELAYS_MS[attempt];
+        if (delay === void 0 || !isRetryableCompletionError(error2))
+          throw error2;
+        await new Promise((resolve2) => setTimeout(resolve2, delay));
+      }
+    }
+  }
+  async abortUpload(orgId, attachmentId) {
+    return this.request("POST", ENDPOINTS.UPLOAD_ABORT(orgId), { attachment_id: attachmentId });
+  }
+  async getFileUrl(id, opts) {
+    return this.request("GET", ENDPOINTS.FILE(id), void 0, opts?.download ? { download: true } : void 0);
+  }
+};
+
 // ts/sdk/dist/client.js
-var ParallClient = class _ParallClient extends WechatClient {
+var ParallClient = class _ParallClient extends AttachmentClient {
   baseUrl;
   wikiBaseUrl;
   token;
@@ -64844,16 +64907,6 @@ var ParallClient = class _ParallClient extends WechatClient {
     const res = await this.request("GET", ENDPOINTS.MESSAGE_REACTIONS(messageId));
     return res.reactions;
   }
-  // ---- File Upload ----
-  async getUploadPresignUrl(orgId, req) {
-    return this.request("POST", ENDPOINTS.UPLOAD_PRESIGN(orgId), req);
-  }
-  async completeUpload(orgId, attachmentId) {
-    return this.request("POST", ENDPOINTS.UPLOAD_COMPLETE(orgId), { attachment_id: attachmentId });
-  }
-  async getFileUrl(id, opts) {
-    return this.request("GET", ENDPOINTS.FILE(id), void 0, opts?.download ? { download: true } : void 0);
-  }
   // ---- Approvals ----
   async getApproval(id) {
     return this.request("GET", ENDPOINTS.APPROVAL(id));
@@ -64861,8 +64914,14 @@ var ParallClient = class _ParallClient extends WechatClient {
   async requestApproval(orgId, req) {
     return this.request("POST", ENDPOINTS.APPROVAL_REQUESTS(orgId), req);
   }
-  async decideApproval(id, decision) {
-    return this.request("POST", ENDPOINTS.APPROVAL_DECIDE(id), { decision });
+  async decideApproval(id, decision, reason) {
+    if (decision === "approve" && reason?.trim()) {
+      throw new ApiError(400, "Approval reason is only allowed for rejection decisions", "INVALID_DECISION_REASON");
+    }
+    return this.request("POST", ENDPOINTS.APPROVAL_DECIDE(id), {
+      decision,
+      ...decision === "reject" && reason !== void 0 ? { reason } : {}
+    });
   }
   async cancelApproval(id) {
     return this.request("POST", ENDPOINTS.APPROVAL_CANCEL(id));
@@ -65695,6 +65754,17 @@ var ParallClient = class _ParallClient extends WechatClient {
     const res = await this.request("GET", ENDPOINTS.WIKI_CHANGESETS(orgId, wikiId));
     return res.data.map(normalizeWikiChangeset);
   }
+  /** Org-wide changeset listing across every wiki the caller can read.
+   *  Server default (no `status`) is the pending set: proposed,
+   *  approval_pending, approved. */
+  async getOrgWikiChangesets(orgId, opts) {
+    const params = new URLSearchParams();
+    for (const s of opts?.status ?? [])
+      params.append("status", s);
+    const qs = params.toString();
+    const res = await this.request("GET", `${ENDPOINTS.WIKI_ORG_CHANGESETS(orgId)}${qs ? `?${qs}` : ""}`);
+    return (res.data ?? []).map(normalizeWikiChangeset);
+  }
   async getWikiChangeset(orgId, wikiId, changesetId) {
     return normalizeWikiChangeset(await this.request("GET", ENDPOINTS.WIKI_CHANGESET(orgId, wikiId, changesetId)));
   }
@@ -65783,6 +65853,35 @@ var ParallClient = class _ParallClient extends WechatClient {
   async getWikiAccessStatus(orgId, wikiId, path7) {
     return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path7 ? { path: path7 } : void 0);
   }
+  // ---- Wiki membership projection (who-can-access, invites, join/leave) ----
+  async getWikiAccessPolicy(orgId, wikiId, path7 = "") {
+    return this.request("GET", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), void 0, path7 ? { path: path7 } : void 0);
+  }
+  async putWikiAccessPolicy(orgId, wikiId, policy) {
+    return this.request("PUT", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), policy);
+  }
+  /** Add-only invite (viewer/editor); allowed for managers, and for editors
+   *  when the library enables editors_can_invite. */
+  async addWikiMember(orgId, wikiId, subject, role) {
+    await this.request("POST", ENDPOINTS.WIKI_ACCESS_POLICY_MEMBERS(orgId, wikiId), {
+      subject,
+      role
+    });
+  }
+  /** Join a PUBLIC library as an explicit member (lands at the library's
+   *  default role). Restricted libraries answer 409 JOIN_REQUIRES_REQUEST —
+   *  go through createWikiAccessRequest instead. */
+  async joinWiki(orgId, wikiId) {
+    await this.request("POST", ENDPOINTS.WIKI_MEMBERSHIP_SELF(orgId, wikiId));
+  }
+  /** Remove the caller's explicit membership (team-granted membership stays). */
+  async leaveWiki(orgId, wikiId) {
+    await this.request("DELETE", ENDPOINTS.WIKI_MEMBERSHIP_SELF(orgId, wikiId));
+  }
+  async getWikiMembers(orgId, wikiId) {
+    const res = await this.request("GET", ENDPOINTS.WIKI_MEMBERS(orgId, wikiId));
+    return res.data ?? [];
+  }
   async createWikiAccessRequest(orgId, wikiId, data2) {
     await this.request("POST", ENDPOINTS.WIKI_ACCESS_REQUESTS(orgId, wikiId), data2);
   }
@@ -66245,6 +66344,76 @@ var ParallClient = class _ParallClient extends WechatClient {
   async listEdgeProfiles(orgId, edgeId) {
     return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILES(orgId, edgeId));
   }
+  /** Start one durable Local BYOC Profile operation. Network-unknown callers
+   * must retry with the same key or recover by operation id; a different body
+   * under the same key is rejected. */
+  async createEdgeProfileOperation(orgId, edgeId, request, idempotencyKey) {
+    return this.request("POST", ENDPOINTS.ORG_EDGE_PROFILE_OPERATIONS(orgId, edgeId), request, void 0, false, { headers: { "Idempotency-Key": idempotencyKey } });
+  }
+  /** Strong-confirm the exact durable Delete impact. A changed impact returns
+   * PROFILE_DELETE_IMPACT_CHANGED with a replacement receipt in
+   * `ApiError.extras.details.operation`. */
+  async confirmEdgeProfileOperation(orgId, edgeId, operationId, request) {
+    return this.request("POST", ENDPOINTS.ORG_EDGE_PROFILE_OPERATION_CONFIRM(orgId, edgeId, operationId), request);
+  }
+  /** Sole read/recovery surface. The server may reconcile an already durable
+   * dispatch/finalization while returning this receipt. */
+  async getEdgeProfileOperation(orgId, edgeId, operationId) {
+    return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILE_OPERATION(orgId, edgeId, operationId));
+  }
+  /** Create and atomically materialize one Local BYOC Browser Alias. A replay
+   * with the same idempotency key and body returns the original stable ccn_. */
+  async createBrowserAlias(orgId, request) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIASES(orgId), request);
+  }
+  async listBrowserAliases(orgId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIASES(orgId));
+  }
+  async getBrowserAlias(orgId, aliasId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId));
+  }
+  async renameBrowserAlias(orgId, aliasId, request) {
+    return this.request("PATCH", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId), request);
+  }
+  async deleteBrowserAlias(orgId, aliasId, request) {
+    return this.request("DELETE", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId), request);
+  }
+  /** Start one durable readiness check. The key is carried as the standard
+   * Idempotency-Key header; the request body is intentionally empty. */
+  async createBrowserAliasReadinessCheck(orgId, aliasId, request) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIAS_READINESS_CHECKS(orgId, aliasId), void 0, void 0, false, { headers: { "Idempotency-Key": request.idempotency_key } });
+  }
+  /** Sole durable recovery surface for one readiness request. */
+  async getBrowserAliasReadinessCheck(orgId, aliasId, checkId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS_READINESS_CHECK(orgId, aliasId, checkId));
+  }
+  /** Organization Owner view. Hashes, reviewed snapshots and deltas are
+   * intentionally available only on this human-JWT management surface. */
+  async listBrowserAliasGrants(orgId, keyId) {
+    return this.request("GET", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANTS(orgId, keyId));
+  }
+  async getBrowserAliasGrant(orgId, keyId, aliasId) {
+    return this.request("GET", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANT(orgId, keyId, aliasId));
+  }
+  async replaceBrowserAliasGrant(orgId, keyId, aliasId, request) {
+    return this.request("PUT", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANT(orgId, keyId, aliasId), request);
+  }
+  /** Managed-key discovery. The response is already grant-filtered and never
+   * carries contract hashes, review snapshots, Edge IDs or Profile IDs. */
+  async listManagedBrowserAliases(orgId) {
+    return this.request("GET", ENDPOINTS.ORG_MANAGED_ALIASES(orgId));
+  }
+  async getManagedBrowserAlias(orgId, aliasName) {
+    return this.request("GET", ENDPOINTS.ORG_MANAGED_ALIAS(orgId, aliasName));
+  }
+  /** Accept and dispatch one @alias command. request_id is generated by the
+   * caller before local validation and is also the sole durable recovery key. */
+  async createBrowserAliasExecution(orgId, request) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIAS_EXECUTIONS(orgId), request);
+  }
+  async getBrowserAliasExecution(orgId, requestId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS_EXECUTION(orgId, requestId));
+  }
   /**
    * Read a hosted Cloud Profile's egress-proxy status (manager-only: hosted
    * human maintainer or org admin). Sanitized — the password never comes back.

package/bundle/parall-claude-agent.js

@@ -51481,6 +51481,12 @@ function isForwardedMessageBody(body) {
 function sanitizeMeta(value) {
   return value.replace(/[\r\n]+/g, " ").replace(/[[\]|]/g, " ").trim();
 }
+function formatApprovalDecisionReason(status, reason) {
+  const normalized = reason?.trim();
+  if (status !== "rejected" || !normalized)
+    return "";
+  return `Reason (JSON): ${JSON.stringify(normalized)}`;
+}
 function buildEventBody(event) {
   const lines = [];
   if (event.type === "message") {
@@ -51701,6 +51707,16 @@ function browserViewerRequestOptions(command, opts) {
   };
 }
 
+// ts/sdk/dist/attachment-endpoints.js
+function attachmentEndpoints(apiBase) {
+  return {
+    UPLOAD_PRESIGN: (orgId) => `${apiBase}/orgs/${orgId}/upload/presign`,
+    UPLOAD_COMPLETE: (orgId) => `${apiBase}/orgs/${orgId}/upload/complete`,
+    UPLOAD_ABORT: (orgId) => `${apiBase}/orgs/${orgId}/upload/abort`,
+    FILE: (id) => `${apiBase}/files/${id}`
+  };
+}
+
 // ts/sdk/dist/constants.js
 var API_BASE = "/api/v1";
 var WIKI_BASE = "/wiki/v1";
@@ -51773,9 +51789,7 @@ var ENDPOINTS = {
   MESSAGE_REACTIONS: (id) => `${API_BASE}/messages/${id}/reactions`,
   MESSAGE_REACTION: (id, emoji) => `${API_BASE}/messages/${id}/reactions/${encodeURIComponent(emoji)}`,
   // Upload (org-scoped)
-  UPLOAD_PRESIGN: (orgId) => `${API_BASE}/orgs/${orgId}/upload/presign`,
-  UPLOAD_COMPLETE: (orgId) => `${API_BASE}/orgs/${orgId}/upload/complete`,
-  FILE: (id) => `${API_BASE}/files/${id}`,
+  ...attachmentEndpoints(API_BASE),
   // Approval requests (org-scoped)
   APPROVAL_REQUESTS: (orgId) => `${API_BASE}/orgs/${orgId}/approval-requests`,
   // Approvals (global)
@@ -51956,6 +51970,8 @@ var ENDPOINTS = {
   // backend router so `deleted` isn't captured as a {wikiId}; the SDK builder
   // is just a string.
   WIKIS_DELETED: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wikis/deleted`,
+  // Org-wide changeset listing across readable wikis (Working on tab).
+  WIKI_ORG_CHANGESETS: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wiki-changesets`,
   // Detail URL — also reused for DELETE (soft-delete) and `${WIKI}/restore`.
   WIKI: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}`,
   WIKI_RESTORE: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restore`,
@@ -51985,6 +52001,10 @@ var ENDPOINTS = {
   // Wiki Path Restrictions (AFCS narrowing ACL — private subtrees)
   WIKI_RESTRICTIONS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restrictions`,
   WIKI_RESTRICTION: (orgId, wikiId, restrictionId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restrictions/${restrictionId}`,
+  WIKI_ACCESS_POLICY: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-policy`,
+  WIKI_ACCESS_POLICY_MEMBERS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-policy/members`,
+  WIKI_MEMBERSHIP_SELF: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/membership/self`,
+  WIKI_MEMBERS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/members`,
   WIKI_ACCESS_STATUS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-status`,
   WIKI_ACCESS_REQUESTS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-requests`,
   // Wiki History (commits, file commits, blame)
@@ -52105,6 +52125,19 @@ var ENDPOINTS = {
   ORG_EDGE_DEVICE_UNREGISTER: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/unregister`,
   ORG_EDGE_ONBOARDING: (orgId) => `/api/v1/orgs/${orgId}/edge/onboarding`,
   ORG_EDGE_PROFILES: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles`,
+  ORG_EDGE_PROFILE_OPERATIONS: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations`,
+  ORG_EDGE_PROFILE_OPERATION: (orgId, edgeId, operationId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations/${operationId}`,
+  ORG_EDGE_PROFILE_OPERATION_CONFIRM: (orgId, edgeId, operationId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations/${operationId}/confirm`,
+  ORG_BROWSER_ALIASES: (orgId) => `/api/v1/orgs/${orgId}/browser-aliases`,
+  ORG_BROWSER_ALIAS: (orgId, aliasId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}`,
+  ORG_BROWSER_ALIAS_READINESS_CHECKS: (orgId, aliasId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}/readiness-checks`,
+  ORG_BROWSER_ALIAS_READINESS_CHECK: (orgId, aliasId, checkId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}/readiness-checks/${checkId}`,
+  ORG_API_KEY_BROWSER_ALIAS_GRANTS: (orgId, keyId) => `/api/v1/orgs/${orgId}/api-keys/${keyId}/browser-alias-grants`,
+  ORG_API_KEY_BROWSER_ALIAS_GRANT: (orgId, keyId, aliasId) => `/api/v1/orgs/${orgId}/api-keys/${keyId}/browser-alias-grants/${aliasId}`,
+  ORG_MANAGED_ALIASES: (orgId) => `/api/v1/orgs/${orgId}/aliases`,
+  ORG_MANAGED_ALIAS: (orgId, aliasName) => `/api/v1/orgs/${orgId}/aliases/${encodeURIComponent(aliasName)}`,
+  ORG_BROWSER_ALIAS_EXECUTIONS: (orgId) => `/api/v1/orgs/${orgId}/executions`,
+  ORG_BROWSER_ALIAS_EXECUTION: (orgId, requestId) => `/api/v1/orgs/${orgId}/executions/${encodeURIComponent(requestId)}`,
   // Per-profile egress proxy (hosted Cloud Profiles; manager-only, human-only).
   ORG_EDGE_PROFILE_PROXY: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/proxy`,
   // Per-profile one-shot cookie seed (hosted Cloud Profiles; manager-only,
@@ -52455,8 +52488,44 @@ var WechatClient = class extends TaskLabelClient {
   }
 };
 
+// ts/sdk/dist/attachment-client.js
+var COMPLETION_RETRY_DELAYS_MS = [250, 750];
+function isRetryableCompletionError(error) {
+  if (!error || typeof error !== "object" || !("status" in error))
+    return false;
+  const status = error.status;
+  return status === 0 || typeof status === "number" && status >= 500;
+}
+var AttachmentClient = class extends WechatClient {
+  async getUploadPresignUrl(orgId, req) {
+    return this.request("POST", ENDPOINTS.UPLOAD_PRESIGN(orgId), req);
+  }
+  async completeUpload(orgId, attachmentId, parts) {
+    const body = {
+      attachment_id: attachmentId,
+      parts
+    };
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        return await this.request("POST", ENDPOINTS.UPLOAD_COMPLETE(orgId), body);
+      } catch (error) {
+        const delay = COMPLETION_RETRY_DELAYS_MS[attempt];
+        if (delay === void 0 || !isRetryableCompletionError(error))
+          throw error;
+        await new Promise((resolve3) => setTimeout(resolve3, delay));
+      }
+    }
+  }
+  async abortUpload(orgId, attachmentId) {
+    return this.request("POST", ENDPOINTS.UPLOAD_ABORT(orgId), { attachment_id: attachmentId });
+  }
+  async getFileUrl(id, opts) {
+    return this.request("GET", ENDPOINTS.FILE(id), void 0, opts?.download ? { download: true } : void 0);
+  }
+};
+
 // ts/sdk/dist/client.js
-var ParallClient = class _ParallClient extends WechatClient {
+var ParallClient = class _ParallClient extends AttachmentClient {
   baseUrl;
   wikiBaseUrl;
   token;
@@ -53103,16 +53172,6 @@ var ParallClient = class _ParallClient extends WechatClient {
     const res = await this.request("GET", ENDPOINTS.MESSAGE_REACTIONS(messageId));
     return res.reactions;
   }
-  // ---- File Upload ----
-  async getUploadPresignUrl(orgId, req) {
-    return this.request("POST", ENDPOINTS.UPLOAD_PRESIGN(orgId), req);
-  }
-  async completeUpload(orgId, attachmentId) {
-    return this.request("POST", ENDPOINTS.UPLOAD_COMPLETE(orgId), { attachment_id: attachmentId });
-  }
-  async getFileUrl(id, opts) {
-    return this.request("GET", ENDPOINTS.FILE(id), void 0, opts?.download ? { download: true } : void 0);
-  }
   // ---- Approvals ----
   async getApproval(id) {
     return this.request("GET", ENDPOINTS.APPROVAL(id));
@@ -53120,8 +53179,14 @@ var ParallClient = class _ParallClient extends WechatClient {
   async requestApproval(orgId, req) {
     return this.request("POST", ENDPOINTS.APPROVAL_REQUESTS(orgId), req);
   }
-  async decideApproval(id, decision) {
-    return this.request("POST", ENDPOINTS.APPROVAL_DECIDE(id), { decision });
+  async decideApproval(id, decision, reason) {
+    if (decision === "approve" && reason?.trim()) {
+      throw new ApiError(400, "Approval reason is only allowed for rejection decisions", "INVALID_DECISION_REASON");
+    }
+    return this.request("POST", ENDPOINTS.APPROVAL_DECIDE(id), {
+      decision,
+      ...decision === "reject" && reason !== void 0 ? { reason } : {}
+    });
   }
   async cancelApproval(id) {
     return this.request("POST", ENDPOINTS.APPROVAL_CANCEL(id));
@@ -53954,6 +54019,17 @@ var ParallClient = class _ParallClient extends WechatClient {
     const res = await this.request("GET", ENDPOINTS.WIKI_CHANGESETS(orgId, wikiId));
     return res.data.map(normalizeWikiChangeset);
   }
+  /** Org-wide changeset listing across every wiki the caller can read.
+   *  Server default (no `status`) is the pending set: proposed,
+   *  approval_pending, approved. */
+  async getOrgWikiChangesets(orgId, opts) {
+    const params = new URLSearchParams();
+    for (const s of opts?.status ?? [])
+      params.append("status", s);
+    const qs = params.toString();
+    const res = await this.request("GET", `${ENDPOINTS.WIKI_ORG_CHANGESETS(orgId)}${qs ? `?${qs}` : ""}`);
+    return (res.data ?? []).map(normalizeWikiChangeset);
+  }
   async getWikiChangeset(orgId, wikiId, changesetId) {
     return normalizeWikiChangeset(await this.request("GET", ENDPOINTS.WIKI_CHANGESET(orgId, wikiId, changesetId)));
   }
@@ -54042,6 +54118,35 @@ var ParallClient = class _ParallClient extends WechatClient {
   async getWikiAccessStatus(orgId, wikiId, path11) {
     return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path11 ? { path: path11 } : void 0);
   }
+  // ---- Wiki membership projection (who-can-access, invites, join/leave) ----
+  async getWikiAccessPolicy(orgId, wikiId, path11 = "") {
+    return this.request("GET", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), void 0, path11 ? { path: path11 } : void 0);
+  }
+  async putWikiAccessPolicy(orgId, wikiId, policy) {
+    return this.request("PUT", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), policy);
+  }
+  /** Add-only invite (viewer/editor); allowed for managers, and for editors
+   *  when the library enables editors_can_invite. */
+  async addWikiMember(orgId, wikiId, subject, role) {
+    await this.request("POST", ENDPOINTS.WIKI_ACCESS_POLICY_MEMBERS(orgId, wikiId), {
+      subject,
+      role
+    });
+  }
+  /** Join a PUBLIC library as an explicit member (lands at the library's
+   *  default role). Restricted libraries answer 409 JOIN_REQUIRES_REQUEST —
+   *  go through createWikiAccessRequest instead. */
+  async joinWiki(orgId, wikiId) {
+    await this.request("POST", ENDPOINTS.WIKI_MEMBERSHIP_SELF(orgId, wikiId));
+  }
+  /** Remove the caller's explicit membership (team-granted membership stays). */
+  async leaveWiki(orgId, wikiId) {
+    await this.request("DELETE", ENDPOINTS.WIKI_MEMBERSHIP_SELF(orgId, wikiId));
+  }
+  async getWikiMembers(orgId, wikiId) {
+    const res = await this.request("GET", ENDPOINTS.WIKI_MEMBERS(orgId, wikiId));
+    return res.data ?? [];
+  }
   async createWikiAccessRequest(orgId, wikiId, data) {
     await this.request("POST", ENDPOINTS.WIKI_ACCESS_REQUESTS(orgId, wikiId), data);
   }
@@ -54504,6 +54609,76 @@ var ParallClient = class _ParallClient extends WechatClient {
   async listEdgeProfiles(orgId, edgeId) {
     return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILES(orgId, edgeId));
   }
+  /** Start one durable Local BYOC Profile operation. Network-unknown callers
+   * must retry with the same key or recover by operation id; a different body
+   * under the same key is rejected. */
+  async createEdgeProfileOperation(orgId, edgeId, request3, idempotencyKey) {
+    return this.request("POST", ENDPOINTS.ORG_EDGE_PROFILE_OPERATIONS(orgId, edgeId), request3, void 0, false, { headers: { "Idempotency-Key": idempotencyKey } });
+  }
+  /** Strong-confirm the exact durable Delete impact. A changed impact returns
+   * PROFILE_DELETE_IMPACT_CHANGED with a replacement receipt in
+   * `ApiError.extras.details.operation`. */
+  async confirmEdgeProfileOperation(orgId, edgeId, operationId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_EDGE_PROFILE_OPERATION_CONFIRM(orgId, edgeId, operationId), request3);
+  }
+  /** Sole read/recovery surface. The server may reconcile an already durable
+   * dispatch/finalization while returning this receipt. */
+  async getEdgeProfileOperation(orgId, edgeId, operationId) {
+    return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILE_OPERATION(orgId, edgeId, operationId));
+  }
+  /** Create and atomically materialize one Local BYOC Browser Alias. A replay
+   * with the same idempotency key and body returns the original stable ccn_. */
+  async createBrowserAlias(orgId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIASES(orgId), request3);
+  }
+  async listBrowserAliases(orgId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIASES(orgId));
+  }
+  async getBrowserAlias(orgId, aliasId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId));
+  }
+  async renameBrowserAlias(orgId, aliasId, request3) {
+    return this.request("PATCH", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId), request3);
+  }
+  async deleteBrowserAlias(orgId, aliasId, request3) {
+    return this.request("DELETE", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId), request3);
+  }
+  /** Start one durable readiness check. The key is carried as the standard
+   * Idempotency-Key header; the request body is intentionally empty. */
+  async createBrowserAliasReadinessCheck(orgId, aliasId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIAS_READINESS_CHECKS(orgId, aliasId), void 0, void 0, false, { headers: { "Idempotency-Key": request3.idempotency_key } });
+  }
+  /** Sole durable recovery surface for one readiness request. */
+  async getBrowserAliasReadinessCheck(orgId, aliasId, checkId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS_READINESS_CHECK(orgId, aliasId, checkId));
+  }
+  /** Organization Owner view. Hashes, reviewed snapshots and deltas are
+   * intentionally available only on this human-JWT management surface. */
+  async listBrowserAliasGrants(orgId, keyId) {
+    return this.request("GET", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANTS(orgId, keyId));
+  }
+  async getBrowserAliasGrant(orgId, keyId, aliasId) {
+    return this.request("GET", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANT(orgId, keyId, aliasId));
+  }
+  async replaceBrowserAliasGrant(orgId, keyId, aliasId, request3) {
+    return this.request("PUT", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANT(orgId, keyId, aliasId), request3);
+  }
+  /** Managed-key discovery. The response is already grant-filtered and never
+   * carries contract hashes, review snapshots, Edge IDs or Profile IDs. */
+  async listManagedBrowserAliases(orgId) {
+    return this.request("GET", ENDPOINTS.ORG_MANAGED_ALIASES(orgId));
+  }
+  async getManagedBrowserAlias(orgId, aliasName) {
+    return this.request("GET", ENDPOINTS.ORG_MANAGED_ALIAS(orgId, aliasName));
+  }
+  /** Accept and dispatch one @alias command. request_id is generated by the
+   * caller before local validation and is also the sole durable recovery key. */
+  async createBrowserAliasExecution(orgId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIAS_EXECUTIONS(orgId), request3);
+  }
+  async getBrowserAliasExecution(orgId, requestId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS_EXECUTION(orgId, requestId));
+  }
   /**
    * Read a hosted Cloud Profile's egress-proxy status (manager-only: hosted
    * human maintainer or org admin). Sanitized — the password never comes back.
@@ -59274,7 +59449,10 @@ var ParallAgentGateway = class {
     this.opts.log?.info(`approval decided: ${approval.id} (${approval.status})`);
     const statusLabel = approval.status === "approved" ? "Approved" : "Rejected";
     const execInfo = approval.execution_status ? ` | execution: ${approval.execution_status}` : "";
-    const body = `${statusLabel}: ${approval.title}${execInfo}`;
+    const reasonLine = formatApprovalDecisionReason(approval.status, approval.decision_reason);
+    const reasonInfo = reasonLine ? `
+${reasonLine}` : "";
+    const body = `${statusLabel}: ${approval.title}${execInfo}${reasonInfo}`;
     const event = {
       type: "approval",
       targetId: chatId ?? approval.chat_id,

package/bundle/parall-codex-agent.js

@@ -51481,6 +51481,12 @@ function isForwardedMessageBody(body) {
 function sanitizeMeta(value) {
   return value.replace(/[\r\n]+/g, " ").replace(/[[\]|]/g, " ").trim();
 }
+function formatApprovalDecisionReason(status, reason) {
+  const normalized = reason?.trim();
+  if (status !== "rejected" || !normalized)
+    return "";
+  return `Reason (JSON): ${JSON.stringify(normalized)}`;
+}
 function buildEventBody(event) {
   const lines = [];
   if (event.type === "message") {
@@ -51701,6 +51707,16 @@ function browserViewerRequestOptions(command, opts) {
   };
 }
 
+// ts/sdk/dist/attachment-endpoints.js
+function attachmentEndpoints(apiBase) {
+  return {
+    UPLOAD_PRESIGN: (orgId) => `${apiBase}/orgs/${orgId}/upload/presign`,
+    UPLOAD_COMPLETE: (orgId) => `${apiBase}/orgs/${orgId}/upload/complete`,
+    UPLOAD_ABORT: (orgId) => `${apiBase}/orgs/${orgId}/upload/abort`,
+    FILE: (id) => `${apiBase}/files/${id}`
+  };
+}
+
 // ts/sdk/dist/constants.js
 var API_BASE = "/api/v1";
 var WIKI_BASE = "/wiki/v1";
@@ -51773,9 +51789,7 @@ var ENDPOINTS = {
   MESSAGE_REACTIONS: (id) => `${API_BASE}/messages/${id}/reactions`,
   MESSAGE_REACTION: (id, emoji) => `${API_BASE}/messages/${id}/reactions/${encodeURIComponent(emoji)}`,
   // Upload (org-scoped)
-  UPLOAD_PRESIGN: (orgId) => `${API_BASE}/orgs/${orgId}/upload/presign`,
-  UPLOAD_COMPLETE: (orgId) => `${API_BASE}/orgs/${orgId}/upload/complete`,
-  FILE: (id) => `${API_BASE}/files/${id}`,
+  ...attachmentEndpoints(API_BASE),
   // Approval requests (org-scoped)
   APPROVAL_REQUESTS: (orgId) => `${API_BASE}/orgs/${orgId}/approval-requests`,
   // Approvals (global)
@@ -51956,6 +51970,8 @@ var ENDPOINTS = {
   // backend router so `deleted` isn't captured as a {wikiId}; the SDK builder
   // is just a string.
   WIKIS_DELETED: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wikis/deleted`,
+  // Org-wide changeset listing across readable wikis (Working on tab).
+  WIKI_ORG_CHANGESETS: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wiki-changesets`,
   // Detail URL — also reused for DELETE (soft-delete) and `${WIKI}/restore`.
   WIKI: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}`,
   WIKI_RESTORE: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restore`,
@@ -51985,6 +52001,10 @@ var ENDPOINTS = {
   // Wiki Path Restrictions (AFCS narrowing ACL — private subtrees)
   WIKI_RESTRICTIONS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restrictions`,
   WIKI_RESTRICTION: (orgId, wikiId, restrictionId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restrictions/${restrictionId}`,
+  WIKI_ACCESS_POLICY: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-policy`,
+  WIKI_ACCESS_POLICY_MEMBERS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-policy/members`,
+  WIKI_MEMBERSHIP_SELF: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/membership/self`,
+  WIKI_MEMBERS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/members`,
   WIKI_ACCESS_STATUS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-status`,
   WIKI_ACCESS_REQUESTS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-requests`,
   // Wiki History (commits, file commits, blame)
@@ -52105,6 +52125,19 @@ var ENDPOINTS = {
   ORG_EDGE_DEVICE_UNREGISTER: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/unregister`,
   ORG_EDGE_ONBOARDING: (orgId) => `/api/v1/orgs/${orgId}/edge/onboarding`,
   ORG_EDGE_PROFILES: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles`,
+  ORG_EDGE_PROFILE_OPERATIONS: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations`,
+  ORG_EDGE_PROFILE_OPERATION: (orgId, edgeId, operationId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations/${operationId}`,
+  ORG_EDGE_PROFILE_OPERATION_CONFIRM: (orgId, edgeId, operationId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations/${operationId}/confirm`,
+  ORG_BROWSER_ALIASES: (orgId) => `/api/v1/orgs/${orgId}/browser-aliases`,
+  ORG_BROWSER_ALIAS: (orgId, aliasId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}`,
+  ORG_BROWSER_ALIAS_READINESS_CHECKS: (orgId, aliasId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}/readiness-checks`,
+  ORG_BROWSER_ALIAS_READINESS_CHECK: (orgId, aliasId, checkId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}/readiness-checks/${checkId}`,
+  ORG_API_KEY_BROWSER_ALIAS_GRANTS: (orgId, keyId) => `/api/v1/orgs/${orgId}/api-keys/${keyId}/browser-alias-grants`,
+  ORG_API_KEY_BROWSER_ALIAS_GRANT: (orgId, keyId, aliasId) => `/api/v1/orgs/${orgId}/api-keys/${keyId}/browser-alias-grants/${aliasId}`,
+  ORG_MANAGED_ALIASES: (orgId) => `/api/v1/orgs/${orgId}/aliases`,
+  ORG_MANAGED_ALIAS: (orgId, aliasName) => `/api/v1/orgs/${orgId}/aliases/${encodeURIComponent(aliasName)}`,
+  ORG_BROWSER_ALIAS_EXECUTIONS: (orgId) => `/api/v1/orgs/${orgId}/executions`,
+  ORG_BROWSER_ALIAS_EXECUTION: (orgId, requestId) => `/api/v1/orgs/${orgId}/executions/${encodeURIComponent(requestId)}`,
   // Per-profile egress proxy (hosted Cloud Profiles; manager-only, human-only).
   ORG_EDGE_PROFILE_PROXY: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/proxy`,
   // Per-profile one-shot cookie seed (hosted Cloud Profiles; manager-only,
@@ -52455,8 +52488,44 @@ var WechatClient = class extends TaskLabelClient {
   }
 };
 
+// ts/sdk/dist/attachment-client.js
+var COMPLETION_RETRY_DELAYS_MS = [250, 750];
+function isRetryableCompletionError(error) {
+  if (!error || typeof error !== "object" || !("status" in error))
+    return false;
+  const status = error.status;
+  return status === 0 || typeof status === "number" && status >= 500;
+}
+var AttachmentClient = class extends WechatClient {
+  async getUploadPresignUrl(orgId, req) {
+    return this.request("POST", ENDPOINTS.UPLOAD_PRESIGN(orgId), req);
+  }
+  async completeUpload(orgId, attachmentId, parts) {
+    const body = {
+      attachment_id: attachmentId,
+      parts
+    };
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        return await this.request("POST", ENDPOINTS.UPLOAD_COMPLETE(orgId), body);
+      } catch (error) {
+        const delay = COMPLETION_RETRY_DELAYS_MS[attempt];
+        if (delay === void 0 || !isRetryableCompletionError(error))
+          throw error;
+        await new Promise((resolve4) => setTimeout(resolve4, delay));
+      }
+    }
+  }
+  async abortUpload(orgId, attachmentId) {
+    return this.request("POST", ENDPOINTS.UPLOAD_ABORT(orgId), { attachment_id: attachmentId });
+  }
+  async getFileUrl(id, opts) {
+    return this.request("GET", ENDPOINTS.FILE(id), void 0, opts?.download ? { download: true } : void 0);
+  }
+};
+
 // ts/sdk/dist/client.js
-var ParallClient = class _ParallClient extends WechatClient {
+var ParallClient = class _ParallClient extends AttachmentClient {
   baseUrl;
   wikiBaseUrl;
   token;
@@ -53103,16 +53172,6 @@ var ParallClient = class _ParallClient extends WechatClient {
     const res = await this.request("GET", ENDPOINTS.MESSAGE_REACTIONS(messageId));
     return res.reactions;
   }
-  // ---- File Upload ----
-  async getUploadPresignUrl(orgId, req) {
-    return this.request("POST", ENDPOINTS.UPLOAD_PRESIGN(orgId), req);
-  }
-  async completeUpload(orgId, attachmentId) {
-    return this.request("POST", ENDPOINTS.UPLOAD_COMPLETE(orgId), { attachment_id: attachmentId });
-  }
-  async getFileUrl(id, opts) {
-    return this.request("GET", ENDPOINTS.FILE(id), void 0, opts?.download ? { download: true } : void 0);
-  }
   // ---- Approvals ----
   async getApproval(id) {
     return this.request("GET", ENDPOINTS.APPROVAL(id));
@@ -53120,8 +53179,14 @@ var ParallClient = class _ParallClient extends WechatClient {
   async requestApproval(orgId, req) {
     return this.request("POST", ENDPOINTS.APPROVAL_REQUESTS(orgId), req);
   }
-  async decideApproval(id, decision) {
-    return this.request("POST", ENDPOINTS.APPROVAL_DECIDE(id), { decision });
+  async decideApproval(id, decision, reason) {
+    if (decision === "approve" && reason?.trim()) {
+      throw new ApiError(400, "Approval reason is only allowed for rejection decisions", "INVALID_DECISION_REASON");
+    }
+    return this.request("POST", ENDPOINTS.APPROVAL_DECIDE(id), {
+      decision,
+      ...decision === "reject" && reason !== void 0 ? { reason } : {}
+    });
   }
   async cancelApproval(id) {
     return this.request("POST", ENDPOINTS.APPROVAL_CANCEL(id));
@@ -53954,6 +54019,17 @@ var ParallClient = class _ParallClient extends WechatClient {
     const res = await this.request("GET", ENDPOINTS.WIKI_CHANGESETS(orgId, wikiId));
     return res.data.map(normalizeWikiChangeset);
   }
+  /** Org-wide changeset listing across every wiki the caller can read.
+   *  Server default (no `status`) is the pending set: proposed,
+   *  approval_pending, approved. */
+  async getOrgWikiChangesets(orgId, opts) {
+    const params = new URLSearchParams();
+    for (const s of opts?.status ?? [])
+      params.append("status", s);
+    const qs = params.toString();
+    const res = await this.request("GET", `${ENDPOINTS.WIKI_ORG_CHANGESETS(orgId)}${qs ? `?${qs}` : ""}`);
+    return (res.data ?? []).map(normalizeWikiChangeset);
+  }
   async getWikiChangeset(orgId, wikiId, changesetId) {
     return normalizeWikiChangeset(await this.request("GET", ENDPOINTS.WIKI_CHANGESET(orgId, wikiId, changesetId)));
   }
@@ -54042,6 +54118,35 @@ var ParallClient = class _ParallClient extends WechatClient {
   async getWikiAccessStatus(orgId, wikiId, path12) {
     return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path12 ? { path: path12 } : void 0);
   }
+  // ---- Wiki membership projection (who-can-access, invites, join/leave) ----
+  async getWikiAccessPolicy(orgId, wikiId, path12 = "") {
+    return this.request("GET", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), void 0, path12 ? { path: path12 } : void 0);
+  }
+  async putWikiAccessPolicy(orgId, wikiId, policy) {
+    return this.request("PUT", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), policy);
+  }
+  /** Add-only invite (viewer/editor); allowed for managers, and for editors
+   *  when the library enables editors_can_invite. */
+  async addWikiMember(orgId, wikiId, subject, role) {
+    await this.request("POST", ENDPOINTS.WIKI_ACCESS_POLICY_MEMBERS(orgId, wikiId), {
+      subject,
+      role
+    });
+  }
+  /** Join a PUBLIC library as an explicit member (lands at the library's
+   *  default role). Restricted libraries answer 409 JOIN_REQUIRES_REQUEST —
+   *  go through createWikiAccessRequest instead. */
+  async joinWiki(orgId, wikiId) {
+    await this.request("POST", ENDPOINTS.WIKI_MEMBERSHIP_SELF(orgId, wikiId));
+  }
+  /** Remove the caller's explicit membership (team-granted membership stays). */
+  async leaveWiki(orgId, wikiId) {
+    await this.request("DELETE", ENDPOINTS.WIKI_MEMBERSHIP_SELF(orgId, wikiId));
+  }
+  async getWikiMembers(orgId, wikiId) {
+    const res = await this.request("GET", ENDPOINTS.WIKI_MEMBERS(orgId, wikiId));
+    return res.data ?? [];
+  }
   async createWikiAccessRequest(orgId, wikiId, data) {
     await this.request("POST", ENDPOINTS.WIKI_ACCESS_REQUESTS(orgId, wikiId), data);
   }
@@ -54504,6 +54609,76 @@ var ParallClient = class _ParallClient extends WechatClient {
   async listEdgeProfiles(orgId, edgeId) {
     return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILES(orgId, edgeId));
   }
+  /** Start one durable Local BYOC Profile operation. Network-unknown callers
+   * must retry with the same key or recover by operation id; a different body
+   * under the same key is rejected. */
+  async createEdgeProfileOperation(orgId, edgeId, request3, idempotencyKey) {
+    return this.request("POST", ENDPOINTS.ORG_EDGE_PROFILE_OPERATIONS(orgId, edgeId), request3, void 0, false, { headers: { "Idempotency-Key": idempotencyKey } });
+  }
+  /** Strong-confirm the exact durable Delete impact. A changed impact returns
+   * PROFILE_DELETE_IMPACT_CHANGED with a replacement receipt in
+   * `ApiError.extras.details.operation`. */
+  async confirmEdgeProfileOperation(orgId, edgeId, operationId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_EDGE_PROFILE_OPERATION_CONFIRM(orgId, edgeId, operationId), request3);
+  }
+  /** Sole read/recovery surface. The server may reconcile an already durable
+   * dispatch/finalization while returning this receipt. */
+  async getEdgeProfileOperation(orgId, edgeId, operationId) {
+    return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILE_OPERATION(orgId, edgeId, operationId));
+  }
+  /** Create and atomically materialize one Local BYOC Browser Alias. A replay
+   * with the same idempotency key and body returns the original stable ccn_. */
+  async createBrowserAlias(orgId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIASES(orgId), request3);
+  }
+  async listBrowserAliases(orgId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIASES(orgId));
+  }
+  async getBrowserAlias(orgId, aliasId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId));
+  }
+  async renameBrowserAlias(orgId, aliasId, request3) {
+    return this.request("PATCH", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId), request3);
+  }
+  async deleteBrowserAlias(orgId, aliasId, request3) {
+    return this.request("DELETE", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId), request3);
+  }
+  /** Start one durable readiness check. The key is carried as the standard
+   * Idempotency-Key header; the request body is intentionally empty. */
+  async createBrowserAliasReadinessCheck(orgId, aliasId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIAS_READINESS_CHECKS(orgId, aliasId), void 0, void 0, false, { headers: { "Idempotency-Key": request3.idempotency_key } });
+  }
+  /** Sole durable recovery surface for one readiness request. */
+  async getBrowserAliasReadinessCheck(orgId, aliasId, checkId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS_READINESS_CHECK(orgId, aliasId, checkId));
+  }
+  /** Organization Owner view. Hashes, reviewed snapshots and deltas are
+   * intentionally available only on this human-JWT management surface. */
+  async listBrowserAliasGrants(orgId, keyId) {
+    return this.request("GET", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANTS(orgId, keyId));
+  }
+  async getBrowserAliasGrant(orgId, keyId, aliasId) {
+    return this.request("GET", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANT(orgId, keyId, aliasId));
+  }
+  async replaceBrowserAliasGrant(orgId, keyId, aliasId, request3) {
+    return this.request("PUT", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANT(orgId, keyId, aliasId), request3);
+  }
+  /** Managed-key discovery. The response is already grant-filtered and never
+   * carries contract hashes, review snapshots, Edge IDs or Profile IDs. */
+  async listManagedBrowserAliases(orgId) {
+    return this.request("GET", ENDPOINTS.ORG_MANAGED_ALIASES(orgId));
+  }
+  async getManagedBrowserAlias(orgId, aliasName) {
+    return this.request("GET", ENDPOINTS.ORG_MANAGED_ALIAS(orgId, aliasName));
+  }
+  /** Accept and dispatch one @alias command. request_id is generated by the
+   * caller before local validation and is also the sole durable recovery key. */
+  async createBrowserAliasExecution(orgId, request3) {
+    return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIAS_EXECUTIONS(orgId), request3);
+  }
+  async getBrowserAliasExecution(orgId, requestId) {
+    return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS_EXECUTION(orgId, requestId));
+  }
   /**
    * Read a hosted Cloud Profile's egress-proxy status (manager-only: hosted
    * human maintainer or org admin). Sanitized — the password never comes back.
@@ -59274,7 +59449,10 @@ var ParallAgentGateway = class {
     this.opts.log?.info(`approval decided: ${approval.id} (${approval.status})`);
     const statusLabel = approval.status === "approved" ? "Approved" : "Rejected";
     const execInfo = approval.execution_status ? ` | execution: ${approval.execution_status}` : "";
-    const body = `${statusLabel}: ${approval.title}${execInfo}`;
+    const reasonLine = formatApprovalDecisionReason(approval.status, approval.decision_reason);
+    const reasonInfo = reasonLine ? `
+${reasonLine}` : "";
+    const body = `${statusLabel}: ${approval.title}${execInfo}${reasonInfo}`;
     const event = {
       type: "approval",
       targetId: chatId ?? approval.chat_id,

package/bundle/parall-daemon.js

@@ -178,11 +178,34 @@ var init_browser_viewer = __esm({
   }
 });
 
+// ts/sdk/dist/attachment-types.js
+var init_attachment_types = __esm({
+  "ts/sdk/dist/attachment-types.js"() {
+    "use strict";
+  }
+});
+
+// ts/sdk/dist/attachment-endpoints.js
+function attachmentEndpoints(apiBase) {
+  return {
+    UPLOAD_PRESIGN: (orgId) => `${apiBase}/orgs/${orgId}/upload/presign`,
+    UPLOAD_COMPLETE: (orgId) => `${apiBase}/orgs/${orgId}/upload/complete`,
+    UPLOAD_ABORT: (orgId) => `${apiBase}/orgs/${orgId}/upload/abort`,
+    FILE: (id) => `${apiBase}/files/${id}`
+  };
+}
+var init_attachment_endpoints = __esm({
+  "ts/sdk/dist/attachment-endpoints.js"() {
+    "use strict";
+  }
+});
+
 // ts/sdk/dist/constants.js
 var API_BASE, WIKI_BASE, CLIP_BASE, ENDPOINTS, WS_EVENTS;
 var init_constants = __esm({
   "ts/sdk/dist/constants.js"() {
     "use strict";
+    init_attachment_endpoints();
     API_BASE = "/api/v1";
     WIKI_BASE = "/wiki/v1";
     CLIP_BASE = "/clip/v1";
@@ -254,9 +277,7 @@ var init_constants = __esm({
       MESSAGE_REACTIONS: (id) => `${API_BASE}/messages/${id}/reactions`,
       MESSAGE_REACTION: (id, emoji) => `${API_BASE}/messages/${id}/reactions/${encodeURIComponent(emoji)}`,
       // Upload (org-scoped)
-      UPLOAD_PRESIGN: (orgId) => `${API_BASE}/orgs/${orgId}/upload/presign`,
-      UPLOAD_COMPLETE: (orgId) => `${API_BASE}/orgs/${orgId}/upload/complete`,
-      FILE: (id) => `${API_BASE}/files/${id}`,
+      ...attachmentEndpoints(API_BASE),
       // Approval requests (org-scoped)
       APPROVAL_REQUESTS: (orgId) => `${API_BASE}/orgs/${orgId}/approval-requests`,
       // Approvals (global)
@@ -437,6 +458,8 @@ var init_constants = __esm({
       // backend router so `deleted` isn't captured as a {wikiId}; the SDK builder
       // is just a string.
       WIKIS_DELETED: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wikis/deleted`,
+      // Org-wide changeset listing across readable wikis (Working on tab).
+      WIKI_ORG_CHANGESETS: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wiki-changesets`,
       // Detail URL — also reused for DELETE (soft-delete) and `${WIKI}/restore`.
       WIKI: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}`,
       WIKI_RESTORE: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restore`,
@@ -466,6 +489,10 @@ var init_constants = __esm({
       // Wiki Path Restrictions (AFCS narrowing ACL — private subtrees)
       WIKI_RESTRICTIONS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restrictions`,
       WIKI_RESTRICTION: (orgId, wikiId, restrictionId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restrictions/${restrictionId}`,
+      WIKI_ACCESS_POLICY: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-policy`,
+      WIKI_ACCESS_POLICY_MEMBERS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-policy/members`,
+      WIKI_MEMBERSHIP_SELF: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/membership/self`,
+      WIKI_MEMBERS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/members`,
       WIKI_ACCESS_STATUS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-status`,
       WIKI_ACCESS_REQUESTS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-requests`,
       // Wiki History (commits, file commits, blame)
@@ -586,6 +613,19 @@ var init_constants = __esm({
       ORG_EDGE_DEVICE_UNREGISTER: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/unregister`,
       ORG_EDGE_ONBOARDING: (orgId) => `/api/v1/orgs/${orgId}/edge/onboarding`,
       ORG_EDGE_PROFILES: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles`,
+      ORG_EDGE_PROFILE_OPERATIONS: (orgId, edgeId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations`,
+      ORG_EDGE_PROFILE_OPERATION: (orgId, edgeId, operationId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations/${operationId}`,
+      ORG_EDGE_PROFILE_OPERATION_CONFIRM: (orgId, edgeId, operationId) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations/${operationId}/confirm`,
+      ORG_BROWSER_ALIASES: (orgId) => `/api/v1/orgs/${orgId}/browser-aliases`,
+      ORG_BROWSER_ALIAS: (orgId, aliasId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}`,
+      ORG_BROWSER_ALIAS_READINESS_CHECKS: (orgId, aliasId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}/readiness-checks`,
+      ORG_BROWSER_ALIAS_READINESS_CHECK: (orgId, aliasId, checkId) => `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}/readiness-checks/${checkId}`,
+      ORG_API_KEY_BROWSER_ALIAS_GRANTS: (orgId, keyId) => `/api/v1/orgs/${orgId}/api-keys/${keyId}/browser-alias-grants`,
+      ORG_API_KEY_BROWSER_ALIAS_GRANT: (orgId, keyId, aliasId) => `/api/v1/orgs/${orgId}/api-keys/${keyId}/browser-alias-grants/${aliasId}`,
+      ORG_MANAGED_ALIASES: (orgId) => `/api/v1/orgs/${orgId}/aliases`,
+      ORG_MANAGED_ALIAS: (orgId, aliasName) => `/api/v1/orgs/${orgId}/aliases/${encodeURIComponent(aliasName)}`,
+      ORG_BROWSER_ALIAS_EXECUTIONS: (orgId) => `/api/v1/orgs/${orgId}/executions`,
+      ORG_BROWSER_ALIAS_EXECUTION: (orgId, requestId) => `/api/v1/orgs/${orgId}/executions/${encodeURIComponent(requestId)}`,
       // Per-profile egress proxy (hosted Cloud Profiles; manager-only, human-only).
       ORG_EDGE_PROFILE_PROXY: (orgId, edgeId, profileName) => `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/proxy`,
       // Per-profile one-shot cookie seed (hosted Cloud Profiles; manager-only,
@@ -961,6 +1001,50 @@ var init_wechat_client = __esm({
   }
 });
 
+// ts/sdk/dist/attachment-client.js
+function isRetryableCompletionError(error) {
+  if (!error || typeof error !== "object" || !("status" in error))
+    return false;
+  const status = error.status;
+  return status === 0 || typeof status === "number" && status >= 500;
+}
+var COMPLETION_RETRY_DELAYS_MS, AttachmentClient;
+var init_attachment_client = __esm({
+  "ts/sdk/dist/attachment-client.js"() {
+    "use strict";
+    init_constants();
+    init_wechat_client();
+    COMPLETION_RETRY_DELAYS_MS = [250, 750];
+    AttachmentClient = class extends WechatClient {
+      async getUploadPresignUrl(orgId, req) {
+        return this.request("POST", ENDPOINTS.UPLOAD_PRESIGN(orgId), req);
+      }
+      async completeUpload(orgId, attachmentId, parts) {
+        const body = {
+          attachment_id: attachmentId,
+          parts
+        };
+        for (let attempt = 0; ; attempt += 1) {
+          try {
+            return await this.request("POST", ENDPOINTS.UPLOAD_COMPLETE(orgId), body);
+          } catch (error) {
+            const delay = COMPLETION_RETRY_DELAYS_MS[attempt];
+            if (delay === void 0 || !isRetryableCompletionError(error))
+              throw error;
+            await new Promise((resolve9) => setTimeout(resolve9, delay));
+          }
+        }
+      }
+      async abortUpload(orgId, attachmentId) {
+        return this.request("POST", ENDPOINTS.UPLOAD_ABORT(orgId), { attachment_id: attachmentId });
+      }
+      async getFileUrl(id, opts) {
+        return this.request("GET", ENDPOINTS.FILE(id), void 0, opts?.download ? { download: true } : void 0);
+      }
+    };
+  }
+});
+
 // ts/sdk/dist/client.js
 function normalizeWikiChangeset(changeset) {
   return {
@@ -1005,8 +1089,8 @@ var init_client = __esm({
     "use strict";
     init_browser_viewer();
     init_constants();
-    init_wechat_client();
-    ParallClient = class _ParallClient extends WechatClient {
+    init_attachment_client();
+    ParallClient = class _ParallClient extends AttachmentClient {
       baseUrl;
       wikiBaseUrl;
       token;
@@ -1653,16 +1737,6 @@ var init_client = __esm({
         const res = await this.request("GET", ENDPOINTS.MESSAGE_REACTIONS(messageId));
         return res.reactions;
       }
-      // ---- File Upload ----
-      async getUploadPresignUrl(orgId, req) {
-        return this.request("POST", ENDPOINTS.UPLOAD_PRESIGN(orgId), req);
-      }
-      async completeUpload(orgId, attachmentId) {
-        return this.request("POST", ENDPOINTS.UPLOAD_COMPLETE(orgId), { attachment_id: attachmentId });
-      }
-      async getFileUrl(id, opts) {
-        return this.request("GET", ENDPOINTS.FILE(id), void 0, opts?.download ? { download: true } : void 0);
-      }
       // ---- Approvals ----
       async getApproval(id) {
         return this.request("GET", ENDPOINTS.APPROVAL(id));
@@ -1670,8 +1744,14 @@ var init_client = __esm({
       async requestApproval(orgId, req) {
         return this.request("POST", ENDPOINTS.APPROVAL_REQUESTS(orgId), req);
       }
-      async decideApproval(id, decision) {
-        return this.request("POST", ENDPOINTS.APPROVAL_DECIDE(id), { decision });
+      async decideApproval(id, decision, reason) {
+        if (decision === "approve" && reason?.trim()) {
+          throw new ApiError(400, "Approval reason is only allowed for rejection decisions", "INVALID_DECISION_REASON");
+        }
+        return this.request("POST", ENDPOINTS.APPROVAL_DECIDE(id), {
+          decision,
+          ...decision === "reject" && reason !== void 0 ? { reason } : {}
+        });
       }
       async cancelApproval(id) {
         return this.request("POST", ENDPOINTS.APPROVAL_CANCEL(id));
@@ -2504,6 +2584,17 @@ var init_client = __esm({
         const res = await this.request("GET", ENDPOINTS.WIKI_CHANGESETS(orgId, wikiId));
         return res.data.map(normalizeWikiChangeset);
       }
+      /** Org-wide changeset listing across every wiki the caller can read.
+       *  Server default (no `status`) is the pending set: proposed,
+       *  approval_pending, approved. */
+      async getOrgWikiChangesets(orgId, opts) {
+        const params = new URLSearchParams();
+        for (const s of opts?.status ?? [])
+          params.append("status", s);
+        const qs = params.toString();
+        const res = await this.request("GET", `${ENDPOINTS.WIKI_ORG_CHANGESETS(orgId)}${qs ? `?${qs}` : ""}`);
+        return (res.data ?? []).map(normalizeWikiChangeset);
+      }
       async getWikiChangeset(orgId, wikiId, changesetId) {
         return normalizeWikiChangeset(await this.request("GET", ENDPOINTS.WIKI_CHANGESET(orgId, wikiId, changesetId)));
       }
@@ -2592,6 +2683,35 @@ var init_client = __esm({
       async getWikiAccessStatus(orgId, wikiId, path23) {
         return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path23 ? { path: path23 } : void 0);
       }
+      // ---- Wiki membership projection (who-can-access, invites, join/leave) ----
+      async getWikiAccessPolicy(orgId, wikiId, path23 = "") {
+        return this.request("GET", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), void 0, path23 ? { path: path23 } : void 0);
+      }
+      async putWikiAccessPolicy(orgId, wikiId, policy) {
+        return this.request("PUT", ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), policy);
+      }
+      /** Add-only invite (viewer/editor); allowed for managers, and for editors
+       *  when the library enables editors_can_invite. */
+      async addWikiMember(orgId, wikiId, subject, role) {
+        await this.request("POST", ENDPOINTS.WIKI_ACCESS_POLICY_MEMBERS(orgId, wikiId), {
+          subject,
+          role
+        });
+      }
+      /** Join a PUBLIC library as an explicit member (lands at the library's
+       *  default role). Restricted libraries answer 409 JOIN_REQUIRES_REQUEST —
+       *  go through createWikiAccessRequest instead. */
+      async joinWiki(orgId, wikiId) {
+        await this.request("POST", ENDPOINTS.WIKI_MEMBERSHIP_SELF(orgId, wikiId));
+      }
+      /** Remove the caller's explicit membership (team-granted membership stays). */
+      async leaveWiki(orgId, wikiId) {
+        await this.request("DELETE", ENDPOINTS.WIKI_MEMBERSHIP_SELF(orgId, wikiId));
+      }
+      async getWikiMembers(orgId, wikiId) {
+        const res = await this.request("GET", ENDPOINTS.WIKI_MEMBERS(orgId, wikiId));
+        return res.data ?? [];
+      }
       async createWikiAccessRequest(orgId, wikiId, data) {
         await this.request("POST", ENDPOINTS.WIKI_ACCESS_REQUESTS(orgId, wikiId), data);
       }
@@ -3054,6 +3174,76 @@ var init_client = __esm({
       async listEdgeProfiles(orgId, edgeId) {
         return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILES(orgId, edgeId));
       }
+      /** Start one durable Local BYOC Profile operation. Network-unknown callers
+       * must retry with the same key or recover by operation id; a different body
+       * under the same key is rejected. */
+      async createEdgeProfileOperation(orgId, edgeId, request3, idempotencyKey) {
+        return this.request("POST", ENDPOINTS.ORG_EDGE_PROFILE_OPERATIONS(orgId, edgeId), request3, void 0, false, { headers: { "Idempotency-Key": idempotencyKey } });
+      }
+      /** Strong-confirm the exact durable Delete impact. A changed impact returns
+       * PROFILE_DELETE_IMPACT_CHANGED with a replacement receipt in
+       * `ApiError.extras.details.operation`. */
+      async confirmEdgeProfileOperation(orgId, edgeId, operationId, request3) {
+        return this.request("POST", ENDPOINTS.ORG_EDGE_PROFILE_OPERATION_CONFIRM(orgId, edgeId, operationId), request3);
+      }
+      /** Sole read/recovery surface. The server may reconcile an already durable
+       * dispatch/finalization while returning this receipt. */
+      async getEdgeProfileOperation(orgId, edgeId, operationId) {
+        return this.request("GET", ENDPOINTS.ORG_EDGE_PROFILE_OPERATION(orgId, edgeId, operationId));
+      }
+      /** Create and atomically materialize one Local BYOC Browser Alias. A replay
+       * with the same idempotency key and body returns the original stable ccn_. */
+      async createBrowserAlias(orgId, request3) {
+        return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIASES(orgId), request3);
+      }
+      async listBrowserAliases(orgId) {
+        return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIASES(orgId));
+      }
+      async getBrowserAlias(orgId, aliasId) {
+        return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId));
+      }
+      async renameBrowserAlias(orgId, aliasId, request3) {
+        return this.request("PATCH", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId), request3);
+      }
+      async deleteBrowserAlias(orgId, aliasId, request3) {
+        return this.request("DELETE", ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId), request3);
+      }
+      /** Start one durable readiness check. The key is carried as the standard
+       * Idempotency-Key header; the request body is intentionally empty. */
+      async createBrowserAliasReadinessCheck(orgId, aliasId, request3) {
+        return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIAS_READINESS_CHECKS(orgId, aliasId), void 0, void 0, false, { headers: { "Idempotency-Key": request3.idempotency_key } });
+      }
+      /** Sole durable recovery surface for one readiness request. */
+      async getBrowserAliasReadinessCheck(orgId, aliasId, checkId) {
+        return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS_READINESS_CHECK(orgId, aliasId, checkId));
+      }
+      /** Organization Owner view. Hashes, reviewed snapshots and deltas are
+       * intentionally available only on this human-JWT management surface. */
+      async listBrowserAliasGrants(orgId, keyId) {
+        return this.request("GET", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANTS(orgId, keyId));
+      }
+      async getBrowserAliasGrant(orgId, keyId, aliasId) {
+        return this.request("GET", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANT(orgId, keyId, aliasId));
+      }
+      async replaceBrowserAliasGrant(orgId, keyId, aliasId, request3) {
+        return this.request("PUT", ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANT(orgId, keyId, aliasId), request3);
+      }
+      /** Managed-key discovery. The response is already grant-filtered and never
+       * carries contract hashes, review snapshots, Edge IDs or Profile IDs. */
+      async listManagedBrowserAliases(orgId) {
+        return this.request("GET", ENDPOINTS.ORG_MANAGED_ALIASES(orgId));
+      }
+      async getManagedBrowserAlias(orgId, aliasName) {
+        return this.request("GET", ENDPOINTS.ORG_MANAGED_ALIAS(orgId, aliasName));
+      }
+      /** Accept and dispatch one @alias command. request_id is generated by the
+       * caller before local validation and is also the sole durable recovery key. */
+      async createBrowserAliasExecution(orgId, request3) {
+        return this.request("POST", ENDPOINTS.ORG_BROWSER_ALIAS_EXECUTIONS(orgId), request3);
+      }
+      async getBrowserAliasExecution(orgId, requestId) {
+        return this.request("GET", ENDPOINTS.ORG_BROWSER_ALIAS_EXECUTION(orgId, requestId));
+      }
       /**
        * Read a hosted Cloud Profile's egress-proxy status (manager-only: hosted
        * human maintainer or org admin). Sanitized — the password never comes back.
@@ -3663,6 +3853,7 @@ var init_dist = __esm({
   "ts/sdk/dist/index.js"() {
     "use strict";
     init_browser_viewer();
+    init_attachment_types();
     init_client();
     init_constants();
     init_subject();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/daemon",
-  "version": "1.55.4",
+  "version": "1.55.5",
   "description": "Parall local agent runtime — daemon supervisor + bridge runtimes, bundled as standalone JS files",
   "license": "MIT",
   "repository": {
@@ -33,11 +33,11 @@
     "@aws-sdk/client-s3": "3.984.0",
     "@pinixai/bb-browser-pro": "0.15.0",
     "ws": "^8.18.0",
-    "@parall/agent-core": "1.55.4",
-    "@parall/sdk": "1.55.4",
-    "@parall/claude-agent": "1.55.4",
-    "@parall/codex-agent": "1.55.4",
-    "@parall/openclaw-agent": "1.55.4"
+    "@parall/agent-core": "1.55.5",
+    "@parall/sdk": "1.55.5",
+    "@parall/claude-agent": "1.55.5",
+    "@parall/codex-agent": "1.55.5",
+    "@parall/openclaw-agent": "1.55.5"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",