@parall/sdk 1.54.0 → 1.55.1

package/src/client.ts

@@ -1,263 +1,263 @@
 import { type BrowserViewerRequestOptions, browserViewerRequestOptions } from './browser-viewer.js';
 import { API_BASE, ENDPOINTS, WIKI_BASE } from './constants.js';
+import { TaskLabelClient } from './task-label-client.js';
 import type {
+  AddTeamMemberRequest,
+  AgentClip,
+  AgentInstructions,
+  AgentProviderConfigRead,
+  AgentSessionDB,
+  AgentStep,
+  AgentWithRuntime,
+  AgentWorkspaceReportStatus,
+  AgentWorkspaceState,
+  ApiKey,
+  Approval,
+  AttachAgentRequest,
+  AttachedAgent,
+  AttachedAgentsResponse,
+  AuthTokens,
+  AutoReloadSettings,
+  AvatarUploadResponse,
+  BacklinksResponse,
+  BillingSummary,
+  BindAgentClipRequest,
+  BrokenRefsResponse,
+  BrowseMachineFilesystemResponse,
+  BrowserProfile,
+  BrowserProfileConsent,
+  BrowserProfileLifecycleRequest,
+  BrowserProfileListItem,
+  BrowserProfileStatus,
+  BrowserRuntimeStatus,
+  BrowserViewerCommandRequest,
+  BrowserViewerCommandResponse,
+  BulkUpdateClipMetadataRequest,
+  ChangePasswordRequest,
+  ChannelConnection,
+  ChannelConversation,
+  ChannelCredentialsInput,
+  ChannelMessage,
+  ChannelProvisioningSession,
+  Chat,
+  ChatMember,
+  ChatMemberRole,
+  CheckEmailResponse,
   ClaimDispatchRequest,
   ClaimDispatchResponse,
-  SteerDispatchRequest,
-  SteerDispatchResponse,
-  UpdateDispatchInputStateRequest,
-  UpdateDispatchInputStateResponse,
+  Clip,
+  ClipAgentExecAccess,
+  ClipAgentExecAccessUpdate,
+  ClipConnection,
+  ClipRegistryEntry,
+  Comment,
   CompleteDispatchByIDRequest,
   CompleteDispatchBySourceResult,
   CompleteDispatchLaneRequest,
   CompleteDispatchRequest,
-  CompleteDispatchSourceFormRequest,
   CompleteDispatchResult,
+  CompleteDispatchSourceFormRequest,
   CompleteDispatchSourcesRequest,
   CompleteDispatchSourcesResult,
-  AuthTokens,
-  AvatarUploadResponse,
-  RegisterRequest,
-  RegisterResponse,
-  LoginRequest,
-  ChangePasswordRequest,
-  CheckEmailResponse,
-  User,
-  Organization,
-  OrgMember,
-  OrgMemberRole,
-  MemberProfile,
-  UpdateMemberProfileRequest,
-  AgentInstructions,
-  UpdateAgentInstructionsRequest,
-  Team,
-  Chat,
-  ChatMember,
-  ChatMemberRole,
-  CreateChatRequest,
-  DiscoverableChat,
-  Message,
-  SendMessageRequest,
-  SendDirectMessageRequest,
-  DirectMessageResponse,
-  PaginatedResponse,
-  Approval,
-  CreateApprovalRequest,
-  PresignResponse,
-  PresignUploadRequest,
-  FileUrlResponse,
+  CompleteRuntimeAuthSessionRequest,
+  ComputePricing,
+  ComputePricingResponse,
+  CopyWikiFileRequest,
+  CopyWikiFileResponse,
   CreateAgentRequest,
   CreateAgentResponse,
-  AgentProviderConfigRead,
-  UpdateAgentProviderConfigRequest,
-  AgentWithRuntime,
-  ApiKey,
-  WsTicketResponse,
-  Machine,
-  MachineCapability,
-  ResizeMachineRequest,
-  MachineKey,
-  MachineRuntimeAuthState,
-  AgentWorkspaceState,
-  AgentWorkspaceReportStatus,
-  DetectedRuntime,
-  BrowseMachineFilesystemResponse,
-  FilesystemEntry,
-  DaemonAgentConfig,
-  AttachedAgent,
-  AttachAgentRequest,
-  AttachedAgentsResponse,
-  LaunchCredentialResponse,
-  Task,
-  CreateTaskRequest,
-  UpdateTaskRequest,
-  TaskRelation,
-  TaskRelationTargetType,
-  TaskWatcher,
-  RefSearchResponse,
-  ThreadWatcher,
-  CreateTaskRelationRequest,
-  TaskComment,
-  CreateTaskCommentRequest,
-  UpdateTaskCommentRequest,
-  TaskActivity,
-  Project,
-  CreateProjectRequest,
-  UpdateProjectRequest,
-  Schedule,
-  ScheduleRun,
+  CreateAgentSessionRequest,
+  CreateAgentStepRequest,
+  CreateApprovalRequest,
+  CreateBrowserProfileRequest,
+  CreateChannelConnectionInput,
+  CreateChatRequest,
+  CreateCheckoutRequest,
+  CreateCheckoutResponse,
+  CreateClipRequest,
+  CreateCommentRequest,
+  CreateExternalConnectionInput,
+  CreateExternalTriggerInput,
   CreateScheduleInput,
-  UpdateScheduleInput,
-  ScheduleFilters,
-  ScheduleRunFilters,
+  CreateSetupIntentResponse,
+  CreateTeamRequest,
+  CreateWikiAccessRequest,
+  CreateWikiChangesetRequest,
+  CreateWikiPathRestrictionRequest,
+  CreateWikiPathScopeRequest,
+  CreateWikiRequest,
+  CreditTransaction,
+  CreditTransactionAgentGroup,
+  CreditTransactionMachineGroup,
+  DaemonAgentConfig,
+  DependencyCheckResult,
+  DeployTemplateRequest,
+  DetectedRuntime,
+  DirectMessageResponse,
+  DiscoverableChat,
+  DispatchEvent,
+  DispatchExpireResult,
+  EdgeBrowserProfile,
+  EdgeClipExecResult,
+  EdgeCookieSeedStatus,
+  EdgeDevice,
+  EdgeOnboardingStatus,
+  EdgePlacement,
+  EdgeProfileProxyStatus,
+  EdgeViewerCommandRequest,
+  EdgeViewerCommandResponse,
+  ExecEdgeClipRequest,
   ExternalConnection,
-  CreateExternalConnectionInput,
-  UpdateExternalConnectionInput,
   ExternalConnectionFilters,
-  ChannelConnection,
-  ChannelConversation,
-  ChannelMessage,
-  ChannelCredentialsInput,
-  ChannelProvisioningSession,
-  CreateChannelConnectionInput,
-  InitiateChannelProvisioningInput,
-  SendChannelMessageInput,
-  SlackChannelsPage,
-  SlackHistoryPage,
-  SlackManifestLinkResult,
-  SlackMembersPage,
-  SlackReadPageQuery,
-  SlackStatusInput,
-  SlackUsersPage,
-  WechatContactsPage,
-  SentChannelMessage,
-  UpdateChannelConnectionInput,
   ExternalIngressEvent,
   ExternalIngressEventFilters,
   ExternalTrigger,
-  CreateExternalTriggerInput,
-  UpdateExternalTriggerInput,
   ExternalTriggerFilters,
   ExternalTriggerRun,
   ExternalTriggerRunFilters,
   ExternalTriggerSchema,
-  AgentSessionDB,
-  AgentStep,
-  CreateAgentSessionRequest,
-  CreateAgentStepRequest,
-  UpdateAgentSessionRequest,
+  FeatureFlagsResponse,
+  FilesystemEntry,
+  FileUrlResponse,
+  GrantBrowserProfileConsentRequest,
+  InboxItem,
+  InboxUnreadCountResponse,
+  InitiateChannelProvisioningInput,
+  InstallRegistryClipResponse,
+  InvitationPublicInfo,
+  InvokeClipRequest,
+  InvokeClipResponse,
+  JoinByLinkResponse,
+  LaunchCredentialResponse,
+  LoginRequest,
+  Machine,
+  MachineBrowserProfile,
+  MachineBrowserProfileViewerResponse,
+  MachineCapability,
+  MachineClip,
+  MachineKey,
+  MachineRuntimeAuthState,
+  MCPConfigPutRequest,
+  MCPConfigResponse,
+  MCPConnectionSummary,
+  MCPOAuthInitiateResponse,
+  MCPOfficialClipRemovalResponse,
+  MemberProfile,
+  Message,
   NewSessionResponse,
+  NotificationPreferences,
+  NotifPrefs,
+  OnboardingProgress,
+  OnlineClipInfo,
+  Organization,
   OrgInvitation,
-  InvitationPublicInfo,
   OrgInviteLink,
-  JoinByLinkResponse,
   OrgJoinRequest,
-  PlatformConfigResponse,
-  Wiki,
-  WikiBlob,
-  CopyWikiFileRequest,
-  CopyWikiFileResponse,
-  WikiChangeset,
-  WikiFileUploadResponse,
-  WikiFilePreviewUrlResponse,
-  WikiTreeResponse,
-  WikiNodeSectionArtifact,
-  WikiSearchResponse,
-  WikiPageIndex,
-  SearchParams,
-  SearchResponse,
-  WikiRefsResponse,
-  WikiRefsCheckResponse,
-  WikiAnchorStatusRequest,
-  WikiAnchorStatusResponse,
-  WikiAnchorResolveRequest,
-  WikiAnchorResolveResponse,
-  WikiDiff,
-  WikiPathScope,
-  WikiAccessStatus,
-  WikiOperation,
-  WikiOperationsResponse,
-  CreateWikiRequest,
-  CreateWikiChangesetRequest,
-  UpdateWikiChangesetRequest,
-  CreateWikiPathScopeRequest,
-  WikiPathRestriction,
-  CreateWikiPathRestrictionRequest,
-  CreateWikiAccessRequest,
-  Comment,
-  CreateCommentRequest,
-  UpdateCommentRequest,
-  WikiCommit,
-  WikiBlameEntry,
-  InboxItem,
-  InboxUnreadCountResponse,
-  DispatchEvent,
-  DispatchExpireResult,
-  ResolveRefsResponse,
-  BacklinksResponse,
+  OrgMember,
+  OrgMemberRole,
   OutboundRefsRequest,
   OutboundRefsResponse,
-  RefGraphResponse,
-  BrokenRefsResponse,
+  PaginatedResponse,
+  PlatformConfigResponse,
+  PlatformModelsResponse,
+  PresignResponse,
+  PresignUploadRequest,
+  PublishRegistryClipRequest,
   PushSubscribeRequest,
-  NotifPrefs,
-  NotificationPreferences,
-  FeatureFlagsResponse,
-  RuntimeAuthSession,
+  ReactionSummary,
+  RefGraphResponse,
+  RefSearchResponse,
+  RegisterRequest,
+  RegisterResponse,
+  ResizeMachineRequest,
+  ResolveRefsResponse,
   RuntimeAuthConnectedState,
-  StartRuntimeAuthSessionRequest,
-  CompleteRuntimeAuthSessionRequest,
-  RuntimeStatus,
+  RuntimeAuthSession,
   RuntimeAvailableTag,
-  RuntimeRelease,
-  SetRuntimeModeRequest,
-  UpdateAgentRequest,
-  TransferChatOwnershipRequest,
-  UpdateChatMemberRequest,
-  UnreadEntry,
-  ThreadUnreadEntry,
-  BillingSummary,
-  CreditTransaction,
-  CreditTransactionAgentGroup,
-  CreditTransactionMachineGroup,
-  CreateCheckoutRequest,
-  CreateCheckoutResponse,
-  CreateSetupIntentResponse,
-  AutoReloadSettings,
-  UpdateAutoReloadRequest,
-  ComputePricing,
-  ComputePricingResponse,
   RuntimeCapability,
-  PlatformModelsResponse,
-  Clip,
-  AgentClip,
-  CreateClipRequest,
-  UpdateClipRequest,
-  BulkUpdateClipMetadataRequest,
-  BindAgentClipRequest,
-  InvokeClipRequest,
-  InvokeClipResponse,
-  OnlineClipInfo,
-  ClipAgentExecAccess,
-  ClipRegistryEntry,
-  InstallRegistryClipResponse,
-  PublishRegistryClipRequest,
-  MachineClip,
-  BrowserProfile,
-  MachineBrowserProfile,
-  MachineBrowserProfileViewerResponse,
-  BrowserProfileListItem,
-  BrowserProfileStatus,
-  BrowserRuntimeStatus,
-  BrowserProfileConsent,
-  CreateBrowserProfileRequest,
-  UpdateBrowserProfileRequest,
-  BrowserProfileLifecycleRequest,
-  BrowserViewerCommandRequest,
-  BrowserViewerCommandResponse,
-  EdgeViewerCommandRequest,
-  EdgeViewerCommandResponse,
-  GrantBrowserProfileConsentRequest,
-  EdgeDevice,
-  EdgePlacement,
-  EdgeBrowserProfile,
-  EdgeProfileProxyStatus,
+  RuntimeRelease,
+  RuntimeStatus,
+  Schedule,
+  ScheduleFilters,
+  ScheduleRun,
+  ScheduleRunFilters,
+  SearchParams,
+  SearchResponse,
+  SendChannelMessageInput,
+  SendDirectMessageRequest,
+  SendMessageRequest,
+  SentChannelMessage,
+  SetEdgeCookieSeedRequest,
   SetEdgeProfileProxyRequest,
-  ClipConnection,
-  MCPConfigPutRequest,
-  MCPConfigResponse,
-  MCPConnectionSummary,
-  EdgeOnboardingStatus,
-  ExecEdgeClipRequest,
-  EdgeClipExecResult,
-  ReactionSummary,
-  ToggleReactionResponse,
-  DependencyCheckResult,
-  DeployTemplateRequest,
-  OnboardingProgress,
+  SetRuntimeModeRequest,
+  SlackChannelsPage,
+  SlackHistoryPage,
+  SlackManifestLinkResult,
+  SlackMembersPage,
+  SlackReadPageQuery,
+  SlackStatusInput,
+  SlackUsersPage,
+  StartRuntimeAuthSessionRequest,
+  SteerDispatchRequest,
+  SteerDispatchResponse,
+  Task,
+  Team,
+  TeamMember,
   Template,
   TemplateDeploymentReport,
+  TemplateDeploymentResult,
+  ThreadUnreadEntry,
+  ToggleReactionResponse,
+  TransferChatOwnershipRequest,
+  UnreadEntry,
+  UpdateAgentInstructionsRequest,
+  UpdateAgentProviderConfigRequest,
+  UpdateAgentRequest,
+  UpdateAgentSessionRequest,
+  UpdateAutoReloadRequest,
+  UpdateBrowserProfileRequest,
+  UpdateChannelConnectionInput,
+  UpdateChatMemberRequest,
+  UpdateClipRequest,
+  UpdateCommentRequest,
+  UpdateDispatchInputStateRequest,
+  UpdateDispatchInputStateResponse,
+  UpdateExternalConnectionInput,
+  UpdateExternalTriggerInput,
+  UpdateMemberProfileRequest,
   UpdateOnboardingProgressRequest,
+  UpdateScheduleInput,
+  UpdateTeamMemberRequest,
+  UpdateTeamRequest,
+  UpdateWikiChangesetRequest,
+  User,
+  WechatContactsPage,
+  WechatProfileView,
+  WechatStatusView,
+  Wiki,
+  WikiAccessStatus,
+  WikiAnchorResolveRequest,
+  WikiAnchorResolveResponse,
+  WikiAnchorStatusRequest,
+  WikiAnchorStatusResponse,
+  WikiBlameEntry,
+  WikiBlob,
+  WikiChangeset,
+  WikiCommit,
+  WikiDiff,
+  WikiFilePreviewUrlResponse,
+  WikiFileUploadResponse,
+  WikiNodeSectionArtifact,
+  WikiOperation,
+  WikiOperationsResponse,
+  WikiPageIndex,
+  WikiPathRestriction,
+  WikiPathScope,
+  WikiRefsCheckResponse,
+  WikiRefsResponse,
+  WikiSearchResponse,
+  WikiTreeResponse,
+  WsTicketResponse,
 } from './types.js';
 
 export interface ParallClientOptions {
@@ -280,7 +280,7 @@ export interface ParallClientOptions {
   getFeatureFlagOverrides?: () => string | null | undefined;
 }
 
-export class ParallClient {
+export class ParallClient extends TaskLabelClient {
   private baseUrl: string;
   private wikiBaseUrl: string;
   private token: string | null;
@@ -351,6 +351,7 @@ export class ParallClient {
   }
 
   constructor(options: ParallClientOptions = {}) {
+    super();
     this.baseUrl = options.baseUrl ?? '';
     // Defaults to baseUrl so existing single-origin consumers (web, desktop,
     // hosted agents behind one gateway) are unchanged; only split api/wiki
@@ -438,7 +439,7 @@ export class ParallClient {
     }
   }
 
-  private async request<T>(
+  protected async request<T>(
     method: string,
     path: string,
     body?: unknown,
@@ -692,7 +693,8 @@ export class ParallClient {
 
   async createOrg(data: {
     name: string;
-    invite_code: string;
+    /** Omitted when the deployment reports `cap:org-invite-code` disabled. */
+    invite_code?: string;
     avatar_url?: string;
   }): Promise<Organization> {
     return this.request('POST', ENDPOINTS.ORGS, data);
@@ -749,6 +751,61 @@ export class ParallClient {
     return res.data;
   }
 
+  async getTeam(orgId: string, teamId: string): Promise<Team> {
+    return this.request('GET', ENDPOINTS.TEAM(orgId, teamId));
+  }
+
+  /** Creating, renaming and deleting a team are org-admin actions. */
+  async createTeam(orgId: string, req: CreateTeamRequest): Promise<Team> {
+    return this.request('POST', ENDPOINTS.TEAMS(orgId), req);
+  }
+
+  /**
+   * Renames a team. Renaming is an ordinary edit: ACL rows reference teams by
+   * ID. Names are org-unique (case-insensitive); a duplicate answers 409
+   * NAME_TAKEN.
+   */
+  async updateTeam(orgId: string, teamId: string, req: UpdateTeamRequest): Promise<Team> {
+    return this.request('PATCH', ENDPOINTS.TEAM(orgId, teamId), req);
+  }
+
+  async deleteTeam(orgId: string, teamId: string): Promise<void> {
+    return this.request('DELETE', ENDPOINTS.TEAM(orgId, teamId));
+  }
+
+  /** Roster with display info; members who left the org are already excluded. */
+  async getTeamMembers(orgId: string, teamId: string): Promise<TeamMember[]> {
+    const res = await this.request<{ data: TeamMember[] }>(
+      'GET',
+      ENDPOINTS.TEAM_MEMBERS(orgId, teamId),
+    );
+    return res.data;
+  }
+
+  /**
+   * Adds an org member (human or agent) to a team. Org admins and that team's
+   * managers may add ordinary members; adding straight to `manager` is an
+   * org-admin action.
+   */
+  async addTeamMember(orgId: string, teamId: string, req: AddTeamMemberRequest): Promise<void> {
+    return this.request('POST', ENDPOINTS.TEAM_MEMBERS(orgId, teamId), req);
+  }
+
+  /** Appointing or demoting a manager is org-admin only. */
+  async updateTeamMember(
+    orgId: string,
+    teamId: string,
+    userId: string,
+    req: UpdateTeamMemberRequest,
+  ): Promise<void> {
+    return this.request('PATCH', ENDPOINTS.TEAM_MEMBER(orgId, teamId, userId), req);
+  }
+
+  /** A team manager may remove ordinary members; removing a peer manager is org-admin only. */
+  async removeTeamMember(orgId: string, teamId: string, userId: string): Promise<void> {
+    return this.request('DELETE', ENDPOINTS.TEAM_MEMBER(orgId, teamId, userId));
+  }
+
   async getOnlineMembers(orgId: string): Promise<string[]> {
     const res = await this.request<{ user_ids: string[] }>(
       'GET',
@@ -2202,226 +2259,6 @@ export class ParallClient {
     return res.json() as Promise<PlatformConfigResponse>;
   }
 
-  // ---- Tasks (org-scoped) ----
-
-  async createTask(orgId: string, data: CreateTaskRequest): Promise<Task> {
-    return this.request('POST', ENDPOINTS.TASKS(orgId), data);
-  }
-
-  async getTasks(
-    orgId: string,
-    params?: {
-      q?: string;
-      status?: string;
-      priority?: string;
-      assignee_id?: string;
-      parent_id?: string;
-      project_id?: string;
-      limit?: number;
-      cursor?: string;
-      sort?: string;
-      order?: string;
-      scope?: 'active' | 'archived' | 'all';
-    },
-  ): Promise<PaginatedResponse<Task>> {
-    return this.request('GET', ENDPOINTS.TASKS(orgId), undefined, params);
-  }
-
-  async getTask(orgId: string, taskId: string): Promise<Task> {
-    return this.request('GET', ENDPOINTS.TASK(orgId, taskId));
-  }
-
-  async updateTask(orgId: string, taskId: string, data: UpdateTaskRequest): Promise<Task> {
-    return this.request('PATCH', ENDPOINTS.TASK(orgId, taskId), data);
-  }
-
-  async deleteTask(orgId: string, taskId: string, opts?: { force?: boolean }): Promise<void> {
-    return this.request(
-      'DELETE',
-      ENDPOINTS.TASK(orgId, taskId),
-      undefined,
-      opts?.force ? { force: 'true' } : undefined,
-    );
-  }
-
-  async archiveTask(orgId: string, taskId: string): Promise<void> {
-    return this.request('POST', ENDPOINTS.TASK_ARCHIVE(orgId, taskId));
-  }
-
-  async restoreTask(orgId: string, taskId: string): Promise<void> {
-    return this.request('POST', ENDPOINTS.TASK_RESTORE(orgId, taskId));
-  }
-
-  async watchTask(orgId: string, taskId: string): Promise<void> {
-    return this.request('POST', ENDPOINTS.TASK_WATCH(orgId, taskId));
-  }
-
-  async unwatchTask(orgId: string, taskId: string): Promise<void> {
-    return this.request('DELETE', ENDPOINTS.TASK_WATCH(orgId, taskId));
-  }
-
-  async getTaskWatchers(orgId: string, taskId: string): Promise<TaskWatcher[]> {
-    const res = await this.request<{ data: TaskWatcher[] }>(
-      'GET',
-      ENDPOINTS.TASK_WATCHERS(orgId, taskId),
-    );
-    return res.data;
-  }
-
-  async subscribeTaskMember(orgId: string, taskId: string, userId: string): Promise<void> {
-    return this.request('PUT', ENDPOINTS.TASK_SUBSCRIBER(orgId, taskId, userId));
-  }
-
-  async unsubscribeTaskMember(orgId: string, taskId: string, userId: string): Promise<void> {
-    return this.request('DELETE', ENDPOINTS.TASK_SUBSCRIBER(orgId, taskId, userId));
-  }
-
-  async watchThread(threadRootId: string): Promise<void> {
-    return this.request('POST', ENDPOINTS.MESSAGE_WATCH(threadRootId));
-  }
-
-  async unwatchThread(threadRootId: string): Promise<void> {
-    return this.request('DELETE', ENDPOINTS.MESSAGE_WATCH(threadRootId));
-  }
-
-  async getThreadWatchers(threadRootId: string): Promise<ThreadWatcher[]> {
-    const res = await this.request<{ data: ThreadWatcher[] }>(
-      'GET',
-      ENDPOINTS.MESSAGE_WATCHERS(threadRootId),
-    );
-    return res.data;
-  }
-
-  async isWatchingThread(threadRootId: string): Promise<boolean> {
-    const res = await this.request<{ watching: boolean }>(
-      'GET',
-      ENDPOINTS.MESSAGE_WATCHING(threadRootId),
-    );
-    return res.watching;
-  }
-
-  async getSubtasks(orgId: string, taskId: string): Promise<Task[]> {
-    const res = await this.request<PaginatedResponse<Task>>(
-      'GET',
-      ENDPOINTS.TASK_SUBTASKS(orgId, taskId),
-    );
-    return res.data;
-  }
-
-  async createTaskRelation(
-    orgId: string,
-    taskId: string,
-    data: CreateTaskRelationRequest,
-  ): Promise<TaskRelation> {
-    return this.request('POST', ENDPOINTS.TASK_RELATIONS(orgId, taskId), data);
-  }
-
-  async getTaskRelations(orgId: string, taskId: string): Promise<TaskRelation[]> {
-    const res = await this.request<{ data: TaskRelation[] }>(
-      'GET',
-      ENDPOINTS.TASK_RELATIONS(orgId, taskId),
-    );
-    return res.data;
-  }
-
-  async listTaskRelationsByTarget(
-    orgId: string,
-    params: { target_type: TaskRelationTargetType; target_id: string },
-  ): Promise<TaskRelation[]> {
-    const query = new URLSearchParams({
-      target_type: params.target_type,
-      target_id: params.target_id,
-    });
-    const res = await this.request<{ data: TaskRelation[] }>(
-      'GET',
-      `${ENDPOINTS.TASK_RELATIONS_BY_TARGET(orgId)}?${query.toString()}`,
-    );
-    return res.data;
-  }
-
-  async deleteTaskRelation(orgId: string, taskId: string, relationId: string): Promise<void> {
-    return this.request('DELETE', ENDPOINTS.TASK_RELATION(orgId, taskId, relationId));
-  }
-
-  // ---- Task Comments ----
-
-  async getTaskComments(
-    orgId: string,
-    taskId: string,
-    params?: {
-      limit?: number;
-      cursor?: string;
-      order?: string;
-    },
-  ): Promise<PaginatedResponse<TaskComment>> {
-    return this.request('GET', ENDPOINTS.TASK_COMMENTS(orgId, taskId), undefined, params);
-  }
-
-  async getTaskComment(orgId: string, taskId: string, commentId: string): Promise<TaskComment> {
-    return this.request('GET', ENDPOINTS.TASK_COMMENT(orgId, taskId, commentId));
-  }
-
-  async createTaskComment(
-    orgId: string,
-    taskId: string,
-    data: CreateTaskCommentRequest,
-  ): Promise<TaskComment> {
-    return this.request('POST', ENDPOINTS.TASK_COMMENTS(orgId, taskId), data);
-  }
-
-  async updateTaskComment(
-    orgId: string,
-    taskId: string,
-    commentId: string,
-    data: UpdateTaskCommentRequest,
-  ): Promise<TaskComment> {
-    return this.request('PATCH', ENDPOINTS.TASK_COMMENT(orgId, taskId, commentId), data);
-  }
-
-  async deleteTaskComment(orgId: string, taskId: string, commentId: string): Promise<void> {
-    return this.request('DELETE', ENDPOINTS.TASK_COMMENT(orgId, taskId, commentId));
-  }
-
-  // ---- Task Activities ----
-
-  async getTaskActivities(
-    orgId: string,
-    taskId: string,
-    params?: {
-      limit?: number;
-      cursor?: string;
-    },
-  ): Promise<PaginatedResponse<TaskActivity>> {
-    return this.request('GET', ENDPOINTS.TASK_ACTIVITIES(orgId, taskId), undefined, params);
-  }
-
-  // ---- Projects (org-scoped) ----
-
-  async createProject(orgId: string, data: CreateProjectRequest): Promise<Project> {
-    return this.request('POST', ENDPOINTS.PROJECTS(orgId), data);
-  }
-
-  async getProjects(orgId: string): Promise<Project[]> {
-    const res = await this.request<{ data: Project[] }>('GET', ENDPOINTS.PROJECTS(orgId));
-    return res.data;
-  }
-
-  async getProject(orgId: string, projectId: string): Promise<Project> {
-    return this.request('GET', ENDPOINTS.PROJECT(orgId, projectId));
-  }
-
-  async updateProject(
-    orgId: string,
-    projectId: string,
-    data: UpdateProjectRequest,
-  ): Promise<Project> {
-    return this.request('PATCH', ENDPOINTS.PROJECT(orgId, projectId), data);
-  }
-
-  async deleteProject(orgId: string, projectId: string): Promise<void> {
-    return this.request('DELETE', ENDPOINTS.PROJECT(orgId, projectId));
-  }
-
   // ---- Schedules (org-scoped) ----
 
   async createSchedule(orgId: string, input: CreateScheduleInput): Promise<Schedule> {
@@ -2685,13 +2522,29 @@ export class ParallClient {
 
   /**
    * WeChat tier-B read verb (agent-only; internal research preview): the
-   * account's address book — friend wxids, saved group room ids, followed
-   * official accounts. Same live gate as the send verb.
+   * account's address book — friends/chatrooms enriched with display names,
+   * followed official accounts. Same live gate as the send verb.
    */
   async listWechatContacts(orgId: string): Promise<WechatContactsPage> {
     return this.request('GET', ENDPOINTS.WECHAT_CONTACTS(orgId));
   }
 
+  /**
+   * WeChat tier-B read verb (agent-only): the connected account's identity
+   * (wxid / alias / nickName / app id).
+   */
+  async wechatProfile(orgId: string): Promise<WechatProfileView> {
+    return this.request('GET', ENDPOINTS.WECHAT_PROFILE(orgId));
+  }
+
+  /**
+   * WeChat tier-B read verb (agent-only): live online probe + identity +
+   * the platform's offline record.
+   */
+  async wechatStatus(orgId: string): Promise<WechatStatusView> {
+    return this.request('GET', ENDPOINTS.WECHAT_STATUS(orgId));
+  }
+
   async listChannelConversations(
     orgId: string,
     connectionId: string,
@@ -3361,7 +3214,8 @@ export class ParallClient {
 
   // ---- Feature Flags (org-scoped, server-evaluated) ----
 
-  async getFeatureFlags(orgId: string): Promise<FeatureFlagsResponse> {
+  /** Omit orgId to resolve deployment capabilities before joining an org. */
+  async getFeatureFlags(orgId?: string): Promise<FeatureFlagsResponse> {
     return this.request('GET', ENDPOINTS.FEATURE_FLAGS(orgId));
   }
 
@@ -3392,10 +3246,67 @@ export class ParallClient {
     });
   }
 
+  /** Queue a template deployment and poll its durable deployment row. Each
+   * request is short-lived; closing the client does not cancel server work. */
+  async deployTemplateAsync(
+    orgId: string,
+    request: DeployTemplateRequest,
+    idempotencyKey: string,
+  ): Promise<TemplateDeploymentReport> {
+    const queue = () =>
+      this.request<TemplateDeploymentResult>('POST', ENDPOINTS.TEMPLATE_DEPLOYMENTS(orgId), {
+        ...request,
+        async: true,
+        idempotency_key: idempotencyKey,
+      });
+
+    let result: TemplateDeploymentResult | undefined;
+    for (let attempt = 0; attempt < 2 && result === undefined; attempt += 1) {
+      try {
+        result = await queue();
+      } catch (error) {
+        // A lost response or transient server failure is safe to retry because
+        // the key resolves to the same deployment row rather than starting a
+        // second team. A second transient failure remains outcome-unknown.
+        if (!(error instanceof ApiError) || (error.status !== 0 && error.status < 500)) throw error;
+      }
+    }
+    if (result === undefined) {
+      throw new ApiError(0, 'Template deployment request outcome is unknown', 'NETWORK_ERROR');
+    }
+
+    const deadline = Date.now() + 30 * 60 * 1000;
+    while (result.status === 'queued' || result.status === 'deploying') {
+      if (Date.now() >= deadline) {
+        throw new ApiError(0, 'Template deployment is still running', 'REQUEST_TIMEOUT');
+      }
+      await new Promise((resolve) => setTimeout(resolve, 2000));
+      try {
+        result = await this.request<TemplateDeploymentResult>(
+          'GET',
+          ENDPOINTS.TEMPLATE_DEPLOYMENT(orgId, result.deployment_id),
+        );
+      } catch (error) {
+        if (!(error instanceof ApiError) || (error.status !== 0 && error.status < 500)) throw error;
+        // A network failure or transient server error does not change the
+        // durable deployment. Keep polling instead of presenting a definite
+        // failure that could make a fresh-key retry create another team.
+      }
+    }
+    if (result.status !== 'deployed') {
+      throw new ApiError(
+        500,
+        result.error?.message ?? 'Template deployment failed',
+        result.error?.code,
+      );
+    }
+    return result;
+  }
+
   async getTemplateDeployment(
     orgId: string,
     deploymentId: string,
-  ): Promise<TemplateDeploymentReport> {
+  ): Promise<TemplateDeploymentResult> {
     return this.request('GET', ENDPOINTS.TEMPLATE_DEPLOYMENT(orgId, deploymentId));
   }
 
@@ -3718,6 +3629,15 @@ export class ParallClient {
     await this.request<void>('DELETE', ENDPOINTS.ORG_CLIP_UNINSTALL(orgId, clipId));
   }
 
+  /** Best-effort provider revoke followed by atomic local removal of an
+   * installed Official MCP Clip and all org-owned connection state. */
+  async removeOfficialMCPClip(
+    orgId: string,
+    clipId: string,
+  ): Promise<MCPOfficialClipRemovalResponse> {
+    return this.request('DELETE', ENDPOINTS.ORG_CLIP_MCP_REMOVE(orgId, clipId));
+  }
+
   /** List the org's installed registry clips (full entries). */
   async listInstalledRegistryClips(orgId: string): Promise<ClipRegistryEntry[]> {
     const resp = await this.request<ClipRegistryEntry[] | null>(
@@ -3761,7 +3681,7 @@ export class ParallClient {
   /**
    * Read a clip's per-org agent exec access. Org-member readable (agents
    * included, so a denied agent can learn why exec answered
-   * `CLIP_AGENT_NOT_ALLOWED`).
+   * `CLIP_AGENT_NOT_ALLOWED` / `CLIP_AGENT_CONNECTION_NOT_ALLOWED`).
    */
   async getClipAgentExecAccess(orgId: string, clipId: string): Promise<ClipAgentExecAccess> {
     return this.request('GET', ENDPOINTS.ORG_CLIP_EXEC_ACCESS(orgId, clipId));
@@ -3769,13 +3689,16 @@ export class ParallClient {
 
   /**
    * Replace a clip's per-org agent exec access. Human-only (agent principals
-   * get 403); under `all_agents` the `agent_ids` must be empty. Every granted
-   * id must be an active agent of this org (else `400 INVALID_INPUT`).
+   * get 403); under `all_agents` both lists must be empty; pass either
+   * `agent_ids` (legacy flat form → every agent gets `connection_scope: 'all'`)
+   * or `grants` (connection-scoped), never both. Every granted id must be an
+   * active agent of this org, and every `connection_ids` entry a connection of
+   * THIS clip in this org (else `400 INVALID_INPUT`).
    */
   async putClipAgentExecAccess(
     orgId: string,
     clipId: string,
-    access: ClipAgentExecAccess,
+    access: ClipAgentExecAccessUpdate,
   ): Promise<ClipAgentExecAccess> {
     return this.request('PUT', ENDPOINTS.ORG_CLIP_EXEC_ACCESS(orgId, clipId), access);
   }
@@ -3903,6 +3826,73 @@ export class ParallClient {
     );
   }
 
+  /**
+   * Read a hosted Cloud Profile's one-shot cookie-seed status (manager-only:
+   * hosted human maintainer or org admin). Sanitized — cookie VALUES never come
+   * back, only `cookie_count` and the distinct target `domains`. `can_mutate` /
+   * `lease_status` are the authoritative idle gate. Typed errors: `EDGE_NOT_HOSTED`
+   * (BYOC device), `NOT_FOUND` (unknown profile).
+   */
+  async getEdgeProfileCookieSeed(
+    orgId: string,
+    edgeId: string,
+    profileName: string,
+  ): Promise<EdgeCookieSeedStatus> {
+    return this.request('GET', ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName));
+  }
+
+  /**
+   * Set/replace the profile's one-shot cookie seed (the full normalized cookie
+   * array every time) — IDLE ONLY: while the profile's hosted browser is running
+   * the server answers 409 `EDGE_PROFILE_IN_USE`; close the viewer, wait for idle
+   * scale-to-zero, and retry. The next cold start injects the cookies into the
+   * profile partition and consumes the seed. Other typed errors:
+   * `EDGE_COOKIE_SEED_STALE` (409 — expectedVersion lost a tab race, sent as the
+   * `cookieseed-<version>` If-Match), `EDGE_DELETING` (409), and
+   * `SECRETBOX_UNCONFIGURED` (503 — server cannot store cookies safely).
+   */
+  async setEdgeProfileCookieSeed(
+    orgId: string,
+    edgeId: string,
+    profileName: string,
+    req: SetEdgeCookieSeedRequest,
+    expectedVersion?: string,
+  ): Promise<EdgeCookieSeedStatus> {
+    return this.request(
+      'PUT',
+      ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName),
+      req,
+      undefined,
+      false,
+      {
+        headers: expectedVersion ? { 'If-Match': `"cookieseed-${expectedVersion}"` } : undefined,
+      },
+    );
+  }
+
+  /**
+   * Clear the pending cookie seed (does NOT sign the profile out — cookies
+   * already injected into the partition stay). Idle-only like set — 409
+   * `EDGE_PROFILE_IN_USE` while the browser is live.
+   */
+  async clearEdgeProfileCookieSeed(
+    orgId: string,
+    edgeId: string,
+    profileName: string,
+    expectedVersion?: string,
+  ): Promise<EdgeCookieSeedStatus> {
+    return this.request(
+      'DELETE',
+      ENDPOINTS.ORG_EDGE_PROFILE_COOKIES(orgId, edgeId, profileName),
+      undefined,
+      undefined,
+      false,
+      {
+        headers: expectedVersion ? { 'If-Match': `"cookieseed-${expectedVersion}"` } : undefined,
+      },
+    );
+  }
+
   /**
    * Execute a registry clip command on an Edge device.
    *
@@ -3994,13 +3984,15 @@ export class ParallClient {
     return this.request('DELETE', ENDPOINTS.CLIP_CONNECTION(orgId, connId));
   }
 
-  // ---- MCP clip server config (cap:clip-mcp; publisher-org only) ----
+  // ---- MCP clip server config (same-org or reviewed Official OAuth) ----
 
   /**
-   * Read the redacted MCP config. 404 NOT_FOUND when the clip has none yet;
-   * 403 MCP_CROSS_ORG_DISABLED for a cross-org installed clip (the whole
-   * mcp-config family is publisher-org property, reads included). `version`
-   * is the CAS token the mutations echo via If-Match.
+   * Read the redacted MCP config. 404 NOT_FOUND when the clip has none yet —
+   * and also when a cross-org clip is not public + approved + installed, which
+   * reads as nonexistent rather than refused (same existence-hiding as exec).
+   * A cross-org clip that IS installed and approved reads fine regardless of
+   * auth shape; what may then be configured is decided per credential owner.
+   * `version` is the CAS token the mutations echo via If-Match.
    */
   async getClipMCPConfig(orgId: string, clipId: string): Promise<MCPConfigResponse> {
     return this.request('GET', ENDPOINTS.ORG_CLIP_MCP_CONFIG(orgId, clipId));
@@ -4059,8 +4051,11 @@ export class ParallClient {
    * List the org's MCP connections for a clip, default first — one row per
    * connection (credential slot), WITHOUT the tools snapshot (`tool_count`
    * summarizes it; the per-config GET carries the full snapshot). Same
-   * family-wide fence as the singular GET: publisher-org members only —
-   * cross-org installs get `403 MCP_CROSS_ORG_DISABLED`, and with
+   * family-wide fence as the singular GET: same-org clips, or a cross-org clip
+   * that is public + approved + installed; anything else reads as
+   * `404 NOT_FOUND`. An installed cross-org clip with no connection yet lists
+   * as an empty array — including one whose approved auth mode cannot be
+   * configured at all (auth=none), which the write path is what refuses. With
    * `cap:clip-mcp` off the route is not registered at all.
    */
   async listClipMCPConnections(
@@ -4070,6 +4065,22 @@ export class ParallClient {
     return this.request('GET', ENDPOINTS.ORG_CLIP_MCP_CONFIGS(orgId, clipId));
   }
 
+  /** Start a new Official OAuth MCP connection with the platform-owned app.
+   * Omitting oauth_client is load-bearing: the server resolves the exact
+   * reviewed-version binding and never falls back to DCR/CIMD cross-org. */
+  async createClipMCPOAuthConnection(
+    orgId: string,
+    clipId: string,
+    serverUrl: string,
+    alias?: string,
+  ): Promise<MCPOAuthInitiateResponse> {
+    return this.request('POST', ENDPOINTS.ORG_CLIP_MCP_CONFIGS(orgId, clipId), {
+      server_url: serverUrl,
+      auth_type: 'oauth',
+      ...(alias ? { alias } : {}),
+    });
+  }
+
   /**
    * Re-run tools/list and replace the cached snapshot (org-admin only).
    * Deliberately does NOT advance the CAS version, so an in-flight edit in