@parall/sdk 1.55.4 → 1.55.5

package/src/client.ts

@@ -1,6 +1,6 @@
 import { type BrowserViewerRequestOptions, browserViewerRequestOptions } from './browser-viewer.js';
 import { API_BASE, ENDPOINTS, WIKI_BASE } from './constants.js';
-import { WechatClient } from './wechat-client.js';
+import { AttachmentClient } from './attachment-client.js';
 import type {
   AddTeamMemberRequest,
   AgentClip,
@@ -30,6 +30,17 @@ import type {
   BrowserProfileLifecycleRequest,
   BrowserProfileListItem,
   BrowserProfileStatus,
+  BrowserAlias,
+  BrowserAliasCreateRequest,
+  BrowserAliasDeleteProof,
+  BrowserAliasDeleteRequest,
+  BrowserAliasRenameRequest,
+  BrowserAliasReadinessCheckReceipt,
+  BrowserAliasReadinessCheckRequest,
+  BrowserAliasExecutionRequest,
+  BrowserAliasExecutionReceipt,
+  BrowserAliasGrantReplaceRequest,
+  BrowserAliasGrantSet,
   BrowserRuntimeStatus,
   BrowserViewerCommandRequest,
   BrowserViewerCommandResponse,
@@ -63,6 +74,8 @@ import type {
   CompleteRuntimeAuthSessionRequest,
   ComputePricing,
   ComputePricingResponse,
+  ManagedBrowserAliasInfo,
+  ManagedBrowserAliasSummary,
   CopyWikiFileRequest,
   CopyWikiFileResponse,
   CreateAgentRequest,
@@ -105,6 +118,9 @@ import type {
   EdgeOnboardingStatus,
   EdgePlacement,
   EdgeProfileProxyStatus,
+  EdgeProfileOperationConfirmRequest,
+  EdgeProfileOperationReceipt,
+  EdgeProfileOperationRequest,
   EdgeViewerCommandRequest,
   EdgeViewerCommandResponse,
   ExecEdgeClipRequest,
@@ -119,7 +135,6 @@ import type {
   ExternalTriggerSchema,
   FeatureFlagsResponse,
   FilesystemEntry,
-  FileUrlResponse,
   GrantBrowserProfileConsentRequest,
   InboxItem,
   InboxUnreadCountResponse,
@@ -161,8 +176,6 @@ import type {
   PaginatedResponse,
   PlatformConfigResponse,
   PlatformModelsResponse,
-  PresignResponse,
-  PresignUploadRequest,
   PublishRegistryClipRequest,
   PushSubscribeRequest,
   ReactionSummary,
@@ -234,6 +247,8 @@ import type {
   UpdateWikiChangesetRequest,
   User,
   Wiki,
+  WikiAccessPolicy,
+  WikiAccessPolicyMember,
   WikiAccessStatus,
   WikiAnchorResolveRequest,
   WikiAnchorResolveResponse,
@@ -279,7 +294,7 @@ export interface ParallClientOptions {
   getFeatureFlagOverrides?: () => string | null | undefined;
 }
 
-export class ParallClient extends WechatClient {
+export class ParallClient extends AttachmentClient {
   private baseUrl: string;
   private wikiBaseUrl: string;
   private token: string | null;
@@ -1251,25 +1266,6 @@ export class ParallClient extends WechatClient {
     return res.reactions;
   }
 
-  // ---- File Upload ----
-
-  async getUploadPresignUrl(orgId: string, req: PresignUploadRequest): Promise<PresignResponse> {
-    return this.request('POST', ENDPOINTS.UPLOAD_PRESIGN(orgId), req);
-  }
-
-  async completeUpload(orgId: string, attachmentId: string): Promise<{ attachment_id: string }> {
-    return this.request('POST', ENDPOINTS.UPLOAD_COMPLETE(orgId), { attachment_id: attachmentId });
-  }
-
-  async getFileUrl(id: string, opts?: { download?: boolean }): Promise<FileUrlResponse> {
-    return this.request(
-      'GET',
-      ENDPOINTS.FILE(id),
-      undefined,
-      opts?.download ? { download: true } : undefined,
-    );
-  }
-
   // ---- Approvals ----
 
   async getApproval(id: string): Promise<Approval> {
@@ -1280,8 +1276,22 @@ export class ParallClient extends WechatClient {
     return this.request('POST', ENDPOINTS.APPROVAL_REQUESTS(orgId), req);
   }
 
-  async decideApproval(id: string, decision: 'approve' | 'reject'): Promise<Approval> {
-    return this.request('POST', ENDPOINTS.APPROVAL_DECIDE(id), { decision });
+  async decideApproval(
+    id: string,
+    decision: 'approve' | 'reject',
+    reason?: string,
+  ): Promise<Approval> {
+    if (decision === 'approve' && reason?.trim()) {
+      throw new ApiError(
+        400,
+        'Approval reason is only allowed for rejection decisions',
+        'INVALID_DECISION_REASON',
+      );
+    }
+    return this.request('POST', ENDPOINTS.APPROVAL_DECIDE(id), {
+      decision,
+      ...(decision === 'reject' && reason !== undefined ? { reason } : {}),
+    });
   }
 
   async cancelApproval(id: string): Promise<void> {
@@ -2691,7 +2701,7 @@ export class ParallClient extends WechatClient {
   async getWikiTree(
     orgId: string,
     wikiId: string,
-    params?: { ref?: string; path?: string },
+    params?: { ref?: string; path?: string; last_commit?: boolean },
   ): Promise<WikiTreeResponse> {
     return this.request('GET', ENDPOINTS.WIKI_TREE(orgId, wikiId), undefined, params);
   }
@@ -2834,6 +2844,23 @@ export class ParallClient extends WechatClient {
     return res.data.map(normalizeWikiChangeset);
   }
 
+  /** Org-wide changeset listing across every wiki the caller can read.
+   *  Server default (no `status`) is the pending set: proposed,
+   *  approval_pending, approved. */
+  async getOrgWikiChangesets(
+    orgId: string,
+    opts?: { status?: WikiChangeset['status'][] },
+  ): Promise<WikiChangeset[]> {
+    const params = new URLSearchParams();
+    for (const s of opts?.status ?? []) params.append('status', s);
+    const qs = params.toString();
+    const res = await this.request<{ data: WikiChangeset[] | null }>(
+      'GET',
+      `${ENDPOINTS.WIKI_ORG_CHANGESETS(orgId)}${qs ? `?${qs}` : ''}`,
+    );
+    return (res.data ?? []).map(normalizeWikiChangeset);
+  }
+
   async getWikiChangeset(
     orgId: string,
     wikiId: string,
@@ -3019,6 +3046,59 @@ export class ParallClient extends WechatClient {
     );
   }
 
+  // ---- Wiki membership projection (who-can-access, invites, join/leave) ----
+
+  async getWikiAccessPolicy(orgId: string, wikiId: string, path = ''): Promise<WikiAccessPolicy> {
+    return this.request(
+      'GET',
+      ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId),
+      undefined,
+      path ? { path } : undefined,
+    );
+  }
+
+  async putWikiAccessPolicy(
+    orgId: string,
+    wikiId: string,
+    policy: WikiAccessPolicy,
+  ): Promise<WikiAccessPolicy> {
+    return this.request('PUT', ENDPOINTS.WIKI_ACCESS_POLICY(orgId, wikiId), policy);
+  }
+
+  /** Add-only invite (viewer/editor); allowed for managers, and for editors
+   *  when the library enables editors_can_invite. */
+  async addWikiMember(
+    orgId: string,
+    wikiId: string,
+    subject: string,
+    role?: 'viewer' | 'editor',
+  ): Promise<void> {
+    await this.request('POST', ENDPOINTS.WIKI_ACCESS_POLICY_MEMBERS(orgId, wikiId), {
+      subject,
+      role,
+    });
+  }
+
+  /** Join a PUBLIC library as an explicit member (lands at the library's
+   *  default role). Restricted libraries answer 409 JOIN_REQUIRES_REQUEST —
+   *  go through createWikiAccessRequest instead. */
+  async joinWiki(orgId: string, wikiId: string): Promise<void> {
+    await this.request('POST', ENDPOINTS.WIKI_MEMBERSHIP_SELF(orgId, wikiId));
+  }
+
+  /** Remove the caller's explicit membership (team-granted membership stays). */
+  async leaveWiki(orgId: string, wikiId: string): Promise<void> {
+    await this.request('DELETE', ENDPOINTS.WIKI_MEMBERSHIP_SELF(orgId, wikiId));
+  }
+
+  async getWikiMembers(orgId: string, wikiId: string): Promise<WikiAccessPolicyMember[]> {
+    const res = await this.request<{ data: WikiAccessPolicyMember[] | null }>(
+      'GET',
+      ENDPOINTS.WIKI_MEMBERS(orgId, wikiId),
+    );
+    return res.data ?? [];
+  }
+
   async createWikiAccessRequest(
     orgId: string,
     wikiId: string,
@@ -3750,6 +3830,166 @@ export class ParallClient extends WechatClient {
     return this.request('GET', ENDPOINTS.ORG_EDGE_PROFILES(orgId, edgeId));
   }
 
+  /** Start one durable Local BYOC Profile operation. Network-unknown callers
+   * must retry with the same key or recover by operation id; a different body
+   * under the same key is rejected. */
+  async createEdgeProfileOperation(
+    orgId: string,
+    edgeId: string,
+    request: EdgeProfileOperationRequest,
+    idempotencyKey: string,
+  ): Promise<EdgeProfileOperationReceipt> {
+    return this.request(
+      'POST',
+      ENDPOINTS.ORG_EDGE_PROFILE_OPERATIONS(orgId, edgeId),
+      request,
+      undefined,
+      false,
+      { headers: { 'Idempotency-Key': idempotencyKey } },
+    );
+  }
+
+  /** Strong-confirm the exact durable Delete impact. A changed impact returns
+   * PROFILE_DELETE_IMPACT_CHANGED with a replacement receipt in
+   * `ApiError.extras.details.operation`. */
+  async confirmEdgeProfileOperation(
+    orgId: string,
+    edgeId: string,
+    operationId: string,
+    request: EdgeProfileOperationConfirmRequest,
+  ): Promise<EdgeProfileOperationReceipt> {
+    return this.request(
+      'POST',
+      ENDPOINTS.ORG_EDGE_PROFILE_OPERATION_CONFIRM(orgId, edgeId, operationId),
+      request,
+    );
+  }
+
+  /** Sole read/recovery surface. The server may reconcile an already durable
+   * dispatch/finalization while returning this receipt. */
+  async getEdgeProfileOperation(
+    orgId: string,
+    edgeId: string,
+    operationId: string,
+  ): Promise<EdgeProfileOperationReceipt> {
+    return this.request('GET', ENDPOINTS.ORG_EDGE_PROFILE_OPERATION(orgId, edgeId, operationId));
+  }
+
+  /** Create and atomically materialize one Local BYOC Browser Alias. A replay
+   * with the same idempotency key and body returns the original stable ccn_. */
+  async createBrowserAlias(
+    orgId: string,
+    request: BrowserAliasCreateRequest,
+  ): Promise<BrowserAlias> {
+    return this.request('POST', ENDPOINTS.ORG_BROWSER_ALIASES(orgId), request);
+  }
+
+  async listBrowserAliases(orgId: string): Promise<BrowserAlias[]> {
+    return this.request('GET', ENDPOINTS.ORG_BROWSER_ALIASES(orgId));
+  }
+
+  async getBrowserAlias(orgId: string, aliasId: string): Promise<BrowserAlias> {
+    return this.request('GET', ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId));
+  }
+
+  async renameBrowserAlias(
+    orgId: string,
+    aliasId: string,
+    request: BrowserAliasRenameRequest,
+  ): Promise<BrowserAlias> {
+    return this.request('PATCH', ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId), request);
+  }
+
+  async deleteBrowserAlias(
+    orgId: string,
+    aliasId: string,
+    request: BrowserAliasDeleteRequest,
+  ): Promise<BrowserAliasDeleteProof> {
+    return this.request('DELETE', ENDPOINTS.ORG_BROWSER_ALIAS(orgId, aliasId), request);
+  }
+
+  /** Start one durable readiness check. The key is carried as the standard
+   * Idempotency-Key header; the request body is intentionally empty. */
+  async createBrowserAliasReadinessCheck(
+    orgId: string,
+    aliasId: string,
+    request: BrowserAliasReadinessCheckRequest,
+  ): Promise<BrowserAliasReadinessCheckReceipt> {
+    return this.request(
+      'POST',
+      ENDPOINTS.ORG_BROWSER_ALIAS_READINESS_CHECKS(orgId, aliasId),
+      undefined,
+      undefined,
+      false,
+      { headers: { 'Idempotency-Key': request.idempotency_key } },
+    );
+  }
+
+  /** Sole durable recovery surface for one readiness request. */
+  async getBrowserAliasReadinessCheck(
+    orgId: string,
+    aliasId: string,
+    checkId: string,
+  ): Promise<BrowserAliasReadinessCheckReceipt> {
+    return this.request(
+      'GET',
+      ENDPOINTS.ORG_BROWSER_ALIAS_READINESS_CHECK(orgId, aliasId, checkId),
+    );
+  }
+
+  /** Organization Owner view. Hashes, reviewed snapshots and deltas are
+   * intentionally available only on this human-JWT management surface. */
+  async listBrowserAliasGrants(orgId: string, keyId: string): Promise<BrowserAliasGrantSet[]> {
+    return this.request('GET', ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANTS(orgId, keyId));
+  }
+
+  async getBrowserAliasGrant(
+    orgId: string,
+    keyId: string,
+    aliasId: string,
+  ): Promise<BrowserAliasGrantSet> {
+    return this.request('GET', ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANT(orgId, keyId, aliasId));
+  }
+
+  async replaceBrowserAliasGrant(
+    orgId: string,
+    keyId: string,
+    aliasId: string,
+    request: BrowserAliasGrantReplaceRequest,
+  ): Promise<BrowserAliasGrantSet> {
+    return this.request(
+      'PUT',
+      ENDPOINTS.ORG_API_KEY_BROWSER_ALIAS_GRANT(orgId, keyId, aliasId),
+      request,
+    );
+  }
+
+  /** Managed-key discovery. The response is already grant-filtered and never
+   * carries contract hashes, review snapshots, Edge IDs or Profile IDs. */
+  async listManagedBrowserAliases(orgId: string): Promise<ManagedBrowserAliasSummary[]> {
+    return this.request('GET', ENDPOINTS.ORG_MANAGED_ALIASES(orgId));
+  }
+
+  async getManagedBrowserAlias(orgId: string, aliasName: string): Promise<ManagedBrowserAliasInfo> {
+    return this.request('GET', ENDPOINTS.ORG_MANAGED_ALIAS(orgId, aliasName));
+  }
+
+  /** Accept and dispatch one @alias command. request_id is generated by the
+   * caller before local validation and is also the sole durable recovery key. */
+  async createBrowserAliasExecution(
+    orgId: string,
+    request: BrowserAliasExecutionRequest,
+  ): Promise<BrowserAliasExecutionReceipt> {
+    return this.request('POST', ENDPOINTS.ORG_BROWSER_ALIAS_EXECUTIONS(orgId), request);
+  }
+
+  async getBrowserAliasExecution(
+    orgId: string,
+    requestId: string,
+  ): Promise<BrowserAliasExecutionReceipt> {
+    return this.request('GET', ENDPOINTS.ORG_BROWSER_ALIAS_EXECUTION(orgId, requestId));
+  }
+
   /**
    * Read a hosted Cloud Profile's egress-proxy status (manager-only: hosted
    * human maintainer or org admin). Sanitized — the password never comes back.

package/src/constants.ts

@@ -1,3 +1,5 @@
+import { attachmentEndpoints } from './attachment-endpoints.js';
+
 // API base path
 export const API_BASE = '/api/v1';
 
@@ -432,9 +434,7 @@ export const ENDPOINTS = {
     `${API_BASE}/messages/${id}/reactions/${encodeURIComponent(emoji)}`,
 
   // Upload (org-scoped)
-  UPLOAD_PRESIGN: (orgId: string) => `${API_BASE}/orgs/${orgId}/upload/presign`,
-  UPLOAD_COMPLETE: (orgId: string) => `${API_BASE}/orgs/${orgId}/upload/complete`,
-  FILE: (id: string) => `${API_BASE}/files/${id}`,
+  ...attachmentEndpoints(API_BASE),
 
   // Approval requests (org-scoped)
   APPROVAL_REQUESTS: (orgId: string) => `${API_BASE}/orgs/${orgId}/approval-requests`,
@@ -718,6 +718,8 @@ export const ENDPOINTS = {
   // backend router so `deleted` isn't captured as a {wikiId}; the SDK builder
   // is just a string.
   WIKIS_DELETED: (orgId: string) => `${WIKI_BASE}/orgs/${orgId}/wikis/deleted`,
+  // Org-wide changeset listing across readable wikis (Working on tab).
+  WIKI_ORG_CHANGESETS: (orgId: string) => `${WIKI_BASE}/orgs/${orgId}/wiki-changesets`,
   // Detail URL — also reused for DELETE (soft-delete) and `${WIKI}/restore`.
   WIKI: (orgId: string, wikiId: string) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}`,
   WIKI_RESTORE: (orgId: string, wikiId: string) =>
@@ -768,6 +770,14 @@ export const ENDPOINTS = {
     `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restrictions`,
   WIKI_RESTRICTION: (orgId: string, wikiId: string, restrictionId: string) =>
     `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/restrictions/${restrictionId}`,
+  WIKI_ACCESS_POLICY: (orgId: string, wikiId: string) =>
+    `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-policy`,
+  WIKI_ACCESS_POLICY_MEMBERS: (orgId: string, wikiId: string) =>
+    `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-policy/members`,
+  WIKI_MEMBERSHIP_SELF: (orgId: string, wikiId: string) =>
+    `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/membership/self`,
+  WIKI_MEMBERS: (orgId: string, wikiId: string) =>
+    `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/members`,
   WIKI_ACCESS_STATUS: (orgId: string, wikiId: string) =>
     `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-status`,
   WIKI_ACCESS_REQUESTS: (orgId: string, wikiId: string) =>
@@ -939,6 +949,29 @@ export const ENDPOINTS = {
   ORG_EDGE_ONBOARDING: (orgId: string) => `/api/v1/orgs/${orgId}/edge/onboarding`,
   ORG_EDGE_PROFILES: (orgId: string, edgeId: string) =>
     `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles`,
+  ORG_EDGE_PROFILE_OPERATIONS: (orgId: string, edgeId: string) =>
+    `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations`,
+  ORG_EDGE_PROFILE_OPERATION: (orgId: string, edgeId: string, operationId: string) =>
+    `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations/${operationId}`,
+  ORG_EDGE_PROFILE_OPERATION_CONFIRM: (orgId: string, edgeId: string, operationId: string) =>
+    `/api/v1/orgs/${orgId}/edge/${edgeId}/profile-operations/${operationId}/confirm`,
+  ORG_BROWSER_ALIASES: (orgId: string) => `/api/v1/orgs/${orgId}/browser-aliases`,
+  ORG_BROWSER_ALIAS: (orgId: string, aliasId: string) =>
+    `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}`,
+  ORG_BROWSER_ALIAS_READINESS_CHECKS: (orgId: string, aliasId: string) =>
+    `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}/readiness-checks`,
+  ORG_BROWSER_ALIAS_READINESS_CHECK: (orgId: string, aliasId: string, checkId: string) =>
+    `/api/v1/orgs/${orgId}/browser-aliases/${aliasId}/readiness-checks/${checkId}`,
+  ORG_API_KEY_BROWSER_ALIAS_GRANTS: (orgId: string, keyId: string) =>
+    `/api/v1/orgs/${orgId}/api-keys/${keyId}/browser-alias-grants`,
+  ORG_API_KEY_BROWSER_ALIAS_GRANT: (orgId: string, keyId: string, aliasId: string) =>
+    `/api/v1/orgs/${orgId}/api-keys/${keyId}/browser-alias-grants/${aliasId}`,
+  ORG_MANAGED_ALIASES: (orgId: string) => `/api/v1/orgs/${orgId}/aliases`,
+  ORG_MANAGED_ALIAS: (orgId: string, aliasName: string) =>
+    `/api/v1/orgs/${orgId}/aliases/${encodeURIComponent(aliasName)}`,
+  ORG_BROWSER_ALIAS_EXECUTIONS: (orgId: string) => `/api/v1/orgs/${orgId}/executions`,
+  ORG_BROWSER_ALIAS_EXECUTION: (orgId: string, requestId: string) =>
+    `/api/v1/orgs/${orgId}/executions/${encodeURIComponent(requestId)}`,
   // Per-profile egress proxy (hosted Cloud Profiles; manager-only, human-only).
   ORG_EDGE_PROFILE_PROXY: (orgId: string, edgeId: string, profileName: string) =>
     `/api/v1/orgs/${orgId}/edge/${edgeId}/profiles/${encodeURIComponent(profileName)}/proxy`,

package/src/index.ts

@@ -1,4 +1,5 @@
 export * from './browser-viewer.js';
+export * from './attachment-types.js';
 export type { ParallClientOptions } from './client.js';
 export { ApiError, ParallClient } from './client.js';
 export * from './constants.js';