@xemahq/app-platform-api-client 0.3.9 → 0.3.13

package/dist/custom-fetch.d.ts

@@ -47,6 +47,28 @@ export interface ClientConfig {
     getAuthToken?: () => Promise<string>;
     /** Optional callback returning headers to inject on every request. Per-call headers take precedence. */
     getHeaders?: () => Record<string, string> | Promise<Record<string, string>>;
+    /**
+     * Optional resolver for the CORRELATION ID of the request being made — the
+     * handle that ties one causal chain together across every service hop.
+     *
+     * WHY IT IS A CALLBACK AND NOT A VALUE. `ClientConfig` is process-global
+     * (`configureClient` is called once at wiring time), and a correlation id is
+     * per-request. This is invoked INSIDE the request, so a server can point it
+     * at whatever carries its ambient request context and get the CURRENT id
+     * rather than the one that happened to be live at boot.
+     *
+     * WHY THE TRANSPORT DOES NOT MINT ONE. Returning `undefined` sends no header,
+     * and the receiving service's `RequestContextMiddleware` mints its own — a
+     * new trace, which is honest. A transport that minted per call would produce
+     * a FRESH id on every hop while looking like propagation, which is strictly
+     * worse than none: every row would carry a correlation id and no two rows
+     * that belong together would share one. That is the exact defect this exists
+     * to fix, so the transport must not reproduce it one layer down.
+     *
+     * A caller-supplied `X-Correlation-Id` header always wins, and so does one
+     * from `getHeaders`.
+     */
+    getCorrelationId?: () => string | undefined | Promise<string | undefined>;
     /**
      * Optional callback invoked on a 401 before ONE re-attempt. Supplying it is
      * what opts this client into that re-attempt; without it a 401 comes back to

package/dist/custom-fetch.js

@@ -89,6 +89,16 @@ function getClientConfig() {
  */
 /** The only statuses that state the request was NOT processed. See above. */
 const RETRYABLE_STATUSES = [429, 503];
+/**
+ * The platform's correlation header, spelled once.
+ *
+ * Value-identical to what `RequestContextMiddleware` reads in
+ * `@xemahq/platform-common`. It is a literal here rather than an import
+ * because this file has ZERO imports on purpose: it ships byte-identical into
+ * browser-target clients as well as server-target ones, and a dependency on a
+ * NestJS-peer package would follow it into every one of them.
+ */
+const CORRELATION_ID_HEADER = 'X-Correlation-Id';
 /** Backoff floor, doubling per attempt up to {@link MAX_BACKOFF_MS}. */
 const BASE_BACKOFF_MS = 1000;
 /** Ceiling on a single backoff, however many attempts have elapsed. */
@@ -104,6 +114,23 @@ async function buildHeaders(config, callerHeaders) {
             }
         }
     }
+    // Correlation id (caller and global headers still take precedence).
+    //
+    // Without this, every server-to-server hop through a generated client started
+    // a NEW trace: the id is read-or-minted per hop by the receiving service's
+    // RequestContextMiddleware, and nothing carried it outbound — so an audit
+    // journal could record a whole causal chain and offer no way to join it back
+    // together.
+    //
+    // Absent resolver, or a resolver that answers `undefined`: NO header. The
+    // receiver mints and a new trace begins, which is the truthful outcome when
+    // there is nothing to continue.
+    if (config.getCorrelationId && !headers.has(CORRELATION_ID_HEADER)) {
+        const correlationId = await Promise.resolve(config.getCorrelationId());
+        if (correlationId) {
+            headers.set(CORRELATION_ID_HEADER, correlationId);
+        }
+    }
     // Auth token (caller or global headers take precedence)
     if (config.getAuthToken && !headers.has('Authorization')) {
         const token = await config.getAuthToken();

package/dist/endpoints/delegated-session-keys/delegated-session-keys.d.ts

@@ -0,0 +1,5 @@
+export declare const getDelegatedSessionJwksControllerJwksUrl: () => string;
+/**
+ * @summary Public signing keys for delegated-session JWTs. Contains the ACTIVE key plus any key rotated out but still inside its publication window.
+ */
+export declare const delegatedSessionJwksControllerJwks: (options?: RequestInit) => Promise<void>;

package/dist/endpoints/delegated-session-keys/delegated-session-keys.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.delegatedSessionJwksControllerJwks = exports.getDelegatedSessionJwksControllerJwksUrl = void 0;
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+const custom_fetch_1 = require("../../custom-fetch");
+const getDelegatedSessionJwksControllerJwksUrl = () => {
+    return `/public/.well-known/delegated-session-jwks.json`;
+};
+exports.getDelegatedSessionJwksControllerJwksUrl = getDelegatedSessionJwksControllerJwksUrl;
+/**
+ * @summary Public signing keys for delegated-session JWTs. Contains the ACTIVE key plus any key rotated out but still inside its publication window.
+ */
+const delegatedSessionJwksControllerJwks = async (options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getDelegatedSessionJwksControllerJwksUrl)(), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.delegatedSessionJwksControllerJwks = delegatedSessionJwksControllerJwks;

package/dist/endpoints/project-apps/project-apps.d.ts

@@ -3,7 +3,7 @@
  * App Runtime API
  * OpenAPI spec version: 0.1.2
  */
-import type { AppClientDtoDataArrayEnvelope, AppClientDtoDataEnvelope, AppDtoDataArrayEnvelope, AppDtoDataEnvelope, AppReleaseDtoDataArrayEnvelope, AppReleaseDtoDataEnvelope, AudiencePolicyDtoDataArrayEnvelope, AudiencePolicyDtoDataEnvelope, CreateAppClientDto, CreateAudiencePolicyDto, CreatePortalDto, CreateProjectAppDto, CreatedAppClientDtoDataEnvelope, PortalDetailDtoDataEnvelope, ProjectAppsControllerListParams, UpdateAudiencePolicyDto, UpdatePortalDto } from '../../models';
+import type { AppClientDtoDataArrayEnvelope, AppClientDtoDataEnvelope, AppDtoDataArrayEnvelope, AppDtoDataEnvelope, AppDtoPaginatedEnvelope, AppReleaseDtoDataArrayEnvelope, AppReleaseDtoDataEnvelope, AudiencePolicyDtoDataArrayEnvelope, AudiencePolicyDtoDataEnvelope, CreateAppClientDto, CreateAudiencePolicyDto, CreatePortalDto, CreateProjectAppDto, CreatedAppClientDtoDataEnvelope, InstallPortalBiomeDto, PortalDetailDtoDataEnvelope, PortalsControllerListParams, ProjectAppsControllerListParams, UnarchivePortalDto, UpdateAudiencePolicyDto, UpdatePortalDto } from '../../models';
 export declare const getProjectAppsControllerCreateUrl: () => string;
 /**
  * @summary Create an App in the caller org + named project.
@@ -11,7 +11,7 @@ export declare const getProjectAppsControllerCreateUrl: () => string;
 export declare const projectAppsControllerCreate: (createProjectAppDto: CreateProjectAppDto, options?: RequestInit) => Promise<AppDtoDataEnvelope>;
 export declare const getProjectAppsControllerListUrl: (params?: ProjectAppsControllerListParams) => string;
 /**
- * @summary List Apps in the caller org (optionally filtered by project/slug).
+ * @summary List Apps in the caller org (optionally filtered by project/slug). Archived Apps are excluded unless `includeArchived=true`.
  */
 export declare const projectAppsControllerList: (params?: ProjectAppsControllerListParams, options?: RequestInit) => Promise<AppDtoDataArrayEnvelope>;
 export declare const getProjectAppsControllerGetByIdUrl: (id: string) => string;
@@ -69,11 +69,11 @@ export declare const getProjectAudiencePoliciesControllerDeleteUrl: (id: string)
  * @summary Delete an AudiencePolicy owned by the caller org.
  */
 export declare const projectAudiencePoliciesControllerDelete: (id: string, options?: RequestInit) => Promise<void>;
-export declare const getPortalsControllerListUrl: () => string;
+export declare const getPortalsControllerListUrl: (params?: PortalsControllerListParams) => string;
 /**
- * @summary List the portals the calling user may see in the caller org (visibility-filtered).
+ * @summary List the portals the calling user may see in the caller org (visibility-filtered, paginated).
  */
-export declare const portalsControllerList: (options?: RequestInit) => Promise<AppDtoDataArrayEnvelope>;
+export declare const portalsControllerList: (params?: PortalsControllerListParams, options?: RequestInit) => Promise<AppDtoPaginatedEnvelope>;
 export declare const getPortalsControllerCreateUrl: () => string;
 /**
  * @summary Create an org-scoped portal (portal-admin only).
@@ -89,8 +89,38 @@ export declare const getPortalsControllerUpdateUrl: (id: string) => string;
  * @summary Update a portal owned by the caller org (portal-admin only).
  */
 export declare const portalsControllerUpdate: (id: string, updatePortalDto: UpdatePortalDto, options?: RequestInit) => Promise<AppDtoDataEnvelope>;
+export declare const getPortalsControllerRemoveUrl: (id: string) => string;
+/**
+ * @summary Hard-delete a UI-owned portal (portal-admin only). Cascades to its releases, app-clients and external subjects. Use archive for a reversible retire; a seeder/IaC/system-owned portal is refused (409) because its producer would recreate it.
+ */
+export declare const portalsControllerRemove: (id: string, options?: RequestInit) => Promise<void>;
 export declare const getPortalsControllerArchiveUrl: (id: string) => string;
 /**
- * @summary Archive a portal owned by the caller org (portal-admin only).
+ * @summary Archive a portal owned by the caller org (portal-admin only). Reversible via `POST :id/unarchive`.
  */
 export declare const portalsControllerArchive: (id: string, options?: RequestInit) => Promise<AppDtoDataEnvelope>;
+export declare const getPortalsControllerUnarchiveUrl: (id: string) => string;
+/**
+ * @summary Un-archive a portal owned by the caller org (portal-admin only). Re-registers its PDP access — `org-shared` unless a block is supplied.
+ */
+export declare const portalsControllerUnarchive: (id: string, unarchivePortalDto: UnarchivePortalDto, options?: RequestInit) => Promise<AppDtoDataEnvelope>;
+export declare const getPortalsControllerReadoptUrl: (id: string) => string;
+/**
+ * @summary Hand a UI-adopted default portal back to the reconciler (portal-admin only), so it resumes tracking the installed web biomes.
+ */
+export declare const portalsControllerReadopt: (id: string, options?: RequestInit) => Promise<AppDtoDataEnvelope>;
+export declare const getPortalsControllerInstallBiomeUrl: (id: string) => string;
+/**
+ * @summary Install one biome on a portal (portal-admin only). Idempotent per ref; serialized against concurrent installs by a per-portal lock. Returns 422 for a ref no web biome is registered for.
+ */
+export declare const portalsControllerInstallBiome: (id: string, installPortalBiomeDto: InstallPortalBiomeDto, options?: RequestInit) => Promise<AppDtoDataEnvelope>;
+export declare const getPortalsControllerUninstallBiomeUrl: (id: string, encodedRef: string) => string;
+/**
+ * @summary Uninstall one biome from a portal (portal-admin only). 404s a ref the portal does not carry, rather than reporting a no-op as success.
+ */
+export declare const portalsControllerUninstallBiome: (id: string, encodedRef: string, options?: RequestInit) => Promise<AppDtoDataEnvelope>;
+export declare const getPortalsControllerRefreshLockfileUrl: (id: string) => string;
+/**
+ * @summary Refresh a portal lockfile (portal-admin only). Re-pins kernel + installed biomes via the kernel Lockfile Resolver. Returns 422 LOCKFILE_RESOLVER_FAILED on any unsatisfiable constraint, malformed ref, or unreachable upstream.
+ */
+export declare const portalsControllerRefreshLockfile: (id: string, options?: RequestInit) => Promise<AppDtoDataEnvelope>;

package/dist/endpoints/project-apps/project-apps.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.portalsControllerArchive = exports.getPortalsControllerArchiveUrl = exports.portalsControllerUpdate = exports.getPortalsControllerUpdateUrl = exports.portalsControllerGetOne = exports.getPortalsControllerGetOneUrl = exports.portalsControllerCreate = exports.getPortalsControllerCreateUrl = exports.portalsControllerList = exports.getPortalsControllerListUrl = exports.projectAudiencePoliciesControllerDelete = exports.getProjectAudiencePoliciesControllerDeleteUrl = exports.projectAudiencePoliciesControllerUpdate = exports.getProjectAudiencePoliciesControllerUpdateUrl = exports.projectAudiencePoliciesControllerList = exports.getProjectAudiencePoliciesControllerListUrl = exports.projectAudiencePoliciesControllerCreate = exports.getProjectAudiencePoliciesControllerCreateUrl = exports.projectAppReleasesControllerRollback = exports.getProjectAppReleasesControllerRollbackUrl = exports.projectAppReleasesControllerListHistory = exports.getProjectAppReleasesControllerListHistoryUrl = exports.projectAppReleasesControllerGetLive = exports.getProjectAppReleasesControllerGetLiveUrl = exports.projectAppClientsControllerRevoke = exports.getProjectAppClientsControllerRevokeUrl = exports.projectAppClientsControllerList = exports.getProjectAppClientsControllerListUrl = exports.projectAppClientsControllerCreate = exports.getProjectAppClientsControllerCreateUrl = exports.projectAppsControllerGetById = exports.getProjectAppsControllerGetByIdUrl = exports.projectAppsControllerList = exports.getProjectAppsControllerListUrl = exports.projectAppsControllerCreate = exports.getProjectAppsControllerCreateUrl = void 0;
+exports.portalsControllerRefreshLockfile = exports.getPortalsControllerRefreshLockfileUrl = exports.portalsControllerUninstallBiome = exports.getPortalsControllerUninstallBiomeUrl = exports.portalsControllerInstallBiome = exports.getPortalsControllerInstallBiomeUrl = exports.portalsControllerReadopt = exports.getPortalsControllerReadoptUrl = exports.portalsControllerUnarchive = exports.getPortalsControllerUnarchiveUrl = exports.portalsControllerArchive = exports.getPortalsControllerArchiveUrl = exports.portalsControllerRemove = exports.getPortalsControllerRemoveUrl = exports.portalsControllerUpdate = exports.getPortalsControllerUpdateUrl = exports.portalsControllerGetOne = exports.getPortalsControllerGetOneUrl = exports.portalsControllerCreate = exports.getPortalsControllerCreateUrl = exports.portalsControllerList = exports.getPortalsControllerListUrl = exports.projectAudiencePoliciesControllerDelete = exports.getProjectAudiencePoliciesControllerDeleteUrl = exports.projectAudiencePoliciesControllerUpdate = exports.getProjectAudiencePoliciesControllerUpdateUrl = exports.projectAudiencePoliciesControllerList = exports.getProjectAudiencePoliciesControllerListUrl = exports.projectAudiencePoliciesControllerCreate = exports.getProjectAudiencePoliciesControllerCreateUrl = exports.projectAppReleasesControllerRollback = exports.getProjectAppReleasesControllerRollbackUrl = exports.projectAppReleasesControllerListHistory = exports.getProjectAppReleasesControllerListHistoryUrl = exports.projectAppReleasesControllerGetLive = exports.getProjectAppReleasesControllerGetLiveUrl = exports.projectAppClientsControllerRevoke = exports.getProjectAppClientsControllerRevokeUrl = exports.projectAppClientsControllerList = exports.getProjectAppClientsControllerListUrl = exports.projectAppClientsControllerCreate = exports.getProjectAppClientsControllerCreateUrl = exports.projectAppsControllerGetById = exports.getProjectAppsControllerGetByIdUrl = exports.projectAppsControllerList = exports.getProjectAppsControllerListUrl = exports.projectAppsControllerCreate = exports.getProjectAppsControllerCreateUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
 const getProjectAppsControllerCreateUrl = () => {
     return `/bff/apps`;
@@ -42,7 +42,7 @@ const getProjectAppsControllerListUrl = (params) => {
 };
 exports.getProjectAppsControllerListUrl = getProjectAppsControllerListUrl;
 /**
- * @summary List Apps in the caller org (optionally filtered by project/slug).
+ * @summary List Apps in the caller org (optionally filtered by project/slug). Archived Apps are excluded unless `includeArchived=true`.
  */
 const projectAppsControllerList = async (params, options) => {
     return (0, custom_fetch_1.customFetch)((0, exports.getProjectAppsControllerListUrl)(params), {
@@ -211,15 +211,34 @@ const projectAudiencePoliciesControllerDelete = async (id, options) => {
     });
 };
 exports.projectAudiencePoliciesControllerDelete = projectAudiencePoliciesControllerDelete;
-const getPortalsControllerListUrl = () => {
-    return `/bff/portals`;
+const getPortalsControllerListUrl = (params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item === undefined || item === null)
+                    continue;
+                normalizedParams.append(key, item.toString());
+            }
+            return;
+        }
+        normalizedParams.append(key, value.toString());
+    });
+    const stringifiedParams = normalizedParams.toString();
+    return stringifiedParams.length > 0 ? `/bff/portals?${stringifiedParams}` : `/bff/portals`;
 };
 exports.getPortalsControllerListUrl = getPortalsControllerListUrl;
 /**
- * @summary List the portals the calling user may see in the caller org (visibility-filtered).
+ * @summary List the portals the calling user may see in the caller org (visibility-filtered, paginated).
  */
-const portalsControllerList = async (options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getPortalsControllerListUrl)(), {
+const portalsControllerList = async (params, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPortalsControllerListUrl)(params), {
         ...options,
         method: 'GET'
     });
@@ -271,12 +290,26 @@ const portalsControllerUpdate = async (id, updatePortalDto, options) => {
     });
 };
 exports.portalsControllerUpdate = portalsControllerUpdate;
+const getPortalsControllerRemoveUrl = (id) => {
+    return `/bff/portals/${id}`;
+};
+exports.getPortalsControllerRemoveUrl = getPortalsControllerRemoveUrl;
+/**
+ * @summary Hard-delete a UI-owned portal (portal-admin only). Cascades to its releases, app-clients and external subjects. Use archive for a reversible retire; a seeder/IaC/system-owned portal is refused (409) because its producer would recreate it.
+ */
+const portalsControllerRemove = async (id, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPortalsControllerRemoveUrl)(id), {
+        ...options,
+        method: 'DELETE'
+    });
+};
+exports.portalsControllerRemove = portalsControllerRemove;
 const getPortalsControllerArchiveUrl = (id) => {
     return `/bff/portals/${id}/archive`;
 };
 exports.getPortalsControllerArchiveUrl = getPortalsControllerArchiveUrl;
 /**
- * @summary Archive a portal owned by the caller org (portal-admin only).
+ * @summary Archive a portal owned by the caller org (portal-admin only). Reversible via `POST :id/unarchive`.
  */
 const portalsControllerArchive = async (id, options) => {
     return (0, custom_fetch_1.customFetch)((0, exports.getPortalsControllerArchiveUrl)(id), {
@@ -285,3 +318,77 @@ const portalsControllerArchive = async (id, options) => {
     });
 };
 exports.portalsControllerArchive = portalsControllerArchive;
+const getPortalsControllerUnarchiveUrl = (id) => {
+    return `/bff/portals/${id}/unarchive`;
+};
+exports.getPortalsControllerUnarchiveUrl = getPortalsControllerUnarchiveUrl;
+/**
+ * @summary Un-archive a portal owned by the caller org (portal-admin only). Re-registers its PDP access — `org-shared` unless a block is supplied.
+ */
+const portalsControllerUnarchive = async (id, unarchivePortalDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPortalsControllerUnarchiveUrl)(id), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(unarchivePortalDto)
+    });
+};
+exports.portalsControllerUnarchive = portalsControllerUnarchive;
+const getPortalsControllerReadoptUrl = (id) => {
+    return `/bff/portals/${id}/readopt`;
+};
+exports.getPortalsControllerReadoptUrl = getPortalsControllerReadoptUrl;
+/**
+ * @summary Hand a UI-adopted default portal back to the reconciler (portal-admin only), so it resumes tracking the installed web biomes.
+ */
+const portalsControllerReadopt = async (id, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPortalsControllerReadoptUrl)(id), {
+        ...options,
+        method: 'POST'
+    });
+};
+exports.portalsControllerReadopt = portalsControllerReadopt;
+const getPortalsControllerInstallBiomeUrl = (id) => {
+    return `/bff/portals/${id}/biomes`;
+};
+exports.getPortalsControllerInstallBiomeUrl = getPortalsControllerInstallBiomeUrl;
+/**
+ * @summary Install one biome on a portal (portal-admin only). Idempotent per ref; serialized against concurrent installs by a per-portal lock. Returns 422 for a ref no web biome is registered for.
+ */
+const portalsControllerInstallBiome = async (id, installPortalBiomeDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPortalsControllerInstallBiomeUrl)(id), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(installPortalBiomeDto)
+    });
+};
+exports.portalsControllerInstallBiome = portalsControllerInstallBiome;
+const getPortalsControllerUninstallBiomeUrl = (id, encodedRef) => {
+    return `/bff/portals/${id}/biomes/${encodedRef}`;
+};
+exports.getPortalsControllerUninstallBiomeUrl = getPortalsControllerUninstallBiomeUrl;
+/**
+ * @summary Uninstall one biome from a portal (portal-admin only). 404s a ref the portal does not carry, rather than reporting a no-op as success.
+ */
+const portalsControllerUninstallBiome = async (id, encodedRef, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPortalsControllerUninstallBiomeUrl)(id, encodedRef), {
+        ...options,
+        method: 'DELETE'
+    });
+};
+exports.portalsControllerUninstallBiome = portalsControllerUninstallBiome;
+const getPortalsControllerRefreshLockfileUrl = (id) => {
+    return `/bff/portals/${id}/lockfile/refresh`;
+};
+exports.getPortalsControllerRefreshLockfileUrl = getPortalsControllerRefreshLockfileUrl;
+/**
+ * @summary Refresh a portal lockfile (portal-admin only). Re-pins kernel + installed biomes via the kernel Lockfile Resolver. Returns 422 LOCKFILE_RESOLVER_FAILED on any unsatisfiable constraint, malformed ref, or unreachable upstream.
+ */
+const portalsControllerRefreshLockfile = async (id, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPortalsControllerRefreshLockfileUrl)(id), {
+        ...options,
+        method: 'POST'
+    });
+};
+exports.portalsControllerRefreshLockfile = portalsControllerRefreshLockfile;

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { configureClient, getClientConfig, ClientError, customFetch, type ClientConfig, type RetryNotice } from './custom-fetch';
 export * from './models';
+export * from './endpoints/delegated-session-keys/delegated-session-keys';
 export * from './endpoints/delegated-sessions/delegated-sessions';
 export * from './endpoints/project-apps/project-apps';
 export * from './endpoints/public-ingress/public-ingress';

package/dist/index.js

@@ -22,6 +22,7 @@ Object.defineProperty(exports, "getClientConfig", { enumerable: true, get: funct
 Object.defineProperty(exports, "ClientError", { enumerable: true, get: function () { return custom_fetch_1.ClientError; } });
 Object.defineProperty(exports, "customFetch", { enumerable: true, get: function () { return custom_fetch_1.customFetch; } });
 __exportStar(require("./models"), exports);
+__exportStar(require("./endpoints/delegated-session-keys/delegated-session-keys"), exports);
 __exportStar(require("./endpoints/delegated-sessions/delegated-sessions"), exports);
 __exportStar(require("./endpoints/project-apps/project-apps"), exports);
 __exportStar(require("./endpoints/public-ingress/public-ingress"), exports);

package/dist/models/anonAuthDto.d.ts

@@ -4,8 +4,12 @@
  * OpenAPI spec version: 0.1.2
  */
 export interface AnonAuthDto {
+    /** AppClient public identifier. */
+    clientId: string;
+    /** Plaintext AppClient secret. Required on EVERY external-auth door, the anonymous one included: "anonymous" describes the subject, never the caller — the App owner controls who may open sessions in its name. */
+    clientSecret: string;
     /** Optional client-supplied hint used for logging / debugging purposes. Not used for identity resolution — every call creates a fresh anon subject. */
     sessionHint?: string;
-    /** AppClient id issuing this auth request. */
-    appClientId: string;
+    /** Requested ExecutionEnvironment slug. Defaults to the App’s `defaultZone`, and either way must be in the resolved AudiencePolicy.allowedEnvironments[]. */
+    requestedZone?: string;
 }

package/dist/models/anonAuthResultDto.d.ts

@@ -12,4 +12,6 @@ export interface AnonAuthResultDto {
     sessionId: string;
     /** Subject ref minted into the token. */
     subjectRef: string;
+    /** ExecutionEnvironment slug the session was minted into. */
+    environment: string;
 }

package/dist/models/appDto.d.ts

@@ -4,6 +4,7 @@
  * OpenAPI spec version: 0.1.2
  */
 import type { AppLockfileDto } from './appLockfileDto.js';
+import type { AudienceKind } from './audienceKind.js';
 import type { BiomeInstallDto } from './biomeInstallDto.js';
 import type { BrandingConfigDto } from './brandingConfigDto.js';
 import type { CapabilityPolicyOverrideDto } from './capabilityPolicyOverrideDto.js';
@@ -22,13 +23,14 @@ export interface AppDto {
     lockfile: AppLockfileDto;
     installedBiomes: BiomeInstallDto[];
     capabilityPolicy: CapabilityPolicyOverrideDto[];
-    /** @nullable */
-    subdomain: string | null;
+    /** Whether this App is reachable on a public host. The host itself is DERIVED (see `codedAppSubdomain`), never tenant-chosen — this is the switch for WHETHER, not WHERE. */
     subdomainEnabled: boolean;
-    defaultAudience: string;
+    defaultAudience: AudienceKind;
     archived: boolean;
     /** Provisioning ownership marker. `iac` = managed by the declarative control plane (Terraform / xema.yaml); `seeder` = a distribution default; `ui` = hand-managed (or adopted from iac/seeder via a UI edit); `system` = platform-shipped; null = unmanaged/legacy. Lets a console badge an IaC-owned resource and surface an "export as code" affordance. */
     managedBy: ResourceManagedBy | null;
+    /** Whether this App can be handed back to the portal reconciler — the exact precondition of POST /bff/portals/:id/readopt (true iff the row carries the reconciler natural key). Read-only, server-derived. A `ui`-managed App with readoptable=false was hand-created and was never reconciler-owned; with readoptable=true it is an adopted default portal, and readopt restores automatic updates. */
+    readoptable: boolean;
     createdAt: string;
     updatedAt: string;
 }

package/dist/models/appDtoPaginatedEnvelope.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+import type { AppDto } from './appDto.js';
+import type { PaginationMeta } from './paginationMeta.js';
+export interface AppDtoPaginatedEnvelope {
+    data: AppDto[];
+    pagination: PaginationMeta;
+}

package/dist/models/appDtoPaginatedEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/audiencePolicyDto.d.ts

@@ -4,7 +4,6 @@
  * OpenAPI spec version: 0.1.2
  */
 import type { AudienceKind } from './audienceKind.js';
-import type { AudiencePolicyDtoRateLimitPerHourPerSubject } from './audiencePolicyDtoRateLimitPerHourPerSubject.js';
 import type { AudienceUpstreamDto } from './audienceUpstreamDto.js';
 export interface AudiencePolicyDto {
     id: string;
@@ -12,8 +11,10 @@ export interface AudiencePolicyDto {
     kind: AudienceKind;
     allowedEnvironments: string[];
     authUpstream?: AudienceUpstreamDto | null;
-    /** @nullable */
-    rateLimitPerHourPerSubject?: AudiencePolicyDtoRateLimitPerHourPerSubject;
+    /** Session opens per hour for ONE identified external subject. Never null: a null used to mean "no limit", so an audience created without one was uncapped while reading as configured. */
+    rateLimitPerHourPerSubject: number;
+    /** Session opens per hour for the whole AppClient, across subjects. This is the cap the ANONYMOUS door is measured against — an anon subject is minted fresh on every call, so no per-subject bucket can bound it. */
+    rateLimitPerHourPerClient: number;
     createdAt: string;
     updatedAt: string;
 }

package/dist/models/createAudiencePolicyDto.d.ts

@@ -10,6 +10,8 @@ export interface CreateAudiencePolicyDto {
     /** ExecutionEnvironmentRef slugs this audience may invoke. Required. */
     allowedEnvironments: string[];
     authUpstream?: AudienceUpstreamDto;
-    /** Rate cap (calls/hour/subject). */
+    /** Session opens per hour for ONE identified external subject. Omitted means the column default, NOT "unlimited" — there is no value that means unlimited. */
     rateLimitPerHourPerSubject?: number;
+    /** Session opens per hour for the whole AppClient, across subjects. This is the cap the ANONYMOUS door is measured against — an anon subject is minted fresh on every call, so no per-subject bucket can bound it. Omitted means the column default, NOT "unlimited". */
+    rateLimitPerHourPerClient?: number;
 }

package/dist/models/createPortalDto.d.ts

@@ -4,6 +4,7 @@
  * OpenAPI spec version: 0.1.2
  */
 import type { AppLockfileDto } from './appLockfileDto.js';
+import type { AudienceKind } from './audienceKind.js';
 import type { BiomeInstallDto } from './biomeInstallDto.js';
 import type { BrandingConfigDto } from './brandingConfigDto.js';
 import type { CapabilityPolicyOverrideDto } from './capabilityPolicyOverrideDto.js';
@@ -18,10 +19,9 @@ export interface CreatePortalDto {
     lockfile: AppLockfileDto;
     installedBiomes: BiomeInstallDto[];
     capabilityPolicy: CapabilityPolicyOverrideDto[];
-    /** @nullable */
-    subdomain?: string | null;
+    /** Whether this App is reachable on a public host. The host itself is DERIVED, never tenant-chosen — this is the switch for WHETHER, not WHERE. */
     subdomainEnabled?: boolean;
-    defaultAudience?: string;
+    defaultAudience?: AudienceKind;
     archived?: boolean;
     access?: PortalAccessDto;
 }

package/dist/models/createProjectAppDto.d.ts

@@ -4,6 +4,7 @@
  * OpenAPI spec version: 0.1.2
  */
 import type { AppLockfileDto } from './appLockfileDto.js';
+import type { AudienceKind } from './audienceKind.js';
 import type { BiomeInstallDto } from './biomeInstallDto.js';
 import type { BrandingConfigDto } from './brandingConfigDto.js';
 import type { CapabilityPolicyOverrideDto } from './capabilityPolicyOverrideDto.js';
@@ -23,10 +24,9 @@ export interface CreateProjectAppDto {
     lockfile: AppLockfileDto;
     installedBiomes: BiomeInstallDto[];
     capabilityPolicy: CapabilityPolicyOverrideDto[];
-    /** @nullable */
-    subdomain?: string | null;
+    /** Whether this App is reachable on a public host. The host itself is DERIVED, never tenant-chosen — this is the switch for WHETHER, not WHERE. */
     subdomainEnabled?: boolean;
-    defaultAudience?: string;
+    defaultAudience?: AudienceKind;
     archived?: boolean;
     /** Authoring tier. `declared` (the default) and `composed` Apps ARE their JSON definition. A `coded` App is one the platform hosts but does not author — a Webapp Studio session builds a container image from the user's own repo, and every release of it carries that image coordinate. Immutable after creation: the tier decides what a release IS, so changing it would leave existing releases describing the wrong thing. */
     surface?: SurfaceKind;

package/dist/models/delegatedSessionActorDto.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+import type { SubjectKind } from './subjectKind.js';
+export interface DelegatedSessionActorDto {
+    /** The acting party’s BARE identifier — an `AppClient.clientId`, never a `"<kind>:<id>"` composite. */
+    sub: string;
+    /** The acting party’s subject kind, stated explicitly by the issuer (wire claim `subject_kind`). Always `app-client` for a delegated session minted by app-platform-api. */
+    subjectKind: SubjectKind;
+}

package/dist/models/delegatedSessionActorDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/index.d.ts

@@ -8,6 +8,7 @@ export * from './appClientDtoRevokedAt';
 export * from './appDto';
 export * from './appDtoDataArrayEnvelope';
 export * from './appDtoDataEnvelope';
+export * from './appDtoPaginatedEnvelope';
 export * from './appLockfileDto';
 export * from './appLockfileDtoAgents';
 export * from './appLockfileDtoBiomes';
@@ -29,7 +30,6 @@ export * from './audienceKind';
 export * from './audiencePolicyDto';
 export * from './audiencePolicyDtoDataArrayEnvelope';
 export * from './audiencePolicyDtoDataEnvelope';
-export * from './audiencePolicyDtoRateLimitPerHourPerSubject';
 export * from './audienceUpstreamDto';
 export * from './audienceUpstreamDtoMetadata';
 export * from './audienceUpstreamType';
@@ -48,6 +48,7 @@ export * from './createdAppClientDtoDataEnvelope';
 export * from './createdAppClientDtoRevokedAt';
 export * from './createdPublicSessionDto';
 export * from './createdPublicSessionDtoDataEnvelope';
+export * from './delegatedSessionActorDto';
 export * from './delegatedSessionDto';
 export * from './delegatedSessionDtoDataEnvelope';
 export * from './delegatedSessionDtoExternalSubjectId';
@@ -57,13 +58,17 @@ export * from './delegatedSessionStatusDto';
 export * from './delegatedSessionStatusDtoDataEnvelope';
 export * from './delegatedSessionStatusDtoExternalSubjectId';
 export * from './delegatedSessionStatusDtoRevokedAt';
+export * from './installPortalBiomeDto';
+export * from './installPortalBiomeDtoConfiguration';
 export * from './oidcAuthDto';
 export * from './oidcAuthResultDto';
 export * from './oidcAuthResultDtoDataEnvelope';
+export * from './paginationMeta';
 export * from './portalAccessDto';
 export * from './portalDetailDto';
 export * from './portalDetailDtoDataEnvelope';
 export * from './portalShareDto';
+export * from './portalsControllerListParams';
 export * from './projectAppsControllerListParams';
 export * from './requestMagicLinkDto';
 export * from './requestMagicLinkResultDto';
@@ -73,8 +78,8 @@ export * from './resourceVisibilityPattern';
 export * from './subjectKind';
 export * from './surfaceKind';
 export * from './tokenClass';
+export * from './unarchivePortalDto';
 export * from './updateAudiencePolicyDto';
-export * from './updateAudiencePolicyDtoRateLimitPerHourPerSubject';
 export * from './updatePortalDto';
 export * from './verifyDelegatedSessionRequestDto';
 export * from './verifyDelegatedSessionResponseDto';

package/dist/models/index.js

@@ -25,6 +25,7 @@ __exportStar(require("./appClientDtoRevokedAt"), exports);
 __exportStar(require("./appDto"), exports);
 __exportStar(require("./appDtoDataArrayEnvelope"), exports);
 __exportStar(require("./appDtoDataEnvelope"), exports);
+__exportStar(require("./appDtoPaginatedEnvelope"), exports);
 __exportStar(require("./appLockfileDto"), exports);
 __exportStar(require("./appLockfileDtoAgents"), exports);
 __exportStar(require("./appLockfileDtoBiomes"), exports);
@@ -46,7 +47,6 @@ __exportStar(require("./audienceKind"), exports);
 __exportStar(require("./audiencePolicyDto"), exports);
 __exportStar(require("./audiencePolicyDtoDataArrayEnvelope"), exports);
 __exportStar(require("./audiencePolicyDtoDataEnvelope"), exports);
-__exportStar(require("./audiencePolicyDtoRateLimitPerHourPerSubject"), exports);
 __exportStar(require("./audienceUpstreamDto"), exports);
 __exportStar(require("./audienceUpstreamDtoMetadata"), exports);
 __exportStar(require("./audienceUpstreamType"), exports);
@@ -65,6 +65,7 @@ __exportStar(require("./createdAppClientDtoDataEnvelope"), exports);
 __exportStar(require("./createdAppClientDtoRevokedAt"), exports);
 __exportStar(require("./createdPublicSessionDto"), exports);
 __exportStar(require("./createdPublicSessionDtoDataEnvelope"), exports);
+__exportStar(require("./delegatedSessionActorDto"), exports);
 __exportStar(require("./delegatedSessionDto"), exports);
 __exportStar(require("./delegatedSessionDtoDataEnvelope"), exports);
 __exportStar(require("./delegatedSessionDtoExternalSubjectId"), exports);
@@ -74,13 +75,17 @@ __exportStar(require("./delegatedSessionStatusDto"), exports);
 __exportStar(require("./delegatedSessionStatusDtoDataEnvelope"), exports);
 __exportStar(require("./delegatedSessionStatusDtoExternalSubjectId"), exports);
 __exportStar(require("./delegatedSessionStatusDtoRevokedAt"), exports);
+__exportStar(require("./installPortalBiomeDto"), exports);
+__exportStar(require("./installPortalBiomeDtoConfiguration"), exports);
 __exportStar(require("./oidcAuthDto"), exports);
 __exportStar(require("./oidcAuthResultDto"), exports);
 __exportStar(require("./oidcAuthResultDtoDataEnvelope"), exports);
+__exportStar(require("./paginationMeta"), exports);
 __exportStar(require("./portalAccessDto"), exports);
 __exportStar(require("./portalDetailDto"), exports);
 __exportStar(require("./portalDetailDtoDataEnvelope"), exports);
 __exportStar(require("./portalShareDto"), exports);
+__exportStar(require("./portalsControllerListParams"), exports);
 __exportStar(require("./projectAppsControllerListParams"), exports);
 __exportStar(require("./requestMagicLinkDto"), exports);
 __exportStar(require("./requestMagicLinkResultDto"), exports);
@@ -90,8 +95,8 @@ __exportStar(require("./resourceVisibilityPattern"), exports);
 __exportStar(require("./subjectKind"), exports);
 __exportStar(require("./surfaceKind"), exports);
 __exportStar(require("./tokenClass"), exports);
+__exportStar(require("./unarchivePortalDto"), exports);
 __exportStar(require("./updateAudiencePolicyDto"), exports);
-__exportStar(require("./updateAudiencePolicyDtoRateLimitPerHourPerSubject"), exports);
 __exportStar(require("./updatePortalDto"), exports);
 __exportStar(require("./verifyDelegatedSessionRequestDto"), exports);
 __exportStar(require("./verifyDelegatedSessionResponseDto"), exports);

package/dist/models/installPortalBiomeDto.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+import type { InstallPortalBiomeDtoConfiguration } from './installPortalBiomeDtoConfiguration.js';
+export interface InstallPortalBiomeDto {
+    /** Canonical XemaObjectRef for the biome (e.g. `xema://system/biome/document-buddy`). */
+    biomeRef: string;
+    /** Semver-range string (`^1.2.0`, `~1.2.0`, `1.2.0`, `latest-compatible`). */
+    versionConstraint: string;
+    /** Free-form per-install configuration the biome consumes. */
+    configuration?: InstallPortalBiomeDtoConfiguration;
+}

package/dist/models/installPortalBiomeDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/{audiencePolicyDtoRateLimitPerHourPerSubject.d.ts → installPortalBiomeDtoConfiguration.d.ts}

@@ -4,8 +4,8 @@
  * OpenAPI spec version: 0.1.2
  */
 /**
- * @nullable
+ * Free-form per-install configuration the biome consumes.
  */
-export type AudiencePolicyDtoRateLimitPerHourPerSubject = {
+export type InstallPortalBiomeDtoConfiguration = {
     [key: string]: unknown;
-} | null;
+};

package/dist/models/oidcAuthDto.d.ts

@@ -4,8 +4,12 @@
  * OpenAPI spec version: 0.1.2
  */
 export interface OidcAuthDto {
+    /** AppClient public identifier. */
+    clientId: string;
+    /** Plaintext AppClient secret. Required on EVERY external-auth door, the anonymous one included: "anonymous" describes the subject, never the caller — the App owner controls who may open sessions in its name. */
+    clientSecret: string;
     /** OIDC id_token issued by the upstream identity provider configured for this App. */
     idToken: string;
-    /** AppClient id issuing this auth request. */
-    appClientId: string;
+    /** Requested ExecutionEnvironment slug. Defaults to the App’s `defaultZone`, and either way must be in the resolved AudiencePolicy.allowedEnvironments[]. */
+    requestedZone?: string;
 }

package/dist/models/oidcAuthResultDto.d.ts

@@ -12,4 +12,6 @@ export interface OidcAuthResultDto {
     sessionId: string;
     /** Subject ref minted into the token. */
     subjectRef: string;
+    /** ExecutionEnvironment slug the session was minted into. */
+    environment: string;
 }

package/dist/models/paginationMeta.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+export interface PaginationMeta {
+    total?: number;
+    page?: number;
+    totalPages?: number;
+    /** @nullable */
+    nextCursor?: string | null;
+    /** @nullable */
+    previousCursor?: string | null;
+    limit?: number;
+    hasMore?: boolean;
+}

package/dist/models/portalDetailDto.d.ts

@@ -7,5 +7,8 @@ import type { AppDto } from './appDto.js';
 import type { PortalAccessDto } from './portalAccessDto.js';
 export interface PortalDetailDto {
     portal: AppDto;
+    /** The portal access this read RESOLVED. When `registered` is false this is the org-shared default the read just repaired the record to, not a record that was found. */
     access: PortalAccessDto;
+    /** Whether the PDP held an access record for this portal BEFORE this read. False means it did not — the portal was invisible to every non-admin member, and this read has registered the org-shared default to repair it. Surfaced rather than hidden because substituting the default and saying nothing rendered "shared with the whole organization" for a portal `listVisible` returned for nobody: a claim the product itself contradicted, with no way for an admin to tell. */
+    registered: boolean;
 }

package/dist/models/portalsControllerListParams.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+export type PortalsControllerListParams = {
+    /**
+     * Page number (1-indexed)
+     * @minimum 1
+     */
+    page?: number;
+    /**
+     * Items per page
+     * @minimum 1
+     * @maximum 100
+     */
+    limit?: number;
+};

package/dist/models/{updateAudiencePolicyDtoRateLimitPerHourPerSubject.d.ts → portalsControllerListParams.js}

@@ -1,11 +1,7 @@
+"use strict";
 /**
  * Generated by @xemahq/api-client-generator — do not edit manually.
  * App Runtime API
  * OpenAPI spec version: 0.1.2
  */
-/**
- * @nullable
- */
-export type UpdateAudiencePolicyDtoRateLimitPerHourPerSubject = {
-    [key: string]: unknown;
-} | null;
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/projectAppsControllerListParams.d.ts

@@ -9,4 +9,8 @@ export type ProjectAppsControllerListParams = {
      */
     projectId?: string;
     slug?: string;
+    /**
+     * Include archived Apps. Default false — an archived App no longer accepts sessions (public ingress and every external-auth flow refuse it), so it is out of the listing unless explicitly asked for.
+     */
+    includeArchived?: boolean;
 };

package/dist/models/requestMagicLinkDto.d.ts

@@ -4,8 +4,10 @@
  * OpenAPI spec version: 0.1.2
  */
 export interface RequestMagicLinkDto {
+    /** AppClient public identifier. */
+    clientId: string;
+    /** Plaintext AppClient secret. Required on EVERY external-auth door, the anonymous one included: "anonymous" describes the subject, never the caller — the App owner controls who may open sessions in its name. */
+    clientSecret: string;
     /** Email address to send the magic-link to. Used as the external subject identifier. */
     email: string;
-    /** AppClient id issuing this auth request. */
-    appClientId: string;
 }

package/dist/models/unarchivePortalDto.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * App Runtime API
+ * OpenAPI spec version: 0.1.2
+ */
+import type { PortalAccessDto } from './portalAccessDto.js';
+export interface UnarchivePortalDto {
+    access?: PortalAccessDto;
+}

package/dist/models/unarchivePortalDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/updateAudiencePolicyDto.d.ts

@@ -4,10 +4,9 @@
  * OpenAPI spec version: 0.1.2
  */
 import type { AudienceUpstreamDto } from './audienceUpstreamDto.js';
-import type { UpdateAudiencePolicyDtoRateLimitPerHourPerSubject } from './updateAudiencePolicyDtoRateLimitPerHourPerSubject.js';
 export interface UpdateAudiencePolicyDto {
     allowedEnvironments?: string[];
     authUpstream?: AudienceUpstreamDto | null;
-    /** @nullable */
-    rateLimitPerHourPerSubject?: UpdateAudiencePolicyDtoRateLimitPerHourPerSubject;
+    rateLimitPerHourPerSubject?: number;
+    rateLimitPerHourPerClient?: number;
 }

package/dist/models/updatePortalDto.d.ts

@@ -3,21 +3,13 @@
  * App Runtime API
  * OpenAPI spec version: 0.1.2
  */
-import type { AppLockfileDto } from './appLockfileDto.js';
-import type { BiomeInstallDto } from './biomeInstallDto.js';
 import type { BrandingConfigDto } from './brandingConfigDto.js';
-import type { CapabilityPolicyOverrideDto } from './capabilityPolicyOverrideDto.js';
 import type { PortalAccessDto } from './portalAccessDto.js';
 export interface UpdatePortalDto {
     displayName?: string;
     defaultZone?: string;
     branding?: BrandingConfigDto;
-    lockfile?: AppLockfileDto;
-    installedBiomes?: BiomeInstallDto[];
-    capabilityPolicy?: CapabilityPolicyOverrideDto[];
-    /** @nullable */
-    subdomain?: string | null;
+    /** Whether this App is reachable on a public host. The host itself is DERIVED, never tenant-chosen — this is the switch for WHETHER, not WHERE. */
     subdomainEnabled?: boolean;
-    defaultAudience?: string;
     access?: PortalAccessDto;
 }

package/dist/models/verifyDelegatedSessionResponseDto.d.ts

@@ -3,12 +3,13 @@
  * App Runtime API
  * OpenAPI spec version: 0.1.2
  */
+import type { DelegatedSessionActorDto } from './delegatedSessionActorDto.js';
 import type { TokenClass } from './tokenClass.js';
 export interface VerifyDelegatedSessionResponseDto {
     /** Id of the App this delegated session was minted FOR (the owning `App.id`, resolved from the backing session row). A consumer edge MUST bind the session to exactly this app before serving app data. */
     appId: string;
     sub: string;
-    act: string;
+    act: DelegatedSessionActorDto;
     org: string;
     project: string;
     session: string;

package/dist/models/verifyMagicLinkResultDto.d.ts

@@ -12,4 +12,6 @@ export interface VerifyMagicLinkResultDto {
     sessionId: string;
     /** Subject ref minted into the token. */
     subjectRef: string;
+    /** ExecutionEnvironment slug the session was minted into. */
+    environment: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/app-platform-api-client",
-  "version": "0.3.9",
+  "version": "0.3.13",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
@@ -20,7 +20,7 @@
     "service": "app-platform-api",
     "biome": "app-platform",
     "target": "server",
-    "generator": "@xemahq/api-client-generator@0.12.1",
+    "generator": "@xemahq/api-client-generator@0.14.1",
     "source": "openapi.public.json"
   },
   "license": "LicenseRef-Xema-BSL-1.1",