@xemahq/biome-host-api-client 0.3.18 → 0.3.19

package/dist/endpoints/platform-biomes-server/platform-biomes-server.d.ts

@@ -6,7 +6,7 @@
 import type { BiomeContributionResponseDtoDataEnvelope, BiomeInstallSchemaResponseDtoDataEnvelope, BiomeProvisioningScaffoldsResponseDtoDataEnvelope, ServerBiomeRegistrationResponseDtoDataArrayEnvelope, ServerBiomeRegistrationResponseDtoDataEnvelope, ServerBiomesControllerListParams } from '../../models';
 export declare const getServerBiomesControllerListUrl: (params?: ServerBiomesControllerListParams) => string;
 /**
- * @summary List registered server biomes. Pass `?org=<orgId>` (or rely on request context) to filter to biomes with effectiveState=enabled for that org.
+ * @summary List registered server biomes. The org is taken from the `X-Xema-Org-Id` REQUEST CONTEXT — never from a query parameter. When an org resolves, only biomes whose effectiveState is `enabled` for that org are returned. A cross-org SERVICE principal (a token whose request carries no tenant header) gets the global catalog baseline, and is the only caller that may name an org via `?org=`.
  */
 export declare const serverBiomesControllerList: (params?: ServerBiomesControllerListParams, options?: RequestInit) => Promise<ServerBiomeRegistrationResponseDtoDataArrayEnvelope>;
 export declare const getServerBiomesControllerGetUrl: (id: string) => string;

package/dist/endpoints/platform-biomes-server/platform-biomes-server.js

@@ -26,7 +26,7 @@ const getServerBiomesControllerListUrl = (params) => {
 };
 exports.getServerBiomesControllerListUrl = getServerBiomesControllerListUrl;
 /**
- * @summary List registered server biomes. Pass `?org=<orgId>` (or rely on request context) to filter to biomes with effectiveState=enabled for that org.
+ * @summary List registered server biomes. The org is taken from the `X-Xema-Org-Id` REQUEST CONTEXT — never from a query parameter. When an org resolves, only biomes whose effectiveState is `enabled` for that org are returned. A cross-org SERVICE principal (a token whose request carries no tenant header) gets the global catalog baseline, and is the only caller that may name an org via `?org=`.
  */
 const serverBiomesControllerList = async (params, options) => {
     return (0, custom_fetch_1.customFetch)((0, exports.getServerBiomesControllerListUrl)(params), {

package/dist/models/serverBiomesControllerListParams.d.ts

@@ -5,7 +5,7 @@
  */
 export type ServerBiomesControllerListParams = {
     /**
-     * Org id to filter for. When set (or inferred from the caller's request context), only biomes whose effective state is 'enabled' are returned. Omit + send no context to get the global catalog (admin/debug).
+     * Retained for wire-compatibility with existing callers; it does NOT select the org. When the request carries a tenant context (`X-Xema-Org-Id`) this value MUST equal it — a disagreeing value is refused with 403, never silently preferred. Only a cross-org SERVICE principal (whose request legitimately carries no tenant header) may use it to name the org to resolve. Omit it and send no context to get the global catalog baseline.
      */
     org?: unknown;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/biome-host-api-client",
-  "version": "0.3.18",
+  "version": "0.3.19",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [