@xemahq/llm-registry-internal-api-client 0.7.29 → 0.15.1

package/README.md

@@ -59,4 +59,4 @@ from the service's OpenAPI spec.
 
 ## License
 
-Proprietary — © Xema. All rights reserved. — [xema.dev](https://xema.dev)
+LicenseRef-Xema-BSL-1.1 — © Neuralchowder Inc.. All rights reserved.

package/dist/custom-fetch.d.ts

@@ -1,11 +1,21 @@
 /**
  * Configurable fetch wrapper for Orval-generated clients.
  *
- * GENERATED by `@xemahq/api-client-generator` — do not edit. Every client in
- * the fleet ships this file byte-for-byte; a local edit is erased by the next
- * `pnpm refresh` and, until then, makes this one client speak to the platform
- * differently from all of its siblings. Change the template instead:
- * `api-client-generator/src/lib/custom-fetch-template.ts`.
+ * AUTO-GENERATED by `@xemahq/api-client-generator` — DO NOT EDIT. Every client
+ * in the fleet ships this file byte-for-byte; a hand edit is erased by the next
+ * regeneration and, until then, makes this one client speak to the platform
+ * differently from all of its siblings.
+ *
+ * Canonical source: `CANONICAL_CUSTOM_FETCH` in
+ * `packages/sdks/api-client-generator/src/lib/custom-fetch-template.ts`
+ * (repository `xema-kernel-sdk`). Change it there.
+ *
+ * Regenerate, from the root of THIS repository:
+ *   pnpm --filter <owning-service> run openapi
+ *   pnpm --filter <owning-service> run client:generate
+ * A mirror of this client under `xema-host-web` is not regenerated there: it
+ * is written by the frontend bridge, `tooling/frontend-bridge` in the
+ * xema-monorepo aggregator.
  *
  * Consumers must call `configureClient()` before using any endpoint function.
  * The baseUrl is prepended to the relative paths generated by Orval.
@@ -31,6 +41,31 @@ export interface RetryNotice {
     /** HTTP method being re-requested. */
     method: string;
 }
+/**
+ * Per-request context handed to the callbacks this transport awaits BEFORE it
+ * sends the request.
+ *
+ * `signal` is the request's own `AbortSignal` (`options.signal`). It is the
+ * CALLER's cancellation: a callback may use it to stop work that is private to
+ * this request, but a callback serving several requests from one shared,
+ * single-flight acquisition (a token refresh) must NOT abort that shared work
+ * because one caller stopped — every other caller waiting on it would fail.
+ * The transport stops WAITING on its own regardless, so a callback that
+ * ignores the signal still cannot hold an aborted request.
+ */
+export interface ClientCallbackOptions {
+    signal?: AbortSignal;
+}
+/** What {@link ClientConfig.onUnauthorized} is told about the 401 it answers. */
+export interface UnauthorizedContext {
+    /**
+     * The token `getAuthToken` returned for the attempt the server rejected.
+     * `undefined` when no `getAuthToken` produced the Authorization header
+     * (a header from `getHeaders` or no credential at all): there is then no
+     * client-held token to drop.
+     */
+    readonly rejectedToken: string | undefined;
+}
 export interface ClientConfig {
     /**
      * Static base URL (e.g. 'http://localhost:3140') — no trailing slash.
@@ -42,9 +77,13 @@ export interface ClientConfig {
      * the service registry on EVERY request (boot-order-safe). Wired by
      * `configureOrvalClientResolved` from `@xemahq/platform-common`.
      */
-    baseUrlResolver?: () => string | Promise<string>;
-    /** Optional async callback to get an auth token. Auto-sets Authorization header on every request. */
-    getAuthToken?: () => Promise<string>;
+    baseUrlResolver?: (options?: ClientCallbackOptions) => string | Promise<string>;
+    /**
+     * Optional async callback to get an auth token. Auto-sets Authorization
+     * header on every request. Receives the request's signal — see
+     * {@link ClientCallbackOptions} for what it may and may not abort.
+     */
+    getAuthToken?: (options?: ClientCallbackOptions) => Promise<string>;
     /** Optional callback returning headers to inject on every request. Per-call headers take precedence. */
     getHeaders?: () => Record<string, string> | Promise<Record<string, string>>;
     /**
@@ -73,8 +112,12 @@ export interface ClientConfig {
      * Optional callback invoked on a 401 before ONE re-attempt. Supplying it is
      * what opts this client into that re-attempt; without it a 401 comes back to
      * the caller as a `ClientError` like any other 4xx.
+     *
+     * It is told WHAT was rejected (see {@link UnauthorizedContext}), so a
+     * callback that drops a cached credential can drop exactly that one and leave
+     * a newer one, minted by a concurrent request, alone.
      */
-    onUnauthorized?: () => Promise<void>;
+    onUnauthorized?: (context: UnauthorizedContext) => Promise<void>;
     /**
      * Re-attempts for a retryable status. **Defaults to 0 — no retry.**
      *
@@ -97,6 +140,7 @@ export declare class ClientError extends Error {
     readonly url: string;
     readonly body: unknown;
     constructor(status: number, url: string, body: unknown);
+    static [Symbol.hasInstance](candidate: unknown): boolean;
 }
 export declare function configureClient(config: ClientConfig): void;
 export declare function getClientConfig(): ClientConfig;

package/dist/custom-fetch.js

@@ -2,11 +2,21 @@
 /**
  * Configurable fetch wrapper for Orval-generated clients.
  *
- * GENERATED by `@xemahq/api-client-generator` — do not edit. Every client in
- * the fleet ships this file byte-for-byte; a local edit is erased by the next
- * `pnpm refresh` and, until then, makes this one client speak to the platform
- * differently from all of its siblings. Change the template instead:
- * `api-client-generator/src/lib/custom-fetch-template.ts`.
+ * AUTO-GENERATED by `@xemahq/api-client-generator` — DO NOT EDIT. Every client
+ * in the fleet ships this file byte-for-byte; a hand edit is erased by the next
+ * regeneration and, until then, makes this one client speak to the platform
+ * differently from all of its siblings.
+ *
+ * Canonical source: `CANONICAL_CUSTOM_FETCH` in
+ * `packages/sdks/api-client-generator/src/lib/custom-fetch-template.ts`
+ * (repository `xema-kernel-sdk`). Change it there.
+ *
+ * Regenerate, from the root of THIS repository:
+ *   pnpm --filter <owning-service> run openapi
+ *   pnpm --filter <owning-service> run client:generate
+ * A mirror of this client under `xema-host-web` is not regenerated there: it
+ * is written by the frontend bridge, `tooling/frontend-bridge` in the
+ * xema-monorepo aggregator.
  *
  * Consumers must call `configureClient()` before using any endpoint function.
  * The baseUrl is prepended to the relative paths generated by Orval.
@@ -19,6 +29,50 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.customFetch = exports.ClientError = void 0;
 exports.configureClient = configureClient;
 exports.getClientConfig = getClientConfig;
+/**
+ * Cross-package identity for `ClientError`.
+ *
+ * ── THE OUTAGE THIS IS FOR ────────────────────────────────────────────────
+ *
+ * PRODUCTION, 2026-09-22. A session launch aborted on
+ * `HTTP 503 from http://skill-registry-api…/skills`. A 503 is the archetypal
+ * TRANSIENT — agent-session's launch taxonomy already listed it as retryable —
+ * but it was classified PERMANENT and the launch was abandoned.
+ *
+ * The cause was this file. Every generated client package gets its OWN copy of
+ * `ClientError`, so there are as many classes as there are clients (81 at the
+ * time of writing), all byte-identical and all DIFFERENT OBJECTS. A consumer
+ * naturally writes `err instanceof ClientError` against the one client it
+ * imported — which reads as obviously correct and is silently package-local. An
+ * error from any OTHER client fails it, falls past every status check, and lands
+ * on whatever the default is.
+ *
+ * That was not the first time: biome-host had already switched to structural
+ * detection for the same reason, and canopy imports TWO `ClientError` classes
+ * and tests both. Three more call sites elsewhere carry the same shape.
+ *
+ * ── WHY A BRAND AND NOT A SHARED PACKAGE ─────────────────────────────────
+ *
+ * The obvious fix is one shared runtime class every client imports. It was
+ * rejected on measurement: the 81 generated clients are DEPENDENCY-FREE by
+ * design (exactly one has any dependency at all), and a shared class would have
+ * to be a PEER dependency to be safe — a normal dependency can be installed
+ * twice under version skew, which reinstates this identical bug in a form that
+ * is HARDER to see, because the classes then look like they ought to match.
+ *
+ * `Symbol.for` is a process-wide registry keyed by STRING, so every copy of
+ * this template resolves the same symbol without importing anything. The brand
+ * costs no dependency, cannot skew, and needs no new package.
+ *
+ * `Symbol.hasInstance` then makes plain `instanceof` mean the right thing
+ * fleet-wide: an error from ANY generated client satisfies `instanceof
+ * ClientError` in ANY other. A helper would have made the safe pattern
+ * available; this makes the dangerous pattern impossible.
+ *
+ * Narrow on purpose — the brand is set only by this constructor, so an unrelated
+ * error carrying a `status` is not admitted.
+ */
+const CLIENT_ERROR_BRAND = Symbol.for('xema.generatedClientError');
 class ClientError extends Error {
     status;
     url;
@@ -29,10 +83,67 @@ class ClientError extends Error {
         this.url = url;
         this.body = body;
         this.name = 'ClientError';
+        // Non-enumerable: it must not appear in JSON, logs or snapshots — it is an
+        // identity marker, not payload.
+        Object.defineProperty(this, CLIENT_ERROR_BRAND, { value: true });
+    }
+    // `override` because the member shadows `Function.prototype[Symbol.hasInstance]`,
+    // which a class constructor inherits: TypeScript 5.9+ reports TS4114 without it
+    // under `noImplicitOverride`. Measured to compile on 5.5.4, 5.9.3, 6.0.3 and
+    // 7.0.2 with the flag on AND off — pinned by
+    // tests/custom-fetch-compiles-standalone.test.cjs.
+    static [Symbol.hasInstance](candidate) {
+        return (typeof candidate === 'object' &&
+            candidate !== null &&
+            CLIENT_ERROR_BRAND in candidate);
     }
 }
 exports.ClientError = ClientError;
 let clientConfig = null;
+/**
+ * THE MOUNT SCOPE — how one process can host several services without their
+ * clients speaking for each other.
+ *
+ * `clientConfig` below is a MODULE global, and in a single-service process
+ * that is correct: one writer, one configuration. Compose two services into one
+ * process and both call `configureClient` on THIS SAME module instance, so the
+ * second overwrites the first and every outbound call from BOTH services leaves
+ * as whichever wired itself last — wrong base URL, and, because
+ * `getAuthToken` is part of the config, WRONG BEARER. That is one tenant's
+ * service calling a peer holding another tenant's credential, and it is silent.
+ *
+ * A composing host installs a hook under this well-known symbol that answers
+ * one question: WHICH MOUNT is currently on the stack. Nothing else crosses.
+ * `configureClient` then files the config under that mount, and
+ * `getClientConfig` reads it back out under the same key.
+ *
+ * Three properties make this safe rather than clever:
+ *
+ *   - The CONFIG is still built by the mount's own wiring, exactly as today.
+ *     The hook never supplies one. So a mount's base URL and bearer are
+ *     resolved FROM THE MOUNT; the scope only decides which drawer they go in.
+ *     A hook that RETURNED configuration would be a mount taking its identity
+ *     from ambient storage a neighbour can write — the inversion to refuse.
+ *   - The key is an OPAQUE OBJECT and the store is a `WeakMap`, so a mount's
+ *     configuration becomes unreachable when the host drops the mount, and no
+ *     client can enumerate the mounts or reach a sibling's entry.
+ *   - With NO hook installed — every process in the fleet today — both
+ *     functions behave exactly as they did before this existed.
+ *
+ * `Symbol.for` is the seam because a generated client must keep its
+ * dependency surface at zero and a host cannot enumerate the clients a process
+ * happens to load. It is the same instrument, and the same reasoning, as the
+ * `ClientError` brand above.
+ */
+const XEMA_CLIENT_CONFIG_SCOPE = Symbol.for('xema.client-config-scope');
+function mountScopeHook() {
+    const hook = globalThis[XEMA_CLIENT_CONFIG_SCOPE];
+    return typeof hook === 'function' ? hook : undefined;
+}
+function currentMountKey() {
+    return mountScopeHook()?.();
+}
+const perMountConfig = new WeakMap();
 function configureClient(config) {
     // Fail at WIRING time, not on the request that happens to be retried. A
     // client configured to retry without an observer is the exact defect this
@@ -42,9 +153,38 @@ function configureClient(config) {
             'reports is indistinguishable from a slow server, which is how two ' +
             'silent re-attempts were read as a 3,312ms call.');
     }
+    const hook = mountScopeHook();
+    if (hook !== undefined) {
+        const mount = hook();
+        if (mount === undefined) {
+            // A composing host is installed and no member is on the stack, so this
+            // configuration belongs to NO member. Filing it in the module global
+            // would hand it to every member that did not configure this client —
+            // someone else's base URL and bearer, silently.
+            throw new Error('configureClient: called in a composed process outside every member. ' +
+                'Configure the client inside the member that uses it (its providers ' +
+                'and factories already run there).');
+        }
+        perMountConfig.set(mount, config);
+        return;
+    }
     clientConfig = config;
 }
 function getClientConfig() {
+    const mount = currentMountKey();
+    if (mount !== undefined) {
+        const scoped = perMountConfig.get(mount);
+        if (scoped) {
+            return scoped;
+        }
+        // A member that never configured THIS client behaves exactly like a
+        // dedicated service that did not either: it is refused. It used to fall
+        // through to the module global, which in a composed process can only have
+        // been written by some OTHER code — so the member called peers under a
+        // base URL and bearer that were never its own.
+        throw new Error('Client not configured for this member. Call configureClient({ baseUrl }) ' +
+            'inside the member before using endpoint functions.');
+    }
     if (!clientConfig) {
         throw new Error('Client not configured. Call configureClient({ baseUrl }) before using endpoint functions.');
     }
@@ -103,11 +243,64 @@ const CORRELATION_ID_HEADER = 'X-Correlation-Id';
 const BASE_BACKOFF_MS = 1000;
 /** Ceiling on a single backoff, however many attempts have elapsed. */
 const MAX_BACKOFF_MS = 30_000;
-async function buildHeaders(config, callerHeaders) {
+/*
+ * CALLER CANCELLATION REACHES EVERY WAIT BEFORE THE REQUEST IS SENT.
+ *
+ * `fetch` always honoured `options.signal`, but everything this transport
+ * awaits BEFORE `fetch` — base-URL resolution, the header callbacks, the auth
+ * token — did not, so a caller that aborted while a token was being minted sat
+ * out the mint and then, at best, had its request refused. The only way to
+ * cancel that wait was a process-wide interceptor aborting every outbound
+ * request, which also aborts a SHARED single-flight token refresh and so fails
+ * every other caller waiting on it.
+ *
+ * So each pre-send wait is RACED against the signal: the caller stops waiting
+ * at once, and the work it was waiting on carries on for anybody else. The
+ * rejection is the signal's own reason — exactly what `fetch` rejects with —
+ * so a caller sees ONE abort shape whenever it aborts. An aborted request is
+ * never retried. Without a signal nothing here changes.
+ */
+function abortedReason(signal) {
+    // `abort()` with no argument sets a DOMException reason, so this is only
+    // ever `undefined` for a hand-built signal; say so rather than throw it.
+    return signal.reason ?? new DOMException('This operation was aborted', 'AbortError');
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted) {
+        throw abortedReason(signal);
+    }
+}
+function raceAbort(pending, signal) {
+    const promise = Promise.resolve(pending);
+    if (!signal) {
+        return promise;
+    }
+    if (signal.aborted) {
+        promise.catch(() => undefined);
+        return Promise.reject(abortedReason(signal));
+    }
+    return new Promise((resolve, reject) => {
+        const onAbort = () => {
+            // The pending work may be shared; it carries on, and its eventual
+            // rejection must not surface as an unhandled one on this side.
+            promise.catch(() => undefined);
+            reject(abortedReason(signal));
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(value);
+        }, (err) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(err);
+        });
+    });
+}
+async function buildHeaders(config, callerHeaders, signal) {
     const headers = new Headers(callerHeaders);
     // Global headers from config (caller-provided headers take precedence)
     if (config.getHeaders) {
-        const globalHeaders = await Promise.resolve(config.getHeaders());
+        const globalHeaders = await raceAbort(config.getHeaders(), signal);
         for (const [key, value] of Object.entries(globalHeaders)) {
             if (!headers.has(key)) {
                 headers.set(key, value);
@@ -126,17 +319,18 @@ async function buildHeaders(config, callerHeaders) {
     // receiver mints and a new trace begins, which is the truthful outcome when
     // there is nothing to continue.
     if (config.getCorrelationId && !headers.has(CORRELATION_ID_HEADER)) {
-        const correlationId = await Promise.resolve(config.getCorrelationId());
+        const correlationId = await raceAbort(config.getCorrelationId(), signal);
         if (correlationId) {
             headers.set(CORRELATION_ID_HEADER, correlationId);
         }
     }
     // Auth token (caller or global headers take precedence)
+    let authToken;
     if (config.getAuthToken && !headers.has('Authorization')) {
-        const token = await config.getAuthToken();
-        headers.set('Authorization', `Bearer ${token}`);
+        authToken = await raceAbort(config.getAuthToken(signal ? { signal } : undefined), signal);
+        headers.set('Authorization', `Bearer ${authToken}`);
     }
-    return headers;
+    return { headers, authToken };
 }
 /*
  * THE TRANSPORT RETURNS THE BODY UNCHANGED. Do not reintroduce an unwrap here.
@@ -163,8 +357,10 @@ async function buildHeaders(config, callerHeaders) {
  */
 const customFetch = async (url, options) => {
     const config = getClientConfig();
+    const signal = options.signal ?? undefined;
+    throwIfAborted(signal);
     const base = config.baseUrlResolver
-        ? await config.baseUrlResolver()
+        ? await raceAbort(config.baseUrlResolver(signal ? { signal } : undefined), signal)
         : config.baseUrl;
     if (base === undefined) {
         throw new Error('Client not configured: set baseUrl or baseUrlResolver via configureClient().');
@@ -176,8 +372,8 @@ const customFetch = async (url, options) => {
     // re-sending would replay the identical failing request with the identical
     // credential: one wasted round trip, plus a global refresh nobody asked for.
     const callerSuppliedAuth = new Headers(options.headers).has('Authorization');
-    const headers = await buildHeaders(config, options.headers);
-    const requestInit = { ...options, headers };
+    const built = await buildHeaders(config, options.headers, signal);
+    const requestInit = { ...options, headers: built.headers };
     let delay = BASE_BACKOFF_MS;
     for (let attempt = 0;; attempt++) {
         const response = await fetch(fullUrl, requestInit);
@@ -185,11 +381,11 @@ const customFetch = async (url, options) => {
             config.onUnauthorized &&
             !callerSuppliedAuth &&
             attempt === 0) {
-            await config.onUnauthorized();
-            const refreshedHeaders = await buildHeaders(config, options.headers);
+            await raceAbort(config.onUnauthorized({ rejectedToken: built.authToken }), signal);
+            const refreshed = await buildHeaders(config, options.headers, signal);
             const retryResponse = await fetch(fullUrl, {
                 ...options,
-                headers: refreshedHeaders,
+                headers: refreshed.headers,
             });
             const retryBody = await parseBody(retryResponse);
             if (retryResponse.status >= 400) {
@@ -218,20 +414,106 @@ const customFetch = async (url, options) => {
             url: fullUrl,
             method: options.method ?? 'GET',
         });
-        await sleep(waitMs);
+        await sleep(waitMs, signal);
         delay = Math.min(delay * 2, MAX_BACKOFF_MS);
     }
 };
 exports.customFetch = customFetch;
+/**
+ * Does this media type carry JSON?
+ *
+ * ── THE OUTAGE THIS FIXES ────────────────────────────────────────────────
+ *
+ * This used to be `contentType?.includes('application/json')`, and EVERY error
+ * this fleet returns failed that test. The platform's `GlobalExceptionFilter`
+ * emits RFC 9457 problem documents and sets the media type explicitly —
+ * `.type(PROBLEM_DETAILS_CONTENT_TYPE)` before `.json()`, so it cannot be
+ * overridden — and that constant is `application/problem+json`, which does NOT
+ * contain the substring `application/json`: after `application/` comes
+ * `problem+json`.
+ *
+ * So every non-2xx body fell through to `response.text()` and reached the
+ * caller as an UNPARSED STRING. `ClientError.body` is typed `unknown`, so
+ * nothing complained; every consumer that reads a machine-readable code off an
+ * error — `error.body.code`, `error.body.details.code` — silently read
+ * `undefined` instead, for every error, in every service.
+ *
+ * Measured in production on 2026-09-15: skill-registry-api's
+ * `resolveOrNull()` absorbs `RELEASE_CHANNEL_NOT_FOUND` into `null` by exactly
+ * that read. With the code unreadable the absorb never fired, a routine "no
+ * pointer on this channel" 404 became a 500 on `GET /skills` and
+ * `GET /describe-objects`, and agent-session-api's `apply_control_bundle` step
+ * aborted EVERY session launch in the organisation — 7,871 failed resolutions
+ * an hour. A fix written for that exact page months earlier was present in the
+ * running image and could not help, because the classifier it repaired was
+ * being handed a string.
+ *
+ * ── WHY THE STRUCTURED SUFFIX, NOT A SECOND SUBSTRING ────────────────────
+ *
+ * Adding `|| includes('application/problem+json')` would fix this one media
+ * type and leave the next one — `application/vnd.api+json`, and anything else
+ * a service legitimately emits. RFC 6839 defines `+json` as the structured
+ * syntax suffix meaning "this is JSON"; that is the actual rule, so it is the
+ * rule implemented. Parameters are stripped first, because
+ * `application/problem+json; charset=utf-8` is the same media type.
+ */
+function isJsonMediaType(contentType) {
+    if (contentType === null) {
+        return false;
+    }
+    const essence = contentType.split(';')[0]?.trim().toLowerCase() ?? '';
+    return essence === 'application/json' || essence.endsWith('+json');
+}
+/**
+ * Does this media type carry TEXT a caller reads as a string?
+ *
+ * The response body is decoded by its declared media type, in three classes,
+ * and each class matches what the generated function's return type says for
+ * the schema such a route declares:
+ *
+ * - JSON (`application/json` or an RFC 6839 `+json` suffix) → parsed;
+ * - TEXT (`text/*` — including `text/event-stream` — `application/javascript`,
+ *   `application/ecmascript`, `application/xml` or an RFC 7303 `+xml`
+ *   suffix) → a string, which is what a `{ type: string }` schema generates;
+ * - anything else — `application/octet-stream`, `application/gzip`,
+ *   `application/pdf`, an Office document type, any `format: binary` body —
+ *   → a `Blob`, which is what a `format: binary` schema generates.
+ *
+ * Reading every non-JSON body as text, as this transport did until 2026-10-04,
+ * handed a caller typed `Blob` a string: `response.text()` decodes the bytes
+ * as UTF-8, so a PDF or a gzip tarball arrived corrupted under a type that
+ * promised the bytes.
+ *
+ * A response with NO content type is read as text, so an empty body stays the
+ * empty string it always was.
+ */
+function isTextMediaType(contentType) {
+    const essence = contentType.split(';')[0]?.trim().toLowerCase() ?? '';
+    return (essence.startsWith('text/') ||
+        essence === 'application/javascript' ||
+        essence === 'application/ecmascript' ||
+        essence === 'application/xml' ||
+        essence.endsWith('+xml'));
+}
 async function parseBody(response) {
+    // 204 FIRST, and deliberately — this ORDER is carried from `develop`, which
+    // fixed the same defect independently and got this half right where `main`
+    // did not. A 204 carries no body, so `response.json()` on one throws
+    // SyntaxError; and a 204 whose headers STILL declare a JSON content type is
+    // ordinary, because the framework sets the header before the handler returns
+    // nothing. With the JSON branch first, a documented `undefined` becomes a
+    // thrown parse error. Pinned by a case in `transport-problem-json.test.cjs`.
+    if (response.status === 204) {
+        return undefined;
+    }
     const contentType = response.headers.get('content-type');
-    if (contentType?.includes('application/json')) {
+    if (isJsonMediaType(contentType)) {
         return response.json();
     }
-    if (response.status === 204) {
-        return undefined;
+    if (contentType === null || isTextMediaType(contentType)) {
+        return response.text();
     }
-    return response.text();
+    return response.blob();
 }
 function parseRetryAfter(value) {
     if (!value)
@@ -247,7 +529,24 @@ function parseRetryAfter(value) {
 function addJitter(delay) {
     return delay + (Math.random() * 2 - 1) * delay * 0.25;
 }
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+/** A retry backoff; the caller's signal ends it at once and is never retried. */
+function sleep(ms, signal) {
+    if (!signal) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    if (signal.aborted) {
+        return Promise.reject(abortedReason(signal));
+    }
+    return new Promise((resolve, reject) => {
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(abortedReason(signal));
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
 }
 exports.default = exports.customFetch;

package/dist/endpoints/agent-reach-tier-declarations/agent-reach-tier-declarations.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * LLM Registry API
+ * OpenAPI spec version: 0.1.3
+ */
+import type { AgentReachTierDeclarationPageDtoDataEnvelope, InternalAgentReachTierControllerReachTierDeclarationsParams } from '../../models';
+export declare const getInternalAgentReachTierControllerReachTierDeclarationsUrl: (params?: InternalAgentReachTierControllerReachTierDeclarationsParams) => string;
+/**
+ * @summary Every Agent's DECLARED reach-tier ceiling, across every tenant, for a consumer-owned projection.
+ */
+export declare const internalAgentReachTierControllerReachTierDeclarations: (params?: InternalAgentReachTierControllerReachTierDeclarationsParams, options?: RequestInit) => Promise<AgentReachTierDeclarationPageDtoDataEnvelope>;

package/dist/endpoints/agent-reach-tier-declarations/agent-reach-tier-declarations.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.internalAgentReachTierControllerReachTierDeclarations = exports.getInternalAgentReachTierControllerReachTierDeclarationsUrl = void 0;
+const custom_fetch_1 = require("../../custom-fetch");
+const getInternalAgentReachTierControllerReachTierDeclarationsUrl = (params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item === undefined || item === null)
+                    continue;
+                normalizedParams.append(key, item.toString());
+            }
+            return;
+        }
+        normalizedParams.append(key, value.toString());
+    });
+    const stringifiedParams = normalizedParams.toString();
+    return stringifiedParams.length > 0 ? `/internal/agents/reach-tier-declarations?${stringifiedParams}` : `/internal/agents/reach-tier-declarations`;
+};
+exports.getInternalAgentReachTierControllerReachTierDeclarationsUrl = getInternalAgentReachTierControllerReachTierDeclarationsUrl;
+/**
+ * @summary Every Agent's DECLARED reach-tier ceiling, across every tenant, for a consumer-owned projection.
+ */
+const internalAgentReachTierControllerReachTierDeclarations = async (params, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getInternalAgentReachTierControllerReachTierDeclarationsUrl)(params), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.internalAgentReachTierControllerReachTierDeclarations = internalAgentReachTierControllerReachTierDeclarations;

package/dist/endpoints/contribution-sync/contribution-sync.d.ts

@@ -1,2 +1,4 @@
 export declare const getContributionSyncControllerSyncUrl: () => string;
 export declare const contributionSyncControllerSync: (options?: RequestInit) => Promise<void>;
+export declare const getContributionSyncControllerSyncOrgUrl: (orgId: string) => string;
+export declare const contributionSyncControllerSyncOrg: (orgId: string, options?: RequestInit) => Promise<void>;

package/dist/endpoints/contribution-sync/contribution-sync.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.contributionSyncControllerSync = exports.getContributionSyncControllerSyncUrl = void 0;
+exports.contributionSyncControllerSyncOrg = exports.getContributionSyncControllerSyncOrgUrl = exports.contributionSyncControllerSync = exports.getContributionSyncControllerSyncUrl = void 0;
 /**
  * Generated by @xemahq/api-client-generator — do not edit manually.
  * LLM Registry API
@@ -18,3 +18,14 @@ const contributionSyncControllerSync = async (options) => {
     });
 };
 exports.contributionSyncControllerSync = contributionSyncControllerSync;
+const getContributionSyncControllerSyncOrgUrl = (orgId) => {
+    return `/contributions/orgs/${orgId}/sync`;
+};
+exports.getContributionSyncControllerSyncOrgUrl = getContributionSyncControllerSyncOrgUrl;
+const contributionSyncControllerSyncOrg = async (orgId, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getContributionSyncControllerSyncOrgUrl)(orgId), {
+        ...options,
+        method: 'PUT'
+    });
+};
+exports.contributionSyncControllerSyncOrg = contributionSyncControllerSyncOrg;

package/dist/endpoints/internal-managed-model-resolution-rules/internal-managed-model-resolution-rules.d.ts

@@ -3,25 +3,13 @@
  * LLM Registry API
  * OpenAPI spec version: 0.1.3
  */
-import type { ModelResolutionRuleResponseDtoDataEnvelope, RepointDefaultTargetDto, UpsertManagedModelResolutionRuleDto } from '../../models';
+import type { ModelResolutionRuleResponseDtoDataEnvelope, UpsertManagedModelResolutionRuleDto } from '../../models';
 export declare const getManagedModelResolutionRuleControllerUpsertUrl: (orgId: string) => string;
 /**
- * Upserts a rule keyed by (orgId, owner, managedKey). The owner is derived from the authenticated service subject. Re-PUT with the same managedKey updates the rule in place. A managed rule can never be the org default.
+ * Upserts a rule keyed by (orgId, owner, managedKey). The owner is derived from the authenticated service subject. Re-PUT with the same managedKey updates the rule in place.
  * @summary Idempotently upsert a service-owned Model Resolution Matrix rule
  */
 export declare const managedModelResolutionRuleControllerUpsert: (orgId: string, upsertManagedModelResolutionRuleDto: UpsertManagedModelResolutionRuleDto, options?: RequestInit) => Promise<ModelResolutionRuleResponseDtoDataEnvelope>;
-export declare const getManagedModelResolutionRuleControllerRepointDefaultTargetUrl: (orgId: string) => string;
-/**
- * Repoints the TARGET of the org's EXISTING single default rule (empty selector) to a concrete model. Does NOT create a second default, change the selector, or transfer ownership — the rule stays provisioning-owned. Captures the prior target on the first override (for revert) under the authenticated service subject; a second service is refused (403). Fail-fast 404 if the org has no default rule.
- * @summary Repoint ONLY the org default rule's target (managed steer)
- */
-export declare const managedModelResolutionRuleControllerRepointDefaultTarget: (orgId: string, repointDefaultTargetDto: RepointDefaultTargetDto, options?: RequestInit) => Promise<ModelResolutionRuleResponseDtoDataEnvelope>;
-export declare const getManagedModelResolutionRuleControllerRevertDefaultTargetUrl: (orgId: string) => string;
-/**
- * Restores the target captured before the FIRST service override and clears all override state. Idempotent — an absent override is a no-op success. Only the service that set the override may clear it (403 otherwise). Fail-fast 404 if the org has no default rule.
- * @summary Revert the org default rule's target to its pre-override value
- */
-export declare const managedModelResolutionRuleControllerRevertDefaultTarget: (orgId: string, options?: RequestInit) => Promise<ModelResolutionRuleResponseDtoDataEnvelope>;
 export declare const getManagedModelResolutionRuleControllerRemoveUrl: (orgId: string, managedKey: string) => string;
 /**
  * Deletes the caller's own rule identified by (orgId, owner, managedKey). Idempotent — removing a non-existent rule succeeds. Scoped to the authenticated service's ownership; a service can only delete its own rules.