chore: sync API types from platform (1fc3581d)

[johnxing-amigo]

Summary

• Auto-synced openapi.json from amigo-ai/platform spec change
• Regenerated src/generated/api.ts via npm run gen-types
• Typecheck + build + tests verified in CI

Test plan

• npm run typecheck passes
• npm run build passes
• npm test passes
• Review generated type diffs for breaking changes

After merging, publish a new patch release via Actions -> Release -> Run workflow

Generated automatically by SDK Type Sync

[github-actions]

Claude Code Review

Reviewed by specialist agents in .claude/agents/. Buckets: sdk.

---

Code Review — PR #425

Scope: 2 files · +380 / -0 · buckets: sdk
Scope sprawl: OK (1 bucket)

Blockers

None.

Concerns

1. src/generated/api.ts / openapi.json — Two new endpoints (POST …/access-token and POST …/switch-mode) land as generated types but there is no matching resource-layer wrapper in this PR, so consumers cannot reach them through the typed client.
   Why: Rule 7 — public surface additions should ship with the resource wiring and tests that make them usable; otherwise the type sync produces dead API surface.
   Fix: Confirm whether resource methods are auto-derived. If not, land the resource additions + tests (and api.md updates) before or alongside the patch release, or explicitly defer in the PR body.

2. PR checklist — "Review generated type diffs for breaking changes" is unchecked on an automated sync PR.
   Why: Rule 4 — generated diffs are the only place where breaking changes to the public surface can slip in silently on a bot PR.
   Fix: Human reviewer should tick the box after confirming the diff is purely additive (spot-check: no removed operations, no renamed schema components, no narrowed types on existing operations). The diff as reviewed appears additive.

Suggestions

1. openapi.json — RunAccessTokenResponse.token is a bearer credential typed as a plain string. Consider annotating it (format: password or x-sensitive: true) upstream so any future logging/serialization helper in the SDK can redact it.
2. openapi.json — The /access-token description lacks the "no impersonation" qualifier that /switch-mode carries, even though the body accepts operator_id. Worth confirming server-side enforcement and mirroring the qualifier in the spec description so SDK consumers don't assume they can mint tokens for arbitrary operators.
3. openapi.json:RunSwitchModeRequest.participant_call_sid — maxLength: 64 is dropped by codegen. If the SDK does client-side validation elsewhere, add it at the resource layer when wiring the endpoint.
4. If neighboring run operations use branded ID types for workspace_id/run_id, update the generator config so the two new operations emit the same brands rather than raw string.

What's good

• Purely additive change; no existing operations, schemas, exports, or signatures modified.
• Generated types faithfully mirror the spec: conference_sid correctly rendered as string | null | undefined, mode narrowed to the "listen" | "takeover" literal union.
• No hand-written duplicates of generated types; codegen path respected.
• No runtime dependencies or workflow files touched.

Verdict

MERGE AFTER BLOCKERS FIXED — no hard blockers, but a human reviewer should complete the breaking-change checklist item and confirm the resource-layer follow-up plan before this bot PR ships in a patch release.

---

Skip automated reviews by including [skip review] in the PR title.

[johnxing-amigo]

Superseded by rolling SDK sync PR #432.