ElevenLabs contract maintenance

plugin.json generates the actions from openapi.json, a snapshot of ElevenLabs' published OpenAPI document; sourceUrl records its upstream location. The overlay declares the API host and the xi-api-key header as the security scheme, replacing the optional header parameter the source repeats on every operation. API key, service account key, single-use token, client session token and workspace auth connection management are excluded, as are streaming variants of endpoints that also return the whole result. Released package artifacts are immutable.

Regenerate from the repository root with installed workspace dependencies:

dual openapi-plugin plugins/elevenlabs-api

Refresh the snapshot only deliberately, by downloading sourceUrl into openapi.json, then review the reported action changes before bumping the package version.

src/auth.ts sends the API key as xi-api-key and routes calls to the global API or to the connection's data residency host. src/triggers.ts owns the triggers: the webhook trigger creates an HMAC workspace webhook, keeps the secret returned at creation and verifies the ElevenLabs-Signature header, t=<seconds>,v0=<hex HMAC-SHA256 of "<seconds>.<body>">; the polling trigger pages ended conversations that started within its lookback window.