Outline contract maintenance

plugin.json generates the actions from openapi.yaml, a snapshot of Outline's published OpenAPI document, with openapi.overlay.yaml fixing it; sourceUrl records its upstream location. API key, OAuth client and OAuth authentication management are excluded, as are the authentication configuration and logout endpoints. Released package artifacts are immutable.

The overlay returns attachments.redirect as the file its redirect serves, and narrows documents.export to Markdown: Outline selects other formats and nested export through the Accept header, which generated actions do not send.

Regenerate from the repository root with installed workspace dependencies:

dual openapi-plugin plugins/outline-api

Refresh the snapshot only deliberately, by downloading sourceUrl into openapi.yaml, then review the reported action changes before bumping the package version.

src/auth.ts sends the API key or OAuth access token as a bearer token and routes calls to Outline cloud or to the connection's self-hosted origin. src/triggers.ts owns the triggers: the webhook trigger creates a webhook subscription with a generated secret and verifies the Outline-Signature header, an HMAC-SHA256 of <milliseconds>.<body>; the polling trigger pages documents.list by updatedAt back to its last change time.