@augstash/sdk 0.2.0 → 0.3.0

package/dist/generated/src/apis/ShipmentApi.js

@@ -0,0 +1,307 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShipmentApi = void 0;
+const runtime = __importStar(require("../runtime"));
+const index_1 = require("../models/index");
+/**
+ *
+ */
+class ShipmentApi extends runtime.BaseAPI {
+    /**
+     * Health comes from the shared connection substrate, so a carrier\'s status here always matches GET /api/v1/integrations/{vendor}. Never returns a credential, and never returns the webhook URL -- that is shown once, at connect. Reads < 300ms. Requires API-key scope: integrations:read.
+     * List every shipment carrier and whether this tenant has connected it
+     */
+    async carriersRaw(initOverrides) {
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/integrations/shipments/carriers`;
+        const response = await this.request({
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => jsonValue.map(index_1.CarrierConnectionResponseFromJSON));
+    }
+    /**
+     * Health comes from the shared connection substrate, so a carrier\'s status here always matches GET /api/v1/integrations/{vendor}. Never returns a credential, and never returns the webhook URL -- that is shown once, at connect. Reads < 300ms. Requires API-key scope: integrations:read.
+     * List every shipment carrier and whether this tenant has connected it
+     */
+    async carriers(initOverrides) {
+        const response = await this.carriersRaw(initOverrides);
+        return await response.value();
+    }
+    /**
+     * Verifies the credentials against the carrier before storing them, so a bad key is refused here rather than discovered later. Credentials are encrypted at rest and are never returned by any endpoint. The response carries the webhook URL to register with the carrier -- it embeds a live credential and is shown ONCE; reconnecting mints a new one and retires the old. Vendor round-trips < 2s. Requires API-key scope: integrations:write.
+     * Connect a shipment carrier for this tenant
+     */
+    async connectIntegrationsShipmentsRaw(requestParameters, initOverrides) {
+        if (requestParameters['carrier'] == null) {
+            throw new runtime.RequiredError('carrier', 'Required parameter "carrier" was null or undefined when calling connectIntegrationsShipments().');
+        }
+        if (requestParameters['connectCarrierRequest'] == null) {
+            throw new runtime.RequiredError('connectCarrierRequest', 'Required parameter "connectCarrierRequest" was null or undefined when calling connectIntegrationsShipments().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/integrations/shipments/carriers/{carrier}`;
+        urlPath = urlPath.replace(`{${"carrier"}}`, encodeURIComponent(String(requestParameters['carrier'])));
+        const response = await this.request({
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: (0, index_1.ConnectCarrierRequestToJSON)(requestParameters['connectCarrierRequest']),
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.CarrierConnectionResponseFromJSON)(jsonValue));
+    }
+    /**
+     * Verifies the credentials against the carrier before storing them, so a bad key is refused here rather than discovered later. Credentials are encrypted at rest and are never returned by any endpoint. The response carries the webhook URL to register with the carrier -- it embeds a live credential and is shown ONCE; reconnecting mints a new one and retires the old. Vendor round-trips < 2s. Requires API-key scope: integrations:write.
+     * Connect a shipment carrier for this tenant
+     */
+    async connectIntegrationsShipments(requestParameters, initOverrides) {
+        const response = await this.connectIntegrationsShipmentsRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * status is the normalised vocabulary and is what to branch on; each event also carries the carrier\'s own label for display. History is newest first and is short by nature -- a parcel has a handful of scans, not a page of them. Reads < 300ms. Requires API-key scope: integrations:read.
+     * Get one tracked shipment and its scan history
+     */
+    async getIntegrationsShipmentsRaw(requestParameters, initOverrides) {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError('id', 'Required parameter "id" was null or undefined when calling getIntegrationsShipments().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/integrations/shipments/{id}`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+        const response = await this.request({
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.ShipmentResponseFromJSON)(jsonValue));
+    }
+    /**
+     * status is the normalised vocabulary and is what to branch on; each event also carries the carrier\'s own label for display. History is newest first and is short by nature -- a parcel has a handful of scans, not a page of them. Reads < 300ms. Requires API-key scope: integrations:read.
+     * Get one tracked shipment and its scan history
+     */
+    async getIntegrationsShipments(requestParameters, initOverrides) {
+        const response = await this.getIntegrationsShipmentsRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Cursor-paginated, newest first by when tracking started here -- pass the previous response\'s nextCursor as ?cursor=; there is no page number and no total (AS-CODE-010). Filter by orderId to answer \"where are this order\'s parcels\", by status to find what is stuck, by carrier to see whether one is reporting. Rows carry each parcel\'s current state and no scan history: fetch GET /{id} for the history of one, which keeps this endpoint\'s cost independent of how often carriers scanned. Reads < 300ms. Requires API-key scope: integrations:read.
+     * List tracked parcels
+     */
+    async listIntegrationsRaw(requestParameters, initOverrides) {
+        const queryParameters = {};
+        if (requestParameters['orderId'] != null) {
+            queryParameters['orderId'] = requestParameters['orderId'];
+        }
+        if (requestParameters['carrier'] != null) {
+            queryParameters['carrier'] = requestParameters['carrier'];
+        }
+        if (requestParameters['status'] != null) {
+            queryParameters['status'] = requestParameters['status'];
+        }
+        if (requestParameters['cursor'] != null) {
+            queryParameters['cursor'] = requestParameters['cursor'];
+        }
+        if (requestParameters['limit'] != null) {
+            queryParameters['limit'] = requestParameters['limit'];
+        }
+        const headerParameters = {};
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/integrations/shipments`;
+        const response = await this.request({
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.CursorPageShipmentSummaryResponseFromJSON)(jsonValue));
+    }
+    /**
+     * Cursor-paginated, newest first by when tracking started here -- pass the previous response\'s nextCursor as ?cursor=; there is no page number and no total (AS-CODE-010). Filter by orderId to answer \"where are this order\'s parcels\", by status to find what is stuck, by carrier to see whether one is reporting. Rows carry each parcel\'s current state and no scan history: fetch GET /{id} for the history of one, which keeps this endpoint\'s cost independent of how often carriers scanned. Reads < 300ms. Requires API-key scope: integrations:read.
+     * List tracked parcels
+     */
+    async listIntegrations(requestParameters = {}, initOverrides) {
+        const response = await this.listIntegrationsRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Removes the parcel and its scan history, so no further status message is sent for it. Use this to correct a mistyped tracking number: the same number can be attached again immediately afterwards, which a stopped-but-kept row would refuse. Where the carrier supports unsubscribing -- EasyPost alone of the four -- it is also told, and carrierNotified says whether that succeeded; for the others their scans keep arriving and are dropped on receipt. Vendor round-trips < 2s. Requires API-key scope: integrations:write.
+     * Stop tracking one parcel
+     */
+    async stopTrackingRaw(requestParameters, initOverrides) {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError('id', 'Required parameter "id" was null or undefined when calling stopTracking().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/integrations/shipments/{id}`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+        const response = await this.request({
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.StopTrackingResponseFromJSON)(jsonValue));
+    }
+    /**
+     * Removes the parcel and its scan history, so no further status message is sent for it. Use this to correct a mistyped tracking number: the same number can be attached again immediately afterwards, which a stopped-but-kept row would refuse. Where the carrier supports unsubscribing -- EasyPost alone of the four -- it is also told, and carrierNotified says whether that succeeded; for the others their scans keep arriving and are dropped on receipt. Vendor round-trips < 2s. Requires API-key scope: integrations:write.
+     * Stop tracking one parcel
+     */
+    async stopTracking(requestParameters, initOverrides) {
+        const response = await this.stopTrackingRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Registers the number with the carrier and starts turning its scans into customer messages, using the tenant\'s existing order-notification rules. The order must belong to this tenant. One order may have several shipments -- a split consignment notifies per parcel. Vendor round-trips < 2s. Requires API-key scope: integrations:write.
+     * Attach a tracking number to an order
+     */
+    async trackRaw(requestParameters, initOverrides) {
+        if (requestParameters['trackShipmentRequest'] == null) {
+            throw new runtime.RequiredError('trackShipmentRequest', 'Required parameter "trackShipmentRequest" was null or undefined when calling track().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/integrations/shipments`;
+        const response = await this.request({
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: (0, index_1.TrackShipmentRequestToJSON)(requestParameters['trackShipmentRequest']),
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.ShipmentResponseFromJSON)(jsonValue));
+    }
+    /**
+     * Registers the number with the carrier and starts turning its scans into customer messages, using the tenant\'s existing order-notification rules. The order must belong to this tenant. One order may have several shipments -- a split consignment notifies per parcel. Vendor round-trips < 2s. Requires API-key scope: integrations:write.
+     * Attach a tracking number to an order
+     */
+    async track(requestParameters, initOverrides) {
+        const response = await this.trackRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+}
+exports.ShipmentApi = ShipmentApi;

package/dist/generated/src/apis/ShipmentWebhookApi.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+import * as runtime from '../runtime';
+export interface ReceiveWebhooksShipmentsRequest {
+    carrier: string;
+    token: string;
+    xIdempotencyKey?: string;
+    body?: string;
+}
+/**
+ * ShipmentWebhookApi - interface
+ *
+ * @export
+ * @interface ShipmentWebhookApiInterface
+ */
+export interface ShipmentWebhookApiInterface {
+    /**
+     * Authenticated by the unguessable path token plus, where the carrier offers one, its own signature or shared secret -- never by a bearer token. Answers 401 to a delivery that does not authenticate and 200 to everything else, including payloads we cannot parse and parcels we do not track: a carrier disables an endpoint that answers non-2xx, which would cost the merchant every parcel. Idempotent -- a replayed scan is recognised by the carrier\'s own event id and changes nothing. Webhook ingest < 1s.
+     * @summary Carrier status webhook (Shippo, EasyPost, Shiprocket, Delhivery)
+     * @param {string} carrier
+     * @param {string} token
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {string} [body]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ShipmentWebhookApiInterface
+     */
+    receiveWebhooksShipmentsRaw(requestParameters: ReceiveWebhooksShipmentsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Authenticated by the unguessable path token plus, where the carrier offers one, its own signature or shared secret -- never by a bearer token. Answers 401 to a delivery that does not authenticate and 200 to everything else, including payloads we cannot parse and parcels we do not track: a carrier disables an endpoint that answers non-2xx, which would cost the merchant every parcel. Idempotent -- a replayed scan is recognised by the carrier\'s own event id and changes nothing. Webhook ingest < 1s.
+     * Carrier status webhook (Shippo, EasyPost, Shiprocket, Delhivery)
+     */
+    receiveWebhooksShipments(requestParameters: ReceiveWebhooksShipmentsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+}
+/**
+ *
+ */
+export declare class ShipmentWebhookApi extends runtime.BaseAPI implements ShipmentWebhookApiInterface {
+    /**
+     * Authenticated by the unguessable path token plus, where the carrier offers one, its own signature or shared secret -- never by a bearer token. Answers 401 to a delivery that does not authenticate and 200 to everything else, including payloads we cannot parse and parcels we do not track: a carrier disables an endpoint that answers non-2xx, which would cost the merchant every parcel. Idempotent -- a replayed scan is recognised by the carrier\'s own event id and changes nothing. Webhook ingest < 1s.
+     * Carrier status webhook (Shippo, EasyPost, Shiprocket, Delhivery)
+     */
+    receiveWebhooksShipmentsRaw(requestParameters: ReceiveWebhooksShipmentsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Authenticated by the unguessable path token plus, where the carrier offers one, its own signature or shared secret -- never by a bearer token. Answers 401 to a delivery that does not authenticate and 200 to everything else, including payloads we cannot parse and parcels we do not track: a carrier disables an endpoint that answers non-2xx, which would cost the merchant every parcel. Idempotent -- a replayed scan is recognised by the carrier\'s own event id and changes nothing. Webhook ingest < 1s.
+     * Carrier status webhook (Shippo, EasyPost, Shiprocket, Delhivery)
+     */
+    receiveWebhooksShipments(requestParameters: ReceiveWebhooksShipmentsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+}

package/dist/generated/src/apis/ShipmentWebhookApi.js

@@ -0,0 +1,102 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShipmentWebhookApi = void 0;
+const runtime = __importStar(require("../runtime"));
+/**
+ *
+ */
+class ShipmentWebhookApi extends runtime.BaseAPI {
+    /**
+     * Authenticated by the unguessable path token plus, where the carrier offers one, its own signature or shared secret -- never by a bearer token. Answers 401 to a delivery that does not authenticate and 200 to everything else, including payloads we cannot parse and parcels we do not track: a carrier disables an endpoint that answers non-2xx, which would cost the merchant every parcel. Idempotent -- a replayed scan is recognised by the carrier\'s own event id and changes nothing. Webhook ingest < 1s.
+     * Carrier status webhook (Shippo, EasyPost, Shiprocket, Delhivery)
+     */
+    async receiveWebhooksShipmentsRaw(requestParameters, initOverrides) {
+        if (requestParameters['carrier'] == null) {
+            throw new runtime.RequiredError('carrier', 'Required parameter "carrier" was null or undefined when calling receiveWebhooksShipments().');
+        }
+        if (requestParameters['token'] == null) {
+            throw new runtime.RequiredError('token', 'Required parameter "token" was null or undefined when calling receiveWebhooksShipments().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/webhooks/shipments/{carrier}/{token}`;
+        urlPath = urlPath.replace(`{${"carrier"}}`, encodeURIComponent(String(requestParameters['carrier'])));
+        urlPath = urlPath.replace(`{${"token"}}`, encodeURIComponent(String(requestParameters['token'])));
+        const response = await this.request({
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: requestParameters['body'],
+        }, initOverrides);
+        return new runtime.VoidApiResponse(response);
+    }
+    /**
+     * Authenticated by the unguessable path token plus, where the carrier offers one, its own signature or shared secret -- never by a bearer token. Answers 401 to a delivery that does not authenticate and 200 to everything else, including payloads we cannot parse and parcels we do not track: a carrier disables an endpoint that answers non-2xx, which would cost the merchant every parcel. Idempotent -- a replayed scan is recognised by the carrier\'s own event id and changes nothing. Webhook ingest < 1s.
+     * Carrier status webhook (Shippo, EasyPost, Shiprocket, Delhivery)
+     */
+    async receiveWebhooksShipments(requestParameters, initOverrides) {
+        await this.receiveWebhooksShipmentsRaw(requestParameters, initOverrides);
+    }
+}
+exports.ShipmentWebhookApi = ShipmentWebhookApi;

package/dist/generated/src/apis/SsoSettingsApi.d.ts

@@ -0,0 +1,159 @@
+/**
+ * Augstash Public API
+ * Every /api/_** response is wrapped in {success, code, data, message, traceId, timestamp}; the schema shown for an operation is what arrives in `data`, and the SDKs unwrap it. Errors carry a stable `code` - branch on that, never on `message`. Authentication is an ask_live_* key on X-Api-Key, or a bearer token. Operations marked \'Not reachable with an ask_live_* API key\' need a user token.
+ *
+ * The version of the OpenAPI document: v1
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+import * as runtime from '../runtime';
+import type { ScimTokenResponse, SsoConnectionResponse, UpsertSsoConnectionRequest } from '../models/index';
+export interface DeleteSettingsRequest {
+    xIdempotencyKey?: string;
+}
+export interface MintScimTokenRequest {
+    xIdempotencyKey?: string;
+}
+export interface RevokeScimTokenRequest {
+    xIdempotencyKey?: string;
+}
+export interface UpsertRequest {
+    upsertSsoConnectionRequest: UpsertSsoConnectionRequest;
+    xIdempotencyKey?: string;
+}
+/**
+ * SsoSettingsApi - interface
+ *
+ * @export
+ * @interface SsoSettingsApiInterface
+ */
+export interface SsoSettingsApiInterface {
+    /**
+     * Writes < 300ms. Deletes the connection and every pushed SCIM group. Users the identity provider created are kept — they are people, with history — and can still sign in with a password once one is set (forgot-password works for them). Requires API-key scope: settings:write.
+     * @summary Remove the workspace\'s single sign-on configuration
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SsoSettingsApiInterface
+     */
+    deleteSettingsRaw(requestParameters: DeleteSettingsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Writes < 300ms. Deletes the connection and every pushed SCIM group. Users the identity provider created are kept — they are people, with history — and can still sign in with a password once one is set (forgot-password works for them). Requires API-key scope: settings:write.
+     * Remove the workspace\'s single sign-on configuration
+     */
+    deleteSettings(requestParameters: DeleteSettingsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Reads < 300ms. Always answers, configured or not: the unconfigured shape still carries the SP entity id, ACS URL and metadata URL the admin needs to set the IdP up first. Certificates are described (subject, SHA-256 fingerprint, validity), never returned; the SCIM token is described by hint and age, never returned. Requires API-key scope: settings:read.
+     * @summary Get the workspace\'s single sign-on configuration
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SsoSettingsApiInterface
+     */
+    getSettingsSsoRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SsoConnectionResponse>>;
+    /**
+     * Reads < 300ms. Always answers, configured or not: the unconfigured shape still carries the SP entity id, ACS URL and metadata URL the admin needs to set the IdP up first. Certificates are described (subject, SHA-256 fingerprint, validity), never returned; the SCIM token is described by hint and age, never returned. Requires API-key scope: settings:read.
+     * Get the workspace\'s single sign-on configuration
+     */
+    getSettingsSso(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SsoConnectionResponse>;
+    /**
+     * Writes < 300ms. Returns the bearer token ONCE, together with the SCIM base URL to paste beside it in Okta / Entra. Minting replaces any previous token immediately. Only its SHA-256 is stored. The token authenticates /scim/v2/_** and nothing else; it is not an API key and carries no API-key scope. Requires API-key scope: settings:write.
+     * @summary Mint a SCIM provisioning token
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SsoSettingsApiInterface
+     */
+    mintScimTokenRaw(requestParameters: MintScimTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ScimTokenResponse>>;
+    /**
+     * Writes < 300ms. Returns the bearer token ONCE, together with the SCIM base URL to paste beside it in Okta / Entra. Minting replaces any previous token immediately. Only its SHA-256 is stored. The token authenticates /scim/v2/_** and nothing else; it is not an API key and carries no API-key scope. Requires API-key scope: settings:write.
+     * Mint a SCIM provisioning token
+     */
+    mintScimToken(requestParameters: MintScimTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ScimTokenResponse>;
+    /**
+     * Writes < 300ms. Every /scim/v2 call with the old token is refused from the next request on. scimEnabled is left as it is — mint a new token to resume. Requires API-key scope: settings:write.
+     * @summary Revoke the SCIM provisioning token
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SsoSettingsApiInterface
+     */
+    revokeScimTokenRaw(requestParameters: RevokeScimTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Writes < 300ms. Every /scim/v2 call with the old token is refused from the next request on. scimEnabled is left as it is — mint a new token to resume. Requires API-key scope: settings:write.
+     * Revoke the SCIM provisioning token
+     */
+    revokeScimToken(requestParameters: RevokeScimTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Writes < 500ms, or a vendor round-trip < 2s when metadataUrl is fetched. The IdP is described by metadataXml (pasted), metadataUrl (fetched, https only) or the manual idpEntityId / idpSsoUrl / idpCertificate — in that precedence. Fields left null keep their stored value. enforced=true is refused until the connection is enabled AND has completed one real sign-in (SSO_ENFORCE_UNVERIFIED); disabling SSO clears enforcement. Workspace owners always keep password sign-in, enforced or not — that is the break-glass path. Requires API-key scope: settings:write.
+     * @summary Create or update the workspace\'s single sign-on configuration
+     * @param {UpsertSsoConnectionRequest} upsertSsoConnectionRequest
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SsoSettingsApiInterface
+     */
+    upsertRaw(requestParameters: UpsertRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SsoConnectionResponse>>;
+    /**
+     * Writes < 500ms, or a vendor round-trip < 2s when metadataUrl is fetched. The IdP is described by metadataXml (pasted), metadataUrl (fetched, https only) or the manual idpEntityId / idpSsoUrl / idpCertificate — in that precedence. Fields left null keep their stored value. enforced=true is refused until the connection is enabled AND has completed one real sign-in (SSO_ENFORCE_UNVERIFIED); disabling SSO clears enforcement. Workspace owners always keep password sign-in, enforced or not — that is the break-glass path. Requires API-key scope: settings:write.
+     * Create or update the workspace\'s single sign-on configuration
+     */
+    upsert(requestParameters: UpsertRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SsoConnectionResponse>;
+}
+/**
+ *
+ */
+export declare class SsoSettingsApi extends runtime.BaseAPI implements SsoSettingsApiInterface {
+    /**
+     * Writes < 300ms. Deletes the connection and every pushed SCIM group. Users the identity provider created are kept — they are people, with history — and can still sign in with a password once one is set (forgot-password works for them). Requires API-key scope: settings:write.
+     * Remove the workspace\'s single sign-on configuration
+     */
+    deleteSettingsRaw(requestParameters: DeleteSettingsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Writes < 300ms. Deletes the connection and every pushed SCIM group. Users the identity provider created are kept — they are people, with history — and can still sign in with a password once one is set (forgot-password works for them). Requires API-key scope: settings:write.
+     * Remove the workspace\'s single sign-on configuration
+     */
+    deleteSettings(requestParameters?: DeleteSettingsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Reads < 300ms. Always answers, configured or not: the unconfigured shape still carries the SP entity id, ACS URL and metadata URL the admin needs to set the IdP up first. Certificates are described (subject, SHA-256 fingerprint, validity), never returned; the SCIM token is described by hint and age, never returned. Requires API-key scope: settings:read.
+     * Get the workspace\'s single sign-on configuration
+     */
+    getSettingsSsoRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SsoConnectionResponse>>;
+    /**
+     * Reads < 300ms. Always answers, configured or not: the unconfigured shape still carries the SP entity id, ACS URL and metadata URL the admin needs to set the IdP up first. Certificates are described (subject, SHA-256 fingerprint, validity), never returned; the SCIM token is described by hint and age, never returned. Requires API-key scope: settings:read.
+     * Get the workspace\'s single sign-on configuration
+     */
+    getSettingsSso(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SsoConnectionResponse>;
+    /**
+     * Writes < 300ms. Returns the bearer token ONCE, together with the SCIM base URL to paste beside it in Okta / Entra. Minting replaces any previous token immediately. Only its SHA-256 is stored. The token authenticates /scim/v2/_** and nothing else; it is not an API key and carries no API-key scope. Requires API-key scope: settings:write.
+     * Mint a SCIM provisioning token
+     */
+    mintScimTokenRaw(requestParameters: MintScimTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ScimTokenResponse>>;
+    /**
+     * Writes < 300ms. Returns the bearer token ONCE, together with the SCIM base URL to paste beside it in Okta / Entra. Minting replaces any previous token immediately. Only its SHA-256 is stored. The token authenticates /scim/v2/_** and nothing else; it is not an API key and carries no API-key scope. Requires API-key scope: settings:write.
+     * Mint a SCIM provisioning token
+     */
+    mintScimToken(requestParameters?: MintScimTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ScimTokenResponse>;
+    /**
+     * Writes < 300ms. Every /scim/v2 call with the old token is refused from the next request on. scimEnabled is left as it is — mint a new token to resume. Requires API-key scope: settings:write.
+     * Revoke the SCIM provisioning token
+     */
+    revokeScimTokenRaw(requestParameters: RevokeScimTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Writes < 300ms. Every /scim/v2 call with the old token is refused from the next request on. scimEnabled is left as it is — mint a new token to resume. Requires API-key scope: settings:write.
+     * Revoke the SCIM provisioning token
+     */
+    revokeScimToken(requestParameters?: RevokeScimTokenRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Writes < 500ms, or a vendor round-trip < 2s when metadataUrl is fetched. The IdP is described by metadataXml (pasted), metadataUrl (fetched, https only) or the manual idpEntityId / idpSsoUrl / idpCertificate — in that precedence. Fields left null keep their stored value. enforced=true is refused until the connection is enabled AND has completed one real sign-in (SSO_ENFORCE_UNVERIFIED); disabling SSO clears enforcement. Workspace owners always keep password sign-in, enforced or not — that is the break-glass path. Requires API-key scope: settings:write.
+     * Create or update the workspace\'s single sign-on configuration
+     */
+    upsertRaw(requestParameters: UpsertRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SsoConnectionResponse>>;
+    /**
+     * Writes < 500ms, or a vendor round-trip < 2s when metadataUrl is fetched. The IdP is described by metadataXml (pasted), metadataUrl (fetched, https only) or the manual idpEntityId / idpSsoUrl / idpCertificate — in that precedence. Fields left null keep their stored value. enforced=true is refused until the connection is enabled AND has completed one real sign-in (SSO_ENFORCE_UNVERIFIED); disabling SSO clears enforcement. Workspace owners always keep password sign-in, enforced or not — that is the break-glass path. Requires API-key scope: settings:write.
+     * Create or update the workspace\'s single sign-on configuration
+     */
+    upsert(requestParameters: UpsertRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SsoConnectionResponse>;
+}