@cubist-labs/cubesigner-sdk 0.3.19 → 0.3.23

package/dist/esm/src/schema_types.d.ts

@@ -3,6 +3,7 @@ import { components } from "./schema";
 import { JsonMap } from "./util";
 type schemas = components["schemas"];
 export type UserInfo = schemas["UserInfo"];
+export type UserInOrgMembership = schemas["UserInOrgMembership"];
 export type ConfiguredMfa = schemas["ConfiguredMfa"];
 export type RatchetConfig = schemas["RatchetConfig"];
 export type IdentityProof = schemas["IdentityProof"];
@@ -28,6 +29,8 @@ export type MemberRole = schemas["MemberRole"];
 export type SchemaKeyType = schemas["KeyType"];
 export type ListKeysResponse = schemas["PaginatedListKeysResponse"];
 export type UpdateKeyRequest = schemas["UpdateKeyRequest"];
+export type UpdateKeyProperties = schemas["UpdateKeyProperties"];
+export type CreateKeyRequest = schemas["CreateKeyRequest"];
 export type KeyInfoApi = schemas["KeyInfo"];
 export type KeyInRoleInfo = schemas["KeyInRoleInfo"];
 export type UserInRoleInfo = schemas["UserInRoleInfo"];

package/dist/esm/src/schema_types.js

@@ -1,2 +1,2 @@
 export {};
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hX3R5cGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL3NjaGVtYV90eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgTWZhUG9saWN5IH0gZnJvbSBcIi4vcm9sZVwiO1xuaW1wb3J0IHsgY29tcG9uZW50cyB9IGZyb20gXCIuL3NjaGVtYVwiO1xuaW1wb3J0IHsgSnNvbk1hcCB9IGZyb20gXCIuL3V0aWxcIjtcblxudHlwZSBzY2hlbWFzID0gY29tcG9uZW50c1tcInNjaGVtYXNcIl07XG5cbmV4cG9ydCB0eXBlIFVzZXJJbmZvID0gc2NoZW1hc1tcIlVzZXJJbmZvXCJdO1xuZXhwb3J0IHR5cGUgQ29uZmlndXJlZE1mYSA9IHNjaGVtYXNbXCJDb25maWd1cmVkTWZhXCJdO1xuZXhwb3J0IHR5cGUgUmF0Y2hldENvbmZpZyA9IHNjaGVtYXNbXCJSYXRjaGV0Q29uZmlnXCJdO1xuZXhwb3J0IHR5cGUgSWRlbnRpdHlQcm9vZiA9IHNjaGVtYXNbXCJJZGVudGl0eVByb29mXCJdO1xuZXhwb3J0IHR5cGUgVG90cEluZm8gPSBzY2hlbWFzW1wiVG90cEluZm9cIl07XG5cbmV4cG9ydCB0eXBlIE9pZGNBdXRoUmVzcG9uc2UgPSBzY2hlbWFzW1wiTmV3U2Vzc2lvblJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgQXBpQWRkRmlkb0NoYWxsZW5nZSA9IHNjaGVtYXNbXCJGaWRvQ3JlYXRlQ2hhbGxlbmdlUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBBcGlNZmFGaWRvQ2hhbGxlbmdlID0gc2NoZW1hc1tcIkZpZG9Bc3NlcnRDaGFsbGVuZ2VcIl07XG5cbmV4cG9ydCB0eXBlIFB1YmxpY0tleUNyZWRlbnRpYWxDcmVhdGlvbk9wdGlvbnMgPSBzY2hlbWFzW1wiUHVibGljS2V5Q3JlZGVudGlhbENyZWF0aW9uT3B0aW9uc1wiXTtcbmV4cG9ydCB0eXBlIFB1YmxpY0tleUNyZWRlbnRpYWxSZXF1ZXN0T3B0aW9ucyA9IHNjaGVtYXNbXCJQdWJsaWNLZXlDcmVkZW50aWFsUmVxdWVzdE9wdGlvbnNcIl07XG5leHBvcnQgdHlwZSBQdWJsaWNLZXlDcmVkZW50aWFsUGFyYW1ldGVycyA9IHNjaGVtYXNbXCJQdWJsaWNLZXlDcmVkZW50aWFsUGFyYW1ldGVyc1wiXTtcbmV4cG9ydCB0eXBlIFB1YmxpY0tleUNyZWRlbnRpYWxEZXNjcmlwdG9yID0gc2NoZW1hc1tcIlB1YmxpY0tleUNyZWRlbnRpYWxEZXNjcmlwdG9yXCJdO1xuZXhwb3J0IHR5cGUgQXV0aGVudGljYXRvclNlbGVjdGlvbkNyaXRlcmlhID0gc2NoZW1hc1tcIkF1dGhlbnRpY2F0b3JTZWxlY3Rpb25Dcml0ZXJpYVwiXTtcbmV4cG9ydCB0eXBlIFB1YmxpY0tleUNyZWRlbnRpYWxVc2VyRW50aXR5ID0gc2NoZW1hc1tcIlB1YmxpY0tleUNyZWRlbnRpYWxVc2VyRW50aXR5XCJdO1xuZXhwb3J0IHR5cGUgUHVibGljS2V5Q3JlZGVudGlhbCA9IHNjaGVtYXNbXCJQdWJsaWNLZXlDcmVkZW50aWFsXCJdO1xuXG5leHBvcnQgdHlwZSBPcmdJbmZvID0gc2NoZW1hc1tcIk9yZ0luZm9cIl07XG5leHBvcnQgdHlwZSBVc2VySW5PcmdJbmZvID0gc2NoZW1hc1tcIlVzZXJJbk9yZ0luZm9cIl07XG5leHBvcnQgdHlwZSBVcGRhdGVPcmdSZXF1ZXN0ID0gc2NoZW1hc1tcIlVwZGF0ZU9yZ1JlcXVlc3RcIl07XG5leHBvcnQgdHlwZSBVcGRhdGVPcmdSZXNwb25zZSA9IHNjaGVtYXNbXCJVcGRhdGVPcmdSZXNwb25zZVwiXTtcbmV4cG9ydCB0eXBlIE5vdGlmaWNhdGlvbkVuZHBvaW50Q29uZmlndXJhdGlvbiA9IHNjaGVtYXNbXCJOb3RpZmljYXRpb25FbmRwb2ludENvbmZpZ3VyYXRpb25cIl07XG5leHBvcnQgdHlwZSBPcmdFdmVudHMgPSBzY2hlbWFzW1wiT3JnRXZlbnREaXNjcmltaW5hbnRzXCJdO1xuXG5leHBvcnQgdHlwZSBPaWRjSWRlbnRpdHkgPSBzY2hlbWFzW1wiT0lEQ0lkZW50aXR5XCJdO1xuZXhwb3J0IHR5cGUgTWVtYmVyUm9sZSA9IHNjaGVtYXNbXCJNZW1iZXJSb2xlXCJdO1xuXG5leHBvcnQgdHlwZSBTY2hlbWFLZXlUeXBlID0gc2NoZW1hc1tcIktleVR5cGVcIl07XG5cbmV4cG9ydCB0eXBlIExpc3RLZXlzUmVzcG9uc2UgPSBzY2hlbWFzW1wiUGFnaW5hdGVkTGlzdEtleXNSZXNwb25zZVwiXTtcbmV4cG9ydCB0eXBlIFVwZGF0ZUtleVJlcXVlc3QgPSBzY2hlbWFzW1wiVXBkYXRlS2V5UmVxdWVzdFwiXTtcbmV4cG9ydCB0eXBlIEtleUluZm9BcGkgPSBzY2hlbWFzW1wiS2V5SW5mb1wiXTtcbmV4cG9ydCB0eXBlIEtleUluUm9sZUluZm8gPSBzY2hlbWFzW1wiS2V5SW5Sb2xlSW5mb1wiXTtcbmV4cG9ydCB0eXBlIFVzZXJJblJvbGVJbmZvID0gc2NoZW1hc1tcIlVzZXJJblJvbGVJbmZvXCJdO1xuZXhwb3J0IHR5cGUgS2V5VHlwZUFwaSA9IHNjaGVtYXNbXCJLZXlUeXBlXCJdO1xuXG5leHBvcnQgdHlwZSBMaXN0S2V5Um9sZXNSZXNwb25zZSA9IHNjaGVtYXNbXCJQYWdpbmF0ZWRMaXN0S2V5Um9sZXNSZXNwb25zZVwiXTtcbmV4cG9ydCB0eXBlIExpc3RSb2xlc1Jlc3BvbnNlID0gc2NoZW1hc1tcIlBhZ2luYXRlZExpc3RSb2xlc1Jlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgTGlzdFJvbGVLZXlzUmVzcG9uc2UgPSBzY2hlbWFzW1wiUGFnaW5hdGVkTGlzdFJvbGVLZXlzUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBMaXN0Um9sZVVzZXJzUmVzcG9uc2UgPSBzY2hlbWFzW1wiUGFnaW5hdGVkTGlzdFJvbGVVc2Vyc1Jlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgVXBkYXRlUm9sZVJlcXVlc3QgPSBzY2hlbWFzW1wiVXBkYXRlUm9sZVJlcXVlc3RcIl07XG5leHBvcnQgdHlwZSBLZXlXaXRoUG9saWNpZXNJbmZvID0gc2NoZW1hc1tcIktleUluUm9sZUluZm9cIl07XG5leHBvcnQgdHlwZSBSb2xlSW5mbyA9IHNjaGVtYXNbXCJSb2xlSW5mb1wiXTtcblxuZXhwb3J0IHR5cGUgU2Vzc2lvbkluZm8gPSBzY2hlbWFzW1wiU2Vzc2lvbkluZm9cIl07XG5leHBvcnQgdHlwZSBDbGllbnRTZXNzaW9uSW5mbyA9IHNjaGVtYXNbXCJDbGllbnRTZXNzaW9uSW5mb1wiXTtcbmV4cG9ydCB0eXBlIE5ld1Nlc3Npb25SZXNwb25zZSA9IHNjaGVtYXNbXCJOZXdTZXNzaW9uUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBTZXNzaW9uc1Jlc3BvbnNlID0gc2NoZW1hc1tcIlBhZ2luYXRlZFNlc3Npb25zUmVzcG9uc2VcIl07XG5cbmV4cG9ydCB0eXBlIENyZWF0ZVNpZ25lclNlc3Npb25SZXF1ZXN0ID0gc2NoZW1hc1tcIkNyZWF0ZVRva2VuUmVxdWVzdFwiXTtcbmV4cG9ydCB0eXBlIFJlZnJlc2hTaWduZXJTZXNzaW9uUmVxdWVzdCA9IHNjaGVtYXNbXCJBdXRoRGF0YVwiXTtcblxuZXhwb3J0IHR5cGUgRXZtU2lnblJlcXVlc3QgPSBzY2hlbWFzW1wiRXRoMVNpZ25SZXF1ZXN0XCJdO1xuZXhwb3J0IHR5cGUgRXZtU2lnblJlc3BvbnNlID0gc2NoZW1hc1tcIkV0aDFTaWduUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBFaXAxOTFTaWduUmVxdWVzdCA9IHNjaGVtYXNbXCJFaXAxOTFTaWduUmVxdWVzdFwiXTtcbmV4cG9ydCB0eXBlIEVpcDcxMlNpZ25SZXF1ZXN0ID0gc2NoZW1hc1tcIkVpcDcxMlNpZ25SZXF1ZXN0XCJdO1xuZXhwb3J0IHR5cGUgRWlwMTkxT3I3MTJTaWduUmVzcG9uc2UgPSBzY2hlbWFzW1wiRWlwMTkxT3I3MTJTaWduUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBFdGgyU2lnblJlcXVlc3QgPSBzY2hlbWFzW1wiRXRoMlNpZ25SZXF1ZXN0XCJdO1xuZXhwb3J0IHR5cGUgRXRoMlNpZ25SZXNwb25zZSA9IHNjaGVtYXNbXCJFdGgyU2lnblJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgRXRoMlN0YWtlUmVxdWVzdCA9IHNjaGVtYXNbXCJTdGFrZVJlcXVlc3RcIl07XG5leHBvcnQgdHlwZSBFdGgyU3Rha2VSZXNwb25zZSA9IHNjaGVtYXNbXCJTdGFrZVJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgRXRoMlVuc3Rha2VSZXF1ZXN0ID0gc2NoZW1hc1tcIlVuc3Rha2VSZXF1ZXN0XCJdO1xuZXhwb3J0IHR5cGUgRXRoMlVuc3Rha2VSZXNwb25zZSA9IHNjaGVtYXNbXCJVbnN0YWtlUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBCbG9iU2lnblJlcXVlc3QgPSBzY2hlbWFzW1wiQmxvYlNpZ25SZXF1ZXN0XCJdO1xuZXhwb3J0IHR5cGUgQmxvYlNpZ25SZXNwb25zZSA9IHNjaGVtYXNbXCJCbG9iU2lnblJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgQnRjU2lnblJlcXVlc3QgPSBzY2hlbWFzW1wiQnRjU2lnblJlcXVlc3RcIl07XG5leHBvcnQgdHlwZSBCdGNTaWduUmVzcG9uc2UgPSBzY2hlbWFzW1wiQnRjU2lnblJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgU29sYW5hU2lnblJlcXVlc3QgPSBzY2hlbWFzW1wiU29sYW5hU2lnblJlcXVlc3RcIl07XG5leHBvcnQgdHlwZSBTb2xhbmFTaWduUmVzcG9uc2UgPSBzY2hlbWFzW1wiU29sYW5hU2lnblJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgQXZhU2lnblJlcXVlc3QgPSBzY2hlbWFzW1wiQXZhU2lnblJlcXVlc3RcIl07XG5leHBvcnQgdHlwZSBBdmFTaWduUmVzcG9uc2UgPSBzY2hlbWFzW1wiQXZhU2lnblJlc3BvbnNlXCJdO1xuXG5leHBvcnQgdHlwZSBBY2NlcHRlZFJlc3BvbnNlID0gc2NoZW1hc1tcIkFjY2VwdGVkUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBFcnJvclJlc3BvbnNlID0gc2NoZW1hc1tcIkVycm9yUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBCdGNTaWduYXR1cmVLaW5kID0gc2NoZW1hc1tcIkJ0Y1NpZ25hdHVyZUtpbmRcIl07XG5leHBvcnQgdHlwZSBDc0VyckNvZGUgPSBzY2hlbWFzW1wiU2lnbmVyRXJyb3JDb2RlXCJdO1xuXG5leHBvcnQgdHlwZSBNZmFUeXBlID0gc2NoZW1hc1tcIk1mYVR5cGVcIl07XG5leHBvcnQgdHlwZSBNZmFWb3RlID0gc2NoZW1hc1tcIk1mYVZvdGVcIl07XG5leHBvcnQgdHlwZSBNZmFSZXF1ZXN0SW5mbyA9IHNjaGVtYXNbXCJNZmFSZXF1ZXN0SW5mb1wiXTtcblxuZXhwb3J0IHR5cGUgVXNlckV4cG9ydEluaXRSZXF1ZXN0ID0gc2NoZW1hc1tcIlVzZXJFeHBvcnRJbml0UmVxdWVzdFwiXTtcbmV4cG9ydCB0eXBlIFVzZXJFeHBvcnRJbml0UmVzcG9uc2UgPSBzY2hlbWFzW1wiVXNlckV4cG9ydEluaXRSZXNwb25zZVwiXTtcbmV4cG9ydCB0eXBlIFVzZXJFeHBvcnRDb21wbGV0ZVJlcXVlc3QgPSBzY2hlbWFzW1wiVXNlckV4cG9ydENvbXBsZXRlUmVxdWVzdFwiXTtcbmV4cG9ydCB0eXBlIFVzZXJFeHBvcnRDb21wbGV0ZVJlc3BvbnNlID0gc2NoZW1hc1tcIlVzZXJFeHBvcnRDb21wbGV0ZVJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgVXNlckV4cG9ydExpc3RSZXNwb25zZSA9IHNjaGVtYXNbXCJQYWdpbmF0ZWRVc2VyRXhwb3J0TGlzdFJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgVXNlckV4cG9ydEtleU1hdGVyaWFsID0gc2NoZW1hc1tcIkpzb25LZXlQYWNrYWdlXCJdO1xuXG5leHBvcnQgdHlwZSBFbXB0eSA9IHNjaGVtYXNbXCJFbXB0eUltcGxcIl07XG5cbi8qKiBPcHRpb25zIGZvciBhIG5ldyBPSURDIHVzZXIgKi9cbmV4cG9ydCBpbnRlcmZhY2UgQ3JlYXRlT2lkY1VzZXJPcHRpb25zIHtcbiAgLyoqIFRoZSByb2xlIG9mIGFuIE9JREMgdXNlciwgZGVmYXVsdCBpcyBcIkFsaWVuXCIgKi9cbiAgbWVtYmVyUm9sZT86IE1lbWJlclJvbGU7XG4gIC8qKiBPcHRpb25hbCBNRkEgcG9saWN5IHRvIGFzc29jaWF0ZSB3aXRoIHRoZSB1c2VyIGFjY291bnQgKi9cbiAgbWZhUG9saWN5PzogTWZhUG9saWN5O1xufVxuXG4vKiogQXZhIFAtIG9yIFgtY2hhaW4gdHJhbnNhY3Rpb24gKi9cbmV4cG9ydCB0eXBlIEF2YVR4ID0geyBQOiBBdmFQQ2hhaW5UeCB9IHwgeyBYOiBBdmFYQ2hhaW5UeCB9O1xuXG4vKiogQXZhIFAtY2hhaW4gdHJhbnNhY3Rpb24gKi9cbmV4cG9ydCB0eXBlIEF2YVBDaGFpblR4ID1cbiAgfCB7IEFkZFBlcm1pc3Npb25sZXNzVmFsaWRhdG9yOiBKc29uTWFwIH1cbiAgfCB7IEFkZFN1Ym5ldFZhbGlkYXRvcjogSnNvbk1hcCB9XG4gIHwgeyBBZGRWYWxpZGF0b3I6IEpzb25NYXAgfVxuICB8IHsgQ3JlYXRlQ2hhaW46IEpzb25NYXAgfVxuICB8IHsgQ3JlYXRlU3VibmV0OiBKc29uTWFwIH1cbiAgfCB7IEV4cG9ydDogSnNvbk1hcCB9XG4gIHwgeyBJbXBvcnQ6IEpzb25NYXAgfTtcblxuLyoqIEF2YSBYLWNoYWluIHRyYW5zYWN0aW9uICovXG5leHBvcnQgdHlwZSBBdmFYQ2hhaW5UeCA9IHsgQmFzZTogSnNvbk1hcCB9IHwgeyBFeHBvcnQ6IEpzb25NYXAgfSB8IHsgSW1wb3J0OiBKc29uTWFwIH07XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hX3R5cGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL3NjaGVtYV90eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgTWZhUG9saWN5IH0gZnJvbSBcIi4vcm9sZVwiO1xuaW1wb3J0IHsgY29tcG9uZW50cyB9IGZyb20gXCIuL3NjaGVtYVwiO1xuaW1wb3J0IHsgSnNvbk1hcCB9IGZyb20gXCIuL3V0aWxcIjtcblxudHlwZSBzY2hlbWFzID0gY29tcG9uZW50c1tcInNjaGVtYXNcIl07XG5cbmV4cG9ydCB0eXBlIFVzZXJJbmZvID0gc2NoZW1hc1tcIlVzZXJJbmZvXCJdO1xuZXhwb3J0IHR5cGUgVXNlckluT3JnTWVtYmVyc2hpcCA9IHNjaGVtYXNbXCJVc2VySW5PcmdNZW1iZXJzaGlwXCJdO1xuZXhwb3J0IHR5cGUgQ29uZmlndXJlZE1mYSA9IHNjaGVtYXNbXCJDb25maWd1cmVkTWZhXCJdO1xuZXhwb3J0IHR5cGUgUmF0Y2hldENvbmZpZyA9IHNjaGVtYXNbXCJSYXRjaGV0Q29uZmlnXCJdO1xuZXhwb3J0IHR5cGUgSWRlbnRpdHlQcm9vZiA9IHNjaGVtYXNbXCJJZGVudGl0eVByb29mXCJdO1xuZXhwb3J0IHR5cGUgVG90cEluZm8gPSBzY2hlbWFzW1wiVG90cEluZm9cIl07XG5cbmV4cG9ydCB0eXBlIE9pZGNBdXRoUmVzcG9uc2UgPSBzY2hlbWFzW1wiTmV3U2Vzc2lvblJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgQXBpQWRkRmlkb0NoYWxsZW5nZSA9IHNjaGVtYXNbXCJGaWRvQ3JlYXRlQ2hhbGxlbmdlUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBBcGlNZmFGaWRvQ2hhbGxlbmdlID0gc2NoZW1hc1tcIkZpZG9Bc3NlcnRDaGFsbGVuZ2VcIl07XG5cbmV4cG9ydCB0eXBlIFB1YmxpY0tleUNyZWRlbnRpYWxDcmVhdGlvbk9wdGlvbnMgPSBzY2hlbWFzW1wiUHVibGljS2V5Q3JlZGVudGlhbENyZWF0aW9uT3B0aW9uc1wiXTtcbmV4cG9ydCB0eXBlIFB1YmxpY0tleUNyZWRlbnRpYWxSZXF1ZXN0T3B0aW9ucyA9IHNjaGVtYXNbXCJQdWJsaWNLZXlDcmVkZW50aWFsUmVxdWVzdE9wdGlvbnNcIl07XG5leHBvcnQgdHlwZSBQdWJsaWNLZXlDcmVkZW50aWFsUGFyYW1ldGVycyA9IHNjaGVtYXNbXCJQdWJsaWNLZXlDcmVkZW50aWFsUGFyYW1ldGVyc1wiXTtcbmV4cG9ydCB0eXBlIFB1YmxpY0tleUNyZWRlbnRpYWxEZXNjcmlwdG9yID0gc2NoZW1hc1tcIlB1YmxpY0tleUNyZWRlbnRpYWxEZXNjcmlwdG9yXCJdO1xuZXhwb3J0IHR5cGUgQXV0aGVudGljYXRvclNlbGVjdGlvbkNyaXRlcmlhID0gc2NoZW1hc1tcIkF1dGhlbnRpY2F0b3JTZWxlY3Rpb25Dcml0ZXJpYVwiXTtcbmV4cG9ydCB0eXBlIFB1YmxpY0tleUNyZWRlbnRpYWxVc2VyRW50aXR5ID0gc2NoZW1hc1tcIlB1YmxpY0tleUNyZWRlbnRpYWxVc2VyRW50aXR5XCJdO1xuZXhwb3J0IHR5cGUgUHVibGljS2V5Q3JlZGVudGlhbCA9IHNjaGVtYXNbXCJQdWJsaWNLZXlDcmVkZW50aWFsXCJdO1xuXG5leHBvcnQgdHlwZSBPcmdJbmZvID0gc2NoZW1hc1tcIk9yZ0luZm9cIl07XG5leHBvcnQgdHlwZSBVc2VySW5PcmdJbmZvID0gc2NoZW1hc1tcIlVzZXJJbk9yZ0luZm9cIl07XG5leHBvcnQgdHlwZSBVcGRhdGVPcmdSZXF1ZXN0ID0gc2NoZW1hc1tcIlVwZGF0ZU9yZ1JlcXVlc3RcIl07XG5leHBvcnQgdHlwZSBVcGRhdGVPcmdSZXNwb25zZSA9IHNjaGVtYXNbXCJVcGRhdGVPcmdSZXNwb25zZVwiXTtcbmV4cG9ydCB0eXBlIE5vdGlmaWNhdGlvbkVuZHBvaW50Q29uZmlndXJhdGlvbiA9IHNjaGVtYXNbXCJOb3RpZmljYXRpb25FbmRwb2ludENvbmZpZ3VyYXRpb25cIl07XG5leHBvcnQgdHlwZSBPcmdFdmVudHMgPSBzY2hlbWFzW1wiT3JnRXZlbnREaXNjcmltaW5hbnRzXCJdO1xuXG5leHBvcnQgdHlwZSBPaWRjSWRlbnRpdHkgPSBzY2hlbWFzW1wiT0lEQ0lkZW50aXR5XCJdO1xuZXhwb3J0IHR5cGUgTWVtYmVyUm9sZSA9IHNjaGVtYXNbXCJNZW1iZXJSb2xlXCJdO1xuXG5leHBvcnQgdHlwZSBTY2hlbWFLZXlUeXBlID0gc2NoZW1hc1tcIktleVR5cGVcIl07XG5cbmV4cG9ydCB0eXBlIExpc3RLZXlzUmVzcG9uc2UgPSBzY2hlbWFzW1wiUGFnaW5hdGVkTGlzdEtleXNSZXNwb25zZVwiXTtcbmV4cG9ydCB0eXBlIFVwZGF0ZUtleVJlcXVlc3QgPSBzY2hlbWFzW1wiVXBkYXRlS2V5UmVxdWVzdFwiXTtcbmV4cG9ydCB0eXBlIFVwZGF0ZUtleVByb3BlcnRpZXMgPSBzY2hlbWFzW1wiVXBkYXRlS2V5UHJvcGVydGllc1wiXTtcbmV4cG9ydCB0eXBlIENyZWF0ZUtleVJlcXVlc3QgPSBzY2hlbWFzW1wiQ3JlYXRlS2V5UmVxdWVzdFwiXTtcbmV4cG9ydCB0eXBlIEtleUluZm9BcGkgPSBzY2hlbWFzW1wiS2V5SW5mb1wiXTtcbmV4cG9ydCB0eXBlIEtleUluUm9sZUluZm8gPSBzY2hlbWFzW1wiS2V5SW5Sb2xlSW5mb1wiXTtcbmV4cG9ydCB0eXBlIFVzZXJJblJvbGVJbmZvID0gc2NoZW1hc1tcIlVzZXJJblJvbGVJbmZvXCJdO1xuZXhwb3J0IHR5cGUgS2V5VHlwZUFwaSA9IHNjaGVtYXNbXCJLZXlUeXBlXCJdO1xuXG5leHBvcnQgdHlwZSBMaXN0S2V5Um9sZXNSZXNwb25zZSA9IHNjaGVtYXNbXCJQYWdpbmF0ZWRMaXN0S2V5Um9sZXNSZXNwb25zZVwiXTtcbmV4cG9ydCB0eXBlIExpc3RSb2xlc1Jlc3BvbnNlID0gc2NoZW1hc1tcIlBhZ2luYXRlZExpc3RSb2xlc1Jlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgTGlzdFJvbGVLZXlzUmVzcG9uc2UgPSBzY2hlbWFzW1wiUGFnaW5hdGVkTGlzdFJvbGVLZXlzUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBMaXN0Um9sZVVzZXJzUmVzcG9uc2UgPSBzY2hlbWFzW1wiUGFnaW5hdGVkTGlzdFJvbGVVc2Vyc1Jlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgVXBkYXRlUm9sZVJlcXVlc3QgPSBzY2hlbWFzW1wiVXBkYXRlUm9sZVJlcXVlc3RcIl07XG5leHBvcnQgdHlwZSBLZXlXaXRoUG9saWNpZXNJbmZvID0gc2NoZW1hc1tcIktleUluUm9sZUluZm9cIl07XG5leHBvcnQgdHlwZSBSb2xlSW5mbyA9IHNjaGVtYXNbXCJSb2xlSW5mb1wiXTtcblxuZXhwb3J0IHR5cGUgU2Vzc2lvbkluZm8gPSBzY2hlbWFzW1wiU2Vzc2lvbkluZm9cIl07XG5leHBvcnQgdHlwZSBDbGllbnRTZXNzaW9uSW5mbyA9IHNjaGVtYXNbXCJDbGllbnRTZXNzaW9uSW5mb1wiXTtcbmV4cG9ydCB0eXBlIE5ld1Nlc3Npb25SZXNwb25zZSA9IHNjaGVtYXNbXCJOZXdTZXNzaW9uUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBTZXNzaW9uc1Jlc3BvbnNlID0gc2NoZW1hc1tcIlBhZ2luYXRlZFNlc3Npb25zUmVzcG9uc2VcIl07XG5cbmV4cG9ydCB0eXBlIENyZWF0ZVNpZ25lclNlc3Npb25SZXF1ZXN0ID0gc2NoZW1hc1tcIkNyZWF0ZVRva2VuUmVxdWVzdFwiXTtcbmV4cG9ydCB0eXBlIFJlZnJlc2hTaWduZXJTZXNzaW9uUmVxdWVzdCA9IHNjaGVtYXNbXCJBdXRoRGF0YVwiXTtcblxuZXhwb3J0IHR5cGUgRXZtU2lnblJlcXVlc3QgPSBzY2hlbWFzW1wiRXRoMVNpZ25SZXF1ZXN0XCJdO1xuZXhwb3J0IHR5cGUgRXZtU2lnblJlc3BvbnNlID0gc2NoZW1hc1tcIkV0aDFTaWduUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBFaXAxOTFTaWduUmVxdWVzdCA9IHNjaGVtYXNbXCJFaXAxOTFTaWduUmVxdWVzdFwiXTtcbmV4cG9ydCB0eXBlIEVpcDcxMlNpZ25SZXF1ZXN0ID0gc2NoZW1hc1tcIkVpcDcxMlNpZ25SZXF1ZXN0XCJdO1xuZXhwb3J0IHR5cGUgRWlwMTkxT3I3MTJTaWduUmVzcG9uc2UgPSBzY2hlbWFzW1wiRWlwMTkxT3I3MTJTaWduUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBFdGgyU2lnblJlcXVlc3QgPSBzY2hlbWFzW1wiRXRoMlNpZ25SZXF1ZXN0XCJdO1xuZXhwb3J0IHR5cGUgRXRoMlNpZ25SZXNwb25zZSA9IHNjaGVtYXNbXCJFdGgyU2lnblJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgRXRoMlN0YWtlUmVxdWVzdCA9IHNjaGVtYXNbXCJTdGFrZVJlcXVlc3RcIl07XG5leHBvcnQgdHlwZSBFdGgyU3Rha2VSZXNwb25zZSA9IHNjaGVtYXNbXCJTdGFrZVJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgRXRoMlVuc3Rha2VSZXF1ZXN0ID0gc2NoZW1hc1tcIlVuc3Rha2VSZXF1ZXN0XCJdO1xuZXhwb3J0IHR5cGUgRXRoMlVuc3Rha2VSZXNwb25zZSA9IHNjaGVtYXNbXCJVbnN0YWtlUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBCbG9iU2lnblJlcXVlc3QgPSBzY2hlbWFzW1wiQmxvYlNpZ25SZXF1ZXN0XCJdO1xuZXhwb3J0IHR5cGUgQmxvYlNpZ25SZXNwb25zZSA9IHNjaGVtYXNbXCJCbG9iU2lnblJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgQnRjU2lnblJlcXVlc3QgPSBzY2hlbWFzW1wiQnRjU2lnblJlcXVlc3RcIl07XG5leHBvcnQgdHlwZSBCdGNTaWduUmVzcG9uc2UgPSBzY2hlbWFzW1wiQnRjU2lnblJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgU29sYW5hU2lnblJlcXVlc3QgPSBzY2hlbWFzW1wiU29sYW5hU2lnblJlcXVlc3RcIl07XG5leHBvcnQgdHlwZSBTb2xhbmFTaWduUmVzcG9uc2UgPSBzY2hlbWFzW1wiU29sYW5hU2lnblJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgQXZhU2lnblJlcXVlc3QgPSBzY2hlbWFzW1wiQXZhU2lnblJlcXVlc3RcIl07XG5leHBvcnQgdHlwZSBBdmFTaWduUmVzcG9uc2UgPSBzY2hlbWFzW1wiQXZhU2lnblJlc3BvbnNlXCJdO1xuXG5leHBvcnQgdHlwZSBBY2NlcHRlZFJlc3BvbnNlID0gc2NoZW1hc1tcIkFjY2VwdGVkUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBFcnJvclJlc3BvbnNlID0gc2NoZW1hc1tcIkVycm9yUmVzcG9uc2VcIl07XG5leHBvcnQgdHlwZSBCdGNTaWduYXR1cmVLaW5kID0gc2NoZW1hc1tcIkJ0Y1NpZ25hdHVyZUtpbmRcIl07XG5leHBvcnQgdHlwZSBDc0VyckNvZGUgPSBzY2hlbWFzW1wiU2lnbmVyRXJyb3JDb2RlXCJdO1xuXG5leHBvcnQgdHlwZSBNZmFUeXBlID0gc2NoZW1hc1tcIk1mYVR5cGVcIl07XG5leHBvcnQgdHlwZSBNZmFWb3RlID0gc2NoZW1hc1tcIk1mYVZvdGVcIl07XG5leHBvcnQgdHlwZSBNZmFSZXF1ZXN0SW5mbyA9IHNjaGVtYXNbXCJNZmFSZXF1ZXN0SW5mb1wiXTtcblxuZXhwb3J0IHR5cGUgVXNlckV4cG9ydEluaXRSZXF1ZXN0ID0gc2NoZW1hc1tcIlVzZXJFeHBvcnRJbml0UmVxdWVzdFwiXTtcbmV4cG9ydCB0eXBlIFVzZXJFeHBvcnRJbml0UmVzcG9uc2UgPSBzY2hlbWFzW1wiVXNlckV4cG9ydEluaXRSZXNwb25zZVwiXTtcbmV4cG9ydCB0eXBlIFVzZXJFeHBvcnRDb21wbGV0ZVJlcXVlc3QgPSBzY2hlbWFzW1wiVXNlckV4cG9ydENvbXBsZXRlUmVxdWVzdFwiXTtcbmV4cG9ydCB0eXBlIFVzZXJFeHBvcnRDb21wbGV0ZVJlc3BvbnNlID0gc2NoZW1hc1tcIlVzZXJFeHBvcnRDb21wbGV0ZVJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgVXNlckV4cG9ydExpc3RSZXNwb25zZSA9IHNjaGVtYXNbXCJQYWdpbmF0ZWRVc2VyRXhwb3J0TGlzdFJlc3BvbnNlXCJdO1xuZXhwb3J0IHR5cGUgVXNlckV4cG9ydEtleU1hdGVyaWFsID0gc2NoZW1hc1tcIkpzb25LZXlQYWNrYWdlXCJdO1xuXG5leHBvcnQgdHlwZSBFbXB0eSA9IHNjaGVtYXNbXCJFbXB0eUltcGxcIl07XG5cbi8qKiBPcHRpb25zIGZvciBhIG5ldyBPSURDIHVzZXIgKi9cbmV4cG9ydCBpbnRlcmZhY2UgQ3JlYXRlT2lkY1VzZXJPcHRpb25zIHtcbiAgLyoqIFRoZSByb2xlIG9mIGFuIE9JREMgdXNlciwgZGVmYXVsdCBpcyBcIkFsaWVuXCIgKi9cbiAgbWVtYmVyUm9sZT86IE1lbWJlclJvbGU7XG4gIC8qKiBPcHRpb25hbCBNRkEgcG9saWN5IHRvIGFzc29jaWF0ZSB3aXRoIHRoZSB1c2VyIGFjY291bnQgKi9cbiAgbWZhUG9saWN5PzogTWZhUG9saWN5O1xufVxuXG4vKiogQXZhIFAtIG9yIFgtY2hhaW4gdHJhbnNhY3Rpb24gKi9cbmV4cG9ydCB0eXBlIEF2YVR4ID0geyBQOiBBdmFQQ2hhaW5UeCB9IHwgeyBYOiBBdmFYQ2hhaW5UeCB9O1xuXG4vKiogQXZhIFAtY2hhaW4gdHJhbnNhY3Rpb24gKi9cbmV4cG9ydCB0eXBlIEF2YVBDaGFpblR4ID1cbiAgfCB7IEFkZFBlcm1pc3Npb25sZXNzVmFsaWRhdG9yOiBKc29uTWFwIH1cbiAgfCB7IEFkZFN1Ym5ldFZhbGlkYXRvcjogSnNvbk1hcCB9XG4gIHwgeyBBZGRWYWxpZGF0b3I6IEpzb25NYXAgfVxuICB8IHsgQ3JlYXRlQ2hhaW46IEpzb25NYXAgfVxuICB8IHsgQ3JlYXRlU3VibmV0OiBKc29uTWFwIH1cbiAgfCB7IEV4cG9ydDogSnNvbk1hcCB9XG4gIHwgeyBJbXBvcnQ6IEpzb25NYXAgfTtcblxuLyoqIEF2YSBYLWNoYWluIHRyYW5zYWN0aW9uICovXG5leHBvcnQgdHlwZSBBdmFYQ2hhaW5UeCA9IHsgQmFzZTogSnNvbk1hcCB9IHwgeyBFeHBvcnQ6IEpzb25NYXAgfSB8IHsgSW1wb3J0OiBKc29uTWFwIH07XG4iXX0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cubist-labs/cubesigner-sdk",
-  "version": "0.3.19",
+  "version": "0.3.23",
   "description": "CubeSigner TypeScript SDK",
   "license": "MIT OR Apache-2.0",
   "author": "Cubist, Inc.",

package/src/api.ts

@@ -74,7 +74,7 @@ import { KeyPolicy } from "./role";
 import { EnvInterface } from "./env";
 import { loadSubtleCrypto } from "./user_export";
 import { EventEmitter } from "./events";
-import { NAME, VERSION } from "./index";
+import { NAME, UpdateKeyProperties, VERSION } from "./index";
 
 /** @internal */
 export type Client = ReturnType<typeof createClient<paths>>;
@@ -712,9 +712,15 @@ export class CubeSignerApi {
    * @param {KeyType} keyType The type of key to create.
    * @param {number} count The number of keys to create.
    * @param {string?} ownerId The owner of the keys. Defaults to the session's user.
+   * @param {UpdateKeyProperties?} props Additional key properties
    * @return {KeyInfoApi[]} The new keys.
    */
-  async keysCreate(keyType: KeyType, count: number, ownerId?: string): Promise<KeyInfoApi[]> {
+  async keysCreate(
+    keyType: KeyType,
+    count: number,
+    ownerId?: string,
+    props?: UpdateKeyProperties,
+  ): Promise<KeyInfoApi[]> {
     const chain_id = 0; // not used anymore
     const client = await this.client("createKey");
     const data = await client.post("/v0/org/{org_id}/keys", {
@@ -723,7 +729,8 @@ export class CubeSignerApi {
         count,
         chain_id,
         key_type: keyType,
-        owner: ownerId || null,
+        ...props,
+        owner: props?.owner ?? ownerId,
       },
     });
     return data.keys;

package/src/client.ts

@@ -1,7 +1,13 @@
 import { SignerSessionManager, SignerSessionStorage } from "./session/signer_session_manager";
 import { CubeSignerApi, OidcClient } from "./api";
 import { KeyType, Key } from "./key";
-import { MfaRequestInfo, OrgInfo, PublicKeyCredential, RatchetConfig } from "./schema_types";
+import {
+  MfaRequestInfo,
+  OrgInfo,
+  PublicKeyCredential,
+  RatchetConfig,
+  UpdateKeyProperties,
+} from "./schema_types";
 import { MfaReceipt } from "./mfa";
 import { PageOpts } from "./paginator";
 import { Role } from "./role";
@@ -68,10 +74,12 @@ export class CubeSignerClient extends CubeSignerApi {
    * Create a new signing key.
    * @param {KeyType} type The type of key to create.
    * @param {string?} ownerId The owner of the key. Defaults to the session's user.
+   * @param {UpdateKeyProperties?} props Additional key properties
    * @return {Key[]} The new keys.
    */
-  async createKey(type: KeyType, ownerId?: string): Promise<Key> {
-    return (await this.createKeys(type, 1, ownerId))[0];
+  async createKey(type: KeyType, ownerId?: string, props?: UpdateKeyProperties): Promise<Key> {
+    const keys = await this.keysCreate(type, 1, ownerId, props);
+    return new Key(this, keys[0]);
   }
 
   /**

package/src/env.ts

@@ -16,6 +16,7 @@ export interface EnvInterface {
   Region: string;
   UserPoolId: string;
   SignerApiRoot: string;
+  OrgEventsTopicArn: string;
 }
 
 export const envs: Record<Environment, EnvInterface> = {

package/src/error.ts

@@ -20,7 +20,12 @@ const mfaErrorCodes: CsErrCode[] = [
 /**
  * Opcodes corresponding to all different MFA approve/reject requests
  */
-const mfaOpCodes: (keyof operations)[] = ["mfaVoteCs", "mfaVoteTotp", "mfaVoteFidoComplete"];
+const mfaOpCodes: (keyof operations)[] = [
+  "mfaVoteCs",
+  "userResetTotpComplete",
+  "mfaVoteTotp",
+  "mfaVoteFidoComplete",
+];
 
 /**
  * Error response type, thrown on non-successful responses.

package/src/index.ts

@@ -298,6 +298,8 @@ export * from "./role";
 export * from "./env";
 /** Fido */
 export * from "./mfa";
+/** Utils for processing org events */
+export * from "./org_event_processor";
 /** Pagination */
 export * from "./paginator";
 /** Response */

package/src/org.ts

@@ -132,7 +132,7 @@ export class Org extends CubeSignerClient {
    */
   async setNotificationEndpoints(notification_endpoints: NotificationEndpointConfiguration[]) {
     await this.orgUpdate({
-      notification_endpoints: notification_endpoints as unknown as Record<string, never>[],
+      notification_endpoints,
     });
   }
 

package/src/org_event_processor.ts

@@ -0,0 +1,173 @@
+import { X509Certificate, createVerify } from "crypto";
+import { Environment, envs } from ".";
+
+// URLs that are safe to retrieve certificates from
+const SNS_CERTIFICATE_URL_HOSTS = ["sns.us-east-1.amazonaws.com"];
+
+const SNS_CERTIFICATE_HOST = "sns.amazonaws.com";
+
+/** The common fields of SNS messages */
+export interface SnsMessage {
+  Type: string;
+  MessageId: string;
+  TopicArn: string;
+  Message: string;
+  Timestamp: string;
+  SignatureVersion: string;
+  Signature: string;
+  SigningCertURL: string;
+}
+
+/** The format of a subscription confirmation sent by SNS */
+export interface SubscriptionConfirmationMessage extends SnsMessage {
+  Token: string;
+  SubscribeURL: string;
+}
+
+/** Common fields for an org event */
+export interface OrgEventBase {
+  org: string;
+  utc_timestamp: number;
+  org_event: string;
+}
+
+/** The format of an event message sent by SNS */
+export interface OrgEventMessage extends SnsMessage {
+  Subject?: string;
+  UnsubscribeURL: string;
+}
+
+/** Options for the processor */
+export interface OrgEventProcessorOptions {
+  env: Environment;
+}
+
+/** A utility for processing org event messages */
+export class OrgEventProcessor {
+  readonly #topicArn: string;
+  readonly #orgId: string;
+  #cachedCertificates: Map<URL, X509Certificate>;
+
+  /**
+   * Constructor.
+   * @param {string} orgId The org id
+   * @param {OrgEventProcessorOptions} options Additional options for the processor
+   */
+  constructor(orgId: string, options?: OrgEventProcessorOptions) {
+    this.#topicArn = envs[options?.env ?? "prod"].OrgEventsTopicArn;
+    this.#orgId = orgId;
+    this.#cachedCertificates = new Map();
+  }
+
+  /**
+   * Checks an SNS message and its signature. Throws an error if the message
+   * invalid or the signature is invalid.
+   *
+   * @param {SnsMessage} message The SNS message to check
+   */
+  async checkMessage(message: SnsMessage) {
+    // Check the topic ARN
+    if (message.TopicArn !== this.#topicArn) {
+      throw new Error(`Expected topic ARN '${this.#topicArn}', found '${message.TopicArn}'`);
+    }
+
+    // Both subscription confirmations and org event messages should have no subject
+    if ("Subject" in message) {
+      throw new Error("Expected a message without a subject");
+    }
+
+    // The org events topic uses signature version 2 (SHA256)
+    if (message.SignatureVersion !== "2") {
+      throw new Error("Expected signature version 2");
+    }
+
+    // Retrieve the certificate and sanity check it
+    const certificate = await this.#fetchAndValidateCertificate(new URL(message.SigningCertURL));
+
+    // Extract fields specific to subscription confirmations
+    const subscribeUrl = (message as SubscriptionConfirmationMessage).SubscribeURL;
+    const token = (message as SubscriptionConfirmationMessage).Token;
+
+    // Check the signature
+    const fields = ["Message", message.Message, "MessageId", message.MessageId]
+      .concat(subscribeUrl !== undefined ? ["SubscribeURL", subscribeUrl] : [])
+      .concat(["Timestamp", message.Timestamp])
+      .concat(token !== undefined ? ["Token", token] : [])
+      .concat(["TopicArn", message.TopicArn, "Type", message.Type]);
+    const verify = createVerify("RSA-SHA256");
+    verify.update(fields.join("\n") + "\n");
+    const isValid = verify.verify(certificate.publicKey, message.Signature, "base64");
+    if (!isValid) {
+      throw new Error("The org event has an invalid signature");
+    }
+  }
+
+  /**
+   * Parse an org event and check its signature. Throws an error if the
+   * message is not a valid org event or the signature is invalid.
+   *
+   * @param {OrgEventMessage} message The org event message to check
+   * @return {OrgEventBase} The org event
+   */
+  async parse(message: OrgEventMessage): Promise<OrgEventBase> {
+    await this.checkMessage(message);
+
+    // Check that the event is for the expected org
+    const orgEvent: OrgEventBase = JSON.parse(message.Message);
+    if (orgEvent.org !== this.#orgId) {
+      throw new Error(`Expected org to be '${this.#orgId}', found '${orgEvent.org}'`);
+    }
+
+    return orgEvent;
+  }
+
+  /**
+   * Fetches a certificate from a given URL or from the certificate cache.
+   * Throws an error if the URL does not correspond to an SNS certificate URL.
+   *
+   * Note: Ideally, this method would verify the certificate chain, but there
+   * is no obvious chain. Instead, this method only fetches certificates from
+   * a small set of allowlisted URLs.
+   *
+   * @param {URL} url The URL of the certificate
+   * @return {X509Certificate} The certificate
+   */
+  async #fetchAndValidateCertificate(url: URL): Promise<X509Certificate> {
+    const currTime = new Date().getTime();
+    const cachedCertificate = this.#cachedCertificates.get(url);
+    if (cachedCertificate && currTime < new Date(cachedCertificate.validTo).getTime()) {
+      return cachedCertificate;
+    }
+
+    // Only fetch certificates from HTTPS URLs
+    if (url.protocol !== "https:") {
+      throw new Error("Expected signing certificate URL to use HTTPS");
+    }
+
+    // Only fetch certificate URLs for SNS
+    if (SNS_CERTIFICATE_URL_HOSTS.indexOf(url.host) === -1) {
+      throw new Error("Expected signing certificate URL for SNS in us-east-1");
+    }
+
+    const response = await fetch(url);
+    if (!response.ok) {
+      throw new Error(`Unable to download certificate. Status: ${response.status}`);
+    }
+    const blob = await response.blob();
+    const certificate = new X509Certificate(await blob.text());
+    if (!certificate.checkHost(SNS_CERTIFICATE_HOST)) {
+      throw new Error(`Expected certificate to be for '${SNS_CERTIFICATE_HOST}'`);
+    }
+
+    // Check validity times
+    if (currTime < new Date(certificate.validFrom).getTime()) {
+      throw new Error("Certificate not valid yet");
+    }
+    if (new Date(certificate.validTo).getTime() < currTime) {
+      throw new Error("Certificate expired");
+    }
+
+    this.#cachedCertificates.set(url, certificate);
+    return certificate;
+  }
+}

package/src/schema.ts

@@ -1095,8 +1095,10 @@ export interface components {
       | "InvalidEip191SignRequest"
       | "CannotResendUserInvitation"
       | "InvalidNotificationEndpointCount"
+      | "CannotDeletePendingSubscription"
       | "InvalidNotificationUrlProtocol"
-      | "EmptyOneOfOrgEventFilter";
+      | "EmptyOneOfOrgEventFilter"
+      | "EmptyAllExceptOrgEventFilter";
     /**
      * @example {
      *   "message_base64": "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTYK"
@@ -1215,7 +1217,7 @@ export interface components {
        */
       enclave_signature: string;
     };
-    CreateKeyRequest: {
+    CreateKeyRequest: components["schemas"]["UpdateKeyProperties"] & {
       /**
        * Format: int64
        * @description Chain id for which the key is allowed to sign messages
@@ -1229,11 +1231,6 @@ export interface components {
        */
       count: number;
       key_type: components["schemas"]["KeyType"];
-      /**
-       * @description Allows users to specify a user other than themselves to receive the key
-       * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
-       */
-      owner?: string | null;
     };
     CreateKeyResponse: {
       /** @description The info about the created keys */
@@ -1644,6 +1641,7 @@ export interface components {
       | "UserNotInRole"
       | "MustBeFullMember"
       | "SessionExpired"
+      | "SessionChanged"
       | "SessionRevoked"
       | "ExpectedUserSession"
       | "SessionRoleChanged"
@@ -1899,6 +1897,9 @@ export interface components {
       | "CognitoGetUser"
       | "SnsSubscribeError"
       | "SnsUnsubscribeError"
+      | "SnsGetSubscriptionAttributesError"
+      | "SnsSubscriptionAttributesMissing"
+      | "SnsSetSubscriptionAttributesError"
       | "SnsPublishBatchError";
     InviteRequest: {
       /**
@@ -2215,12 +2216,22 @@ export interface components {
       | "TotpChallengeNotFound"
       | "UserExportRequestNotFound"
       | "UserExportCiphertextNotFound";
+    /** @description The configuration and status of a notification endpoint */
+    NotificationEndpoint: components["schemas"]["NotificationEndpointSubscription"] & {
+      status: components["schemas"]["SubscriptionStatus"];
+    };
     /** @description The configuration for an org event endpoint */
     NotificationEndpointConfiguration: {
       filter?: components["schemas"]["OrgEventFilter"];
       /** @description URL of the endpoint */
       url: string;
     };
+    /** @description A notification endpoint subscription */
+    NotificationEndpointSubscription: {
+      /** @description The ARN of the subscription */
+      arn: string;
+      config: components["schemas"]["NotificationEndpointConfiguration"];
+    };
     /**
      * @description Represents a globally unique OIDC-authorized user by expressing the full "path" to a user. That is:
      *
@@ -2266,6 +2277,7 @@ export interface components {
      * @enum {string}
      */
     OrgEventDiscriminants:
+      | "Billing"
       | "OidcAuth"
       | "Eth2ConcurrentAttestationSigning"
       | "Eth2ConcurrentBlockSigning"
@@ -2279,6 +2291,10 @@ export interface components {
     OrgEventFilter: OneOf<
       [
         "All",
+        {
+          /** @description Accepts all org events other than the ones listed */
+          AllExcept: components["schemas"]["OrgEventDiscriminants"][];
+        },
         {
           /** @description Only accepts org events that are one of the listed events */
           OneOf: components["schemas"]["OrgEventDiscriminants"][];
@@ -2317,11 +2333,28 @@ export interface components {
        * request with a JSON-formatted body that contains the event details.
        * @example [
        *   {
-       *     "url": "https://example.com/endpoint"
+       *     "arn": "arn:aws:sns:us-east-1:012345678901:OrgEventsTopic:12345678-0000-0000-0000-000000000001",
+       *     "config": {
+       *       "url": "https://example.com/endpoint1"
+       *     },
+       *     "status": "Confirmed"
+       *   },
+       *   {
+       *     "arn": "arn:aws:sns:us-east-1:012345678901:OrgEventsTopic:12345678-0000-0000-0000-000000000002",
+       *     "config": {
+       *       "filter": {
+       *         "OneOf": [
+       *           "Eth2ConcurrentAttestationSigning",
+       *           "Eth2ConcurrentBlockSigning"
+       *         ]
+       *       },
+       *       "url": "https://example.com/endpoint2"
+       *     },
+       *     "status": "Pending"
        *   }
        * ]
        */
-      notification_endpoints?: Record<string, never>[];
+      notification_endpoints?: components["schemas"]["NotificationEndpoint"][];
       /**
        * @description The ID of the organization
        * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
@@ -3026,6 +3059,11 @@ export interface components {
        */
       num_auth_factors: number;
     };
+    /**
+     * @description The status of a subscription
+     * @enum {string}
+     */
+    SubscriptionStatus: "Confirmed" | "Pending";
     TokenInfo: {
       /** @description Session ID. Use it to revoke a session. Cannot be used for auth. */
       hash: string;
@@ -3143,19 +3181,14 @@ export interface components {
        */
       signature: string;
     };
-    UpdateKeyRequest: {
-      /**
-       * @description If set, updates the keys's `enabled` property to this value.
-       * Once disabled, a key cannot be used for signing.
-       */
-      enabled?: boolean | null;
+    UpdateKeyProperties: {
       /**
        * @description If set, update this key's metadata. Validation regex: ^[A-Za-z0-9_=+/ \-\.\,]{0,1024}$
        * @example Contract admin key
        */
       metadata?: string | null;
       /**
-       * @description If set, updates key's owner to this value.
+       * @description Allows users to specify a user other than themselves to receive the key
        * The new owner must be an existing user who is a member of the same org.
        * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
        */
@@ -3173,6 +3206,13 @@ export interface components {
        */
       policy?: Record<string, never>[] | null;
     };
+    UpdateKeyRequest: components["schemas"]["UpdateKeyProperties"] & {
+      /**
+       * @description If set, updates the keys's `enabled` property to this value.
+       * Once disabled, a key cannot be used for signing.
+       */
+      enabled?: boolean | null;
+    };
     UpdateOrgRequest: {
       /** @description If set, update this org's `enabled` field to this value. */
       enabled?: boolean | null;
@@ -3218,7 +3258,7 @@ export interface components {
        *   }
        * ]
        */
-      notification_endpoints?: Record<string, never>[] | null;
+      notification_endpoints?: components["schemas"]["NotificationEndpointConfiguration"][] | null;
       /**
        * @description If set, update this org's policies (old policies will be overwritten!).
        * @example [
@@ -3279,7 +3319,7 @@ export interface components {
        *   }
        * ]
        */
-      notification_endpoints?: Record<string, never>[];
+      notification_endpoints?: components["schemas"]["NotificationEndpointConfiguration"][] | null;
       /**
        * @description The ID of the organization
        * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
@@ -3442,6 +3482,18 @@ export interface components {
       /** @description Optional user name. */
       name?: string | null;
     };
+    /**
+     * @description Information about a user's membership in an organization
+     * (without including any info about the user)
+     */
+    UserInOrgMembership: {
+      membership: components["schemas"]["MemberRole"];
+      /**
+       * @description Organization id
+       * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
+       */
+      org_id: string;
+    };
     UserInRoleInfo: {
       user_id: string;
     };
@@ -3461,12 +3513,15 @@ export interface components {
        */
       name?: string | null;
       /**
-       * @description All organizations the user belongs to
+       * @deprecated
+       * @description All organizations the user belongs to. Deprecated in favor of 'orgs'.
        * @example [
        *   "Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a"
        * ]
        */
       org_ids: string[];
+      /** @description All organizations the user belongs to, including the membership role in each. */
+      orgs: components["schemas"]["UserInOrgMembership"][];
       /**
        * @description The id of the currently logged in user
        * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f
@@ -3856,11 +3911,28 @@ export interface components {
            * request with a JSON-formatted body that contains the event details.
            * @example [
            *   {
-           *     "url": "https://example.com/endpoint"
+           *     "arn": "arn:aws:sns:us-east-1:012345678901:OrgEventsTopic:12345678-0000-0000-0000-000000000001",
+           *     "config": {
+           *       "url": "https://example.com/endpoint1"
+           *     },
+           *     "status": "Confirmed"
+           *   },
+           *   {
+           *     "arn": "arn:aws:sns:us-east-1:012345678901:OrgEventsTopic:12345678-0000-0000-0000-000000000002",
+           *     "config": {
+           *       "filter": {
+           *         "OneOf": [
+           *           "Eth2ConcurrentAttestationSigning",
+           *           "Eth2ConcurrentBlockSigning"
+           *         ]
+           *       },
+           *       "url": "https://example.com/endpoint2"
+           *     },
+           *     "status": "Pending"
            *   }
            * ]
            */
-          notification_endpoints?: Record<string, never>[];
+          notification_endpoints?: components["schemas"]["NotificationEndpoint"][];
           /**
            * @description The ID of the organization
            * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
@@ -4188,7 +4260,9 @@ export interface components {
            *   }
            * ]
            */
-          notification_endpoints?: Record<string, never>[];
+          notification_endpoints?:
+            | components["schemas"]["NotificationEndpointConfiguration"][]
+            | null;
           /**
            * @description The ID of the organization
            * @example Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
@@ -4276,12 +4350,15 @@ export interface components {
            */
           name?: string | null;
           /**
-           * @description All organizations the user belongs to
+           * @deprecated
+           * @description All organizations the user belongs to. Deprecated in favor of 'orgs'.
            * @example [
            *   "Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a"
            * ]
            */
           org_ids: string[];
+          /** @description All organizations the user belongs to, including the membership role in each. */
+          orgs: components["schemas"]["UserInOrgMembership"][];
           /**
            * @description The id of the currently logged in user
            * @example User#c3b9379c-4e8c-4216-bd0a-65ace53cf98f

package/src/schema_types.ts

@@ -5,6 +5,7 @@ import { JsonMap } from "./util";
 type schemas = components["schemas"];
 
 export type UserInfo = schemas["UserInfo"];
+export type UserInOrgMembership = schemas["UserInOrgMembership"];
 export type ConfiguredMfa = schemas["ConfiguredMfa"];
 export type RatchetConfig = schemas["RatchetConfig"];
 export type IdentityProof = schemas["IdentityProof"];
@@ -36,6 +37,8 @@ export type SchemaKeyType = schemas["KeyType"];
 
 export type ListKeysResponse = schemas["PaginatedListKeysResponse"];
 export type UpdateKeyRequest = schemas["UpdateKeyRequest"];
+export type UpdateKeyProperties = schemas["UpdateKeyProperties"];
+export type CreateKeyRequest = schemas["CreateKeyRequest"];
 export type KeyInfoApi = schemas["KeyInfo"];
 export type KeyInRoleInfo = schemas["KeyInRoleInfo"];
 export type UserInRoleInfo = schemas["UserInRoleInfo"];