@epilot/sdk 2.20.69 → 2.20.71

package/definitions/identity-runtime.json

@@ -1 +1 @@
-{"s":"https://id.epilot.cloud","o":[["listClients","get","/v1/identity/operator/clients",[["PartnerKeyQuery"],["ClientStatusQuery"],["SizeQuery"],["CursorQuery"]]],["createOidcClient","post","/v1/identity/operator/clients",null,1],["getOidcClient","get","/v1/identity/operator/clients/{client_id}"],["updateClient","put","/v1/identity/operator/clients/{client_id}",null,1],["retireClient","delete","/v1/identity/operator/clients/{client_id}"],["activateClient","post","/v1/identity/operator/clients/{client_id}:activate"],["suspendClient","post","/v1/identity/operator/clients/{client_id}:suspend",null,1],["rotateClientSecret","post","/v1/identity/operator/clients/{client_id}:rotateSecret",null,1],["listClientOrganizations","get","/v1/identity/operator/clients/{client_id}/organizations",[["OrgEnablementStatusQuery"]]],["enableClientOrganization","post","/v1/identity/operator/clients/{client_id}/organizations",null,1],["getClientOrganization","get","/v1/identity/operator/clients/{client_id}/organizations/{org_id}"],["updateClientOrganization","put","/v1/identity/operator/clients/{client_id}/organizations/{org_id}",null,1],["revokeClientOrganization","delete","/v1/identity/operator/clients/{client_id}/organizations/{org_id}",null,1],["suspendClientOrganization","post","/v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend",null,1],["activateClientOrganization","post","/v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate"],["createIdentitySession","get","/v1/identity/session"],["deleteIdentitySession","delete","/v1/identity/session"],["launchClient","get","/v1/identity/launch/{client_id}",[["target","q"],["AnyOtherQueryParameters"]]]],"v":"3.0.3","cp":{"AnyOtherQueryParameters":["extra","q",false,"form",true],"ClientIdPath":["client_id","p",true],"OrgIdPath":["org_id","p",true],"PartnerKeyQuery":["partner_key","q"],"ClientStatusQuery":["status","q"],"OrgEnablementStatusQuery":["status","q"],"SizeQuery":["size","q"],"CursorQuery":["cursor","q"]},"pp":{"/v1/identity/operator/clients/{client_id}":[["ClientIdPath"]],"/v1/identity/operator/clients/{client_id}:activate":[["ClientIdPath"]],"/v1/identity/operator/clients/{client_id}:suspend":[["ClientIdPath"]],"/v1/identity/operator/clients/{client_id}:rotateSecret":[["ClientIdPath"]],"/v1/identity/operator/clients/{client_id}/organizations":[["ClientIdPath"]],"/v1/identity/operator/clients/{client_id}/organizations/{org_id}":[["ClientIdPath"],["OrgIdPath"]],"/v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend":[["ClientIdPath"],["OrgIdPath"]],"/v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate":[["ClientIdPath"],["OrgIdPath"]],"/v1/identity/interaction/{interaction_id}":[["interaction_id","p",true]],"/v1/identity/launch/{client_id}":[["ClientIdPath"]]}}
+{"s":"https://id.epilot.cloud","o":[["listClients","get","/v1/identity/operator/clients",[["PartnerKeyQuery"],["ClientStatusQuery"],["SizeQuery"],["CursorQuery"]]],["createOidcClient","post","/v1/identity/operator/clients",null,1],["getOidcClient","get","/v1/identity/operator/clients/{client_id}"],["updateClient","put","/v1/identity/operator/clients/{client_id}",null,1],["retireClient","delete","/v1/identity/operator/clients/{client_id}"],["activateClient","post","/v1/identity/operator/clients/{client_id}:activate"],["suspendClient","post","/v1/identity/operator/clients/{client_id}:suspend",null,1],["rotateClientSecret","post","/v1/identity/operator/clients/{client_id}:rotateSecret",null,1],["listClientOrganizations","get","/v1/identity/operator/clients/{client_id}/organizations",[["OrgEnablementStatusQuery"]]],["enableClientOrganization","post","/v1/identity/operator/clients/{client_id}/organizations",null,1],["getClientOrganization","get","/v1/identity/operator/clients/{client_id}/organizations/{org_id}"],["updateClientOrganization","put","/v1/identity/operator/clients/{client_id}/organizations/{org_id}",null,1],["revokeClientOrganization","delete","/v1/identity/operator/clients/{client_id}/organizations/{org_id}",null,1],["suspendClientOrganization","post","/v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend",null,1],["activateClientOrganization","post","/v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate"],["getUserSubject","get","/v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject"],["createIdentitySession","get","/v1/identity/session"],["deleteIdentitySession","delete","/v1/identity/session"],["launchClient","get","/v1/identity/launch/{client_id}",[["target","q"],["AnyOtherQueryParameters"]]]],"v":"3.0.3","cp":{"AnyOtherQueryParameters":["extra","q",false,"form",true],"ClientIdPath":["client_id","p",true],"OrgIdPath":["org_id","p",true],"UserIdPath":["user_id","p",true],"PartnerKeyQuery":["partner_key","q"],"ClientStatusQuery":["status","q"],"OrgEnablementStatusQuery":["status","q"],"SizeQuery":["size","q"],"CursorQuery":["cursor","q"]},"pp":{"/v1/identity/operator/clients/{client_id}":[["ClientIdPath"]],"/v1/identity/operator/clients/{client_id}:activate":[["ClientIdPath"]],"/v1/identity/operator/clients/{client_id}:suspend":[["ClientIdPath"]],"/v1/identity/operator/clients/{client_id}:rotateSecret":[["ClientIdPath"]],"/v1/identity/operator/clients/{client_id}/organizations":[["ClientIdPath"]],"/v1/identity/operator/clients/{client_id}/organizations/{org_id}":[["ClientIdPath"],["OrgIdPath"]],"/v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend":[["ClientIdPath"],["OrgIdPath"]],"/v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate":[["ClientIdPath"],["OrgIdPath"]],"/v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject":[["ClientIdPath"],["OrgIdPath"],["UserIdPath"]],"/v1/identity/interaction/{interaction_id}":[["interaction_id","p",true]],"/v1/identity/launch/{client_id}":[["ClientIdPath"]]}}

package/definitions/identity.json

@@ -37,6 +37,11 @@
     "/v1/identity/operator/clients": {
       "get": {
         "operationId": "listClients",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "listClients",
         "description": "List registered partner clients. The client secret is never returned.",
         "tags": [
@@ -77,6 +82,11 @@
       },
       "post": {
         "operationId": "createOidcClient",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "createOidcClient",
         "description": "Create a partner client in `draft` status. The client secret is returned exactly once in this\nresponse and can never be read again; use `rotateClientSecret` to obtain a new one.\n",
         "tags": [
@@ -123,6 +133,11 @@
       ],
       "get": {
         "operationId": "getOidcClient",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "getOidcClient",
         "description": "Read a partner client. The client secret is never returned.",
         "tags": [
@@ -152,6 +167,11 @@
       },
       "put": {
         "operationId": "updateClient",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "updateClient",
         "description": "Replace the mutable configuration of a client. `config_version` must equal the current\nversion (compare-and-swap); a mismatch is rejected with `409`.\n",
         "tags": [
@@ -197,6 +217,11 @@
       },
       "delete": {
         "operationId": "retireClient",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "retireClient",
         "description": "Retire a client. The record is kept as a tombstone, the `client_id` is never reused, every\norganization enablement is revoked and all provider-side artefacts are revoked.\n",
         "tags": [
@@ -233,6 +258,11 @@
       ],
       "post": {
         "operationId": "activateClient",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "activateClient",
         "description": "Activate a `draft` or `suspended` client. Validates that every redirect URI is an absolute\nHTTPS URL without fragment, that `scopes_allowed` contains `openid`, and that the\nauthentication method is `client_secret_basic`.\n",
         "tags": [
@@ -275,6 +305,11 @@
       ],
       "post": {
         "operationId": "suspendClient",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "suspendClient",
         "description": "Immediately block the client for every organization. Provider-side artefacts (codes, tokens,\ngrants) are revoked; the audit trail is kept. Reversible with `activateClient`.\n",
         "tags": [
@@ -324,6 +359,11 @@
       ],
       "post": {
         "operationId": "rotateClientSecret",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "rotateClientSecret",
         "description": "Issue a new client secret. The new secret is returned exactly once. The previous secret\nkeeps working until `previous_secret_expires_at` unless `compromise_mode` is set, in which\ncase it stops working immediately.\n",
         "tags": [
@@ -373,6 +413,11 @@
       ],
       "get": {
         "operationId": "listClientOrganizations",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "listClientOrganizations",
         "description": "List the organizations enabled on a client, including suspended and revoked ones.",
         "tags": [
@@ -407,6 +452,11 @@
       },
       "post": {
         "operationId": "enableClientOrganization",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "enableClientOrganization",
         "description": "Enable an epilot organization on a client, recording the customer's authorization policy\n(version 1). `allowed_scopes` must contain `openid` and be a subset of the client's\n`scopes_allowed`.\n",
         "tags": [
@@ -462,6 +512,11 @@
       ],
       "get": {
         "operationId": "getClientOrganization",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "getClientOrganization",
         "description": "Read one organization enablement.",
         "tags": [
@@ -491,6 +546,11 @@
       },
       "put": {
         "operationId": "updateClientOrganization",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "updateClientOrganization",
         "description": "Record a new version of the customer's authorization policy. `expected_policy_version` must\nequal the current version (compare-and-swap); a mismatch is rejected with `409`.\n",
         "tags": [
@@ -536,6 +596,11 @@
       },
       "delete": {
         "operationId": "revokeClientOrganization",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "revokeClientOrganization",
         "description": "Revoke an organization's enablement. The record is kept as an audited tombstone; future\nauthorizations for this organization fail with `access_denied` and provider-side artefacts\nbound to it are revoked.\n",
         "tags": [
@@ -585,6 +650,11 @@
       ],
       "post": {
         "operationId": "suspendClientOrganization",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "suspendClientOrganization",
         "description": "Temporarily block one organization on this client. Reversible with `activateClientOrganization`.",
         "tags": [
@@ -637,6 +707,11 @@
       ],
       "post": {
         "operationId": "activateClientOrganization",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
         "summary": "activateClientOrganization",
         "description": "Resume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization again (`POST …/organizations`) replaces the revoked entry and continues its policy version.",
         "tags": [
@@ -668,11 +743,90 @@
         }
       }
     },
+    "/v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/ClientIdPath"
+        },
+        {
+          "$ref": "#/components/parameters/OrgIdPath"
+        },
+        {
+          "$ref": "#/components/parameters/UserIdPath"
+        }
+      ],
+      "get": {
+        "operationId": "getUserSubject",
+        "x-epilot-permissions": [
+          {
+            "access": "internal"
+          }
+        ],
+        "summary": "getUserSubject",
+        "description": "The pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its\nside **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with\n`externalId = sub`).\n\nDerived exactly as the token endpoint derives it, never stored:\n`sub = key_version + \".\" + base64url(HMAC-SHA256(key[key_version], sector + \"\\n\" + user_id))`, where the\nsector is the client's `sector_identifier_uri` host or, without one, the host of its first redirect URI.\nThe same inputs always give the same value; it changes only when the client's sector or the active key\nversion changes.\n\nRequires an **active** client (a draft client's sector may still change and would invalidate every binding),\nan organization enablement that is not revoked, and the user being an active member of that organization\n(checked live against user-api). Every read is written to the audit trail: the value is a partner-facing\nidentifier.\n",
+        "tags": [
+          "Operator Organizations"
+        ],
+        "responses": {
+          "200": {
+            "description": "The subject this client sees for the user",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UserSubject"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "user_id is not the canonical epilot user id (the spelling 360 tokens carry)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "description": "Client, enablement or active organization membership not found",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "Client not active, or the organization's enablement is revoked",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/v1/identity/session": {
       "get": {
         "operationId": "createIdentitySession",
+        "x-epilot-permissions": [
+          {
+            "access": "self"
+          }
+        ],
         "summary": "createIdentitySession",
-        "description": "Called by the epilot portal through the portal-host proxy after every persisted 360 session.\nValidates the 360 bearer token itself and mirrors it into the `identity_session` cookie\n(`HttpOnly; Secure; Path=/v1/identity`) whose lifetime equals the remaining token lifetime.\nThe cookie is what proves the live 360 session during `completeInteraction`.\n",
+        "description": "Called by the epilot portal through the portal-host proxy after every persisted 360 session.\nValidates the 360 bearer token itself and mirrors it into the `identity_session` cookie\n(`HttpOnly; Secure; Path=/v1/identity`) whose lifetime is the remaining token lifetime, capped at 15 minutes\n(the portal mirrors the credential again on every token refresh and just before a partner sign-in).\nThe cookie is what proves the live 360 session during `completeInteraction`.\n",
         "tags": [
           "Session"
         ],
@@ -686,7 +840,7 @@
             "description": "Session mirrored into the cookie",
             "headers": {
               "Set-Cookie": {
-                "description": "`identity_session=<360 ID token>; HttpOnly; Secure; SameSite=None; Path=/v1/identity; Max-Age=<remaining lifetime>`",
+                "description": "`identity_session=<360 ID token>; HttpOnly; Secure; SameSite=None; Path=/v1/identity; Max-Age=<remaining lifetime, at most 900>`",
                 "schema": {
                   "type": "string"
                 }
@@ -845,6 +999,14 @@
           "$ref": "#/components/schemas/OrgId"
         }
       },
+      "UserIdPath": {
+        "name": "user_id",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "$ref": "#/components/schemas/UserId"
+        }
+      },
       "PartnerKeyQuery": {
         "name": "partner_key",
         "in": "query",
@@ -985,6 +1147,14 @@
         "maxLength": 64,
         "pattern": "^[A-Za-z0-9_-]+$"
       },
+      "UserId": {
+        "type": "string",
+        "description": "epilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.",
+        "example": "100321",
+        "minLength": 1,
+        "maxLength": 64,
+        "pattern": "^[A-Za-z0-9_-]+$"
+      },
       "Environment": {
         "type": "string",
         "description": "Partner-side environment this client belongs to",
@@ -1246,10 +1416,11 @@
           },
           "created_by": {
             "type": "string",
-            "description": "Admin-portal identity of the operator who created the client"
+            "description": "Email of the admin-portal operator who created the client (their Cognito identity when the pool holds no email)"
           },
           "updated_by": {
-            "type": "string"
+            "type": "string",
+            "description": "Email of the admin-portal operator who last changed the client"
           }
         }
       },
@@ -1387,7 +1558,8 @@
                 }
               },
               "recorded_by": {
-                "type": "string"
+                "type": "string",
+                "description": "Email of the admin-portal operator who recorded this policy version"
               },
               "recorded_at": {
                 "type": "string",
@@ -1397,23 +1569,6 @@
           }
         ]
       },
-      "PartnerAccount": {
-        "type": "object",
-        "description": "Optional audit reference to the partner tenant this organization maps to. The partner enforces the mapping.",
-        "required": [
-          "id"
-        ],
-        "properties": {
-          "id": {
-            "type": "string",
-            "maxLength": 256
-          },
-          "label": {
-            "type": "string",
-            "maxLength": 256
-          }
-        }
-      },
       "OrgEnablementStatus": {
         "type": "string",
         "enum": [
@@ -1434,9 +1589,6 @@
           },
           "authorization_policy": {
             "$ref": "#/components/schemas/AuthorizationPolicyInput"
-          },
-          "partner_account": {
-            "$ref": "#/components/schemas/PartnerAccount"
           }
         }
       },
@@ -1454,9 +1606,6 @@
           },
           "authorization_policy": {
             "$ref": "#/components/schemas/AuthorizationPolicyInput"
-          },
-          "partner_account": {
-            "$ref": "#/components/schemas/PartnerAccount"
           }
         }
       },
@@ -1486,9 +1635,6 @@
           "authorization_policy": {
             "$ref": "#/components/schemas/AuthorizationPolicy"
           },
-          "partner_account": {
-            "$ref": "#/components/schemas/PartnerAccount"
-          },
           "created_at": {
             "type": "string",
             "format": "date-time"
@@ -1498,10 +1644,12 @@
             "format": "date-time"
           },
           "created_by": {
-            "type": "string"
+            "type": "string",
+            "description": "Email of the admin-portal operator who enabled the organization"
           },
           "updated_by": {
-            "type": "string"
+            "type": "string",
+            "description": "Email of the admin-portal operator who last changed the enablement"
           }
         }
       },
@@ -1537,7 +1685,44 @@
           "expires_at": {
             "type": "string",
             "format": "date-time",
-            "description": "When the mirrored credential, and therefore the cookie, expires"
+            "description": "When the cookie expires (the mirrored credential's expiry, capped at 15 minutes)"
+          }
+        }
+      },
+      "UserSubject": {
+        "type": "object",
+        "required": [
+          "client_id",
+          "org_id",
+          "user_id",
+          "sub",
+          "key_version",
+          "sector"
+        ],
+        "properties": {
+          "client_id": {
+            "$ref": "#/components/schemas/PartnerClientId"
+          },
+          "org_id": {
+            "$ref": "#/components/schemas/OrgId"
+          },
+          "user_id": {
+            "$ref": "#/components/schemas/UserId"
+          },
+          "sub": {
+            "type": "string",
+            "description": "The pairwise subject this client receives for the user, `<key_version>.<base64url digest>`",
+            "example": "v1.dGhpcy1pcy1hLWR1bW15LXN1YmplY3QtdmFsdWUtMDAx"
+          },
+          "key_version": {
+            "type": "string",
+            "description": "Active pairwise key version the value was derived with",
+            "example": "v1"
+          },
+          "sector": {
+            "type": "string",
+            "description": "Pairwise sector the value was derived for (sector_identifier_uri host, else the first redirect host)",
+            "example": "portal.epilot.cloud"
           }
         }
       }

package/definitions/validation-rules-runtime.json

@@ -1 +1 @@
-{"s":"","o":[["getValidationRules","get","/v1/validation-rules"],["createValidationRule","post","/v1/validation-rules",null,1],["getValidationRuleById","get","/v1/validation-rules/{ruleId}",[["ruleId","p",true]]],["updateValidationRule","patch","/v1/validation-rules/{ruleId}",[["ruleId","p",true]],1],["deleteValidationRule","delete","/v1/validation-rules/{ruleId}",[["ruleId","p",true]]],["addUsedByReference","post","/v1/validation-rules/{ruleId}/used-by",[["ruleId","p",true]],1],["removeUsedByReference","delete","/v1/validation-rules/{ruleId}/used-by",[["ruleId","p",true]],1]],"v":"3.0.3"}
+{"s":"https://validation-rules.sls.epilot.io","o":[["getValidationRules","get","/v1/validation-rules"],["createValidationRule","post","/v1/validation-rules",null,1],["getValidationRuleById","get","/v1/validation-rules/{ruleId}",[["ruleId","p",true]]],["updateValidationRule","patch","/v1/validation-rules/{ruleId}",[["ruleId","p",true]],1],["deleteValidationRule","delete","/v1/validation-rules/{ruleId}",[["ruleId","p",true]]],["addUsedByReference","post","/v1/validation-rules/{ruleId}/used-by",[["ruleId","p",true]],1],["removeUsedByReference","delete","/v1/validation-rules/{ruleId}/used-by",[["ruleId","p",true]],1]],"v":"3.0.3"}

package/definitions/validation-rules.json

@@ -2115,6 +2115,9 @@
           {
             "$ref": "#/components/schemas/ExternalValue"
           },
+          {
+            "$ref": "#/components/schemas/ParameterValue"
+          },
           {
             "$ref": "#/components/schemas/RangeValue"
           },
@@ -2124,7 +2127,7 @@
         ]
       },
       "ScalarValue": {
-        "description": "A single comparison value - static, resolved from context, a relative date, an organisation environment variable, or an external value.",
+        "description": "A single comparison value - static, resolved from context, a relative date, an organisation environment variable, an external value, or a parameter the consuming surface supplies.",
         "oneOf": [
           {
             "$ref": "#/components/schemas/StaticValue"
@@ -2140,6 +2143,9 @@
           },
           {
             "$ref": "#/components/schemas/ExternalValue"
+          },
+          {
+            "$ref": "#/components/schemas/ParameterValue"
           }
         ]
       },
@@ -2154,6 +2160,9 @@
           },
           {
             "$ref": "#/components/schemas/ExternalValue"
+          },
+          {
+            "$ref": "#/components/schemas/ParameterValue"
           }
         ]
       },
@@ -2224,6 +2233,31 @@
           }
         }
       },
+      "ParameterValue": {
+        "type": "object",
+        "description": "A comparison value supplied by the surface that evaluates the rule, identified by a name\nthe rule chooses (e.g. `start_date`). The rule stores the name only. The consuming surface\nbinds the name to a source of its own - a journey binds it to the value of another block -\nand resolves it at evaluation time, so the rule never references the surface's objects\nand stays reusable across journeys and forms.\n\nThe kind a parameter is compared as follows from the field it sits in: `number`, `text`\nor `date` for comparison values, range bounds, adjustment amounts and relative date\noffsets, or a number, string or boolean as an `applies_when` value. One name is compared\nas one kind throughout a rule; a rule using a name as two kinds is rejected at write time.\nA parameter the surface leaves unbound or empty leaves the comparison unresolved.\n",
+        "required": [
+          "source",
+          "name"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "source": {
+            "type": "string",
+            "enum": [
+              "parameter"
+            ]
+          },
+          "name": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9_]{0,63}$",
+            "description": "Parameter name, e.g. `start_date`."
+          },
+          "adjust": {
+            "$ref": "#/components/schemas/ValueAdjustment"
+          }
+        }
+      },
       "StaticValue": {
         "type": "object",
         "description": "A fixed comparison value.",
@@ -2300,7 +2334,7 @@
             ]
           },
           "value": {
-            "description": "The adjustment amount - a fixed non-negative number, or a reference resolving to a\nnumber at evaluation time. Accepted reference sources: `context` (e.g. a per-contract\npercentage limit) and `environment` (a `Number` organisation environment variable).\nAny other source is rejected at write time, and the reference must not carry its own\n`adjust`.\n",
+            "description": "The adjustment amount - a fixed non-negative number, or a reference resolving to a\nnumber at evaluation time. Accepted reference sources: `context` (e.g. a per-contract\npercentage limit), `environment` (a `Number` organisation environment variable) and\n`parameter` (a number the consuming surface supplies). Any other source is rejected at\nwrite time, and the reference must not carry its own `adjust`.\n",
             "oneOf": [
               {
                 "type": "number",
@@ -2345,7 +2379,7 @@
             ]
           },
           "offset": {
-            "description": "Offset from the anchor. Negative values are in the past, positive in the future, 0 is the anchor itself.\nEither a fixed whole number, or a reference resolved at evaluation time. Accepted reference source:\n`environment` (a `Number` organisation environment variable). Any other source is rejected at write\ntime, and the reference must not carry an `adjust`. If the referenced value is missing or is not a\nwhole number within ±36500, the comparison is unresolved.\n",
+            "description": "Offset from the anchor. Negative values are in the past, positive in the future, 0 is the anchor itself.\nEither a fixed whole number, or a reference resolved at evaluation time. Accepted reference sources:\n`environment` (a `Number` organisation environment variable) and `parameter` (a number the consuming\nsurface supplies). Any other source is rejected at write time, and the reference must not carry an\n`adjust`. If the referenced value is missing or is not a whole number within ±36500, the comparison\nis unresolved.\n",
             "oneOf": [
               {
                 "type": "integer",
@@ -2366,11 +2400,19 @@
             ]
           },
           "anchor": {
-            "type": "string",
-            "enum": [
-              "today"
-            ],
-            "default": "today"
+            "description": "The date the offset is applied to. `today` (the default) is the evaluation moment. A\nreference resolves to a date at evaluation time - for example a `parameter` bound to\nanother field's date, so \"at least one day after the start date\" is `offset: 1`,\n`unit: days` on that anchor. Accepted reference sources: `context`, `environment` (a\n`Text` variable holding an ISO 8601 date), `external` (a `date` result) and `parameter`.\nThe reference must not carry an `adjust`; if it does not resolve to a date, the\ncomparison is unresolved.\n",
+            "default": "today",
+            "oneOf": [
+              {
+                "type": "string",
+                "enum": [
+                  "today"
+                ]
+              },
+              {
+                "$ref": "#/components/schemas/ValueReference"
+              }
+            ]
           }
         }
       },
@@ -2616,7 +2658,7 @@
             "description": "Comparison applied to the resolved context value. `isEmpty` / `isNotEmpty`\ntake no `value`; all other operators require one.\n"
           },
           "value": {
-            "description": "Comparison value for binary operators: a static number, string or boolean, or a\nreference resolved at evaluation time. Accepted reference source: `environment` (a\n`Number`, `Text` or `Boolean` organisation environment variable), so a precondition\ncan act as a per-organisation switch or threshold. Any other source is rejected at\nwrite time, and the reference must not carry an `adjust`.\n",
+            "description": "Comparison value for binary operators: a static number, string or boolean, or a\nreference resolved at evaluation time. Accepted reference sources: `environment` (a\n`Number`, `Text` or `Boolean` organisation environment variable), so a precondition\ncan act as a per-organisation switch or threshold, and `parameter` (a value the\nconsuming surface supplies, e.g. another field's answer). Any other source is rejected\nat write time, and the reference must not carry an `adjust`.\n",
             "oneOf": [
               {
                 "type": "number"
@@ -2652,5 +2694,9 @@
       }
     }
   },
-  "servers": []
+  "servers": [
+    {
+      "url": "https://validation-rules.sls.epilot.io"
+    }
+  ]
 }

package/dist/apis/access-token.cjs

@@ -6,7 +6,7 @@ var _chunkZMBA3WV4cjs = require('../chunk-ZMBA3WV4.cjs');
 
 
 
-var _chunkPAMXQWNLcjs = require('../chunk-PAMXQWNL.cjs');
+var _chunkM6RNRDA3cjs = require('../chunk-M6RNRDA3.cjs');
 require('../chunk-NJK5F5TF.cjs');
 
 // src/apis/access-token.ts
@@ -14,7 +14,7 @@ var _definition = null;
 var loadDefinition = () => {
   if (!_definition) {
     const mod = _chunkZMBA3WV4cjs.require_access_token_runtime.call(void 0, );
-    _definition = _chunkPAMXQWNLcjs.expand.call(void 0, _nullishCoalesce(mod.default, () => ( mod)));
+    _definition = _chunkM6RNRDA3cjs.expand.call(void 0, _nullishCoalesce(mod.default, () => ( mod)));
   }
   return _definition;
 };
@@ -22,13 +22,13 @@ var _instance = null;
 var resolve = () => {
   if (!_instance) {
     const def = loadDefinition();
-    _instance = _chunkPAMXQWNLcjs.createApiClient.call(void 0, { definition: def, apiName: "accessToken" });
+    _instance = _chunkM6RNRDA3cjs.createApiClient.call(void 0, { definition: def, apiName: "accessToken" });
   }
   return _instance;
 };
-var _handle = _chunkPAMXQWNLcjs.createApiHandle.call(void 0, {
+var _handle = _chunkM6RNRDA3cjs.createApiHandle.call(void 0, {
   resolveClient: resolve,
-  createClient: () => _chunkPAMXQWNLcjs.createApiClient.call(void 0, { definition: loadDefinition(), apiName: "accessToken" }),
+  createClient: () => _chunkM6RNRDA3cjs.createApiClient.call(void 0, { definition: loadDefinition(), apiName: "accessToken" }),
   apiName: "accessToken"
 });
 var getClient = _handle.getClient;
@@ -39,4 +39,4 @@ var accessToken = _handle;
 
 
 
-exports.accessToken = accessToken; exports.authorize = _chunkPAMXQWNLcjs.authorize; exports.createClient = createClient; exports.getClient = getClient;
+exports.accessToken = accessToken; exports.authorize = _chunkM6RNRDA3cjs.authorize; exports.createClient = createClient; exports.getClient = getClient;

package/dist/apis/access-token.js

@@ -6,7 +6,7 @@ import {
   createApiClient,
   createApiHandle,
   expand
-} from "../chunk-BVDXJ4QV.js";
+} from "../chunk-N2IV6QYZ.js";
 import "../chunk-YPSWSI3M.js";
 
 // src/apis/access-token.ts