@epilot/sdk 2.20.70 → 2.20.72

package/dist/identity-F5XHYPXY.js

@@ -0,0 +1,7 @@
+import "./chunk-YPSWSI3M.js";
+
+// src/docs/identity.json
+var identity_default = '# Identity API\n\n- **Base URL:** `https://id.epilot.cloud`\n- **Full API Docs:** [https://docs.epilot.io/api/identity](https://docs.epilot.io/api/identity)\n\n## Usage\n\n```ts\nimport { epilot } from \'@epilot/sdk\'\n\nepilot.authorize(() => \'<token>\')\nconst { data } = await epilot.identity.listClients(...)\n```\n\n### Tree-shakeable import\n\n```ts\nimport { getClient, authorize } from \'@epilot/sdk/identity\'\n\nconst identityClient = getClient()\nauthorize(identityClient, () => \'<token>\')\nconst { data } = await identityClient.listClients(...)\n```\n\n## Operations\n\n**Operator Clients**\n- [`listClients`](#listclients)\n- [`createOidcClient`](#createoidcclient)\n- [`getOidcClient`](#getoidcclient)\n- [`updateClient`](#updateclient)\n- [`retireClient`](#retireclient)\n- [`activateClient`](#activateclient)\n- [`suspendClient`](#suspendclient)\n- [`rotateClientSecret`](#rotateclientsecret)\n\n**Operator Organizations**\n- [`listClientOrganizations`](#listclientorganizations)\n- [`enableClientOrganization`](#enableclientorganization)\n- [`getClientOrganization`](#getclientorganization)\n- [`updateClientOrganization`](#updateclientorganization)\n- [`revokeClientOrganization`](#revokeclientorganization)\n- [`suspendClientOrganization`](#suspendclientorganization)\n- [`activateClientOrganization`](#activateclientorganization)\n- [`getUserSubject`](#getusersubject)\n\n**Session**\n- [`createIdentitySession`](#createidentitysession)\n- [`deleteIdentitySession`](#deleteidentitysession)\n\n**Launch**\n- [`launchClient`](#launchclient)\n\n**Schemas**\n- [`Error`](#error)\n- [`PartnerClientId`](#partnerclientid)\n- [`OrgId`](#orgid)\n- [`UserId`](#userid)\n- [`Environment`](#environment)\n- [`PartnerClientStatus`](#partnerclientstatus)\n- [`Scope`](#scope)\n- [`HttpsUri`](#httpsuri)\n- [`PartnerClientCreate`](#partnerclientcreate)\n- [`PartnerClientUpdate`](#partnerclientupdate)\n- [`PartnerClient`](#partnerclient)\n- [`PartnerClientWithSecret`](#partnerclientwithsecret)\n- [`PartnerClientList`](#partnerclientlist)\n- [`StatusChangeRequest`](#statuschangerequest)\n- [`RotateSecretRequest`](#rotatesecretrequest)\n- [`AuthorizationPolicyInput`](#authorizationpolicyinput)\n- [`AuthorizationPolicy`](#authorizationpolicy)\n- [`OrgEnablementStatus`](#orgenablementstatus)\n- [`OrgEnablementCreate`](#orgenablementcreate)\n- [`OrgEnablementUpdate`](#orgenablementupdate)\n- [`OrgEnablement`](#orgenablement)\n- [`OrgEnablementList`](#orgenablementlist)\n- [`IdentitySession`](#identitysession)\n- [`UserSubject`](#usersubject)\n\n### `listClients`\n\nList registered partner clients. The client secret is never returned.\n\n`GET /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.listClients({\n  partner_key: \'example\',\n  status: \'example\',\n  size: 1,\n  cursor: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "partner_key": "string",\n      "display_name": "string",\n      "description": "string",\n      "environment": "dev",\n      "redirect_uris": ["https://partner.example.com/auth/callback"],\n      "sector_identifier_uri": "https://partner.example.com/auth/callback",\n      "initiate_login_uri": "https://partner.example.com/auth/callback",\n      "launch_target_prefixes": ["string"],\n      "token_endpoint_auth_method": "client_secret_basic",\n      "grant_types": ["authorization_code"],\n      "scopes_allowed": ["openid"],\n      "status": "draft",\n      "status_reason": "string",\n      "config_version": 1,\n      "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n      "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ],\n  "next_cursor": "string"\n}\n```\n\n</details>\n\n---\n\n### `createOidcClient`\n\nCreate a partner client in `draft` status. The client secret is returned exactly once in this\nresponse and can never be read again; use `rotateClientSecret` to obtain a new one.\n\n`POST /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.createOidcClient(\n  null,\n  {\n    partner_key: \'babelforce\',\n    display_name: \'Babelforce\',\n    description: \'string\',\n    environment: \'dev\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `getOidcClient`\n\nRead a partner client. The client secret is never returned.\n\n`GET /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.getOidcClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClient`\n\nReplace the mutable configuration of a client. `config_version` must equal the current\nversion (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.updateClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    config_version: 1,\n    allow_sector_change: false,\n    display_name: \'string\',\n    description: \'string\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `retireClient`\n\nRetire a client. The record is kept as a tombstone, the `client_id` is never reused, every\norganization enablement is revoked and all provider-side artefacts are revoked.\n\n`DELETE /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.retireClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClient`\n\nActivate a `draft` or `suspended` client. Validates that every redirect URI is an absolute\nHTTPS URL without fragment, that `scopes_allowed` contains `openid`, and that the\nauthentication method is `c\n\n`POST /v1/identity/operator/clients/{client_id}:activate`\n\n```ts\nconst { data } = await client.activateClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClient`\n\nImmediately block the client for every organization. Provider-side artefacts (codes, tokens,\ngrants) are revoked; the audit trail is kept. Reversible with `activateClient`.\n\n`POST /v1/identity/operator/clients/{client_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `rotateClientSecret`\n\nIssue a new client secret. The new secret is returned exactly once. The previous secret\nkeeps working until `previous_secret_expires_at` unless `compromise_mode` is set, in which\ncase it stops working\n\n`POST /v1/identity/operator/clients/{client_id}:rotateSecret`\n\n```ts\nconst { data } = await client.rotateClientSecret(\n  {\n    client_id: \'example\',\n  },\n  {\n    compromise_mode: false,\n    migration_window_seconds: 86400\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `listClientOrganizations`\n\nList the organizations enabled on a client, including suspended and revoked ones.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.listClientOrganizations({\n  client_id: \'example\',\n  status: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "org_id": "739224",\n      "status": "active",\n      "status_reason": "string",\n      "authorization_policy": {\n        "mode": "preauthorized",\n        "population": "all_current_org_members",\n        "allowed_scopes": ["openid"],\n        "customer_approval_ref": "string",\n        "approved_at": "1970-01-01T00:00:00.000Z",\n        "version": 1,\n        "mandatory_claims": ["org_id"],\n        "recorded_by": "string",\n        "recorded_at": "1970-01-01T00:00:00.000Z"\n      },\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ]\n}\n```\n\n</details>\n\n---\n\n### `enableClientOrganization`\n\nEnable an epilot organization on a client, recording the customer\'s authorization policy\n(version 1). `allowed_scopes` must contain `openid` and be a subset of the client\'s\n`scopes_allowed`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.enableClientOrganization(\n  {\n    client_id: \'example\',\n  },\n  {\n    org_id: \'739224\',\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getClientOrganization`\n\nRead one organization enablement.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.getClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClientOrganization`\n\nRecord a new version of the customer\'s authorization policy. `expected_policy_version` must\nequal the current version (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.updateClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    expected_policy_version: 1,\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `revokeClientOrganization`\n\nRevoke an organization\'s enablement. The record is kept as an audited tombstone; future\nauthorizations for this organization fail with `access_denied` and provider-side artefacts\nbound to it are revok\n\n`DELETE /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.revokeClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClientOrganization`\n\nTemporarily block one organization on this client. Reversible with `activateClientOrganization`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClientOrganization`\n\nResume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization again (`POST \u2026/organizations`) replaces the revoked entry and continues its policy\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate`\n\n```ts\nconst { data } = await client.activateClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getUserSubject`\n\nThe pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its\nside **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with\n`\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject`\n\n```ts\nconst { data } = await client.getUserSubject({\n  client_id: \'example\',\n  org_id: \'example\',\n  user_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "user_id": "100321",\n  "sub": "v1.dGhpcy1pcy1hLWR1bW15LXN1YmplY3QtdmFsdWUtMDAx",\n  "key_version": "v1",\n  "sector": "portal.epilot.cloud"\n}\n```\n\n</details>\n\n---\n\n### `createIdentitySession`\n\nCalled by the epilot portal through the portal-host proxy after every persisted 360 session.\nValidates the 360 bearer token itself and mirrors it into the `identity_session` cookie\n(`HttpOnly; Secure;\n\n`GET /v1/identity/session`\n\n```ts\nconst { data } = await client.createIdentitySession()\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "org_id": "739224",\n  "user_id": "string",\n  "expires_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `deleteIdentitySession`\n\nClears the `identity_session` cookie. Called by the portal on logout.\n\n`DELETE /v1/identity/session`\n\n```ts\nconst { data } = await client.deleteIdentitySession()\n```\n\n---\n\n### `launchClient`\n\nOne validated place for partner start links (manager UI, hosted apps). Redirects the browser to the\nclient\'s registered `initiate_login_uri` with `iss` set to this issuer and, when given, the deep lin\n\n`GET /v1/identity/launch/{client_id}`\n\n```ts\nconst { data } = await client.launchClient({\n  client_id: \'example\',\n  target: \'example\',\n  extra: \'example\',\n})\n```\n\n---\n\n## Schemas\n\n### `Error`\n\n```ts\ntype Error = {\n  status: number\n  error: string\n  details?: Record<string, unknown>[]\n}\n```\n\n### `PartnerClientId`\n\nOpaque client identifier, unique within the issuer, never reused\n\n```ts\ntype PartnerClientId = string\n```\n\n### `OrgId`\n\nepilot organization id, an opaque case-sensitive string\n\n```ts\ntype OrgId = string\n```\n\n### `UserId`\n\nepilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.\n\n```ts\ntype UserId = string\n```\n\n### `Environment`\n\nPartner-side environment this client belongs to\n\n```ts\ntype Environment = "dev" | "staging" | "production"\n```\n\n### `PartnerClientStatus`\n\n```ts\ntype PartnerClientStatus = "draft" | "active" | "suspended" | "retired"\n```\n\n### `Scope`\n\n```ts\ntype Scope = "openid" | "email" | "profile"\n```\n\n### `HttpsUri`\n\nAbsolute HTTPS URL without fragment\n\n```ts\ntype HttpsUri = string // uri\n```\n\n### `PartnerClientCreate`\n\n```ts\ntype PartnerClientCreate = {\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed?: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClientUpdate`\n\n```ts\ntype PartnerClientUpdate = {\n  config_version: number\n  allow_sector_change?: boolean\n  display_name: string\n  description?: string\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClient`\n\n```ts\ntype PartnerClient = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `PartnerClientWithSecret`\n\n```ts\ntype PartnerClientWithSecret = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n  client_secret: string\n}\n```\n\n### `PartnerClientList`\n\n```ts\ntype PartnerClientList = {\n  results: Array<{\n    client_id: string\n    partner_key: string\n    display_name: string\n    description?: string\n    environment: "dev" | "staging" | "production"\n    redirect_uris: string // uri[]\n    sector_identifier_uri?: string // uri\n    initiate_login_uri?: string // uri\n    launch_target_prefixes?: string[]\n    token_endpoint_auth_method: "client_secret_basic"\n    grant_types: "authorization_code"[]\n    scopes_allowed: "openid" | "email" | "profile"[]\n    status: "draft" | "active" | "suspended" | "retired"\n    status_reason?: string\n    config_version: number\n    secret_rotated_at?: string // date-time\n    previous_secret_expires_at?: string // date-time\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n  next_cursor?: string\n}\n```\n\n### `StatusChangeRequest`\n\n```ts\ntype StatusChangeRequest = {\n  reason?: string\n}\n```\n\n### `RotateSecretRequest`\n\n```ts\ntype RotateSecretRequest = {\n  compromise_mode?: boolean\n  migration_window_seconds?: number\n}\n```\n\n### `AuthorizationPolicyInput`\n\n```ts\ntype AuthorizationPolicyInput = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n}\n```\n\n### `AuthorizationPolicy`\n\n```ts\ntype AuthorizationPolicy = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n  version: number\n  mandatory_claims: "org_id"[]\n  recorded_by: string\n  recorded_at: string // date-time\n}\n```\n\n### `OrgEnablementStatus`\n\n```ts\ntype OrgEnablementStatus = "active" | "suspended" | "revoked"\n```\n\n### `OrgEnablementCreate`\n\n```ts\ntype OrgEnablementCreate = {\n  org_id: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n}\n```\n\n### `OrgEnablementUpdate`\n\n```ts\ntype OrgEnablementUpdate = {\n  expected_policy_version: number\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n}\n```\n\n### `OrgEnablement`\n\n```ts\ntype OrgEnablement = {\n  client_id: string\n  org_id: string\n  status: "active" | "suspended" | "revoked"\n  status_reason?: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n    version: number\n    mandatory_claims: "org_id"[]\n    recorded_by: string\n    recorded_at: string // date-time\n  }\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `OrgEnablementList`\n\n```ts\ntype OrgEnablementList = {\n  results: Array<{\n    client_id: string\n    org_id: string\n    status: "active" | "suspended" | "revoked"\n    status_reason?: string\n    authorization_policy: {\n      mode?: { ... }\n      population?: { ... }\n      allowed_scopes: { ... }\n      customer_approval_ref: { ... }\n      approved_at: { ... }\n      version: { ... }\n      mandatory_claims: { ... }\n      recorded_by: { ... }\n      recorded_at: { ... }\n    }\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n}\n```\n\n### `IdentitySession`\n\n```ts\ntype IdentitySession = {\n  org_id: string\n  user_id: string\n  expires_at: string // date-time\n}\n```\n\n### `UserSubject`\n\n```ts\ntype UserSubject = {\n  client_id: string\n  org_id: string\n  user_id: string\n  sub: string\n  key_version: string\n  sector: string\n}\n```\n';
+export {
+  identity_default as default
+};

package/dist/identity-JDTGYAOV.cjs

@@ -0,0 +1,7 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});require('./chunk-NJK5F5TF.cjs');
+
+// src/docs/identity.json
+var identity_default = '# Identity API\n\n- **Base URL:** `https://id.epilot.cloud`\n- **Full API Docs:** [https://docs.epilot.io/api/identity](https://docs.epilot.io/api/identity)\n\n## Usage\n\n```ts\nimport { epilot } from \'@epilot/sdk\'\n\nepilot.authorize(() => \'<token>\')\nconst { data } = await epilot.identity.listClients(...)\n```\n\n### Tree-shakeable import\n\n```ts\nimport { getClient, authorize } from \'@epilot/sdk/identity\'\n\nconst identityClient = getClient()\nauthorize(identityClient, () => \'<token>\')\nconst { data } = await identityClient.listClients(...)\n```\n\n## Operations\n\n**Operator Clients**\n- [`listClients`](#listclients)\n- [`createOidcClient`](#createoidcclient)\n- [`getOidcClient`](#getoidcclient)\n- [`updateClient`](#updateclient)\n- [`retireClient`](#retireclient)\n- [`activateClient`](#activateclient)\n- [`suspendClient`](#suspendclient)\n- [`rotateClientSecret`](#rotateclientsecret)\n\n**Operator Organizations**\n- [`listClientOrganizations`](#listclientorganizations)\n- [`enableClientOrganization`](#enableclientorganization)\n- [`getClientOrganization`](#getclientorganization)\n- [`updateClientOrganization`](#updateclientorganization)\n- [`revokeClientOrganization`](#revokeclientorganization)\n- [`suspendClientOrganization`](#suspendclientorganization)\n- [`activateClientOrganization`](#activateclientorganization)\n- [`getUserSubject`](#getusersubject)\n\n**Session**\n- [`createIdentitySession`](#createidentitysession)\n- [`deleteIdentitySession`](#deleteidentitysession)\n\n**Launch**\n- [`launchClient`](#launchclient)\n\n**Schemas**\n- [`Error`](#error)\n- [`PartnerClientId`](#partnerclientid)\n- [`OrgId`](#orgid)\n- [`UserId`](#userid)\n- [`Environment`](#environment)\n- [`PartnerClientStatus`](#partnerclientstatus)\n- [`Scope`](#scope)\n- [`HttpsUri`](#httpsuri)\n- [`PartnerClientCreate`](#partnerclientcreate)\n- [`PartnerClientUpdate`](#partnerclientupdate)\n- [`PartnerClient`](#partnerclient)\n- [`PartnerClientWithSecret`](#partnerclientwithsecret)\n- [`PartnerClientList`](#partnerclientlist)\n- [`StatusChangeRequest`](#statuschangerequest)\n- [`RotateSecretRequest`](#rotatesecretrequest)\n- [`AuthorizationPolicyInput`](#authorizationpolicyinput)\n- [`AuthorizationPolicy`](#authorizationpolicy)\n- [`OrgEnablementStatus`](#orgenablementstatus)\n- [`OrgEnablementCreate`](#orgenablementcreate)\n- [`OrgEnablementUpdate`](#orgenablementupdate)\n- [`OrgEnablement`](#orgenablement)\n- [`OrgEnablementList`](#orgenablementlist)\n- [`IdentitySession`](#identitysession)\n- [`UserSubject`](#usersubject)\n\n### `listClients`\n\nList registered partner clients. The client secret is never returned.\n\n`GET /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.listClients({\n  partner_key: \'example\',\n  status: \'example\',\n  size: 1,\n  cursor: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "partner_key": "string",\n      "display_name": "string",\n      "description": "string",\n      "environment": "dev",\n      "redirect_uris": ["https://partner.example.com/auth/callback"],\n      "sector_identifier_uri": "https://partner.example.com/auth/callback",\n      "initiate_login_uri": "https://partner.example.com/auth/callback",\n      "launch_target_prefixes": ["string"],\n      "token_endpoint_auth_method": "client_secret_basic",\n      "grant_types": ["authorization_code"],\n      "scopes_allowed": ["openid"],\n      "status": "draft",\n      "status_reason": "string",\n      "config_version": 1,\n      "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n      "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ],\n  "next_cursor": "string"\n}\n```\n\n</details>\n\n---\n\n### `createOidcClient`\n\nCreate a partner client in `draft` status. The client secret is returned exactly once in this\nresponse and can never be read again; use `rotateClientSecret` to obtain a new one.\n\n`POST /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.createOidcClient(\n  null,\n  {\n    partner_key: \'babelforce\',\n    display_name: \'Babelforce\',\n    description: \'string\',\n    environment: \'dev\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `getOidcClient`\n\nRead a partner client. The client secret is never returned.\n\n`GET /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.getOidcClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClient`\n\nReplace the mutable configuration of a client. `config_version` must equal the current\nversion (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.updateClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    config_version: 1,\n    allow_sector_change: false,\n    display_name: \'string\',\n    description: \'string\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `retireClient`\n\nRetire a client. The record is kept as a tombstone, the `client_id` is never reused, every\norganization enablement is revoked and all provider-side artefacts are revoked.\n\n`DELETE /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.retireClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClient`\n\nActivate a `draft` or `suspended` client. Validates that every redirect URI is an absolute\nHTTPS URL without fragment, that `scopes_allowed` contains `openid`, and that the\nauthentication method is `c\n\n`POST /v1/identity/operator/clients/{client_id}:activate`\n\n```ts\nconst { data } = await client.activateClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClient`\n\nImmediately block the client for every organization. Provider-side artefacts (codes, tokens,\ngrants) are revoked; the audit trail is kept. Reversible with `activateClient`.\n\n`POST /v1/identity/operator/clients/{client_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `rotateClientSecret`\n\nIssue a new client secret. The new secret is returned exactly once. The previous secret\nkeeps working until `previous_secret_expires_at` unless `compromise_mode` is set, in which\ncase it stops working\n\n`POST /v1/identity/operator/clients/{client_id}:rotateSecret`\n\n```ts\nconst { data } = await client.rotateClientSecret(\n  {\n    client_id: \'example\',\n  },\n  {\n    compromise_mode: false,\n    migration_window_seconds: 86400\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `listClientOrganizations`\n\nList the organizations enabled on a client, including suspended and revoked ones.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.listClientOrganizations({\n  client_id: \'example\',\n  status: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "org_id": "739224",\n      "status": "active",\n      "status_reason": "string",\n      "authorization_policy": {\n        "mode": "preauthorized",\n        "population": "all_current_org_members",\n        "allowed_scopes": ["openid"],\n        "customer_approval_ref": "string",\n        "approved_at": "1970-01-01T00:00:00.000Z",\n        "version": 1,\n        "mandatory_claims": ["org_id"],\n        "recorded_by": "string",\n        "recorded_at": "1970-01-01T00:00:00.000Z"\n      },\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ]\n}\n```\n\n</details>\n\n---\n\n### `enableClientOrganization`\n\nEnable an epilot organization on a client, recording the customer\'s authorization policy\n(version 1). `allowed_scopes` must contain `openid` and be a subset of the client\'s\n`scopes_allowed`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.enableClientOrganization(\n  {\n    client_id: \'example\',\n  },\n  {\n    org_id: \'739224\',\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getClientOrganization`\n\nRead one organization enablement.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.getClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClientOrganization`\n\nRecord a new version of the customer\'s authorization policy. `expected_policy_version` must\nequal the current version (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.updateClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    expected_policy_version: 1,\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `revokeClientOrganization`\n\nRevoke an organization\'s enablement. The record is kept as an audited tombstone; future\nauthorizations for this organization fail with `access_denied` and provider-side artefacts\nbound to it are revok\n\n`DELETE /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.revokeClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClientOrganization`\n\nTemporarily block one organization on this client. Reversible with `activateClientOrganization`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClientOrganization`\n\nResume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization again (`POST \u2026/organizations`) replaces the revoked entry and continues its policy\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate`\n\n```ts\nconst { data } = await client.activateClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getUserSubject`\n\nThe pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its\nside **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with\n`\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject`\n\n```ts\nconst { data } = await client.getUserSubject({\n  client_id: \'example\',\n  org_id: \'example\',\n  user_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "user_id": "100321",\n  "sub": "v1.dGhpcy1pcy1hLWR1bW15LXN1YmplY3QtdmFsdWUtMDAx",\n  "key_version": "v1",\n  "sector": "portal.epilot.cloud"\n}\n```\n\n</details>\n\n---\n\n### `createIdentitySession`\n\nCalled by the epilot portal through the portal-host proxy after every persisted 360 session.\nValidates the 360 bearer token itself and mirrors it into the `identity_session` cookie\n(`HttpOnly; Secure;\n\n`GET /v1/identity/session`\n\n```ts\nconst { data } = await client.createIdentitySession()\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "org_id": "739224",\n  "user_id": "string",\n  "expires_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `deleteIdentitySession`\n\nClears the `identity_session` cookie. Called by the portal on logout.\n\n`DELETE /v1/identity/session`\n\n```ts\nconst { data } = await client.deleteIdentitySession()\n```\n\n---\n\n### `launchClient`\n\nOne validated place for partner start links (manager UI, hosted apps). Redirects the browser to the\nclient\'s registered `initiate_login_uri` with `iss` set to this issuer and, when given, the deep lin\n\n`GET /v1/identity/launch/{client_id}`\n\n```ts\nconst { data } = await client.launchClient({\n  client_id: \'example\',\n  target: \'example\',\n  extra: \'example\',\n})\n```\n\n---\n\n## Schemas\n\n### `Error`\n\n```ts\ntype Error = {\n  status: number\n  error: string\n  details?: Record<string, unknown>[]\n}\n```\n\n### `PartnerClientId`\n\nOpaque client identifier, unique within the issuer, never reused\n\n```ts\ntype PartnerClientId = string\n```\n\n### `OrgId`\n\nepilot organization id, an opaque case-sensitive string\n\n```ts\ntype OrgId = string\n```\n\n### `UserId`\n\nepilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.\n\n```ts\ntype UserId = string\n```\n\n### `Environment`\n\nPartner-side environment this client belongs to\n\n```ts\ntype Environment = "dev" | "staging" | "production"\n```\n\n### `PartnerClientStatus`\n\n```ts\ntype PartnerClientStatus = "draft" | "active" | "suspended" | "retired"\n```\n\n### `Scope`\n\n```ts\ntype Scope = "openid" | "email" | "profile"\n```\n\n### `HttpsUri`\n\nAbsolute HTTPS URL without fragment\n\n```ts\ntype HttpsUri = string // uri\n```\n\n### `PartnerClientCreate`\n\n```ts\ntype PartnerClientCreate = {\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed?: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClientUpdate`\n\n```ts\ntype PartnerClientUpdate = {\n  config_version: number\n  allow_sector_change?: boolean\n  display_name: string\n  description?: string\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClient`\n\n```ts\ntype PartnerClient = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `PartnerClientWithSecret`\n\n```ts\ntype PartnerClientWithSecret = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n  client_secret: string\n}\n```\n\n### `PartnerClientList`\n\n```ts\ntype PartnerClientList = {\n  results: Array<{\n    client_id: string\n    partner_key: string\n    display_name: string\n    description?: string\n    environment: "dev" | "staging" | "production"\n    redirect_uris: string // uri[]\n    sector_identifier_uri?: string // uri\n    initiate_login_uri?: string // uri\n    launch_target_prefixes?: string[]\n    token_endpoint_auth_method: "client_secret_basic"\n    grant_types: "authorization_code"[]\n    scopes_allowed: "openid" | "email" | "profile"[]\n    status: "draft" | "active" | "suspended" | "retired"\n    status_reason?: string\n    config_version: number\n    secret_rotated_at?: string // date-time\n    previous_secret_expires_at?: string // date-time\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n  next_cursor?: string\n}\n```\n\n### `StatusChangeRequest`\n\n```ts\ntype StatusChangeRequest = {\n  reason?: string\n}\n```\n\n### `RotateSecretRequest`\n\n```ts\ntype RotateSecretRequest = {\n  compromise_mode?: boolean\n  migration_window_seconds?: number\n}\n```\n\n### `AuthorizationPolicyInput`\n\n```ts\ntype AuthorizationPolicyInput = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n}\n```\n\n### `AuthorizationPolicy`\n\n```ts\ntype AuthorizationPolicy = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n  version: number\n  mandatory_claims: "org_id"[]\n  recorded_by: string\n  recorded_at: string // date-time\n}\n```\n\n### `OrgEnablementStatus`\n\n```ts\ntype OrgEnablementStatus = "active" | "suspended" | "revoked"\n```\n\n### `OrgEnablementCreate`\n\n```ts\ntype OrgEnablementCreate = {\n  org_id: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n}\n```\n\n### `OrgEnablementUpdate`\n\n```ts\ntype OrgEnablementUpdate = {\n  expected_policy_version: number\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n}\n```\n\n### `OrgEnablement`\n\n```ts\ntype OrgEnablement = {\n  client_id: string\n  org_id: string\n  status: "active" | "suspended" | "revoked"\n  status_reason?: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n    version: number\n    mandatory_claims: "org_id"[]\n    recorded_by: string\n    recorded_at: string // date-time\n  }\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `OrgEnablementList`\n\n```ts\ntype OrgEnablementList = {\n  results: Array<{\n    client_id: string\n    org_id: string\n    status: "active" | "suspended" | "revoked"\n    status_reason?: string\n    authorization_policy: {\n      mode?: { ... }\n      population?: { ... }\n      allowed_scopes: { ... }\n      customer_approval_ref: { ... }\n      approved_at: { ... }\n      version: { ... }\n      mandatory_claims: { ... }\n      recorded_by: { ... }\n      recorded_at: { ... }\n    }\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n}\n```\n\n### `IdentitySession`\n\n```ts\ntype IdentitySession = {\n  org_id: string\n  user_id: string\n  expires_at: string // date-time\n}\n```\n\n### `UserSubject`\n\n```ts\ntype UserSubject = {\n  client_id: string\n  org_id: string\n  user_id: string\n  sub: string\n  key_version: string\n  sector: string\n}\n```\n';
+
+
+exports.default = identity_default;

package/dist/{identity-runtime-PFM5KQWA.js → identity-runtime-A4LSC77N.js}

@@ -1,5 +1,5 @@
 import {
   require_identity_runtime
-} from "./chunk-3IBAPVLY.js";
+} from "./chunk-DSYS22AC.js";
 import "./chunk-YPSWSI3M.js";
 export default require_identity_runtime();

package/dist/{identity-runtime-57DQPQWX.cjs → identity-runtime-GNE4EC7V.cjs}

@@ -1,5 +1,5 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkRPWTWCDCcjs = require('./chunk-RPWTWCDC.cjs');
+var _chunkTKRZK7V2cjs = require('./chunk-TKRZK7V2.cjs');
 require('./chunk-NJK5F5TF.cjs');
-exports. default = _chunkRPWTWCDCcjs.require_identity_runtime.call(void 0, );
+exports. default = _chunkTKRZK7V2cjs.require_identity_runtime.call(void 0, );

package/dist/index.cjs

@@ -87,7 +87,7 @@ var _chunk424JLS5Gcjs = require('./chunk-424JLS5G.cjs');
 var _chunkYO4M3BZLcjs = require('./chunk-YO4M3BZL.cjs');
 
 
-var _chunkRPWTWCDCcjs = require('./chunk-RPWTWCDC.cjs');
+var _chunkTKRZK7V2cjs = require('./chunk-TKRZK7V2.cjs');
 
 
 var _chunkQDPZZUG3cjs = require('./chunk-QDPZZUG3.cjs');
@@ -153,7 +153,7 @@ var _chunkLKRBFBFNcjs = require('./chunk-LKRBFBFN.cjs');
 var _chunkT67ZXTVGcjs = require('./chunk-T67ZXTVG.cjs');
 
 
-var _chunkGD6KHA54cjs = require('./chunk-GD6KHA54.cjs');
+var _chunkS455SL5Ccjs = require('./chunk-S455SL5C.cjs');
 
 
 var _chunkN2P6RELZcjs = require('./chunk-N2P6RELZ.cjs');
@@ -170,7 +170,7 @@ var _chunkWOUASZJWcjs = require('./chunk-WOUASZJW.cjs');
 
 
 
-var _chunk4PXSWMYJcjs = require('./chunk-4PXSWMYJ.cjs');
+var _chunk5QSR7CYTcjs = require('./chunk-5QSR7CYT.cjs');
 
 
 var _chunkNJK5F5TFcjs = require('./chunk-NJK5F5TF.cjs');
@@ -244,7 +244,7 @@ var resolveClient = (params) => {
   }
   if (!entry.instance) {
     const definition = entry.loader();
-    entry.instance = _chunk4PXSWMYJcjs.createApiClient.call(void 0, {
+    entry.instance = _chunk5QSR7CYTcjs.createApiClient.call(void 0, {
       definition,
       token: state.token,
       headers: state.globalHeaders,
@@ -277,7 +277,7 @@ var resetAllClients = (registry) => {
 };
 
 // src/apis/_registry.ts
-var expandDef = (mod) => _chunk4PXSWMYJcjs.expand.call(void 0, _nullishCoalesce(mod.default, () => ( mod)));
+var expandDef = (mod) => _chunk5QSR7CYTcjs.expand.call(void 0, _nullishCoalesce(mod.default, () => ( mod)));
 var registerBuiltinApis = (registry) => {
   registerApi({
     registry,
@@ -297,7 +297,7 @@ var registerBuiltinApis = (registry) => {
   registerApi({
     registry,
     name: "aiAgents",
-    loader: () => expandDef(_chunkGD6KHA54cjs.require_ai_agents_runtime.call(void 0, ))
+    loader: () => expandDef(_chunkS455SL5Ccjs.require_ai_agents_runtime.call(void 0, ))
   });
   registerApi({
     registry,
@@ -422,7 +422,7 @@ var registerBuiltinApis = (registry) => {
   registerApi({
     registry,
     name: "identity",
-    loader: () => expandDef(_chunkRPWTWCDCcjs.require_identity_runtime.call(void 0, ))
+    loader: () => expandDef(_chunkTKRZK7V2cjs.require_identity_runtime.call(void 0, ))
   });
   registerApi({
     registry,
@@ -640,9 +640,9 @@ var createSDK = () => {
       const available = [...registry.keys()].join(", ");
       throw new Error(`Unknown API: "${name}". Available: ${available}`);
     }
-    return _chunk4PXSWMYJcjs.createApiHandle.call(void 0, {
+    return _chunk5QSR7CYTcjs.createApiHandle.call(void 0, {
       resolveClient: () => resolveClient({ registry, name, state }),
-      createClient: () => _chunk4PXSWMYJcjs.createApiClient.call(void 0, { definition: entry.loader(), apiName: name }),
+      createClient: () => _chunk5QSR7CYTcjs.createApiClient.call(void 0, { definition: entry.loader(), apiName: name }),
       apiName: name
     });
   };
@@ -690,9 +690,9 @@ var createSDK = () => {
           return interceptorUse;
         }
         case "help":
-          return (apiName) => _chunk4PXSWMYJcjs.help.call(void 0, apiName);
+          return (apiName) => _chunk5QSR7CYTcjs.help.call(void 0, apiName);
         case "openapi":
-          return (apiName) => _chunk4PXSWMYJcjs.openapi.call(void 0, apiName);
+          return (apiName) => _chunk5QSR7CYTcjs.openapi.call(void 0, apiName);
         case "then":
         case "catch":
         case "finally":
@@ -722,4 +722,4 @@ var epilot = createSDK();
 
 
 
-exports.applyLargeResponseInterceptor = applyLargeResponseInterceptor; exports.applyRetryInterceptor = applyRetryInterceptor; exports.authorize = _chunk4PXSWMYJcjs.authorize; exports.createSDK = createSDK; exports.epilot = epilot; exports.help = _chunk4PXSWMYJcjs.help; exports.openapi = _chunk4PXSWMYJcjs.openapi;
+exports.applyLargeResponseInterceptor = applyLargeResponseInterceptor; exports.applyRetryInterceptor = applyRetryInterceptor; exports.authorize = _chunk5QSR7CYTcjs.authorize; exports.createSDK = createSDK; exports.epilot = epilot; exports.help = _chunk5QSR7CYTcjs.help; exports.openapi = _chunk5QSR7CYTcjs.openapi;

package/dist/index.d.cts

@@ -6,7 +6,7 @@ export { I as Interceptor, O as OverridesConfig, a as authorize } from './types-
 import { C as Client } from './access-token.d-Yy-yrft_.cjs';
 import { C as Client$1 } from './address.d-CwAPOVxa.cjs';
 import { C as Client$2 } from './address-suggestions.d-_YwTOR-9.cjs';
-import { C as Client$3 } from './ai-agents.d-B3TkP4mo.cjs';
+import { C as Client$3 } from './ai-agents.d-BhnWCRxD.cjs';
 import { C as Client$4 } from './app.d-CZELwNO3.cjs';
 import { C as Client$5 } from './audit-logs.d-BRToFqeX.cjs';
 import { C as Client$6 } from './automation.d-B8g3nYp-.cjs';

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export { I as Interceptor, O as OverridesConfig, a as authorize } from './types-
 import { C as Client } from './access-token.d-Yy-yrft_.js';
 import { C as Client$1 } from './address.d-CwAPOVxa.js';
 import { C as Client$2 } from './address-suggestions.d-_YwTOR-9.js';
-import { C as Client$3 } from './ai-agents.d-B3TkP4mo.js';
+import { C as Client$3 } from './ai-agents.d-BhnWCRxD.js';
 import { C as Client$4 } from './app.d-CZELwNO3.js';
 import { C as Client$5 } from './audit-logs.d-BRToFqeX.js';
 import { C as Client$6 } from './automation.d-B8g3nYp-.js';

package/dist/index.js

@@ -87,7 +87,7 @@ import {
 } from "./chunk-5MFHAXBT.js";
 import {
   require_identity_runtime
-} from "./chunk-3IBAPVLY.js";
+} from "./chunk-DSYS22AC.js";
 import {
   require_integration_toolkit_runtime
 } from "./chunk-I6IC54PD.js";
@@ -153,7 +153,7 @@ import {
 } from "./chunk-H45V55VT.js";
 import {
   require_ai_agents_runtime
-} from "./chunk-IZ6OQZZ2.js";
+} from "./chunk-QVJTUU3Q.js";
 import {
   require_app_runtime
 } from "./chunk-QHWCHWQT.js";
@@ -170,7 +170,7 @@ import {
   expand,
   help,
   openapi
-} from "./chunk-YIK62G53.js";
+} from "./chunk-B42G3PU6.js";
 import {
   __require
 } from "./chunk-YPSWSI3M.js";