@epilot/sdk 2.20.73 → 2.20.75

package/dist/{identity.d-BBL0NI_O.d.ts → identity.d-DUcoy_-W.d.ts}

@@ -25,10 +25,17 @@ declare namespace Components {
         Schemas.OrgId /* ^[A-Za-z0-9_-]+$ */;
         export type PartnerKeyQuery = string;
         export type SizeQuery = number;
+        export type UserIdPath = /**
+         * epilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.
+         * example:
+         * 100321
+         */
+        Schemas.UserId /* ^[A-Za-z0-9_-]+$ */;
     }
     export interface PathParameters {
         ClientIdPath?: Parameters.ClientIdPath;
         OrgIdPath?: Parameters.OrgIdPath;
+        UserIdPath?: Parameters.UserIdPath;
     }
     export interface QueryParameters {
         AnyOtherQueryParameters?: Parameters.AnyOtherQueryParameters;
@@ -60,9 +67,17 @@ declare namespace Components {
              * Reference to the customer's approval evidence (ticket, signed order, contract clause)
              */
             customer_approval_ref: string;
+            /**
+             * When the customer approved. Optional: enabling an organization defaults it to the time of the
+             * request, and a policy update keeps the current value unless a new one is given.
+             *
+             */
             approved_at: string; // date-time
             version: number;
             mandatory_claims: ("org_id")[];
+            /**
+             * Email of the admin-portal operator who recorded this policy version
+             */
             recorded_by: string;
             recorded_at: string; // date-time
         }
@@ -80,7 +95,12 @@ declare namespace Components {
              * Reference to the customer's approval evidence (ticket, signed order, contract clause)
              */
             customer_approval_ref: string;
-            approved_at: string; // date-time
+            /**
+             * When the customer approved. Optional: enabling an organization defaults it to the time of the
+             * request, and a policy update keeps the current value unless a new one is given.
+             *
+             */
+            approved_at?: string; // date-time
         }
         /**
          * Partner-side environment this client belongs to
@@ -122,7 +142,7 @@ declare namespace Components {
              */
             user_id: string;
             /**
-             * When the mirrored credential, and therefore the cookie, expires
+             * When the cookie expires (the mirrored credential's expiry, capped at 15 minutes)
              */
             expires_at: string; // date-time
         }
@@ -142,10 +162,15 @@ declare namespace Components {
             status: OrgEnablementStatus;
             status_reason?: string;
             authorization_policy: AuthorizationPolicy;
-            partner_account?: /* Optional audit reference to the partner tenant this organization maps to. The partner enforces the mapping. */ PartnerAccount;
             created_at: string; // date-time
             updated_at: string; // date-time
+            /**
+             * Email of the admin-portal operator who enabled the organization
+             */
             created_by?: string;
+            /**
+             * Email of the admin-portal operator who last changed the enablement
+             */
             updated_by?: string;
         }
         export interface OrgEnablementCreate {
@@ -156,7 +181,6 @@ declare namespace Components {
              */
             OrgId /* ^[A-Za-z0-9_-]+$ */;
             authorization_policy: AuthorizationPolicyInput;
-            partner_account?: /* Optional audit reference to the partner tenant this organization maps to. The partner enforces the mapping. */ PartnerAccount;
         }
         export interface OrgEnablementList {
             results: OrgEnablement[];
@@ -168,7 +192,6 @@ declare namespace Components {
              */
             expected_policy_version: number;
             authorization_policy: AuthorizationPolicyInput;
-            partner_account?: /* Optional audit reference to the partner tenant this organization maps to. The partner enforces the mapping. */ PartnerAccount;
         }
         /**
          * epilot organization id, an opaque case-sensitive string
@@ -176,13 +199,6 @@ declare namespace Components {
          * 739224
          */
         export type OrgId = string; // ^[A-Za-z0-9_-]+$
-        /**
-         * Optional audit reference to the partner tenant this organization maps to. The partner enforces the mapping.
-         */
-        export interface PartnerAccount {
-            id: string;
-            label?: string;
-        }
         export interface PartnerClient {
             client_id: /**
              * Opaque client identifier, unique within the issuer, never reused
@@ -230,9 +246,12 @@ declare namespace Components {
             created_at: string; // date-time
             updated_at: string; // date-time
             /**
-             * Admin-portal identity of the operator who created the client
+             * Email of the admin-portal operator who created the client (their Cognito identity when the pool holds no email)
              */
             created_by?: string;
+            /**
+             * Email of the admin-portal operator who last changed the client
+             */
             updated_by?: string;
         }
         export interface PartnerClientCreate {
@@ -393,9 +412,12 @@ declare namespace Components {
             created_at: string; // date-time
             updated_at: string; // date-time
             /**
-             * Admin-portal identity of the operator who created the client
+             * Email of the admin-portal operator who created the client (their Cognito identity when the pool holds no email)
              */
             created_by?: string;
+            /**
+             * Email of the admin-portal operator who last changed the client
+             */
             updated_by?: string;
             /**
              * Returned exactly once. Store it securely; it cannot be retrieved again.
@@ -416,6 +438,50 @@ declare namespace Components {
         export interface StatusChangeRequest {
             reason?: string;
         }
+        /**
+         * epilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.
+         * example:
+         * 100321
+         */
+        export type UserId = string; // ^[A-Za-z0-9_-]+$
+        export interface UserSubject {
+            client_id: /**
+             * Opaque client identifier, unique within the issuer, never reused
+             * example:
+             * bf-prod-x7k2
+             */
+            PartnerClientId /* ^[A-Za-z0-9._~-]+$ */;
+            org_id: /**
+             * epilot organization id, an opaque case-sensitive string
+             * example:
+             * 739224
+             */
+            OrgId /* ^[A-Za-z0-9_-]+$ */;
+            user_id: /**
+             * epilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.
+             * example:
+             * 100321
+             */
+            UserId /* ^[A-Za-z0-9_-]+$ */;
+            /**
+             * The pairwise subject this client receives for the user, `<key_version>.<base64url digest>`
+             * example:
+             * v1.dGhpcy1pcy1hLWR1bW15LXN1YmplY3QtdmFsdWUtMDAx
+             */
+            sub: string;
+            /**
+             * Active pairwise key version the value was derived with
+             * example:
+             * v1
+             */
+            key_version: string;
+            /**
+             * Pairwise sector the value was derived for (sector_identifier_uri host, else the first redirect host)
+             * example:
+             * portal.epilot.cloud
+             */
+            sector: string;
+        }
     }
 }
 declare namespace Paths {
@@ -486,6 +552,16 @@ declare namespace Paths {
             export type $404 = Components.Responses.NotFound;
         }
     }
+    namespace GetUserSubject {
+        namespace Responses {
+            export type $200 = Components.Schemas.UserSubject;
+            export type $400 = Components.Schemas.Error;
+            export type $401 = Components.Responses.Unauthorized;
+            export type $403 = Components.Responses.Forbidden;
+            export type $404 = Components.Schemas.Error;
+            export type $409 = Components.Schemas.Error;
+        }
+    }
     namespace LaunchClient {
         namespace Parameters {
             export interface Extra {
@@ -652,6 +728,13 @@ declare namespace Paths {
             export type $1 = Components.Parameters.OrgIdPath;
         }
     }
+    namespace V1IdentityOperatorClients$ClientIdOrganizations$OrgIdUsers$UserIdSubject {
+        namespace Parameters {
+            export type $0 = Components.Parameters.ClientIdPath;
+            export type $1 = Components.Parameters.OrgIdPath;
+            export type $2 = Components.Parameters.UserIdPath;
+        }
+    }
     namespace V1IdentityOperatorClients$ClientIdRotateSecret {
         namespace Parameters {
             export type $0 = Components.Parameters.ClientIdPath;
@@ -838,12 +921,37 @@ interface OperationMethods {
     data?: any,
     config?: AxiosRequestConfig  
   ): OperationResponse<Paths.ActivateClientOrganization.Responses.$200>
+  /**
+   * getUserSubject - getUserSubject
+   * 
+   * The pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its
+   * side **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with
+   * `externalId = sub`).
+   * 
+   * Derived exactly as the token endpoint derives it, never stored:
+   * `sub = key_version + "." + base64url(HMAC-SHA256(key[key_version], sector + "\n" + user_id))`, where the
+   * sector is the client's `sector_identifier_uri` host or, without one, the host of its first redirect URI.
+   * The same inputs always give the same value; it changes only when the client's sector or the active key
+   * version changes.
+   * 
+   * Requires an **active** client (a draft client's sector may still change and would invalidate every binding),
+   * an organization enablement that is not revoked, and the user being an active member of that organization
+   * (checked live against user-api). Every read is written to the audit trail: the value is a partner-facing
+   * identifier.
+   * 
+   */
+  'getUserSubject'(
+    parameters?: Parameters<UnknownParamsObject> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.GetUserSubject.Responses.$200>
   /**
    * createIdentitySession - createIdentitySession
    * 
    * Called by the epilot portal through the portal-host proxy after every persisted 360 session.
    * Validates the 360 bearer token itself and mirrors it into the `identity_session` cookie
-   * (`HttpOnly; Secure; Path=/v1/identity`) whose lifetime equals the remaining token lifetime.
+   * (`HttpOnly; Secure; Path=/v1/identity`) whose lifetime is the remaining token lifetime, capped at 15 minutes
+   * (the portal mirrors the credential again on every token refresh and just before a partner sign-in).
    * The cookie is what proves the live 360 session during `completeInteraction`.
    * 
    */
@@ -1073,13 +1181,40 @@ interface PathsDictionary {
       config?: AxiosRequestConfig  
     ): OperationResponse<Paths.ActivateClientOrganization.Responses.$200>
   }
+  ['/v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject']: {
+    /**
+     * getUserSubject - getUserSubject
+     * 
+     * The pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its
+     * side **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with
+     * `externalId = sub`).
+     * 
+     * Derived exactly as the token endpoint derives it, never stored:
+     * `sub = key_version + "." + base64url(HMAC-SHA256(key[key_version], sector + "\n" + user_id))`, where the
+     * sector is the client's `sector_identifier_uri` host or, without one, the host of its first redirect URI.
+     * The same inputs always give the same value; it changes only when the client's sector or the active key
+     * version changes.
+     * 
+     * Requires an **active** client (a draft client's sector may still change and would invalidate every binding),
+     * an organization enablement that is not revoked, and the user being an active member of that organization
+     * (checked live against user-api). Every read is written to the audit trail: the value is a partner-facing
+     * identifier.
+     * 
+     */
+    'get'(
+      parameters?: Parameters<UnknownParamsObject> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.GetUserSubject.Responses.$200>
+  }
   ['/v1/identity/session']: {
     /**
      * createIdentitySession - createIdentitySession
      * 
      * Called by the epilot portal through the portal-host proxy after every persisted 360 session.
      * Validates the 360 bearer token itself and mirrors it into the `identity_session` cookie
-     * (`HttpOnly; Secure; Path=/v1/identity`) whose lifetime equals the remaining token lifetime.
+     * (`HttpOnly; Secure; Path=/v1/identity`) whose lifetime is the remaining token lifetime, capped at 15 minutes
+     * (the portal mirrors the credential again on every token refresh and just before a partner sign-in).
      * The cookie is what proves the live 360 session during `completeInteraction`.
      * 
      */
@@ -1138,7 +1273,6 @@ type OrgEnablementList = Components.Schemas.OrgEnablementList;
 type OrgEnablementStatus = Components.Schemas.OrgEnablementStatus;
 type OrgEnablementUpdate = Components.Schemas.OrgEnablementUpdate;
 type OrgId = Components.Schemas.OrgId;
-type PartnerAccount = Components.Schemas.PartnerAccount;
 type PartnerClient = Components.Schemas.PartnerClient;
 type PartnerClientCreate = Components.Schemas.PartnerClientCreate;
 type PartnerClientId = Components.Schemas.PartnerClientId;
@@ -1149,5 +1283,7 @@ type PartnerClientWithSecret = Components.Schemas.PartnerClientWithSecret;
 type RotateSecretRequest = Components.Schemas.RotateSecretRequest;
 type Scope = Components.Schemas.Scope;
 type StatusChangeRequest = Components.Schemas.StatusChangeRequest;
+type UserId = Components.Schemas.UserId;
+type UserSubject = Components.Schemas.UserSubject;
 
-export { type AuthorizationPolicy as A, type Client as C, type Environment as E, type HttpsUri as H, type IdentitySession as I, type OperationMethods as O, Paths as P, type RotateSecretRequest as R, type Scope as S, Components as a, type PathsDictionary as b, type AuthorizationPolicyInput as c, type Error as d, type OrgEnablement as e, type OrgEnablementCreate as f, type OrgEnablementList as g, type OrgEnablementStatus as h, type OrgEnablementUpdate as i, type OrgId as j, type PartnerAccount as k, type PartnerClient as l, type PartnerClientCreate as m, type PartnerClientId as n, type PartnerClientList as o, type PartnerClientStatus as p, type PartnerClientUpdate as q, type PartnerClientWithSecret as r, type StatusChangeRequest as s };
+export { type AuthorizationPolicy as A, type Client as C, type Environment as E, type HttpsUri as H, type IdentitySession as I, type OperationMethods as O, Paths as P, type RotateSecretRequest as R, type Scope as S, type UserId as U, Components as a, type PathsDictionary as b, type AuthorizationPolicyInput as c, type Error as d, type OrgEnablement as e, type OrgEnablementCreate as f, type OrgEnablementList as g, type OrgEnablementStatus as h, type OrgEnablementUpdate as i, type OrgId as j, type PartnerClient as k, type PartnerClientCreate as l, type PartnerClientId as m, type PartnerClientList as n, type PartnerClientStatus as o, type PartnerClientUpdate as p, type PartnerClientWithSecret as q, type StatusChangeRequest as r, type UserSubject as s };

package/dist/index.cjs

@@ -170,7 +170,7 @@ var _chunkWOUASZJWcjs = require('./chunk-WOUASZJW.cjs');
 
 
 
-var _chunk5PG5IEQ7cjs = require('./chunk-5PG5IEQ7.cjs');
+var _chunkJGPHZYSDcjs = require('./chunk-JGPHZYSD.cjs');
 
 
 var _chunkNJK5F5TFcjs = require('./chunk-NJK5F5TF.cjs');
@@ -244,7 +244,7 @@ var resolveClient = (params) => {
   }
   if (!entry.instance) {
     const definition = entry.loader();
-    entry.instance = _chunk5PG5IEQ7cjs.createApiClient.call(void 0, {
+    entry.instance = _chunkJGPHZYSDcjs.createApiClient.call(void 0, {
       definition,
       token: state.token,
       headers: state.globalHeaders,
@@ -277,7 +277,7 @@ var resetAllClients = (registry) => {
 };
 
 // src/apis/_registry.ts
-var expandDef = (mod) => _chunk5PG5IEQ7cjs.expand.call(void 0, _nullishCoalesce(mod.default, () => ( mod)));
+var expandDef = (mod) => _chunkJGPHZYSDcjs.expand.call(void 0, _nullishCoalesce(mod.default, () => ( mod)));
 var registerBuiltinApis = (registry) => {
   registerApi({
     registry,
@@ -640,9 +640,9 @@ var createSDK = () => {
       const available = [...registry.keys()].join(", ");
       throw new Error(`Unknown API: "${name}". Available: ${available}`);
     }
-    return _chunk5PG5IEQ7cjs.createApiHandle.call(void 0, {
+    return _chunkJGPHZYSDcjs.createApiHandle.call(void 0, {
       resolveClient: () => resolveClient({ registry, name, state }),
-      createClient: () => _chunk5PG5IEQ7cjs.createApiClient.call(void 0, { definition: entry.loader(), apiName: name }),
+      createClient: () => _chunkJGPHZYSDcjs.createApiClient.call(void 0, { definition: entry.loader(), apiName: name }),
       apiName: name
     });
   };
@@ -690,9 +690,9 @@ var createSDK = () => {
           return interceptorUse;
         }
         case "help":
-          return (apiName) => _chunk5PG5IEQ7cjs.help.call(void 0, apiName);
+          return (apiName) => _chunkJGPHZYSDcjs.help.call(void 0, apiName);
         case "openapi":
-          return (apiName) => _chunk5PG5IEQ7cjs.openapi.call(void 0, apiName);
+          return (apiName) => _chunkJGPHZYSDcjs.openapi.call(void 0, apiName);
         case "then":
         case "catch":
         case "finally":
@@ -722,4 +722,4 @@ var epilot = createSDK();
 
 
 
-exports.applyLargeResponseInterceptor = applyLargeResponseInterceptor; exports.applyRetryInterceptor = applyRetryInterceptor; exports.authorize = _chunk5PG5IEQ7cjs.authorize; exports.createSDK = createSDK; exports.epilot = epilot; exports.help = _chunk5PG5IEQ7cjs.help; exports.openapi = _chunk5PG5IEQ7cjs.openapi;
+exports.applyLargeResponseInterceptor = applyLargeResponseInterceptor; exports.applyRetryInterceptor = applyRetryInterceptor; exports.authorize = _chunkJGPHZYSDcjs.authorize; exports.createSDK = createSDK; exports.epilot = epilot; exports.help = _chunkJGPHZYSDcjs.help; exports.openapi = _chunkJGPHZYSDcjs.openapi;

package/dist/index.d.cts

@@ -31,7 +31,7 @@ import { C as Client$o } from './event-catalog.d-BrAxYS9D.cjs';
 import { C as Client$p } from './external-values.d-23q55J5P.cjs';
 import { C as Client$q } from './file.d-DELNV63w.cjs';
 import { C as Client$r } from './iban.d-BwdiGbxi.cjs';
-import { C as Client$s } from './identity.d-BBL0NI_O.cjs';
+import { C as Client$s } from './identity.d-DUcoy_-W.cjs';
 import { C as Client$t } from './integration-toolkit.d-l5cgwHLa.cjs';
 import { C as Client$u } from './journey.d-CMtM6U3Y.cjs';
 import { C as Client$v } from './kanban.d-BHnSRCYW.cjs';

package/dist/index.d.ts

@@ -31,7 +31,7 @@ import { C as Client$o } from './event-catalog.d-BrAxYS9D.js';
 import { C as Client$p } from './external-values.d-23q55J5P.js';
 import { C as Client$q } from './file.d-DELNV63w.js';
 import { C as Client$r } from './iban.d-BwdiGbxi.js';
-import { C as Client$s } from './identity.d-BBL0NI_O.js';
+import { C as Client$s } from './identity.d-DUcoy_-W.js';
 import { C as Client$t } from './integration-toolkit.d-l5cgwHLa.js';
 import { C as Client$u } from './journey.d-CMtM6U3Y.js';
 import { C as Client$v } from './kanban.d-BHnSRCYW.js';

package/dist/index.js

@@ -170,7 +170,7 @@ import {
   expand,
   help,
   openapi
-} from "./chunk-WG7OKIQ3.js";
+} from "./chunk-6B5HXASK.js";
 import {
   __require
 } from "./chunk-YPSWSI3M.js";

package/docs/identity.md

@@ -1139,7 +1139,7 @@ type AuthorizationPolicyInput = {
   population?: "all_current_org_members"
   allowed_scopes: "openid" | "email" | "profile"[]
   customer_approval_ref: string
-  approved_at: string // date-time
+  approved_at?: string // date-time
 }
 ```
 
@@ -1175,7 +1175,7 @@ type OrgEnablementCreate = {
     population?: "all_current_org_members"
     allowed_scopes: "openid" | "email" | "profile"[]
     customer_approval_ref: string
-    approved_at: string // date-time
+    approved_at?: string // date-time
   }
 }
 ```
@@ -1190,7 +1190,7 @@ type OrgEnablementUpdate = {
     population?: "all_current_org_members"
     allowed_scopes: "openid" | "email" | "profile"[]
     customer_approval_ref: string
-    approved_at: string // date-time
+    approved_at?: string // date-time
   }
 }
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epilot/sdk",
-  "version": "2.20.73",
+  "version": "2.20.75",
   "description": "JavaScript/TypeScript SDK for epilot APIs",
   "type": "module",
   "main": "./dist/index.cjs",