@epilot/sdk 2.20.74 → 2.20.76

package/dist/environments-QII3AKWU.cjs

@@ -0,0 +1,7 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});require('./chunk-NJK5F5TF.cjs');
+
+// src/docs/environments.json
+var environments_default = '# Environments API\n\n- **Base URL:** `https://environments.sls.epilot.io`\n- **Full API Docs:** [https://docs.epilot.io/api/environments](https://docs.epilot.io/api/environments)\n\n## Usage\n\n```ts\nimport { epilot } from \'@epilot/sdk\'\n\nepilot.authorize(() => \'<token>\')\nconst { data } = await epilot.environments.listEnvironmentVariables(...)\n```\n\n### Tree-shakeable import\n\n```ts\nimport { getClient, authorize } from \'@epilot/sdk/environments\'\n\nconst environmentsClient = getClient()\nauthorize(environmentsClient, () => \'<token>\')\nconst { data } = await environmentsClient.listEnvironmentVariables(...)\n```\n\n## Operations\n\n**environments**\n- [`listEnvironmentVariables`](#listenvironmentvariables)\n- [`createEnvironmentVariable`](#createenvironmentvariable)\n- [`listEnvironmentGroups`](#listenvironmentgroups)\n- [`putEnvironmentGroup`](#putenvironmentgroup)\n- [`deleteEnvironmentGroup`](#deleteenvironmentgroup)\n- [`getEnvironmentVariable`](#getenvironmentvariable)\n- [`updateEnvironmentVariable`](#updateenvironmentvariable)\n- [`deleteEnvironmentVariable`](#deleteenvironmentvariable)\n\n**Schemas**\n- [`EnvironmentValueType`](#environmentvaluetype)\n- [`StringTranslations`](#stringtranslations)\n- [`MapEntry`](#mapentry)\n- [`MapValue`](#mapvalue)\n- [`JsonValue`](#jsonvalue)\n- [`LinkValue`](#linkvalue)\n- [`LinkFields`](#linkfields)\n- [`ListItemType`](#listitemtype)\n- [`ListOfText`](#listoftext)\n- [`ListOfString`](#listofstring)\n- [`ListOfSecretString`](#listofsecretstring)\n- [`ListOfNumber`](#listofnumber)\n- [`ListOfBoolean`](#listofboolean)\n- [`ListOfJson`](#listofjson)\n- [`ListOfLink`](#listoflink)\n- [`ListValue`](#listvalue)\n- [`EnvironmentValue`](#environmentvalue)\n- [`EnvironmentVariable`](#environmentvariable)\n- [`EnvironmentVariableListItem`](#environmentvariablelistitem)\n- [`EnvironmentVariableList`](#environmentvariablelist)\n- [`EnvironmentVariableCreateRequest`](#environmentvariablecreaterequest)\n- [`EnvironmentVariableUpdateRequest`](#environmentvariableupdaterequest)\n- [`EnvironmentGroup`](#environmentgroup)\n- [`EnvironmentGroupList`](#environmentgrouplist)\n- [`EnvironmentGroupUpsertRequest`](#environmentgroupupsertrequest)\n\n### `listEnvironmentVariables`\n\nList all environment variables for the organization. Returns metadata only, no secret values.\n\n`GET /v1/environments`\n\n```ts\nconst { data } = await client.listEnvironmentVariables()\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "items": [\n    {\n      "key": "string",\n      "type": "String",\n      "item_type": "String",\n      "description": "string",\n      "group": "string",\n      "value": "string",\n      "protected": true,\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z"\n    }\n  ]\n}\n```\n\n</details>\n\n---\n\n### `createEnvironmentVariable`\n\nCreate a new environment variable or secret for the organization. If `group` is provided and the group does not yet exist, it is created automatically.\n\n`POST /v1/environments`\n\n```ts\nconst { data } = await client.createEnvironmentVariable(\n  null,\n  {\n    key: \'string\',\n    type: \'String\',\n    description: \'string\',\n    group: \'string\',\n    value: \'string\',\n    protected: true\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "key": "string",\n  "type": "String",\n  "item_type": "String",\n  "description": "string",\n  "group": "string",\n  "value": "string",\n  "protected": true,\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `listEnvironmentGroups`\n\nList all environment groups for the organization.\n\n`GET /v1/environments/groups`\n\n```ts\nconst { data } = await client.listEnvironmentGroups()\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "items": [\n    {\n      "name": "string",\n      "description": "string",\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z"\n    }\n  ]\n}\n```\n\n</details>\n\n---\n\n### `putEnvironmentGroup`\n\nCreate or update an environment group by name. Acts as an upsert \u2014 creates the group if it does not exist.\n\n`PUT /v1/environments/groups/{name}`\n\n```ts\nconst { data } = await client.putEnvironmentGroup(\n  {\n    name: \'example\',\n  },\n  {\n    description: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "name": "string",\n  "description": "string",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `deleteEnvironmentGroup`\n\nDeletes a group. Variables assigned to this group become ungrouped.\n\n`DELETE /v1/environments/groups/{name}`\n\n```ts\nconst { data } = await client.deleteEnvironmentGroup({\n  name: \'example\',\n})\n```\n\n---\n\n### `getEnvironmentVariable`\n\nGet an environment variable by key. Returns value for non-secret types, omitted for SecretString.\n\n`GET /v1/environments/{key}`\n\n```ts\nconst { data } = await client.getEnvironmentVariable({\n  key: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "key": "string",\n  "type": "String",\n  "item_type": "String",\n  "description": "string",\n  "group": "string",\n  "value": "string",\n  "protected": true,\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `updateEnvironmentVariable`\n\nCreate or update an environment variable. Acts as an upsert \u2014 creates the variable if it does not exist. If `group` is provided and the group does not yet exist, it is created automatically.\n\n`PUT /v1/environments/{key}`\n\n```ts\nconst { data } = await client.updateEnvironmentVariable(\n  {\n    key: \'example\',\n  },\n  {\n    type: \'String\',\n    value: \'string\',\n    description: \'string\',\n    group: \'string\',\n    protected: true\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "key": "string",\n  "type": "String",\n  "item_type": "String",\n  "description": "string",\n  "group": "string",\n  "value": "string",\n  "protected": true,\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `deleteEnvironmentVariable`\n\nDelete an environment variable by key.\n\n`DELETE /v1/environments/{key}`\n\n```ts\nconst { data } = await client.deleteEnvironmentVariable({\n  key: \'example\',\n})\n```\n\n---\n\n## Schemas\n\n### `EnvironmentValueType`\n\nThe structure a variable\'s value holds. `SecretString` is encrypted at rest and\nits value is never returned. Every other type\nmay be served to browser-facing consumers. A `List` inherits this from its element\ntype: a `List`<SecretString>`` is never served.\n\n\n```ts\ntype EnvironmentValueType = "String" | "SecretString" | "Text" | "Number" | "Boolean" | "Map" | "JSON" | "Link" | "List"\n```\n\n### `StringTranslations`\n\nA string translated per language. Keys are language codes (e.g. `de`,\n`en-US`), matching the hyphen-only BCP-47 form epilot\'s i18n stack uses\neverywhere else: `^[a-z]{2,3}(-[A-Za-z0-9]+)*$`. The server enforces\nthat with LANGUAGE_KEY_PATTERN in src/core/value-types.ts \u2014 the two are\nnot otherwise lin\n\n```ts\ntype StringTranslations = Record<string, string>\n```\n\n### `MapEntry`\n\nOne entry of a Map. `key` is the token a journey submits; `value` is\nwhat the customer reads \u2014 either one string, or one string per\nlanguage. Every entry of a Map must agree on which of the two it uses.\n\n\n```ts\ntype MapEntry = {\n  key: string\n  value: string | Record<string, string>\n}\n```\n\n### `MapValue`\n\n```ts\ntype MapValue = {\n  fallbackLanguage?: string\n  options: Array<{\n    key: string\n    value: string | Record<string, string>\n  }>\n}\n```\n\n### `JsonValue`\n\nArbitrary JSON object, e.g. a flat key/value map used by integrations for\nenum translation: {"Mr.": 1, "Ms. / Mrs.": 2}. Max 32 KB serialised.\n\n\n```ts\ntype JsonValue = Record<string, unknown>\n```\n\n### `LinkValue`\n\nOne URL with a label and description a customer reads. `label` and\n`description` are each either a plain string or one string per language;\nthe two fields decide that independently \u2014 a plain string means "the\nsame in every language". A translated field must carry the fallback\nlanguage.\n\nThe URL must\n\n```ts\ntype LinkValue = {\n  url: string\n  label: string | Record<string, string>\n  description?: string | Record<string, string>\n  fallbackLanguage?: string\n}\n```\n\n### `LinkFields`\n\nThe fields of a link, without a fallback language \u2014 the shape a `List`\nitem carries. Inside a list the fallback belongs to the wrapper, which\nowns the language tabs for every row.\n\nRestated rather than composed with `LinkValue`: `allOf` plus\n`additionalProperties: false` is rejected by most validato\n\n```ts\ntype LinkFields = {\n  url: string\n  label: string | Record<string, string>\n  description?: string | Record<string, string>\n}\n```\n\n### `ListItemType`\n\nThe element type a `List` holds \u2014 every value type except the\ncontainers. `Map` is already a keyed collection and a list of lists has\nno consumer. A list is exactly as client-safe and exactly as secret as\nits element type: a list of `SecretString` is encrypted per item and its\nvalue is never returne\n\n```ts\ntype ListItemType = "String" | "SecretString" | "Text" | "Number" | "Boolean" | "JSON" | "Link"\n```\n\n### `ListOfText`\n\n```ts\ntype ListOfText = {\n  itemType: "Text"\n  items: string[]\n}\n```\n\n### `ListOfString`\n\n```ts\ntype ListOfString = {\n  itemType: "String"\n  items: string[]\n}\n```\n\n### `ListOfSecretString`\n\nWrite-only in effect: the items are encrypted per item at rest and the\nwhole value is omitted from every read response, exactly as a\n`SecretString` variable\'s value is. Read `item_type` to learn what a\nlist holds when its value is withheld.\n\n\n```ts\ntype ListOfSecretString = {\n  itemType: "SecretString"\n  items: string[]\n}\n```\n\n### `ListOfNumber`\n\n```ts\ntype ListOfNumber = {\n  itemType: "Number"\n  items: number[]\n}\n```\n\n### `ListOfBoolean`\n\n```ts\ntype ListOfBoolean = {\n  itemType: "Boolean"\n  items: boolean[]\n}\n```\n\n### `ListOfJson`\n\n```ts\ntype ListOfJson = {\n  itemType: "JSON"\n  items: Record<string, unknown>[]\n}\n```\n\n### `ListOfLink`\n\nA list of links. `fallbackLanguage` applies to every item\'s translated\n`label` and `description`; items may mix plain and translated fields\nfreely, since a plain string is a complete answer for any language.\n\n\n```ts\ntype ListOfLink = {\n  itemType: "Link"\n  fallbackLanguage?: string\n  items: Array<{\n    url: string\n    label: string | Record<string, string>\n    description?: string | Record<string, string>\n  }>\n}\n```\n\n### `ListValue`\n\nAn ordered collection of one declared element type. Items round-trip in\nthe order written; nothing sorts them. Holds at most 100 items.\n\nThe whole value is limited to 32768 characters when serialised \u2014 the\nserver enforces this, and it is not expressible per-property here.\n\n\n```ts\ntype ListValue = {\n  itemType: "Text"\n  items: string[]\n} | {\n  itemType: "Number"\n  items: number[]\n} | {\n  itemType: "Boolean"\n  items: boolean[]\n} | {\n  itemType: "JSON"\n  items: Record<string, unknown>[]\n} | {\n  itemType: "Link"\n  fallbackLanguage?: string\n  items: Array<{\n    url: string\n    label: string | Record<string, string>\n    description?: string | Record<string, string>\n  }>\n} | {\n  itemType: "String"\n  items: string[]\n} | {\n  itemType: "SecretString"\n  items: string[]\n}\n```\n\n### `EnvironmentValue`\n\nA variable\'s value. The JSON type corresponds to the variable\'s `type`:\n`String`, `SecretString` and `Text` are strings, `Number` is a number,\n`Boolean` is a boolean, and `Map`, `JSON`, `Link` and `List` are objects.\nNumbers are IEEE 754 doubles; integers above 2^53 may lose precision on\nround-trip.\n\n```ts\ntype EnvironmentValue = string | number | boolean | {\n  fallbackLanguage?: string\n  options: Array<{\n    key: string\n    value: string | Record<string, string>\n  }>\n} | Record<string, unknown> | {\n  url: string\n  label: string | Record<string, string>\n  description?: string | Record<string, string>\n  fallbackLanguage?: string\n} | {\n  itemType: "Text"\n  items: string[]\n} | {\n  itemType: "Number"\n  items: number[]\n} | {\n  itemType: "Boolean"\n  items: boolean[]\n} | {\n  itemType: "JSON"\n  items: Record<string, unknown>[]\n} | {\n  itemType: "Link"\n  fallbackLanguage?: string\n  items: Array<{\n    url: string\n    label: string | Record<string, string>\n    description?: string | Record<string, string>\n  }>\n} | {\n  itemType: "String"\n  items: string[]\n} | {\n  itemType: "SecretString"\n  items: string[]\n}\n```\n\n### `EnvironmentVariable`\n\n```ts\ntype EnvironmentVariable = {\n  key: string\n  type: "String" | "SecretString" | "Text" | "Number" | "Boolean" | "Map" | "JSON" | "Link" | "List"\n  item_type?: "String" | "SecretString" | "Text" | "Number" | "Boolean" | "JSON" | "Link"\n  description?: string\n  group?: string\n  value?: string | number | boolean | {\n    fallbackLanguage?: string\n    options: Array<{\n      key: { ... }\n      value: { ... }\n    }>\n  } | Record<string, unknown> | {\n    url: string\n    label: string | Record<string, string>\n    description?: string | Record<string, string>\n    fallbackLanguage?: string\n  } | {\n    itemType: "Text"\n    items: string[]\n  } | {\n    itemType: "Number"\n    items: number[]\n  } | {\n    itemType: "Boolean"\n    items: boolean[]\n  } | {\n    itemType: "JSON"\n    items: Record<string, unknown>[]\n  } | {\n    itemType: "Link"\n    fallbackLanguage?: string\n    items: Array<{\n      url: { ... }\n      label: { ... }\n      description?: { ... }\n    }>\n  } | {\n    itemType: "String"\n    items: string[]\n  } | {\n    itemType: "SecretString"\n    items: string[]\n  }\n  protected?: boolean\n  created_at: string // date-time\n  updated_at: string // date-time\n}\n```\n\n### `EnvironmentVariableListItem`\n\n```ts\ntype EnvironmentVariableListItem = {\n  key: string\n  type: "String" | "SecretString" | "Text" | "Number" | "Boolean" | "Map" | "JSON" | "Link" | "List"\n  item_type?: "String" | "SecretString" | "Text" | "Number" | "Boolean" | "JSON" | "Link"\n  description?: string\n  group?: string\n  value?: string | number | boolean | {\n    fallbackLanguage?: string\n    options: Array<{\n      key: { ... }\n      value: { ... }\n    }>\n  } | Record<string, unknown> | {\n    url: string\n    label: string | Record<string, string>\n    description?: string | Record<string, string>\n    fallbackLanguage?: string\n  } | {\n    itemType: "Text"\n    items: string[]\n  } | {\n    itemType: "Number"\n    items: number[]\n  } | {\n    itemType: "Boolean"\n    items: boolean[]\n  } | {\n    itemType: "JSON"\n    items: Record<string, unknown>[]\n  } | {\n    itemType: "Link"\n    fallbackLanguage?: string\n    items: Array<{\n      url: { ... }\n      label: { ... }\n      description?: { ... }\n    }>\n  } | {\n    itemType: "String"\n    items: string[]\n  } | {\n    itemType: "SecretString"\n    items: string[]\n  }\n  protected?: boolean\n  created_at: string // date-time\n  updated_at: string // date-time\n}\n```\n\n### `EnvironmentVariableList`\n\n```ts\ntype EnvironmentVariableList = {\n  items: Array<{\n    key: string\n    type: "String" | "SecretString" | "Text" | "Number" | "Boolean" | "Map" | "JSON" | "Link" | "List"\n    item_type?: "String" | "SecretString" | "Text" | "Number" | "Boolean" | "JSON" | "Link"\n    description?: string\n    group?: string\n    value?: string | number | boolean | {\n      fallbackLanguage?: { ... }\n      options: { ... }\n    } | Record<string, unknown> | {\n      url: { ... }\n      label: { ... }\n      description?: { ... }\n      fallbackLanguage?: { ... }\n    } | {\n      itemType: { ... }\n      items: { ... }\n    } | {\n      itemType: { ... }\n      items: { ... }\n    } | {\n      itemType: { ... }\n      items: { ... }\n    } | {\n      itemType: { ... }\n      items: { ... }\n    } | {\n      itemType: { ... }\n      fallbackLanguage?: { ... }\n      items: { ... }\n    } | {\n      itemType: { ... }\n      items: { ... }\n    } | {\n      itemType: { ... }\n      items: { ... }\n    }\n    protected?: boolean\n    created_at: string // date-time\n    updated_at: string // date-time\n  }>\n}\n```\n\n### `EnvironmentVariableCreateRequest`\n\n```ts\ntype EnvironmentVariableCreateRequest = {\n  key: string\n  type: "String" | "SecretString" | "Text" | "Number" | "Boolean" | "Map" | "JSON" | "Link" | "List"\n  description?: string\n  group?: string\n  value?: string | number | boolean | {\n    fallbackLanguage?: string\n    options: Array<{\n      key: { ... }\n      value: { ... }\n    }>\n  } | Record<string, unknown> | {\n    url: string\n    label: string | Record<string, string>\n    description?: string | Record<string, string>\n    fallbackLanguage?: string\n  } | {\n    itemType: "Text"\n    items: string[]\n  } | {\n    itemType: "Number"\n    items: number[]\n  } | {\n    itemType: "Boolean"\n    items: boolean[]\n  } | {\n    itemType: "JSON"\n    items: Record<string, unknown>[]\n  } | {\n    itemType: "Link"\n    fallbackLanguage?: string\n    items: Array<{\n      url: { ... }\n      label: { ... }\n      description?: { ... }\n    }>\n  } | {\n    itemType: "String"\n    items: string[]\n  } | {\n    itemType: "SecretString"\n    items: string[]\n  }\n  protected?: boolean\n}\n```\n\n### `EnvironmentVariableUpdateRequest`\n\n```ts\ntype EnvironmentVariableUpdateRequest = {\n  type?: "String" | "SecretString" | "Text" | "Number" | "Boolean" | "Map" | "JSON" | "Link" | "List"\n  value?: string | number | boolean | {\n    fallbackLanguage?: string\n    options: Array<{\n      key: { ... }\n      value: { ... }\n    }>\n  } | Record<string, unknown> | {\n    url: string\n    label: string | Record<string, string>\n    description?: string | Record<string, string>\n    fallbackLanguage?: string\n  } | {\n    itemType: "Text"\n    items: string[]\n  } | {\n    itemType: "Number"\n    items: number[]\n  } | {\n    itemType: "Boolean"\n    items: boolean[]\n  } | {\n    itemType: "JSON"\n    items: Record<string, unknown>[]\n  } | {\n    itemType: "Link"\n    fallbackLanguage?: string\n    items: Array<{\n      url: { ... }\n      label: { ... }\n      description?: { ... }\n    }>\n  } | {\n    itemType: "String"\n    items: string[]\n  } | {\n    itemType: "SecretString"\n    items: string[]\n  }\n  description?: string\n  group?: string\n  protected?: boolean\n}\n```\n\n### `EnvironmentGroup`\n\n```ts\ntype EnvironmentGroup = {\n  name: string\n  description?: string\n  created_at: string // date-time\n  updated_at: string // date-time\n}\n```\n\n### `EnvironmentGroupList`\n\n```ts\ntype EnvironmentGroupList = {\n  items: Array<{\n    name: string\n    description?: string\n    created_at: string // date-time\n    updated_at: string // date-time\n  }>\n}\n```\n\n### `EnvironmentGroupUpsertRequest`\n\n```ts\ntype EnvironmentGroupUpsertRequest = {\n  description?: string\n}\n```\n';
+
+
+exports.default = environments_default;

package/dist/{environments.d-qL1urwAq.d.cts → environments.d-BC2zAtBO.d.cts}

@@ -45,9 +45,13 @@ declare namespace Components {
          * same in every language". A translated field must carry the fallback
          * language.
          *
-         * The URL must be absolute and `http`/`https` only. This value is served
-         * to browser-facing consumers, so `javascript:` and `data:` URLs are
-         * rejected at write time.
+         * The URL must be absolute and use `http`, `https`, `mailto` or `tel`.
+         * `mailto:` needs at least one address (`name@domain`) and may carry
+         * `?subject=…`; `tel:` needs a phone number (digits, an optional leading
+         * `+`, spaces, `-`, `.`, `(`, `)`) and may carry `;ext=…`. The checks are
+         * deliberately light. This value is served to browser-facing consumers,
+         * so every other scheme — `javascript:` and `data:` included — is rejected
+         * at write time.
          *
          * Written flat rather than composed from a shared field set: `allOf` plus
          * `additionalProperties: false` is rejected by most validators, because
@@ -72,10 +76,9 @@ declare namespace Components {
         ListValue;
         /**
          * The structure a variable's value holds. `SecretString` is encrypted at rest and
-         * its value is never returned. `Text`, `Number`, `Boolean`, `Map`, `JSON` and `Link`
-         * may be served to browser-facing consumers; `String` and `SecretString` may not. A
-         * `List` inherits this from its element type: a `List` is served only when its
-         * `itemType` is itself client-safe, so a `List<String>` or `List<SecretString>` is not.
+         * its value is never returned. Every other type
+         * may be served to browser-facing consumers. A `List` inherits this from its element
+         * type: a `List<SecretString>` is never served.
          *
          */
         export type EnvironmentValueType = "String" | "SecretString" | "Text" | "Number" | "Boolean" | "Map" | "JSON" | "Link" | "List";
@@ -83,10 +86,9 @@ declare namespace Components {
             key: string; // ^[a-z0-9][a-z0-9_.\-]{0,127}$
             type: /**
              * The structure a variable's value holds. `SecretString` is encrypted at rest and
-             * its value is never returned. `Text`, `Number`, `Boolean`, `Map`, `JSON` and `Link`
-             * may be served to browser-facing consumers; `String` and `SecretString` may not. A
-             * `List` inherits this from its element type: a `List` is served only when its
-             * `itemType` is itself client-safe, so a `List<String>` or `List<SecretString>` is not.
+             * its value is never returned. Every other type
+             * may be served to browser-facing consumers. A `List` inherits this from its element
+             * type: a `List<SecretString>` is never served.
              *
              */
             EnvironmentValueType;
@@ -129,9 +131,13 @@ declare namespace Components {
              * same in every language". A translated field must carry the fallback
              * language.
              *
-             * The URL must be absolute and `http`/`https` only. This value is served
-             * to browser-facing consumers, so `javascript:` and `data:` URLs are
-             * rejected at write time.
+             * The URL must be absolute and use `http`, `https`, `mailto` or `tel`.
+             * `mailto:` needs at least one address (`name@domain`) and may carry
+             * `?subject=…`; `tel:` needs a phone number (digits, an optional leading
+             * `+`, spaces, `-`, `.`, `(`, `)`) and may carry `;ext=…`. The checks are
+             * deliberately light. This value is served to browser-facing consumers,
+             * so every other scheme — `javascript:` and `data:` included — is rejected
+             * at write time.
              *
              * Written flat rather than composed from a shared field set: `allOf` plus
              * `additionalProperties: false` is rejected by most validators, because
@@ -165,10 +171,9 @@ declare namespace Components {
             key: string; // ^[a-z0-9][a-z0-9_.\-]{0,127}$
             type: /**
              * The structure a variable's value holds. `SecretString` is encrypted at rest and
-             * its value is never returned. `Text`, `Number`, `Boolean`, `Map`, `JSON` and `Link`
-             * may be served to browser-facing consumers; `String` and `SecretString` may not. A
-             * `List` inherits this from its element type: a `List` is served only when its
-             * `itemType` is itself client-safe, so a `List<String>` or `List<SecretString>` is not.
+             * its value is never returned. Every other type
+             * may be served to browser-facing consumers. A `List` inherits this from its element
+             * type: a `List<SecretString>` is never served.
              *
              */
             EnvironmentValueType;
@@ -195,10 +200,9 @@ declare namespace Components {
             key: string;
             type: /**
              * The structure a variable's value holds. `SecretString` is encrypted at rest and
-             * its value is never returned. `Text`, `Number`, `Boolean`, `Map`, `JSON` and `Link`
-             * may be served to browser-facing consumers; `String` and `SecretString` may not. A
-             * `List` inherits this from its element type: a `List` is served only when its
-             * `itemType` is itself client-safe, so a `List<String>` or `List<SecretString>` is not.
+             * its value is never returned. Every other type
+             * may be served to browser-facing consumers. A `List` inherits this from its element
+             * type: a `List<SecretString>` is never served.
              *
              */
             EnvironmentValueType;
@@ -241,9 +245,13 @@ declare namespace Components {
              * same in every language". A translated field must carry the fallback
              * language.
              *
-             * The URL must be absolute and `http`/`https` only. This value is served
-             * to browser-facing consumers, so `javascript:` and `data:` URLs are
-             * rejected at write time.
+             * The URL must be absolute and use `http`, `https`, `mailto` or `tel`.
+             * `mailto:` needs at least one address (`name@domain`) and may carry
+             * `?subject=…`; `tel:` needs a phone number (digits, an optional leading
+             * `+`, spaces, `-`, `.`, `(`, `)`) and may carry `;ext=…`. The checks are
+             * deliberately light. This value is served to browser-facing consumers,
+             * so every other scheme — `javascript:` and `data:` included — is rejected
+             * at write time.
              *
              * Written flat rather than composed from a shared field set: `allOf` plus
              * `additionalProperties: false` is rejected by most validators, because
@@ -345,9 +353,13 @@ declare namespace Components {
          * same in every language". A translated field must carry the fallback
          * language.
          *
-         * The URL must be absolute and `http`/`https` only. This value is served
-         * to browser-facing consumers, so `javascript:` and `data:` URLs are
-         * rejected at write time.
+         * The URL must be absolute and use `http`, `https`, `mailto` or `tel`.
+         * `mailto:` needs at least one address (`name@domain`) and may carry
+         * `?subject=…`; `tel:` needs a phone number (digits, an optional leading
+         * `+`, spaces, `-`, `.`, `(`, `)`) and may carry `;ext=…`. The checks are
+         * deliberately light. This value is served to browser-facing consumers,
+         * so every other scheme — `javascript:` and `data:` included — is rejected
+         * at write time.
          *
          * Written flat rather than composed from a shared field set: `allOf` plus
          * `additionalProperties: false` is rejected by most validators, because

package/dist/{environments.d-qL1urwAq.d.ts → environments.d-BC2zAtBO.d.ts}

@@ -45,9 +45,13 @@ declare namespace Components {
          * same in every language". A translated field must carry the fallback
          * language.
          *
-         * The URL must be absolute and `http`/`https` only. This value is served
-         * to browser-facing consumers, so `javascript:` and `data:` URLs are
-         * rejected at write time.
+         * The URL must be absolute and use `http`, `https`, `mailto` or `tel`.
+         * `mailto:` needs at least one address (`name@domain`) and may carry
+         * `?subject=…`; `tel:` needs a phone number (digits, an optional leading
+         * `+`, spaces, `-`, `.`, `(`, `)`) and may carry `;ext=…`. The checks are
+         * deliberately light. This value is served to browser-facing consumers,
+         * so every other scheme — `javascript:` and `data:` included — is rejected
+         * at write time.
          *
          * Written flat rather than composed from a shared field set: `allOf` plus
          * `additionalProperties: false` is rejected by most validators, because
@@ -72,10 +76,9 @@ declare namespace Components {
         ListValue;
         /**
          * The structure a variable's value holds. `SecretString` is encrypted at rest and
-         * its value is never returned. `Text`, `Number`, `Boolean`, `Map`, `JSON` and `Link`
-         * may be served to browser-facing consumers; `String` and `SecretString` may not. A
-         * `List` inherits this from its element type: a `List` is served only when its
-         * `itemType` is itself client-safe, so a `List<String>` or `List<SecretString>` is not.
+         * its value is never returned. Every other type
+         * may be served to browser-facing consumers. A `List` inherits this from its element
+         * type: a `List<SecretString>` is never served.
          *
          */
         export type EnvironmentValueType = "String" | "SecretString" | "Text" | "Number" | "Boolean" | "Map" | "JSON" | "Link" | "List";
@@ -83,10 +86,9 @@ declare namespace Components {
             key: string; // ^[a-z0-9][a-z0-9_.\-]{0,127}$
             type: /**
              * The structure a variable's value holds. `SecretString` is encrypted at rest and
-             * its value is never returned. `Text`, `Number`, `Boolean`, `Map`, `JSON` and `Link`
-             * may be served to browser-facing consumers; `String` and `SecretString` may not. A
-             * `List` inherits this from its element type: a `List` is served only when its
-             * `itemType` is itself client-safe, so a `List<String>` or `List<SecretString>` is not.
+             * its value is never returned. Every other type
+             * may be served to browser-facing consumers. A `List` inherits this from its element
+             * type: a `List<SecretString>` is never served.
              *
              */
             EnvironmentValueType;
@@ -129,9 +131,13 @@ declare namespace Components {
              * same in every language". A translated field must carry the fallback
              * language.
              *
-             * The URL must be absolute and `http`/`https` only. This value is served
-             * to browser-facing consumers, so `javascript:` and `data:` URLs are
-             * rejected at write time.
+             * The URL must be absolute and use `http`, `https`, `mailto` or `tel`.
+             * `mailto:` needs at least one address (`name@domain`) and may carry
+             * `?subject=…`; `tel:` needs a phone number (digits, an optional leading
+             * `+`, spaces, `-`, `.`, `(`, `)`) and may carry `;ext=…`. The checks are
+             * deliberately light. This value is served to browser-facing consumers,
+             * so every other scheme — `javascript:` and `data:` included — is rejected
+             * at write time.
              *
              * Written flat rather than composed from a shared field set: `allOf` plus
              * `additionalProperties: false` is rejected by most validators, because
@@ -165,10 +171,9 @@ declare namespace Components {
             key: string; // ^[a-z0-9][a-z0-9_.\-]{0,127}$
             type: /**
              * The structure a variable's value holds. `SecretString` is encrypted at rest and
-             * its value is never returned. `Text`, `Number`, `Boolean`, `Map`, `JSON` and `Link`
-             * may be served to browser-facing consumers; `String` and `SecretString` may not. A
-             * `List` inherits this from its element type: a `List` is served only when its
-             * `itemType` is itself client-safe, so a `List<String>` or `List<SecretString>` is not.
+             * its value is never returned. Every other type
+             * may be served to browser-facing consumers. A `List` inherits this from its element
+             * type: a `List<SecretString>` is never served.
              *
              */
             EnvironmentValueType;
@@ -195,10 +200,9 @@ declare namespace Components {
             key: string;
             type: /**
              * The structure a variable's value holds. `SecretString` is encrypted at rest and
-             * its value is never returned. `Text`, `Number`, `Boolean`, `Map`, `JSON` and `Link`
-             * may be served to browser-facing consumers; `String` and `SecretString` may not. A
-             * `List` inherits this from its element type: a `List` is served only when its
-             * `itemType` is itself client-safe, so a `List<String>` or `List<SecretString>` is not.
+             * its value is never returned. Every other type
+             * may be served to browser-facing consumers. A `List` inherits this from its element
+             * type: a `List<SecretString>` is never served.
              *
              */
             EnvironmentValueType;
@@ -241,9 +245,13 @@ declare namespace Components {
              * same in every language". A translated field must carry the fallback
              * language.
              *
-             * The URL must be absolute and `http`/`https` only. This value is served
-             * to browser-facing consumers, so `javascript:` and `data:` URLs are
-             * rejected at write time.
+             * The URL must be absolute and use `http`, `https`, `mailto` or `tel`.
+             * `mailto:` needs at least one address (`name@domain`) and may carry
+             * `?subject=…`; `tel:` needs a phone number (digits, an optional leading
+             * `+`, spaces, `-`, `.`, `(`, `)`) and may carry `;ext=…`. The checks are
+             * deliberately light. This value is served to browser-facing consumers,
+             * so every other scheme — `javascript:` and `data:` included — is rejected
+             * at write time.
              *
              * Written flat rather than composed from a shared field set: `allOf` plus
              * `additionalProperties: false` is rejected by most validators, because
@@ -345,9 +353,13 @@ declare namespace Components {
          * same in every language". A translated field must carry the fallback
          * language.
          *
-         * The URL must be absolute and `http`/`https` only. This value is served
-         * to browser-facing consumers, so `javascript:` and `data:` URLs are
-         * rejected at write time.
+         * The URL must be absolute and use `http`, `https`, `mailto` or `tel`.
+         * `mailto:` needs at least one address (`name@domain`) and may carry
+         * `?subject=…`; `tel:` needs a phone number (digits, an optional leading
+         * `+`, spaces, `-`, `.`, `(`, `)`) and may carry `;ext=…`. The checks are
+         * deliberately light. This value is served to browser-facing consumers,
+         * so every other scheme — `javascript:` and `data:` included — is rejected
+         * at write time.
          *
          * Written flat rather than composed from a shared field set: `allOf` plus
          * `additionalProperties: false` is rejected by most validators, because

package/dist/{identity-F5XHYPXY.js → identity-OT3MIWHV.js}

@@ -1,7 +1,7 @@
 import "./chunk-YPSWSI3M.js";
 
 // src/docs/identity.json
-var identity_default = '# Identity API\n\n- **Base URL:** `https://id.epilot.cloud`\n- **Full API Docs:** [https://docs.epilot.io/api/identity](https://docs.epilot.io/api/identity)\n\n## Usage\n\n```ts\nimport { epilot } from \'@epilot/sdk\'\n\nepilot.authorize(() => \'<token>\')\nconst { data } = await epilot.identity.listClients(...)\n```\n\n### Tree-shakeable import\n\n```ts\nimport { getClient, authorize } from \'@epilot/sdk/identity\'\n\nconst identityClient = getClient()\nauthorize(identityClient, () => \'<token>\')\nconst { data } = await identityClient.listClients(...)\n```\n\n## Operations\n\n**Operator Clients**\n- [`listClients`](#listclients)\n- [`createOidcClient`](#createoidcclient)\n- [`getOidcClient`](#getoidcclient)\n- [`updateClient`](#updateclient)\n- [`retireClient`](#retireclient)\n- [`activateClient`](#activateclient)\n- [`suspendClient`](#suspendclient)\n- [`rotateClientSecret`](#rotateclientsecret)\n\n**Operator Organizations**\n- [`listClientOrganizations`](#listclientorganizations)\n- [`enableClientOrganization`](#enableclientorganization)\n- [`getClientOrganization`](#getclientorganization)\n- [`updateClientOrganization`](#updateclientorganization)\n- [`revokeClientOrganization`](#revokeclientorganization)\n- [`suspendClientOrganization`](#suspendclientorganization)\n- [`activateClientOrganization`](#activateclientorganization)\n- [`getUserSubject`](#getusersubject)\n\n**Session**\n- [`createIdentitySession`](#createidentitysession)\n- [`deleteIdentitySession`](#deleteidentitysession)\n\n**Launch**\n- [`launchClient`](#launchclient)\n\n**Schemas**\n- [`Error`](#error)\n- [`PartnerClientId`](#partnerclientid)\n- [`OrgId`](#orgid)\n- [`UserId`](#userid)\n- [`Environment`](#environment)\n- [`PartnerClientStatus`](#partnerclientstatus)\n- [`Scope`](#scope)\n- [`HttpsUri`](#httpsuri)\n- [`PartnerClientCreate`](#partnerclientcreate)\n- [`PartnerClientUpdate`](#partnerclientupdate)\n- [`PartnerClient`](#partnerclient)\n- [`PartnerClientWithSecret`](#partnerclientwithsecret)\n- [`PartnerClientList`](#partnerclientlist)\n- [`StatusChangeRequest`](#statuschangerequest)\n- [`RotateSecretRequest`](#rotatesecretrequest)\n- [`AuthorizationPolicyInput`](#authorizationpolicyinput)\n- [`AuthorizationPolicy`](#authorizationpolicy)\n- [`OrgEnablementStatus`](#orgenablementstatus)\n- [`OrgEnablementCreate`](#orgenablementcreate)\n- [`OrgEnablementUpdate`](#orgenablementupdate)\n- [`OrgEnablement`](#orgenablement)\n- [`OrgEnablementList`](#orgenablementlist)\n- [`IdentitySession`](#identitysession)\n- [`UserSubject`](#usersubject)\n\n### `listClients`\n\nList registered partner clients. The client secret is never returned.\n\n`GET /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.listClients({\n  partner_key: \'example\',\n  status: \'example\',\n  size: 1,\n  cursor: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "partner_key": "string",\n      "display_name": "string",\n      "description": "string",\n      "environment": "dev",\n      "redirect_uris": ["https://partner.example.com/auth/callback"],\n      "sector_identifier_uri": "https://partner.example.com/auth/callback",\n      "initiate_login_uri": "https://partner.example.com/auth/callback",\n      "launch_target_prefixes": ["string"],\n      "token_endpoint_auth_method": "client_secret_basic",\n      "grant_types": ["authorization_code"],\n      "scopes_allowed": ["openid"],\n      "status": "draft",\n      "status_reason": "string",\n      "config_version": 1,\n      "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n      "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ],\n  "next_cursor": "string"\n}\n```\n\n</details>\n\n---\n\n### `createOidcClient`\n\nCreate a partner client in `draft` status. The client secret is returned exactly once in this\nresponse and can never be read again; use `rotateClientSecret` to obtain a new one.\n\n`POST /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.createOidcClient(\n  null,\n  {\n    partner_key: \'babelforce\',\n    display_name: \'Babelforce\',\n    description: \'string\',\n    environment: \'dev\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `getOidcClient`\n\nRead a partner client. The client secret is never returned.\n\n`GET /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.getOidcClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClient`\n\nReplace the mutable configuration of a client. `config_version` must equal the current\nversion (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.updateClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    config_version: 1,\n    allow_sector_change: false,\n    display_name: \'string\',\n    description: \'string\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `retireClient`\n\nRetire a client. The record is kept as a tombstone, the `client_id` is never reused, every\norganization enablement is revoked and all provider-side artefacts are revoked.\n\n`DELETE /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.retireClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClient`\n\nActivate a `draft` or `suspended` client. Validates that every redirect URI is an absolute\nHTTPS URL without fragment, that `scopes_allowed` contains `openid`, and that the\nauthentication method is `c\n\n`POST /v1/identity/operator/clients/{client_id}:activate`\n\n```ts\nconst { data } = await client.activateClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClient`\n\nImmediately block the client for every organization. Provider-side artefacts (codes, tokens,\ngrants) are revoked; the audit trail is kept. Reversible with `activateClient`.\n\n`POST /v1/identity/operator/clients/{client_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `rotateClientSecret`\n\nIssue a new client secret. The new secret is returned exactly once. The previous secret\nkeeps working until `previous_secret_expires_at` unless `compromise_mode` is set, in which\ncase it stops working\n\n`POST /v1/identity/operator/clients/{client_id}:rotateSecret`\n\n```ts\nconst { data } = await client.rotateClientSecret(\n  {\n    client_id: \'example\',\n  },\n  {\n    compromise_mode: false,\n    migration_window_seconds: 86400\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `listClientOrganizations`\n\nList the organizations enabled on a client, including suspended and revoked ones.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.listClientOrganizations({\n  client_id: \'example\',\n  status: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "org_id": "739224",\n      "status": "active",\n      "status_reason": "string",\n      "authorization_policy": {\n        "mode": "preauthorized",\n        "population": "all_current_org_members",\n        "allowed_scopes": ["openid"],\n        "customer_approval_ref": "string",\n        "approved_at": "1970-01-01T00:00:00.000Z",\n        "version": 1,\n        "mandatory_claims": ["org_id"],\n        "recorded_by": "string",\n        "recorded_at": "1970-01-01T00:00:00.000Z"\n      },\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ]\n}\n```\n\n</details>\n\n---\n\n### `enableClientOrganization`\n\nEnable an epilot organization on a client, recording the customer\'s authorization policy\n(version 1). `allowed_scopes` must contain `openid` and be a subset of the client\'s\n`scopes_allowed`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.enableClientOrganization(\n  {\n    client_id: \'example\',\n  },\n  {\n    org_id: \'739224\',\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getClientOrganization`\n\nRead one organization enablement.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.getClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClientOrganization`\n\nRecord a new version of the customer\'s authorization policy. `expected_policy_version` must\nequal the current version (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.updateClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    expected_policy_version: 1,\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `revokeClientOrganization`\n\nRevoke an organization\'s enablement. The record is kept as an audited tombstone; future\nauthorizations for this organization fail with `access_denied` and provider-side artefacts\nbound to it are revok\n\n`DELETE /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.revokeClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClientOrganization`\n\nTemporarily block one organization on this client. Reversible with `activateClientOrganization`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClientOrganization`\n\nResume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization again (`POST \u2026/organizations`) replaces the revoked entry and continues its policy\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate`\n\n```ts\nconst { data } = await client.activateClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getUserSubject`\n\nThe pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its\nside **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with\n`\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject`\n\n```ts\nconst { data } = await client.getUserSubject({\n  client_id: \'example\',\n  org_id: \'example\',\n  user_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "user_id": "100321",\n  "sub": "v1.dGhpcy1pcy1hLWR1bW15LXN1YmplY3QtdmFsdWUtMDAx",\n  "key_version": "v1",\n  "sector": "portal.epilot.cloud"\n}\n```\n\n</details>\n\n---\n\n### `createIdentitySession`\n\nCalled by the epilot portal through the portal-host proxy after every persisted 360 session.\nValidates the 360 bearer token itself and mirrors it into the `identity_session` cookie\n(`HttpOnly; Secure;\n\n`GET /v1/identity/session`\n\n```ts\nconst { data } = await client.createIdentitySession()\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "org_id": "739224",\n  "user_id": "string",\n  "expires_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `deleteIdentitySession`\n\nClears the `identity_session` cookie. Called by the portal on logout.\n\n`DELETE /v1/identity/session`\n\n```ts\nconst { data } = await client.deleteIdentitySession()\n```\n\n---\n\n### `launchClient`\n\nOne validated place for partner start links (manager UI, hosted apps). Redirects the browser to the\nclient\'s registered `initiate_login_uri` with `iss` set to this issuer and, when given, the deep lin\n\n`GET /v1/identity/launch/{client_id}`\n\n```ts\nconst { data } = await client.launchClient({\n  client_id: \'example\',\n  target: \'example\',\n  extra: \'example\',\n})\n```\n\n---\n\n## Schemas\n\n### `Error`\n\n```ts\ntype Error = {\n  status: number\n  error: string\n  details?: Record<string, unknown>[]\n}\n```\n\n### `PartnerClientId`\n\nOpaque client identifier, unique within the issuer, never reused\n\n```ts\ntype PartnerClientId = string\n```\n\n### `OrgId`\n\nepilot organization id, an opaque case-sensitive string\n\n```ts\ntype OrgId = string\n```\n\n### `UserId`\n\nepilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.\n\n```ts\ntype UserId = string\n```\n\n### `Environment`\n\nPartner-side environment this client belongs to\n\n```ts\ntype Environment = "dev" | "staging" | "production"\n```\n\n### `PartnerClientStatus`\n\n```ts\ntype PartnerClientStatus = "draft" | "active" | "suspended" | "retired"\n```\n\n### `Scope`\n\n```ts\ntype Scope = "openid" | "email" | "profile"\n```\n\n### `HttpsUri`\n\nAbsolute HTTPS URL without fragment\n\n```ts\ntype HttpsUri = string // uri\n```\n\n### `PartnerClientCreate`\n\n```ts\ntype PartnerClientCreate = {\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed?: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClientUpdate`\n\n```ts\ntype PartnerClientUpdate = {\n  config_version: number\n  allow_sector_change?: boolean\n  display_name: string\n  description?: string\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClient`\n\n```ts\ntype PartnerClient = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `PartnerClientWithSecret`\n\n```ts\ntype PartnerClientWithSecret = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n  client_secret: string\n}\n```\n\n### `PartnerClientList`\n\n```ts\ntype PartnerClientList = {\n  results: Array<{\n    client_id: string\n    partner_key: string\n    display_name: string\n    description?: string\n    environment: "dev" | "staging" | "production"\n    redirect_uris: string // uri[]\n    sector_identifier_uri?: string // uri\n    initiate_login_uri?: string // uri\n    launch_target_prefixes?: string[]\n    token_endpoint_auth_method: "client_secret_basic"\n    grant_types: "authorization_code"[]\n    scopes_allowed: "openid" | "email" | "profile"[]\n    status: "draft" | "active" | "suspended" | "retired"\n    status_reason?: string\n    config_version: number\n    secret_rotated_at?: string // date-time\n    previous_secret_expires_at?: string // date-time\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n  next_cursor?: string\n}\n```\n\n### `StatusChangeRequest`\n\n```ts\ntype StatusChangeRequest = {\n  reason?: string\n}\n```\n\n### `RotateSecretRequest`\n\n```ts\ntype RotateSecretRequest = {\n  compromise_mode?: boolean\n  migration_window_seconds?: number\n}\n```\n\n### `AuthorizationPolicyInput`\n\n```ts\ntype AuthorizationPolicyInput = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n}\n```\n\n### `AuthorizationPolicy`\n\n```ts\ntype AuthorizationPolicy = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n  version: number\n  mandatory_claims: "org_id"[]\n  recorded_by: string\n  recorded_at: string // date-time\n}\n```\n\n### `OrgEnablementStatus`\n\n```ts\ntype OrgEnablementStatus = "active" | "suspended" | "revoked"\n```\n\n### `OrgEnablementCreate`\n\n```ts\ntype OrgEnablementCreate = {\n  org_id: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n}\n```\n\n### `OrgEnablementUpdate`\n\n```ts\ntype OrgEnablementUpdate = {\n  expected_policy_version: number\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n}\n```\n\n### `OrgEnablement`\n\n```ts\ntype OrgEnablement = {\n  client_id: string\n  org_id: string\n  status: "active" | "suspended" | "revoked"\n  status_reason?: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n    version: number\n    mandatory_claims: "org_id"[]\n    recorded_by: string\n    recorded_at: string // date-time\n  }\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `OrgEnablementList`\n\n```ts\ntype OrgEnablementList = {\n  results: Array<{\n    client_id: string\n    org_id: string\n    status: "active" | "suspended" | "revoked"\n    status_reason?: string\n    authorization_policy: {\n      mode?: { ... }\n      population?: { ... }\n      allowed_scopes: { ... }\n      customer_approval_ref: { ... }\n      approved_at: { ... }\n      version: { ... }\n      mandatory_claims: { ... }\n      recorded_by: { ... }\n      recorded_at: { ... }\n    }\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n}\n```\n\n### `IdentitySession`\n\n```ts\ntype IdentitySession = {\n  org_id: string\n  user_id: string\n  expires_at: string // date-time\n}\n```\n\n### `UserSubject`\n\n```ts\ntype UserSubject = {\n  client_id: string\n  org_id: string\n  user_id: string\n  sub: string\n  key_version: string\n  sector: string\n}\n```\n';
+var identity_default = '# Identity API\n\n- **Base URL:** `https://id.epilot.cloud`\n- **Full API Docs:** [https://docs.epilot.io/api/identity](https://docs.epilot.io/api/identity)\n\n## Usage\n\n```ts\nimport { epilot } from \'@epilot/sdk\'\n\nepilot.authorize(() => \'<token>\')\nconst { data } = await epilot.identity.listClients(...)\n```\n\n### Tree-shakeable import\n\n```ts\nimport { getClient, authorize } from \'@epilot/sdk/identity\'\n\nconst identityClient = getClient()\nauthorize(identityClient, () => \'<token>\')\nconst { data } = await identityClient.listClients(...)\n```\n\n## Operations\n\n**Operator Clients**\n- [`listClients`](#listclients)\n- [`createOidcClient`](#createoidcclient)\n- [`getOidcClient`](#getoidcclient)\n- [`updateClient`](#updateclient)\n- [`retireClient`](#retireclient)\n- [`activateClient`](#activateclient)\n- [`suspendClient`](#suspendclient)\n- [`rotateClientSecret`](#rotateclientsecret)\n\n**Operator Organizations**\n- [`listClientOrganizations`](#listclientorganizations)\n- [`enableClientOrganization`](#enableclientorganization)\n- [`getClientOrganization`](#getclientorganization)\n- [`updateClientOrganization`](#updateclientorganization)\n- [`revokeClientOrganization`](#revokeclientorganization)\n- [`suspendClientOrganization`](#suspendclientorganization)\n- [`activateClientOrganization`](#activateclientorganization)\n- [`getUserSubject`](#getusersubject)\n\n**Session**\n- [`createIdentitySession`](#createidentitysession)\n- [`deleteIdentitySession`](#deleteidentitysession)\n\n**Launch**\n- [`launchClient`](#launchclient)\n\n**Schemas**\n- [`Error`](#error)\n- [`PartnerClientId`](#partnerclientid)\n- [`OrgId`](#orgid)\n- [`UserId`](#userid)\n- [`Environment`](#environment)\n- [`PartnerClientStatus`](#partnerclientstatus)\n- [`Scope`](#scope)\n- [`HttpsUri`](#httpsuri)\n- [`PartnerClientCreate`](#partnerclientcreate)\n- [`PartnerClientUpdate`](#partnerclientupdate)\n- [`PartnerClient`](#partnerclient)\n- [`PartnerClientWithSecret`](#partnerclientwithsecret)\n- [`PartnerClientList`](#partnerclientlist)\n- [`StatusChangeRequest`](#statuschangerequest)\n- [`RotateSecretRequest`](#rotatesecretrequest)\n- [`AuthorizationPolicyInput`](#authorizationpolicyinput)\n- [`AuthorizationPolicy`](#authorizationpolicy)\n- [`OrgEnablementStatus`](#orgenablementstatus)\n- [`OrgEnablementCreate`](#orgenablementcreate)\n- [`OrgEnablementUpdate`](#orgenablementupdate)\n- [`OrgEnablement`](#orgenablement)\n- [`OrgEnablementList`](#orgenablementlist)\n- [`IdentitySession`](#identitysession)\n- [`UserSubject`](#usersubject)\n\n### `listClients`\n\nList registered partner clients. The client secret is never returned.\n\n`GET /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.listClients({\n  partner_key: \'example\',\n  status: \'example\',\n  size: 1,\n  cursor: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "partner_key": "string",\n      "display_name": "string",\n      "description": "string",\n      "environment": "dev",\n      "redirect_uris": ["https://partner.example.com/auth/callback"],\n      "sector_identifier_uri": "https://partner.example.com/auth/callback",\n      "initiate_login_uri": "https://partner.example.com/auth/callback",\n      "launch_target_prefixes": ["string"],\n      "token_endpoint_auth_method": "client_secret_basic",\n      "grant_types": ["authorization_code"],\n      "scopes_allowed": ["openid"],\n      "status": "draft",\n      "status_reason": "string",\n      "config_version": 1,\n      "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n      "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ],\n  "next_cursor": "string"\n}\n```\n\n</details>\n\n---\n\n### `createOidcClient`\n\nCreate a partner client in `draft` status. The client secret is returned exactly once in this\nresponse and can never be read again; use `rotateClientSecret` to obtain a new one.\n\n`POST /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.createOidcClient(\n  null,\n  {\n    partner_key: \'babelforce\',\n    display_name: \'Babelforce\',\n    description: \'string\',\n    environment: \'dev\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `getOidcClient`\n\nRead a partner client. The client secret is never returned.\n\n`GET /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.getOidcClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClient`\n\nReplace the mutable configuration of a client. `config_version` must equal the current\nversion (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.updateClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    config_version: 1,\n    allow_sector_change: false,\n    display_name: \'string\',\n    description: \'string\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `retireClient`\n\nRetire a client. The record is kept as a tombstone, the `client_id` is never reused, every\norganization enablement is revoked and all provider-side artefacts are revoked.\n\n`DELETE /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.retireClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClient`\n\nActivate a `draft` or `suspended` client. Validates that every redirect URI is an absolute\nHTTPS URL without fragment, that `scopes_allowed` contains `openid`, and that the\nauthentication method is `c\n\n`POST /v1/identity/operator/clients/{client_id}:activate`\n\n```ts\nconst { data } = await client.activateClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClient`\n\nImmediately block the client for every organization. Provider-side artefacts (codes, tokens,\ngrants) are revoked; the audit trail is kept. Reversible with `activateClient`.\n\n`POST /v1/identity/operator/clients/{client_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `rotateClientSecret`\n\nIssue a new client secret. The new secret is returned exactly once. The previous secret\nkeeps working until `previous_secret_expires_at` unless `compromise_mode` is set, in which\ncase it stops working\n\n`POST /v1/identity/operator/clients/{client_id}:rotateSecret`\n\n```ts\nconst { data } = await client.rotateClientSecret(\n  {\n    client_id: \'example\',\n  },\n  {\n    compromise_mode: false,\n    migration_window_seconds: 86400\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `listClientOrganizations`\n\nList the organizations enabled on a client, including suspended and revoked ones.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.listClientOrganizations({\n  client_id: \'example\',\n  status: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "org_id": "739224",\n      "status": "active",\n      "status_reason": "string",\n      "authorization_policy": {\n        "mode": "preauthorized",\n        "population": "all_current_org_members",\n        "allowed_scopes": ["openid"],\n        "customer_approval_ref": "string",\n        "approved_at": "1970-01-01T00:00:00.000Z",\n        "version": 1,\n        "mandatory_claims": ["org_id"],\n        "recorded_by": "string",\n        "recorded_at": "1970-01-01T00:00:00.000Z"\n      },\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ]\n}\n```\n\n</details>\n\n---\n\n### `enableClientOrganization`\n\nEnable an epilot organization on a client, recording the customer\'s authorization policy\n(version 1). `allowed_scopes` must contain `openid` and be a subset of the client\'s\n`scopes_allowed`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.enableClientOrganization(\n  {\n    client_id: \'example\',\n  },\n  {\n    org_id: \'739224\',\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getClientOrganization`\n\nRead one organization enablement.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.getClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClientOrganization`\n\nRecord a new version of the customer\'s authorization policy. `expected_policy_version` must\nequal the current version (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.updateClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    expected_policy_version: 1,\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `revokeClientOrganization`\n\nRevoke an organization\'s enablement. The record is kept as an audited tombstone; future\nauthorizations for this organization fail with `access_denied` and provider-side artefacts\nbound to it are revok\n\n`DELETE /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.revokeClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClientOrganization`\n\nTemporarily block one organization on this client. Reversible with `activateClientOrganization`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClientOrganization`\n\nResume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization again (`POST \u2026/organizations`) replaces the revoked entry and continues its policy\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate`\n\n```ts\nconst { data } = await client.activateClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getUserSubject`\n\nThe pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its\nside **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with\n`\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject`\n\n```ts\nconst { data } = await client.getUserSubject({\n  client_id: \'example\',\n  org_id: \'example\',\n  user_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "user_id": "100321",\n  "sub": "v1.dGhpcy1pcy1hLWR1bW15LXN1YmplY3QtdmFsdWUtMDAx",\n  "key_version": "v1",\n  "sector": "portal.epilot.cloud"\n}\n```\n\n</details>\n\n---\n\n### `createIdentitySession`\n\nCalled by the epilot portal through the portal-host proxy after every persisted 360 session.\nValidates the 360 bearer token itself and mirrors it into the `identity_session` cookie\n(`HttpOnly; Secure;\n\n`GET /v1/identity/session`\n\n```ts\nconst { data } = await client.createIdentitySession()\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "org_id": "739224",\n  "user_id": "string",\n  "expires_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `deleteIdentitySession`\n\nClears the `identity_session` cookie. Called by the portal on logout.\n\n`DELETE /v1/identity/session`\n\n```ts\nconst { data } = await client.deleteIdentitySession()\n```\n\n---\n\n### `launchClient`\n\nOne validated place for partner start links (manager UI, hosted apps). Redirects the browser to the\nclient\'s registered `initiate_login_uri` with `iss` set to this issuer and, when given, the deep lin\n\n`GET /v1/identity/launch/{client_id}`\n\n```ts\nconst { data } = await client.launchClient({\n  client_id: \'example\',\n  target: \'example\',\n  extra: \'example\',\n})\n```\n\n---\n\n## Schemas\n\n### `Error`\n\n```ts\ntype Error = {\n  status: number\n  error: string\n  details?: Record<string, unknown>[]\n}\n```\n\n### `PartnerClientId`\n\nOpaque client identifier, unique within the issuer, never reused\n\n```ts\ntype PartnerClientId = string\n```\n\n### `OrgId`\n\nepilot organization id, an opaque case-sensitive string\n\n```ts\ntype OrgId = string\n```\n\n### `UserId`\n\nepilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.\n\n```ts\ntype UserId = string\n```\n\n### `Environment`\n\nPartner-side environment this client belongs to\n\n```ts\ntype Environment = "dev" | "staging" | "production"\n```\n\n### `PartnerClientStatus`\n\n```ts\ntype PartnerClientStatus = "draft" | "active" | "suspended" | "retired"\n```\n\n### `Scope`\n\n```ts\ntype Scope = "openid" | "email" | "profile"\n```\n\n### `HttpsUri`\n\nAbsolute HTTPS URL without fragment\n\n```ts\ntype HttpsUri = string // uri\n```\n\n### `PartnerClientCreate`\n\n```ts\ntype PartnerClientCreate = {\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed?: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClientUpdate`\n\n```ts\ntype PartnerClientUpdate = {\n  config_version: number\n  allow_sector_change?: boolean\n  display_name: string\n  description?: string\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClient`\n\n```ts\ntype PartnerClient = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `PartnerClientWithSecret`\n\n```ts\ntype PartnerClientWithSecret = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n  client_secret: string\n}\n```\n\n### `PartnerClientList`\n\n```ts\ntype PartnerClientList = {\n  results: Array<{\n    client_id: string\n    partner_key: string\n    display_name: string\n    description?: string\n    environment: "dev" | "staging" | "production"\n    redirect_uris: string // uri[]\n    sector_identifier_uri?: string // uri\n    initiate_login_uri?: string // uri\n    launch_target_prefixes?: string[]\n    token_endpoint_auth_method: "client_secret_basic"\n    grant_types: "authorization_code"[]\n    scopes_allowed: "openid" | "email" | "profile"[]\n    status: "draft" | "active" | "suspended" | "retired"\n    status_reason?: string\n    config_version: number\n    secret_rotated_at?: string // date-time\n    previous_secret_expires_at?: string // date-time\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n  next_cursor?: string\n}\n```\n\n### `StatusChangeRequest`\n\n```ts\ntype StatusChangeRequest = {\n  reason?: string\n}\n```\n\n### `RotateSecretRequest`\n\n```ts\ntype RotateSecretRequest = {\n  compromise_mode?: boolean\n  migration_window_seconds?: number\n}\n```\n\n### `AuthorizationPolicyInput`\n\n```ts\ntype AuthorizationPolicyInput = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at?: string // date-time\n}\n```\n\n### `AuthorizationPolicy`\n\n```ts\ntype AuthorizationPolicy = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n  version: number\n  mandatory_claims: "org_id"[]\n  recorded_by: string\n  recorded_at: string // date-time\n}\n```\n\n### `OrgEnablementStatus`\n\n```ts\ntype OrgEnablementStatus = "active" | "suspended" | "revoked"\n```\n\n### `OrgEnablementCreate`\n\n```ts\ntype OrgEnablementCreate = {\n  org_id: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at?: string // date-time\n  }\n}\n```\n\n### `OrgEnablementUpdate`\n\n```ts\ntype OrgEnablementUpdate = {\n  expected_policy_version: number\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at?: string // date-time\n  }\n}\n```\n\n### `OrgEnablement`\n\n```ts\ntype OrgEnablement = {\n  client_id: string\n  org_id: string\n  status: "active" | "suspended" | "revoked"\n  status_reason?: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n    version: number\n    mandatory_claims: "org_id"[]\n    recorded_by: string\n    recorded_at: string // date-time\n  }\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `OrgEnablementList`\n\n```ts\ntype OrgEnablementList = {\n  results: Array<{\n    client_id: string\n    org_id: string\n    status: "active" | "suspended" | "revoked"\n    status_reason?: string\n    authorization_policy: {\n      mode?: { ... }\n      population?: { ... }\n      allowed_scopes: { ... }\n      customer_approval_ref: { ... }\n      approved_at: { ... }\n      version: { ... }\n      mandatory_claims: { ... }\n      recorded_by: { ... }\n      recorded_at: { ... }\n    }\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n}\n```\n\n### `IdentitySession`\n\n```ts\ntype IdentitySession = {\n  org_id: string\n  user_id: string\n  expires_at: string // date-time\n}\n```\n\n### `UserSubject`\n\n```ts\ntype UserSubject = {\n  client_id: string\n  org_id: string\n  user_id: string\n  sub: string\n  key_version: string\n  sector: string\n}\n```\n';
 export {
   identity_default as default
 };