@onesi/genesis 0.1.13 → 0.2.1

package/dist/auto.js

@@ -0,0 +1,125 @@
+import { idempotencyHeaders, ifMatchHeaders } from './idempotency.js';
+/** Auto, your organization's operating structure: orgs, mandates, spend actions, approvals, the org structure (units, positions with
+ * delegated authority, occupants, goals and scorecards), how the org operates (budgets, policies, cadences,
+ * succession and acting appointments), verifiable authority (the authority check with its signed receipt,
+ * AuthorityCredentials, token verification) and the decision ledger. Auto never runs or controls an agent.
+ * Updates, archives, appointments, vacancies, succession and acting changes take the `version` you read
+ * (sent as If-Match); a stale one is a 409. */
+export function autoModule(client) {
+    return {
+        whoami: () => client.request('auto_whoami'),
+        orgs: {
+            list: (includeArchived) => client.request('auto_listOrgs', includeArchived === undefined ? {} : { include_archived: includeArchived }),
+            get: (org) => client.request('auto_getOrg', { org }),
+            create: (body) => client.request('auto_createOrg', { body }),
+            update: (org, version, body) => client.request('auto_updateOrg', { org, body }, { headers: ifMatchHeaders('auto_updateOrg', version) }),
+            archive: (org, version) => client.request('auto_archiveOrg', { org }, { headers: ifMatchHeaders('auto_archiveOrg', version) }),
+            mandates: (org) => client.request('auto_listMandates', { org }),
+            createMandate: (org, body) => client.request('auto_createMandate', { org, body }),
+            recordDecision: (org, body) => client.request('auto_recordDecision', { org, body }),
+            ledger: (org, page = {}) => client.request('auto_getLedger', { org, ...page }),
+            verifyLedger: (org) => client.request('auto_verifyLedger', { org }),
+            approvals: (org, status) => client.request('auto_listApprovals', status ? { org, status } : { org }),
+            units: (org, includeArchived) => client.request('auto_listUnits', includeArchived === undefined ? { org } : { org, include_archived: includeArchived }),
+            createUnit: (org, body) => client.request('auto_createUnit', { org, body }),
+            positions: (org, filter = {}) => client.request('auto_listPositions', { org, ...filter }),
+            createPosition: (org, body) => client.request('auto_createPosition', { org, body }),
+            chart: (org) => client.request('auto_getOrgChart', { org }),
+            goals: (org, positionId) => client.request('auto_listGoals', positionId ? { org, position_id: positionId } : { org }),
+            createGoal: (org, body) => client.request('auto_createGoal', { org, body }),
+            scorecard: (org) => client.request('auto_getOrgScorecard', { org }),
+            budgets: (org, filter = {}) => client.request('auto_listBudgets', { org, ...filter }),
+            createBudget: (org, body) => client.request('auto_createBudget', { org, body }),
+            policies: (org, includeArchived) => client.request('auto_listPolicies', includeArchived === undefined ? { org } : { org, include_archived: includeArchived }),
+            createPolicy: (org, body) => client.request('auto_createPolicy', { org, body }),
+            cadences: (org, filter = {}) => client.request('auto_listCadences', { org, ...filter }),
+            createCadence: (org, body) => client.request('auto_createCadence', { org, body }),
+            /** Active cadences due within `withinHours` (default 24, at most 744), overdue first, with who runs each. */
+            dueCadences: (org, withinHours) => client.request('auto_listDueCadences', withinHours === undefined ? { org } : { org, within_hours: withinHours }),
+            /** Vacancies, successors and single points of spend. */
+            continuity: (org) => client.request('auto_getOrgContinuity', { org }),
+            credentials: (org, positionId) => client.request('auto_listCredentials', positionId ? { org, position_id: positionId } : { org }),
+        },
+        units: {
+            get: (unit) => client.request('auto_getUnit', { unit }),
+            update: (unit, version, body) => client.request('auto_updateUnit', { unit, body }, { headers: ifMatchHeaders('auto_updateUnit', version) }),
+            archive: (unit, version) => client.request('auto_archiveUnit', { unit }, { headers: ifMatchHeaders('auto_archiveUnit', version) }),
+        },
+        /** Positions hold delegated authority; it only flows down the reporting line. */
+        positions: {
+            get: (position) => client.request('auto_getPosition', { position }),
+            update: (position, version, body) => client.request('auto_updatePosition', { position, body }, { headers: ifMatchHeaders('auto_updatePosition', version) }),
+            archive: (position, version) => client.request('auto_archivePosition', { position }, { headers: ifMatchHeaders('auto_archivePosition', version) }),
+            /** Fill the position or swap its occupant (a person, or a Henry, Fleets or Flocks agent that Auto only references). */
+            appoint: (position, version, body) => client.request('auto_appointOccupant', { position, body }, { headers: ifMatchHeaders('auto_appointOccupant', version) }),
+            vacate: (position, version) => client.request('auto_vacatePosition', { position }, { headers: ifMatchHeaders('auto_vacatePosition', version) }),
+            terms: (position) => client.request('auto_listPositionTerms', { position }),
+            scorecard: (position) => client.request('auto_getPositionScorecard', { position }),
+            /** Replace the ordered successor list (up to 5 positions; empty clears it). */
+            setSuccession: (position, version, body) => client.request('auto_setPositionSuccession', { position, body }, { headers: ifMatchHeaders('auto_setPositionSuccession', version) }),
+            /** Someone (the occupant of `from_position_id`, or the first filled successor) acts for the position. */
+            startActing: (position, version, body) => client.request('auto_startActing', { position, body }, { headers: ifMatchHeaders('auto_startActing', version) }),
+            endActing: (position, version, reason) => client.request('auto_endActing', reason === undefined ? { position } : { position, reason }, { headers: ifMatchHeaders('auto_endActing', version) }),
+            /** A signed AuthorityCredential (JWT) for the position's holder; the `token` is returned only here. */
+            issueCredential: (position, body = {}) => client.request('auto_issuePositionCredential', { position, body }),
+        },
+        /** "May this principal, in this position, do this?" Ledgered, never metered; `auto:read` alone gets a dry run. */
+        authority: {
+            /** With an idempotency key, a repeat returns the first answer (`idempotent_replay: true`) instead of counting spend twice. */
+            check: (body, options = {}) => client.request('auto_checkAuthority', { body }, { headers: idempotencyHeaders('auto_checkAuthority', options.idempotencyKey) }),
+            getCheck: (check) => client.request('auto_getAuthorityCheck', { check }),
+            /** Spend that was allowed but did not happen stops counting against limits and budgets. Once per check. */
+            release: (check, reason) => client.request('auto_releaseAuthorityCheck', { check, body: reason === undefined ? {} : { reason } }),
+            /** Check a receipt or an AuthorityCredential: Auto's signature, expiry and revocation. */
+            verify: (token) => client.request('auto_verifyAuthorityToken', { body: { token } }),
+        },
+        goals: {
+            get: (goal) => client.request('auto_getGoal', { goal }),
+            update: (goal, version, body) => client.request('auto_updateGoal', { goal, body }, { headers: ifMatchHeaders('auto_updateGoal', version) }),
+            archive: (goal, version) => client.request('auto_archiveGoal', { goal }, { headers: ifMatchHeaders('auto_archiveGoal', version) }),
+            measure: (goal, body) => client.request('auto_recordGoalMeasurement', { goal, body }),
+        },
+        /** Spend caps for a unit (and every unit below it) or the whole org, enforced by the authority check. */
+        budgets: {
+            get: (budget) => client.request('auto_getBudget', { budget }),
+            update: (budget, version, body) => client.request('auto_updateBudget', { budget, body }, { headers: ifMatchHeaders('auto_updateBudget', version) }),
+            archive: (budget, version) => client.request('auto_archiveBudget', { budget }, { headers: ifMatchHeaders('auto_archiveBudget', version) }),
+        },
+        /** Rules that tighten every authority check (deny, or escalate to a named position). */
+        policies: {
+            get: (policy) => client.request('auto_getPolicy', { policy }),
+            update: (policy, version, body) => client.request('auto_updatePolicy', { policy, body }, { headers: ifMatchHeaders('auto_updatePolicy', version) }),
+            archive: (policy, version) => client.request('auto_archivePolicy', { policy }, { headers: ifMatchHeaders('auto_archivePolicy', version) }),
+        },
+        /** The meetings, reviews and reports the org keeps. Auto keeps the schedule and the record; it never holds the meeting. */
+        cadences: {
+            get: (cadence) => client.request('auto_getCadence', { cadence }),
+            update: (cadence, version, body) => client.request('auto_updateCadence', { cadence, body }, { headers: ifMatchHeaders('auto_updateCadence', version) }),
+            archive: (cadence, version) => client.request('auto_archiveCadence', { cadence }, { headers: ifMatchHeaders('auto_archiveCadence', version) }),
+            occurrences: (cadence, limit) => client.request('auto_listCadenceOccurrences', limit === undefined ? { cadence } : { cadence, limit }),
+            /** Record that the occurrence was held or skipped; the cadence moves to its next slot. */
+            record: (cadence, body) => client.request('auto_recordCadenceOccurrence', { cadence, body }),
+        },
+        credentials: {
+            get: (credential) => client.request('auto_getCredential', { credential }),
+            /** Public (no credential sent): the status any verifier reads from a credential's `credentialStatus` URL. */
+            status: (credential) => client.request('auto_getCredentialStatus', { credential }),
+            revoke: (credential, reason) => client.request('auto_revokeCredential', { credential, body: reason === undefined ? {} : { reason } }),
+        },
+        /** Public (no credential sent): Auto's signing keys and DID document, to verify receipts and credentials offline. */
+        keys: {
+            jwks: () => client.request('auto_getJwks'),
+            did: () => client.request('auto_getDidDocument'),
+        },
+        mandates: {
+            get: (mandate) => client.request('auto_getMandate', { mandate }),
+            update: (mandate, version, body) => client.request('auto_updateMandate', { mandate, body }, { headers: ifMatchHeaders('auto_updateMandate', version) }),
+            archive: (mandate, version) => client.request('auto_archiveMandate', { mandate }, { headers: ifMatchHeaders('auto_archiveMandate', version) }),
+            propose: (mandate, body) => client.request('auto_proposeAction', { mandate, body }),
+        },
+        approvals: {
+            get: (approval) => client.request('auto_getApproval', { approval }),
+            decide: (approval, body) => client.request('auto_decideApproval', { approval, body }),
+        },
+    };
+}

package/dist/beacons.d.ts

@@ -4,6 +4,14 @@ type DashboardOptions = {
     signal?: AbortSignal;
 };
 type PolicyConfig = OperationInput<'beacons_updateDashboardPolicy'>['body']['config'];
+/** Configuration-record families Genesis admits (beacons-api native_resources.rs). */
+export declare const BEACONS_RESOURCE_FAMILIES: readonly ["gateways", "private-gateways", "sims"];
+export type BeaconsResourceFamily = typeof BEACONS_RESOURCE_FAMILIES[number];
+type ResourceCreate = OperationInput<'beacons_createDashboardResource'>['body'];
+type ResourceUpdate = OperationInput<'beacons_updateDashboardResource'>['body'];
+/** Platforms with a Beacons agent client profile; the gateway and Beacons admit only these. */
+export declare const BEACONS_CLIENT_PLATFORMS: readonly ["linux", "macos", "windows", "ios", "android"];
+export type BeaconsClientPlatform = typeof BEACONS_CLIENT_PLATFORMS[number];
 /** Beacons uses the authenticated Genesis organization; never supply an org header. */
 export declare function beaconsModule(client: GenesisClient): {
     fleets: {
@@ -19,6 +27,26 @@ export declare function beaconsModule(client: GenesisClient): {
         peers: (id: string, options?: DashboardOptions) => Promise<{
             data: import("./index.js").components["schemas"]["Beacons.DashboardPeer"][];
         }>;
+        /** One peer's tunnel config: other live peers' public keys; never a private key. */
+        wireguardConfig: (id: string, peerId: string, options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardWireguardConfig"];
+        }>;
+        /** One fleet in the current selection; 404 when it is outside it. */
+        get: (id: string, options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardFleet"];
+        }>;
+        /** Mesh DNS map: one A record per live peer. */
+        dns: (id: string, options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardDnsMap"];
+        }>;
+        /** Mesh discovery map: live peers' public keys and routes, DNS, signal and relay map. */
+        discovery: (id: string, options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardDiscoveryMap"];
+        }>;
+        /** beacons-agent profile for one platform: API origin, DNS suffix and command line. */
+        clientProfile: (id: string, platform: BeaconsClientPlatform, options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardClientProfile"];
+        }>;
         policy: {
             get: (id: string, options?: DashboardOptions) => Promise<{
                 data: {
@@ -40,6 +68,20 @@ export declare function beaconsModule(client: GenesisClient): {
                 };
             }>;
         };
+        /** Fleet configuration records (gateways, private-gateways, sims). Configuration only: nothing is provisioned or connected. */
+        resources: {
+            list: (id: string, kind: BeaconsResourceFamily, options?: DashboardOptions) => Promise<{
+                data: import("./index.js").components["schemas"]["Beacons.DashboardResource"][];
+            }>;
+            /** Not idempotent: a retry after an interrupted response creates a second record. */
+            create: (id: string, kind: BeaconsResourceFamily, body: ResourceCreate, options?: DashboardOptions) => Promise<{
+                data: import("./index.js").components["schemas"]["Beacons.DashboardResource"];
+            }>;
+            update: (id: string, kind: BeaconsResourceFamily, resourceId: string, body: ResourceUpdate, options?: DashboardOptions) => Promise<{
+                data: import("./index.js").components["schemas"]["Beacons.DashboardResource"];
+            }>;
+            delete: (id: string, kind: BeaconsResourceFamily, resourceId: string, options?: DashboardOptions) => Promise<void>;
+        };
         /** Reuse the same request ID and body after an interrupted response. Creates metadata only. */
         provision: (requestId: string, body?: {
             name?: string;

package/dist/beacons.js

@@ -37,6 +37,45 @@ function policyInput(config) {
     return { config: { device_enrollment: mode,
             ...(limit === undefined ? {} : { max_devices: limit }) } };
 }
+/** Configuration-record families Genesis admits (beacons-api native_resources.rs). */
+export const BEACONS_RESOURCE_FAMILIES = ['gateways', 'private-gateways', 'sims'];
+const RESOURCE_STATUS = ['active', 'inactive', 'disabled', 'pending'];
+function family(value, operationId) {
+    if (!BEACONS_RESOURCE_FAMILIES.includes(value))
+        invalidDashboard(operationId);
+    return value;
+}
+function plainObject(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+/** A shallow snapshot of the documented fields; the receiver validates every value. */
+function resourceBody(value, operationId, create) {
+    if (!plainObject(value))
+        invalidDashboard(operationId);
+    const keys = Object.keys(value);
+    if (keys.some(key => !['name', 'status', 'config'].includes(key)) || (create ? keys.length !== 3 : keys.length === 0))
+        invalidDashboard(operationId);
+    const out = {};
+    if (Object.hasOwn(value, 'name')) {
+        if (typeof value.name !== 'string')
+            invalidDashboard(operationId);
+        const name = value.name.trim();
+        if (!name || new TextEncoder().encode(name).length > 128 || /[\u0000-\u001f\u007f-\u009f]/.test(name))
+            invalidDashboard(operationId);
+        out.name = name;
+    }
+    if (Object.hasOwn(value, 'status')) {
+        if (typeof value.status !== 'string' || !RESOURCE_STATUS.includes(value.status))
+            invalidDashboard(operationId);
+        out.status = value.status;
+    }
+    if (Object.hasOwn(value, 'config')) {
+        if (!plainObject(value.config) || Object.values(value.config).some(v => v === null || v === undefined))
+            invalidDashboard(operationId);
+        out.config = JSON.parse(JSON.stringify(value.config));
+    }
+    return out;
+}
 function provisioningInput(requestId, body) {
     if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(requestId)
         || requestId === '00000000-0000-0000-0000-000000000000'
@@ -48,6 +87,8 @@ function provisioningInput(requestId, body) {
     }
     return body.name === undefined ? {} : { name: body.name };
 }
+/** Platforms with a Beacons agent client profile; the gateway and Beacons admit only these. */
+export const BEACONS_CLIENT_PLATFORMS = ['linux', 'macos', 'windows', 'ios', 'android'];
 /** Beacons uses the authenticated Genesis organization; never supply an org header. */
 export function beaconsModule(client) {
     return {
@@ -56,11 +97,41 @@ export function beaconsModule(client) {
             list: (options = {}) => client.request('beacons_listDashboardFleets', {}, options),
             update: (id, body, options = {}) => client.request('beacons_updateDashboardFleet', { fleet_id: fleetId(id, 'beacons_updateDashboardFleet'), body: renameInput(body) }, options),
             peers: (id, options = {}) => client.request('beacons_listDashboardPeers', { fleet_id: fleetId(id, 'beacons_listDashboardPeers') }, options),
+            /** One peer's tunnel config: other live peers' public keys; never a private key. */
+            wireguardConfig: (id, peerId, options = {}) => client.request('beacons_getDashboardPeerWireguardConfig', { fleet_id: fleetId(id, 'beacons_getDashboardPeerWireguardConfig'),
+                peer_id: fleetId(peerId, 'beacons_getDashboardPeerWireguardConfig') }, options),
+            /** One fleet in the current selection; 404 when it is outside it. */
+            get: (id, options = {}) => client.request('beacons_getDashboardFleet', { fleet_id: fleetId(id, 'beacons_getDashboardFleet') }, options),
+            /** Mesh DNS map: one A record per live peer. */
+            dns: (id, options = {}) => client.request('beacons_getDashboardFleetDns', { fleet_id: fleetId(id, 'beacons_getDashboardFleetDns') }, options),
+            /** Mesh discovery map: live peers' public keys and routes, DNS, signal and relay map. */
+            discovery: (id, options = {}) => client.request('beacons_getDashboardFleetDiscovery', { fleet_id: fleetId(id, 'beacons_getDashboardFleetDiscovery') }, options),
+            /** beacons-agent profile for one platform: API origin, DNS suffix and command line. */
+            clientProfile: (id, platform, options = {}) => {
+                const op = 'beacons_getDashboardClientProfile';
+                if (!BEACONS_CLIENT_PLATFORMS.includes(platform))
+                    invalidDashboard(op);
+                return client.request(op, { fleet_id: fleetId(id, op), platform }, options);
+            },
             policy: {
                 get: (id, options = {}) => client.request('beacons_getDashboardPolicy', { fleet_id: fleetId(id, 'beacons_getDashboardPolicy') }, options),
                 /** Future device admissions only; this never grants IAM rights or revokes an existing peer. */
                 update: (id, config, options = {}) => client.request('beacons_updateDashboardPolicy', { fleet_id: fleetId(id, 'beacons_updateDashboardPolicy'), body: policyInput(config) }, options),
             },
+            /** Fleet configuration records (gateways, private-gateways, sims). Configuration only: nothing is provisioned or connected. */
+            resources: {
+                list: (id, kind, options = {}) => client.request('beacons_listDashboardResources', { fleet_id: fleetId(id, 'beacons_listDashboardResources'),
+                    family: family(kind, 'beacons_listDashboardResources') }, options),
+                /** Not idempotent: a retry after an interrupted response creates a second record. */
+                create: (id, kind, body, options = {}) => client.request('beacons_createDashboardResource', { fleet_id: fleetId(id, 'beacons_createDashboardResource'),
+                    family: family(kind, 'beacons_createDashboardResource'), body: resourceBody(body, 'beacons_createDashboardResource', true) }, options),
+                update: (id, kind, resourceId, body, options = {}) => client.request('beacons_updateDashboardResource', { fleet_id: fleetId(id, 'beacons_updateDashboardResource'),
+                    family: family(kind, 'beacons_updateDashboardResource'), resource_id: fleetId(resourceId, 'beacons_updateDashboardResource'),
+                    body: resourceBody(body, 'beacons_updateDashboardResource', false) }, options),
+                delete: (id, kind, resourceId, options = {}) => client.request('beacons_deleteDashboardResource', { fleet_id: fleetId(id, 'beacons_deleteDashboardResource'),
+                    family: family(kind, 'beacons_deleteDashboardResource'), resource_id: fleetId(resourceId, 'beacons_deleteDashboardResource') }, options)
+                    .then(() => undefined),
+            },
             /** Reuse the same request ID and body after an interrupted response. Creates metadata only. */
             provision: (requestId, body = {}) => client.request('beacons_provisionBridgeFleet', { body: provisioningInput(requestId, body) }, { headers: { 'idempotency-key': requestId } }),
         },

package/dist/blinds-owner-enrollment.d.ts

@@ -30,6 +30,13 @@ export declare function blindsModule(client: GenesisClient): {
             signal?: AbortSignal;
             idempotencyKey?: string;
         }) => Promise<unknown>;
+        /** Revoke every credential in the selected organization. Bulk and irreversible. */
+        revokeAll: (init?: {
+            signal?: AbortSignal;
+            idempotencyKey?: string;
+        }) => Promise<{
+            revoked: number;
+        }>;
     };
     oauth: {
         connections: (init?: {
@@ -38,6 +45,108 @@ export declare function blindsModule(client: GenesisClient): {
             connections: import("./index.js").components["schemas"]["Blinds.OAuthConnection"][];
             total: number;
         }>;
+        /** Catalog providers that use OAuth 2.0. */
+        providers: (query?: {
+            q?: string;
+            category?: string;
+            limit?: number;
+            offset?: number;
+        }, init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            providers: import("./index.js").components["schemas"]["Blinds.ProviderSummary"][];
+            total: number;
+            limit: number;
+            offset: number;
+        }>;
+    };
+    /** What a credential can be bound to: auth mode and allowed destination domains. */
+    providers: {
+        list: (query?: {
+            q?: string;
+            category?: string;
+            limit?: number;
+            offset?: number;
+        } & {
+            auth_mode?: string;
+        }, init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            providers: import("./index.js").components["schemas"]["Blinds.ProviderSummary"][];
+            total: number;
+            limit: number;
+            offset: number;
+        }>;
+        get: (slug: string, init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            provider: import("./index.js").components["schemas"]["Blinds.ProviderSummary"];
+            oauth2?: {
+                authorization_url?: string;
+                token_url?: string;
+                refresh_url?: string | null;
+                revocation_url?: string | null;
+                default_scopes?: string[];
+                scopes_separator?: string;
+                supports_refresh?: boolean;
+                supports_pkce?: boolean;
+                pkce_method?: string | null;
+            } | null;
+            api_key?: {
+                placement?: string;
+                key_name?: string;
+                prefix?: string | null;
+            } | null;
+            destination: {
+                allowed_domains?: string[];
+                allow_subdomains?: boolean;
+                require_tls?: boolean;
+                allowed_ports?: number[];
+            };
+            auth_header_template?: Record<string, never> | null;
+        }>;
+    };
+    settings: {
+        get: (init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            consent_policy: "never" | "per_variable" | "per_delegate";
+            dashboard_notifications: boolean;
+            email_notifications: boolean;
+            slack_notifications: boolean;
+            updated_at: string;
+        }>;
+        update: (body: OperationInput<"blinds_updateSettings">["body"], init?: {
+            signal?: AbortSignal;
+            idempotencyKey?: string;
+        }) => Promise<{
+            consent_policy: "never" | "per_variable" | "per_delegate";
+            dashboard_notifications: boolean;
+            email_notifications: boolean;
+            slack_notifications: boolean;
+            updated_at: string;
+        }>;
+    };
+    agents: (init?: {
+        signal?: AbortSignal;
+    }) => Promise<{
+        agents: import("./index.js").components["schemas"]["Blinds.AgentSummary"][];
+    }>;
+    alerts: (init?: {
+        signal?: AbortSignal;
+    }) => Promise<{
+        events: import("./index.js").components["schemas"]["Blinds.ActivityEvent"][];
+    }>;
+    /** The receipt for a mutation, by the Idempotency-Key it was sent with. Read it after an uncertain outcome; never replay. */
+    operations: {
+        get: (operation_id: string, init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            operation_id: string;
+            state: "pending" | "completed";
+            response_status?: number | null;
+            response?: unknown;
+        }>;
     };
     consent: {
         pending: (init?: {
@@ -94,6 +203,18 @@ export declare function blindsModule(client: GenesisClient): {
     }) => Promise<{
         events: import("./index.js").components["schemas"]["Blinds.ActivityEvent"][];
     }>;
+    /** One HTTPS call made by Blinds under a delegation the caller holds; {{VARIABLE}} templates are filled server side and values never leave Blinds. Never retried. */
+    proxy: (body: OperationInput<"blinds_proxyRequest">["body"], init?: {
+        signal?: AbortSignal;
+        idempotencyKey?: string;
+    }) => Promise<{
+        status: number;
+        headers: {
+            [key: string]: string;
+        };
+        body: string;
+        request_id: string;
+    }>;
     ownerEnrollment: {
         reserve: (body: OperationInput<"blinds_ownerReserve">["body"], init?: {
             signal?: AbortSignal;

package/dist/blinds-owner-enrollment.js

@@ -103,7 +103,7 @@ export async function blindsOwnerTransport(options) {
 }
 export function blindsModule(client) {
     const write = (id, input, init = {}) => client.request(id, { ...input, ...(init.idempotencyKey ? { idempotency_key: init.idempotencyKey } : {}) }, { signal: init.signal });
-    const read = (id, init = {}) => client.request(id, {}, init);
+    const read = (id, init = {}, input = {}) => client.request(id, input, init);
     return {
         credentials: {
             /** Variable names only; values never leave Blinds. */
@@ -111,8 +111,27 @@ export function blindsModule(client) {
             /** Connect a static credential. The value is KMS-encrypted and never returned. */
             store: (body, init) => write('blinds_storeCredential', { body }, init),
             revoke: (variable, init) => write('blinds_deleteCredential', { variable }, init),
+            /** Revoke every credential in the selected organization. Bulk and irreversible. */
+            revokeAll: (init) => write('blinds_revokeAllCredentials', { all: 'true' }, init),
         },
-        oauth: { connections: (init) => read('blinds_listOAuthConnections', init) },
+        oauth: {
+            connections: (init) => read('blinds_listOAuthConnections', init),
+            /** Catalog providers that use OAuth 2.0. */
+            providers: (query = {}, init) => read('blinds_listOAuthProviders', init, query),
+        },
+        /** What a credential can be bound to: auth mode and allowed destination domains. */
+        providers: {
+            list: (query = {}, init) => read('blinds_listProviders', init, query),
+            get: (slug, init) => read('blinds_getProvider', init, { slug }),
+        },
+        settings: {
+            get: (init) => read('blinds_getSettings', init),
+            update: (body, init) => write('blinds_updateSettings', { body }, init),
+        },
+        agents: (init) => read('blinds_listAgents', init),
+        alerts: (init) => read('blinds_listAlerts', init),
+        /** The receipt for a mutation, by the Idempotency-Key it was sent with. Read it after an uncertain outcome; never replay. */
+        operations: { get: (operation_id, init) => read('blinds_getOperation', init, { operation_id }) },
         consent: {
             pending: (init) => read('blinds_listPendingConsent', init),
             records: (init) => read('blinds_listConsentRecords', init),
@@ -126,6 +145,8 @@ export function blindsModule(client) {
             revoke: (delegate_id, init) => write('blinds_revokeDelegate', { delegate_id }, init),
         },
         activity: (init) => read('blinds_listActivity', init),
+        /** One HTTPS call made by Blinds under a delegation the caller holds; {{VARIABLE}} templates are filled server side and values never leave Blinds. Never retried. */
+        proxy: (body, init) => write('blinds_proxyRequest', { body }, init),
         ownerEnrollment: {
             reserve: (body, init = {}) => client.request('blinds_ownerReserve', { body }, init),
             sign: (body, init = {}) => client.request('blinds_ownerSign', { body }, init),