@polyester/sdk 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @polyester/sdk
 
+## 0.8.0
+
+### Minor Changes
+
+- [#75](https://github.com/Fabric-Labs/polyester-sdk-typescript/pull/75) [`f9590a0`](https://github.com/Fabric-Labs/polyester-sdk-typescript/commit/f9590a0fbfabfc6a4bb5ba6d12870e7dd30f1a4a) Thanks [@aiiven](https://github.com/aiiven)! - feat(orders): require symbol IDs for order modifications and expose policy-specific rejection codes.
+
+- [#75](https://github.com/Fabric-Labs/polyester-sdk-typescript/pull/75) [`f9590a0`](https://github.com/Fabric-Labs/polyester-sdk-typescript/commit/f9590a0fbfabfc6a4bb5ba6d12870e7dd30f1a4a) Thanks [@aiiven](https://github.com/aiiven)! - feat(triggers): require symbol IDs for policy-routed modifications and resumes, and expose failed trigger events.
+
+- [#75](https://github.com/Fabric-Labs/polyester-sdk-typescript/pull/75) [`f9590a0`](https://github.com/Fabric-Labs/polyester-sdk-typescript/commit/f9590a0fbfabfc6a4bb5ba6d12870e7dd30f1a4a) Thanks [@aiiven](https://github.com/aiiven)! - feat(policies): expose the spot-only policy contract, including read-address-book permissions and no-permission API-key defaults.
+
+### Patch Changes
+
+- [#75](https://github.com/Fabric-Labs/polyester-sdk-typescript/pull/75) [`f9590a0`](https://github.com/Fabric-Labs/polyester-sdk-typescript/commit/f9590a0fbfabfc6a4bb5ba6d12870e7dd30f1a4a) Thanks [@aiiven](https://github.com/aiiven)! - perf(gen): omit unused option-only descriptor metadata from published protobuf modules.
+
+- [#72](https://github.com/Fabric-Labs/polyester-sdk-typescript/pull/72) [`1a5fa52`](https://github.com/Fabric-Labs/polyester-sdk-typescript/commit/1a5fa52df5ac8a8bd4bb4b64dfb705c8abb3ac60) Thanks [@huntabyte](https://github.com/huntabyte)! - fix(auth): Ed25519 API-key signing now allocates strictly increasing `X-API-TIMESTAMP` values, so concurrent requests in the same millisecond no longer share a timestamp and risk replay rejection on strict servers.
+
 ## 0.7.0
 
 ### Minor Changes

package/dist/gen/auth/v1/api_keys_pb.d.ts

@@ -60,7 +60,7 @@ type ApiKey = Message<"auth.v1.ApiKey"> & {
   subaccountId?: bigint | undefined;
   /**
    * Optional API policy attached to this key (opaque ID).
-   * Empty means "no per-key policy", so only the sub-account policy (and roles) apply.
+   * Empty means no policy is attached and the key has no permissions.
    *
    * @generated from field: optional fixed64 policy_id = 8;
    */

package/dist/gen/auth/v1/api_keys_pb.js.map

@@ -1 +1 @@
-{"version":3,"file":"api_keys_pb.js","names":[],"sources":["../../../../src/gen/auth/v1/api_keys_pb.ts"],"sourcesContent":["// @generated by protoc-gen-es v2.13.0 with parameter \"target=ts,import_extension=js\"\n// @generated from file auth/v1/api_keys.proto (package auth.v1, syntax proto3)\n/* eslint-disable */\n\nimport type { GenEnum, GenFile, GenMessage, GenService } from \"@bufbuild/protobuf/codegenv2\";\nimport { enumDesc, fileDesc, messageDesc, serviceDesc } from \"@bufbuild/protobuf/codegenv2\";\nimport type { FieldMask, Timestamp } from \"@bufbuild/protobuf/wkt\";\nimport { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from \"@bufbuild/protobuf/wkt\";\nimport { file_polyester_api_options } from \"../../polyester/api/options_pb.js\";\nimport type { Message } from \"@bufbuild/protobuf\";\n\n/**\n * Describes the file auth/v1/api_keys.proto.\n */\nexport const file_auth_v1_api_keys: GenFile = /*@__PURE__*/\n  fileDesc(\"ChZhdXRoL3YxL2FwaV9rZXlzLnByb3RvEgdhdXRoLnYxIucDCgZBcGlLZXkSEAoGa2V5X2lkGAIgASgJQgASDQoFbGFiZWwYAyABKAkSDgoEaWNvbhgJIAEoCUIAEg8KBWNvbG9yGAogASgJQgASFgoMaXBfd2hpdGVsaXN0GAQgAygJQgASJQoGc3RhdHVzGAYgASgOMhUuYXV0aC52MS5BcGlLZXlTdGF0dXMSGgoNc3ViYWNjb3VudF9pZBgHIAEoBkgAiAEBEhYKCXBvbGljeV9pZBgIIAEoBkgBiAEBEi4KCmNyZWF0ZWRfYXQYFCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjAKDGxhc3RfdXNlZF9hdBgVIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGgoScHVibGljX2tleV9lZDI1NTE5GBYgASgMEi4KCmV4cGlyZXNfYXQYFyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhgKEGNyZWF0ZWRfYnlfYWN0b3IYGCABKAkSLgoKdXBkYXRlZF9hdBgZIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEAoIcmV2aXNpb24YGiABKARCEAoOX3N1YmFjY291bnRfaWRCDAoKX3BvbGljeV9pZCKrAQoTQ3JlYXRlQXBpS2V5UmVxdWVzdBIPCgVsYWJlbBgBIAEoCUIAEhoKDXN1YmFjY291bnRfaWQYAyABKAZIAIgBARIOCgRpY29uGAYgASgJQgASDwoFY29sb3IYByABKAlCABIWCgxpcF93aGl0ZWxpc3QYBCADKAlCABIcChJwdWJsaWNfa2V5X2VkMjU1MTkYBSABKAxCAEIQCg5fc3ViYWNjb3VudF9pZCI4ChRDcmVhdGVBcGlLZXlSZXNwb25zZRIgCgdhcGlfa2V5GAEgASgLMg8uYXV0aC52MS5BcGlLZXkiQgoSTGlzdEFwaUtleXNSZXF1ZXN0EhoKDXN1YmFjY291bnRfaWQYASABKAZIAIgBAUIQCg5fc3ViYWNjb3VudF9pZCI4ChNMaXN0QXBpS2V5c1Jlc3BvbnNlEiEKCGFwaV9rZXlzGAEgAygLMg8uYXV0aC52MS5BcGlLZXkiJwoTRGVsZXRlQXBpS2V5UmVxdWVzdBIQCgZrZXlfaWQYASABKAlCACIWChREZWxldGVBcGlLZXlSZXNwb25zZSIkChBHZXRBcGlLZXlSZXF1ZXN0EhAKBmtleV9pZBgBIAEoCUIAIjUKEUdldEFwaUtleVJlc3BvbnNlEiAKB2FwaV9rZXkYASABKAsyDy5hdXRoLnYxLkFwaUtleSK3AQoQQXBpS2V5VXBkYXRlU3BlYxIPCgVsYWJlbBgBIAEoCUIAEg4KBGljb24YAiABKAlCABIPCgVjb2xvchgDIAEoCUIAEicKBnN0YXR1cxgEIAEoDjIVLmF1dGgudjEuQXBpS2V5U3RhdHVzQgASFgoMaXBfd2hpdGVsaXN0GAUgAygJQgASLgoKZXhwaXJlc19hdBgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXA6ACKlAQoTVXBkYXRlQXBpS2V5UmVxdWVzdBIQCgZrZXlfaWQYASABKAlCABIsCgdhcGlfa2V5GAIgASgLMhkuYXV0aC52MS5BcGlLZXlVcGRhdGVTcGVjQgASMQoLdXBkYXRlX21hc2sYAyABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQgASGwoRZXhwZWN0ZWRfcmV2aXNpb24YBCABKARCACI4ChRVcGRhdGVBcGlLZXlSZXNwb25zZRIgCgdhcGlfa2V5GAEgASgLMg8uYXV0aC52MS5BcGlLZXkqVQoMQXBpS2V5U3RhdHVzEh4KGkFQSV9LRVlfU1RBVFVTX1VOU1BFQ0lGSUVEEAASCgoGQUNUSVZFEAESCwoHUkVWT0tFRBACEgwKCERJU0FCTEVEEAMyjgMKDUFwaUtleVNlcnZpY2USTQoMQ3JlYXRlQXBpS2V5EhwuYXV0aC52MS5DcmVhdGVBcGlLZXlSZXF1ZXN0Gh0uYXV0aC52MS5DcmVhdGVBcGlLZXlSZXNwb25zZSIAEkoKC0xpc3RBcGlLZXlzEhsuYXV0aC52MS5MaXN0QXBpS2V5c1JlcXVlc3QaHC5hdXRoLnYxLkxpc3RBcGlLZXlzUmVzcG9uc2UiABJECglHZXRBcGlLZXkSGS5hdXRoLnYxLkdldEFwaUtleVJlcXVlc3QaGi5hdXRoLnYxLkdldEFwaUtleVJlc3BvbnNlIgASTQoMRGVsZXRlQXBpS2V5EhwuYXV0aC52MS5EZWxldGVBcGlLZXlSZXF1ZXN0Gh0uYXV0aC52MS5EZWxldGVBcGlLZXlSZXNwb25zZSIAEk0KDFVwZGF0ZUFwaUtleRIcLmF1dGgudjEuVXBkYXRlQXBpS2V5UmVxdWVzdBodLmF1dGgudjEuVXBkYXRlQXBpS2V5UmVzcG9uc2UiAEI8WjpnaXRodWIuY29tL0ZhYnJpYy1MYWJzL3BvbHllc3Rlci1zZGstZ28vZ2VuL2F1dGgvdjE7YXV0aHYxYgZwcm90bzM=\", [file_google_protobuf_field_mask, file_google_protobuf_timestamp, file_polyester_api_options]);\n\n/**\n * ApiKey is public API key metadata. It never includes the private key or seed.\n *\n * @generated from message auth.v1.ApiKey\n */\nexport type ApiKey = Message<\"auth.v1.ApiKey\"> & {\n  /**\n   * Stable opaque identifier used to refer to this key, formatted as \"ak_\"\n   * followed by 32 lowercase hex characters.\n   *\n   * @generated from field: string key_id = 2;\n   */\n  keyId: string;\n\n  /**\n   * Human-readable label for the key. Maximum length is 64 characters.\n   *\n   * @generated from field: string label = 3;\n   */\n  label: string;\n\n  /**\n   * Optional user-chosen icon/emoji for UI display.\n   *\n   * @generated from field: string icon = 9;\n   */\n  icon: string;\n\n  /**\n   * Optional user-chosen color token for UI display.\n   *\n   * @generated from field: string color = 10;\n   */\n  color: string;\n\n  /**\n   * Optional CIDR whitelist. Empty means no IP restriction. Maximum 32 unique\n   * entries.\n   *\n   * @generated from field: repeated string ip_whitelist = 4;\n   */\n  ipWhitelist: string[];\n\n  /**\n   * Current key status.\n   *\n   * @generated from field: auth.v1.ApiKeyStatus status = 6;\n   */\n  status: ApiKeyStatus;\n\n  /**\n   * Optional sub-account this key is scoped to (opaque ID; empty = root-level).\n   *\n   * @generated from field: optional fixed64 subaccount_id = 7;\n   */\n  subaccountId?: bigint | undefined;\n\n  /**\n   * Optional API policy attached to this key (opaque ID).\n   * Empty means \"no per-key policy\", so only the sub-account policy (and roles) apply.\n   *\n   * @generated from field: optional fixed64 policy_id = 8;\n   */\n  policyId?: bigint | undefined;\n\n  /**\n   * Time in UTC when this key was created.\n   *\n   * @generated from field: google.protobuf.Timestamp created_at = 20;\n   */\n  createdAt?: Timestamp | undefined;\n\n  /**\n   * Last time in UTC when this key authenticated a request. Omitted when the\n   * key has not been used.\n   *\n   * @generated from field: google.protobuf.Timestamp last_used_at = 21;\n   */\n  lastUsedAt?: Timestamp | undefined;\n\n  /**\n   * Ed25519 public key bytes associated with this API key. The private key or\n   * seed is never returned by the API.\n   *\n   * @generated from field: bytes public_key_ed25519 = 22;\n   */\n  publicKeyEd25519: Uint8Array;\n\n  /**\n   * Optional expiry time in UTC. When set, the key cannot authenticate requests\n   * after this time, regardless of status.\n   *\n   * @generated from field: google.protobuf.Timestamp expires_at = 23;\n   */\n  expiresAt?: Timestamp | undefined;\n\n  /**\n   * Read-only actor label describing who created this key, such as a username\n   * or account label.\n   *\n   * @generated from field: string created_by_actor = 24;\n   */\n  createdByActor: string;\n\n  /**\n   * Time in UTC when this key's configuration was last changed. For the same\n   * key, later is fresher, equal is an idempotent replay, and earlier is stale.\n   * Equal timestamps with different configuration indicate an invariant failure.\n   * This is independent of last_used_at, which tracks authentication activity.\n   *\n   * @generated from field: google.protobuf.Timestamp updated_at = 25;\n   */\n  updatedAt?: Timestamp | undefined;\n\n  /**\n   * Monotonic resource revision used for conditional updates.\n   *\n   * @generated from field: uint64 revision = 26;\n   */\n  revision: bigint;\n};\n\n/**\n * Describes the message auth.v1.ApiKey.\n * Use `create(ApiKeySchema)` to create a new message.\n */\nexport const ApiKeySchema: GenMessage<ApiKey> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 0);\n\n/**\n * CreateApiKeyRequest creates a new API key. Clients generate the Ed25519 key\n * pair locally and submit only the public key.\n *\n * @generated from message auth.v1.CreateApiKeyRequest\n */\nexport type CreateApiKeyRequest = Message<\"auth.v1.CreateApiKeyRequest\"> & {\n  /**\n   * Human-readable label for the key. Required; 1 to 64 characters.\n   *\n   * @generated from field: string label = 1;\n   */\n  label: string;\n\n  /**\n   * Optional sub-account to scope this key to (opaque ID). If unset, the key is\n   * root-level.\n   *\n   * @generated from field: optional fixed64 subaccount_id = 3;\n   */\n  subaccountId?: bigint | undefined;\n\n  /**\n   * Optional user-chosen icon/emoji for UI display.\n   *\n   * @generated from field: string icon = 6;\n   */\n  icon: string;\n\n  /**\n   * Optional user-chosen color token for UI display.\n   *\n   * @generated from field: string color = 7;\n   */\n  color: string;\n\n  /**\n   * Optional CIDR whitelist. Empty means no IP restriction. Maximum 32 unique\n   * entries.\n   *\n   * @generated from field: repeated string ip_whitelist = 4;\n   */\n  ipWhitelist: string[];\n\n  /**\n   * Ed25519 public key bytes. Must be exactly 32 bytes. The private key or seed\n   * must never be sent to the API.\n   *\n   * @generated from field: bytes public_key_ed25519 = 5;\n   */\n  publicKeyEd25519: Uint8Array;\n};\n\n/**\n * Describes the message auth.v1.CreateApiKeyRequest.\n * Use `create(CreateApiKeyRequestSchema)` to create a new message.\n */\nexport const CreateApiKeyRequestSchema: GenMessage<CreateApiKeyRequest> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 1);\n\n/**\n * CreateApiKeyResponse returns the created API key metadata.\n *\n * @generated from message auth.v1.CreateApiKeyResponse\n */\nexport type CreateApiKeyResponse = Message<\"auth.v1.CreateApiKeyResponse\"> & {\n  /**\n   * Created API key metadata. The private key or seed is never returned.\n   *\n   * @generated from field: auth.v1.ApiKey api_key = 1;\n   */\n  apiKey?: ApiKey | undefined;\n};\n\n/**\n * Describes the message auth.v1.CreateApiKeyResponse.\n * Use `create(CreateApiKeyResponseSchema)` to create a new message.\n */\nexport const CreateApiKeyResponseSchema: GenMessage<CreateApiKeyResponse> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 2);\n\n/**\n * ListApiKeysRequest lists non-revoked API keys owned by the caller.\n *\n * @generated from message auth.v1.ListApiKeysRequest\n */\nexport type ListApiKeysRequest = Message<\"auth.v1.ListApiKeysRequest\"> & {\n  /**\n   * Optional filter: only keys scoped to this sub-account (opaque ID). If unset,\n   * all non-revoked keys owned by the caller are returned.\n   *\n   * @generated from field: optional fixed64 subaccount_id = 1;\n   */\n  subaccountId?: bigint | undefined;\n};\n\n/**\n * Describes the message auth.v1.ListApiKeysRequest.\n * Use `create(ListApiKeysRequestSchema)` to create a new message.\n */\nexport const ListApiKeysRequestSchema: GenMessage<ListApiKeysRequest> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 3);\n\n/**\n * ListApiKeysResponse contains matching API keys, newest first by creation time.\n *\n * @generated from message auth.v1.ListApiKeysResponse\n */\nexport type ListApiKeysResponse = Message<\"auth.v1.ListApiKeysResponse\"> & {\n  /**\n   * Matching API keys, newest first. Revoked keys are excluded.\n   *\n   * @generated from field: repeated auth.v1.ApiKey api_keys = 1;\n   */\n  apiKeys: ApiKey[];\n};\n\n/**\n * Describes the message auth.v1.ListApiKeysResponse.\n * Use `create(ListApiKeysResponseSchema)` to create a new message.\n */\nexport const ListApiKeysResponseSchema: GenMessage<ListApiKeysResponse> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 4);\n\n/**\n * DeleteApiKeyRequest permanently revokes an API key.\n *\n * @generated from message auth.v1.DeleteApiKeyRequest\n */\nexport type DeleteApiKeyRequest = Message<\"auth.v1.DeleteApiKeyRequest\"> & {\n  /**\n   * Opaque API key identifier (e.g. \"ak_<hex>\"). This is the stable public\n   * handle for a key.\n   *\n   * @generated from field: string key_id = 1;\n   */\n  keyId: string;\n};\n\n/**\n * Describes the message auth.v1.DeleteApiKeyRequest.\n * Use `create(DeleteApiKeyRequestSchema)` to create a new message.\n */\nexport const DeleteApiKeyRequestSchema: GenMessage<DeleteApiKeyRequest> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 5);\n\n/**\n * DeleteApiKeyResponse is empty when revocation succeeds.\n *\n * @generated from message auth.v1.DeleteApiKeyResponse\n */\nexport type DeleteApiKeyResponse = Message<\"auth.v1.DeleteApiKeyResponse\"> & {\n};\n\n/**\n * Describes the message auth.v1.DeleteApiKeyResponse.\n * Use `create(DeleteApiKeyResponseSchema)` to create a new message.\n */\nexport const DeleteApiKeyResponseSchema: GenMessage<DeleteApiKeyResponse> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 6);\n\n/**\n * GetApiKeyRequest returns a single API key owned by the caller's account.\n *\n * @generated from message auth.v1.GetApiKeyRequest\n */\nexport type GetApiKeyRequest = Message<\"auth.v1.GetApiKeyRequest\"> & {\n  /**\n   * Opaque API key identifier, formatted as \"ak_\" followed by 32 lowercase hex\n   * characters.\n   *\n   * @generated from field: string key_id = 1;\n   */\n  keyId: string;\n};\n\n/**\n * Describes the message auth.v1.GetApiKeyRequest.\n * Use `create(GetApiKeyRequestSchema)` to create a new message.\n */\nexport const GetApiKeyRequestSchema: GenMessage<GetApiKeyRequest> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 7);\n\n/**\n * GetApiKeyResponse returns one API key owned by the caller.\n *\n * @generated from message auth.v1.GetApiKeyResponse\n */\nexport type GetApiKeyResponse = Message<\"auth.v1.GetApiKeyResponse\"> & {\n  /**\n   * Matching API key metadata.\n   *\n   * @generated from field: auth.v1.ApiKey api_key = 1;\n   */\n  apiKey?: ApiKey | undefined;\n};\n\n/**\n * Describes the message auth.v1.GetApiKeyResponse.\n * Use `create(GetApiKeyResponseSchema)` to create a new message.\n */\nexport const GetApiKeyResponseSchema: GenMessage<GetApiKeyResponse> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 8);\n\n/**\n * ApiKeyUpdateSpec contains mutable API key configuration.\n *\n * @generated from message auth.v1.ApiKeyUpdateSpec\n */\nexport type ApiKeyUpdateSpec = Message<\"auth.v1.ApiKeyUpdateSpec\"> & {\n  /**\n   * Human-friendly label for the key. Empty clears the label when selected.\n   *\n   * @generated from field: string label = 1;\n   */\n  label: string;\n\n  /**\n   * User-chosen icon/emoji for UI display. Empty clears the icon when selected.\n   *\n   * @generated from field: string icon = 2;\n   */\n  icon: string;\n\n  /**\n   * User-chosen color token for UI display. Empty clears the color when selected.\n   *\n   * @generated from field: string color = 3;\n   */\n  color: string;\n\n  /**\n   * New status. ACTIVE and DISABLED are allowed; revocation uses DeleteApiKey.\n   *\n   * @generated from field: auth.v1.ApiKeyStatus status = 4;\n   */\n  status: ApiKeyStatus;\n\n  /**\n   * Complete replacement IP whitelist. Empty clears the restriction when selected.\n   *\n   * @generated from field: repeated string ip_whitelist = 5;\n   */\n  ipWhitelist: string[];\n\n  /**\n   * Expiry time in UTC. When selected, omission or the epoch clears expiry.\n   *\n   * @generated from field: google.protobuf.Timestamp expires_at = 6;\n   */\n  expiresAt?: Timestamp | undefined;\n};\n\n/**\n * Describes the message auth.v1.ApiKeyUpdateSpec.\n * Use `create(ApiKeyUpdateSpecSchema)` to create a new message.\n */\nexport const ApiKeyUpdateSpecSchema: GenMessage<ApiKeyUpdateSpec> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 9);\n\n/**\n * UpdateApiKeyRequest changes selected mutable fields on an existing API key.\n *\n * @generated from message auth.v1.UpdateApiKeyRequest\n */\nexport type UpdateApiKeyRequest = Message<\"auth.v1.UpdateApiKeyRequest\"> & {\n  /**\n   * Opaque API key identifier to update.\n   *\n   * @generated from field: string key_id = 1;\n   */\n  keyId: string;\n\n  /**\n   * Candidate values for fields selected by update_mask.\n   *\n   * @generated from field: auth.v1.ApiKeyUpdateSpec api_key = 2;\n   */\n  apiKey?: ApiKeyUpdateSpec | undefined;\n\n  /**\n   * Mutable fields to apply. Paths are relative to api_key. The mask is required,\n   * must be non-empty, and cannot contain \"*\".\n   *\n   * @generated from field: google.protobuf.FieldMask update_mask = 3;\n   */\n  updateMask?: FieldMask | undefined;\n\n  /**\n   * Revision returned by the latest successful read.\n   *\n   * @generated from field: uint64 expected_revision = 4;\n   */\n  expectedRevision: bigint;\n};\n\n/**\n * Describes the message auth.v1.UpdateApiKeyRequest.\n * Use `create(UpdateApiKeyRequestSchema)` to create a new message.\n */\nexport const UpdateApiKeyRequestSchema: GenMessage<UpdateApiKeyRequest> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 10);\n\n/**\n * UpdateApiKeyResponse returns the API key after applying the update.\n *\n * @generated from message auth.v1.UpdateApiKeyResponse\n */\nexport type UpdateApiKeyResponse = Message<\"auth.v1.UpdateApiKeyResponse\"> & {\n  /**\n   * Updated API key metadata.\n   *\n   * @generated from field: auth.v1.ApiKey api_key = 1;\n   */\n  apiKey?: ApiKey | undefined;\n};\n\n/**\n * Describes the message auth.v1.UpdateApiKeyResponse.\n * Use `create(UpdateApiKeyResponseSchema)` to create a new message.\n */\nexport const UpdateApiKeyResponseSchema: GenMessage<UpdateApiKeyResponse> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 11);\n\n/**\n * Status of an API key.\n *\n * @generated from enum auth.v1.ApiKeyStatus\n */\nexport enum ApiKeyStatus {\n  /**\n   * No API key status specified.\n   *\n   * @generated from enum value: API_KEY_STATUS_UNSPECIFIED = 0;\n   */\n  API_KEY_STATUS_UNSPECIFIED = 0,\n\n  /**\n   * Key can authenticate requests.\n   *\n   * @generated from enum value: ACTIVE = 1;\n   */\n  ACTIVE = 1,\n\n  /**\n   * Key has been permanently revoked and cannot be used again.\n   *\n   * @generated from enum value: REVOKED = 2;\n   */\n  REVOKED = 2,\n\n  /**\n   * Key is temporarily disabled and cannot authenticate requests until re-enabled.\n   *\n   * @generated from enum value: DISABLED = 3;\n   */\n  DISABLED = 3,\n}\n\n/**\n * Describes the enum auth.v1.ApiKeyStatus.\n */\nexport const ApiKeyStatusSchema: GenEnum<ApiKeyStatus> = /*@__PURE__*/\n  enumDesc(file_auth_v1_api_keys, 0);\n\n/**\n * ApiKeyService manages API keys for authenticated callers.\n *\n * @generated from service auth.v1.ApiKeyService\n */\nexport const ApiKeyService: GenService<{\n  /**\n   * Create a new API key for the caller. Account security settings may require\n   * MFA enrollment or a fresh step-up proof.\n   *\n   * @generated from rpc auth.v1.ApiKeyService.CreateApiKey\n   */\n  createApiKey: {\n    methodKind: \"unary\";\n    input: typeof CreateApiKeyRequestSchema;\n    output: typeof CreateApiKeyResponseSchema;\n  },\n  /**\n   * List non-revoked API keys owned by the caller, newest first.\n   *\n   * @generated from rpc auth.v1.ApiKeyService.ListApiKeys\n   */\n  listApiKeys: {\n    methodKind: \"unary\";\n    input: typeof ListApiKeysRequestSchema;\n    output: typeof ListApiKeysResponseSchema;\n  },\n  /**\n   * Get a single API key owned by the caller.\n   *\n   * @generated from rpc auth.v1.ApiKeyService.GetApiKey\n   */\n  getApiKey: {\n    methodKind: \"unary\";\n    input: typeof GetApiKeyRequestSchema;\n    output: typeof GetApiKeyResponseSchema;\n  },\n  /**\n   * Revoke an API key permanently.\n   *\n   * @generated from rpc auth.v1.ApiKeyService.DeleteApiKey\n   */\n  deleteApiKey: {\n    methodKind: \"unary\";\n    input: typeof DeleteApiKeyRequestSchema;\n    output: typeof DeleteApiKeyResponseSchema;\n  },\n  /**\n   * Update API key metadata and allowed status transitions. Revocation must use\n   * DeleteApiKey.\n   *\n   * @generated from rpc auth.v1.ApiKeyService.UpdateApiKey\n   */\n  updateApiKey: {\n    methodKind: \"unary\";\n    input: typeof UpdateApiKeyRequestSchema;\n    output: typeof UpdateApiKeyResponseSchema;\n  },\n}> = /*@__PURE__*/\n  serviceDesc(file_auth_v1_api_keys, 0);\n\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,MAAa,wBACX,uBAAS,4nFAA4nF;CAAC;CAAiC;CAAgC;AAA0B,CAAC;;;;;AAgIpuF,MAAa,eACX,0BAAY,uBAAuB,CAAC;;;;;AA2DtC,MAAa,4BACX,0BAAY,uBAAuB,CAAC;;;;;AAoBtC,MAAa,6BACX,0BAAY,uBAAuB,CAAC;;;;;AAqBtC,MAAa,2BACX,0BAAY,uBAAuB,CAAC;;;;;AAoBtC,MAAa,4BACX,0BAAY,uBAAuB,CAAC;;;;;AAqBtC,MAAa,4BACX,0BAAY,uBAAuB,CAAC;;;;;AActC,MAAa,6BACX,0BAAY,uBAAuB,CAAC;;;;;AAqBtC,MAAa,yBACX,0BAAY,uBAAuB,CAAC;;;;;AAoBtC,MAAa,0BACX,0BAAY,uBAAuB,CAAC;;;;;AAuDtC,MAAa,yBACX,0BAAY,uBAAuB,CAAC;;;;;AA0CtC,MAAa,4BACX,0BAAY,uBAAuB,EAAE;;;;;AAoBvC,MAAa,6BACX,0BAAY,uBAAuB,EAAE;;;;;;AAOvC,IAAY,eAAL,yBAAA,cAAA;;;;;;CAML,aAAA,aAAA,gCAAA,KAAA;;;;;;CAOA,aAAA,aAAA,YAAA,KAAA;;;;;;CAOA,aAAA,aAAA,aAAA,KAAA;;;;;;CAOA,aAAA,aAAA,cAAA,KAAA;;AACF,EAAA,CAAA,CAAA;;;;AAKA,MAAa,qBACX,uBAAS,uBAAuB,CAAC;;;;;;AAOnC,MAAa,gBAsDX,0BAAY,uBAAuB,CAAC"}
+{"version":3,"file":"api_keys_pb.js","names":[],"sources":["../../../../src/gen/auth/v1/api_keys_pb.ts"],"sourcesContent":["// @generated by protoc-gen-es v2.13.0 with parameter \"target=ts,import_extension=js\"\n// @generated from file auth/v1/api_keys.proto (package auth.v1, syntax proto3)\n/* eslint-disable */\n\nimport type { GenEnum, GenFile, GenMessage, GenService } from \"@bufbuild/protobuf/codegenv2\";\nimport { enumDesc, fileDesc, messageDesc, serviceDesc } from \"@bufbuild/protobuf/codegenv2\";\nimport type { FieldMask, Timestamp } from \"@bufbuild/protobuf/wkt\";\nimport { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from \"@bufbuild/protobuf/wkt\";\nimport { file_polyester_api_options } from \"../../polyester/api/options_pb.js\";\nimport type { Message } from \"@bufbuild/protobuf\";\n\n/**\n * Describes the file auth/v1/api_keys.proto.\n */\nexport const file_auth_v1_api_keys: GenFile = /*@__PURE__*/\n  fileDesc(\"ChZhdXRoL3YxL2FwaV9rZXlzLnByb3RvEgdhdXRoLnYxIucDCgZBcGlLZXkSEAoGa2V5X2lkGAIgASgJQgASDQoFbGFiZWwYAyABKAkSDgoEaWNvbhgJIAEoCUIAEg8KBWNvbG9yGAogASgJQgASFgoMaXBfd2hpdGVsaXN0GAQgAygJQgASJQoGc3RhdHVzGAYgASgOMhUuYXV0aC52MS5BcGlLZXlTdGF0dXMSGgoNc3ViYWNjb3VudF9pZBgHIAEoBkgAiAEBEhYKCXBvbGljeV9pZBgIIAEoBkgBiAEBEi4KCmNyZWF0ZWRfYXQYFCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjAKDGxhc3RfdXNlZF9hdBgVIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGgoScHVibGljX2tleV9lZDI1NTE5GBYgASgMEi4KCmV4cGlyZXNfYXQYFyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhgKEGNyZWF0ZWRfYnlfYWN0b3IYGCABKAkSLgoKdXBkYXRlZF9hdBgZIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEAoIcmV2aXNpb24YGiABKARCEAoOX3N1YmFjY291bnRfaWRCDAoKX3BvbGljeV9pZCKrAQoTQ3JlYXRlQXBpS2V5UmVxdWVzdBIPCgVsYWJlbBgBIAEoCUIAEhoKDXN1YmFjY291bnRfaWQYAyABKAZIAIgBARIOCgRpY29uGAYgASgJQgASDwoFY29sb3IYByABKAlCABIWCgxpcF93aGl0ZWxpc3QYBCADKAlCABIcChJwdWJsaWNfa2V5X2VkMjU1MTkYBSABKAxCAEIQCg5fc3ViYWNjb3VudF9pZCI4ChRDcmVhdGVBcGlLZXlSZXNwb25zZRIgCgdhcGlfa2V5GAEgASgLMg8uYXV0aC52MS5BcGlLZXkiQgoSTGlzdEFwaUtleXNSZXF1ZXN0EhoKDXN1YmFjY291bnRfaWQYASABKAZIAIgBAUIQCg5fc3ViYWNjb3VudF9pZCI4ChNMaXN0QXBpS2V5c1Jlc3BvbnNlEiEKCGFwaV9rZXlzGAEgAygLMg8uYXV0aC52MS5BcGlLZXkiJwoTRGVsZXRlQXBpS2V5UmVxdWVzdBIQCgZrZXlfaWQYASABKAlCACIWChREZWxldGVBcGlLZXlSZXNwb25zZSIkChBHZXRBcGlLZXlSZXF1ZXN0EhAKBmtleV9pZBgBIAEoCUIAIjUKEUdldEFwaUtleVJlc3BvbnNlEiAKB2FwaV9rZXkYASABKAsyDy5hdXRoLnYxLkFwaUtleSK3AQoQQXBpS2V5VXBkYXRlU3BlYxIPCgVsYWJlbBgBIAEoCUIAEg4KBGljb24YAiABKAlCABIPCgVjb2xvchgDIAEoCUIAEicKBnN0YXR1cxgEIAEoDjIVLmF1dGgudjEuQXBpS2V5U3RhdHVzQgASFgoMaXBfd2hpdGVsaXN0GAUgAygJQgASLgoKZXhwaXJlc19hdBgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXA6ACKlAQoTVXBkYXRlQXBpS2V5UmVxdWVzdBIQCgZrZXlfaWQYASABKAlCABIsCgdhcGlfa2V5GAIgASgLMhkuYXV0aC52MS5BcGlLZXlVcGRhdGVTcGVjQgASMQoLdXBkYXRlX21hc2sYAyABKAsyGi5nb29nbGUucHJvdG9idWYuRmllbGRNYXNrQgASGwoRZXhwZWN0ZWRfcmV2aXNpb24YBCABKARCACI4ChRVcGRhdGVBcGlLZXlSZXNwb25zZRIgCgdhcGlfa2V5GAEgASgLMg8uYXV0aC52MS5BcGlLZXkqVQoMQXBpS2V5U3RhdHVzEh4KGkFQSV9LRVlfU1RBVFVTX1VOU1BFQ0lGSUVEEAASCgoGQUNUSVZFEAESCwoHUkVWT0tFRBACEgwKCERJU0FCTEVEEAMyjgMKDUFwaUtleVNlcnZpY2USTQoMQ3JlYXRlQXBpS2V5EhwuYXV0aC52MS5DcmVhdGVBcGlLZXlSZXF1ZXN0Gh0uYXV0aC52MS5DcmVhdGVBcGlLZXlSZXNwb25zZSIAEkoKC0xpc3RBcGlLZXlzEhsuYXV0aC52MS5MaXN0QXBpS2V5c1JlcXVlc3QaHC5hdXRoLnYxLkxpc3RBcGlLZXlzUmVzcG9uc2UiABJECglHZXRBcGlLZXkSGS5hdXRoLnYxLkdldEFwaUtleVJlcXVlc3QaGi5hdXRoLnYxLkdldEFwaUtleVJlc3BvbnNlIgASTQoMRGVsZXRlQXBpS2V5EhwuYXV0aC52MS5EZWxldGVBcGlLZXlSZXF1ZXN0Gh0uYXV0aC52MS5EZWxldGVBcGlLZXlSZXNwb25zZSIAEk0KDFVwZGF0ZUFwaUtleRIcLmF1dGgudjEuVXBkYXRlQXBpS2V5UmVxdWVzdBodLmF1dGgudjEuVXBkYXRlQXBpS2V5UmVzcG9uc2UiAEI8WjpnaXRodWIuY29tL0ZhYnJpYy1MYWJzL3BvbHllc3Rlci1zZGstZ28vZ2VuL2F1dGgvdjE7YXV0aHYxYgZwcm90bzM=\", [file_google_protobuf_field_mask, file_google_protobuf_timestamp, file_polyester_api_options]);\n\n/**\n * ApiKey is public API key metadata. It never includes the private key or seed.\n *\n * @generated from message auth.v1.ApiKey\n */\nexport type ApiKey = Message<\"auth.v1.ApiKey\"> & {\n  /**\n   * Stable opaque identifier used to refer to this key, formatted as \"ak_\"\n   * followed by 32 lowercase hex characters.\n   *\n   * @generated from field: string key_id = 2;\n   */\n  keyId: string;\n\n  /**\n   * Human-readable label for the key. Maximum length is 64 characters.\n   *\n   * @generated from field: string label = 3;\n   */\n  label: string;\n\n  /**\n   * Optional user-chosen icon/emoji for UI display.\n   *\n   * @generated from field: string icon = 9;\n   */\n  icon: string;\n\n  /**\n   * Optional user-chosen color token for UI display.\n   *\n   * @generated from field: string color = 10;\n   */\n  color: string;\n\n  /**\n   * Optional CIDR whitelist. Empty means no IP restriction. Maximum 32 unique\n   * entries.\n   *\n   * @generated from field: repeated string ip_whitelist = 4;\n   */\n  ipWhitelist: string[];\n\n  /**\n   * Current key status.\n   *\n   * @generated from field: auth.v1.ApiKeyStatus status = 6;\n   */\n  status: ApiKeyStatus;\n\n  /**\n   * Optional sub-account this key is scoped to (opaque ID; empty = root-level).\n   *\n   * @generated from field: optional fixed64 subaccount_id = 7;\n   */\n  subaccountId?: bigint | undefined;\n\n  /**\n   * Optional API policy attached to this key (opaque ID).\n   * Empty means no policy is attached and the key has no permissions.\n   *\n   * @generated from field: optional fixed64 policy_id = 8;\n   */\n  policyId?: bigint | undefined;\n\n  /**\n   * Time in UTC when this key was created.\n   *\n   * @generated from field: google.protobuf.Timestamp created_at = 20;\n   */\n  createdAt?: Timestamp | undefined;\n\n  /**\n   * Last time in UTC when this key authenticated a request. Omitted when the\n   * key has not been used.\n   *\n   * @generated from field: google.protobuf.Timestamp last_used_at = 21;\n   */\n  lastUsedAt?: Timestamp | undefined;\n\n  /**\n   * Ed25519 public key bytes associated with this API key. The private key or\n   * seed is never returned by the API.\n   *\n   * @generated from field: bytes public_key_ed25519 = 22;\n   */\n  publicKeyEd25519: Uint8Array;\n\n  /**\n   * Optional expiry time in UTC. When set, the key cannot authenticate requests\n   * after this time, regardless of status.\n   *\n   * @generated from field: google.protobuf.Timestamp expires_at = 23;\n   */\n  expiresAt?: Timestamp | undefined;\n\n  /**\n   * Read-only actor label describing who created this key, such as a username\n   * or account label.\n   *\n   * @generated from field: string created_by_actor = 24;\n   */\n  createdByActor: string;\n\n  /**\n   * Time in UTC when this key's configuration was last changed. For the same\n   * key, later is fresher, equal is an idempotent replay, and earlier is stale.\n   * Equal timestamps with different configuration indicate an invariant failure.\n   * This is independent of last_used_at, which tracks authentication activity.\n   *\n   * @generated from field: google.protobuf.Timestamp updated_at = 25;\n   */\n  updatedAt?: Timestamp | undefined;\n\n  /**\n   * Monotonic resource revision used for conditional updates.\n   *\n   * @generated from field: uint64 revision = 26;\n   */\n  revision: bigint;\n};\n\n/**\n * Describes the message auth.v1.ApiKey.\n * Use `create(ApiKeySchema)` to create a new message.\n */\nexport const ApiKeySchema: GenMessage<ApiKey> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 0);\n\n/**\n * CreateApiKeyRequest creates a new API key. Clients generate the Ed25519 key\n * pair locally and submit only the public key.\n *\n * @generated from message auth.v1.CreateApiKeyRequest\n */\nexport type CreateApiKeyRequest = Message<\"auth.v1.CreateApiKeyRequest\"> & {\n  /**\n   * Human-readable label for the key. Required; 1 to 64 characters.\n   *\n   * @generated from field: string label = 1;\n   */\n  label: string;\n\n  /**\n   * Optional sub-account to scope this key to (opaque ID). If unset, the key is\n   * root-level.\n   *\n   * @generated from field: optional fixed64 subaccount_id = 3;\n   */\n  subaccountId?: bigint | undefined;\n\n  /**\n   * Optional user-chosen icon/emoji for UI display.\n   *\n   * @generated from field: string icon = 6;\n   */\n  icon: string;\n\n  /**\n   * Optional user-chosen color token for UI display.\n   *\n   * @generated from field: string color = 7;\n   */\n  color: string;\n\n  /**\n   * Optional CIDR whitelist. Empty means no IP restriction. Maximum 32 unique\n   * entries.\n   *\n   * @generated from field: repeated string ip_whitelist = 4;\n   */\n  ipWhitelist: string[];\n\n  /**\n   * Ed25519 public key bytes. Must be exactly 32 bytes. The private key or seed\n   * must never be sent to the API.\n   *\n   * @generated from field: bytes public_key_ed25519 = 5;\n   */\n  publicKeyEd25519: Uint8Array;\n};\n\n/**\n * Describes the message auth.v1.CreateApiKeyRequest.\n * Use `create(CreateApiKeyRequestSchema)` to create a new message.\n */\nexport const CreateApiKeyRequestSchema: GenMessage<CreateApiKeyRequest> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 1);\n\n/**\n * CreateApiKeyResponse returns the created API key metadata.\n *\n * @generated from message auth.v1.CreateApiKeyResponse\n */\nexport type CreateApiKeyResponse = Message<\"auth.v1.CreateApiKeyResponse\"> & {\n  /**\n   * Created API key metadata. The private key or seed is never returned.\n   *\n   * @generated from field: auth.v1.ApiKey api_key = 1;\n   */\n  apiKey?: ApiKey | undefined;\n};\n\n/**\n * Describes the message auth.v1.CreateApiKeyResponse.\n * Use `create(CreateApiKeyResponseSchema)` to create a new message.\n */\nexport const CreateApiKeyResponseSchema: GenMessage<CreateApiKeyResponse> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 2);\n\n/**\n * ListApiKeysRequest lists non-revoked API keys owned by the caller.\n *\n * @generated from message auth.v1.ListApiKeysRequest\n */\nexport type ListApiKeysRequest = Message<\"auth.v1.ListApiKeysRequest\"> & {\n  /**\n   * Optional filter: only keys scoped to this sub-account (opaque ID). If unset,\n   * all non-revoked keys owned by the caller are returned.\n   *\n   * @generated from field: optional fixed64 subaccount_id = 1;\n   */\n  subaccountId?: bigint | undefined;\n};\n\n/**\n * Describes the message auth.v1.ListApiKeysRequest.\n * Use `create(ListApiKeysRequestSchema)` to create a new message.\n */\nexport const ListApiKeysRequestSchema: GenMessage<ListApiKeysRequest> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 3);\n\n/**\n * ListApiKeysResponse contains matching API keys, newest first by creation time.\n *\n * @generated from message auth.v1.ListApiKeysResponse\n */\nexport type ListApiKeysResponse = Message<\"auth.v1.ListApiKeysResponse\"> & {\n  /**\n   * Matching API keys, newest first. Revoked keys are excluded.\n   *\n   * @generated from field: repeated auth.v1.ApiKey api_keys = 1;\n   */\n  apiKeys: ApiKey[];\n};\n\n/**\n * Describes the message auth.v1.ListApiKeysResponse.\n * Use `create(ListApiKeysResponseSchema)` to create a new message.\n */\nexport const ListApiKeysResponseSchema: GenMessage<ListApiKeysResponse> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 4);\n\n/**\n * DeleteApiKeyRequest permanently revokes an API key.\n *\n * @generated from message auth.v1.DeleteApiKeyRequest\n */\nexport type DeleteApiKeyRequest = Message<\"auth.v1.DeleteApiKeyRequest\"> & {\n  /**\n   * Opaque API key identifier (e.g. \"ak_<hex>\"). This is the stable public\n   * handle for a key.\n   *\n   * @generated from field: string key_id = 1;\n   */\n  keyId: string;\n};\n\n/**\n * Describes the message auth.v1.DeleteApiKeyRequest.\n * Use `create(DeleteApiKeyRequestSchema)` to create a new message.\n */\nexport const DeleteApiKeyRequestSchema: GenMessage<DeleteApiKeyRequest> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 5);\n\n/**\n * DeleteApiKeyResponse is empty when revocation succeeds.\n *\n * @generated from message auth.v1.DeleteApiKeyResponse\n */\nexport type DeleteApiKeyResponse = Message<\"auth.v1.DeleteApiKeyResponse\"> & {\n};\n\n/**\n * Describes the message auth.v1.DeleteApiKeyResponse.\n * Use `create(DeleteApiKeyResponseSchema)` to create a new message.\n */\nexport const DeleteApiKeyResponseSchema: GenMessage<DeleteApiKeyResponse> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 6);\n\n/**\n * GetApiKeyRequest returns a single API key owned by the caller's account.\n *\n * @generated from message auth.v1.GetApiKeyRequest\n */\nexport type GetApiKeyRequest = Message<\"auth.v1.GetApiKeyRequest\"> & {\n  /**\n   * Opaque API key identifier, formatted as \"ak_\" followed by 32 lowercase hex\n   * characters.\n   *\n   * @generated from field: string key_id = 1;\n   */\n  keyId: string;\n};\n\n/**\n * Describes the message auth.v1.GetApiKeyRequest.\n * Use `create(GetApiKeyRequestSchema)` to create a new message.\n */\nexport const GetApiKeyRequestSchema: GenMessage<GetApiKeyRequest> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 7);\n\n/**\n * GetApiKeyResponse returns one API key owned by the caller.\n *\n * @generated from message auth.v1.GetApiKeyResponse\n */\nexport type GetApiKeyResponse = Message<\"auth.v1.GetApiKeyResponse\"> & {\n  /**\n   * Matching API key metadata.\n   *\n   * @generated from field: auth.v1.ApiKey api_key = 1;\n   */\n  apiKey?: ApiKey | undefined;\n};\n\n/**\n * Describes the message auth.v1.GetApiKeyResponse.\n * Use `create(GetApiKeyResponseSchema)` to create a new message.\n */\nexport const GetApiKeyResponseSchema: GenMessage<GetApiKeyResponse> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 8);\n\n/**\n * ApiKeyUpdateSpec contains mutable API key configuration.\n *\n * @generated from message auth.v1.ApiKeyUpdateSpec\n */\nexport type ApiKeyUpdateSpec = Message<\"auth.v1.ApiKeyUpdateSpec\"> & {\n  /**\n   * Human-friendly label for the key. Empty clears the label when selected.\n   *\n   * @generated from field: string label = 1;\n   */\n  label: string;\n\n  /**\n   * User-chosen icon/emoji for UI display. Empty clears the icon when selected.\n   *\n   * @generated from field: string icon = 2;\n   */\n  icon: string;\n\n  /**\n   * User-chosen color token for UI display. Empty clears the color when selected.\n   *\n   * @generated from field: string color = 3;\n   */\n  color: string;\n\n  /**\n   * New status. ACTIVE and DISABLED are allowed; revocation uses DeleteApiKey.\n   *\n   * @generated from field: auth.v1.ApiKeyStatus status = 4;\n   */\n  status: ApiKeyStatus;\n\n  /**\n   * Complete replacement IP whitelist. Empty clears the restriction when selected.\n   *\n   * @generated from field: repeated string ip_whitelist = 5;\n   */\n  ipWhitelist: string[];\n\n  /**\n   * Expiry time in UTC. When selected, omission or the epoch clears expiry.\n   *\n   * @generated from field: google.protobuf.Timestamp expires_at = 6;\n   */\n  expiresAt?: Timestamp | undefined;\n};\n\n/**\n * Describes the message auth.v1.ApiKeyUpdateSpec.\n * Use `create(ApiKeyUpdateSpecSchema)` to create a new message.\n */\nexport const ApiKeyUpdateSpecSchema: GenMessage<ApiKeyUpdateSpec> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 9);\n\n/**\n * UpdateApiKeyRequest changes selected mutable fields on an existing API key.\n *\n * @generated from message auth.v1.UpdateApiKeyRequest\n */\nexport type UpdateApiKeyRequest = Message<\"auth.v1.UpdateApiKeyRequest\"> & {\n  /**\n   * Opaque API key identifier to update.\n   *\n   * @generated from field: string key_id = 1;\n   */\n  keyId: string;\n\n  /**\n   * Candidate values for fields selected by update_mask.\n   *\n   * @generated from field: auth.v1.ApiKeyUpdateSpec api_key = 2;\n   */\n  apiKey?: ApiKeyUpdateSpec | undefined;\n\n  /**\n   * Mutable fields to apply. Paths are relative to api_key. The mask is required,\n   * must be non-empty, and cannot contain \"*\".\n   *\n   * @generated from field: google.protobuf.FieldMask update_mask = 3;\n   */\n  updateMask?: FieldMask | undefined;\n\n  /**\n   * Revision returned by the latest successful read.\n   *\n   * @generated from field: uint64 expected_revision = 4;\n   */\n  expectedRevision: bigint;\n};\n\n/**\n * Describes the message auth.v1.UpdateApiKeyRequest.\n * Use `create(UpdateApiKeyRequestSchema)` to create a new message.\n */\nexport const UpdateApiKeyRequestSchema: GenMessage<UpdateApiKeyRequest> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 10);\n\n/**\n * UpdateApiKeyResponse returns the API key after applying the update.\n *\n * @generated from message auth.v1.UpdateApiKeyResponse\n */\nexport type UpdateApiKeyResponse = Message<\"auth.v1.UpdateApiKeyResponse\"> & {\n  /**\n   * Updated API key metadata.\n   *\n   * @generated from field: auth.v1.ApiKey api_key = 1;\n   */\n  apiKey?: ApiKey | undefined;\n};\n\n/**\n * Describes the message auth.v1.UpdateApiKeyResponse.\n * Use `create(UpdateApiKeyResponseSchema)` to create a new message.\n */\nexport const UpdateApiKeyResponseSchema: GenMessage<UpdateApiKeyResponse> = /*@__PURE__*/\n  messageDesc(file_auth_v1_api_keys, 11);\n\n/**\n * Status of an API key.\n *\n * @generated from enum auth.v1.ApiKeyStatus\n */\nexport enum ApiKeyStatus {\n  /**\n   * No API key status specified.\n   *\n   * @generated from enum value: API_KEY_STATUS_UNSPECIFIED = 0;\n   */\n  API_KEY_STATUS_UNSPECIFIED = 0,\n\n  /**\n   * Key can authenticate requests.\n   *\n   * @generated from enum value: ACTIVE = 1;\n   */\n  ACTIVE = 1,\n\n  /**\n   * Key has been permanently revoked and cannot be used again.\n   *\n   * @generated from enum value: REVOKED = 2;\n   */\n  REVOKED = 2,\n\n  /**\n   * Key is temporarily disabled and cannot authenticate requests until re-enabled.\n   *\n   * @generated from enum value: DISABLED = 3;\n   */\n  DISABLED = 3,\n}\n\n/**\n * Describes the enum auth.v1.ApiKeyStatus.\n */\nexport const ApiKeyStatusSchema: GenEnum<ApiKeyStatus> = /*@__PURE__*/\n  enumDesc(file_auth_v1_api_keys, 0);\n\n/**\n * ApiKeyService manages API keys for authenticated callers.\n *\n * @generated from service auth.v1.ApiKeyService\n */\nexport const ApiKeyService: GenService<{\n  /**\n   * Create a new API key for the caller. Account security settings may require\n   * MFA enrollment or a fresh step-up proof.\n   *\n   * @generated from rpc auth.v1.ApiKeyService.CreateApiKey\n   */\n  createApiKey: {\n    methodKind: \"unary\";\n    input: typeof CreateApiKeyRequestSchema;\n    output: typeof CreateApiKeyResponseSchema;\n  },\n  /**\n   * List non-revoked API keys owned by the caller, newest first.\n   *\n   * @generated from rpc auth.v1.ApiKeyService.ListApiKeys\n   */\n  listApiKeys: {\n    methodKind: \"unary\";\n    input: typeof ListApiKeysRequestSchema;\n    output: typeof ListApiKeysResponseSchema;\n  },\n  /**\n   * Get a single API key owned by the caller.\n   *\n   * @generated from rpc auth.v1.ApiKeyService.GetApiKey\n   */\n  getApiKey: {\n    methodKind: \"unary\";\n    input: typeof GetApiKeyRequestSchema;\n    output: typeof GetApiKeyResponseSchema;\n  },\n  /**\n   * Revoke an API key permanently.\n   *\n   * @generated from rpc auth.v1.ApiKeyService.DeleteApiKey\n   */\n  deleteApiKey: {\n    methodKind: \"unary\";\n    input: typeof DeleteApiKeyRequestSchema;\n    output: typeof DeleteApiKeyResponseSchema;\n  },\n  /**\n   * Update API key metadata and allowed status transitions. Revocation must use\n   * DeleteApiKey.\n   *\n   * @generated from rpc auth.v1.ApiKeyService.UpdateApiKey\n   */\n  updateApiKey: {\n    methodKind: \"unary\";\n    input: typeof UpdateApiKeyRequestSchema;\n    output: typeof UpdateApiKeyResponseSchema;\n  },\n}> = /*@__PURE__*/\n  serviceDesc(file_auth_v1_api_keys, 0);\n\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,MAAa,wBACX,uBAAS,4nFAA4nF;CAAC;CAAiC;CAAgC;AAA0B,CAAC;;;;;AAgIpuF,MAAa,eACX,0BAAY,uBAAuB,CAAC;;;;;AA2DtC,MAAa,4BACX,0BAAY,uBAAuB,CAAC;;;;;AAoBtC,MAAa,6BACX,0BAAY,uBAAuB,CAAC;;;;;AAqBtC,MAAa,2BACX,0BAAY,uBAAuB,CAAC;;;;;AAoBtC,MAAa,4BACX,0BAAY,uBAAuB,CAAC;;;;;AAqBtC,MAAa,4BACX,0BAAY,uBAAuB,CAAC;;;;;AActC,MAAa,6BACX,0BAAY,uBAAuB,CAAC;;;;;AAqBtC,MAAa,yBACX,0BAAY,uBAAuB,CAAC;;;;;AAoBtC,MAAa,0BACX,0BAAY,uBAAuB,CAAC;;;;;AAuDtC,MAAa,yBACX,0BAAY,uBAAuB,CAAC;;;;;AA0CtC,MAAa,4BACX,0BAAY,uBAAuB,EAAE;;;;;AAoBvC,MAAa,6BACX,0BAAY,uBAAuB,EAAE;;;;;;AAOvC,IAAY,eAAL,yBAAA,cAAA;;;;;;CAML,aAAA,aAAA,gCAAA,KAAA;;;;;;CAOA,aAAA,aAAA,YAAA,KAAA;;;;;;CAOA,aAAA,aAAA,aAAA,KAAA;;;;;;CAOA,aAAA,aAAA,cAAA,KAAA;;AACF,EAAA,CAAA,CAAA;;;;AAKA,MAAa,qBACX,uBAAS,uBAAuB,CAAC;;;;;;AAOnC,MAAa,gBAsDX,0BAAY,uBAAuB,CAAC"}