@spaceinvoices/js-sdk 13.16.0 → 13.16.1

package/dist/generated/entity-users/entity-users.d.cts

@@ -44,7 +44,7 @@ export type getEntityUsersResponse = (getEntityUsersResponseSuccess | getEntityU
 export declare const getGetEntityUsersUrl: (params?: GetEntityUsersParams) => string;
 export declare const getEntityUsers: (params?: GetEntityUsersParams, options?: RequestInit) => Promise<getEntityUsersResponse>;
 /**
- * Add an existing white-label user for this account to the entity or send an invitation. Existing account users must accept the invitation so they receive separate entity-user access. With `silent: true` no email is sent (`send_invite` is ignored): a missing white-label user is created immediately (no password, optional `metadata`) and linked to the entity, and an existing white-label user is linked. Silent provisioning requires an account API key or an account owner/admin user token. The new user's email counts as verified when the credential is an account API key or a user token whose email is verified; otherwise the user must verify their email before sending documents by email. Silent provisioning can be followed by `POST /entities/users/{user_id}/token` with `ttl` to embed the user.
+ * Add an existing white-label user for this account to the entity or send an invitation. Existing account users must accept the invitation so they receive separate entity-user access. With `silent: true` no email is sent (`send_invite` is ignored): a missing white-label user is created immediately (no password, optional `metadata`) and linked to the entity, and an existing white-label user is linked. Silent provisioning requires an account API key or an account owner/admin signed in directly (an interactive session); delegated (SSO) tokens are rejected. The new user's email counts as verified when the credential is an account API key or a user token whose email is verified; otherwise the user must verify their email before sending documents by email. Silent provisioning can be followed by `POST /entities/users/{user_id}/token` with `ttl` to embed the user.
  * @summary Add user to entity
  */
 export type addEntityUserResponse201 = {
@@ -204,7 +204,7 @@ export type removeEntityUserResponse = (removeEntityUserResponseSuccess | remove
 export declare const getRemoveEntityUserUrl: (userId: string) => string;
 export declare const removeEntityUser: (userId: string, options?: RequestInit) => Promise<removeEntityUserResponse>;
 /**
- * Generate a delegated SSO access token for a WL user to enable SSO-like redirect. Requires an account API key or a non-impersonated account owner/admin user token; entity API keys, entity-only roles, and account members are rejected. The token has the standard one-year session TTL but cannot authorize user-presence-sensitive operations such as account deletion, so callers must treat issuance as a privileged account-level operation. Pass `ttl` (300 to 86400 seconds) to receive a short-lived `delegated_embed` token for embedding the user's app instead; it cannot be extended. An embed session can call only the routes the embedded UI needs, and can never manage users, invitations, memberships or account settings, mint other credentials (tokens, API keys, impersonation), manage passkeys, two-factor or till operator PINs, or delete the account; a request to any other route is refused with 403.
+ * Generate a delegated SSO access token for a WL user to enable SSO-like redirect. Requires an account API key or a non-impersonated account owner/admin signed in directly (an interactive session); entity API keys, entity-only roles, account members, and delegated (SSO) tokens are rejected. The token has the standard one-year session TTL but cannot authorize user-presence-sensitive operations such as account deletion, so callers must treat issuance as a privileged account-level operation. Pass `ttl` (300 to 86400 seconds) to receive a short-lived `delegated_embed` token for embedding the user's app instead; it cannot be extended. An embed session can call only the routes the embedded UI needs, and can never manage users, invitations, memberships or account settings, mint other credentials (tokens, API keys, impersonation), manage passkeys, two-factor or till operator PINs, or delete the account; a request to any other route is refused with 403.
  * @summary Generate user access token
  */
 export type generateEntityUserTokenResponse200 = {

package/dist/generated/entity-users/entity-users.d.ts

@@ -44,7 +44,7 @@ export type getEntityUsersResponse = (getEntityUsersResponseSuccess | getEntityU
 export declare const getGetEntityUsersUrl: (params?: GetEntityUsersParams) => string;
 export declare const getEntityUsers: (params?: GetEntityUsersParams, options?: RequestInit) => Promise<getEntityUsersResponse>;
 /**
- * Add an existing white-label user for this account to the entity or send an invitation. Existing account users must accept the invitation so they receive separate entity-user access. With `silent: true` no email is sent (`send_invite` is ignored): a missing white-label user is created immediately (no password, optional `metadata`) and linked to the entity, and an existing white-label user is linked. Silent provisioning requires an account API key or an account owner/admin user token. The new user's email counts as verified when the credential is an account API key or a user token whose email is verified; otherwise the user must verify their email before sending documents by email. Silent provisioning can be followed by `POST /entities/users/{user_id}/token` with `ttl` to embed the user.
+ * Add an existing white-label user for this account to the entity or send an invitation. Existing account users must accept the invitation so they receive separate entity-user access. With `silent: true` no email is sent (`send_invite` is ignored): a missing white-label user is created immediately (no password, optional `metadata`) and linked to the entity, and an existing white-label user is linked. Silent provisioning requires an account API key or an account owner/admin signed in directly (an interactive session); delegated (SSO) tokens are rejected. The new user's email counts as verified when the credential is an account API key or a user token whose email is verified; otherwise the user must verify their email before sending documents by email. Silent provisioning can be followed by `POST /entities/users/{user_id}/token` with `ttl` to embed the user.
  * @summary Add user to entity
  */
 export type addEntityUserResponse201 = {
@@ -204,7 +204,7 @@ export type removeEntityUserResponse = (removeEntityUserResponseSuccess | remove
 export declare const getRemoveEntityUserUrl: (userId: string) => string;
 export declare const removeEntityUser: (userId: string, options?: RequestInit) => Promise<removeEntityUserResponse>;
 /**
- * Generate a delegated SSO access token for a WL user to enable SSO-like redirect. Requires an account API key or a non-impersonated account owner/admin user token; entity API keys, entity-only roles, and account members are rejected. The token has the standard one-year session TTL but cannot authorize user-presence-sensitive operations such as account deletion, so callers must treat issuance as a privileged account-level operation. Pass `ttl` (300 to 86400 seconds) to receive a short-lived `delegated_embed` token for embedding the user's app instead; it cannot be extended. An embed session can call only the routes the embedded UI needs, and can never manage users, invitations, memberships or account settings, mint other credentials (tokens, API keys, impersonation), manage passkeys, two-factor or till operator PINs, or delete the account; a request to any other route is refused with 403.
+ * Generate a delegated SSO access token for a WL user to enable SSO-like redirect. Requires an account API key or a non-impersonated account owner/admin signed in directly (an interactive session); entity API keys, entity-only roles, account members, and delegated (SSO) tokens are rejected. The token has the standard one-year session TTL but cannot authorize user-presence-sensitive operations such as account deletion, so callers must treat issuance as a privileged account-level operation. Pass `ttl` (300 to 86400 seconds) to receive a short-lived `delegated_embed` token for embedding the user's app instead; it cannot be extended. An embed session can call only the routes the embedded UI needs, and can never manage users, invitations, memberships or account settings, mint other credentials (tokens, API keys, impersonation), manage passkeys, two-factor or till operator PINs, or delete the account; a request to any other route is refused with 403.
  * @summary Generate user access token
  */
 export type generateEntityUserTokenResponse200 = {

package/dist/generated/model/addEntityUserBody.d.cts

@@ -15,7 +15,7 @@ export type AddEntityUserBody = {
     /** Whether to send an invitation email (only applies to new users). Defaults to true. Ignored when `silent` is true: no email is sent. */
     send_invite?: boolean;
     /**
-     * Provision the user without sending any email. A missing white-label user is created immediately, with no password, and linked to the entity; an existing white-label user is linked (its email verification is unchanged). The new user's email counts as verified when the credential is an account API key or a user with a verified email. Requires an account API key or an account owner/admin user token. Follow it with `POST /entities/users/{user_id}/token` and `ttl` to give the user an embedded session.
+     * Provision the user without sending any email. A missing white-label user is created immediately, with no password, and linked to the entity; an existing white-label user is linked (its email verification is unchanged). The new user's email counts as verified when the credential is an account API key or a user with a verified email. Requires an account API key or an account owner/admin signed in directly (an interactive session); delegated (SSO) tokens are rejected. Follow it with `POST /entities/users/{user_id}/token` and `ttl` to give the user an embedded session.
      * @nullable
      */
     silent?: boolean | null;

package/dist/generated/model/addEntityUserBody.d.ts

@@ -15,7 +15,7 @@ export type AddEntityUserBody = {
     /** Whether to send an invitation email (only applies to new users). Defaults to true. Ignored when `silent` is true: no email is sent. */
     send_invite?: boolean;
     /**
-     * Provision the user without sending any email. A missing white-label user is created immediately, with no password, and linked to the entity; an existing white-label user is linked (its email verification is unchanged). The new user's email counts as verified when the credential is an account API key or a user with a verified email. Requires an account API key or an account owner/admin user token. Follow it with `POST /entities/users/{user_id}/token` and `ttl` to give the user an embedded session.
+     * Provision the user without sending any email. A missing white-label user is created immediately, with no password, and linked to the entity; an existing white-label user is linked (its email verification is unchanged). The new user's email counts as verified when the credential is an account API key or a user with a verified email. Requires an account API key or an account owner/admin signed in directly (an interactive session); delegated (SSO) tokens are rejected. Follow it with `POST /entities/users/{user_id}/token` and `ttl` to give the user an embedded session.
      * @nullable
      */
     silent?: boolean | null;

package/dist/generated/ticket-ba-i/ticket-ba-i.d.cts

@@ -89,7 +89,7 @@ export type updateTicketBaiSettingsResponse = (updateTicketBaiSettingsResponseSu
 export declare const getUpdateTicketBaiSettingsUrl: () => string;
 export declare const updateTicketBaiSettings: (updateTicketBaiSettings: UpdateTicketBaiSettings, options?: RequestInit) => Promise<updateTicketBaiSettingsResponse>;
 /**
- * Requires an account API key or an account owner/admin session; entity-scoped keys cannot upload certificates. Upload a P12/PFX certificate and matching private key, at most 1 MiB. The private key is encrypted at rest. Uploading does not establish taxpayer representation or activate fiscalization.
+ * Requires an account API key or an account owner/admin signed in directly (delegated SSO tokens are rejected); entity-scoped keys cannot upload certificates. Upload a P12/PFX certificate and matching private key, at most 1 MiB. The private key is encrypted at rest. Uploading does not establish taxpayer representation or activate fiscalization.
  * @summary Upload TicketBAI signing and submission certificate
  */
 export type uploadTicketBaiCertificateResponse200 = {

package/dist/generated/ticket-ba-i/ticket-ba-i.d.ts

@@ -89,7 +89,7 @@ export type updateTicketBaiSettingsResponse = (updateTicketBaiSettingsResponseSu
 export declare const getUpdateTicketBaiSettingsUrl: () => string;
 export declare const updateTicketBaiSettings: (updateTicketBaiSettings: UpdateTicketBaiSettings, options?: RequestInit) => Promise<updateTicketBaiSettingsResponse>;
 /**
- * Requires an account API key or an account owner/admin session; entity-scoped keys cannot upload certificates. Upload a P12/PFX certificate and matching private key, at most 1 MiB. The private key is encrypted at rest. Uploading does not establish taxpayer representation or activate fiscalization.
+ * Requires an account API key or an account owner/admin signed in directly (delegated SSO tokens are rejected); entity-scoped keys cannot upload certificates. Upload a P12/PFX certificate and matching private key, at most 1 MiB. The private key is encrypted at rest. Uploading does not establish taxpayer representation or activate fiscalization.
  * @summary Upload TicketBAI signing and submission certificate
  */
 export type uploadTicketBaiCertificateResponse200 = {

package/dist/generated-zod/entity-users/entity-users.d.cts

@@ -34,7 +34,7 @@ export declare const GetEntityUsersResponse: zod.ZodObject<{
     }, zod.z.core.$strip>>;
 }, zod.z.core.$strip>;
 /**
- * Add an existing white-label user for this account to the entity or send an invitation. Existing account users must accept the invitation so they receive separate entity-user access. With `silent: true` no email is sent (`send_invite` is ignored): a missing white-label user is created immediately (no password, optional `metadata`) and linked to the entity, and an existing white-label user is linked. Silent provisioning requires an account API key or an account owner/admin user token. The new user's email counts as verified when the credential is an account API key or a user token whose email is verified; otherwise the user must verify their email before sending documents by email. Silent provisioning can be followed by `POST /entities/users/{user_id}/token` with `ttl` to embed the user.
+ * Add an existing white-label user for this account to the entity or send an invitation. Existing account users must accept the invitation so they receive separate entity-user access. With `silent: true` no email is sent (`send_invite` is ignored): a missing white-label user is created immediately (no password, optional `metadata`) and linked to the entity, and an existing white-label user is linked. Silent provisioning requires an account API key or an account owner/admin signed in directly (an interactive session); delegated (SSO) tokens are rejected. The new user's email counts as verified when the credential is an account API key or a user token whose email is verified; otherwise the user must verify their email before sending documents by email. Silent provisioning can be followed by `POST /entities/users/{user_id}/token` with `ttl` to embed the user.
  * @summary Add user to entity
  */
 export declare const AddEntityUserHeader: zod.ZodObject<{
@@ -127,7 +127,7 @@ export declare const RemoveEntityUserResponse: zod.ZodObject<{
     message: zod.ZodString;
 }, zod.z.core.$strip>;
 /**
- * Generate a delegated SSO access token for a WL user to enable SSO-like redirect. Requires an account API key or a non-impersonated account owner/admin user token; entity API keys, entity-only roles, and account members are rejected. The token has the standard one-year session TTL but cannot authorize user-presence-sensitive operations such as account deletion, so callers must treat issuance as a privileged account-level operation. Pass `ttl` (300 to 86400 seconds) to receive a short-lived `delegated_embed` token for embedding the user's app instead; it cannot be extended. An embed session can call only the routes the embedded UI needs, and can never manage users, invitations, memberships or account settings, mint other credentials (tokens, API keys, impersonation), manage passkeys, two-factor or till operator PINs, or delete the account; a request to any other route is refused with 403.
+ * Generate a delegated SSO access token for a WL user to enable SSO-like redirect. Requires an account API key or a non-impersonated account owner/admin signed in directly (an interactive session); entity API keys, entity-only roles, account members, and delegated (SSO) tokens are rejected. The token has the standard one-year session TTL but cannot authorize user-presence-sensitive operations such as account deletion, so callers must treat issuance as a privileged account-level operation. Pass `ttl` (300 to 86400 seconds) to receive a short-lived `delegated_embed` token for embedding the user's app instead; it cannot be extended. An embed session can call only the routes the embedded UI needs, and can never manage users, invitations, memberships or account settings, mint other credentials (tokens, API keys, impersonation), manage passkeys, two-factor or till operator PINs, or delete the account; a request to any other route is refused with 403.
  * @summary Generate user access token
  */
 export declare const generateEntityUserTokenPathUserIdRegExp: RegExp;

package/dist/generated-zod/entity-users/entity-users.d.ts

@@ -34,7 +34,7 @@ export declare const GetEntityUsersResponse: zod.ZodObject<{
     }, zod.z.core.$strip>>;
 }, zod.z.core.$strip>;
 /**
- * Add an existing white-label user for this account to the entity or send an invitation. Existing account users must accept the invitation so they receive separate entity-user access. With `silent: true` no email is sent (`send_invite` is ignored): a missing white-label user is created immediately (no password, optional `metadata`) and linked to the entity, and an existing white-label user is linked. Silent provisioning requires an account API key or an account owner/admin user token. The new user's email counts as verified when the credential is an account API key or a user token whose email is verified; otherwise the user must verify their email before sending documents by email. Silent provisioning can be followed by `POST /entities/users/{user_id}/token` with `ttl` to embed the user.
+ * Add an existing white-label user for this account to the entity or send an invitation. Existing account users must accept the invitation so they receive separate entity-user access. With `silent: true` no email is sent (`send_invite` is ignored): a missing white-label user is created immediately (no password, optional `metadata`) and linked to the entity, and an existing white-label user is linked. Silent provisioning requires an account API key or an account owner/admin signed in directly (an interactive session); delegated (SSO) tokens are rejected. The new user's email counts as verified when the credential is an account API key or a user token whose email is verified; otherwise the user must verify their email before sending documents by email. Silent provisioning can be followed by `POST /entities/users/{user_id}/token` with `ttl` to embed the user.
  * @summary Add user to entity
  */
 export declare const AddEntityUserHeader: zod.ZodObject<{
@@ -127,7 +127,7 @@ export declare const RemoveEntityUserResponse: zod.ZodObject<{
     message: zod.ZodString;
 }, zod.z.core.$strip>;
 /**
- * Generate a delegated SSO access token for a WL user to enable SSO-like redirect. Requires an account API key or a non-impersonated account owner/admin user token; entity API keys, entity-only roles, and account members are rejected. The token has the standard one-year session TTL but cannot authorize user-presence-sensitive operations such as account deletion, so callers must treat issuance as a privileged account-level operation. Pass `ttl` (300 to 86400 seconds) to receive a short-lived `delegated_embed` token for embedding the user's app instead; it cannot be extended. An embed session can call only the routes the embedded UI needs, and can never manage users, invitations, memberships or account settings, mint other credentials (tokens, API keys, impersonation), manage passkeys, two-factor or till operator PINs, or delete the account; a request to any other route is refused with 403.
+ * Generate a delegated SSO access token for a WL user to enable SSO-like redirect. Requires an account API key or a non-impersonated account owner/admin signed in directly (an interactive session); entity API keys, entity-only roles, account members, and delegated (SSO) tokens are rejected. The token has the standard one-year session TTL but cannot authorize user-presence-sensitive operations such as account deletion, so callers must treat issuance as a privileged account-level operation. Pass `ttl` (300 to 86400 seconds) to receive a short-lived `delegated_embed` token for embedding the user's app instead; it cannot be extended. An embed session can call only the routes the embedded UI needs, and can never manage users, invitations, memberships or account settings, mint other credentials (tokens, API keys, impersonation), manage passkeys, two-factor or till operator PINs, or delete the account; a request to any other route is refused with 403.
  * @summary Generate user access token
  */
 export declare const generateEntityUserTokenPathUserIdRegExp: RegExp;

package/dist/generated-zod/ticket-ba-i/ticket-ba-i.d.cts

@@ -105,7 +105,7 @@ export declare const UpdateTicketBaiSettingsResponse: zod.ZodObject<{
     has_issued_records: zod.ZodBoolean;
 }, zod.z.core.$strip>;
 /**
- * Requires an account API key or an account owner/admin session; entity-scoped keys cannot upload certificates. Upload a P12/PFX certificate and matching private key, at most 1 MiB. The private key is encrypted at rest. Uploading does not establish taxpayer representation or activate fiscalization.
+ * Requires an account API key or an account owner/admin signed in directly (delegated SSO tokens are rejected); entity-scoped keys cannot upload certificates. Upload a P12/PFX certificate and matching private key, at most 1 MiB. The private key is encrypted at rest. Uploading does not establish taxpayer representation or activate fiscalization.
  * @summary Upload TicketBAI signing and submission certificate
  */
 export declare const UploadTicketBaiCertificateHeader: zod.ZodObject<{

package/dist/generated-zod/ticket-ba-i/ticket-ba-i.d.ts

@@ -105,7 +105,7 @@ export declare const UpdateTicketBaiSettingsResponse: zod.ZodObject<{
     has_issued_records: zod.ZodBoolean;
 }, zod.z.core.$strip>;
 /**
- * Requires an account API key or an account owner/admin session; entity-scoped keys cannot upload certificates. Upload a P12/PFX certificate and matching private key, at most 1 MiB. The private key is encrypted at rest. Uploading does not establish taxpayer representation or activate fiscalization.
+ * Requires an account API key or an account owner/admin signed in directly (delegated SSO tokens are rejected); entity-scoped keys cannot upload certificates. Upload a P12/PFX certificate and matching private key, at most 1 MiB. The private key is encrypted at rest. Uploading does not establish taxpayer representation or activate fiscalization.
  * @summary Upload TicketBAI signing and submission certificate
  */
 export declare const UploadTicketBaiCertificateHeader: zod.ZodObject<{