@typeship-ax/cli 0.6.0 → 0.9.1

package/dist/polling-login.d.ts

@@ -0,0 +1,57 @@
+export declare class LoginPollingError extends Error {
+    readonly code: "cancelled" | "expired" | "denied" | "invalid_response" | "request_failed";
+    constructor(code: "cancelled" | "expired" | "denied" | "invalid_response" | "request_failed");
+}
+export declare function loginEndpoint(value: string): URL;
+export interface DeviceLoginConfig {
+    clientId: string;
+    issuer?: string | null;
+    discoveryUrls: string[];
+    deviceUrl?: string | null;
+    tokenUrl?: string | null;
+    scopes: string[];
+    audience?: string;
+    resource?: string;
+}
+export interface DeviceLoginSession {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    tokenUrl: string;
+    issuer?: string;
+    clientId: string;
+    revocationUrl?: string;
+    scopes?: string[];
+}
+/** RFC 8628: pending and slow_down are the only responses that keep polling.
+ * All deadlines include response bodies; cancellation also interrupts waits. */
+export declare function oauthDeviceLogin(config: DeviceLoginConfig, interaction: {
+    authorize(value: {
+        verificationUri: string;
+        userCode: string;
+        expiresIn: number;
+    }): void;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}): Promise<DeviceLoginSession>;
+export interface ApprovedCredential {
+    api_key: string;
+    key_name: string;
+    org_id?: string;
+    revocationUrl: string;
+}
+/** This is the owner's custom approval contract, not an OAuth grant. A failed
+ * poll is not replayed: its one-use credential may already have been consumed. */
+export declare function customBrowserApproval(config: {
+    authUrl: string;
+    name: string;
+    source: "agent" | "cli";
+}, interaction: {
+    authorize(value: {
+        verificationUrl: string;
+        expiresIn: number;
+    }): void;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}): Promise<ApprovedCredential>;
+//# sourceMappingURL=polling-login.d.ts.map

package/dist/polling-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"polling-login.d.ts","sourceRoot":"","sources":["../src/polling-login.ts"],"names":[],"mappings":"AAGA,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,kBAAkB,GAAG,gBAAgB;gBAAhF,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,kBAAkB,GAAG,gBAAgB;CAItG;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAQhD;AAkCD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAC;IAClE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACxD;AACD,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC/D,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CAChG;AAED;gFACgF;AAChF,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE;IAC7E,SAAS,CAAC,KAAK,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzF,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC1C,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsD9B;AAED,MAAM,WAAW,kBAAkB;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE;AAEjH;kFACkF;AAClF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,KAAK,CAAA;CAAE,EAAE,WAAW,EAAE;IAC3H,SAAS,CAAC,KAAK,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC1C,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkC9B"}

package/dist/polling-login.js

@@ -0,0 +1,204 @@
+import { createHash, randomBytes } from "node:crypto";
+import { oauthJsonRequest, oauthDeviceRequest, OAuthResponseError } from "./oauth-request.js";
+export class LoginPollingError extends Error {
+    code;
+    constructor(code) {
+        super({ cancelled: "Login was cancelled.", expired: "Login expired. Run login again and approve the new request.", denied: "Login was denied. Run login again if you want to retry.", invalid_response: "The login service returned an invalid response. Check its configuration.", request_failed: "The login request failed. Check the service and start a new login." }[code]);
+        this.code = code;
+        this.name = "LoginPollingError";
+    }
+}
+export function loginEndpoint(value) {
+    try {
+        if (typeof value !== "string" || /[\x00-\x20\x7f]/.test(value))
+            throw new Error();
+        const url = new URL(value);
+        const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+        if ((url.protocol !== "https:" && !(url.protocol === "http:" && local)) || url.username || url.password || url.hash)
+            throw new Error();
+        return url;
+    }
+    catch {
+        throw new LoginPollingError("invalid_response");
+    }
+}
+function text(value, limit = 65_536) {
+    return typeof value === "string" && value.trim().length > 0 && value.length <= limit && !/[\x00-\x1f\x7f]/.test(value);
+}
+function seconds(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0 && Number.isSafeInteger(Math.ceil(value * 1000));
+}
+function interval(value, fallback) {
+    if (value === undefined)
+        return fallback * 1000;
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || !Number.isSafeInteger(Math.ceil(value * 1000)))
+        throw new LoginPollingError("invalid_response");
+    return Math.max(1, value) * 1000;
+}
+function lifetime(signal, timeoutMs, maximum) {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > maximum)
+        throw new LoginPollingError("invalid_response");
+    const controller = new AbortController();
+    let expired = false;
+    const cancel = () => controller.abort();
+    const timer = setTimeout(() => { expired = true; controller.abort(); }, timeoutMs);
+    signal?.addEventListener("abort", cancel, { once: true });
+    if (signal?.aborted)
+        cancel();
+    const check = () => { if (controller.signal.aborted)
+        throw new LoginPollingError(expired ? "expired" : "cancelled"); };
+    return { signal: controller.signal, check, close() { clearTimeout(timer); signal?.removeEventListener("abort", cancel); } };
+}
+async function pause(ms, signal) {
+    if (signal.aborted)
+        throw new LoginPollingError("cancelled");
+    await new Promise((resolve, reject) => {
+        const done = () => { clearTimeout(timer); signal.removeEventListener("abort", abort); resolve(); };
+        const abort = () => { clearTimeout(timer); signal.removeEventListener("abort", abort); reject(new LoginPollingError("cancelled")); };
+        const timer = setTimeout(done, Math.min(ms, 2_147_483_647));
+        signal.addEventListener("abort", abort, { once: true });
+    });
+}
+const form = (params, signal) => ({ method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" }, body: new URLSearchParams(params), signal });
+/** RFC 8628: pending and slow_down are the only responses that keep polling.
+ * All deadlines include response bodies; cancellation also interrupts waits. */
+export async function oauthDeviceLogin(config, interaction) {
+    const flow = lifetime(interaction.signal, interaction.timeoutMs ?? 900_000, 900_000);
+    try {
+        flow.check();
+        if (!text(config.clientId))
+            throw new LoginPollingError("invalid_response");
+        if (config.issuer && loginEndpoint(config.issuer).search)
+            throw new LoginPollingError("invalid_response");
+        let deviceUrl = config.deviceUrl ? loginEndpoint(config.deviceUrl).href : undefined;
+        let tokenUrl = config.tokenUrl ? loginEndpoint(config.tokenUrl).href : undefined;
+        let revocationUrl;
+        for (const url of config.discoveryUrls) {
+            if (deviceUrl && tokenUrl)
+                break;
+            const response = await oauthJsonRequest(loginEndpoint(url), { headers: { Accept: "application/json" }, signal: flow.signal }, 10_000);
+            if (response.status !== 200)
+                continue;
+            const data = response.data;
+            if (config.issuer && data.issuer !== config.issuer)
+                throw new LoginPollingError("invalid_response");
+            if (!deviceUrl && typeof data.device_authorization_endpoint === "string")
+                deviceUrl = loginEndpoint(data.device_authorization_endpoint).href;
+            if (!tokenUrl && typeof data.token_endpoint === "string")
+                tokenUrl = loginEndpoint(data.token_endpoint).href;
+            if (data.revocation_endpoint !== undefined)
+                revocationUrl = loginEndpoint(data.revocation_endpoint).href;
+        }
+        if (!deviceUrl || !tokenUrl)
+            throw new LoginPollingError("invalid_response");
+        const params = { ...(config.audience ? { audience: config.audience } : {}), ...(config.resource ? { resource: config.resource } : {}) };
+        const start = await oauthJsonRequest(deviceUrl, form({ client_id: config.clientId, ...(config.scopes.length ? { scope: config.scopes.join(" ") } : {}), ...params }, flow.signal));
+        const data = start.data;
+        if (start.status !== 200)
+            throw new LoginPollingError("request_failed");
+        if (!data || !text(data.device_code) || !text(data.user_code, 512) || !text(data.verification_uri, 8192) || !seconds(data.expires_in))
+            throw new LoginPollingError("invalid_response");
+        loginEndpoint(data.verification_uri);
+        const verificationUri = loginEndpoint((data.verification_uri_complete ?? data.verification_uri)).href;
+        let intervalMs = interval(data.interval, 5);
+        const expiresIn = Math.min(data.expires_in, 900), deadline = Date.now() + expiresIn * 1000;
+        interaction.authorize({ verificationUri, userCode: data.user_code, expiresIn });
+        while (true) {
+            await pause(Math.min(intervalMs, Math.max(0, deadline - Date.now())), flow.signal);
+            flow.check();
+            if (Date.now() >= deadline)
+                throw new LoginPollingError("expired");
+            let response;
+            try {
+                response = await oauthDeviceRequest(tokenUrl, form({ ...params, grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: data.device_code, client_id: config.clientId }, flow.signal), Math.min(30_000, deadline - Date.now()));
+            }
+            catch (error) {
+                flow.check();
+                if (error instanceof OAuthResponseError && error.code === "timed_out") {
+                    intervalMs *= 2;
+                    continue;
+                }
+                throw error;
+            }
+            flow.check();
+            if (Date.now() >= deadline)
+                throw new LoginPollingError("expired");
+            if (response.status === 400 && response.error === "authorization_pending")
+                continue;
+            if (response.status === 400 && response.error === "slow_down") {
+                intervalMs += 5000;
+                continue;
+            }
+            if (response.status === 400 && response.error === "access_denied")
+                throw new LoginPollingError("denied");
+            if (response.status === 400 && response.error === "expired_token")
+                throw new LoginPollingError("expired");
+            if (response.status !== 200)
+                throw new LoginPollingError("request_failed");
+            const token = response.data;
+            if (!text(token.access_token) || typeof token.token_type !== "string" || token.token_type.toLowerCase() !== "bearer" || token.error !== undefined || token.refresh_token !== undefined && !text(token.refresh_token) || token.expires_in !== undefined && !seconds(token.expires_in) || token.scope !== undefined && typeof token.scope !== "string")
+                throw new LoginPollingError("invalid_response");
+            return { accessToken: token.access_token, ...(typeof token.refresh_token === "string" ? { refreshToken: token.refresh_token } : {}), ...(typeof token.expires_in === "number" ? { expiresAt: Date.now() + token.expires_in * 1000 } : {}), clientId: config.clientId, tokenUrl, ...(config.issuer ? { issuer: config.issuer } : {}), ...(revocationUrl ? { revocationUrl } : {}), ...(typeof token.scope === "string" ? { scopes: token.scope.split(/\s+/).filter(Boolean) } : {}) };
+        }
+    }
+    catch (error) {
+        flow.check();
+        throw error;
+    }
+    finally {
+        flow.close();
+    }
+}
+/** This is the owner's custom approval contract, not an OAuth grant. A failed
+ * poll is not replayed: its one-use credential may already have been consumed. */
+export async function customBrowserApproval(config, interaction) {
+    const flow = lifetime(interaction.signal, interaction.timeoutMs ?? 600_000, 600_000);
+    try {
+        flow.check();
+        const base = loginEndpoint(config.authUrl);
+        if (base.search)
+            throw new LoginPollingError("invalid_response");
+        const url = base.href.replace(/\/$/, "");
+        const verifier = randomBytes(32).toString("base64url"), challenge = createHash("sha256").update(verifier).digest("base64url");
+        const post = (body) => ({ method: "POST", headers: { "Content-Type": "application/json", Accept: "application/json" }, body: JSON.stringify(body), signal: flow.signal });
+        const response = await oauthJsonRequest(url + "/start", post({ code_challenge: challenge, name: config.name, source: config.source }), 15_000);
+        if (response.status !== 200)
+            throw new LoginPollingError("request_failed");
+        const start = response.data;
+        if (!text(start.session) || !text(start.verification_url, 8192) || start.expires_in !== undefined && !seconds(start.expires_in))
+            throw new LoginPollingError("invalid_response");
+        const verificationUrl = loginEndpoint(start.verification_url).href;
+        const expiresIn = Math.min(typeof start.expires_in === "number" ? start.expires_in : 600, 600);
+        const intervalMs = interval(start.interval, 3), deadline = Date.now() + expiresIn * 1000;
+        interaction.authorize({ verificationUrl, expiresIn });
+        while (true) {
+            await pause(Math.min(intervalMs, Math.max(0, deadline - Date.now())), flow.signal);
+            flow.check();
+            if (Date.now() >= deadline)
+                throw new LoginPollingError("expired");
+            const result = await oauthJsonRequest(url + "/status", post({ session: start.session, code_verifier: verifier }), Math.min(15_000, deadline - Date.now()));
+            flow.check();
+            if (Date.now() >= deadline)
+                throw new LoginPollingError("expired");
+            if (result.status !== 200)
+                throw new LoginPollingError("request_failed");
+            const poll = result.data;
+            if (poll.status === "pending")
+                continue;
+            if (poll.status === "denied")
+                throw new LoginPollingError("denied");
+            if (poll.status === "expired")
+                throw new LoginPollingError("expired");
+            if (poll.status !== "complete" || !text(poll.api_key) || poll.key_name !== undefined && !text(poll.key_name, 1024) || poll.org_id !== undefined && !text(poll.org_id, 1024))
+                throw new LoginPollingError("invalid_response");
+            return { api_key: poll.api_key, key_name: typeof poll.key_name === "string" ? poll.key_name : config.name, ...(typeof poll.org_id === "string" ? { org_id: poll.org_id } : {}), revocationUrl: url + "/revoke" };
+        }
+    }
+    catch (error) {
+        flow.check();
+        throw error;
+    }
+    finally {
+        flow.close();
+    }
+}

package/dist/resources/account.d.ts

@@ -1,6 +1,6 @@
 import { HttpCore, type ApiResult, type RequestOptions } from "../core/http.js";
-import { TransportError, UnexpectedApiError, ValidationError, ForbiddenError, RateLimitedError, UnauthorizedError } from "../errors.js";
-import type { Account } from "../types.js";
+import { ResponseParseError, TransportError, UnexpectedApiError, ValidationError, ForbiddenError, RateLimitedError, UnauthorizedError } from "../errors.js";
+import type { AccountRead } from "../types.js";
 export declare class AccountResource {
     private readonly _core;
     constructor(_core: HttpCore);
@@ -11,8 +11,8 @@ export declare class AccountResource {
      * identity endpoint the generated typeship CLI's `whoami` calls.
      * `GET /me`
      */
-    retrieve(options?: RequestOptions): Promise<ApiResult<Account, AccountRetrieveError>>;
+    retrieve(options?: RequestOptions): Promise<ApiResult<AccountRead, AccountRetrieveError>>;
 }
 /** Every error `retrieve` can produce, as a discriminated union. */
-export type AccountRetrieveError = UnauthorizedError | ForbiddenError | RateLimitedError | UnexpectedApiError | TransportError | ValidationError;
+export type AccountRetrieveError = UnauthorizedError | ForbiddenError | RateLimitedError | UnexpectedApiError | ResponseParseError | TransportError | ValidationError;
 //# sourceMappingURL=account.d.ts.map

package/dist/resources/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/resources/account.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,QAAQ;IAC5C;;;;;;OAMG;IACG,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;CAU5F;AAED,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,cAAc,GACd,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC"}
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/resources/account.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,aAAa,CAAC;AAExD,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,QAAQ;IAC5C;;;;;;OAMG;IACG,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;CAWhG;AAED,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,cAAc,GACd,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC"}

package/dist/resources/account.js

@@ -17,6 +17,7 @@ export class AccountResource {
         return this._core.request({
             method: "GET",
             path: "/me",
+            security: [{ "apiKey": [] }],
             errors: { "401": UnauthorizedError, "403": ForbiddenError, "429": RateLimitedError },
             idempotent: true,
             schemaKey: "account.retrieve",

package/dist/resources/api-keys.d.ts

@@ -1,7 +1,7 @@
 import { HttpCore, type ApiResult, type RequestOptions } from "../core/http.js";
 import { PagePromise } from "../core/pagination.js";
-import { TransportError, UnexpectedApiError, ValidationError, BadRequestError, ForbiddenError, NotFoundError, RateLimitedError, UnauthorizedError } from "../errors.js";
-import type { ApiKey } from "../types.js";
+import { ResponseParseError, TransportError, UnexpectedApiError, ValidationError, BadRequestError, ForbiddenError, NotFoundError, RateLimitedError, UnauthorizedError } from "../errors.js";
+import type { ApiKeyRead, ApiKeyResponseRead } from "../types.js";
 export declare class ApiKeysResource {
     private readonly _core;
     constructor(_core: HttpCore);
@@ -14,24 +14,29 @@ export declare class ApiKeysResource {
      * Auto-paginates: `for await (const item of …)` walks every page.
      * `GET /api_keys`
      */
-    list(params?: ApiKeysListParams, options?: RequestOptions): PagePromise<ApiKey, ApiKeysListError>;
+    list(params?: ApiKeysListParams, options?: RequestOptions): PagePromise<ApiKeyRead, ApiKeysListError>;
     /**
      * Revoke an API key
      *
      * Idempotent: revoking an already-revoked key returns the same body, so a rotation script that
-     * re-runs does not have to special-case having already succeeded.
+     * re-runs does not have to special-case having already succeeded. An OAuth member may revoke a
+     * key they created; an organization admin may revoke any key. Organization API keys retain
+     * account-wide authority.
      * `DELETE /api_keys/{api_key_id}`
      */
-    revoke(apiKeyId: string, options?: RequestOptions): Promise<ApiResult<ApiKey, ApiKeysRevokeError>>;
+    revoke(apiKeyId: string, options?: RequestOptions): Promise<ApiResult<ApiKeyResponseRead, ApiKeysRevokeError>>;
 }
 export interface ApiKeysListParams {
     /** Maximum number of resources to return. */
     limit?: number;
-    /** Opaque cursor from the preceding page's next_cursor. */
+    /**
+     * Opaque cursor from the preceding page's next_cursor. Valid only for the same account,
+     * operation, filters, and ordering that issued it.
+     */
     cursor?: string;
 }
 /** Every error `list` can produce, as a discriminated union. */
-export type ApiKeysListError = BadRequestError | UnauthorizedError | ForbiddenError | RateLimitedError | UnexpectedApiError | TransportError | ValidationError;
+export type ApiKeysListError = BadRequestError | UnauthorizedError | ForbiddenError | RateLimitedError | UnexpectedApiError | ResponseParseError | TransportError | ValidationError;
 /** Every error `revoke` can produce, as a discriminated union. */
-export type ApiKeysRevokeError = UnauthorizedError | ForbiddenError | NotFoundError | RateLimitedError | UnexpectedApiError | TransportError | ValidationError;
+export type ApiKeysRevokeError = UnauthorizedError | ForbiddenError | NotFoundError | RateLimitedError | UnexpectedApiError | ResponseParseError | TransportError | ValidationError;
 //# sourceMappingURL=api-keys.d.ts.map

package/dist/resources/api-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/resources/api-keys.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAY,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,MAAM,EAAc,MAAM,aAAa,CAAC;AAEtD,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,QAAQ;IAC5C;;;;;;;;OAQG;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC;IA2BjG;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAezG;AAED,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gEAAgE;AAChE,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,iBAAiB,GACjB,cAAc,GACd,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC;AAEpB,kEAAkE;AAClE,MAAM,MAAM,kBAAkB,GAC1B,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC"}
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/resources/api-keys.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAY,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAIV,UAAU,EAEV,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAErB,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,QAAQ;IAC5C;;;;;;;;OAQG;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,WAAW,CAAC,UAAU,EAAE,gBAAgB,CAAC;IA4BrG;;;;;;;;OAQG;IACG,MAAM,CACV,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;CAgB9D;AAED,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gEAAgE;AAChE,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,iBAAiB,GACjB,cAAc,GACd,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC;AAEpB,kEAAkE;AAClE,MAAM,MAAM,kBAAkB,GAC1B,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC"}

package/dist/resources/api-keys.js

@@ -20,6 +20,7 @@ export class ApiKeysResource {
         return paginate(this._core, {
             method: "GET",
             path: "/api_keys",
+            security: [{ "apiKey": [] }],
             query: {
                 limit: params?.limit,
                 cursor: params?.cursor,
@@ -46,13 +47,16 @@ export class ApiKeysResource {
      * Revoke an API key
      *
      * Idempotent: revoking an already-revoked key returns the same body, so a rotation script that
-     * re-runs does not have to special-case having already succeeded.
+     * re-runs does not have to special-case having already succeeded. An OAuth member may revoke a
+     * key they created; an organization admin may revoke any key. Organization API keys retain
+     * account-wide authority.
      * `DELETE /api_keys/{api_key_id}`
      */
     async revoke(apiKeyId, options) {
         return this._core.request({
             method: "DELETE",
             path: `/api_keys/${encodeURIComponent(String(apiKeyId))}`,
+            security: [{ "apiKey": [] }],
             errors: {
                 "401": UnauthorizedError,
                 "403": ForbiddenError,

package/dist/resources/definition-revisions.d.ts

@@ -0,0 +1,58 @@
+import { HttpCore, type ApiResult, type RequestOptions } from "../core/http.js";
+import { PagePromise } from "../core/pagination.js";
+import { ResponseParseError, TransportError, UnexpectedApiError, ValidationError, BadRequestError, ForbiddenError, NotFoundError, RateLimitedError, UnauthorizedError } from "../errors.js";
+import type { DefinitionDocumentId, DefinitionId, DefinitionRevisionId, DefinitionRevisionRead, DefinitionRevisionResponseRead } from "../types.js";
+export declare class DefinitionRevisionsResource {
+    private readonly _core;
+    constructor(_core: HttpCore);
+    /**
+     * List Definition Revisions
+     *
+     * Immutable snapshots of the complete resolved document graph this Definition observed, newest
+     * first. Content is available from the revision and document endpoints and is never embedded in a
+     * list response.
+     *
+     * Auto-paginates: `for await (const item of …)` walks every page.
+     * `GET /definitions/{definition_id}/revisions`
+     */
+    list(definitionId: DefinitionId, params?: DefinitionRevisionsListParams, options?: RequestOptions): PagePromise<DefinitionRevisionRead, DefinitionRevisionsListError>;
+    /**
+     * Retrieve a Definition Revision
+     *
+     * Metadata for one immutable resolved document graph. Fetch its canonical content or individual
+     * source documents from the content endpoints.
+     * `GET /definition_revisions/{definition_revision_id}`
+     */
+    retrieve(definitionRevisionId: DefinitionRevisionId, options?: RequestOptions): Promise<ApiResult<DefinitionRevisionResponseRead, DefinitionRevisionsRetrieveError>>;
+    /**
+     * Retrieve a Definition Revision's canonical content
+     *
+     * Returns the exact canonical resolved content identified by the revision's graph digest,
+     * suitable for saving or piping into a diff.
+     * `GET /definition_revisions/{definition_revision_id}/content`
+     */
+    retrieveContent(definitionRevisionId: DefinitionRevisionId, options?: RequestOptions): Promise<ApiResult<string, DefinitionRevisionsRetrieveContentError>>;
+    /**
+     * Retrieve one source document from a Definition Revision
+     * `GET /definition_revisions/{definition_revision_id}/documents/{document_id}/content`
+     */
+    retrieveDocumentContent(definitionRevisionId: DefinitionRevisionId, documentId: DefinitionDocumentId, options?: RequestOptions): Promise<ApiResult<string, DefinitionRevisionsRetrieveDocumentContentError>>;
+}
+export interface DefinitionRevisionsListParams {
+    /** Maximum number of resources to return. */
+    limit?: number;
+    /**
+     * Opaque cursor from the preceding page's next_cursor. Valid only for the same account,
+     * operation, filters, and ordering that issued it.
+     */
+    cursor?: string;
+}
+/** Every error `list` can produce, as a discriminated union. */
+export type DefinitionRevisionsListError = BadRequestError | UnauthorizedError | ForbiddenError | NotFoundError | RateLimitedError | UnexpectedApiError | ResponseParseError | TransportError | ValidationError;
+/** Every error `retrieve` can produce, as a discriminated union. */
+export type DefinitionRevisionsRetrieveError = UnauthorizedError | ForbiddenError | NotFoundError | RateLimitedError | UnexpectedApiError | ResponseParseError | TransportError | ValidationError;
+/** Every error `retrieveContent` can produce, as a discriminated union. */
+export type DefinitionRevisionsRetrieveContentError = UnauthorizedError | ForbiddenError | NotFoundError | RateLimitedError | UnexpectedApiError | ResponseParseError | TransportError | ValidationError;
+/** Every error `retrieveDocumentContent` can produce, as a discriminated union. */
+export type DefinitionRevisionsRetrieveDocumentContentError = UnauthorizedError | ForbiddenError | NotFoundError | RateLimitedError | UnexpectedApiError | ResponseParseError | TransportError | ValidationError;
+//# sourceMappingURL=definition-revisions.d.ts.map

package/dist/resources/definition-revisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition-revisions.d.ts","sourceRoot":"","sources":["../../src/resources/definition-revisions.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAY,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EAEZ,oBAAoB,EAGpB,sBAAsB,EAEtB,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AAErB,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,QAAQ;IAC5C;;;;;;;;;OASG;IACH,IAAI,CACF,YAAY,EAAE,YAAY,EAC1B,MAAM,CAAC,EAAE,6BAA6B,EACtC,OAAO,CAAC,EAAE,cAAc,GACvB,WAAW,CAAC,sBAAsB,EAAE,4BAA4B,CAAC;IA6BpE;;;;;;OAMG;IACG,QAAQ,CACZ,oBAAoB,EAAE,oBAAoB,EAC1C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,SAAS,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC;IAiBvF;;;;;;OAMG;IACG,eAAe,CACnB,oBAAoB,EAAE,oBAAoB,EAC1C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC;IAiBtE;;;OAGG;IACG,uBAAuB,CAC3B,oBAAoB,EAAE,oBAAoB,EAC1C,UAAU,EAAE,oBAAoB,EAChC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAC;CAgB/E;AAED,MAAM,WAAW,6BAA6B;IAC5C,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gEAAgE;AAChE,MAAM,MAAM,4BAA4B,GACpC,eAAe,GACf,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC;AAEpB,oEAAoE;AACpE,MAAM,MAAM,gCAAgC,GACxC,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC;AAEpB,2EAA2E;AAC3E,MAAM,MAAM,uCAAuC,GAC/C,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC;AAEpB,mFAAmF;AACnF,MAAM,MAAM,+CAA+C,GACvD,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC"}

package/dist/resources/definition-revisions.js

@@ -0,0 +1,114 @@
+// typeship — definitionRevisions resource.
+// Generated by typeship — https://typeship.dev — do not edit by hand.
+import { paginate } from "../core/pagination.js";
+import { BadRequestError, ForbiddenError, NotFoundError, RateLimitedError, UnauthorizedError, } from "../errors.js";
+export class DefinitionRevisionsResource {
+    _core;
+    constructor(_core) {
+        this._core = _core;
+    }
+    /**
+     * List Definition Revisions
+     *
+     * Immutable snapshots of the complete resolved document graph this Definition observed, newest
+     * first. Content is available from the revision and document endpoints and is never embedded in a
+     * list response.
+     *
+     * Auto-paginates: `for await (const item of …)` walks every page.
+     * `GET /definitions/{definition_id}/revisions`
+     */
+    list(definitionId, params, options) {
+        return paginate(this._core, {
+            method: "GET",
+            path: `/definitions/${encodeURIComponent(String(definitionId))}/revisions`,
+            security: [{ "apiKey": [] }],
+            query: {
+                limit: params?.limit,
+                cursor: params?.cursor,
+            },
+            errors: {
+                "400": BadRequestError,
+                "401": UnauthorizedError,
+                "403": ForbiddenError,
+                "404": NotFoundError,
+                "429": RateLimitedError,
+            },
+            idempotent: true,
+            schemaKey: "definitionRevisions.list",
+            options,
+        }, {
+            style: "cursor",
+            itemsField: "data",
+            cursorParam: "cursor",
+            nextCursorField: "next_cursor",
+            hasMoreField: "has_more",
+            limitParam: "limit",
+        });
+    }
+    /**
+     * Retrieve a Definition Revision
+     *
+     * Metadata for one immutable resolved document graph. Fetch its canonical content or individual
+     * source documents from the content endpoints.
+     * `GET /definition_revisions/{definition_revision_id}`
+     */
+    async retrieve(definitionRevisionId, options) {
+        return this._core.request({
+            method: "GET",
+            path: `/definition_revisions/${encodeURIComponent(String(definitionRevisionId))}`,
+            security: [{ "apiKey": [] }],
+            errors: {
+                "401": UnauthorizedError,
+                "403": ForbiddenError,
+                "404": NotFoundError,
+                "429": RateLimitedError,
+            },
+            idempotent: true,
+            schemaKey: "definitionRevisions.retrieve",
+            options,
+        });
+    }
+    /**
+     * Retrieve a Definition Revision's canonical content
+     *
+     * Returns the exact canonical resolved content identified by the revision's graph digest,
+     * suitable for saving or piping into a diff.
+     * `GET /definition_revisions/{definition_revision_id}/content`
+     */
+    async retrieveContent(definitionRevisionId, options) {
+        return this._core.request({
+            method: "GET",
+            path: `/definition_revisions/${encodeURIComponent(String(definitionRevisionId))}/content`,
+            security: [{ "apiKey": [] }],
+            errors: {
+                "401": UnauthorizedError,
+                "403": ForbiddenError,
+                "404": NotFoundError,
+                "429": RateLimitedError,
+            },
+            idempotent: true,
+            schemaKey: "definitionRevisions.retrieveContent",
+            options,
+        });
+    }
+    /**
+     * Retrieve one source document from a Definition Revision
+     * `GET /definition_revisions/{definition_revision_id}/documents/{document_id}/content`
+     */
+    async retrieveDocumentContent(definitionRevisionId, documentId, options) {
+        return this._core.request({
+            method: "GET",
+            path: `/definition_revisions/${encodeURIComponent(String(definitionRevisionId))}/documents/${encodeURIComponent(String(documentId))}/content`,
+            security: [{ "apiKey": [] }],
+            errors: {
+                "401": UnauthorizedError,
+                "403": ForbiddenError,
+                "404": NotFoundError,
+                "429": RateLimitedError,
+            },
+            idempotent: true,
+            schemaKey: "definitionRevisions.retrieveDocumentContent",
+            options,
+        });
+    }
+}

package/dist/resources/definitions.d.ts

@@ -0,0 +1,35 @@
+import { HttpCore, type ApiResult, type RequestOptions } from "../core/http.js";
+import { ResponseParseError, TransportError, UnexpectedApiError, ValidationError, BadRequestError, ConflictError, ForbiddenError, NotFoundError, RateLimitedError, UnauthorizedError, UnprocessableEntityError } from "../errors.js";
+import type { DefinitionId, DefinitionRead, DefinitionUpdateRequest } from "../types.js";
+export declare class DefinitionsResource {
+    private readonly _core;
+    constructor(_core: HttpCore);
+    /**
+     * Retrieve a Definition
+     * `GET /definitions/{definition_id}`
+     */
+    retrieve(definitionId: DefinitionId, options?: RequestOptions): Promise<ApiResult<DefinitionRead, DefinitionsRetrieveError>>;
+    /**
+     * Update and resolve a Definition
+     *
+     * Resolves the complete document graph and records a new immutable revision before saving.
+     *
+     * A `Idempotency-Key` UUID is generated per call (stable across retries) unless you pass one.
+     * `PATCH /definitions/{definition_id}`
+     */
+    update(definitionId: DefinitionId, body: DefinitionUpdateRequest, params?: DefinitionsUpdateParams, options?: RequestOptions): Promise<ApiResult<DefinitionRead, DefinitionsUpdateError>>;
+}
+/** Every error `retrieve` can produce, as a discriminated union. */
+export type DefinitionsRetrieveError = UnauthorizedError | ForbiddenError | NotFoundError | RateLimitedError | UnexpectedApiError | ResponseParseError | TransportError | ValidationError;
+export interface DefinitionsUpdateParams {
+    /**
+     * Identifies one logical write for 24 hours. The key is scoped to the authenticated account and
+     * operation; account-less generation uses a hashed network identity. Retrying the same method,
+     * path, query, and JSON body replays the original response. Reusing the key with changed intent
+     * returns 409. After expiry the key starts a new write.
+     */
+    idempotencyKey?: string;
+}
+/** Every error `update` can produce, as a discriminated union. */
+export type DefinitionsUpdateError = BadRequestError | UnauthorizedError | ForbiddenError | NotFoundError | ConflictError | UnprocessableEntityError | RateLimitedError | UnexpectedApiError | ResponseParseError | TransportError | ValidationError;
+//# sourceMappingURL=definitions.d.ts.map

package/dist/resources/definitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/resources/definitions.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,aAAa,EACb,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAEV,YAAY,EACZ,cAAc,EACd,uBAAuB,EACxB,MAAM,aAAa,CAAC;AAErB,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,QAAQ;IAC5C;;;OAGG;IACG,QAAQ,CACZ,YAAY,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAiB/D;;;;;;;OAOG;IACG,MAAM,CACV,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,uBAAuB,EAC7B,MAAM,CAAC,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;CAuB9D;AAED,oEAAoE;AACpE,MAAM,MAAM,wBAAwB,GAChC,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC;AAEpB,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,kEAAkE;AAClE,MAAM,MAAM,sBAAsB,GAC9B,eAAe,GACf,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,aAAa,GACb,wBAAwB,GACxB,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,eAAe,CAAC"}