@whooshbang/sdk 6.0.0 → 7.1.0

package/dist/browser-confirmation.d.ts

@@ -1,5 +1,14 @@
-/** Browser-safe result encryption. No dashboard authority or readable credential
- * is persisted by the handoff: only the invoking CLI holds the private key. */
+/**
+ * One credential operation a signed-in person approves in the dashboard.
+ *
+ * Two handoffs share the page. The CLI's carries a public key and a loopback
+ * callback, and the result goes back to the CLI encrypted, so no dashboard
+ * authority or readable credential is persisted. An agent's (`reveal`) carries
+ * neither: the person sees the secret once on the page and copies it, and the
+ * agent only ever reads the result's metadata (FXO-3726). An agent may also
+ * hand off creating or rotating a webhook endpoint, whose signing secret is
+ * revealed the same way.
+ */
 export interface CredentialConfirmation {
     apiOrigin: string;
     organizationId: string;
@@ -11,7 +20,31 @@ export interface CredentialConfirmation {
     state: string;
     expiresAt: number;
 }
+/** An agent's handoff: the person approves it and sees any secret on the page. */
+export interface RevealCredentialConfirmation {
+    apiOrigin: string;
+    organizationId: string;
+    method: "POST";
+    path: string;
+    body?: unknown;
+    reveal: true;
+    state: string;
+    expiresAt: number;
+}
+/** How long an agent's link stays usable: long enough for a person to open it. */
+export declare const REVEAL_CONFIRMATION_LIFETIME_MS: number;
+/**
+ * A reveal link is stamped by the server and checked by the person's browser,
+ * whose clock may run behind. Allow two minutes so a slow clock does not refuse
+ * a fresh link. CLI links are stamped and checked on one computer.
+ */
+export declare const REVEAL_CLOCK_SKEW_MS: number;
+/** The CLI handoff: credential operations only, answered to the CLI encrypted. */
 export declare function parseCredentialConfirmation(value: string): CredentialConfirmation;
+/** An agent's handoff (FXO-3726): revealed on the page, never sent anywhere. */
+export declare function parseRevealConfirmation(value: string): RevealCredentialConfirmation;
+/** Either handoff, whichever this one is. */
+export declare function parseAnyCredentialConfirmation(value: string): CredentialConfirmation | RevealCredentialConfirmation;
 export declare function encryptCredentialResult(publicKey: JsonWebKey, state: string, result: unknown): Promise<string>;
 export declare function decryptCredentialResult(privateKey: CryptoKey, state: string, encrypted: string): Promise<unknown>;
 export declare function credentialConfirmationDigest(request: CredentialConfirmation): Promise<string>;

package/dist/browser-confirmation.js

@@ -1,4 +1,14 @@
-import { validateProblem, validateCreateOrganizationCredentialRequest, validateCreateApiCredentialRequest, validateRotateOrganizationCredentialRequest, validateRotateApiCredentialRequest, validateOrganizationCredentialCollection, validateApiCredentialCollection, validateOrganizationCredentialSecretReveal, validateApiCredentialSecretReveal, validateOrganizationCredentialRotation, validateApiCredentialRotation, validateOrganizationCredential, validateApiCredential, } from "@whooshbang/contracts";
+import { validateProblem, validateCreateOrganizationCredentialRequest, validateCreateApiCredentialRequest, validateRotateOrganizationCredentialRequest, validateRotateApiCredentialRequest, validateOrganizationCredentialCollection, validateApiCredentialCollection, validateOrganizationCredentialSecretReveal, validateApiCredentialSecretReveal, validateOrganizationCredentialRotation, validateApiCredentialRotation, validateOrganizationCredential, validateApiCredential, validateCreateCustomerEndpointRequest, validateRotateCustomerEndpointRequest, } from "@whooshbang/contracts";
+/** How long an agent's link stays usable: long enough for a person to open it. */
+export const REVEAL_CONFIRMATION_LIFETIME_MS = 15 * 60_000;
+/**
+ * A reveal link is stamped by the server and checked by the person's browser,
+ * whose clock may run behind. Allow two minutes so a slow clock does not refuse
+ * a fresh link. CLI links are stamped and checked on one computer.
+ */
+export const REVEAL_CLOCK_SKEW_MS = 2 * 60_000;
+const CREDENTIAL_PATH = /^\/v1\/(?:organization|projects\/[A-Za-z0-9_-]+\/environments\/[A-Za-z0-9_-]+)\/credentials(?:\/[A-Za-z0-9_-]+\/(?:rotate|revoke))?$/u;
+const ENDPOINT_PATH = /^\/v1\/projects\/[A-Za-z0-9_-]+\/environments\/[A-Za-z0-9_-]+\/customer-endpoints(?:\/[A-Za-z0-9_-]+\/rotate)?$/u;
 function encoded(bytes) {
     return btoa(Array.from(new Uint8Array(bytes), (byte) => String.fromCharCode(byte)).join(""))
         .replaceAll("+", "-")
@@ -8,9 +18,28 @@ function encoded(bytes) {
 function decoded(value) {
     return Uint8Array.from(atob(value.replaceAll("-", "+").replaceAll("_", "/")), (c) => c.charCodeAt(0));
 }
+/** The CLI handoff: credential operations only, answered to the CLI encrypted. */
 export function parseCredentialConfirmation(value) {
     const parsed = JSON.parse(value);
-    const callback = new URL(parsed.redirectUri);
+    if (parsed.reveal !== undefined)
+        throw new Error("Invalid or expired credential confirmation.");
+    return checkedConfirmation(parsed);
+}
+/** An agent's handoff (FXO-3726): revealed on the page, never sent anywhere. */
+export function parseRevealConfirmation(value) {
+    const parsed = JSON.parse(value);
+    if (parsed.reveal !== true)
+        throw new Error("Invalid or expired credential confirmation.");
+    return checkedConfirmation(parsed);
+}
+/** Either handoff, whichever this one is. */
+export function parseAnyCredentialConfirmation(value) {
+    return JSON.parse(value).reveal === true
+        ? parseRevealConfirmation(value)
+        : parseCredentialConfirmation(value);
+}
+function checkedConfirmation(raw) {
+    const parsed = raw;
     const api = new URL(parsed.apiOrigin);
     if (api.origin !== parsed.apiOrigin ||
         api.username ||
@@ -19,43 +48,68 @@ export function parseCredentialConfirmation(value) {
             !(api.protocol === "http:" &&
                 ["127.0.0.1", "localhost"].includes(api.hostname))))
         throw new Error("Invalid API origin.");
-    if (callback.protocol !== "http:" ||
-        callback.hostname !== "127.0.0.1" ||
-        !callback.port ||
-        callback.pathname !== "/callback" ||
-        callback.username ||
-        callback.password ||
-        callback.search ||
-        callback.hash ||
-        !/^[A-Za-z0-9_-]{32,128}$/u.test(parsed.state) ||
+    const reveal = parsed.reveal === true;
+    const lifetime = reveal
+        ? REVEAL_CONFIRMATION_LIFETIME_MS + REVEAL_CLOCK_SKEW_MS
+        : 300_000;
+    if (!/^[A-Za-z0-9_-]{32,128}$/u.test(parsed.state) ||
         !Number.isFinite(parsed.expiresAt) ||
         parsed.expiresAt <= Date.now() ||
-        parsed.expiresAt > Date.now() + 300_000 ||
+        parsed.expiresAt > Date.now() + lifetime ||
         typeof parsed.organizationId !== "string" ||
         parsed.organizationId.length > 100 ||
-        !["GET", "POST"].includes(parsed.method) ||
-        !/^\/v1\/(?:organization|projects\/[A-Za-z0-9_-]+\/environments\/[A-Za-z0-9_-]+)\/credentials(?:\/[A-Za-z0-9_-]+\/(?:rotate|revoke))?$/u.test(parsed.path) ||
+        !["GET", "POST"].includes(parsed.method))
+        throw new Error("Invalid or expired credential confirmation.");
+    if (reveal) {
+        // Nothing leaves the page: no key to encrypt to, no callback to call.
+        if (parsed.publicKey !== undefined || parsed.redirectUri !== undefined)
+            throw new Error("Invalid or expired credential confirmation.");
+    }
+    else {
+        const callback = new URL(parsed.redirectUri ?? "");
+        const key = parsed.publicKey;
+        if (parsed.reveal !== undefined ||
+            callback.protocol !== "http:" ||
+            callback.hostname !== "127.0.0.1" ||
+            !callback.port ||
+            callback.pathname !== "/callback" ||
+            callback.username ||
+            callback.password ||
+            callback.search ||
+            callback.hash ||
+            !key ||
+            key.kty !== "RSA" ||
+            key.e !== "AQAB" ||
+            typeof key.n !== "string" ||
+            key.n.length !== 342 ||
+            key.d !== undefined)
+            throw new Error("Invalid or expired credential confirmation.");
+    }
+    const credential = CREDENTIAL_PATH.test(parsed.path);
+    const endpoint = reveal && ENDPOINT_PATH.test(parsed.path);
+    if ((!credential && !endpoint) ||
         (parsed.method === "GET" &&
-            (parsed.path.endsWith("/rotate") ||
+            (endpoint ||
+                parsed.path.endsWith("/rotate") ||
                 parsed.path.endsWith("/revoke") ||
                 parsed.body !== undefined)) ||
-        parsed.publicKey.kty !== "RSA" ||
-        parsed.publicKey.e !== "AQAB" ||
-        typeof parsed.publicKey.n !== "string" ||
-        parsed.publicKey.n.length !== 342 ||
-        parsed.publicKey.d !== undefined) {
+        // An agent hands off a change; reading the inventory is its own tool.
+        (reveal && parsed.method === "GET"))
         throw new Error("Invalid or expired credential confirmation.");
-    }
     const organization = parsed.path.startsWith("/v1/organization/");
-    const validBody = parsed.method === "GET" || parsed.path.endsWith("/revoke")
-        ? parsed.body === undefined
-        : parsed.path.endsWith("/rotate")
-            ? organization
-                ? validateRotateOrganizationCredentialRequest(parsed.body)
-                : validateRotateApiCredentialRequest(parsed.body)
-            : organization
-                ? validateCreateOrganizationCredentialRequest(parsed.body)
-                : validateCreateApiCredentialRequest(parsed.body);
+    const validBody = endpoint
+        ? parsed.path.endsWith("/rotate")
+            ? validateRotateCustomerEndpointRequest(parsed.body ?? {})
+            : validateCreateCustomerEndpointRequest(parsed.body)
+        : parsed.method === "GET" || parsed.path.endsWith("/revoke")
+            ? parsed.body === undefined
+            : parsed.path.endsWith("/rotate")
+                ? organization
+                    ? validateRotateOrganizationCredentialRequest(parsed.body)
+                    : validateRotateApiCredentialRequest(parsed.body)
+                : organization
+                    ? validateCreateOrganizationCredentialRequest(parsed.body)
+                    : validateCreateApiCredentialRequest(parsed.body);
     if (!validBody ||
         Object.keys(parsed).some((key) => ![
             "apiOrigin",
@@ -65,6 +119,7 @@ export function parseCredentialConfirmation(value) {
             "body",
             "publicKey",
             "redirectUri",
+            "reveal",
             "state",
             "expiresAt",
         ].includes(key)))

package/dist/browser-confirmation.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser-confirmation.js","sourceRoot":"","sources":["../src/browser-confirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,2CAA2C,EAC3C,kCAAkC,EAClC,2CAA2C,EAC3C,kCAAkC,EAClC,wCAAwC,EACxC,+BAA+B,EAC/B,0CAA0C,EAC1C,iCAAiC,EACjC,sCAAsC,EACtC,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAgB/B,SAAS,OAAO,CAAC,KAAkB;IACjC,OAAO,IAAI,CACT,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CACF;SACE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AACD,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,UAAU,CAAC,IAAI,CACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAa;IAEb,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAA2B,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtC,IACE,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,SAAS;QAC/B,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CACC,GAAG,CAAC,QAAQ,KAAK,OAAO;gBACxB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClD,CAAC;QAEJ,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,IACE,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAC7B,QAAQ,CAAC,QAAQ,KAAK,WAAW;QACjC,CAAC,QAAQ,CAAC,IAAI;QACd,QAAQ,CAAC,QAAQ,KAAK,WAAW;QACjC,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,MAAM;QACf,QAAQ,CAAC,IAAI;QACb,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9C,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAC9B,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;QACvC,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;QACzC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,GAAG;QAClC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QACxC,CAAC,uIAAuI,CAAC,IAAI,CAC3I,MAAM,CAAC,IAAI,CACZ;QACD,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK;YACtB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC/B,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QAC/B,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,KAAK;QAC9B,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,MAAM;QAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,QAAQ;QACtC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG;QACjC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACjE,MAAM,SAAS,GACb,MAAM,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxD,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;QAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC/B,CAAC,CAAC,YAAY;gBACZ,CAAC,CAAC,2CAA2C,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC1D,CAAC,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC;YACnD,CAAC,CAAC,YAAY;gBACZ,CAAC,CAAC,2CAA2C,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC1D,CAAC,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,IACE,CAAC,SAAS;QACV,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,CAAC,GAAG,EAAE,EAAE,CACN,CAAC;YACC,WAAW;YACX,gBAAgB;YAChB,QAAQ;YACR,MAAM;YACN,MAAM;YACN,WAAW;YACX,aAAa;YACb,OAAO;YACP,WAAW;SACZ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClB;QAED,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqB,EACrB,KAAa,EACb,MAAe;IAEf,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,SAAS,EACT,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EACrC,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CACzC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACxE,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CACjD,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzC,UAAU,EACV,GAAG,EACH,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAC1C,CAAC;IACF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAqB,EACrB,KAAa,EACb,SAAiB;IAEjB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;IACxC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,OAAO;QACR,CAAC,EAAE;QACH,CAAC,UAAU;QACX,SAAS,CAAC,MAAM,GAAG,MAAM;QAEzB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC,UAAU,EACV,UAAU,EACV,OAAO,CAAC,OAAO,CAAC,CACjB,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;QACzE,SAAS;KACV,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,KAAK,CACf,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;QACf,cAAc,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;KAChD,EACD,GAAG,EACH,OAAO,CAAC,UAAU,CAAC,CACpB,CACF,CACS,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAA+B;IAE/B,OAAO,OAAO,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxB,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,cAAc;QACtB,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,IAAI,IAAI,IAAI;QACpB,OAAO,CAAC,SAAS,CAAC,CAAC;QACnB,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,KAAK;QACb,OAAO,CAAC,SAAS;KAClB,CAAC,CACH,CACF,CACF,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,8BAA8B,CAC5C,OAA+B,EAC/B,KAAgC;IAEhC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC;IACvD,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;QACrB,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;IAC3E,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAC1B,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,CAAC,YAAY;gBACX,CAAC,CAAC,wCAAwC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACtD,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CACjD,CAAC;IACJ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClC,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,CAAC,YAAY;gBACX,CAAC,CAAC,8BAA8B,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC5C,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CACvC,CAAC;IACJ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClC,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,CAAC,YAAY;gBACX,CAAC,CAAC,sCAAsC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACpD,CAAC,CAAC,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAC/C,CAAC;IACJ,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,YAAY;YACX,CAAC,CAAC,0CAA0C,CAAC,KAAK,CAAC,IAAI,CAAC;YACxD,CAAC,CAAC,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CACnD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"browser-confirmation.js","sourceRoot":"","sources":["../src/browser-confirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,2CAA2C,EAC3C,kCAAkC,EAClC,2CAA2C,EAC3C,kCAAkC,EAClC,wCAAwC,EACxC,+BAA+B,EAC/B,0CAA0C,EAC1C,iCAAiC,EACjC,sCAAsC,EACtC,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,qCAAqC,EACrC,qCAAqC,GACtC,MAAM,uBAAuB,CAAC;AAqC/B,kFAAkF;AAClF,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,MAAM,CAAC;AAC3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,MAAM,CAAC;AAE/C,MAAM,eAAe,GACnB,uIAAuI,CAAC;AAC1I,MAAM,aAAa,GACjB,kHAAkH,CAAC;AAErH,SAAS,OAAO,CAAC,KAAkB;IACjC,OAAO,IAAI,CACT,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CACF;SACE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AACD,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,UAAU,CAAC,IAAI,CACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,2BAA2B,CACzC,KAAa;IAEb,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAA4B,CAAC;IAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAC7B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,OAAO,mBAAmB,CAAC,MAAM,CAA2B,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CACrC,KAAa;IAEb,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAA4B,CAAC;IAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QACxB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,OAAO,mBAAmB,CAAC,MAAM,CAAiC,CAAC;AACrE,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,8BAA8B,CAC5C,KAAa;IAEb,OAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAA0B,CAAC,MAAM,KAAK,IAAI;QAChE,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC;QAChC,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA4B;IACvD,MAAM,MAAM,GAAG,GAWd,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtC,IACE,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,SAAS;QAC/B,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CACC,GAAG,CAAC,QAAQ,KAAK,OAAO;gBACxB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClD,CAAC;QAEJ,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM;QACrB,CAAC,CAAC,+BAA+B,GAAG,oBAAoB;QACxD,CAAC,CAAC,OAAO,CAAC;IACZ,IACE,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9C,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAC9B,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;QACxC,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;QACzC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,GAAG;QAClC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QAExC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,IAAI,MAAM,EAAE,CAAC;QACX,sEAAsE;QACtE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YACpE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;QAC7B,IACE,MAAM,CAAC,MAAM,KAAK,SAAS;YAC3B,QAAQ,CAAC,QAAQ,KAAK,OAAO;YAC7B,QAAQ,CAAC,QAAQ,KAAK,WAAW;YACjC,CAAC,QAAQ,CAAC,IAAI;YACd,QAAQ,CAAC,QAAQ,KAAK,WAAW;YACjC,QAAQ,CAAC,QAAQ;YACjB,QAAQ,CAAC,QAAQ;YACjB,QAAQ,CAAC,MAAM;YACf,QAAQ,CAAC,IAAI;YACb,CAAC,GAAG;YACJ,GAAG,CAAC,GAAG,KAAK,KAAK;YACjB,GAAG,CAAC,CAAC,KAAK,MAAM;YAChB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;YACzB,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG;YACpB,GAAG,CAAC,CAAC,KAAK,SAAS;YAEnB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,IACE,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC;QAC1B,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK;YACtB,CAAC,QAAQ;gBACP,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC/B,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QAC/B,sEAAsE;QACtE,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC;QAEnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,QAAQ;QACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC/B,CAAC,CAAC,qCAAqC,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC1D,CAAC,CAAC,qCAAqC,CAAC,MAAM,CAAC,IAAI,CAAC;QACtD,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC1D,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;YAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC/B,CAAC,CAAC,YAAY;oBACZ,CAAC,CAAC,2CAA2C,CAAC,MAAM,CAAC,IAAI,CAAC;oBAC1D,CAAC,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC;gBACnD,CAAC,CAAC,YAAY;oBACZ,CAAC,CAAC,2CAA2C,CAAC,MAAM,CAAC,IAAI,CAAC;oBAC1D,CAAC,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,IACE,CAAC,SAAS;QACV,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,CAAC,GAAG,EAAE,EAAE,CACN,CAAC;YACC,WAAW;YACX,gBAAgB;YAChB,QAAQ;YACR,MAAM;YACN,MAAM;YACN,WAAW;YACX,aAAa;YACb,QAAQ;YACR,OAAO;YACP,WAAW;SACZ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClB;QAED,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqB,EACrB,KAAa,EACb,MAAe;IAEf,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,SAAS,EACT,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EACrC,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CACzC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACxE,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CACjD,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzC,UAAU,EACV,GAAG,EACH,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAC1C,CAAC;IACF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAqB,EACrB,KAAa,EACb,SAAiB;IAEjB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;IACxC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,OAAO;QACR,CAAC,EAAE;QACH,CAAC,UAAU;QACX,SAAS,CAAC,MAAM,GAAG,MAAM;QAEzB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC,UAAU,EACV,UAAU,EACV,OAAO,CAAC,OAAO,CAAC,CACjB,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;QACzE,SAAS;KACV,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,KAAK,CACf,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;QACf,cAAc,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;KAChD,EACD,GAAG,EACH,OAAO,CAAC,UAAU,CAAC,CACpB,CACF,CACS,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAA+B;IAE/B,OAAO,OAAO,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxB,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,cAAc;QACtB,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,IAAI,IAAI,IAAI;QACpB,OAAO,CAAC,SAAS,CAAC,CAAC;QACnB,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,KAAK;QACb,OAAO,CAAC,SAAS;KAClB,CAAC,CACH,CACF,CACF,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,8BAA8B,CAC5C,OAA+B,EAC/B,KAAgC;IAEhC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC;IACvD,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;QACrB,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;IAC3E,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAC1B,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,CAAC,YAAY;gBACX,CAAC,CAAC,wCAAwC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACtD,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CACjD,CAAC;IACJ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClC,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,CAAC,YAAY;gBACX,CAAC,CAAC,8BAA8B,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC5C,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CACvC,CAAC;IACJ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClC,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,CAAC,YAAY;gBACX,CAAC,CAAC,sCAAsC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACpD,CAAC,CAAC,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAC/C,CAAC;IACJ,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,YAAY;YACX,CAAC,CAAC,0CAA0C,CAAC,KAAK,CAAC,IAAI,CAAC;YACxD,CAAC,CAAC,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CACnD,CAAC;AACJ,CAAC"}

package/dist/client.d.ts

@@ -2,7 +2,7 @@ import { type WhoAmI, type OperatorCollection, type OperatorResolution, type Cre
 import type { BillingProjectSlots, BillingPromotions, BillingPromotion, RedeemBillingPromotionRequest, AssignBillingProjectSlotsRequest, SubscriptionChange, ConfirmSubscriptionChangeRequest, BillingEntitlements, SubscriptionSelection, ProjectAttribution, UpdateProjectAttributionRequest, AutoTopUpSettings, UpdateAutoTopUpSettingsRequest, BillingAccount, CardSetup, CreateCreditPurchaseRequest, CreditPurchase, BillingInvoiceCollection, UpdateBillingReceiptEmailRequest } from "@whooshbang/contracts";
 import { type AssertEmailConsentRequest, type BindingSummary } from "@whooshbang/contracts";
 import type { InteractionOutcome } from "./interactions.js";
-import type { OrganizationProjection, ApiCredential, OrganizationCredential, OrganizationCredentialCollection, OrganizationCredentialRotation, OrganizationCredentialSecretReveal, ApiCredentialCollection, ApiCredentialRotation, ApiCredentialSecretReveal, AttachNotifierConnectionRequest, ChannelConnection, ChannelConnectionCollection, ConnectionProviderCollection, UsageGrouping, UsageReport, MessageState, MessageListPage, MessageDeliveryHistory, MessageNotificationImage, InteractionTimeline, UpdateEmailSenderRequest, CustomerEventDeliveryHistory, CustomerEventDeliveryAttempt, DeliveryHolds, MachineClientOperationsList, RecipientCopyCatalogue, NotifierConnectionCollection, ProjectRecipientExperience, RecipientBrandLogoUpload, NotificationImageAsset, UpdateProjectRecipientExperienceRequest, EnvironmentRecipientExperience, UpdateEnvironmentRecipientExperienceRequest, SubscriberChannelSettings, AcknowledgeEmailRemediationRequest, CreateRecipientSessionRequest, CreateRecipientSessionResponse, RecipientSession, RecipientSessionCapability, CreateProviderHandoffRequest, ProviderHandoff, SetPreferredBindingRequest, PreferredBinding, CreateSubscriberRequest, Subscriber, SubscriberDataExport, UpdateSubscriberRequest, SubscriberCollection, CloseOrganizationRequest, InviteTeammateRequest, Teammate, TeammateAccessRequest, TeammateCollection, OrganizationClosureResult, CreateSubscriberGroupRequest, UpdateSubscriberGroupRequest, SubscriberGroup, SubscriberGroupCollection, SubscriberGroupMembership, SubscriberGroupMembershipCollection, CreateGroupBroadcastRequest, GroupBroadcast, CreateOrganizationCredentialRequest, CreateApiCredentialRequest, CreateChannelConnectionRequest, CreateCustomerEndpointRequest, CreateMachineClientRequest, CreateMessageRequest, CancelEscalationByKeyRequest, EscalationPathPreview, EscalationOrder, EscalationOrderCollection, SaveEscalationOrderRequest, QuietHours, SaveQuietHoursRequest, EscalationPolicy, EscalationPolicyCollection, EscalationLimits, UpdateEscalationLimitsRequest, EscalationPagingLimitReport, EscalationPolicyLevel, UpdateEscalationPolicyRequest, CancelEscalationRequest, Escalation, MessageCategory, MessageCategoryCollection, CreateMessageCategoryRequest, UpdateMessageCategoryRequest, SubscriberCategoryPreference, SubscriberCategoryPreferenceCollection, CreateProjectRequest, UpdateProjectRequest, CreateSubscriptionLinkRequest, CustomerEndpoint, CustomerEndpointAttemptCollection, CustomerEndpointCollection, CustomerEndpointMutationResult, InteractionSummary, MachineClient, MachineCredential, MachineEventAckRequest, MachineEventAckResponse, MachineEventPollResponse, Message, Problem, Project, ProjectCollection, RecipientCopyKey, RecipientCopyOverride, RecipientCopyOverrideCollection, RecipientLanguage, ProviderCapabilitiesCollection, ProviderInstallation, ProviderInstallationCollection, EmailDomain, EmailDomainCollection, CreateEmailDomainRequest, RegisterMachineCredentialRequest, RotateOrganizationCredentialRequest, RotateApiCredentialRequest, ConnectionTest, ConnectionTestCollection, CreateConnectionTestRequest, CustomerApplicationManifest, RotateChannelConnectionCredentialRequest, RotateCustomerEndpointRequest, SubscriptionLink, UpdateChannelConnectionRequest, UpdateRecipientCopyOverrideRequest } from "@whooshbang/contracts";
+import type { OrganizationProjection, ApiCredential, OrganizationCredential, OrganizationCredentialCollection, OrganizationCredentialRotation, OrganizationCredentialSecretReveal, ApiCredentialCollection, ApiCredentialRotation, ApiCredentialSecretReveal, AttachNotifierConnectionRequest, ChannelConnection, ChannelConnectionCollection, ConnectionProviderCollection, UsageGrouping, UsageReport, MessageState, MessageListPage, MessageDeliveryHistory, MessageNotificationImage, InteractionTimeline, UpdateEmailSenderRequest, CustomerEventDeliveryHistory, CustomerEventDeliveryAttempt, DeliveryHolds, MachineClientOperationsList, RecipientCopyCatalogue, NotifierConnectionCollection, ProjectRecipientExperience, RecipientBrandLogoUpload, NotificationImageAsset, UpdateProjectRecipientExperienceRequest, EnvironmentRecipientExperience, UpdateEnvironmentRecipientExperienceRequest, SubscriberChannelSettings, AcknowledgeEmailRemediationRequest, CreateRecipientSessionRequest, CreateRecipientSessionResponse, RecipientSession, RecipientSessionCapability, CreateProviderHandoffRequest, ProviderHandoff, SetPreferredBindingRequest, PreferredBinding, CreateSubscriberRequest, Subscriber, SubscriberDataExport, UpdateSubscriberRequest, SubscriberCollection, CloseOrganizationRequest, InviteTeammateRequest, Teammate, TeammateAccessRequest, TeammateCollection, OrganizationClosureResult, CreateSubscriberGroupRequest, UpdateSubscriberGroupRequest, SubscriberGroup, SubscriberGroupCollection, SubscriberGroupMembership, SubscriberGroupMembershipCollection, CreateGroupBroadcastRequest, GroupBroadcast, CreateOrganizationCredentialRequest, CreateApiCredentialRequest, CreateChannelConnectionRequest, CreateCustomerEndpointRequest, CreateMachineClientRequest, CreateMessageRequest, CancelEscalationByKeyRequest, EscalationPathPreview, EscalationOrder, EscalationOrderCollection, SaveEscalationOrderRequest, QuietHours, SaveQuietHoursRequest, SetDigestPreferenceRequest, SetSubscriberDigestSettingRequest, SubscriberDigestSettings, EscalationPolicy, EscalationPolicyCollection, EscalationLimits, UpdateEscalationLimitsRequest, EscalationPagingLimitReport, EscalationPolicyLevel, UpdateEscalationPolicyRequest, CancelEscalationRequest, Escalation, MessageCategory, MessageCategoryCollection, CreateMessageCategoryRequest, UpdateMessageCategoryRequest, SubscriberCategoryPreference, SubscriberCategoryPreferenceCollection, CreateProjectRequest, UpdateProjectRequest, CreateSubscriptionLinkRequest, CustomerEndpoint, CustomerEndpointAttemptCollection, CustomerEndpointCollection, CustomerEndpointMutationResult, InteractionSummary, MachineClient, MachineCredential, MachineEventAckRequest, MachineEventAckResponse, MachineEventPollResponse, Message, Problem, Project, ProjectCollection, RecipientCopyKey, RecipientCopyOverride, RecipientCopyOverrideCollection, RecipientLanguage, ProviderCapabilitiesCollection, ProviderInstallation, ProviderInstallationCollection, EmailDomain, EmailDomainCollection, CreateEmailDomainRequest, RegisterMachineCredentialRequest, RotateOrganizationCredentialRequest, RotateApiCredentialRequest, ConnectionTest, ConnectionTestCollection, CreateConnectionTestRequest, CustomerApplicationManifest, RotateChannelConnectionCredentialRequest, RotateCustomerEndpointRequest, SubscriptionLink, UpdateChannelConnectionRequest, UpdateRecipientCopyOverrideRequest } from "@whooshbang/contracts";
 export type WhooshBangFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 /**
  * The outcome of one SDK invocation, as reported to an optional logging hook.
@@ -319,6 +319,81 @@ export interface TemplateMessageSendResult {
         readonly layout_locale?: string;
     };
 }
+/** A template as its author sees it: the editable draft and the published revision. */
+export interface MessageTemplate extends MessageTemplateCatalogEntry {
+    readonly draftVersion: number;
+    readonly createdAt?: string;
+    readonly updatedAt?: string;
+}
+export interface CreateMessageTemplateRequest {
+    readonly name: string;
+    readonly display_name: string;
+    readonly description?: string;
+    readonly category?: string;
+    /** Editable draft; complete validation runs at publish. */
+    readonly definition: Readonly<Record<string, unknown>>;
+}
+export interface UpdateMessageTemplateRequest {
+    readonly name?: string;
+    readonly display_name?: string;
+    readonly description?: string;
+    readonly category?: string;
+    readonly disabled?: boolean;
+}
+export interface PublishedTemplateRevision {
+    readonly revision: number;
+    readonly definition: Readonly<Record<string, unknown>>;
+    readonly publishedAt: string;
+    readonly publishedBy?: string;
+}
+export interface PreviewMessageTemplateRequest {
+    readonly input: Readonly<Record<string, unknown>>;
+    /** `default` renders the message every channel falls back to. Omitted means email. */
+    readonly channel?: "default" | "generic" | "email" | "telegram" | "slack";
+    readonly locale?: string;
+    readonly revision?: number;
+    /** An unsaved definition to render; cannot be combined with `revision`. */
+    readonly definition?: Readonly<Record<string, unknown>>;
+}
+export interface MessageTemplatePreview {
+    readonly channel: "default" | "email" | "telegram" | "slack";
+    readonly subject?: string;
+    readonly html?: string;
+    readonly text?: string;
+    readonly normalizedInput: Readonly<Record<string, unknown>>;
+    readonly templateLocale: string;
+    readonly layoutLocale?: string;
+    readonly layoutId?: string;
+    readonly layoutRevision?: number;
+    readonly approximate?: true;
+    readonly payload?: Readonly<Record<string, unknown>>;
+}
+export interface DraftTemplateTestSendRequest {
+    readonly draft_version: number;
+    readonly input: Readonly<Record<string, unknown>>;
+    readonly to: {
+        readonly subscriber_id: string;
+    };
+    readonly connection_id?: string;
+    readonly notifier_id?: string;
+    readonly category_key?: string;
+    readonly purpose?: "service" | "marketing";
+    readonly correlation_id?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly expires_at?: string;
+}
+export interface EmailLayout {
+    readonly id: string;
+    readonly name: string;
+    readonly isDefault: boolean;
+    readonly disabled: boolean;
+    readonly draft: Readonly<Record<string, unknown>>;
+    readonly draftVersion: number;
+    readonly latestPublishedRevision: number;
+    readonly published?: PublishedTemplateRevision;
+    readonly createdAt?: string;
+    readonly updatedAt?: string;
+}
 export declare class WhooshBangClient {
     #private;
     whoAmI(projectId: string, environmentId: string, options?: RequestOptions): Promise<WhoAmI>;
@@ -408,6 +483,46 @@ export declare class WhooshBangClient {
     }, options?: RequestOptions): Promise<MessageTemplateCatalog>;
     sendTemplateMessage(projectId: string, environmentId: string, request: TemplateMessageSendRequest, options?: SideEffectRequestOptions): Promise<TemplateMessageSendResult>;
     getMessageTemplate(projectId: string, reference: string, options?: RequestOptions): Promise<MessageTemplateCatalogEntry>;
+    /** The template as its author sees it, including the editable draft. */
+    getMessageTemplateForAuthoring(projectId: string, reference: string, options?: RequestOptions): Promise<MessageTemplate>;
+    /** Every template, drafts and disabled ones included, for authoring. */
+    listMessageTemplatesForAuthoring(projectId: string, query?: {
+        search?: string;
+        category?: string;
+        after?: string;
+        limit?: number;
+        page?: number;
+    }, options?: RequestOptions): Promise<Omit<MessageTemplateCatalog, "items"> & {
+        readonly items: readonly MessageTemplate[];
+    }>;
+    createMessageTemplate(projectId: string, request: CreateMessageTemplateRequest, options?: RequestOptions): Promise<MessageTemplate>;
+    /** Renames, recategorises, disables or re-enables a template. */
+    updateMessageTemplate(projectId: string, templateId: string, request: UpdateMessageTemplateRequest, options?: RequestOptions): Promise<MessageTemplate>;
+    /** Replaces the draft. `draftVersion` is the version last read; a newer save refuses this one. */
+    saveMessageTemplateDraft(projectId: string, templateId: string, draftVersion: number, definition: Readonly<Record<string, unknown>>, options?: RequestOptions): Promise<MessageTemplate>;
+    /** Validates the draft completely and publishes it as the next revision. */
+    publishMessageTemplate(projectId: string, templateId: string, draftVersion: number, options?: RequestOptions): Promise<PublishedTemplateRevision>;
+    listMessageTemplateRevisions(projectId: string, templateId: string, options?: RequestOptions): Promise<{
+        readonly items: readonly PublishedTemplateRevision[];
+    }>;
+    /** Renders the draft, a revision or an unsaved definition. Nothing is sent. */
+    previewMessageTemplate(projectId: string, templateId: string, request: PreviewMessageTemplateRequest, options?: RequestOptions): Promise<MessageTemplatePreview>;
+    /** Sends the exact draft to one subscriber as a test. It never publishes. */
+    testSendMessageTemplateDraft(projectId: string, environmentId: string, templateId: string, request: DraftTemplateTestSendRequest, options?: SideEffectRequestOptions): Promise<TemplateMessageSendResult>;
+    listEmailLayouts(projectId: string, options?: RequestOptions): Promise<{
+        readonly items: readonly EmailLayout[];
+    }>;
+    getEmailLayout(projectId: string, layoutId: string, options?: RequestOptions): Promise<EmailLayout>;
+    createEmailLayout(projectId: string, request: {
+        readonly name: string;
+        readonly definition: Readonly<Record<string, unknown>>;
+    }, options?: RequestOptions): Promise<EmailLayout>;
+    saveEmailLayoutDraft(projectId: string, layoutId: string, draftVersion: number, definition: Readonly<Record<string, unknown>>, options?: RequestOptions): Promise<EmailLayout>;
+    publishEmailLayout(projectId: string, layoutId: string, draftVersion: number, options?: RequestOptions): Promise<PublishedTemplateRevision>;
+    /** Makes a published layout the project's default for email templates. */
+    setDefaultEmailLayout(projectId: string, layoutId: string, options?: RequestOptions): Promise<{
+        readonly default_layout_id: string;
+    }>;
     createMessageCategory(projectId: string, request: CreateMessageCategoryRequest, options?: RequestOptions): Promise<MessageCategory>;
     updateMessageCategory(projectId: string, key: string, request: UpdateMessageCategoryRequest, options?: RequestOptions): Promise<MessageCategory>;
     deleteMessageCategory(projectId: string, key: string, options?: RequestOptions): Promise<void>;
@@ -445,6 +560,18 @@ export declare class WhooshBangClient {
      * them, through their recipient session.
      */
     getSubscriberQuietHours(projectId: string, environmentId: string, subscriberId: string, options?: RequestOptions): Promise<QuietHours>;
+    /**
+     * One subscriber's digest settings: for each category, the policy in
+     * effect, where each setting comes from, what the subscriber may change,
+     * their saved choices and your setting for them (FXO-3729).
+     */
+    getSubscriberDigestSettings(projectId: string, environmentId: string, subscriberId: string, options?: RequestOptions): Promise<SubscriberDigestSettings>;
+    /**
+     * Your digest setting for one subscriber and category, and which settings
+     * they can't change; `{ setting: null }` removes it. Their own choice is
+     * kept and returns when you unlock.
+     */
+    setSubscriberDigestSetting(projectId: string, environmentId: string, subscriberId: string, categoryKey: string, request: SetSubscriberDigestSettingRequest, options?: RequestOptions): Promise<SubscriberDigestSettings>;
     transitionSubscriberBinding(projectId: string, environmentId: string, subscriberId: string, bindingId: string, action: "pause" | "resume" | "unsubscribe", options?: RequestOptions): Promise<SubscriberChannelSettings>;
     setSubscriberPreferredBinding(projectId: string, environmentId: string, subscriberId: string, request: SetPreferredBindingRequest, options?: RequestOptions): Promise<SubscriberChannelSettings>;
     acknowledgeEmailRemediation(projectId: string, environmentId: string, connectionId: string, request: AcknowledgeEmailRemediationRequest, options?: RequestOptions): Promise<ChannelConnection>;
@@ -938,6 +1065,24 @@ export declare class WhooshBangRecipientSessionClient {
      * is not theirs.
      */
     saveQuietHours(request: SaveQuietHoursRequest, options?: RequestOptions): Promise<QuietHours>;
+    /**
+     * This subscriber's digest settings: only the categories whose owner lets
+     * them choose something, with what is in effect and what they can change,
+     * plus their Default (FXO-3729).
+     */
+    getDigestSettings(options?: RequestOptions): Promise<SubscriberDigestSettings>;
+    /**
+     * Sets this subscriber's Default digest choice, or clears it with
+     * `{ preference: null }`. A setting the owner doesn't offer fails with
+     * `request_invalid` naming it, and the previous setting stays.
+     */
+    setDefaultDigestPreference(request: SetDigestPreferenceRequest, options?: RequestOptions): Promise<SubscriberDigestSettings>;
+    /**
+     * Sets this subscriber's digest choice for one category, or clears it so
+     * the category follows the Default again. Locked or unoffered settings
+     * fail with `request_invalid` and the previous setting stays.
+     */
+    setCategoryDigestPreference(categoryKey: string, request: SetDigestPreferenceRequest, options?: RequestOptions): Promise<SubscriberDigestSettings>;
     /** Turns off this subscriber's quiet hours. */
     resetQuietHours(options?: RequestOptions): Promise<QuietHours>;
     transitionBinding(bindingId: string, action: RecipientBindingAction, options?: RequestOptions): Promise<RecipientSession>;