@xkova/sdk 0.1.0-alpha.6 → 0.1.0-alpha.8

package/dist/held-approval.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Narrow a governance hold before reading a mutation's entity result.
+ *
+ * On a workspace with a seeded/configured governance requirement, a
+ * create-shaped mutation (for example, `createTreasuryCounterparty` or
+ * treasury signer changes) may not execute: it returns a `HeldApproval`
+ * (`{ status: 'pending_approval', pending_approval_request_id }`) instead of
+ * the entity. No entity is created. Independently eligible approvers complete
+ * the required approval, then the same call is reissued through normal policy.
+ *
+ * Narrow BEFORE reading entity fields:
+ *
+ *   const res = await client.treasury.createCounterparty(body, opts);
+ *   if (isHeldApproval(res)) {
+ *     await waitForApproval(res.pending_approval_request_id); // your flow
+ *     return client.treasury.createCounterparty(body, opts); // same request
+ *   }
+ *   res.id; // safely the entity now
+ *
+ * This helper grants no approval, signer authority or permission to retry a
+ * changed request. Existing entity-shaped responses are not governance holds.
+ */
+import type { components } from './generated/types.js';
+export type HeldApproval = components['schemas']['HeldApproval'];
+/** True when a mutation response is a governance hold rather than the entity. */
+export declare function isHeldApproval(res: unknown): res is HeldApproval;
+/**
+ * Thrown by `assertNotHeld` when a mutation was governance-held. Carries the
+ * approval request id so a script that does not implement the attest flow
+ * fails loudly with the pointer a human needs.
+ */
+export declare class XKOVAHeldApprovalError extends Error {
+    readonly pendingApprovalRequestId: string;
+    constructor(held: HeldApproval, action?: string);
+}
+/**
+ * Unwrap a `entity | HeldApproval` union for callers that treat a hold as
+ * exceptional (scripts, one-shot provisioning). Returns the entity, or throws
+ * `XKOVAHeldApprovalError` carrying the approval request id.
+ */
+export declare function assertNotHeld<T>(res: T | HeldApproval, action?: string): T;

package/dist/held-approval.js

@@ -0,0 +1,33 @@
+/** True when a mutation response is a governance hold rather than the entity. */
+export function isHeldApproval(res) {
+    return (typeof res === 'object' &&
+        res !== null &&
+        res.status === 'pending_approval' &&
+        typeof res
+            .pending_approval_request_id === 'string');
+}
+/**
+ * Thrown by `assertNotHeld` when a mutation was governance-held. Carries the
+ * approval request id so a script that does not implement the attest flow
+ * fails loudly with the pointer a human needs.
+ */
+export class XKOVAHeldApprovalError extends Error {
+    pendingApprovalRequestId;
+    constructor(held, action) {
+        super(`${action ?? 'The mutation'} was held for governance approval ` +
+            `(approval request ${held.pending_approval_request_id}). Attest the ` +
+            `request, then re-issue the same call.`);
+        this.name = 'XKOVAHeldApprovalError';
+        this.pendingApprovalRequestId = held.pending_approval_request_id;
+    }
+}
+/**
+ * Unwrap a `entity | HeldApproval` union for callers that treat a hold as
+ * exceptional (scripts, one-shot provisioning). Returns the entity, or throws
+ * `XKOVAHeldApprovalError` carrying the approval request id.
+ */
+export function assertNotHeld(res, action) {
+    if (isHeldApproval(res))
+        throw new XKOVAHeldApprovalError(res, action);
+    return res;
+}

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export { generateIdempotencyKey, withIdempotency } from './idempotency.js';
 export { withRetry, type RetryPolicy } from './retry.js';
 export { collectCursor, paginateCursor, type CursorPage, type PaginateCursorOptions, } from './cursor.js';
 export { XKOVAApiError, XKOVAUploadError } from './errors.js';
+export { isHeldApproval, assertNotHeld, XKOVAHeldApprovalError, type HeldApproval, } from './held-approval.js';
 export { type PollOptions } from './resources/workflows.js';
 export { type XKOVAMemberSessionContext } from './resources/account-holders.js';
 export { verifyWebhookSignature, type VerifyWebhookSignatureResult } from './webhook.js';

package/dist/index.js

@@ -4,5 +4,6 @@ export { generateIdempotencyKey, withIdempotency } from './idempotency.js';
 export { withRetry } from './retry.js';
 export { collectCursor, paginateCursor, } from './cursor.js';
 export { XKOVAApiError, XKOVAUploadError } from './errors.js';
+export { isHeldApproval, assertNotHeld, XKOVAHeldApprovalError, } from './held-approval.js';
 export { verifyWebhookSignature } from './webhook.js';
 export { verifyInclusion, verifyConsistency, verifySth, } from './rwa-verify.js';

package/dist/member-bff.d.ts

@@ -34,6 +34,14 @@ export interface XKOVAMemberSessionMaterial extends XKOVAMemberContext {
     /** Confidential refresh credential, BFF storage only. */
     readonly refreshToken: string;
 }
+export interface XKOVAExternalMemberEnrollment {
+    readonly accountHolderId: string;
+    readonly applicationId: string;
+    readonly publishableKey: string;
+    readonly applicationConfigVersion: number;
+    readonly providerNamespace: string;
+    readonly created: boolean;
+}
 export interface XKOVABrowserMemberProjection {
     readonly signedIn: true;
     readonly accountHolderId: string;
@@ -49,8 +57,12 @@ export interface StoredXKOVAMemberSession<TApplicationData = unknown> extends XK
 }
 /**
  * `runExclusive` must serialize refresh and logout for the same reference
- * across all BFF instances. Use a database transaction or distributed lock;
- * a process-local mutex cannot coordinate multiple instances.
+ * across all BFF instances. Use a distributed or session-level database lock;
+ * a process-local mutex cannot coordinate multiple instances. This lock is not
+ * a surrounding rollback transaction: every awaited put/replace/delete must be
+ * durable before resolving and must survive a later error from work(). In
+ * particular, a pending refresh-attempt checkpoint cannot roll back after the
+ * provider/API has acted. replace is exact-existing-only, never an upsert.
  */
 export interface XKOVAMemberSessionStore<TApplicationData = unknown> {
     put(reference: string, session: StoredXKOVAMemberSession<TApplicationData>): Promise<void>;
@@ -169,6 +181,11 @@ export type XKOVAMemberAuthorizationTransaction<TApplicationData = unknown> = {
  * every BFF instance. `replace` and `delete` must target that exact state. A
  * production store must encrypt the transaction because it can briefly hold a
  * confidential provider proof while XKOVA session exchange is retried.
+ * Every awaited write must commit independently of a later work() exception.
+ * Never wrap the entire callback in a rollback transaction: that can erase the
+ * staged proof after its one-time provider code has already been consumed.
+ * On uncertain write acknowledgement, reconcile the same exact record; never
+ * re-exchange the provider code or invent a replacement operation identity.
  */
 export interface XKOVAMemberAuthorizationTransactionStore<TApplicationData = unknown> {
     put(stateHash: string, transaction: XKOVAMemberAuthorizationTransaction<TApplicationData>): Promise<void>;
@@ -198,6 +215,10 @@ export type XKOVAMemberProofExchangeTransaction<TApplicationData = unknown> = {
  * Durable transaction store for a confidential proof exchange that does not
  * use the browser callback helper. Pending records contain a provider proof
  * and customer application data, so production adapters must encrypt them.
+ * Serialize the exact reference across replicas without a surrounding rollback
+ * transaction. Awaited put/replace/delete checkpoints must remain committed if
+ * the later exchange fails. Reconcile an uncertain acknowledgement against the
+ * same reference and attempt identity before retrying.
  */
 export interface XKOVAMemberProofExchangeTransactionStore<TApplicationData = unknown> {
     put(exchangeHash: string, transaction: XKOVAMemberProofExchangeTransaction<TApplicationData>): Promise<void>;
@@ -321,6 +342,18 @@ export declare class XKOVAMemberBffClient {
     exchangeProof(proofToken: string, options: {
         readonly attemptId: string;
     }): Promise<XKOVAMemberSessionMaterial>;
+    /**
+     * BFF-only membership provisioning after validating the provider identity or
+     * resolving it from a trusted directory. This creates no login session or
+     * wallet and does not substitute for genuine provider-proof verification.
+     * Save one idempotencyKey before the first attempt and retain the same subject,
+     * selector and observed configuration version during response-loss recovery.
+     */
+    enrollExternalMember(input: {
+        readonly externalSub: string;
+        readonly applicationConfigVersion: number;
+        readonly idempotencyKey: string;
+    }): Promise<XKOVAExternalMemberEnrollment>;
     refresh(refreshToken: string, options: {
         readonly attemptId: string;
     }): Promise<XKOVAMemberSessionMaterial>;
@@ -426,6 +459,17 @@ export declare class XKOVAMemberBffClient {
         readonly transactionStore: XKOVAMemberAuthorizationTransactionStore<TApplicationData>;
         readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
         readonly exchangeProviderCode: (input: XKOVAMemberProviderCodeExchangeInput) => XKOVAMemberProviderCodeExchangeResult | Promise<XKOVAMemberProviderCodeExchangeResult>;
+        /**
+         * Optional OIDC enrollment, invoked only after the validated provider proof
+         * is durably staged. Validate/extract its exact subject on your backend and
+         * call enrollExternalMember with this stable idempotency key. Do not perform
+         * enrollment RPC inside exchangeProviderCode: failure there can otherwise
+         * require reusing an already-consumed provider authorization code.
+         */
+        readonly ensureMemberEnrollment?: (input: {
+            readonly proofToken: string;
+            readonly idempotencyKey: string;
+        }) => Promise<XKOVAExternalMemberEnrollment>;
         readonly applicationData: TApplicationData;
         readonly applicationSessionSeconds?: number;
     }): Promise<EstablishedXKOVAMemberSession<TApplicationData>>;

package/dist/member-bff.js

@@ -79,6 +79,48 @@ export class XKOVAMemberBffClient {
             proof_token: proofToken,
         }), 'proof exchange');
     }
+    /**
+     * BFF-only membership provisioning after validating the provider identity or
+     * resolving it from a trusted directory. This creates no login session or
+     * wallet and does not substitute for genuine provider-proof verification.
+     * Save one idempotencyKey before the first attempt and retain the same subject,
+     * selector and observed configuration version during response-loss recovery.
+     */
+    async enrollExternalMember(input) {
+        if (typeof input.externalSub !== 'string' ||
+            input.externalSub.length === 0 ||
+            input.externalSub.length > 512 ||
+            /\u0000/u.test(input.externalSub) ||
+            !/\S/u.test(input.externalSub))
+            throw new TypeError('externalSub must be an exact nonempty provider subject of at most 512 characters');
+        assertPositiveInteger(input.applicationConfigVersion, 'applicationConfigVersion');
+        if (!/^[A-Za-z0-9._:-]{1,255}$/u.test(input.idempotencyKey))
+            throw new TypeError('idempotencyKey must be a retained opaque operation key of at most 255 characters');
+        const value = await this.recoverablePostJson('/member-auth/enrollments', {
+            publishable_key: this.options.publishableKey,
+            application_config_version: input.applicationConfigVersion,
+            external_sub: input.externalSub,
+        }, undefined, input.idempotencyKey);
+        const result = requireObject(value, 'external member enrollment');
+        const applicationId = requireString(result, 'application_id', 'external member enrollment');
+        assertUuid(applicationId, 'enrollment application id');
+        const publishableKey = requireString(result, 'publishable_key', 'external member enrollment');
+        const applicationConfigVersion = requirePositiveInteger(result, 'application_config_version', 'external member enrollment');
+        const providerNamespace = requireString(result, 'provider_namespace', 'external member enrollment');
+        if (publishableKey !== this.options.publishableKey ||
+            applicationConfigVersion !== input.applicationConfigVersion ||
+            !providerNamespace.startsWith('oidc:') ||
+            typeof result.created !== 'boolean')
+            throw new Error('XKOVA external member enrollment returned a different application or configuration');
+        return {
+            accountHolderId: requireString(result, 'account_holder_id', 'external member enrollment'),
+            applicationId,
+            publishableKey,
+            applicationConfigVersion,
+            providerNamespace,
+            created: result.created,
+        };
+    }
     async refresh(refreshToken, options) {
         if (refreshToken.length < 20) {
             throw new TypeError('member refresh token is malformed');
@@ -759,6 +801,10 @@ export class XKOVAMemberBffClient {
             if (transaction.completionMode !== 'provider_proof') {
                 throw new Error('member authorization transaction is not a provider-proof flow');
             }
+            if (input.ensureMemberEnrollment &&
+                transaction.status === 'pending' &&
+                transaction.proofKind !== 'oidc')
+                throw new Error('external member enrollment is available only for an OIDC proof flow');
             if (!sameCallback(callback, new URL(transaction.redirectUri))) {
                 throw new Error('member authorization callback does not match its redirect URI');
             }
@@ -821,6 +867,14 @@ export class XKOVAMemberBffClient {
                     },
                 });
             }
+            const enrollment = input.ensureMemberEnrollment
+                ? await input.ensureMemberEnrollment({
+                    proofToken,
+                    idempotencyKey: `enroll:${transaction.exchangeAttemptId}`,
+                })
+                : undefined;
+            if (enrollment && enrollment.publishableKey !== this.options.publishableKey)
+                throw new Error('member enrollment does not belong to this application');
             const established = await this.persistSessionWithAttempt({
                 proofToken,
                 attemptId: transaction.exchangeAttemptId,
@@ -828,6 +882,7 @@ export class XKOVAMemberBffClient {
                 sessionStore: input.sessionStore,
                 applicationData,
                 applicationExpiresAt,
+                ...(enrollment !== undefined && { expectedAccountHolderId: enrollment.accountHolderId }),
             });
             await input.transactionStore.replace(stateHash, {
                 status: 'completed',
@@ -1014,6 +1069,9 @@ export class XKOVAMemberBffClient {
         const material = await this.exchangeProof(input.proofToken, {
             attemptId: input.attemptId,
         });
+        if (input.expectedAccountHolderId !== undefined &&
+            material.accountHolderId !== input.expectedAccountHolderId)
+            throw new Error('XKOVA proof exchange returned a different member from the enrolled identity');
         return this.persistSessionMaterial({
             material,
             reference: input.reference,
@@ -1064,8 +1122,7 @@ export class XKOVAMemberBffClient {
             ...(idempotencyKey !== undefined && { idempotencyKey }),
         });
     }
-    async recoverablePostJson(path, body, sessionId) {
-        const idempotencyKey = generateIdempotencyKey();
+    async recoverablePostJson(path, body, sessionId, idempotencyKey = generateIdempotencyKey()) {
         try {
             return await this.postJson(path, body, sessionId, idempotencyKey);
         }

package/dist/member-resources.d.ts

@@ -52,6 +52,9 @@ export declare class XKOVAMemberResources {
             credit: {
                 amount: string;
                 token_deployment_id: string;
+                token_address: string;
+                token_symbol: string;
+                chain: import("./generated/types.js").components["schemas"]["ChainDescriptor"];
                 status: "pending" | "submitted" | "settled" | "requires_review";
                 transaction_hash: string | null;
             } | null;
@@ -64,6 +67,9 @@ export declare class XKOVAMemberResources {
             credit: {
                 amount: string;
                 token_deployment_id: string;
+                token_address: string;
+                token_symbol: string;
+                chain: import("./generated/types.js").components["schemas"]["ChainDescriptor"];
                 status: "pending" | "submitted" | "settled" | "requires_review";
                 transaction_hash: string | null;
             } | null;
@@ -103,6 +109,7 @@ export declare class XKOVAMemberResources {
         }>;
         balance: (control?: XKOVARequestControl) => Promise<{
             balances: import("./generated/types.js").components["schemas"]["AccountHolderSelfBalanceEntry"][];
+            data_freshness: import("./generated/types.js").components["schemas"]["DataFreshness"][];
         }>;
         wallets: (control?: XKOVARequestControl) => Promise<{
             data: import("./generated/types.js").components["schemas"]["Wallet"][];

package/dist/request-signing.js

@@ -11,6 +11,10 @@ const CONDITIONAL_HEADERS = [
     'idempotency-key',
     'x-member-session-id',
     'x-xkova-publishable-key',
+    'x-xkova-workforce-key',
+    'x-workforce-session',
+    'x-xkova-human-authorization',
+    'origin',
     'x-account-holder-id',
     'x-sender-wallet-id',
     'x-sandbox-scenario',
@@ -78,6 +82,8 @@ export async function signXKOVARequest(input) {
 function requiredComponents(headers, bodyPresent) {
     const components = [...BASE_COMPONENTS];
     for (const header of CONDITIONAL_HEADERS) {
+        if (header === 'origin' && !headers.has('x-xkova-workforce-key'))
+            continue;
         if (headers.has(header) ||
             (bodyPresent && (header === 'content-digest' || header === 'content-type'))) {
             components.push(header);

package/dist/resources/account-holders.d.ts

@@ -152,6 +152,9 @@ export declare class AccountHoldersResource extends Resource {
         credit: {
             amount: string;
             token_deployment_id: string;
+            token_address: string;
+            token_symbol: string;
+            chain: import("../generated/types.js").components["schemas"]["ChainDescriptor"];
             status: "pending" | "submitted" | "settled" | "requires_review";
             transaction_hash: string | null;
         } | null;
@@ -164,12 +167,16 @@ export declare class AccountHoldersResource extends Resource {
         credit: {
             amount: string;
             token_deployment_id: string;
+            token_address: string;
+            token_symbol: string;
+            chain: import("../generated/types.js").components["schemas"]["ChainDescriptor"];
             status: "pending" | "submitted" | "settled" | "requires_review";
             transaction_hash: string | null;
         } | null;
     }>;
     selfBalance(context: XKOVAMemberSessionContext, control?: XKOVARequestControl): Promise<{
         balances: import("../generated/types.js").components["schemas"]["AccountHolderSelfBalanceEntry"][];
+        data_freshness: import("../generated/types.js").components["schemas"]["DataFreshness"][];
     }>;
     listSelfWallets(context: XKOVAMemberSessionContext, control?: XKOVARequestControl): Promise<{
         data: import("../generated/types.js").components["schemas"]["Wallet"][];

package/dist/resources/branding.d.ts

@@ -2,6 +2,8 @@ import { Resource, type ReqBody, type Query } from './base.js';
 import type { XKOVAMutationOptions } from '../client.js';
 export declare class BrandingResource extends Resource {
     get(): Promise<{
+        logo_upload_limits: import("../generated/types.js").components["schemas"]["LogoUploadLimits"];
+        has_logo_override: boolean;
         resolved: {
             brand_name: string;
             legal_name: string;
@@ -28,6 +30,8 @@ export declare class BrandingResource extends Resource {
         theme: import("../generated/types.js").components["schemas"]["TenantBrandingTheme"];
     }>;
     upsert(body: ReqBody<'upsertBranding'>, opts?: XKOVAMutationOptions): Promise<{
+        logo_upload_limits: import("../generated/types.js").components["schemas"]["LogoUploadLimits"];
+        has_logo_override: boolean;
         resolved: {
             brand_name: string;
             legal_name: string;
@@ -94,12 +98,16 @@ export declare class BrandingResource extends Resource {
         last_synced_at: string;
         created_at: string;
     }>;
+    /** Upload bytes to the returned URL, then confirm its opaque key as the same tenant. */
     logoUploadUrl(body: ReqBody<'brandingLogoUploadUrl'>, opts?: XKOVAMutationOptions): Promise<{
         upload_url: string;
         object_key: string;
         expires_at: string;
     }>;
+    /** Publish a newly issued upload. Saved logo URLs or keys are not upload keys. */
     confirmLogo(body: ReqBody<'confirmBrandingLogo'>, opts?: XKOVAMutationOptions): Promise<{
+        logo_upload_limits: import("../generated/types.js").components["schemas"]["LogoUploadLimits"];
+        has_logo_override: boolean;
         resolved: {
             brand_name: string;
             legal_name: string;
@@ -126,6 +134,8 @@ export declare class BrandingResource extends Resource {
         theme: import("../generated/types.js").components["schemas"]["TenantBrandingTheme"];
     }>;
     deleteLogo(opts?: XKOVAMutationOptions): Promise<{
+        logo_upload_limits: import("../generated/types.js").components["schemas"]["LogoUploadLimits"];
+        has_logo_override: boolean;
         resolved: {
             brand_name: string;
             legal_name: string;

package/dist/resources/branding.js

@@ -22,9 +22,11 @@ export class BrandingResource extends Resource {
     verifyEmailDomain(id, opts) {
         return this.postJson(`/branding/email-domains/${this.enc(id)}/verify`, undefined, opts);
     }
+    /** Upload bytes to the returned URL, then confirm its opaque key as the same tenant. */
     logoUploadUrl(body, opts) {
         return this.postJson('/branding/logo/upload-url', body, opts);
     }
+    /** Publish a newly issued upload. Saved logo URLs or keys are not upload keys. */
     confirmLogo(body, opts) {
         return this.postJson('/branding/logo', body, opts);
     }

package/dist/resources/escrows.d.ts

@@ -7,6 +7,7 @@ export declare class EscrowsResource extends Resource {
         has_more: boolean;
     }>;
     create(body: ReqBody<'createEscrow'>, opts?: XKOVAMutationOptions): Promise<{
+        notification_status?: "queued" | "sent" | "failed" | "cancelled";
         escrow: import("../generated/types.js").components["schemas"]["Escrow"];
         claim_token: string;
         claim_url: string;
@@ -15,6 +16,7 @@ export declare class EscrowsResource extends Resource {
         signing_expires_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
     }>;
     retrieve(id: string, query?: Query<'getEscrow'>): Promise<{
+        notification_status?: "queued" | "sent" | "failed" | "cancelled";
         id: import("../generated/types.js").components["schemas"]["EscrowId"];
         chain: import("../generated/types.js").components["schemas"]["ChainDescriptor"];
         fingerprint: string;
@@ -28,6 +30,7 @@ export declare class EscrowsResource extends Resource {
         on_chain_payment_id?: string | null;
         create_tx_hash?: string | null;
         release_tx_hash?: string | null;
+        data_freshness?: import("../generated/types.js").components["schemas"]["DataFreshness"][];
         fee_accruals?: import("../generated/types.js").components["schemas"]["EscrowFeeAccrual"][];
         net_amount?: import("../generated/types.js").components["schemas"]["Money"] | null;
         claimed_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;

package/dist/resources/payment-requests.d.ts

@@ -11,6 +11,7 @@ export declare class PaymentRequestsResource extends Resource {
         has_more: boolean;
     }>;
     create(body: ReqBody<'createPaymentRequest'>, opts?: XKOVAMutationOptions): Promise<{
+        notification_status?: "queued" | "sent" | "failed" | "cancelled";
         id?: import("../generated/types.js").components["schemas"]["PaymentRequestId"];
         requester_id?: import("../generated/types.js").components["schemas"]["AccountHolderId"];
         payer_id?: import("../generated/types.js").components["schemas"]["AccountHolderId"] | null;
@@ -26,6 +27,7 @@ export declare class PaymentRequestsResource extends Resource {
         updated_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"];
     }>;
     retrieve(id: string): Promise<{
+        notification_status?: "queued" | "sent" | "failed" | "cancelled";
         id?: import("../generated/types.js").components["schemas"]["PaymentRequestId"];
         requester_id?: import("../generated/types.js").components["schemas"]["AccountHolderId"];
         payer_id?: import("../generated/types.js").components["schemas"]["AccountHolderId"] | null;
@@ -82,6 +84,7 @@ export declare class PaymentRequestsResource extends Resource {
         finalized_at: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
     }>;
     cancel(id: string, opts?: XKOVAMutationOptions): Promise<{
+        notification_status?: "queued" | "sent" | "failed" | "cancelled";
         id?: import("../generated/types.js").components["schemas"]["PaymentRequestId"];
         requester_id?: import("../generated/types.js").components["schemas"]["AccountHolderId"];
         payer_id?: import("../generated/types.js").components["schemas"]["AccountHolderId"] | null;
@@ -97,6 +100,7 @@ export declare class PaymentRequestsResource extends Resource {
         updated_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"];
     }>;
     decline(id: string, body?: ReqBody<'declinePaymentRequest'>, opts?: XKOVAMutationOptions): Promise<{
+        notification_status?: "queued" | "sent" | "failed" | "cancelled";
         id?: import("../generated/types.js").components["schemas"]["PaymentRequestId"];
         requester_id?: import("../generated/types.js").components["schemas"]["AccountHolderId"];
         payer_id?: import("../generated/types.js").components["schemas"]["AccountHolderId"] | null;

package/dist/resources/tenant.d.ts

@@ -47,6 +47,12 @@ export declare class TenantResource extends Resource {
         publishable_key: string;
         name: string;
         provider_kind: "xkova_hosted" | "oidc" | "signed_launch";
+        provider_namespace: string;
+        issuer: string | null;
+        audience: string | null;
+        jwks_uri: string | null;
+        allowed_jwt_algorithms: ("RS256" | "PS256" | "ES256" | "EdDSA")[];
+        proof_binding_mode: "authorization_nonce" | "server_assertion_jti";
         enrollment_mode: import("../generated/types.js").components["schemas"]["MemberAuthEnrollmentMode"];
         is_default: boolean;
         status: "active" | "principal_disabled";
@@ -73,6 +79,12 @@ export declare class TenantResource extends Resource {
         publishable_key: string;
         name: string;
         provider_kind: "xkova_hosted" | "oidc" | "signed_launch";
+        provider_namespace: string;
+        issuer: string | null;
+        audience: string | null;
+        jwks_uri: string | null;
+        allowed_jwt_algorithms: ("RS256" | "PS256" | "ES256" | "EdDSA")[];
+        proof_binding_mode: "authorization_nonce" | "server_assertion_jti";
         enrollment_mode: import("../generated/types.js").components["schemas"]["MemberAuthEnrollmentMode"];
         is_default: boolean;
         status: "active" | "principal_disabled";
@@ -90,6 +102,9 @@ export declare class TenantResource extends Resource {
         created_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
         updated_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
     }>;
+    /** Disables the exact Hosted Auth or OIDC member application. */
+    disableMemberAuthApplication(id: string, opts?: XKOVAMutationOptions): Promise<void>;
+    /** Existing Hosted Auth convenience name. */
     disableHostedApplication(id: string, opts?: XKOVAMutationOptions): Promise<void>;
     configureOidcApplication(body: ReqBody<'configureMemberAuthOidcApplication'>, opts?: XKOVAMutationOptions): Promise<{
         id: string;

package/dist/resources/tenant.js

@@ -15,9 +15,14 @@ export class TenantResource extends Resource {
     updateHostedApplication(id, body, opts) {
         return this.patchJson(`/tenant/member-auth/applications/${this.enc(id)}`, body, opts);
     }
-    disableHostedApplication(id, opts) {
+    /** Disables the exact Hosted Auth or OIDC member application. */
+    disableMemberAuthApplication(id, opts) {
         return this.deleteJson(`/tenant/member-auth/applications/${this.enc(id)}`, opts);
     }
+    /** Existing Hosted Auth convenience name. */
+    disableHostedApplication(id, opts) {
+        return this.disableMemberAuthApplication(id, opts);
+    }
     configureOidcApplication(body, opts) {
         return this.putJson('/tenant/member-auth/application', body, opts);
     }

package/dist/resources/tokenization.d.ts

@@ -186,6 +186,9 @@ export declare class TokenizationResource extends Resource {
         raw_contract: string | null;
         raw_function: string | null;
         raw_args: string[] | null;
+        failure_reason_code: string | null;
+        failure_reason_detail: string | null;
+        failure_retryable: boolean;
         created_at: string;
         updated_at: string;
     }>;
@@ -222,6 +225,9 @@ export declare class TokenizationResource extends Resource {
         raw_contract: string | null;
         raw_function: string | null;
         raw_args: string[] | null;
+        failure_reason_code: string | null;
+        failure_reason_detail: string | null;
+        failure_retryable: boolean;
         created_at: string;
         updated_at: string;
     }>;
@@ -261,6 +267,9 @@ export declare class TokenizationResource extends Resource {
         raw_contract: string | null;
         raw_function: string | null;
         raw_args: string[] | null;
+        failure_reason_code: string | null;
+        failure_reason_detail: string | null;
+        failure_retryable: boolean;
         created_at: string;
         updated_at: string;
     }>;
@@ -292,6 +301,9 @@ export declare class TokenizationResource extends Resource {
         raw_contract: string | null;
         raw_function: string | null;
         raw_args: string[] | null;
+        failure_reason_code: string | null;
+        failure_reason_detail: string | null;
+        failure_retryable: boolean;
         created_at: string;
         updated_at: string;
     }>;
@@ -323,6 +335,9 @@ export declare class TokenizationResource extends Resource {
         raw_contract: string | null;
         raw_function: string | null;
         raw_args: string[] | null;
+        failure_reason_code: string | null;
+        failure_reason_detail: string | null;
+        failure_retryable: boolean;
         created_at: string;
         updated_at: string;
     }>;