agentmail 0.5.15 → 0.5.17

package/dist/cjs/BaseClient.js

@@ -43,8 +43,8 @@ function normalizeClientOptions(options) {
     const headers = (0, headers_js_1.mergeHeaders)({
         "X-Fern-Language": "JavaScript",
         "X-Fern-SDK-Name": "agentmail",
-        "X-Fern-SDK-Version": "0.5.15",
-        "User-Agent": "agentmail/0.5.15",
+        "X-Fern-SDK-Version": "0.5.17",
+        "User-Agent": "agentmail/0.5.17",
         "X-Fern-Runtime": core.RUNTIME.type,
         "X-Fern-Runtime-Version": core.RUNTIME.version,
     }, options === null || options === void 0 ? void 0 : options.headers);

package/dist/cjs/api/resources/apiKeys/client/Client.d.ts

@@ -56,4 +56,98 @@ export declare class ApiKeysClient {
      */
     delete(api_key_id: AgentMail.ApiKeyId, requestOptions?: ApiKeysClient.RequestOptions): core.HttpResponsePromise<void>;
     private __delete;
+    /**
+     * List only public-key credentials visible to the bearer caller's scope.
+     * Bearer credentials are never returned, even though both credential types
+     * share storage and pagination indexes. Requires `api_key_read`.
+     *
+     * @param {AgentMail.ListPublicKeysRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @example
+     *     await client.apiKeys.listPublicKeys()
+     */
+    listPublicKeys(request?: AgentMail.ListPublicKeysRequest, requestOptions?: ApiKeysClient.RequestOptions): core.HttpResponsePromise<AgentMail.ListPublicKeysResponse>;
+    private __listPublicKeys;
+    /**
+     * Register a public P-256 JWK using an existing AgentMail bearer API key
+     * with `api_key_create`. Re-registering the same JWK creates a new
+     * credential ID; it does not replace or recover an earlier credential.
+     * The private key must never be sent to AgentMail.
+     *
+     * @param {AgentMail.CreatePublicKeyRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.ConflictError}
+     *
+     * @example
+     *     await client.apiKeys.createPublicKey({
+     *         publicKey: {
+     *             kty: "EC",
+     *             crv: "P-256",
+     *             x: "blackcurrant...............................",
+     *             y: "blackcurrant..............................."
+     *         }
+     *     })
+     */
+    createPublicKey(request: AgentMail.CreatePublicKeyRequest, requestOptions?: ApiKeysClient.RequestOptions): core.HttpResponsePromise<AgentMail.PublicKeyCredential>;
+    private __createPublicKey;
+    /**
+     * Rename the credential. All security-relevant fields are immutable.
+     * Requires `api_key_update`.
+     *
+     * @param {string} api_key_id - Public-key credential ID returned by registration.
+     * @param {AgentMail.UpdatePublicKeyNameRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.NotFoundError}
+     *
+     * @example
+     *     await client.apiKeys.updatePublicKeyName("d5e9c84f-c2b2-4bf4-b4b0-7ffd7a9ffc32", {
+     *         name: "x"
+     *     })
+     */
+    updatePublicKeyName(api_key_id: string, request: AgentMail.UpdatePublicKeyNameRequest, requestOptions?: ApiKeysClient.RequestOptions): core.HttpResponsePromise<AgentMail.PublicKeyCredential>;
+    private __updatePublicKeyName;
+    /**
+     * Permanently revoke one public-key credential. This hard-deletes the
+     * credential; repeating the request returns not found. Requires
+     * `api_key_delete`.
+     *
+     * @param {string} api_key_id - Public-key credential ID returned by registration.
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.NotFoundError}
+     *
+     * @example
+     *     await client.apiKeys.revokePublicKey("d5e9c84f-c2b2-4bf4-b4b0-7ffd7a9ffc32")
+     */
+    revokePublicKey(api_key_id: string, requestOptions?: ApiKeysClient.RequestOptions): core.HttpResponsePromise<void>;
+    private __revokePublicKey;
+    /**
+     * Invalidate every current public-key credential in the caller's
+     * organization by advancing its AgentID key generation. The caller must be
+     * organization-scoped and either have `api_key_delete` or, for a verified
+     * self-serve agent organization, use an unrestricted unmanaged bearer
+     * credential. No request body is accepted.
+     *
+     * `Idempotency-Key` is required and must be a UUID. Reusing the same UUID
+     * returns the original permanent receipt without advancing the generation
+     * again. A new UUID performs a new generation advance.
+     *
+     * @param {AgentMail.RevokeAllAgentIdSignInKeysRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.ConflictError}
+     *
+     * @example
+     *     await client.apiKeys.revokeAllAgentIdSignInKeys({
+     *         idempotencyKey: "Idempotency-Key"
+     *     })
+     */
+    revokeAllAgentIdSignInKeys(request: AgentMail.RevokeAllAgentIdSignInKeysRequest, requestOptions?: ApiKeysClient.RequestOptions): core.HttpResponsePromise<AgentMail.RevokeAllAgentIdSignInKeysResponse>;
+    private __revokeAllAgentIdSignInKeys;
 }

package/dist/cjs/api/resources/apiKeys/client/Client.js

@@ -247,5 +247,377 @@ class ApiKeysClient {
             return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "DELETE", "/v0/api-keys/{api_key_id}");
         });
     }
+    /**
+     * List only public-key credentials visible to the bearer caller's scope.
+     * Bearer credentials are never returned, even though both credential types
+     * share storage and pagination indexes. Requires `api_key_read`.
+     *
+     * @param {AgentMail.ListPublicKeysRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @example
+     *     await client.apiKeys.listPublicKeys()
+     */
+    listPublicKeys(request = {}, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__listPublicKeys(request, requestOptions));
+    }
+    __listPublicKeys() {
+        return __awaiter(this, arguments, void 0, function* (request = {}, requestOptions) {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const { limit, pageToken, ascending } = request;
+            const _queryParams = {
+                limit,
+                page_token: pageToken,
+                ascending,
+            };
+            const _authRequest = yield this._options.authProvider.getAuthRequest();
+            const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+            const _response = yield core.fetcher({
+                url: core.url.join((_b = (yield core.Supplier.get(this._options.baseUrl))) !== null && _b !== void 0 ? _b : ((_c = (yield core.Supplier.get(this._options.environment))) !== null && _c !== void 0 ? _c : environments.AgentMailEnvironment.Prod)
+                    .http, "/v0/api-keys/public-keys"),
+                method: "GET",
+                headers: _headers,
+                queryParameters: Object.assign(Object.assign({}, _queryParams), requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams),
+                timeoutMs: ((_f = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _d !== void 0 ? _d : (_e = this._options) === null || _e === void 0 ? void 0 : _e.timeoutInSeconds) !== null && _f !== void 0 ? _f : 60) * 1000,
+                maxRetries: (_g = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _g !== void 0 ? _g : (_h = this._options) === null || _h === void 0 ? void 0 : _h.maxRetries,
+                abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                fetchFn: (_j = this._options) === null || _j === void 0 ? void 0 : _j.fetch,
+                logging: this._options.logging,
+            });
+            if (_response.ok) {
+                return {
+                    data: serializers.ListPublicKeysResponse.parseOrThrow(_response.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }),
+                    rawResponse: _response.rawResponse,
+                };
+            }
+            if (_response.error.reason === "status-code") {
+                throw new errors.AgentMailError({
+                    statusCode: _response.error.statusCode,
+                    body: _response.error.body,
+                    rawResponse: _response.rawResponse,
+                });
+            }
+            return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "GET", "/v0/api-keys/public-keys");
+        });
+    }
+    /**
+     * Register a public P-256 JWK using an existing AgentMail bearer API key
+     * with `api_key_create`. Re-registering the same JWK creates a new
+     * credential ID; it does not replace or recover an earlier credential.
+     * The private key must never be sent to AgentMail.
+     *
+     * @param {AgentMail.CreatePublicKeyRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.ConflictError}
+     *
+     * @example
+     *     await client.apiKeys.createPublicKey({
+     *         publicKey: {
+     *             kty: "EC",
+     *             crv: "P-256",
+     *             x: "blackcurrant...............................",
+     *             y: "blackcurrant..............................."
+     *         }
+     *     })
+     */
+    createPublicKey(request, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__createPublicKey(request, requestOptions));
+    }
+    __createPublicKey(request, requestOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const _authRequest = yield this._options.authProvider.getAuthRequest();
+            const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+            const _response = yield core.fetcher({
+                url: core.url.join((_b = (yield core.Supplier.get(this._options.baseUrl))) !== null && _b !== void 0 ? _b : ((_c = (yield core.Supplier.get(this._options.environment))) !== null && _c !== void 0 ? _c : environments.AgentMailEnvironment.Prod)
+                    .http, "/v0/api-keys/public-keys"),
+                method: "POST",
+                headers: _headers,
+                contentType: "application/json",
+                queryParameters: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams,
+                requestType: "json",
+                body: serializers.CreatePublicKeyRequest.jsonOrThrow(request, {
+                    unrecognizedObjectKeys: "strip",
+                    omitUndefined: true,
+                }),
+                timeoutMs: ((_f = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _d !== void 0 ? _d : (_e = this._options) === null || _e === void 0 ? void 0 : _e.timeoutInSeconds) !== null && _f !== void 0 ? _f : 60) * 1000,
+                maxRetries: (_g = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _g !== void 0 ? _g : (_h = this._options) === null || _h === void 0 ? void 0 : _h.maxRetries,
+                abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                fetchFn: (_j = this._options) === null || _j === void 0 ? void 0 : _j.fetch,
+                logging: this._options.logging,
+            });
+            if (_response.ok) {
+                return {
+                    data: serializers.PublicKeyCredential.parseOrThrow(_response.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }),
+                    rawResponse: _response.rawResponse,
+                };
+            }
+            if (_response.error.reason === "status-code") {
+                switch (_response.error.statusCode) {
+                    case 400:
+                        throw new AgentMail.ValidationError(serializers.ValidationErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    case 409:
+                        throw new AgentMail.ConflictError(serializers.ErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    default:
+                        throw new errors.AgentMailError({
+                            statusCode: _response.error.statusCode,
+                            body: _response.error.body,
+                            rawResponse: _response.rawResponse,
+                        });
+                }
+            }
+            return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "POST", "/v0/api-keys/public-keys");
+        });
+    }
+    /**
+     * Rename the credential. All security-relevant fields are immutable.
+     * Requires `api_key_update`.
+     *
+     * @param {string} api_key_id - Public-key credential ID returned by registration.
+     * @param {AgentMail.UpdatePublicKeyNameRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.NotFoundError}
+     *
+     * @example
+     *     await client.apiKeys.updatePublicKeyName("d5e9c84f-c2b2-4bf4-b4b0-7ffd7a9ffc32", {
+     *         name: "x"
+     *     })
+     */
+    updatePublicKeyName(api_key_id, request, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__updatePublicKeyName(api_key_id, request, requestOptions));
+    }
+    __updatePublicKeyName(api_key_id, request, requestOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const _authRequest = yield this._options.authProvider.getAuthRequest();
+            const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+            const _response = yield core.fetcher({
+                url: core.url.join((_b = (yield core.Supplier.get(this._options.baseUrl))) !== null && _b !== void 0 ? _b : ((_c = (yield core.Supplier.get(this._options.environment))) !== null && _c !== void 0 ? _c : environments.AgentMailEnvironment.Prod)
+                    .http, `/v0/api-keys/public-keys/${core.url.encodePathParam(api_key_id)}`),
+                method: "PATCH",
+                headers: _headers,
+                contentType: "application/json",
+                queryParameters: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams,
+                requestType: "json",
+                body: serializers.UpdatePublicKeyNameRequest.jsonOrThrow(request, {
+                    unrecognizedObjectKeys: "strip",
+                    omitUndefined: true,
+                }),
+                timeoutMs: ((_f = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _d !== void 0 ? _d : (_e = this._options) === null || _e === void 0 ? void 0 : _e.timeoutInSeconds) !== null && _f !== void 0 ? _f : 60) * 1000,
+                maxRetries: (_g = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _g !== void 0 ? _g : (_h = this._options) === null || _h === void 0 ? void 0 : _h.maxRetries,
+                abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                fetchFn: (_j = this._options) === null || _j === void 0 ? void 0 : _j.fetch,
+                logging: this._options.logging,
+            });
+            if (_response.ok) {
+                return {
+                    data: serializers.PublicKeyCredential.parseOrThrow(_response.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }),
+                    rawResponse: _response.rawResponse,
+                };
+            }
+            if (_response.error.reason === "status-code") {
+                switch (_response.error.statusCode) {
+                    case 400:
+                        throw new AgentMail.ValidationError(serializers.ValidationErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    case 404:
+                        throw new AgentMail.NotFoundError(serializers.ErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    default:
+                        throw new errors.AgentMailError({
+                            statusCode: _response.error.statusCode,
+                            body: _response.error.body,
+                            rawResponse: _response.rawResponse,
+                        });
+                }
+            }
+            return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "PATCH", "/v0/api-keys/public-keys/{api_key_id}");
+        });
+    }
+    /**
+     * Permanently revoke one public-key credential. This hard-deletes the
+     * credential; repeating the request returns not found. Requires
+     * `api_key_delete`.
+     *
+     * @param {string} api_key_id - Public-key credential ID returned by registration.
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.NotFoundError}
+     *
+     * @example
+     *     await client.apiKeys.revokePublicKey("d5e9c84f-c2b2-4bf4-b4b0-7ffd7a9ffc32")
+     */
+    revokePublicKey(api_key_id, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__revokePublicKey(api_key_id, requestOptions));
+    }
+    __revokePublicKey(api_key_id, requestOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const _authRequest = yield this._options.authProvider.getAuthRequest();
+            const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+            const _response = yield core.fetcher({
+                url: core.url.join((_b = (yield core.Supplier.get(this._options.baseUrl))) !== null && _b !== void 0 ? _b : ((_c = (yield core.Supplier.get(this._options.environment))) !== null && _c !== void 0 ? _c : environments.AgentMailEnvironment.Prod)
+                    .http, `/v0/api-keys/public-keys/${core.url.encodePathParam(api_key_id)}`),
+                method: "DELETE",
+                headers: _headers,
+                queryParameters: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams,
+                timeoutMs: ((_f = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _d !== void 0 ? _d : (_e = this._options) === null || _e === void 0 ? void 0 : _e.timeoutInSeconds) !== null && _f !== void 0 ? _f : 60) * 1000,
+                maxRetries: (_g = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _g !== void 0 ? _g : (_h = this._options) === null || _h === void 0 ? void 0 : _h.maxRetries,
+                abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                fetchFn: (_j = this._options) === null || _j === void 0 ? void 0 : _j.fetch,
+                logging: this._options.logging,
+            });
+            if (_response.ok) {
+                return { data: undefined, rawResponse: _response.rawResponse };
+            }
+            if (_response.error.reason === "status-code") {
+                switch (_response.error.statusCode) {
+                    case 404:
+                        throw new AgentMail.NotFoundError(serializers.ErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    default:
+                        throw new errors.AgentMailError({
+                            statusCode: _response.error.statusCode,
+                            body: _response.error.body,
+                            rawResponse: _response.rawResponse,
+                        });
+                }
+            }
+            return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "DELETE", "/v0/api-keys/public-keys/{api_key_id}");
+        });
+    }
+    /**
+     * Invalidate every current public-key credential in the caller's
+     * organization by advancing its AgentID key generation. The caller must be
+     * organization-scoped and either have `api_key_delete` or, for a verified
+     * self-serve agent organization, use an unrestricted unmanaged bearer
+     * credential. No request body is accepted.
+     *
+     * `Idempotency-Key` is required and must be a UUID. Reusing the same UUID
+     * returns the original permanent receipt without advancing the generation
+     * again. A new UUID performs a new generation advance.
+     *
+     * @param {AgentMail.RevokeAllAgentIdSignInKeysRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.ConflictError}
+     *
+     * @example
+     *     await client.apiKeys.revokeAllAgentIdSignInKeys({
+     *         idempotencyKey: "Idempotency-Key"
+     *     })
+     */
+    revokeAllAgentIdSignInKeys(request, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__revokeAllAgentIdSignInKeys(request, requestOptions));
+    }
+    __revokeAllAgentIdSignInKeys(request, requestOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const { idempotencyKey } = request;
+            const _authRequest = yield this._options.authProvider.getAuthRequest();
+            const _headers = (0, headers_js_1.mergeHeaders)(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, (0, headers_js_1.mergeOnlyDefinedHeaders)({ "Idempotency-Key": idempotencyKey }), requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+            const _response = yield core.fetcher({
+                url: core.url.join((_b = (yield core.Supplier.get(this._options.baseUrl))) !== null && _b !== void 0 ? _b : ((_c = (yield core.Supplier.get(this._options.environment))) !== null && _c !== void 0 ? _c : environments.AgentMailEnvironment.Prod)
+                    .http, "/v0/api-keys/public-keys/agentid-sign-in/revoke-all"),
+                method: "POST",
+                headers: _headers,
+                queryParameters: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams,
+                timeoutMs: ((_f = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _d !== void 0 ? _d : (_e = this._options) === null || _e === void 0 ? void 0 : _e.timeoutInSeconds) !== null && _f !== void 0 ? _f : 60) * 1000,
+                maxRetries: (_g = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _g !== void 0 ? _g : (_h = this._options) === null || _h === void 0 ? void 0 : _h.maxRetries,
+                abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                fetchFn: (_j = this._options) === null || _j === void 0 ? void 0 : _j.fetch,
+                logging: this._options.logging,
+            });
+            if (_response.ok) {
+                return {
+                    data: serializers.RevokeAllAgentIdSignInKeysResponse.parseOrThrow(_response.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }),
+                    rawResponse: _response.rawResponse,
+                };
+            }
+            if (_response.error.reason === "status-code") {
+                switch (_response.error.statusCode) {
+                    case 400:
+                        throw new AgentMail.ValidationError(serializers.ValidationErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    case 409:
+                        throw new AgentMail.ConflictError(serializers.ErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    default:
+                        throw new errors.AgentMailError({
+                            statusCode: _response.error.statusCode,
+                            body: _response.error.body,
+                            rawResponse: _response.rawResponse,
+                        });
+                }
+            }
+            return (0, handleNonStatusCodeError_js_1.handleNonStatusCodeError)(_response.error, _response.rawResponse, "POST", "/v0/api-keys/public-keys/agentid-sign-in/revoke-all");
+        });
+    }
 }
 exports.ApiKeysClient = ApiKeysClient;

package/dist/cjs/api/resources/apiKeys/client/requests/ListPublicKeysRequest.d.ts

@@ -0,0 +1,10 @@
+import type * as AgentMail from "../../../../index.js";
+/**
+ * @example
+ *     {}
+ */
+export interface ListPublicKeysRequest {
+    limit?: AgentMail.Limit;
+    pageToken?: AgentMail.PageToken;
+    ascending?: AgentMail.Ascending;
+}

package/dist/cjs/api/resources/apiKeys/client/requests/RevokeAllAgentIdSignInKeysRequest.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @example
+ *     {
+ *         idempotencyKey: "Idempotency-Key"
+ *     }
+ */
+export interface RevokeAllAgentIdSignInKeysRequest {
+    /** Required UUID identifying this revoke-all operation permanently. */
+    idempotencyKey: string;
+}

package/dist/cjs/api/resources/apiKeys/client/requests/index.d.ts

@@ -1 +1,3 @@
 export type { ListApiKeysRequest } from "./ListApiKeysRequest.js";
+export type { ListPublicKeysRequest } from "./ListPublicKeysRequest.js";
+export type { RevokeAllAgentIdSignInKeysRequest } from "./RevokeAllAgentIdSignInKeysRequest.js";

package/dist/cjs/api/resources/apiKeys/types/ApiKeyPermissions.d.ts

@@ -64,6 +64,8 @@ export interface ApiKeyPermissions {
     apiKeyRead?: boolean;
     /** Create API keys. */
     apiKeyCreate?: boolean;
+    /** Update API keys. */
+    apiKeyUpdate?: boolean;
     /** Delete API keys. */
     apiKeyDelete?: boolean;
     /** Read pods. */

package/dist/cjs/api/resources/apiKeys/types/CreatePublicKeyRequest.d.ts

@@ -0,0 +1,21 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * Register only a public P-256 JWK. Credential type, `api_key_id`, sign-in
+ * eligibility, permissions, and generation are server-owned and are not
+ * request properties.
+ */
+export interface CreatePublicKeyRequest {
+    publicKey: AgentMail.PublicJwk;
+    /** Defaults to `AgentID key {first eight fingerprint characters}`. */
+    name?: string;
+    /**
+     * Omit to inherit the registering bearer key's exact scope. An explicit
+     * scope must be the caller's scope or a live descendant.
+     */
+    scope?: AgentMail.PublicKeyScope;
+    /**
+     * Future absolute expiry. Omit to inherit the registering bearer key's
+     * expiry. A child credential cannot outlive its creator.
+     */
+    expiresAt?: Date;
+}

package/dist/cjs/api/resources/apiKeys/types/InboxPublicKeyScope.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Authority over one live inbox incarnation.
+ */
+export interface InboxPublicKeyScope {
+    /** ID of the inbox. */
+    id: string;
+}

package/dist/cjs/api/resources/apiKeys/types/InboxPublicKeyScope.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/apiKeys/types/ListPublicKeysResponse.d.ts

@@ -0,0 +1,7 @@
+import type * as AgentMail from "../../../index.js";
+export interface ListPublicKeysResponse {
+    count: AgentMail.Count;
+    nextPageToken?: AgentMail.PageToken;
+    /** Public-key credentials only, ordered by creation time descending by default. */
+    publicKeys: AgentMail.PublicKeyCredential[];
+}

package/dist/cjs/api/resources/apiKeys/types/ListPublicKeysResponse.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/apiKeys/types/OrganizationPublicKeyScope.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Organization-wide authority.
+ */
+export type OrganizationPublicKeyScope = {};

package/dist/cjs/api/resources/apiKeys/types/OrganizationPublicKeyScope.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/apiKeys/types/PodPublicKeyScope.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Authority over one live pod and its inboxes.
+ */
+export interface PodPublicKeyScope {
+    /** ID of the pod. */
+    id: string;
+}

package/dist/cjs/api/resources/apiKeys/types/PodPublicKeyScope.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/apiKeys/types/PublicJwk.d.ts

@@ -0,0 +1,13 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * A public P-256 JWK. The object accepts exactly `kty`, `crv`, `x`, and `y`.
+ * Private key material such as `d`, embedded key IDs, and all other members
+ * are rejected. The server also rejects coordinates that are not a point on
+ * P-256.
+ */
+export interface PublicJwk {
+    kty: "EC";
+    crv: "P-256";
+    x: AgentMail.PublicJwkCoordinate;
+    y: AgentMail.PublicJwkCoordinate;
+}

package/dist/cjs/api/resources/apiKeys/types/PublicJwk.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/apiKeys/types/PublicJwkCoordinate.d.ts

@@ -0,0 +1,4 @@
+/**
+ * A 32-byte P-256 coordinate encoded as unpadded base64url.
+ */
+export type PublicJwkCoordinate = string;

package/dist/cjs/api/resources/apiKeys/types/PublicJwkCoordinate.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });