agentmail 0.5.15 → 0.5.17

package/dist/esm/api/resources/apiKeys/client/Client.mjs

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { normalizeClientOptionsWithAuth } from "../../../../BaseClient.mjs";
-import { mergeHeaders } from "../../../../core/headers.mjs";
+import { mergeHeaders, mergeOnlyDefinedHeaders } from "../../../../core/headers.mjs";
 import * as core from "../../../../core/index.mjs";
 import * as environments from "../../../../environments.mjs";
 import { handleNonStatusCodeError } from "../../../../errors/handleNonStatusCodeError.mjs";
@@ -211,4 +211,376 @@ export class ApiKeysClient {
             return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v0/api-keys/{api_key_id}");
         });
     }
+    /**
+     * List only public-key credentials visible to the bearer caller's scope.
+     * Bearer credentials are never returned, even though both credential types
+     * share storage and pagination indexes. Requires `api_key_read`.
+     *
+     * @param {AgentMail.ListPublicKeysRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @example
+     *     await client.apiKeys.listPublicKeys()
+     */
+    listPublicKeys(request = {}, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__listPublicKeys(request, requestOptions));
+    }
+    __listPublicKeys() {
+        return __awaiter(this, arguments, void 0, function* (request = {}, requestOptions) {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const { limit, pageToken, ascending } = request;
+            const _queryParams = {
+                limit,
+                page_token: pageToken,
+                ascending,
+            };
+            const _authRequest = yield this._options.authProvider.getAuthRequest();
+            const _headers = mergeHeaders(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+            const _response = yield core.fetcher({
+                url: core.url.join((_b = (yield core.Supplier.get(this._options.baseUrl))) !== null && _b !== void 0 ? _b : ((_c = (yield core.Supplier.get(this._options.environment))) !== null && _c !== void 0 ? _c : environments.AgentMailEnvironment.Prod)
+                    .http, "/v0/api-keys/public-keys"),
+                method: "GET",
+                headers: _headers,
+                queryParameters: Object.assign(Object.assign({}, _queryParams), requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams),
+                timeoutMs: ((_f = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _d !== void 0 ? _d : (_e = this._options) === null || _e === void 0 ? void 0 : _e.timeoutInSeconds) !== null && _f !== void 0 ? _f : 60) * 1000,
+                maxRetries: (_g = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _g !== void 0 ? _g : (_h = this._options) === null || _h === void 0 ? void 0 : _h.maxRetries,
+                abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                fetchFn: (_j = this._options) === null || _j === void 0 ? void 0 : _j.fetch,
+                logging: this._options.logging,
+            });
+            if (_response.ok) {
+                return {
+                    data: serializers.ListPublicKeysResponse.parseOrThrow(_response.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }),
+                    rawResponse: _response.rawResponse,
+                };
+            }
+            if (_response.error.reason === "status-code") {
+                throw new errors.AgentMailError({
+                    statusCode: _response.error.statusCode,
+                    body: _response.error.body,
+                    rawResponse: _response.rawResponse,
+                });
+            }
+            return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v0/api-keys/public-keys");
+        });
+    }
+    /**
+     * Register a public P-256 JWK using an existing AgentMail bearer API key
+     * with `api_key_create`. Re-registering the same JWK creates a new
+     * credential ID; it does not replace or recover an earlier credential.
+     * The private key must never be sent to AgentMail.
+     *
+     * @param {AgentMail.CreatePublicKeyRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.ConflictError}
+     *
+     * @example
+     *     await client.apiKeys.createPublicKey({
+     *         publicKey: {
+     *             kty: "EC",
+     *             crv: "P-256",
+     *             x: "blackcurrant...............................",
+     *             y: "blackcurrant..............................."
+     *         }
+     *     })
+     */
+    createPublicKey(request, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__createPublicKey(request, requestOptions));
+    }
+    __createPublicKey(request, requestOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const _authRequest = yield this._options.authProvider.getAuthRequest();
+            const _headers = mergeHeaders(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+            const _response = yield core.fetcher({
+                url: core.url.join((_b = (yield core.Supplier.get(this._options.baseUrl))) !== null && _b !== void 0 ? _b : ((_c = (yield core.Supplier.get(this._options.environment))) !== null && _c !== void 0 ? _c : environments.AgentMailEnvironment.Prod)
+                    .http, "/v0/api-keys/public-keys"),
+                method: "POST",
+                headers: _headers,
+                contentType: "application/json",
+                queryParameters: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams,
+                requestType: "json",
+                body: serializers.CreatePublicKeyRequest.jsonOrThrow(request, {
+                    unrecognizedObjectKeys: "strip",
+                    omitUndefined: true,
+                }),
+                timeoutMs: ((_f = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _d !== void 0 ? _d : (_e = this._options) === null || _e === void 0 ? void 0 : _e.timeoutInSeconds) !== null && _f !== void 0 ? _f : 60) * 1000,
+                maxRetries: (_g = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _g !== void 0 ? _g : (_h = this._options) === null || _h === void 0 ? void 0 : _h.maxRetries,
+                abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                fetchFn: (_j = this._options) === null || _j === void 0 ? void 0 : _j.fetch,
+                logging: this._options.logging,
+            });
+            if (_response.ok) {
+                return {
+                    data: serializers.PublicKeyCredential.parseOrThrow(_response.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }),
+                    rawResponse: _response.rawResponse,
+                };
+            }
+            if (_response.error.reason === "status-code") {
+                switch (_response.error.statusCode) {
+                    case 400:
+                        throw new AgentMail.ValidationError(serializers.ValidationErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    case 409:
+                        throw new AgentMail.ConflictError(serializers.ErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    default:
+                        throw new errors.AgentMailError({
+                            statusCode: _response.error.statusCode,
+                            body: _response.error.body,
+                            rawResponse: _response.rawResponse,
+                        });
+                }
+            }
+            return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v0/api-keys/public-keys");
+        });
+    }
+    /**
+     * Rename the credential. All security-relevant fields are immutable.
+     * Requires `api_key_update`.
+     *
+     * @param {string} api_key_id - Public-key credential ID returned by registration.
+     * @param {AgentMail.UpdatePublicKeyNameRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.NotFoundError}
+     *
+     * @example
+     *     await client.apiKeys.updatePublicKeyName("d5e9c84f-c2b2-4bf4-b4b0-7ffd7a9ffc32", {
+     *         name: "x"
+     *     })
+     */
+    updatePublicKeyName(api_key_id, request, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__updatePublicKeyName(api_key_id, request, requestOptions));
+    }
+    __updatePublicKeyName(api_key_id, request, requestOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const _authRequest = yield this._options.authProvider.getAuthRequest();
+            const _headers = mergeHeaders(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+            const _response = yield core.fetcher({
+                url: core.url.join((_b = (yield core.Supplier.get(this._options.baseUrl))) !== null && _b !== void 0 ? _b : ((_c = (yield core.Supplier.get(this._options.environment))) !== null && _c !== void 0 ? _c : environments.AgentMailEnvironment.Prod)
+                    .http, `/v0/api-keys/public-keys/${core.url.encodePathParam(api_key_id)}`),
+                method: "PATCH",
+                headers: _headers,
+                contentType: "application/json",
+                queryParameters: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams,
+                requestType: "json",
+                body: serializers.UpdatePublicKeyNameRequest.jsonOrThrow(request, {
+                    unrecognizedObjectKeys: "strip",
+                    omitUndefined: true,
+                }),
+                timeoutMs: ((_f = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _d !== void 0 ? _d : (_e = this._options) === null || _e === void 0 ? void 0 : _e.timeoutInSeconds) !== null && _f !== void 0 ? _f : 60) * 1000,
+                maxRetries: (_g = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _g !== void 0 ? _g : (_h = this._options) === null || _h === void 0 ? void 0 : _h.maxRetries,
+                abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                fetchFn: (_j = this._options) === null || _j === void 0 ? void 0 : _j.fetch,
+                logging: this._options.logging,
+            });
+            if (_response.ok) {
+                return {
+                    data: serializers.PublicKeyCredential.parseOrThrow(_response.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }),
+                    rawResponse: _response.rawResponse,
+                };
+            }
+            if (_response.error.reason === "status-code") {
+                switch (_response.error.statusCode) {
+                    case 400:
+                        throw new AgentMail.ValidationError(serializers.ValidationErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    case 404:
+                        throw new AgentMail.NotFoundError(serializers.ErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    default:
+                        throw new errors.AgentMailError({
+                            statusCode: _response.error.statusCode,
+                            body: _response.error.body,
+                            rawResponse: _response.rawResponse,
+                        });
+                }
+            }
+            return handleNonStatusCodeError(_response.error, _response.rawResponse, "PATCH", "/v0/api-keys/public-keys/{api_key_id}");
+        });
+    }
+    /**
+     * Permanently revoke one public-key credential. This hard-deletes the
+     * credential; repeating the request returns not found. Requires
+     * `api_key_delete`.
+     *
+     * @param {string} api_key_id - Public-key credential ID returned by registration.
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.NotFoundError}
+     *
+     * @example
+     *     await client.apiKeys.revokePublicKey("d5e9c84f-c2b2-4bf4-b4b0-7ffd7a9ffc32")
+     */
+    revokePublicKey(api_key_id, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__revokePublicKey(api_key_id, requestOptions));
+    }
+    __revokePublicKey(api_key_id, requestOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const _authRequest = yield this._options.authProvider.getAuthRequest();
+            const _headers = mergeHeaders(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+            const _response = yield core.fetcher({
+                url: core.url.join((_b = (yield core.Supplier.get(this._options.baseUrl))) !== null && _b !== void 0 ? _b : ((_c = (yield core.Supplier.get(this._options.environment))) !== null && _c !== void 0 ? _c : environments.AgentMailEnvironment.Prod)
+                    .http, `/v0/api-keys/public-keys/${core.url.encodePathParam(api_key_id)}`),
+                method: "DELETE",
+                headers: _headers,
+                queryParameters: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams,
+                timeoutMs: ((_f = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _d !== void 0 ? _d : (_e = this._options) === null || _e === void 0 ? void 0 : _e.timeoutInSeconds) !== null && _f !== void 0 ? _f : 60) * 1000,
+                maxRetries: (_g = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _g !== void 0 ? _g : (_h = this._options) === null || _h === void 0 ? void 0 : _h.maxRetries,
+                abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                fetchFn: (_j = this._options) === null || _j === void 0 ? void 0 : _j.fetch,
+                logging: this._options.logging,
+            });
+            if (_response.ok) {
+                return { data: undefined, rawResponse: _response.rawResponse };
+            }
+            if (_response.error.reason === "status-code") {
+                switch (_response.error.statusCode) {
+                    case 404:
+                        throw new AgentMail.NotFoundError(serializers.ErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    default:
+                        throw new errors.AgentMailError({
+                            statusCode: _response.error.statusCode,
+                            body: _response.error.body,
+                            rawResponse: _response.rawResponse,
+                        });
+                }
+            }
+            return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v0/api-keys/public-keys/{api_key_id}");
+        });
+    }
+    /**
+     * Invalidate every current public-key credential in the caller's
+     * organization by advancing its AgentID key generation. The caller must be
+     * organization-scoped and either have `api_key_delete` or, for a verified
+     * self-serve agent organization, use an unrestricted unmanaged bearer
+     * credential. No request body is accepted.
+     *
+     * `Idempotency-Key` is required and must be a UUID. Reusing the same UUID
+     * returns the original permanent receipt without advancing the generation
+     * again. A new UUID performs a new generation advance.
+     *
+     * @param {AgentMail.RevokeAllAgentIdSignInKeysRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.ConflictError}
+     *
+     * @example
+     *     await client.apiKeys.revokeAllAgentIdSignInKeys({
+     *         idempotencyKey: "Idempotency-Key"
+     *     })
+     */
+    revokeAllAgentIdSignInKeys(request, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__revokeAllAgentIdSignInKeys(request, requestOptions));
+    }
+    __revokeAllAgentIdSignInKeys(request, requestOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const { idempotencyKey } = request;
+            const _authRequest = yield this._options.authProvider.getAuthRequest();
+            const _headers = mergeHeaders(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, mergeOnlyDefinedHeaders({ "Idempotency-Key": idempotencyKey }), requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+            const _response = yield core.fetcher({
+                url: core.url.join((_b = (yield core.Supplier.get(this._options.baseUrl))) !== null && _b !== void 0 ? _b : ((_c = (yield core.Supplier.get(this._options.environment))) !== null && _c !== void 0 ? _c : environments.AgentMailEnvironment.Prod)
+                    .http, "/v0/api-keys/public-keys/agentid-sign-in/revoke-all"),
+                method: "POST",
+                headers: _headers,
+                queryParameters: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams,
+                timeoutMs: ((_f = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _d !== void 0 ? _d : (_e = this._options) === null || _e === void 0 ? void 0 : _e.timeoutInSeconds) !== null && _f !== void 0 ? _f : 60) * 1000,
+                maxRetries: (_g = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _g !== void 0 ? _g : (_h = this._options) === null || _h === void 0 ? void 0 : _h.maxRetries,
+                abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                fetchFn: (_j = this._options) === null || _j === void 0 ? void 0 : _j.fetch,
+                logging: this._options.logging,
+            });
+            if (_response.ok) {
+                return {
+                    data: serializers.RevokeAllAgentIdSignInKeysResponse.parseOrThrow(_response.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }),
+                    rawResponse: _response.rawResponse,
+                };
+            }
+            if (_response.error.reason === "status-code") {
+                switch (_response.error.statusCode) {
+                    case 400:
+                        throw new AgentMail.ValidationError(serializers.ValidationErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    case 409:
+                        throw new AgentMail.ConflictError(serializers.ErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    default:
+                        throw new errors.AgentMailError({
+                            statusCode: _response.error.statusCode,
+                            body: _response.error.body,
+                            rawResponse: _response.rawResponse,
+                        });
+                }
+            }
+            return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v0/api-keys/public-keys/agentid-sign-in/revoke-all");
+        });
+    }
 }

package/dist/esm/api/resources/apiKeys/client/requests/ListPublicKeysRequest.d.mts

@@ -0,0 +1,10 @@
+import type * as AgentMail from "../../../../index.mjs";
+/**
+ * @example
+ *     {}
+ */
+export interface ListPublicKeysRequest {
+    limit?: AgentMail.Limit;
+    pageToken?: AgentMail.PageToken;
+    ascending?: AgentMail.Ascending;
+}

package/dist/esm/api/resources/apiKeys/client/requests/RevokeAllAgentIdSignInKeysRequest.d.mts

@@ -0,0 +1,10 @@
+/**
+ * @example
+ *     {
+ *         idempotencyKey: "Idempotency-Key"
+ *     }
+ */
+export interface RevokeAllAgentIdSignInKeysRequest {
+    /** Required UUID identifying this revoke-all operation permanently. */
+    idempotencyKey: string;
+}

package/dist/esm/api/resources/apiKeys/client/requests/index.d.mts

@@ -1 +1,3 @@
 export type { ListApiKeysRequest } from "./ListApiKeysRequest.mjs";
+export type { ListPublicKeysRequest } from "./ListPublicKeysRequest.mjs";
+export type { RevokeAllAgentIdSignInKeysRequest } from "./RevokeAllAgentIdSignInKeysRequest.mjs";

package/dist/esm/api/resources/apiKeys/types/ApiKeyPermissions.d.mts

@@ -64,6 +64,8 @@ export interface ApiKeyPermissions {
     apiKeyRead?: boolean;
     /** Create API keys. */
     apiKeyCreate?: boolean;
+    /** Update API keys. */
+    apiKeyUpdate?: boolean;
     /** Delete API keys. */
     apiKeyDelete?: boolean;
     /** Read pods. */

package/dist/esm/api/resources/apiKeys/types/CreatePublicKeyRequest.d.mts

@@ -0,0 +1,21 @@
+import type * as AgentMail from "../../../index.mjs";
+/**
+ * Register only a public P-256 JWK. Credential type, `api_key_id`, sign-in
+ * eligibility, permissions, and generation are server-owned and are not
+ * request properties.
+ */
+export interface CreatePublicKeyRequest {
+    publicKey: AgentMail.PublicJwk;
+    /** Defaults to `AgentID key {first eight fingerprint characters}`. */
+    name?: string;
+    /**
+     * Omit to inherit the registering bearer key's exact scope. An explicit
+     * scope must be the caller's scope or a live descendant.
+     */
+    scope?: AgentMail.PublicKeyScope;
+    /**
+     * Future absolute expiry. Omit to inherit the registering bearer key's
+     * expiry. A child credential cannot outlive its creator.
+     */
+    expiresAt?: Date;
+}

package/dist/esm/api/resources/apiKeys/types/InboxPublicKeyScope.d.mts

@@ -0,0 +1,7 @@
+/**
+ * Authority over one live inbox incarnation.
+ */
+export interface InboxPublicKeyScope {
+    /** ID of the inbox. */
+    id: string;
+}

package/dist/esm/api/resources/apiKeys/types/InboxPublicKeyScope.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/apiKeys/types/ListPublicKeysResponse.d.mts

@@ -0,0 +1,7 @@
+import type * as AgentMail from "../../../index.mjs";
+export interface ListPublicKeysResponse {
+    count: AgentMail.Count;
+    nextPageToken?: AgentMail.PageToken;
+    /** Public-key credentials only, ordered by creation time descending by default. */
+    publicKeys: AgentMail.PublicKeyCredential[];
+}

package/dist/esm/api/resources/apiKeys/types/ListPublicKeysResponse.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/apiKeys/types/OrganizationPublicKeyScope.d.mts

@@ -0,0 +1,4 @@
+/**
+ * Organization-wide authority.
+ */
+export type OrganizationPublicKeyScope = {};

package/dist/esm/api/resources/apiKeys/types/OrganizationPublicKeyScope.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/apiKeys/types/PodPublicKeyScope.d.mts

@@ -0,0 +1,7 @@
+/**
+ * Authority over one live pod and its inboxes.
+ */
+export interface PodPublicKeyScope {
+    /** ID of the pod. */
+    id: string;
+}

package/dist/esm/api/resources/apiKeys/types/PodPublicKeyScope.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/apiKeys/types/PublicJwk.d.mts

@@ -0,0 +1,13 @@
+import type * as AgentMail from "../../../index.mjs";
+/**
+ * A public P-256 JWK. The object accepts exactly `kty`, `crv`, `x`, and `y`.
+ * Private key material such as `d`, embedded key IDs, and all other members
+ * are rejected. The server also rejects coordinates that are not a point on
+ * P-256.
+ */
+export interface PublicJwk {
+    kty: "EC";
+    crv: "P-256";
+    x: AgentMail.PublicJwkCoordinate;
+    y: AgentMail.PublicJwkCoordinate;
+}

package/dist/esm/api/resources/apiKeys/types/PublicJwk.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/apiKeys/types/PublicJwkCoordinate.d.mts

@@ -0,0 +1,4 @@
+/**
+ * A 32-byte P-256 coordinate encoded as unpadded base64url.
+ */
+export type PublicJwkCoordinate = string;

package/dist/esm/api/resources/apiKeys/types/PublicJwkCoordinate.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/apiKeys/types/PublicKeyCredential.d.mts

@@ -0,0 +1,22 @@
+import type * as AgentMail from "../../../index.mjs";
+/**
+ * An AgentID sign-in credential. `type` and `api_key_id` are server-owned;
+ * use `api_key_id` as the JWS `kid`. This response never contains a bearer
+ * secret or private key.
+ */
+export interface PublicKeyCredential {
+    /** Server-generated credential ID. Store this value as the signing key's `kid`. */
+    apiKeyId: string;
+    /** Server-owned credential discriminator. Callers cannot select or update it. */
+    type: "public_key";
+    /** Human-readable credential name. */
+    name: AgentMail.Name;
+    publicKey: AgentMail.PublicKeyMaterial;
+    scope: AgentMail.PublicKeyScope;
+    /** Immutable absolute expiry. Omitted when the credential does not expire. */
+    expiresAt?: Date;
+    /** Present when organization-wide revoke-all invalidated this credential generation. */
+    revokedAt?: Date;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/dist/esm/api/resources/apiKeys/types/PublicKeyCredential.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/apiKeys/types/PublicKeyMaterial.d.mts

@@ -0,0 +1,9 @@
+import type * as AgentMail from "../../../index.mjs";
+/**
+ * Registered public key material and its server-computed RFC 7638 thumbprint.
+ */
+export interface PublicKeyMaterial {
+    jwk: AgentMail.PublicJwk;
+    /** RFC 7638 SHA-256 JWK thumbprint encoded as unpadded base64url. */
+    fingerprint: string;
+}

package/dist/esm/api/resources/apiKeys/types/PublicKeyMaterial.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/apiKeys/types/PublicKeyScope.d.mts

@@ -0,0 +1,16 @@
+import type * as AgentMail from "../../../index.mjs";
+/**
+ * The immutable scope in which a public-key credential can approve AgentID sign-in.
+ */
+export type PublicKeyScope = AgentMail.PublicKeyScope.Organization | AgentMail.PublicKeyScope.Pod | AgentMail.PublicKeyScope.Inbox;
+export declare namespace PublicKeyScope {
+    interface Organization extends AgentMail.OrganizationPublicKeyScope {
+        type: "organization";
+    }
+    interface Pod extends AgentMail.PodPublicKeyScope {
+        type: "pod";
+    }
+    interface Inbox extends AgentMail.InboxPublicKeyScope {
+        type: "inbox";
+    }
+}

package/dist/esm/api/resources/apiKeys/types/PublicKeyScope.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/apiKeys/types/RevokeAllAgentIdSignInKeysResponse.d.mts

@@ -0,0 +1,8 @@
+/**
+ * Permanent idempotency receipt for an organization-wide AgentID sign-in key revocation.
+ */
+export interface RevokeAllAgentIdSignInKeysResponse {
+    previousGeneration: number;
+    currentGeneration: number;
+    revokedAt: Date;
+}

package/dist/esm/api/resources/apiKeys/types/RevokeAllAgentIdSignInKeysResponse.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/apiKeys/types/UpdatePublicKeyNameRequest.d.mts

@@ -0,0 +1,7 @@
+/**
+ * Rename a public-key credential. Key material, ID, type, scope, sign-in
+ * eligibility, permissions, generation, and expiry are immutable.
+ */
+export interface UpdatePublicKeyNameRequest {
+    name: string;
+}

package/dist/esm/api/resources/apiKeys/types/UpdatePublicKeyNameRequest.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/apiKeys/types/index.d.mts

@@ -4,6 +4,18 @@ export * from "./ApiKeyPermissions.mjs";
 export * from "./CreateApiKeyRequest.mjs";
 export * from "./CreateApiKeyResponse.mjs";
 export * from "./CreatedAt.mjs";
+export * from "./CreatePublicKeyRequest.mjs";
+export * from "./InboxPublicKeyScope.mjs";
 export * from "./ListApiKeysResponse.mjs";
+export * from "./ListPublicKeysResponse.mjs";
 export * from "./Name.mjs";
+export * from "./OrganizationPublicKeyScope.mjs";
+export * from "./PodPublicKeyScope.mjs";
 export * from "./Prefix.mjs";
+export * from "./PublicJwk.mjs";
+export * from "./PublicJwkCoordinate.mjs";
+export * from "./PublicKeyCredential.mjs";
+export * from "./PublicKeyMaterial.mjs";
+export * from "./PublicKeyScope.mjs";
+export * from "./RevokeAllAgentIdSignInKeysResponse.mjs";
+export * from "./UpdatePublicKeyNameRequest.mjs";