agentmail 0.5.23 → 0.5.25

package/dist/esm/api/resources/apiKeys/client/requests/ListApiKeysRequest.d.mts

@@ -4,6 +4,8 @@ import type * as AgentMail from "../../../../index.mjs";
  *     {}
  */
 export interface ListApiKeysRequest {
+    /** Restrict the list to one credential family. Omit for every family. */
+    type?: AgentMail.ApiKeyType;
     limit?: AgentMail.Limit;
     pageToken?: AgentMail.PageToken;
     ascending?: AgentMail.Ascending;

package/dist/esm/api/resources/apiKeys/client/requests/index.d.mts

@@ -1,6 +1 @@
 export type { ListApiKeysRequest } from "./ListApiKeysRequest.mjs";
-export type { ListBrowserConsentsRequest } from "./ListBrowserConsentsRequest.mjs";
-export type { ListBrowserCredentialEventsRequest } from "./ListBrowserCredentialEventsRequest.mjs";
-export type { ListBrowserCredentialsRequest } from "./ListBrowserCredentialsRequest.mjs";
-export type { ListPublicKeysRequest } from "./ListPublicKeysRequest.mjs";
-export type { RevokeAllAgentIdSignInKeysRequest } from "./RevokeAllAgentIdSignInKeysRequest.mjs";

package/dist/esm/api/resources/apiKeys/types/AcceptDisclosure.d.mts

@@ -0,0 +1,6 @@
+/**
+ * Accept the provider's disclosure on the agent's behalf, skipping the
+ * first-use disclosure page. Requires `provider_share_owner` when owner
+ * scopes are involved.
+ */
+export type AcceptDisclosure = boolean;

package/dist/esm/api/resources/apiKeys/types/ApiKey.d.mts

@@ -1,14 +1,7 @@
 import type * as AgentMail from "../../../index.mjs";
-export interface ApiKey {
-    apiKeyId: AgentMail.ApiKeyId;
-    prefix: AgentMail.Prefix;
-    name: AgentMail.Name;
-    /** Pod ID the api key is scoped to. If set, the key can only access resources within this pod. */
-    podId?: string;
-    /** Inbox ID the api key is scoped to. If set, the key can only access resources within this inbox. */
-    inboxId?: string;
-    /** Time at which api key was last used. */
-    usedAt?: Date;
-    permissions?: AgentMail.ApiKeyPermissions;
-    createdAt: AgentMail.CreatedAt;
-}
+/**
+ * One credential of any family. `type` is `bearer` or `public_key`. A
+ * public key carrying `status` is a sign-in key; one without it is a
+ * registered signing key.
+ */
+export type ApiKey = AgentMail.BearerApiKey | AgentMail.PublicKeyCredential;

package/dist/esm/api/resources/apiKeys/types/ApiKeyCreator.d.mts

@@ -0,0 +1,7 @@
+import type * as AgentMail from "../../../index.mjs";
+/**
+ * The bearer API key that created the credential. Provenance only; the credential outlives it.
+ */
+export interface ApiKeyCreator {
+    apiKeyId: AgentMail.ApiKeyId;
+}

package/dist/esm/api/resources/apiKeys/types/ApiKeyMutableFields.d.mts

@@ -0,0 +1,8 @@
+import type * as AgentMail from "../../../index.mjs";
+/**
+ * The fields a caller may set on a bearer key at creation and change afterward.
+ */
+export interface ApiKeyMutableFields {
+    name?: AgentMail.Name;
+    permissions?: AgentMail.ApiKeyPermissions;
+}

package/dist/esm/api/resources/apiKeys/types/ApiKeyPermissions.d.mts

@@ -68,6 +68,16 @@ export interface ApiKeyPermissions {
     apiKeyUpdate?: boolean;
     /** Delete API keys. */
     apiKeyDelete?: boolean;
+    /**
+     * Sign in to providers as an inbox: connect a provider, authorize an inbox, and mint the
+     * sign-in keys. Omitted on a new bearer key means false, whatever else the key holds.
+     */
+    providerConnect?: boolean;
+    /**
+     * Share the organization owner's name and email with providers at sign-in. One permission
+     * for both values.
+     */
+    providerShareOwner?: boolean;
     /** Read pods. */
     podRead?: boolean;
     /** Create pods. */

package/dist/esm/api/resources/apiKeys/types/ApiKeyType.d.mts

@@ -0,0 +1,5 @@
+export declare const ApiKeyType: {
+    readonly Bearer: "bearer";
+    readonly PublicKey: "public_key";
+};
+export type ApiKeyType = (typeof ApiKeyType)[keyof typeof ApiKeyType];

package/dist/esm/api/resources/apiKeys/types/ApiKeyType.mjs

@@ -0,0 +1,5 @@
+// This file was auto-generated by Fern from our API Definition.
+export const ApiKeyType = {
+    Bearer: "bearer",
+    PublicKey: "public_key",
+};

package/dist/esm/api/resources/apiKeys/types/AuthToken.d.mts

@@ -0,0 +1,4 @@
+/**
+ * Token identifying one pending AgentID sign-in, read from the sign-in action on exactly `https://auth.agentid.com`.
+ */
+export type AuthToken = string;

package/dist/esm/api/resources/apiKeys/types/BearerApiKey.d.mts

@@ -0,0 +1,17 @@
+import type * as AgentMail from "../../../index.mjs";
+/**
+ * An API key presented as a bearer token in the `Authorization` header.
+ */
+export interface BearerApiKey {
+    type: "bearer";
+    apiKeyId: AgentMail.ApiKeyId;
+    prefix: AgentMail.Prefix;
+    name: AgentMail.Name;
+    podId?: AgentMail.PodScopeId;
+    inboxId?: AgentMail.InboxScopeId;
+    usedAt?: AgentMail.UsedAt;
+    permissions?: AgentMail.ApiKeyPermissions;
+    createdAt: AgentMail.CreatedAt;
+    updatedAt: AgentMail.UpdatedAt;
+    expiresAt?: AgentMail.ExpiresAt;
+}

package/dist/esm/api/resources/apiKeys/types/CreateApiKeyRequest.d.mts

@@ -1,5 +1,6 @@
 import type * as AgentMail from "../../../index.mjs";
-export interface CreateApiKeyRequest {
-    name?: AgentMail.Name;
-    permissions?: AgentMail.ApiKeyPermissions;
-}
+/**
+ * A body with `public_key` registers a public-key credential; any other
+ * body mints a bearer key.
+ */
+export type CreateApiKeyRequest = AgentMail.CreateBearerApiKeyRequest | AgentMail.CreatePublicKeyRequest;

package/dist/esm/api/resources/apiKeys/types/CreateApiKeyResponse.d.mts

@@ -5,10 +5,8 @@ export interface CreateApiKeyResponse {
     apiKey: string;
     prefix: AgentMail.Prefix;
     name: AgentMail.Name;
-    /** Pod ID the api key is scoped to. */
-    podId?: string;
-    /** Inbox ID the api key is scoped to. */
-    inboxId?: string;
+    podId?: AgentMail.PodScopeId;
+    inboxId?: AgentMail.InboxScopeId;
     permissions?: AgentMail.ApiKeyPermissions;
     createdAt: AgentMail.CreatedAt;
 }

package/dist/esm/api/resources/apiKeys/types/CreateApiKeyResult.d.mts

@@ -0,0 +1,5 @@
+import type * as AgentMail from "../../../index.mjs";
+/**
+ * The secret-bearing bearer key, or the registered public key without any secret.
+ */
+export type CreateApiKeyResult = AgentMail.CreateApiKeyResponse | AgentMail.PublicKeyCredential;

package/dist/esm/api/resources/apiKeys/types/CreateBearerApiKeyRequest.d.mts

@@ -0,0 +1,3 @@
+import type * as AgentMail from "../../../index.mjs";
+export interface CreateBearerApiKeyRequest extends AgentMail.ApiKeyMutableFields {
+}

package/dist/esm/api/resources/apiKeys/types/CreatePublicKeyRequest.d.mts

@@ -1,21 +1,16 @@
 import type * as AgentMail from "../../../index.mjs";
 /**
- * Register only a public P-256 JWK. Credential type, `api_key_id`, sign-in
- * eligibility, permissions, and generation are server-owned and are not
- * request properties.
+ * Registers a public P-256 JWK at the route's scope. `type` and
+ * `api_key_id` are server-owned. `name` defaults to
+ * `AgentID key {first eight fingerprint characters}`; `permissions`
+ * defaults to the registering key's, and only grants it holds may be
+ * true; `expires_at` defaults to the registering key's expiry and is
+ * independent of that key afterward.
  */
 export interface CreatePublicKeyRequest {
     publicKey: AgentMail.PublicJwk;
-    /** Defaults to `AgentID key {first eight fingerprint characters}`. */
-    name?: string;
-    /**
-     * Omit to inherit the registering bearer key's exact scope. An explicit
-     * scope must be the caller's scope or a live descendant.
-     */
-    scope?: AgentMail.PublicKeyScope;
-    /**
-     * Future absolute expiry. Omit to inherit the registering bearer key's
-     * expiry. A child credential cannot outlive its creator.
-     */
-    expiresAt?: Date;
+    clientId?: AgentMail.PublicKeyClientId;
+    name?: AgentMail.Name;
+    permissions?: AgentMail.ApiKeyPermissions;
+    expiresAt?: AgentMail.ExpiresAt;
 }

package/dist/esm/api/resources/apiKeys/types/ExpiresAt.d.mts

@@ -0,0 +1,4 @@
+/**
+ * Time at which api key expires. Omitted when it does not expire.
+ */
+export type ExpiresAt = Date;

package/dist/esm/api/resources/apiKeys/types/InboxScopeId.d.mts

@@ -0,0 +1,4 @@
+/**
+ * Inbox ID the api key is scoped to. If set, the key can only access resources within this inbox.
+ */
+export type InboxScopeId = string;

package/dist/esm/api/resources/apiKeys/types/ListApiKeysResponse.d.mts

@@ -2,6 +2,9 @@ import type * as AgentMail from "../../../index.mjs";
 export interface ListApiKeysResponse {
     count: AgentMail.Count;
     nextPageToken?: AgentMail.PageToken;
-    /** Ordered by `created_at` descending. */
+    /**
+     * Every credential family, ordered by `created_at`. `type` restricts
+     * to one family.
+     */
     apiKeys: AgentMail.ApiKey[];
 }

package/dist/esm/api/resources/apiKeys/types/PodScopeId.d.mts

@@ -0,0 +1,4 @@
+/**
+ * Pod ID the api key is scoped to. If set, the key can only access resources within this pod.
+ */
+export type PodScopeId = string;

package/dist/esm/api/resources/apiKeys/types/PublicKeyClientId.d.mts

@@ -0,0 +1,7 @@
+/**
+ * Caller-chosen alias for a public key, unique within the organization and
+ * reusable after deletion. Accepted in place of `api_key_id` on get, update,
+ * and delete. Registration is idempotent on it: the same alias returns the
+ * existing key, a conflicting one returns `409`. URL-safe; no slash or `@`.
+ */
+export type PublicKeyClientId = string;

package/dist/esm/api/resources/apiKeys/types/PublicKeyCredential.d.mts

@@ -1,22 +1,25 @@
 import type * as AgentMail from "../../../index.mjs";
 /**
- * An AgentID sign-in credential. `type` and `api_key_id` are server-owned;
- * use `api_key_id` as the JWS `kid`. This response never contains a bearer
- * secret or private key.
+ * An AgentID sign-in credential, scoped like a bearer key; `api_key_id` is
+ * the JWS `kid`. A sign-in key carries `status`, gains `public_key` once
+ * the client has proved it, expires 30 days after
+ * activation, and carries exactly `provider_connect` and
+ * `provider_share_owner`, snapshotted from the bearer key that created it
+ * and enforced from the key itself.
  */
 export interface PublicKeyCredential {
-    /** Server-generated credential ID. Store this value as the signing key's `kid`. */
-    apiKeyId: string;
-    /** Server-owned credential discriminator. Callers cannot select or update it. */
     type: "public_key";
-    /** Human-readable credential name. */
+    apiKeyId: AgentMail.ApiKeyId;
+    clientId?: AgentMail.PublicKeyClientId;
     name: AgentMail.Name;
-    publicKey: AgentMail.PublicKeyMaterial;
-    scope: AgentMail.PublicKeyScope;
-    /** Immutable absolute expiry. Omitted when the credential does not expire. */
-    expiresAt?: Date;
-    /** Present when organization-wide revoke-all invalidated this credential generation. */
-    revokedAt?: Date;
-    createdAt: Date;
-    updatedAt: Date;
+    publicKey?: AgentMail.PublicKeyMaterial;
+    podId?: AgentMail.PodScopeId;
+    inboxId?: AgentMail.InboxScopeId;
+    status?: AgentMail.PublicKeyStatus;
+    usedAt?: AgentMail.UsedAt;
+    permissions: AgentMail.ApiKeyPermissions;
+    createdBy: AgentMail.ApiKeyCreator;
+    createdAt: AgentMail.CreatedAt;
+    updatedAt: AgentMail.UpdatedAt;
+    expiresAt?: AgentMail.ExpiresAt;
 }

package/dist/esm/api/resources/apiKeys/types/PublicKeyStatus.d.mts

@@ -0,0 +1,10 @@
+/**
+ * Lifecycle of a sign-in key: `pending` until the client finishes
+ * creating it on the AgentID page, `active` once it can sign in as the
+ * inbox. Absent on a registered key.
+ */
+export declare const PublicKeyStatus: {
+    readonly Pending: "pending";
+    readonly Active: "active";
+};
+export type PublicKeyStatus = (typeof PublicKeyStatus)[keyof typeof PublicKeyStatus];

package/dist/esm/api/resources/apiKeys/types/PublicKeyStatus.mjs

@@ -0,0 +1,10 @@
+// This file was auto-generated by Fern from our API Definition.
+/**
+ * Lifecycle of a sign-in key: `pending` until the client finishes
+ * creating it on the AgentID page, `active` once it can sign in as the
+ * inbox. Absent on a registered key.
+ */
+export const PublicKeyStatus = {
+    Pending: "pending",
+    Active: "active",
+};

package/dist/esm/api/resources/apiKeys/types/UpdateApiKeyRequest.d.mts

@@ -0,0 +1,7 @@
+import type * as AgentMail from "../../../index.mjs";
+/**
+ * Rename a credential or change its permissions. Key material, type,
+ * scope, and expiry are immutable.
+ */
+export interface UpdateApiKeyRequest extends AgentMail.ApiKeyMutableFields {
+}

package/dist/esm/api/resources/apiKeys/types/UpdatedAt.d.mts

@@ -0,0 +1,4 @@
+/**
+ * Time at which api key was last updated.
+ */
+export type UpdatedAt = Date;

package/dist/esm/api/resources/apiKeys/types/UsedAt.d.mts

@@ -0,0 +1,4 @@
+/**
+ * Time at which api key was last used.
+ */
+export type UsedAt = Date;

package/dist/esm/api/resources/apiKeys/types/index.d.mts

@@ -1,39 +1,30 @@
+export * from "./AcceptDisclosure.mjs";
 export * from "./ApiKey.mjs";
+export * from "./ApiKeyCreator.mjs";
 export * from "./ApiKeyId.mjs";
+export * from "./ApiKeyMutableFields.mjs";
 export * from "./ApiKeyPermissions.mjs";
-export * from "./BrowserAuthorizationListLimit.mjs";
-export * from "./BrowserConsent.mjs";
-export * from "./BrowserConsentLifecycleEvent.mjs";
-export * from "./BrowserConsentLifecycleEventType.mjs";
-export * from "./BrowserCredential.mjs";
-export * from "./BrowserCredentialCreator.mjs";
-export * from "./BrowserEnrollmentAccepted.mjs";
-export * from "./BrowserEnrollmentLifecycleEvent.mjs";
-export * from "./BrowserEnrollmentLifecycleEventType.mjs";
-export * from "./BrowserEnrollmentTransactionJti.mjs";
-export * from "./BrowserLifecycleActor.mjs";
-export * from "./BrowserLifecycleApiKeyActor.mjs";
-export * from "./BrowserLifecycleCredentialActor.mjs";
-export * from "./BrowserLifecycleEvent.mjs";
+export * from "./ApiKeyType.mjs";
+export * from "./AuthToken.mjs";
+export * from "./BearerApiKey.mjs";
 export * from "./CreateApiKeyRequest.mjs";
 export * from "./CreateApiKeyResponse.mjs";
-export * from "./CreateBrowserEnrollmentRequest.mjs";
+export * from "./CreateApiKeyResult.mjs";
+export * from "./CreateBearerApiKeyRequest.mjs";
 export * from "./CreatedAt.mjs";
 export * from "./CreatePublicKeyRequest.mjs";
-export * from "./InboxPublicKeyScope.mjs";
+export * from "./ExpiresAt.mjs";
+export * from "./InboxScopeId.mjs";
 export * from "./ListApiKeysResponse.mjs";
-export * from "./ListBrowserConsentsResponse.mjs";
-export * from "./ListBrowserCredentialsResponse.mjs";
-export * from "./ListBrowserLifecycleEventsResponse.mjs";
-export * from "./ListPublicKeysResponse.mjs";
 export * from "./Name.mjs";
-export * from "./OrganizationPublicKeyScope.mjs";
-export * from "./PodPublicKeyScope.mjs";
+export * from "./PodScopeId.mjs";
 export * from "./Prefix.mjs";
 export * from "./PublicJwk.mjs";
 export * from "./PublicJwkCoordinate.mjs";
+export * from "./PublicKeyClientId.mjs";
 export * from "./PublicKeyCredential.mjs";
 export * from "./PublicKeyMaterial.mjs";
-export * from "./PublicKeyScope.mjs";
-export * from "./RevokeAllAgentIdSignInKeysResponse.mjs";
-export * from "./UpdatePublicKeyNameRequest.mjs";
+export * from "./PublicKeyStatus.mjs";
+export * from "./UpdateApiKeyRequest.mjs";
+export * from "./UpdatedAt.mjs";
+export * from "./UsedAt.mjs";

package/dist/esm/api/resources/apiKeys/types/index.mjs

@@ -1,39 +1,30 @@
+export * from "./AcceptDisclosure.mjs";
 export * from "./ApiKey.mjs";
+export * from "./ApiKeyCreator.mjs";
 export * from "./ApiKeyId.mjs";
+export * from "./ApiKeyMutableFields.mjs";
 export * from "./ApiKeyPermissions.mjs";
-export * from "./BrowserAuthorizationListLimit.mjs";
-export * from "./BrowserConsent.mjs";
-export * from "./BrowserConsentLifecycleEvent.mjs";
-export * from "./BrowserConsentLifecycleEventType.mjs";
-export * from "./BrowserCredential.mjs";
-export * from "./BrowserCredentialCreator.mjs";
-export * from "./BrowserEnrollmentAccepted.mjs";
-export * from "./BrowserEnrollmentLifecycleEvent.mjs";
-export * from "./BrowserEnrollmentLifecycleEventType.mjs";
-export * from "./BrowserEnrollmentTransactionJti.mjs";
-export * from "./BrowserLifecycleActor.mjs";
-export * from "./BrowserLifecycleApiKeyActor.mjs";
-export * from "./BrowserLifecycleCredentialActor.mjs";
-export * from "./BrowserLifecycleEvent.mjs";
+export * from "./ApiKeyType.mjs";
+export * from "./AuthToken.mjs";
+export * from "./BearerApiKey.mjs";
 export * from "./CreateApiKeyRequest.mjs";
 export * from "./CreateApiKeyResponse.mjs";
-export * from "./CreateBrowserEnrollmentRequest.mjs";
+export * from "./CreateApiKeyResult.mjs";
+export * from "./CreateBearerApiKeyRequest.mjs";
 export * from "./CreatedAt.mjs";
 export * from "./CreatePublicKeyRequest.mjs";
-export * from "./InboxPublicKeyScope.mjs";
+export * from "./ExpiresAt.mjs";
+export * from "./InboxScopeId.mjs";
 export * from "./ListApiKeysResponse.mjs";
-export * from "./ListBrowserConsentsResponse.mjs";
-export * from "./ListBrowserCredentialsResponse.mjs";
-export * from "./ListBrowserLifecycleEventsResponse.mjs";
-export * from "./ListPublicKeysResponse.mjs";
 export * from "./Name.mjs";
-export * from "./OrganizationPublicKeyScope.mjs";
-export * from "./PodPublicKeyScope.mjs";
+export * from "./PodScopeId.mjs";
 export * from "./Prefix.mjs";
 export * from "./PublicJwk.mjs";
 export * from "./PublicJwkCoordinate.mjs";
+export * from "./PublicKeyClientId.mjs";
 export * from "./PublicKeyCredential.mjs";
 export * from "./PublicKeyMaterial.mjs";
-export * from "./PublicKeyScope.mjs";
-export * from "./RevokeAllAgentIdSignInKeysResponse.mjs";
-export * from "./UpdatePublicKeyNameRequest.mjs";
+export * from "./PublicKeyStatus.mjs";
+export * from "./UpdateApiKeyRequest.mjs";
+export * from "./UpdatedAt.mjs";
+export * from "./UsedAt.mjs";

package/dist/esm/api/resources/inboxes/client/Client.d.mts

@@ -3,7 +3,6 @@ import { type NormalizedClientOptionsWithAuth } from "../../../../BaseClient.mjs
 import * as core from "../../../../core/index.mjs";
 import * as AgentMail from "../../../index.mjs";
 import { ApiKeysClient } from "../resources/apiKeys/client/Client.mjs";
-import { BrowserCredentialsClient } from "../resources/browserCredentials/client/Client.mjs";
 import { DraftsClient } from "../resources/drafts/client/Client.mjs";
 import { EventsClient } from "../resources/events/client/Client.mjs";
 import { ListsClient } from "../resources/lists/client/Client.mjs";
@@ -21,7 +20,6 @@ export declare class InboxesClient {
     protected _threads: ThreadsClient | undefined;
     protected _messages: MessagesClient | undefined;
     protected _drafts: DraftsClient | undefined;
-    protected _browserCredentials: BrowserCredentialsClient | undefined;
     protected _webhooks: WebhooksClient | undefined;
     protected _lists: ListsClient | undefined;
     protected _metrics: MetricsClient | undefined;
@@ -31,7 +29,6 @@ export declare class InboxesClient {
     get threads(): ThreadsClient;
     get messages(): MessagesClient;
     get drafts(): DraftsClient;
-    get browserCredentials(): BrowserCredentialsClient;
     get webhooks(): WebhooksClient;
     get lists(): ListsClient;
     get metrics(): MetricsClient;
@@ -138,4 +135,23 @@ export declare class InboxesClient {
      */
     delete(inbox_id: AgentMail.inboxes.InboxId, requestOptions?: InboxesClient.RequestOptions): core.HttpResponsePromise<void>;
     private __delete;
+    /**
+     * Authorizes the AgentID sign-in a client is already waiting in, for the
+     * inbox in the path, and returns the pending public key it will activate. A
+     * repeat for the same token, inbox, and bearer returns the same key.
+     *
+     * @param {AgentMail.inboxes.InboxId} inbox_id
+     * @param {AgentMail.inboxes.AuthorizeInboxRequest} request
+     * @param {InboxesClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.NotFoundError}
+     *
+     * @example
+     *     await client.inboxes.authorize("inbox_id", {
+     *         authToken: "blackcurrant.........."
+     *     })
+     */
+    authorize(inbox_id: AgentMail.inboxes.InboxId, request: AgentMail.inboxes.AuthorizeInboxRequest, requestOptions?: InboxesClient.RequestOptions): core.HttpResponsePromise<AgentMail.PublicKeyCredential>;
+    private __authorize;
 }

package/dist/esm/api/resources/inboxes/client/Client.mjs

@@ -17,7 +17,6 @@ import * as errors from "../../../../errors/index.mjs";
 import * as serializers from "../../../../serialization/index.mjs";
 import * as AgentMail from "../../../index.mjs";
 import { ApiKeysClient } from "../resources/apiKeys/client/Client.mjs";
-import { BrowserCredentialsClient } from "../resources/browserCredentials/client/Client.mjs";
 import { DraftsClient } from "../resources/drafts/client/Client.mjs";
 import { EventsClient } from "../resources/events/client/Client.mjs";
 import { ListsClient } from "../resources/lists/client/Client.mjs";
@@ -41,10 +40,6 @@ export class InboxesClient {
         var _a;
         return ((_a = this._drafts) !== null && _a !== void 0 ? _a : (this._drafts = new DraftsClient(this._options)));
     }
-    get browserCredentials() {
-        var _a;
-        return ((_a = this._browserCredentials) !== null && _a !== void 0 ? _a : (this._browserCredentials = new BrowserCredentialsClient(this._options)));
-    }
     get webhooks() {
         var _a;
         return ((_a = this._webhooks) !== null && _a !== void 0 ? _a : (this._webhooks = new WebhooksClient(this._options)));
@@ -492,4 +487,88 @@ export class InboxesClient {
             return handleNonStatusCodeError(_response.error, _response.rawResponse, "DELETE", "/v0/inboxes/{inbox_id}");
         });
     }
+    /**
+     * Authorizes the AgentID sign-in a client is already waiting in, for the
+     * inbox in the path, and returns the pending public key it will activate. A
+     * repeat for the same token, inbox, and bearer returns the same key.
+     *
+     * @param {AgentMail.inboxes.InboxId} inbox_id
+     * @param {AgentMail.inboxes.AuthorizeInboxRequest} request
+     * @param {InboxesClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.NotFoundError}
+     *
+     * @example
+     *     await client.inboxes.authorize("inbox_id", {
+     *         authToken: "blackcurrant.........."
+     *     })
+     */
+    authorize(inbox_id, request, requestOptions) {
+        return core.HttpResponsePromise.fromPromise(this.__authorize(inbox_id, request, requestOptions));
+    }
+    __authorize(inbox_id, request, requestOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            const _authRequest = yield this._options.authProvider.getAuthRequest();
+            const _headers = mergeHeaders(_authRequest.headers, (_a = this._options) === null || _a === void 0 ? void 0 : _a.headers, requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers);
+            const _response = yield core.fetcher({
+                url: core.url.join((_b = (yield core.Supplier.get(this._options.baseUrl))) !== null && _b !== void 0 ? _b : ((_c = (yield core.Supplier.get(this._options.environment))) !== null && _c !== void 0 ? _c : environments.AgentMailEnvironment.Prod)
+                    .http, `/v0/inboxes/${core.url.encodePathParam(serializers.inboxes.InboxId.jsonOrThrow(inbox_id, { omitUndefined: true }))}/authorize`),
+                method: "POST",
+                headers: _headers,
+                contentType: "application/json",
+                queryParameters: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams,
+                requestType: "json",
+                body: serializers.inboxes.AuthorizeInboxRequest.jsonOrThrow(request, {
+                    unrecognizedObjectKeys: "strip",
+                    omitUndefined: true,
+                }),
+                timeoutMs: ((_f = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _d !== void 0 ? _d : (_e = this._options) === null || _e === void 0 ? void 0 : _e.timeoutInSeconds) !== null && _f !== void 0 ? _f : 60) * 1000,
+                maxRetries: (_g = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _g !== void 0 ? _g : (_h = this._options) === null || _h === void 0 ? void 0 : _h.maxRetries,
+                abortSignal: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal,
+                fetchFn: (_j = this._options) === null || _j === void 0 ? void 0 : _j.fetch,
+                logging: this._options.logging,
+            });
+            if (_response.ok) {
+                return {
+                    data: serializers.PublicKeyCredential.parseOrThrow(_response.body, {
+                        unrecognizedObjectKeys: "passthrough",
+                        allowUnrecognizedUnionMembers: true,
+                        allowUnrecognizedEnumValues: true,
+                        skipValidation: true,
+                        breadcrumbsPrefix: ["response"],
+                    }),
+                    rawResponse: _response.rawResponse,
+                };
+            }
+            if (_response.error.reason === "status-code") {
+                switch (_response.error.statusCode) {
+                    case 400:
+                        throw new AgentMail.ValidationError(serializers.ValidationErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    case 404:
+                        throw new AgentMail.NotFoundError(serializers.ErrorResponse.parseOrThrow(_response.error.body, {
+                            unrecognizedObjectKeys: "passthrough",
+                            allowUnrecognizedUnionMembers: true,
+                            allowUnrecognizedEnumValues: true,
+                            skipValidation: true,
+                            breadcrumbsPrefix: ["response"],
+                        }), _response.rawResponse);
+                    default:
+                        throw new errors.AgentMailError({
+                            statusCode: _response.error.statusCode,
+                            body: _response.error.body,
+                            rawResponse: _response.rawResponse,
+                        });
+                }
+            }
+            return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v0/inboxes/{inbox_id}/authorize");
+        });
+    }
 }

package/dist/esm/api/resources/inboxes/resources/apiKeys/client/Client.d.mts

@@ -43,8 +43,27 @@ export declare class ApiKeysClient {
      * @example
      *     await client.inboxes.apiKeys.create("inbox_id", {})
      */
-    create(inbox_id: AgentMail.inboxes.InboxId, request: AgentMail.CreateApiKeyRequest, requestOptions?: ApiKeysClient.RequestOptions): core.HttpResponsePromise<AgentMail.CreateApiKeyResponse>;
+    create(inbox_id: AgentMail.inboxes.InboxId, request: AgentMail.CreateApiKeyRequest, requestOptions?: ApiKeysClient.RequestOptions): core.HttpResponsePromise<AgentMail.CreateApiKeyResult>;
     private __create;
+    /**
+     * **CLI:**
+     * ```bash
+     * agentmail inboxes api-keys update --inbox-id <inbox_id> --api-key-id <api_key_id> --name "Renamed"
+     * ```
+     *
+     * @param {AgentMail.inboxes.InboxId} inbox_id
+     * @param {AgentMail.ApiKeyId} api_key_id
+     * @param {AgentMail.UpdateApiKeyRequest} request
+     * @param {ApiKeysClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.NotFoundError}
+     *
+     * @example
+     *     await client.inboxes.apiKeys.update("inbox_id", "api_key_id", {})
+     */
+    update(inbox_id: AgentMail.inboxes.InboxId, api_key_id: AgentMail.ApiKeyId, request: AgentMail.UpdateApiKeyRequest, requestOptions?: ApiKeysClient.RequestOptions): core.HttpResponsePromise<AgentMail.ApiKey>;
+    private __update;
     /**
      * **CLI:**
      * ```bash