agentmail 0.5.24 → 0.5.25

package/dist/cjs/api/resources/apiKeys/client/requests/ListApiKeysRequest.d.ts

@@ -4,6 +4,8 @@ import type * as AgentMail from "../../../../index.js";
  *     {}
  */
 export interface ListApiKeysRequest {
+    /** Restrict the list to one credential family. Omit for every family. */
+    type?: AgentMail.ApiKeyType;
     limit?: AgentMail.Limit;
     pageToken?: AgentMail.PageToken;
     ascending?: AgentMail.Ascending;

package/dist/cjs/api/resources/apiKeys/client/requests/index.d.ts

@@ -1,6 +1 @@
 export type { ListApiKeysRequest } from "./ListApiKeysRequest.js";
-export type { ListBrowserConsentsRequest } from "./ListBrowserConsentsRequest.js";
-export type { ListBrowserCredentialEventsRequest } from "./ListBrowserCredentialEventsRequest.js";
-export type { ListBrowserCredentialsRequest } from "./ListBrowserCredentialsRequest.js";
-export type { ListPublicKeysRequest } from "./ListPublicKeysRequest.js";
-export type { RevokeAllAgentIdSignInKeysRequest } from "./RevokeAllAgentIdSignInKeysRequest.js";

package/dist/cjs/api/resources/apiKeys/types/AcceptDisclosure.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Accept the provider's disclosure on the agent's behalf, skipping the
+ * first-use disclosure page. Requires `provider_share_owner` when owner
+ * scopes are involved.
+ */
+export type AcceptDisclosure = boolean;

package/dist/cjs/api/resources/apiKeys/types/ApiKey.d.ts

@@ -1,14 +1,7 @@
 import type * as AgentMail from "../../../index.js";
-export interface ApiKey {
-    apiKeyId: AgentMail.ApiKeyId;
-    prefix: AgentMail.Prefix;
-    name: AgentMail.Name;
-    /** Pod ID the api key is scoped to. If set, the key can only access resources within this pod. */
-    podId?: string;
-    /** Inbox ID the api key is scoped to. If set, the key can only access resources within this inbox. */
-    inboxId?: string;
-    /** Time at which api key was last used. */
-    usedAt?: Date;
-    permissions?: AgentMail.ApiKeyPermissions;
-    createdAt: AgentMail.CreatedAt;
-}
+/**
+ * One credential of any family. `type` is `bearer` or `public_key`. A
+ * public key carrying `status` is a sign-in key; one without it is a
+ * registered signing key.
+ */
+export type ApiKey = AgentMail.BearerApiKey | AgentMail.PublicKeyCredential;

package/dist/cjs/api/resources/apiKeys/types/ApiKeyCreator.d.ts

@@ -0,0 +1,7 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * The bearer API key that created the credential. Provenance only; the credential outlives it.
+ */
+export interface ApiKeyCreator {
+    apiKeyId: AgentMail.ApiKeyId;
+}

package/dist/cjs/api/resources/apiKeys/types/ApiKeyMutableFields.d.ts

@@ -0,0 +1,8 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * The fields a caller may set on a bearer key at creation and change afterward.
+ */
+export interface ApiKeyMutableFields {
+    name?: AgentMail.Name;
+    permissions?: AgentMail.ApiKeyPermissions;
+}

package/dist/cjs/api/resources/apiKeys/types/ApiKeyPermissions.d.ts

@@ -68,6 +68,16 @@ export interface ApiKeyPermissions {
     apiKeyUpdate?: boolean;
     /** Delete API keys. */
     apiKeyDelete?: boolean;
+    /**
+     * Sign in to providers as an inbox: connect a provider, authorize an inbox, and mint the
+     * sign-in keys. Omitted on a new bearer key means false, whatever else the key holds.
+     */
+    providerConnect?: boolean;
+    /**
+     * Share the organization owner's name and email with providers at sign-in. One permission
+     * for both values.
+     */
+    providerShareOwner?: boolean;
     /** Read pods. */
     podRead?: boolean;
     /** Create pods. */

package/dist/cjs/api/resources/apiKeys/types/ApiKeyType.d.ts

@@ -0,0 +1,5 @@
+export declare const ApiKeyType: {
+    readonly Bearer: "bearer";
+    readonly PublicKey: "public_key";
+};
+export type ApiKeyType = (typeof ApiKeyType)[keyof typeof ApiKeyType];

package/dist/cjs/api/resources/apiKeys/types/ApiKeyType.js

@@ -0,0 +1,8 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyType = void 0;
+exports.ApiKeyType = {
+    Bearer: "bearer",
+    PublicKey: "public_key",
+};

package/dist/cjs/api/resources/apiKeys/types/AuthToken.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Token identifying one pending AgentID sign-in, read from the sign-in action on exactly `https://auth.agentid.com`.
+ */
+export type AuthToken = string;

package/dist/cjs/api/resources/apiKeys/types/BearerApiKey.d.ts

@@ -0,0 +1,17 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * An API key presented as a bearer token in the `Authorization` header.
+ */
+export interface BearerApiKey {
+    type: "bearer";
+    apiKeyId: AgentMail.ApiKeyId;
+    prefix: AgentMail.Prefix;
+    name: AgentMail.Name;
+    podId?: AgentMail.PodScopeId;
+    inboxId?: AgentMail.InboxScopeId;
+    usedAt?: AgentMail.UsedAt;
+    permissions?: AgentMail.ApiKeyPermissions;
+    createdAt: AgentMail.CreatedAt;
+    updatedAt: AgentMail.UpdatedAt;
+    expiresAt?: AgentMail.ExpiresAt;
+}

package/dist/cjs/api/resources/apiKeys/types/CreateApiKeyRequest.d.ts

@@ -1,5 +1,6 @@
 import type * as AgentMail from "../../../index.js";
-export interface CreateApiKeyRequest {
-    name?: AgentMail.Name;
-    permissions?: AgentMail.ApiKeyPermissions;
-}
+/**
+ * A body with `public_key` registers a public-key credential; any other
+ * body mints a bearer key.
+ */
+export type CreateApiKeyRequest = AgentMail.CreateBearerApiKeyRequest | AgentMail.CreatePublicKeyRequest;

package/dist/cjs/api/resources/apiKeys/types/CreateApiKeyResponse.d.ts

@@ -5,10 +5,8 @@ export interface CreateApiKeyResponse {
     apiKey: string;
     prefix: AgentMail.Prefix;
     name: AgentMail.Name;
-    /** Pod ID the api key is scoped to. */
-    podId?: string;
-    /** Inbox ID the api key is scoped to. */
-    inboxId?: string;
+    podId?: AgentMail.PodScopeId;
+    inboxId?: AgentMail.InboxScopeId;
     permissions?: AgentMail.ApiKeyPermissions;
     createdAt: AgentMail.CreatedAt;
 }

package/dist/cjs/api/resources/apiKeys/types/CreateApiKeyResult.d.ts

@@ -0,0 +1,5 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * The secret-bearing bearer key, or the registered public key without any secret.
+ */
+export type CreateApiKeyResult = AgentMail.CreateApiKeyResponse | AgentMail.PublicKeyCredential;

package/dist/cjs/api/resources/apiKeys/types/CreateBearerApiKeyRequest.d.ts

@@ -0,0 +1,3 @@
+import type * as AgentMail from "../../../index.js";
+export interface CreateBearerApiKeyRequest extends AgentMail.ApiKeyMutableFields {
+}

package/dist/cjs/api/resources/apiKeys/types/CreatePublicKeyRequest.d.ts

@@ -1,21 +1,16 @@
 import type * as AgentMail from "../../../index.js";
 /**
- * Register only a public P-256 JWK. Credential type, `api_key_id`, sign-in
- * eligibility, permissions, and generation are server-owned and are not
- * request properties.
+ * Registers a public P-256 JWK at the route's scope. `type` and
+ * `api_key_id` are server-owned. `name` defaults to
+ * `AgentID key {first eight fingerprint characters}`; `permissions`
+ * defaults to the registering key's, and only grants it holds may be
+ * true; `expires_at` defaults to the registering key's expiry and is
+ * independent of that key afterward.
  */
 export interface CreatePublicKeyRequest {
     publicKey: AgentMail.PublicJwk;
-    /** Defaults to `AgentID key {first eight fingerprint characters}`. */
-    name?: string;
-    /**
-     * Omit to inherit the registering bearer key's exact scope. An explicit
-     * scope must be the caller's scope or a live descendant.
-     */
-    scope?: AgentMail.PublicKeyScope;
-    /**
-     * Future absolute expiry. Omit to inherit the registering bearer key's
-     * expiry. A child credential cannot outlive its creator.
-     */
-    expiresAt?: Date;
+    clientId?: AgentMail.PublicKeyClientId;
+    name?: AgentMail.Name;
+    permissions?: AgentMail.ApiKeyPermissions;
+    expiresAt?: AgentMail.ExpiresAt;
 }

package/dist/cjs/api/resources/apiKeys/types/ExpiresAt.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Time at which api key expires. Omitted when it does not expire.
+ */
+export type ExpiresAt = Date;

package/dist/cjs/api/resources/apiKeys/types/InboxScopeId.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Inbox ID the api key is scoped to. If set, the key can only access resources within this inbox.
+ */
+export type InboxScopeId = string;

package/dist/cjs/api/resources/apiKeys/types/ListApiKeysResponse.d.ts

@@ -2,6 +2,9 @@ import type * as AgentMail from "../../../index.js";
 export interface ListApiKeysResponse {
     count: AgentMail.Count;
     nextPageToken?: AgentMail.PageToken;
-    /** Ordered by `created_at` descending. */
+    /**
+     * Every credential family, ordered by `created_at`. `type` restricts
+     * to one family.
+     */
     apiKeys: AgentMail.ApiKey[];
 }

package/dist/cjs/api/resources/apiKeys/types/PodScopeId.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Pod ID the api key is scoped to. If set, the key can only access resources within this pod.
+ */
+export type PodScopeId = string;

package/dist/cjs/api/resources/apiKeys/types/PublicKeyClientId.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Caller-chosen alias for a public key, unique within the organization and
+ * reusable after deletion. Accepted in place of `api_key_id` on get, update,
+ * and delete. Registration is idempotent on it: the same alias returns the
+ * existing key, a conflicting one returns `409`. URL-safe; no slash or `@`.
+ */
+export type PublicKeyClientId = string;

package/dist/cjs/api/resources/apiKeys/types/PublicKeyCredential.d.ts

@@ -1,22 +1,25 @@
 import type * as AgentMail from "../../../index.js";
 /**
- * An AgentID sign-in credential. `type` and `api_key_id` are server-owned;
- * use `api_key_id` as the JWS `kid`. This response never contains a bearer
- * secret or private key.
+ * An AgentID sign-in credential, scoped like a bearer key; `api_key_id` is
+ * the JWS `kid`. A sign-in key carries `status`, gains `public_key` once
+ * the client has proved it, expires 30 days after
+ * activation, and carries exactly `provider_connect` and
+ * `provider_share_owner`, snapshotted from the bearer key that created it
+ * and enforced from the key itself.
  */
 export interface PublicKeyCredential {
-    /** Server-generated credential ID. Store this value as the signing key's `kid`. */
-    apiKeyId: string;
-    /** Server-owned credential discriminator. Callers cannot select or update it. */
     type: "public_key";
-    /** Human-readable credential name. */
+    apiKeyId: AgentMail.ApiKeyId;
+    clientId?: AgentMail.PublicKeyClientId;
     name: AgentMail.Name;
-    publicKey: AgentMail.PublicKeyMaterial;
-    scope: AgentMail.PublicKeyScope;
-    /** Immutable absolute expiry. Omitted when the credential does not expire. */
-    expiresAt?: Date;
-    /** Present when organization-wide revoke-all invalidated this credential generation. */
-    revokedAt?: Date;
-    createdAt: Date;
-    updatedAt: Date;
+    publicKey?: AgentMail.PublicKeyMaterial;
+    podId?: AgentMail.PodScopeId;
+    inboxId?: AgentMail.InboxScopeId;
+    status?: AgentMail.PublicKeyStatus;
+    usedAt?: AgentMail.UsedAt;
+    permissions: AgentMail.ApiKeyPermissions;
+    createdBy: AgentMail.ApiKeyCreator;
+    createdAt: AgentMail.CreatedAt;
+    updatedAt: AgentMail.UpdatedAt;
+    expiresAt?: AgentMail.ExpiresAt;
 }

package/dist/cjs/api/resources/apiKeys/types/PublicKeyStatus.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Lifecycle of a sign-in key: `pending` until the client finishes
+ * creating it on the AgentID page, `active` once it can sign in as the
+ * inbox. Absent on a registered key.
+ */
+export declare const PublicKeyStatus: {
+    readonly Pending: "pending";
+    readonly Active: "active";
+};
+export type PublicKeyStatus = (typeof PublicKeyStatus)[keyof typeof PublicKeyStatus];

package/dist/cjs/api/resources/apiKeys/types/PublicKeyStatus.js

@@ -0,0 +1,13 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicKeyStatus = void 0;
+/**
+ * Lifecycle of a sign-in key: `pending` until the client finishes
+ * creating it on the AgentID page, `active` once it can sign in as the
+ * inbox. Absent on a registered key.
+ */
+exports.PublicKeyStatus = {
+    Pending: "pending",
+    Active: "active",
+};

package/dist/cjs/api/resources/apiKeys/types/UpdateApiKeyRequest.d.ts

@@ -0,0 +1,7 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * Rename a credential or change its permissions. Key material, type,
+ * scope, and expiry are immutable.
+ */
+export interface UpdateApiKeyRequest extends AgentMail.ApiKeyMutableFields {
+}

package/dist/cjs/api/resources/apiKeys/types/UpdatedAt.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Time at which api key was last updated.
+ */
+export type UpdatedAt = Date;

package/dist/cjs/api/resources/apiKeys/types/UsedAt.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Time at which api key was last used.
+ */
+export type UsedAt = Date;

package/dist/cjs/api/resources/apiKeys/types/index.d.ts

@@ -1,39 +1,30 @@
+export * from "./AcceptDisclosure.js";
 export * from "./ApiKey.js";
+export * from "./ApiKeyCreator.js";
 export * from "./ApiKeyId.js";
+export * from "./ApiKeyMutableFields.js";
 export * from "./ApiKeyPermissions.js";
-export * from "./BrowserAuthorizationListLimit.js";
-export * from "./BrowserConsent.js";
-export * from "./BrowserConsentLifecycleEvent.js";
-export * from "./BrowserConsentLifecycleEventType.js";
-export * from "./BrowserCredential.js";
-export * from "./BrowserCredentialCreator.js";
-export * from "./BrowserEnrollmentAccepted.js";
-export * from "./BrowserEnrollmentLifecycleEvent.js";
-export * from "./BrowserEnrollmentLifecycleEventType.js";
-export * from "./BrowserEnrollmentTransactionJti.js";
-export * from "./BrowserLifecycleActor.js";
-export * from "./BrowserLifecycleApiKeyActor.js";
-export * from "./BrowserLifecycleCredentialActor.js";
-export * from "./BrowserLifecycleEvent.js";
+export * from "./ApiKeyType.js";
+export * from "./AuthToken.js";
+export * from "./BearerApiKey.js";
 export * from "./CreateApiKeyRequest.js";
 export * from "./CreateApiKeyResponse.js";
-export * from "./CreateBrowserEnrollmentRequest.js";
+export * from "./CreateApiKeyResult.js";
+export * from "./CreateBearerApiKeyRequest.js";
 export * from "./CreatedAt.js";
 export * from "./CreatePublicKeyRequest.js";
-export * from "./InboxPublicKeyScope.js";
+export * from "./ExpiresAt.js";
+export * from "./InboxScopeId.js";
 export * from "./ListApiKeysResponse.js";
-export * from "./ListBrowserConsentsResponse.js";
-export * from "./ListBrowserCredentialsResponse.js";
-export * from "./ListBrowserLifecycleEventsResponse.js";
-export * from "./ListPublicKeysResponse.js";
 export * from "./Name.js";
-export * from "./OrganizationPublicKeyScope.js";
-export * from "./PodPublicKeyScope.js";
+export * from "./PodScopeId.js";
 export * from "./Prefix.js";
 export * from "./PublicJwk.js";
 export * from "./PublicJwkCoordinate.js";
+export * from "./PublicKeyClientId.js";
 export * from "./PublicKeyCredential.js";
 export * from "./PublicKeyMaterial.js";
-export * from "./PublicKeyScope.js";
-export * from "./RevokeAllAgentIdSignInKeysResponse.js";
-export * from "./UpdatePublicKeyNameRequest.js";
+export * from "./PublicKeyStatus.js";
+export * from "./UpdateApiKeyRequest.js";
+export * from "./UpdatedAt.js";
+export * from "./UsedAt.js";

package/dist/cjs/api/resources/apiKeys/types/index.js

@@ -14,42 +14,33 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./AcceptDisclosure.js"), exports);
 __exportStar(require("./ApiKey.js"), exports);
+__exportStar(require("./ApiKeyCreator.js"), exports);
 __exportStar(require("./ApiKeyId.js"), exports);
+__exportStar(require("./ApiKeyMutableFields.js"), exports);
 __exportStar(require("./ApiKeyPermissions.js"), exports);
-__exportStar(require("./BrowserAuthorizationListLimit.js"), exports);
-__exportStar(require("./BrowserConsent.js"), exports);
-__exportStar(require("./BrowserConsentLifecycleEvent.js"), exports);
-__exportStar(require("./BrowserConsentLifecycleEventType.js"), exports);
-__exportStar(require("./BrowserCredential.js"), exports);
-__exportStar(require("./BrowserCredentialCreator.js"), exports);
-__exportStar(require("./BrowserEnrollmentAccepted.js"), exports);
-__exportStar(require("./BrowserEnrollmentLifecycleEvent.js"), exports);
-__exportStar(require("./BrowserEnrollmentLifecycleEventType.js"), exports);
-__exportStar(require("./BrowserEnrollmentTransactionJti.js"), exports);
-__exportStar(require("./BrowserLifecycleActor.js"), exports);
-__exportStar(require("./BrowserLifecycleApiKeyActor.js"), exports);
-__exportStar(require("./BrowserLifecycleCredentialActor.js"), exports);
-__exportStar(require("./BrowserLifecycleEvent.js"), exports);
+__exportStar(require("./ApiKeyType.js"), exports);
+__exportStar(require("./AuthToken.js"), exports);
+__exportStar(require("./BearerApiKey.js"), exports);
 __exportStar(require("./CreateApiKeyRequest.js"), exports);
 __exportStar(require("./CreateApiKeyResponse.js"), exports);
-__exportStar(require("./CreateBrowserEnrollmentRequest.js"), exports);
+__exportStar(require("./CreateApiKeyResult.js"), exports);
+__exportStar(require("./CreateBearerApiKeyRequest.js"), exports);
 __exportStar(require("./CreatedAt.js"), exports);
 __exportStar(require("./CreatePublicKeyRequest.js"), exports);
-__exportStar(require("./InboxPublicKeyScope.js"), exports);
+__exportStar(require("./ExpiresAt.js"), exports);
+__exportStar(require("./InboxScopeId.js"), exports);
 __exportStar(require("./ListApiKeysResponse.js"), exports);
-__exportStar(require("./ListBrowserConsentsResponse.js"), exports);
-__exportStar(require("./ListBrowserCredentialsResponse.js"), exports);
-__exportStar(require("./ListBrowserLifecycleEventsResponse.js"), exports);
-__exportStar(require("./ListPublicKeysResponse.js"), exports);
 __exportStar(require("./Name.js"), exports);
-__exportStar(require("./OrganizationPublicKeyScope.js"), exports);
-__exportStar(require("./PodPublicKeyScope.js"), exports);
+__exportStar(require("./PodScopeId.js"), exports);
 __exportStar(require("./Prefix.js"), exports);
 __exportStar(require("./PublicJwk.js"), exports);
 __exportStar(require("./PublicJwkCoordinate.js"), exports);
+__exportStar(require("./PublicKeyClientId.js"), exports);
 __exportStar(require("./PublicKeyCredential.js"), exports);
 __exportStar(require("./PublicKeyMaterial.js"), exports);
-__exportStar(require("./PublicKeyScope.js"), exports);
-__exportStar(require("./RevokeAllAgentIdSignInKeysResponse.js"), exports);
-__exportStar(require("./UpdatePublicKeyNameRequest.js"), exports);
+__exportStar(require("./PublicKeyStatus.js"), exports);
+__exportStar(require("./UpdateApiKeyRequest.js"), exports);
+__exportStar(require("./UpdatedAt.js"), exports);
+__exportStar(require("./UsedAt.js"), exports);

package/dist/cjs/api/resources/inboxes/client/Client.d.ts

@@ -3,7 +3,6 @@ import { type NormalizedClientOptionsWithAuth } from "../../../../BaseClient.js"
 import * as core from "../../../../core/index.js";
 import * as AgentMail from "../../../index.js";
 import { ApiKeysClient } from "../resources/apiKeys/client/Client.js";
-import { BrowserCredentialsClient } from "../resources/browserCredentials/client/Client.js";
 import { DraftsClient } from "../resources/drafts/client/Client.js";
 import { EventsClient } from "../resources/events/client/Client.js";
 import { ListsClient } from "../resources/lists/client/Client.js";
@@ -21,7 +20,6 @@ export declare class InboxesClient {
     protected _threads: ThreadsClient | undefined;
     protected _messages: MessagesClient | undefined;
     protected _drafts: DraftsClient | undefined;
-    protected _browserCredentials: BrowserCredentialsClient | undefined;
     protected _webhooks: WebhooksClient | undefined;
     protected _lists: ListsClient | undefined;
     protected _metrics: MetricsClient | undefined;
@@ -31,7 +29,6 @@ export declare class InboxesClient {
     get threads(): ThreadsClient;
     get messages(): MessagesClient;
     get drafts(): DraftsClient;
-    get browserCredentials(): BrowserCredentialsClient;
     get webhooks(): WebhooksClient;
     get lists(): ListsClient;
     get metrics(): MetricsClient;
@@ -138,4 +135,23 @@ export declare class InboxesClient {
      */
     delete(inbox_id: AgentMail.inboxes.InboxId, requestOptions?: InboxesClient.RequestOptions): core.HttpResponsePromise<void>;
     private __delete;
+    /**
+     * Authorizes the AgentID sign-in a client is already waiting in, for the
+     * inbox in the path, and returns the pending public key it will activate. A
+     * repeat for the same token, inbox, and bearer returns the same key.
+     *
+     * @param {AgentMail.inboxes.InboxId} inbox_id
+     * @param {AgentMail.inboxes.AuthorizeInboxRequest} request
+     * @param {InboxesClient.RequestOptions} requestOptions - Request-specific configuration.
+     *
+     * @throws {@link AgentMail.ValidationError}
+     * @throws {@link AgentMail.NotFoundError}
+     *
+     * @example
+     *     await client.inboxes.authorize("inbox_id", {
+     *         authToken: "blackcurrant.........."
+     *     })
+     */
+    authorize(inbox_id: AgentMail.inboxes.InboxId, request: AgentMail.inboxes.AuthorizeInboxRequest, requestOptions?: InboxesClient.RequestOptions): core.HttpResponsePromise<AgentMail.PublicKeyCredential>;
+    private __authorize;
 }