burnledger 0.4.0 → 0.6.0

package/src/http.ts

@@ -1,16 +1,29 @@
 /** HTTP transport layer wrapping native fetch.
  *
  * Handles: Bearer auth, response envelope unwrapping, retry on 5xx/transport
- * errors, Retry-After respect on 429, and raw byte streaming for PDFs.
+ * errors and on 429, and raw byte streaming for PDFs.
+ *
+ * Retry delay: a `Retry-After` header (delta-seconds or HTTP-date) is honoured
+ * when the server sends one and it is at most `MAX_RETRY_AFTER`; otherwise
+ * exponential backoff with jitter. A 429 with no usable `Retry-After`, one
+ * beyond the cap, or one on the last attempt throws `RateLimitError` with
+ * `retryAfter` populated so the caller can decide.
  */
 
 import { raiseForError } from "./errors.js";
 
+/** Longest Retry-After, in seconds, the transport will wait on before
+ * throwing instead: a server asking for minutes gets the error and the
+ * number rather than a promise nobody can cancel. */
+export const MAX_RETRY_AFTER = 30;
+
 export interface TransportOptions {
   baseUrl: string;
   apiKey: string;
   timeout: number;
   maxRetries: number;
+  /** Team to act as. Omit to let the API use the caller's default team. */
+  teamId?: string;
 }
 
 export class Transport {
@@ -18,12 +31,18 @@ export class Transport {
   private readonly apiKey: string;
   private readonly timeout: number;
   private readonly maxRetries: number;
+  // Which team the caller is acting as. The API resolves scope from this
+  // header and otherwise falls back to the caller's default team, so a member
+  // of more than one team who does not send it silently acts as whichever they
+  // joined first.
+  private readonly teamId?: string;
 
   constructor(opts: TransportOptions) {
     this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
     this.apiKey = opts.apiKey;
     this.timeout = opts.timeout;
     this.maxRetries = opts.maxRetries;
+    this.teamId = opts.teamId;
   }
 
   /** Make a request and return the unwrapped `data` field. */
@@ -56,6 +75,12 @@ export class Transport {
     };
     if (authenticated) {
       headers["Authorization"] = `Bearer ${this.apiKey}`;
+      // Alongside the key, never without it: the header names the scope the
+      // caller is acting in, which is meaningless for an unauthenticated
+      // request and is not a second credential.
+      if (this.teamId) {
+        headers["X-Team-ID"] = this.teamId;
+      }
     }
 
     let url = `${this.baseUrl}${path}`;
@@ -80,14 +105,14 @@ export class Transport {
     }
 
     let lastError: Error | undefined;
+    // Delay before the next attempt when the server named one; undefined
+    // means fall back to backoff.
+    let retryAfter: number | undefined;
 
     for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
       if (attempt > 0) {
-        // Backoff with ±25% jitter so coordinated 5xx events don't produce
-        // a synchronized retry storm from every client at the same instant.
-        const base = 500 * 2 ** (attempt - 1);
-        const jitter = base * 0.25 * (Math.random() * 2 - 1);
-        await sleep(base + jitter);
+        await sleep(retryDelayMs(attempt, retryAfter));
+        retryAfter = undefined;
       }
 
       const controller = new AbortController();
@@ -116,8 +141,19 @@ export class Transport {
         return {};
       }
 
+      retryAfter = parseRetryAfter(resp);
       if (resp.status === 429) {
-        const retryAfter = parseRetryAfter(resp);
+        // Only on the server's say-so: without Retry-After there is no delay
+        // known to be enough, and beyond the cap the caller gets the number
+        // (RateLimitError.retryAfter) rather than a hung promise.
+        if (
+          retryAfter !== undefined &&
+          retryAfter <= MAX_RETRY_AFTER &&
+          attempt < this.maxRetries
+        ) {
+          lastError = new Error(`Server error ${resp.status}`);
+          continue;
+        }
         const errorBody = await safeJson(resp);
         raiseForError(resp.status, errorBody, retryAfter);
       }
@@ -150,6 +186,11 @@ export class Transport {
     const headers: Record<string, string> = {};
     if (authenticated) {
       headers["Authorization"] = `Bearer ${this.apiKey}`;
+      // A downloaded certificate is as team-scoped as the JSON one; omitting
+      // the header here would hand a member their default team's PDF.
+      if (this.teamId) {
+        headers["X-Team-ID"] = this.teamId;
+      }
     }
 
     const url = `${this.baseUrl}${path}`;
@@ -172,11 +213,37 @@ export class Transport {
   }
 }
 
-function parseRetryAfter(resp: Response): number | undefined {
-  const raw = resp.headers.get("Retry-After");
-  if (raw == null) return undefined;
-  const n = Number(raw);
-  return Number.isFinite(n) ? n : undefined;
+/** Seconds to wait per the Retry-After header (RFC 9110 §10.2.3).
+ *
+ * Accepts both forms the header allows: non-negative delta-seconds and an
+ * HTTP-date, converted to seconds from now (a date already past reads as 0).
+ * Anything else is treated as absent.
+ */
+export function parseRetryAfter(resp: Response): number | undefined {
+  const raw = resp.headers.get("Retry-After")?.trim();
+  if (!raw) return undefined;
+  if (/^\d+(\.\d+)?$/.test(raw)) {
+    return Number(raw);
+  }
+  // Every HTTP-date form (IMF-fixdate, RFC 850, asctime) opens with a weekday
+  // name; Date.parse alone would also read "-3" or "2099" as a year.
+  if (!/^[A-Za-z]{3}/.test(raw)) return undefined;
+  const when = Date.parse(raw);
+  if (Number.isNaN(when)) return undefined;
+  return Math.max(0, (when - Date.now()) / 1000);
+}
+
+/** Milliseconds to sleep before retry `attempt` (1-based). A server-supplied
+ * delay within the cap wins; otherwise exponential backoff with ±25% jitter so
+ * coordinated 5xx events don't produce a synchronized retry storm from every
+ * client at the same instant. */
+function retryDelayMs(attempt: number, retryAfter: number | undefined): number {
+  if (retryAfter !== undefined && retryAfter <= MAX_RETRY_AFTER) {
+    return retryAfter * 1000;
+  }
+  const base = Math.min(500 * 2 ** (attempt - 1), MAX_RETRY_AFTER * 1000);
+  const jitter = base * 0.25 * (Math.random() * 2 - 1);
+  return base + jitter;
 }
 
 async function safeJson(resp: Response): Promise<Record<string, unknown>> {

package/src/index.browser.ts

@@ -69,7 +69,7 @@ import {
   verifyConsistency as _verifyConsistency,
   publicKeyFromHex as _publicKeyFromHex,
 } from "./verify.js";
-import type { PublicKeyInfo } from "./verify.js";
+import type { PublicKeyInfo, PublicKeyOptions } from "./verify.js";
 import type { VerificationResult, TransparencyResult } from "./models.js";
 
 type Cert = Record<string, unknown>;
@@ -93,7 +93,7 @@ export function verifyTransparency(
 /** Construct a PublicKeyInfo from a hex-encoded Ed25519 public key. */
 export function publicKeyFromHex(
   hexKey: string,
-  opts?: { revoked?: boolean },
+  opts?: PublicKeyOptions,
 ): Promise<PublicKeyInfo> {
   return _publicKeyFromHex(browserCrypto, hexKey, opts);
 }

package/src/index.ts

@@ -1,6 +1,6 @@
 /** BurnLedger TypeScript SDK — public API (Node.js entry point). */
 
-export { BurnLedger } from "./client.js";
+export { BurnLedger, MAX_BATCH_REVOKE } from "./client.js";
 export type { BurnLedgerOptions } from "./client.js";
 
 export {
@@ -14,11 +14,15 @@ export {
   ServerError,
   TimeoutError,
   VerificationError,
+  CERTIFICATE_REVOKED,
+  UNSUPPORTED_FORMAT_VERSION,
 } from "./errors.js";
 
 export { Transport } from "./http.js";
 export type { TransportOptions } from "./http.js";
 
+export type { PublicKeyOptions } from "./verify.js";
+
 export type {
   ProofMode,
   AttestationStatus,
@@ -47,6 +51,8 @@ export type {
   ConsistencyProof,
   BatchAttestationResponse,
   BatchAttestationError,
+  BatchRevokeResponse,
+  BatchRevokeError,
   MonthlyCount,
   CertificateStats,
   WebhookRotateResponse,
@@ -76,7 +82,7 @@ import {
   verifyConsistency as _verifyConsistency,
   publicKeyFromHex as _publicKeyFromHex,
 } from "./verify.js";
-import type { PublicKeyInfo } from "./verify.js";
+import type { PublicKeyInfo, PublicKeyOptions } from "./verify.js";
 import type { VerificationResult, TransparencyResult } from "./models.js";
 
 type Cert = Record<string, unknown>;
@@ -123,13 +129,7 @@ export function verifyTransparency(
  */
 export function publicKeyFromHex(
   hexKey: string,
-  opts?: {
-    revoked?: boolean;
-    keyStatus?: string;
-    notBefore?: string;
-    notAfter?: string;
-    compromisedFrom?: string;
-  },
+  opts?: PublicKeyOptions,
 ): Promise<PublicKeyInfo> {
   return _publicKeyFromHex(nodeCrypto, hexKey, opts);
 }
@@ -146,3 +146,22 @@ export function verifyConsistency(
 }
 
 export { verifyWebhookSignature, isTimestampFresh } from "./webhooks.js";
+
+/**
+ * Client-side connection-config sealing.
+ *
+ * Node only, and absent from the browser entry point on purpose: verifying an
+ * attestation document needs X.509 chain building, which browsers do not
+ * expose, and sealing a datastore credential is not something a browser should
+ * be doing.
+ */
+export {
+  EnclaveAttestationError,
+  ENVELOPE_MAGIC,
+  HEADER_SIZE,
+  NITRO_ROOT_G1_PEM,
+  sealConnectionConfig,
+  sealToKey,
+  verifyEnclaveConfigSealKey,
+} from "./enclave-seal.js";
+export type { SealOptions } from "./enclave-seal.js";

package/src/keys.ts

@@ -1,4 +1,15 @@
-// Public-key file parsing shared by the CLI (and unit-testable in isolation).
+// Public-key file parsing shared by the CLI and the browser verifier, and the
+// key_list.v3 verdict (ADR-017 §5a) — unit-testable in isolation.
+
+import type { CryptoOps } from "./crypto.js";
+import {
+  buildKeyListPayload,
+  evaluateKey,
+  formatTimestamp,
+  hexToBytes,
+  keyIsUsable,
+  publicKeyFromHex,
+} from "./verify.js";
 
 export type KeyEntry = {
   key_id: string;
@@ -12,6 +23,25 @@ export type KeyEntry = {
   compromised_from?: string | null;
 };
 
+/**
+ * The published key set as /.well-known/burnledger-keys serves it: the `keys`
+ * array, and BESIDE it — in the same object — the fields of a signed
+ * key_list.v3 statement when the server signs one (ADR-017 §5a). A body with no
+ * `signature` is the unsigned list the endpoint has always served; that is not
+ * an error, it is the state of the world before §5a is deployed.
+ *
+ * Mirrors core.KeyListDocument.
+ */
+export type KeyListDocument = {
+  keys: KeyEntry[];
+  statement_issued_at?: string;
+  statement_expires_at?: string;
+  sth_tree_size?: number;
+  sth_root_hash?: string;
+  signature?: string;
+  key_id?: string;
+};
+
 /**
  * Normalize a parsed keys file to an array of key entries. Accepts a bare
  * JSON array (the generated keys.json shape), a { "keys": [...] } envelope,
@@ -19,10 +49,153 @@ export type KeyEntry = {
  * actually publishes. Throws on any other shape.
  */
 export function parseKeyEntries(parsed: unknown): KeyEntry[] {
+  return parseKeyListDocument(parsed).keys;
+}
+
+/**
+ * Read a published key set in any shape this project has ever served — a bare
+ * array, a {"keys": [...]} object, or either inside the API's {"data": ...}
+ * envelope — keeping the statement fields when the object forms carry them.
+ * Mirrors core.ParseKeyListDocument, so this CLI, the Go CLI and the browser
+ * cannot disagree about which files are key sets.
+ */
+export function parseKeyListDocument(parsed: unknown): KeyListDocument {
   const root = (parsed as { data?: unknown })?.data ?? parsed;
-  const entries = Array.isArray(root) ? root : (root as { keys?: unknown })?.keys;
+  if (Array.isArray(root)) return { keys: root as KeyEntry[] };
+  const entries = (root as { keys?: unknown })?.keys;
   if (!Array.isArray(entries)) {
     throw new Error('--keys file must be a JSON array of keys or a {"keys": [...]} object');
   }
-  return entries as KeyEntry[];
+  return root as KeyListDocument;
+}
+
+/** Verdicts about a key list. Mirrors core.KeyListResult, plus the one the CLI
+ * adds (SIGNING_KEY_NOT_IN_LIST) because core never reaches it: VerifyKeyList
+ * is told which key to trust, and this is the case where there is none to offer. */
+export const KEY_LIST_VALID = "VALID";
+export const KEY_LIST_MALFORMED = "MALFORMED_KEY_LIST";
+export const KEY_LIST_SIGNING_KEY_UNUSABLE = "KEY_LIST_SIGNING_KEY_UNUSABLE";
+export const KEY_LIST_INVALID_SIGNATURE = "INVALID_KEY_LIST_SIGNATURE";
+export const KEY_LIST_STALE = "KEY_LIST_STALE";
+export const KEY_LIST_SIGNING_KEY_ABSENT = "SIGNING_KEY_NOT_IN_LIST";
+
+/**
+ * What a run learned about where the key statuses and dates came from.
+ * Mirrors keyListEvidence in cmd/cli/keys.go: it is not a pass/fail input to
+ * certificate verification, it qualifies one. An auditor reading
+ * KEY_COMPROMISED needs to know whether that word arrived as evidence they can
+ * keep or as JSON from an endpoint trusted for one TCP connection.
+ */
+export interface KeyListEvidence {
+  /** Whether the file carried a signed statement at all. */
+  present: boolean;
+  result?: string;
+  /** The trusted key was taken from the list itself — trust-on-first-use, not proof. */
+  selfSigned: boolean;
+  /** statement_expires_at, normalized to the form Go prints. */
+  expiresAt?: string;
+}
+
+/** The whole-second RFC 3339 form every published key date uses
+ * (core.KeyTimeFormat). Entry dates are validated against it strictly, as
+ * core.KeyEntry.PublicKeyInfo does, so a date Go refuses is refused here. */
+const KEY_TIME_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/;
+
+function requireKeyTime(keyId: string, field: string, value: unknown): void {
+  if (typeof value !== "string" || !KEY_TIME_RE.test(value)) {
+    throw new Error(`key ${keyId}: ${field} is not YYYY-MM-DDTHH:MM:SSZ`);
+  }
+}
+
+function requireHex(field: string, value: unknown, bytes: number): Uint8Array {
+  if (typeof value !== "string" || value.length !== bytes * 2 || !/^[0-9a-fA-F]+$/.test(value)) {
+    throw new Error(`key list: ${field} is not ${bytes} bytes of hex`);
+  }
+  return hexToBytes(value);
+}
+
+/**
+ * Check a key-list statement the way cmd/cli/keys.go does, so four verifiers
+ * agree: the trusted key is looked up IN THE LIST ITSELF (trust-on-first-use,
+ * and selfSigned says so), then core.VerifyKeyList's order — the list parses
+ * and has no duplicate, the signing key is usable at `now` under ADR-017's
+ * table, the signature verifies over the published entries, and only then
+ * freshness. A stale verdict is never returned for a signature never tested.
+ *
+ * THROWS where the Go CLI exits 2: an entry that does not parse, a key_id that
+ * is not sha256(public_key), or a statement whose fields will not read. Someone
+ * signed something the reader cannot read, and continuing as though the file
+ * were merely unsigned would throw that fact away.
+ */
+export async function verifyKeyList(
+  crypto: CryptoOps,
+  doc: KeyListDocument,
+  now: Date,
+): Promise<KeyListEvidence> {
+  if (doc.keys.length === 0) throw new Error("keys file contains no keys");
+  const signed = doc.signature !== undefined && doc.signature !== "";
+  const keys = new Map<string, Awaited<ReturnType<typeof publicKeyFromHex>>>();
+  let duplicate = false;
+  for (const e of doc.keys) {
+    if (typeof e.public_key !== "string") throw new Error(`key ${e.key_id}: public_key is not a string`);
+    const pki = await publicKeyFromHex(crypto, e.public_key, {
+      keyStatus: e.key_status,
+      notBefore: e.not_before,
+      notAfter: e.not_after ?? undefined,
+      compromisedFrom: e.compromised_from ?? undefined,
+    });
+    // The strict Go loader rules — key_id is sha256(public_key), dates are
+    // whole-second UTC — apply to a SIGNED list, whose statement signs the
+    // published strings. An unsigned list keeps this CLI's existing
+    // tolerance (an absent key_id is allowed, and the map is keyed on the
+    // derived id either way); tightening the unsigned path would refuse files
+    // it accepts today.
+    if (signed) {
+      if (e.key_id !== pki.keyId) {
+        throw new Error(`key_id ${e.key_id} does not match sha256(public_key) (${pki.keyId})`);
+      }
+      if (e.not_before != null && e.not_before !== "") requireKeyTime(e.key_id, "not_before", e.not_before);
+      if (e.not_after != null) requireKeyTime(e.key_id, "not_after", e.not_after);
+      if (e.compromised_from != null) requireKeyTime(e.key_id, "compromised_from", e.compromised_from);
+    }
+    if (keys.has(pki.keyId)) duplicate = true;
+    keys.set(pki.keyId, pki);
+  }
+
+  if (!signed) {
+    return { present: false, selfSigned: false };
+  }
+
+  // The statement's own fields. Refused rather than defaulted: a zero
+  // statement_expires_at would read as "expired", which is an answer.
+  requireHex("sth_root_hash", doc.sth_root_hash, 32);
+  const signature = requireHex("signature", doc.signature, 64);
+  if (typeof doc.key_id !== "string" || doc.key_id === "") throw new Error("key list: key_id is missing");
+  if (typeof doc.sth_tree_size !== "number" || !Number.isInteger(doc.sth_tree_size) || doc.sth_tree_size < 0) {
+    throw new Error("key list: sth_tree_size is not a non-negative integer");
+  }
+  const issued = formatTimestamp(doc.statement_issued_at);
+  const expires = formatTimestamp(doc.statement_expires_at);
+
+  const evidence: KeyListEvidence = { present: true, selfSigned: false, expiresAt: expires };
+  const signingKey = keys.get(doc.key_id);
+  if (signingKey === undefined) {
+    return { ...evidence, result: KEY_LIST_SIGNING_KEY_ABSENT };
+  }
+  evidence.selfSigned = true;
+
+  if (duplicate) return { ...evidence, result: KEY_LIST_MALFORMED };
+
+  const at = formatTimestamp(now.toISOString());
+  if (!keyIsUsable(evaluateKey(signingKey, Math.floor(Date.parse(at) / 1000)))) {
+    return { ...evidence, result: KEY_LIST_SIGNING_KEY_UNUSABLE };
+  }
+  const payload = buildKeyListPayload(doc as unknown as Record<string, unknown>);
+  if (!(await crypto.ed25519Verify(signingKey.keyBytes, payload, signature))) {
+    return { ...evidence, result: KEY_LIST_INVALID_SIGNATURE };
+  }
+  if (at < issued || at >= expires) {
+    return { ...evidence, result: KEY_LIST_STALE };
+  }
+  return { ...evidence, result: KEY_LIST_VALID };
 }

package/src/models.ts

@@ -146,6 +146,13 @@ export interface CertificateResponse {
   readonly revokedAt: Date | undefined;
   readonly revocationReason: string | undefined;
   readonly certificate: Record<string, unknown>;
+  /**
+   * Raw enclave-signed status statement stapled by the server. Best-effort on
+   * the server side, so undefined when it could not be produced; GET
+   * /v1/certificates/{id}/status is the call that errors instead. Kept raw so
+   * it can be handed straight to verifyCertificateWithStatus().
+   */
+  readonly statusStatement: Record<string, unknown> | undefined;
 }
 
 export interface RevocationStatus {
@@ -206,6 +213,9 @@ export interface Profile {
   readonly id: string;
   readonly name: string;
   readonly email: string;
+  /** A new address waiting for the code mailed to it; `email` stays the
+   * current one until the change is confirmed from the dashboard. */
+  readonly pendingEmail: string | undefined;
   readonly plan: string;
   readonly planStartedAt: string | undefined;
   readonly createdAt: string;
@@ -218,9 +228,9 @@ export interface Profile {
 
 export interface SystemHealth {
   readonly systemId: string;
-  readonly status: HealthStatus;
-  readonly lastCheckAt: string | undefined;
-  readonly error: string | undefined;
+  readonly healthStatus: HealthStatus;
+  readonly healthCheckedAt: Date | undefined;
+  readonly healthError: string | undefined;
 }
 
 // ---------------------------------------------------------------------------
@@ -233,7 +243,34 @@ export interface BatchAttestationResponse {
 }
 
 export interface BatchAttestationError {
+  /** Position in the submitted subjectIdentifiers list. index is the durable
+   * key: subjectIdentifier is verbatim on the live response, but a replayed
+   * (Idempotency-Key) response carries a "sha256:<hex>" placeholder instead,
+   * because the cached copy never holds a raw identifier (PRIV-2). Do not key
+   * a retry on it after a replay. */
+  readonly index: number;
+  readonly error: string;
   readonly subjectIdentifier: string;
+}
+
+// ---------------------------------------------------------------------------
+// Batch revocation types
+// ---------------------------------------------------------------------------
+
+/** Result of POST /v1/certificates/batch-revoke. The server answers 200
+ * whether all, some or none of the ids were revoked; `errors` is the only
+ * signal of partial completion. The records in `certificates` never carry a
+ * `statusStatement` (revoking invalidates the cached one). */
+export interface BatchRevokeResponse {
+  readonly certificates: readonly CertificateResponse[];
+  readonly errors: readonly BatchRevokeError[];
+}
+
+export interface BatchRevokeError {
+  /** Position in the submitted certificateIds list. */
+  readonly index: number;
+  readonly certificateId: string;
+  /** Code and message, e.g. "NOT_FOUND: certificate not found". */
   readonly error: string;
 }
 
@@ -266,6 +303,7 @@ export interface WebhookRotateResponse {
   readonly id: string;
   readonly url: string;
   readonly newSecret: string;
+  readonly rotationExpiresAt: Date | undefined;
 }
 
 export interface WebhookDelivery {
@@ -274,6 +312,7 @@ export interface WebhookDelivery {
   readonly eventType: string;
   readonly errorMessage: string;
   readonly attempts: number;
+  readonly nextAttemptAt: Date | undefined;
   readonly createdAt: Date;
 }
 
@@ -287,6 +326,8 @@ export interface ApiKeyListItem {
   readonly id: string;
   readonly prefix: string;
   readonly role: ApiKeyRole;
+  /** The team the key is pinned to; undefined for an unpinned key. */
+  readonly teamId: string | undefined;
   readonly createdAt: Date;
   readonly revokedAt: Date | undefined;
 }
@@ -295,6 +336,8 @@ export interface ApiKeyResponse {
   readonly id: string;
   readonly prefix: string;
   readonly key: string;
+  /** The team the key is pinned to; undefined for an unpinned key. */
+  readonly teamId: string | undefined;
   readonly createdAt: Date;
 }
 
@@ -396,6 +439,7 @@ export function parseCertificateResponse(d: Raw): CertificateResponse {
     revokedAt: parseDtOpt(d.revoked_at),
     revocationReason: d.revocation_reason ?? undefined,
     certificate: d.certificate,
+    statusStatement: d.status_statement ?? undefined,
   };
 }
 
@@ -455,8 +499,9 @@ export function parseConsistencyProof(d: Raw): ConsistencyProof {
 
 function parseBatchAttestationError(d: Raw): BatchAttestationError {
   return {
-    subjectIdentifier: d.subject_identifier,
+    index: d.index,
     error: d.error,
+    subjectIdentifier: d.subject_identifier ?? "",
   };
 }
 
@@ -467,6 +512,21 @@ export function parseBatchAttestationResponse(d: Raw): BatchAttestationResponse
   };
 }
 
+function parseBatchRevokeError(d: Raw): BatchRevokeError {
+  return {
+    index: d.index,
+    certificateId: d.certificate_id,
+    error: d.error,
+  };
+}
+
+export function parseBatchRevokeResponse(d: Raw): BatchRevokeResponse {
+  return {
+    certificates: (d.certificates ?? []).map(parseCertificateResponse),
+    errors: (d.errors ?? []).map(parseBatchRevokeError),
+  };
+}
+
 function parseMonthlyCount(d: Raw): MonthlyCount {
   return {
     month: d.month,
@@ -492,6 +552,7 @@ export function parseWebhookRotateResponse(d: Raw): WebhookRotateResponse {
     id: d.id,
     url: d.url,
     newSecret: d.new_secret,
+    rotationExpiresAt: parseDtOpt(d.rotation_expires_at),
   };
 }
 
@@ -502,6 +563,7 @@ export function parseWebhookDelivery(d: Raw): WebhookDelivery {
     eventType: d.event_type,
     errorMessage: d.error_message,
     attempts: d.attempts,
+    nextAttemptAt: parseDtOpt(d.next_attempt_at),
     createdAt: parseDt(d.created_at),
   };
 }
@@ -511,6 +573,7 @@ export function parseApiKeyListItem(d: Raw): ApiKeyListItem {
     id: d.id,
     prefix: d.prefix,
     role: d.role as ApiKeyRole,
+    teamId: d.team_id ?? undefined,
     createdAt: parseDt(d.created_at),
     revokedAt: parseDtOpt(d.revoked_at),
   };
@@ -521,6 +584,7 @@ export function parseApiKeyResponse(d: Raw): ApiKeyResponse {
     id: d.id,
     prefix: d.prefix,
     key: d.key,
+    teamId: d.team_id ?? undefined,
     createdAt: parseDt(d.created_at),
   };
 }
@@ -544,6 +608,7 @@ export function parseProfile(d: Raw): Profile {
     id: d.id,
     name: d.name,
     email: d.email,
+    pendingEmail: d.pending_email ?? undefined,
     plan: d.plan,
     planStartedAt: d.plan_started_at ?? undefined,
     createdAt: d.created_at,
@@ -554,8 +619,8 @@ export function parseProfile(d: Raw): Profile {
 export function parseSystemHealth(d: Raw): SystemHealth {
   return {
     systemId: d.system_id,
-    status: d.status as HealthStatus,
-    lastCheckAt: d.last_check_at ?? undefined,
-    error: d.error ?? undefined,
+    healthStatus: (d.health_status ?? "UNKNOWN") as HealthStatus,
+    healthCheckedAt: parseDtOpt(d.health_checked_at),
+    healthError: d.health_error ?? undefined,
   };
 }