[fern-api]

🔧 Changes

Regenerates the Management API SDK with Fern generator 3.107.6 (previously 3.107.1).

This release:

• adds admin endpoints for user consent signing keys;
• adds oidc_support to Client responses;
• adds otp_settings to database connection options;
• adds a resource server type (universal_commerce_protocol_server);
• adds SAML cross-app-access requesting app fields;
• adds a status filter to segment listing.

All API changes are additive. The core runtime (core/, errors/, BaseClient.ts) is unchanged, and there are no breaking changes.

• Users – consent signing keys (new)
  • users.listConsentSigningKeys(id): GET /users/{id}/consent-signing-keys. Returns ListUserConsentSigningKeysResponseContent (ConsentSigningKey[]); the array is empty when the user has no keys.
  • users.getConsentSigningKey(id, kid): GET /users/{id}/consent-signing-keys/{kid}.
  • users.deleteConsentSigningKey(id, kid): DELETE /users/{id}/consent-signing-keys/{kid}.
  • New type ConsentSigningKey: kid, device_identifier, created_at, expires_at (all required).
  • Errors: 400 / 401 / 403 / 429 on all three, plus 404 on getConsentSigningKey.
  • Path parameters go through encodePathParam(…, errors.ManagementError), so . / .. are rejected before any request is sent.
• Clients – oidc_support
  • New ClientOidcSupport (is_allowed?, allow_all_scopes?, allowed_scopes?) on Client, ClientSearchResponse, and the Get / Create / Update / RotateSecret ClientResponseContent types. The request-side types (ClientOidcSupportPost / Patch) were already present.
  • allowed_scopes uses the existing ClientOidcSupportAllowedScopesEnum: profile | email | address | phone.
• Connections
  • New otp_settings?: ConnectionOtpSettings (email?, phone?) on ConnectionOptionsAuth0, ConnectionPropertiesOptions and UpdateConnectionOptions.
  • New ConnectionOtpChannelSettings: otp_length? (digits), otp_expiry? (seconds).
  • SAML: ConnectionOptionsSaml gains client_id? and client_secret?. Their types are ConnectionClientIdSamlxaaRequestingApp (an alias of ConnectionClientIdOidc) and ConnectionClientSecretSamlxaaRequestingApp; both are strings.
  • ConnectionResponseContentSaml, CreateConnectionRequestContentSaml and UpdateConnectionRequestContentSaml gain cross_app_access_requesting_app?.
• Resource Servers: new type?: ResourceServerTypeEnum | null on CreateResourceServerRequestContent / UpdateResourceServerRequestContent and on all resource server response types (ResourceServer, ResourceServerSearchResponse, Create / Get / Update ResourceServerResponseContent). ResourceServerTypeEnum has one value, universal_commerce_protocol_server.
• Experimentation: experimentation.segments.list() accepts status?: SegmentStatusEnum | null (active | archived) and sends it as a query parameter.
• Attack Protection: form_submission_mode moves before max_attempts in the brute-force settings types. Ordering only; no type change.
• Tenant settings: the JSDoc for TenantSettingsFlags.dashboard_insights_view now marks it deprecated (it has no effect).
• Tests: Stream.test.ts keeps the Promise<ReadableStream> return type on the null-reconnect stub, so the @ts-expect-error stays valid. The generator drops this annotation; it is reapplied here as a replay customisation, as originally fixed in feat: add SSE reconnection, passkey guardian factor, and additionalBodyParameters; reject dot-segment path params #1428.
• Version, docs and dependencies
  • package.json and src/management/version.ts: version bumped from 7.6.0 to 7.6.1.
  • reference.md regenerated: adds users.listConsentSigningKeys, users.getConsentSigningKey and users.deleteConsentSigningKey.
  • yarn.lock refreshed with dev / transitive updates only:
    • @babel/* 7.29.11 (including @babel/types);
    • @typescript-eslint/* 8.72.1;
    • baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases, schema-utils, tldts-core, and a few other transitive packages.
  • .fern/replay.lock updated for the new generation.

// Consent signing keys
const keys = await client.users.listConsentSigningKeys("auth0|123");
const key = await client.users.getConsentSigningKey("auth0|123", keys[0].kid);
await client.users.deleteConsentSigningKey("auth0|123", key.kid);

// Resource server type
await client.resourceServers.create({
    identifier: "https://ucp.example.com",
    type: "universal_commerce_protocol_server",
});

// OTP settings on a database connection
await client.connections.update("con_123", {
    options: { otp_settings: { email: { otp_length: 6, otp_expiry: 900 } } },
});

// OIDC support on a client response
const app = await client.clients.get("client_id");
console.log(app.oidc_support?.is_allowed, app.oidc_support?.allowed_scopes);

// Segments filtered by status
await client.experimentation.segments.list({ status: "active" });

🔬 Testing

• wire/users.test.ts: 16 new tests for consent signing keys (listConsentSigningKeys 1–5, getConsentSigningKey 1–6, deleteConsentSigningKey 1–5), covering success and the 400 / 401 / 403 / 404 / 429 error paths.
• wire/clients.test.ts: oidc_support added to the client response fixtures.
• wire/resourceServers.test.ts: type added to the resource server request and response fixtures.
• wire/experimentation/segments.test.ts: status added to the list() request.
• wire/attackProtection/bruteForceProtection.test.ts: fixture field order updated to match the type.
• unit/stream/Stream.test.ts: return-type annotation on the null-reconnect stub restored (see Changes).
• Locally: yarn test passes 207/207 suites and 4,865 tests across the unit, wire and root projects. tsc --noEmit is clean, yarn build succeeds, and lint reports no errors.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov]

Codecov Report

❌ Patch coverage is 87.87879% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.46%. Comparing base (b064402) to head (f1f0713).

Files with missing lines	Patch %	Lines
...rc/management/api/resources/users/client/Client.ts	87.36%	12 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1436      +/-   ##
==========================================
- Coverage   89.47%   89.46%   -0.01%     
==========================================
  Files         449      449              
  Lines       22784    22881      +97     
  Branches    10823    10882      +59     
==========================================
+ Hits        20386    20471      +85     
- Misses       2398     2410      +12     

Flag	Coverage Δ
alltests	89.46% <87.87%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...xperimentation/resources/segments/client/Client.ts	89.06% <100.00%> (+0.05%)	⬆️
src/management/api/types/types.ts	100.00% <100.00%> (ø)
src/management/version.ts	100.00% <100.00%> (ø)
...rc/management/api/resources/users/client/Client.ts	89.55% <87.36%> (-0.59%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ankita10119]

LGTM

[developerkunal]

LGTM