@atlasauth/backend 0.1.0

package/dist/client/index.js

@@ -0,0 +1,174 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collect = exports.paginate = exports.AtlasApiError = exports.DEFAULT_API_URL = void 0;
+exports.createAtlasClient = createAtlasClient;
+const request_1 = require("./request");
+const users_1 = require("./users");
+const sessions_1 = require("./sessions");
+const organizations_1 = require("./organizations");
+const roles_1 = require("./roles");
+const oauth_clients_1 = require("./oauth-clients");
+const resource_servers_1 = require("./resource-servers");
+const sso_connections_1 = require("./sso-connections");
+const scim_tokens_1 = require("./scim-tokens");
+const domains_1 = require("./domains");
+const waitlist_1 = require("./waitlist");
+const restrictions_1 = require("./restrictions");
+const attack_protection_1 = require("./attack-protection");
+const actor_tokens_1 = require("./actor-tokens");
+const invitations_1 = require("./invitations");
+const webhooks_1 = require("./webhooks");
+const sign_in_tokens_1 = require("./sign-in-tokens");
+const audit_logs_1 = require("./audit-logs");
+const jwt_templates_1 = require("./jwt-templates");
+const api_keys_1 = require("./api-keys");
+const oauth_providers_1 = require("./oauth-providers");
+const sso_onboarding_1 = require("./sso-onboarding");
+const scim_provisioning_1 = require("./scim-provisioning");
+const fga_1 = require("./fga");
+const rate_limit_1 = require("./rate-limit");
+const risk_based_mfa_1 = require("./risk-based-mfa");
+const bot_signals_1 = require("./bot-signals");
+const network_acls_1 = require("./network-acls");
+const managed_waf_1 = require("./managed-waf");
+const log_streams_1 = require("./log-streams");
+const branding_1 = require("./branding");
+const email_templates_1 = require("./email-templates");
+const sms_templates_1 = require("./sms-templates");
+const localizations_1 = require("./localizations");
+const actions_1 = require("./actions");
+const billing_plans_1 = require("./billing-plans");
+const messaging_1 = require("./messaging");
+const import_export_1 = require("./import-export");
+const data_subject_requests_1 = require("./data-subject-requests");
+const radius_clients_1 = require("./radius-clients");
+const lti_platforms_1 = require("./lti-platforms");
+const instance_1 = require("./instance");
+const instance_security_1 = require("./instance-security");
+const tokens_1 = require("./tokens");
+/**
+ * The typed management client for the Atlas Backend API — the secret-key
+ * surface, the peer of `@clerk/backend`'s `createClerkClient`.
+ *
+ * Each namespace is one line: it hands the shared, config-bound `request`
+ * function to a resource factory. That factory is where the method↔endpoint
+ * mapping and the wire types live, so this file stays a table of contents you
+ * can read top to bottom to see the whole surface.
+ */
+function createAtlasClient(config) {
+    const request = (0, request_1.createRequest)(config);
+    return {
+        users: (0, users_1.usersResource)(request),
+        sessions: (0, sessions_1.sessionsResource)(request),
+        organizations: (0, organizations_1.organizationsResource)(request),
+        roles: (0, roles_1.rolesResource)(request),
+        permissions: (0, roles_1.permissionsResource)(request),
+        oauthClients: (0, oauth_clients_1.oauthClientsResource)(request),
+        resourceServers: (0, resource_servers_1.resourceServersResource)(request),
+        ssoConnections: (0, sso_connections_1.ssoConnectionsResource)(request),
+        scimTokens: (0, scim_tokens_1.scimTokensResource)(request),
+        domains: (0, domains_1.domainsResource)(request),
+        waitlist: (0, waitlist_1.waitlistResource)(request),
+        allowlist: (0, restrictions_1.allowlistResource)(request),
+        blocklist: (0, restrictions_1.blocklistResource)(request),
+        attackProtection: (0, attack_protection_1.attackProtectionResource)(request),
+        actorTokens: (0, actor_tokens_1.actorTokensResource)(request),
+        invitations: (0, invitations_1.invitationsResource)(request),
+        webhooks: (0, webhooks_1.webhooksResource)(request),
+        signInTokens: (0, sign_in_tokens_1.signInTokensResource)(request),
+        auditLogs: (0, audit_logs_1.auditLogsResource)(request),
+        jwtTemplates: (0, jwt_templates_1.jwtTemplatesResource)(request),
+        apiKeys: (0, api_keys_1.apiKeysResource)(request),
+        oauthProviders: (0, oauth_providers_1.oauthProvidersResource)(request),
+        ssoOnboarding: (0, sso_onboarding_1.ssoOnboardingResource)(request),
+        scimProvisioning: (0, scim_provisioning_1.scimProvisioningResource)(request),
+        fga: (0, fga_1.fgaResource)(request),
+        rateLimitPolicy: (0, rate_limit_1.rateLimitPolicyResource)(request),
+        riskBasedMfa: (0, risk_based_mfa_1.riskBasedMfaResource)(request),
+        botSignals: (0, bot_signals_1.botSignalsResource)(request),
+        networkAcls: (0, network_acls_1.networkAclsResource)(request),
+        managedWaf: (0, managed_waf_1.managedWafResource)(request),
+        logStreams: (0, log_streams_1.logStreamsResource)(request),
+        branding: (0, branding_1.brandingResource)(request),
+        emailTemplates: (0, email_templates_1.emailTemplatesResource)(request),
+        smsTemplates: (0, sms_templates_1.smsTemplatesResource)(request),
+        localizations: (0, localizations_1.localizationsResource)(request),
+        actions: (0, actions_1.actionsResource)(request),
+        billing: (0, billing_plans_1.billingResource)(request),
+        messaging: (0, messaging_1.messagingResource)(request),
+        importExport: (0, import_export_1.importExportResource)(request),
+        dataSubjectRequests: (0, data_subject_requests_1.dataSubjectRequestsResource)(request),
+        radiusClients: (0, radius_clients_1.radiusClientsResource)(request),
+        ltiPlatforms: (0, lti_platforms_1.ltiPlatformsResource)(request),
+        instance: (0, instance_1.instanceResource)(request),
+        instanceSecurity: (0, instance_security_1.instanceSecurityResource)(request),
+        tokens: (0, tokens_1.tokensResource)(request),
+    };
+}
+var request_2 = require("./request");
+Object.defineProperty(exports, "DEFAULT_API_URL", { enumerable: true, get: function () { return request_2.DEFAULT_API_URL; } });
+var error_1 = require("./error");
+Object.defineProperty(exports, "AtlasApiError", { enumerable: true, get: function () { return error_1.AtlasApiError; } });
+var paginate_1 = require("./paginate");
+Object.defineProperty(exports, "paginate", { enumerable: true, get: function () { return paginate_1.paginate; } });
+Object.defineProperty(exports, "collect", { enumerable: true, get: function () { return paginate_1.collect; } });
+// Resource types — exported so callers can annotate their own code.
+__exportStar(require("./types"), exports);
+__exportStar(require("./users"), exports);
+__exportStar(require("./sessions"), exports);
+__exportStar(require("./organizations"), exports);
+__exportStar(require("./roles"), exports);
+__exportStar(require("./oauth-clients"), exports);
+__exportStar(require("./resource-servers"), exports);
+__exportStar(require("./sso-connections"), exports);
+__exportStar(require("./scim-tokens"), exports);
+__exportStar(require("./domains"), exports);
+__exportStar(require("./waitlist"), exports);
+__exportStar(require("./restrictions"), exports);
+__exportStar(require("./attack-protection"), exports);
+__exportStar(require("./actor-tokens"), exports);
+__exportStar(require("./invitations"), exports);
+__exportStar(require("./webhooks"), exports);
+__exportStar(require("./sign-in-tokens"), exports);
+__exportStar(require("./audit-logs"), exports);
+__exportStar(require("./jwt-templates"), exports);
+__exportStar(require("./api-keys"), exports);
+__exportStar(require("./oauth-providers"), exports);
+__exportStar(require("./sso-onboarding"), exports);
+__exportStar(require("./scim-provisioning"), exports);
+__exportStar(require("./fga"), exports);
+__exportStar(require("./rate-limit"), exports);
+__exportStar(require("./risk-based-mfa"), exports);
+__exportStar(require("./bot-signals"), exports);
+__exportStar(require("./network-acls"), exports);
+__exportStar(require("./managed-waf"), exports);
+__exportStar(require("./log-streams"), exports);
+__exportStar(require("./branding"), exports);
+__exportStar(require("./email-templates"), exports);
+__exportStar(require("./sms-templates"), exports);
+__exportStar(require("./localizations"), exports);
+__exportStar(require("./actions"), exports);
+__exportStar(require("./billing-plans"), exports);
+__exportStar(require("./messaging"), exports);
+__exportStar(require("./import-export"), exports);
+__exportStar(require("./data-subject-requests"), exports);
+__exportStar(require("./radius-clients"), exports);
+__exportStar(require("./lti-platforms"), exports);
+__exportStar(require("./instance"), exports);
+__exportStar(require("./instance-security"), exports);
+__exportStar(require("./tokens"), exports);
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAsDA,8CAkDC;AAxGD,uCAAkE;AAClE,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,qCAA0C;AAE1C;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IAEtC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;KAChC,CAAC;AACJ,CAAC;AAMD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,2CAAyB"}

package/dist/client/instance-security.d.ts

@@ -0,0 +1,79 @@
+import { type RequestFn } from './request';
+/**
+ * §5/§11.2 instance security config — the agent mirror of the dashboard security
+ * screen. Settings that live OUTSIDE `auth_config` (so a raw `PATCH /v1/instance`
+ * cannot reach them): the per-flow kill switches, the customer IP allowlist, and
+ * the write-only provider secrets (captcha, Kerberos proxy, LDAP bind password).
+ * No secret is ever readable back.
+ */
+export interface InstanceKillSwitches {
+    /** Refuse sign-ups for this instance only. */
+    disableSignUps?: boolean;
+    /** Refuse all sign-ins for this instance — the heaviest per-tenant control. */
+    disableSignIns?: boolean;
+    /** Require a bot challenge for this instance only. */
+    forceChallenge?: boolean;
+    /** Provider keys temporarily refused (e.g. a provider outage). */
+    disabledProviders?: string[];
+}
+export interface InstanceSecurity {
+    object: 'instance_security';
+    kill_switches: InstanceKillSwitches;
+    ip_allowlist: string[];
+}
+export interface UpdateInstanceSecurityBody {
+    kill_switches?: InstanceKillSwitches;
+    /** CIDRs / IPs; `[]` clears the allowlist. Every entry is validated. */
+    ip_allowlist?: string[];
+    /**
+     * Required to set an allowlist that omits the caller's own IP — which would
+     * lock THIS management API out irreversibly. Otherwise such a list is a 422.
+     */
+    confirm_lockout?: boolean;
+}
+/** A confirmed self-lockout returns the config plus a plain-language `warning`. */
+export interface InstanceSecurityResult extends InstanceSecurity {
+    warning?: string;
+}
+export declare function instanceSecurityResource(request: RequestFn): {
+    get(): Promise<InstanceSecurity>;
+    update(body: UpdateInstanceSecurityBody): Promise<InstanceSecurityResult>;
+    /** Store the captcha provider secret. Refused while the provider is `none`. */
+    setCaptchaSecret(body: {
+        secret: string;
+    }): Promise<{
+        object: "captcha_secret";
+        provider: string;
+        set: true;
+    }>;
+    deleteCaptchaSecret(): Promise<{
+        object: "captcha_secret";
+        provider: string;
+        deleted: true;
+    }>;
+    /** Store the Kerberos/IWA trusted-proxy secret. Refused while the strategy is off. */
+    setKerberosSecret(body: {
+        secret: string;
+    }): Promise<{
+        object: "kerberos_secret";
+        set: true;
+    }>;
+    deleteKerberosSecret(): Promise<{
+        object: "kerberos_secret";
+        deleted: true;
+    }>;
+    /** Store an LDAP connection's service-account bind password. The connection
+     *  must already exist in `auth_config.ldap.connections`. */
+    setLdapBindPassword(connectionId: string, body: {
+        bind_password: string;
+    }): Promise<{
+        object: "ldap_bind_password";
+        connection_id: string;
+        set: true;
+    }>;
+    deleteLdapBindPassword(connectionId: string): Promise<{
+        object: "ldap_bind_password";
+        connection_id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/instance-security.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.instanceSecurityResource = instanceSecurityResource;
+const request_1 = require("./request");
+function instanceSecurityResource(request) {
+    return {
+        get() {
+            return request({ method: 'GET', path: '/v1/instance/security' });
+        },
+        update(body) {
+            return request({ method: 'PATCH', path: '/v1/instance/security', body });
+        },
+        /** Store the captcha provider secret. Refused while the provider is `none`. */
+        setCaptchaSecret(body) {
+            return request({ method: 'PUT', path: '/v1/instance/captcha_secret', body });
+        },
+        deleteCaptchaSecret() {
+            return request({ method: 'DELETE', path: '/v1/instance/captcha_secret' });
+        },
+        /** Store the Kerberos/IWA trusted-proxy secret. Refused while the strategy is off. */
+        setKerberosSecret(body) {
+            return request({ method: 'PUT', path: '/v1/instance/kerberos_secret', body });
+        },
+        deleteKerberosSecret() {
+            return request({ method: 'DELETE', path: '/v1/instance/kerberos_secret' });
+        },
+        /** Store an LDAP connection's service-account bind password. The connection
+         *  must already exist in `auth_config.ldap.connections`. */
+        setLdapBindPassword(connectionId, body) {
+            return request({
+                method: 'PUT',
+                path: `/v1/instance/ldap_connections/${(0, request_1.enc)(connectionId)}/bind_password`,
+                body,
+            });
+        },
+        deleteLdapBindPassword(connectionId) {
+            return request({
+                method: 'DELETE',
+                path: `/v1/instance/ldap_connections/${(0, request_1.enc)(connectionId)}/bind_password`,
+            });
+        },
+    };
+}
+//# sourceMappingURL=instance-security.js.map

package/dist/client/instance-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;AA2CA,4DAgDC;AA3FD,uCAAgD;AA2ChD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,+EAA+E;QAC/E,gBAAgB,CACd,IAAwB;YAExB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,sFAAsF;QACtF,iBAAiB,CAAC,IAAwB;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,oBAAoB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED;oEAC4D;QAC5D,mBAAmB,CACjB,YAAoB,EACpB,IAA+B;YAE/B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;gBACxE,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,sBAAsB,CACpB,YAAoB;YAEpB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/instance.d.ts

@@ -0,0 +1,34 @@
+import type { RequestFn } from './request';
+import type { Metadata } from './types';
+/**
+ * §9.3 instance configuration. The instance is the tenant's environment (its
+ * publishable key, frontend API host, allowed origins and auth config). The
+ * signing private key is never returned. JWT templates live under their own
+ * `jwtTemplates` resource, not here.
+ */
+export interface Instance {
+    object: 'instance';
+    id: string;
+    environment: string;
+    publishable_key: string;
+    frontend_api_host: string;
+    allowed_origins: string[];
+    auth_config: Metadata;
+    created_at: number;
+}
+export interface UpdateInstanceBody {
+    /** Exact origins only — a wildcard or a path is rejected (§13.1). */
+    allowed_origins?: string[];
+    auth_config?: Record<string, unknown>;
+}
+/** `PATCH /v1/instance` echoes only the mutable fields, not a full Instance. */
+export interface InstanceUpdateResult {
+    object: 'instance';
+    id: string;
+    allowed_origins: string[];
+    auth_config: Metadata;
+}
+export declare function instanceResource(request: RequestFn): {
+    get(): Promise<Instance>;
+    update(body: UpdateInstanceBody): Promise<InstanceUpdateResult>;
+};

package/dist/client/instance.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.instanceResource = instanceResource;
+function instanceResource(request) {
+    return {
+        get() {
+            return request({ method: 'GET', path: '/v1/instance' });
+        },
+        update(body) {
+            return request({ method: 'PATCH', path: '/v1/instance', body });
+        },
+    };
+}
+//# sourceMappingURL=instance.js.map

package/dist/client/instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAmCA,4CASC;AATD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/invitations.d.ts

@@ -0,0 +1,21 @@
+import { type RequestFn } from './request';
+import type { CursorPage, CursorParams, Metadata } from './types';
+export interface Invitation {
+    object: 'invitation';
+    id: string;
+    email_address: string;
+    status: string;
+    public_metadata: Metadata;
+    expires_at: number;
+    accepted_at: number | null;
+    created_at: number;
+}
+export interface CreateInvitationBody {
+    email_address: string;
+    public_metadata?: Metadata;
+}
+export declare function invitationsResource(request: RequestFn): {
+    list(params?: CursorParams): Promise<CursorPage<Invitation>>;
+    create(body: CreateInvitationBody, idempotencyKey?: string): Promise<Invitation>;
+    revoke(id: string): Promise<Invitation>;
+};

package/dist/client/invitations.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.invitationsResource = invitationsResource;
+const request_1 = require("./request");
+function invitationsResource(request) {
+    return {
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/invitations', query: { ...params } });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/invitations', body, idempotencyKey });
+        },
+        revoke(id) {
+            return request({ method: 'POST', path: `/v1/invitations/${(0, request_1.enc)(id)}/revoke` });
+        },
+    };
+}
+//# sourceMappingURL=invitations.js.map

package/dist/client/invitations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitations.js","sourceRoot":"","sources":["../../src/client/invitations.ts"],"names":[],"mappings":";;AAmBA,kDAYC;AA/BD,uCAAgD;AAmBhD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,IAAI,CAAC,SAAuB,EAAE;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/jwt-templates.d.ts

@@ -0,0 +1,26 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface JwtTemplate {
+    object: 'jwt_template';
+    name: string;
+    claims: Record<string, string>;
+}
+export interface CreateJwtTemplateBody {
+    name: string;
+    claims: Record<string, string>;
+}
+export declare function jwtTemplatesResource(request: RequestFn): {
+    list(): Promise<ListPage<JwtTemplate>>;
+    /** Fetched by template name. */
+    get(name: string): Promise<JwtTemplate>;
+    create(body: CreateJwtTemplateBody): Promise<JwtTemplate>;
+    /** Only the claims are updatable; the name is the key. */
+    update(name: string, body: {
+        claims: Record<string, string>;
+    }): Promise<JwtTemplate>;
+    delete(name: string): Promise<{
+        object: "jwt_template";
+        name: string;
+        deleted: true;
+    }>;
+};

package/dist/client/jwt-templates.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jwtTemplatesResource = jwtTemplatesResource;
+const request_1 = require("./request");
+function jwtTemplatesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/jwt_templates' });
+        },
+        /** Fetched by template name. */
+        get(name) {
+            return request({ method: 'GET', path: `/v1/jwt_templates/${(0, request_1.enc)(name)}` });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/jwt_templates', body });
+        },
+        /** Only the claims are updatable; the name is the key. */
+        update(name, body) {
+            return request({ method: 'PATCH', path: `/v1/jwt_templates/${(0, request_1.enc)(name)}`, body });
+        },
+        delete(name) {
+            return request({ method: 'DELETE', path: `/v1/jwt_templates/${(0, request_1.enc)(name)}` });
+        },
+    };
+}
+//# sourceMappingURL=jwt-templates.js.map

package/dist/client/jwt-templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-templates.js","sourceRoot":"","sources":["../../src/client/jwt-templates.ts"],"names":[],"mappings":";;AAcA,oDAoBC;AAlCD,uCAAgD;AAchD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,gCAAgC;QAChC,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,0DAA0D;QAC1D,MAAM,CAAC,IAAY,EAAE,IAAwC;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/localizations.d.ts

@@ -0,0 +1,43 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/** The surface a localization row overrides for one locale. */
+export type LocalizationResourceType = 'email_template' | 'sms_template' | 'prompt_copy';
+/**
+ * A per-locale override the render paths resolve at send/render time. Always an
+ * OVERRIDE: the base renders whenever no row matches the target locale, so a row
+ * can only change a surface for one locale, never break it. Timestamps are ISO
+ * strings, not epoch numbers.
+ */
+export interface Localization {
+    object: 'localization';
+    id: string;
+    resource_type: LocalizationResourceType;
+    resource_name: string;
+    locale: string;
+    content: Record<string, unknown>;
+    enabled: boolean;
+    created_at: string;
+    updated_at: string;
+}
+export interface ListLocalizationsParams {
+    resource_type?: string;
+    resource_name?: string;
+    locale?: string;
+}
+export interface CreateLocalizationBody {
+    resource_type: LocalizationResourceType;
+    resource_name: string;
+    locale: string;
+    content: Record<string, unknown>;
+    enabled?: boolean;
+}
+export declare function localizationsResource(request: RequestFn): {
+    list(params?: ListLocalizationsParams): Promise<ListPage<Localization>>;
+    create(body: CreateLocalizationBody, idempotencyKey?: string): Promise<Localization>;
+    get(id: string): Promise<Localization>;
+    update(id: string, body: {
+        content?: Record<string, unknown>;
+        enabled?: boolean;
+    }): Promise<Localization>;
+    delete(id: string): Promise<void>;
+};

package/dist/client/localizations.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.localizationsResource = localizationsResource;
+const request_1 = require("./request");
+function localizationsResource(request) {
+    return {
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/localizations', query: { ...params } });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/localizations', body, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/localizations/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/localizations/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/localizations/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=localizations.js.map

package/dist/client/localizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localizations.js","sourceRoot":"","sources":["../../src/client/localizations.ts"],"names":[],"mappings":";;AAsCA,sDAqBC;AA3DD,uCAAgD;AAsChD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI,CAAC,SAAkC,EAAE;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CACJ,EAAU,EACV,IAA8D;YAE9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/log-streams.d.ts

@@ -0,0 +1,66 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type LogStreamType = 'http' | 'datadog' | 'splunk';
+/**
+ * A log stream — the instance event feed forwarded to an external sink (generic
+ * HTTP, Datadog, Splunk HEC), Auth0-style. Destination SECRETS (datadog api_key,
+ * splunk token, http auth headers) are write-only: encrypted at rest and never
+ * returned, so the `destination` here carries only non-secret fields plus `has_*`
+ * markers.
+ */
+export interface LogStream {
+    object: 'log_stream';
+    id: string;
+    name: string;
+    type: LogStreamType;
+    enabled: boolean;
+    status: string;
+    event_filter: string[] | null;
+    /** Non-secret destination fields plus has_* markers; NEVER a secret value. */
+    destination: Record<string, unknown>;
+    cursor: string | null;
+    consecutive_failures: number;
+    last_error: string | null;
+    last_delivered_at: number | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateLogStreamBody {
+    name: string;
+    type: LogStreamType;
+    /** Shape depends on `type`: http {url,headers?}, datadog {site,api_key}, splunk {hec_endpoint,token}. */
+    destination: Record<string, unknown>;
+    /** null (or omitted) forwards everything; an array of event-type prefixes filters. */
+    event_filter?: string[] | null;
+    enabled?: boolean;
+}
+/** PATCH accepts everything create does except `type`, which is immutable. */
+export interface UpdateLogStreamBody {
+    name?: string;
+    /** Merged over the stored destination; a secret left out is kept. */
+    destination?: Record<string, unknown>;
+    event_filter?: string[] | null;
+    enabled?: boolean;
+    status?: 'active' | 'paused';
+}
+/** The tester's outcome: one synthetic event sent to the sink, its status reported. */
+export interface LogStreamTestResult {
+    object: 'log_stream_test_result';
+    id: string;
+    ok: boolean;
+    status: number | null;
+    error: string | null;
+}
+export declare function logStreamsResource(request: RequestFn): {
+    list(): Promise<ListPage<LogStream>>;
+    get(id: string): Promise<LogStream>;
+    create(body: CreateLogStreamBody, idempotencyKey?: string): Promise<LogStream>;
+    update(id: string, body: UpdateLogStreamBody): Promise<LogStream>;
+    delete(id: string): Promise<{
+        object: "log_stream";
+        id: string;
+        deleted: true;
+    }>;
+    /** Send ONE synthetic event with the real credentials; the cursor is never touched. */
+    test(id: string): Promise<LogStreamTestResult>;
+};

package/dist/client/log-streams.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logStreamsResource = logStreamsResource;
+const request_1 = require("./request");
+function logStreamsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/log_streams' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/log_streams/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/log_streams', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/log_streams/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/log_streams/${(0, request_1.enc)(id)}` });
+        },
+        /** Send ONE synthetic event with the real credentials; the cursor is never touched. */
+        test(id) {
+            return request({ method: 'POST', path: `/v1/log_streams/${(0, request_1.enc)(id)}/test` });
+        },
+    };
+}
+//# sourceMappingURL=log-streams.js.map

package/dist/client/log-streams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-streams.js","sourceRoot":"","sources":["../../src/client/log-streams.ts"],"names":[],"mappings":";;AA2DA,gDAsBC;AAjFD,uCAAgD;AA2DhD,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,IAAyB,EAAE,cAAuB;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAyB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,uFAAuF;QACvF,IAAI,CAAC,EAAU;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC"}