@atlasauth/backend 0.1.0

package/dist/client/lti-platforms.d.ts

@@ -0,0 +1,49 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * An LTI 1.3 platform (LMS) registration for a core launch. Every field is a
+ * PUBLIC trust anchor — a launch is verified against the platform's own
+ * published JWKS, not a shared secret — so a registration is fully readable and
+ * editable with no reveal-once.
+ */
+export interface LtiPlatform {
+    object: 'lti_platform';
+    id: string;
+    organization_id: string | null;
+    issuer: string;
+    client_id: string;
+    auth_login_url: string;
+    jwks_uri: string;
+    deployment_ids: string[];
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateLtiPlatformBody {
+    issuer: string;
+    client_id: string;
+    /** An absolute https URL. */
+    auth_login_url: string;
+    /** An absolute https URL. */
+    jwks_uri: string;
+    /** At least one deployment id is required. */
+    deployment_ids: string[];
+    organization_id?: string;
+}
+export interface UpdateLtiPlatformBody {
+    auth_login_url?: string;
+    jwks_uri?: string;
+    deployment_ids?: string[];
+    /** Pass `null` to unbind the platform from an organization. */
+    organization_id?: string | null;
+}
+export declare function ltiPlatformsResource(request: RequestFn): {
+    list(): Promise<ListPage<LtiPlatform>>;
+    get(id: string): Promise<LtiPlatform>;
+    create(body: CreateLtiPlatformBody, idempotencyKey?: string): Promise<LtiPlatform>;
+    update(id: string, body: UpdateLtiPlatformBody): Promise<LtiPlatform>;
+    delete(id: string): Promise<{
+        object: "lti_platform";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/lti-platforms.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ltiPlatformsResource = ltiPlatformsResource;
+const request_1 = require("./request");
+function ltiPlatformsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/lti_platforms' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/lti_platforms/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/lti_platforms', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/lti_platforms/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/lti_platforms/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=lti-platforms.js.map

package/dist/client/lti-platforms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lti-platforms.js","sourceRoot":"","sources":["../../src/client/lti-platforms.ts"],"names":[],"mappings":";;AA0CA,oDAkBC;AA5DD,uCAAgD;AA0ChD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/managed-waf.d.ts

@@ -0,0 +1,100 @@
+import { type RequestFn } from './request';
+/** Credential config, with secrets reduced to `has_*` markers. */
+export interface ManagedWafCredential {
+    /** 'keys' (BYO IAM key/secret) | 'role' (cross-account STS AssumeRole). */
+    mode: string;
+    /** `keys` mode: the IAM access key id (an identifier, not a secret). */
+    access_key_id: string | null;
+    /** Whether a secret access key EXISTS — never the secret itself. */
+    has_secret_access_key: boolean;
+    /** `role` mode: the ARN of the cross-account role Atlas assumes. */
+    role_arn: string | null;
+    /** Whether an AssumeRole ExternalId EXISTS — never the value itself. */
+    has_external_id: boolean;
+}
+/**
+ * §5 Managed AWS WAF config + provisioning state. Secrets are write-only and
+ * NEVER returned; GET exposes only `has_*` markers. When the instance has no
+ * config the response collapses to `{ configured: false, enabled: false,
+ * status: 'disabled' }` and the config fields are absent.
+ */
+export interface ManagedWaf {
+    object: 'managed_waf';
+    configured: boolean;
+    enabled: boolean;
+    /** 'disabled' | 'active' | 'error' */
+    status: string;
+    scope?: string;
+    region?: string;
+    web_acl_name?: string;
+    edge_resource_arn?: string | null;
+    cloudfront_distribution_id?: string | null;
+    token_domains?: string[];
+    gated_paths?: string[];
+    immunity_seconds?: number;
+    credential?: ManagedWafCredential;
+    web_acl_id?: string | null;
+    web_acl_arn?: string | null;
+    last_error?: string | null;
+    last_provisioned_at?: number | null;
+    updated_at?: number;
+}
+/** Just the provisioning state — what `GET /v1/managed_waf/status` returns. */
+export interface ManagedWafStatus {
+    object: 'managed_waf_status';
+    enabled: boolean;
+    status: string;
+    web_acl_id: string | null;
+    web_acl_arn: string | null;
+    last_error: string | null;
+    last_provisioned_at: number | null;
+}
+/**
+ * The outcome of a provision/deprovision: the full config plus the FAIL-SAFE
+ * result. An AWS failure rides `ok: false` + `error` in the body rather than
+ * throwing, so it never looks like an Atlas outage.
+ */
+export type ManagedWafOutcome = ManagedWaf & {
+    ok: boolean;
+    error: string | null;
+};
+export interface UpdateManagedWafBody {
+    enabled?: boolean;
+    /** 'REGIONAL' | 'CLOUDFRONT' */
+    scope?: string;
+    region?: string;
+    web_acl_name?: string;
+    edge_resource_arn?: string | null;
+    cloudfront_distribution_id?: string | null;
+    token_domains?: string[];
+    gated_paths?: string[];
+    /** 60..86400 seconds. */
+    immunity_seconds?: number;
+    credential?: {
+        /** 'keys' | 'role' */
+        mode?: string;
+        access_key_id?: string | null;
+        /** Write-only: accepted, encrypted at rest, never returned. */
+        secret_access_key?: string | null;
+        role_arn?: string | null;
+        /** Write-only: accepted, encrypted at rest, never returned. */
+        external_id?: string | null;
+    };
+}
+/**
+ * The self-service control plane for Atlas's managed AWS WAF captcha gate —
+ * config + write-only credentials, and the provision/deprovision actions that
+ * reconcile the WebACL.
+ */
+export declare function managedWafResource(request: RequestFn): {
+    /** Read config + provisioning state, with secrets reduced to `has_*` markers. */
+    get(): Promise<ManagedWaf>;
+    /** Read just the provisioning state. */
+    status(): Promise<ManagedWafStatus>;
+    /** Set config and write-only credentials; omitted fields are left unchanged. */
+    update(body: UpdateManagedWafBody): Promise<ManagedWaf>;
+    /** Apply now — idempotent create/update + associate the WebACL. */
+    provision(): Promise<ManagedWafOutcome>;
+    /** Disassociate and delete the WebACL. */
+    deprovision(): Promise<ManagedWafOutcome>;
+};

package/dist/client/managed-waf.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.managedWafResource = managedWafResource;
+/**
+ * The self-service control plane for Atlas's managed AWS WAF captcha gate —
+ * config + write-only credentials, and the provision/deprovision actions that
+ * reconcile the WebACL.
+ */
+function managedWafResource(request) {
+    return {
+        /** Read config + provisioning state, with secrets reduced to `has_*` markers. */
+        get() {
+            return request({ method: 'GET', path: '/v1/managed_waf' });
+        },
+        /** Read just the provisioning state. */
+        status() {
+            return request({ method: 'GET', path: '/v1/managed_waf/status' });
+        },
+        /** Set config and write-only credentials; omitted fields are left unchanged. */
+        update(body) {
+            return request({ method: 'PUT', path: '/v1/managed_waf', body });
+        },
+        /** Apply now — idempotent create/update + associate the WebACL. */
+        provision() {
+            return request({ method: 'POST', path: '/v1/managed_waf/provision' });
+        },
+        /** Disassociate and delete the WebACL. */
+        deprovision() {
+            return request({ method: 'POST', path: '/v1/managed_waf/deprovision' });
+        },
+    };
+}
+//# sourceMappingURL=managed-waf.js.map

package/dist/client/managed-waf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-waf.js","sourceRoot":"","sources":["../../src/client/managed-waf.ts"],"names":[],"mappings":";;AA8FA,gDAuBC;AA5BD;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,iFAAiF;QACjF,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,wCAAwC;QACxC,MAAM;YACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,gFAAgF;QAChF,MAAM,CAAC,IAA0B;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,mEAAmE;QACnE,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,0CAA0C;QAC1C,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC1E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/messaging.d.ts

@@ -0,0 +1,56 @@
+import { type RequestFn } from './request';
+/**
+ * §BYOK messaging provider config — wire the tenant's own email/SMS provider
+ * (Resend/SES/SMTP/Brevo/Mailgun, Twilio) over the secret-key BAPI.
+ *
+ * A provider SECRET is WRITE-ONLY: it goes in through `config` and is never
+ * read back — a response reports only WHICH secret keys are set (`secrets_set`).
+ * Omit a secret on an edit to keep the stored one (so a from-address change need
+ * not re-enter the API key).
+ */
+export interface MessagingProvider {
+    object: 'messaging_provider';
+    channel: 'email' | 'sms';
+    transport: string;
+    from_address: string | null;
+    status: string;
+    /** Non-secret config only — secret values are stripped before serialising. */
+    config: Record<string, unknown>;
+    /** Which secret keys are set for this transport, never their values. */
+    secrets_set: Record<string, boolean>;
+    updated_at: number;
+}
+export interface MessagingProviders {
+    object: 'messaging_providers';
+    email: MessagingProvider | null;
+    sms: MessagingProvider | null;
+}
+export interface MessagingProviderInput {
+    /** The transport, e.g. `resend`, `ses`, `smtp` (email) or `twilio` (sms). */
+    transport: string;
+    from_address?: string;
+    /** Transport config; carries the write-only secret keys on write. */
+    config?: Record<string, unknown>;
+}
+export interface MessagingTestResult {
+    object: 'messaging_test';
+    channel: string;
+    sent_to: string;
+    ok: true;
+}
+export interface DeletedMessagingProvider {
+    object: 'messaging_provider';
+    channel: string;
+    deleted: true;
+}
+export declare function messagingResource(request: RequestFn): {
+    /** The instance's configured email and SMS providers, secrets omitted. */
+    get(): Promise<MessagingProviders>;
+    setEmail(body: MessagingProviderInput): Promise<MessagingProvider>;
+    setSms(body: MessagingProviderInput): Promise<MessagingProvider>;
+    deleteChannel(channel: "email" | "sms"): Promise<DeletedMessagingProvider>;
+    /** Send a fixed, clearly-marked test message through the channel's provider. */
+    test(channel: "email" | "sms", body: {
+        to: string;
+    }): Promise<MessagingTestResult>;
+};

package/dist/client/messaging.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.messagingResource = messagingResource;
+const request_1 = require("./request");
+function messagingResource(request) {
+    return {
+        /** The instance's configured email and SMS providers, secrets omitted. */
+        get() {
+            return request({ method: 'GET', path: '/v1/messaging_providers' });
+        },
+        setEmail(body) {
+            return request({ method: 'PUT', path: '/v1/messaging_providers/email', body });
+        },
+        setSms(body) {
+            return request({ method: 'PUT', path: '/v1/messaging_providers/sms', body });
+        },
+        deleteChannel(channel) {
+            return request({ method: 'DELETE', path: `/v1/messaging_providers/${(0, request_1.enc)(channel)}` });
+        },
+        /** Send a fixed, clearly-marked test message through the channel's provider. */
+        test(channel, body) {
+            return request({
+                method: 'POST',
+                path: `/v1/messaging_providers/${(0, request_1.enc)(channel)}/test`,
+                body,
+            });
+        },
+    };
+}
+//# sourceMappingURL=messaging.js.map

package/dist/client/messaging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAmDA,8CAwBC;AA3ED,uCAAgD;AAmDhD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,IAA4B;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,aAAa,CAAC,OAAwB;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/network-acls.d.ts

@@ -0,0 +1,50 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type NetworkAclAction = 'allow' | 'deny';
+/**
+ * §11.2 a per-instance IP allow/deny rule — a richer control than the single
+ * ip_allowlist, layered on top of it. Rules are evaluated in priority order
+ * (lower first), first match wins.
+ */
+export interface NetworkAcl {
+    object: 'network_acl';
+    id: string;
+    action: NetworkAclAction;
+    /** A single IP or CIDR range; refused at write time if malformed. */
+    cidr: string;
+    description: string | null;
+    priority: number;
+    enabled: boolean;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateNetworkAclBody {
+    action: NetworkAclAction;
+    cidr: string;
+    description?: string | null;
+    priority?: number;
+    enabled?: boolean;
+}
+export interface UpdateNetworkAclBody {
+    action?: NetworkAclAction;
+    cidr?: string;
+    description?: string | null;
+    priority?: number;
+    enabled?: boolean;
+}
+/**
+ * CRUD over the instance's Network ACL rules. Enforcement lives in the request
+ * choke point; this surface just manages the rules, and every write is audited.
+ */
+export declare function networkAclsResource(request: RequestFn): {
+    /** All rules for the instance, in priority order. */
+    list(): Promise<ListPage<NetworkAcl>>;
+    get(id: string): Promise<NetworkAcl>;
+    create(body: CreateNetworkAclBody, idempotencyKey?: string): Promise<NetworkAcl>;
+    update(id: string, body: UpdateNetworkAclBody): Promise<NetworkAcl>;
+    delete(id: string): Promise<{
+        object: "network_acl";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/network-acls.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.networkAclsResource = networkAclsResource;
+const request_1 = require("./request");
+/**
+ * CRUD over the instance's Network ACL rules. Enforcement lives in the request
+ * choke point; this surface just manages the rules, and every write is audited.
+ */
+function networkAclsResource(request) {
+    return {
+        /** All rules for the instance, in priority order. */
+        list() {
+            return request({ method: 'GET', path: '/v1/network_acls' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/network_acls/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/network_acls', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/network_acls/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/network_acls/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=network-acls.js.map

package/dist/client/network-acls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-acls.js","sourceRoot":"","sources":["../../src/client/network-acls.ts"],"names":[],"mappings":";;AA2CA,kDAmBC;AA9DD,uCAAgD;AAuChD;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,qDAAqD;QACrD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/oauth-clients.d.ts

@@ -0,0 +1,75 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface OAuthClient {
+    object: 'oauth_client';
+    id: string;
+    client_id: string;
+    name: string;
+    logo_url: string | null;
+    redirect_uris: string[];
+    allowed_scopes: string[];
+    grant_types: string[];
+    token_endpoint_auth_method: 'client_secret_basic' | 'client_secret_post' | 'none';
+    secret_prefix: string | null;
+    is_public: boolean;
+    first_party: boolean;
+    created_at: number;
+    updated_at: number;
+}
+/** Create/rotate reveal the secret exactly once, alongside the client. */
+export interface OAuthClientWithSecret extends OAuthClient {
+    client_secret?: string;
+    note: string;
+}
+export interface ClientGrant {
+    object: 'client_grant';
+    id: string;
+    /** The internal OAuthClient.id (not the public client_id). */
+    client_id: string;
+    resource_server_id: string;
+    scopes: string[];
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateOAuthClientBody {
+    name: string;
+    redirect_uris: string[];
+    allowed_scopes?: string[];
+    grant_types?: string[];
+    token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
+    logo_url?: string;
+    first_party?: boolean;
+}
+export interface UpdateOAuthClientBody {
+    name?: string;
+    redirect_uris?: string[];
+    allowed_scopes?: string[];
+    token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
+    logo_url?: string | null;
+    first_party?: boolean;
+}
+export declare function oauthClientsResource(request: RequestFn): {
+    list(): Promise<ListPage<OAuthClient>>;
+    get(id: string): Promise<OAuthClient>;
+    create(body: CreateOAuthClientBody, idempotencyKey?: string): Promise<OAuthClientWithSecret>;
+    update(id: string, body: UpdateOAuthClientBody): Promise<OAuthClient>;
+    rotateSecret(id: string): Promise<OAuthClientWithSecret>;
+    delete(id: string): Promise<{
+        object: "oauth_client";
+        id: string;
+        deleted: true;
+        note: string;
+    }>;
+    grants: {
+        list(clientId: string): Promise<ListPage<ClientGrant>>;
+        create(clientId: string, body: {
+            resource_server_id: string;
+            scopes?: string[];
+        }): Promise<ClientGrant>;
+        delete(clientId: string, grantId: string): Promise<{
+            object: "client_grant";
+            id: string;
+            deleted: true;
+        }>;
+    };
+};

package/dist/client/oauth-clients.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthClientsResource = oauthClientsResource;
+const request_1 = require("./request");
+function oauthClientsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/oauth_clients' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/oauth_clients', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}`, body });
+        },
+        rotateSecret(id) {
+            return request({ method: 'POST', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/rotate_secret` });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}` });
+        },
+        grants: {
+            list(clientId) {
+                return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/grants` });
+            },
+            create(clientId, body) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/grants`,
+                    body,
+                });
+            },
+            delete(clientId, grantId) {
+                return request({
+                    method: 'DELETE',
+                    path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/grants/${(0, request_1.enc)(grantId)}`,
+                });
+            },
+        },
+    };
+}
+//# sourceMappingURL=oauth-clients.js.map

package/dist/client/oauth-clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AAwDA,oDA8CC;AAtGD,uCAAgD;AAwDhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/oauth-providers.d.ts

@@ -0,0 +1,109 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/** One credential input a provider needs (client_id, team_id, private key…). */
+export interface OAuthProviderCredentialField {
+    key: string;
+    label: string;
+    /** Stored encrypted and never returned. */
+    secret?: boolean;
+    multiline?: boolean;
+    optional?: boolean;
+    help?: string;
+}
+/** A provider-specific option beyond credentials (Google `hd`, tenant, prompt…). */
+export interface OAuthProviderSetting {
+    key: string;
+    label: string;
+    type: 'string' | 'boolean' | 'select';
+    options?: string[];
+    help?: string;
+}
+/**
+ * A single social sign-in provider row: the whole catalog entry plus whatever is
+ * configured for this instance, and NEVER the secret — only `has_secret`. The
+ * `redirect_uri` is derived from the instance's own FAPI host (the exact string
+ * to register at the provider console), never accepted from the caller.
+ */
+export interface OAuthProvider {
+    object: 'oauth_provider';
+    provider: string;
+    display_name: string;
+    category: string;
+    tier: string;
+    setup_docs_url: string | null;
+    default_scopes: string[];
+    credential_fields: OAuthProviderCredentialField[];
+    settings: OAuthProviderSetting[];
+    native: boolean;
+    redirect_uri: string;
+    configured: boolean;
+    client_id: string | null;
+    has_secret: boolean;
+    enabled: boolean;
+    /** §6.5 which screens this provider serves. Both default true. */
+    allow_sign_in: boolean;
+    allow_sign_up: boolean;
+    scopes: string[];
+    updated_at: number | null;
+}
+/**
+ * Credentials for the redirect code-exchange flow. `client_id`/`client_secret`
+ * cover the common two-field case; `values` carries the exact per-field shape for
+ * providers that need more (Apple team/key id, etc.), and `settings` the
+ * provider-specific options. The secret is write-only.
+ */
+export interface UpsertOAuthProviderBody {
+    client_id?: string;
+    /** Write-only; stored encrypted, never returned. Required for redirect-only providers. */
+    client_secret?: string;
+    scopes?: string[];
+    values?: Record<string, string>;
+    settings?: Record<string, string>;
+}
+/** The connectivity test's honest verdict: what it proved, and what it did not. */
+export interface OAuthConnectionTest {
+    object: 'oauth_connection_test';
+    provider: string;
+    ok: boolean;
+    reason: string;
+    message: string;
+    /** The credential facts this check verified. */
+    checked: string[];
+    /** What a pass deliberately does NOT prove (redirect registration, consent…). */
+    not_checked: string[];
+}
+export declare function oauthProvidersResource(request: RequestFn): {
+    /** The whole catalog, configured or not — a not-yet-set-up provider is exactly the one a setup agent wants. */
+    list(): Promise<ListPage<OAuthProvider>>;
+    get(provider: string): Promise<OAuthProvider>;
+    /** Set (or replace) this instance's own credentials for a provider. */
+    upsert(provider: string, body: UpsertOAuthProviderBody, idempotencyKey?: string): Promise<{
+        object: "oauth_provider";
+        provider: string;
+        configured: true;
+    }>;
+    delete(provider: string): Promise<{
+        object: "oauth_provider";
+        provider: string;
+        deleted: true;
+        note: string;
+    }>;
+    /** Turn a configured provider on or off. Refused if it has no usable credentials. */
+    setEnabled(provider: string, enabled: boolean): Promise<{
+        object: "oauth_provider";
+        provider: string;
+        enabled: boolean;
+    }>;
+    /** §6.5 which screens this provider serves. At least one must be true. */
+    setScope(provider: string, body: {
+        allow_sign_in: boolean;
+        allow_sign_up: boolean;
+    }): Promise<{
+        object: "oauth_provider";
+        provider: string;
+        allow_sign_in: boolean;
+        allow_sign_up: boolean;
+    }>;
+    /** Verify the stored credentials against the provider's token endpoint, without enabling it. */
+    test(provider: string): Promise<OAuthConnectionTest>;
+};