@atlasauth/backend 0.1.0

package/dist/client/request.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_API_URL = void 0;
+exports.serializeQuery = serializeQuery;
+exports.enc = enc;
+exports.createRequest = createRequest;
+const error_1 = require("./error");
+/** The default BAPI origin, overridable per instance via `apiUrl`. */
+exports.DEFAULT_API_URL = 'https://api.atlas.dev';
+/** Serialize a query object to a string, dropping null/undefined, spreading arrays. */
+function serializeQuery(query) {
+    if (!query)
+        return '';
+    const parts = [];
+    for (const [key, value] of Object.entries(query)) {
+        if (value === undefined || value === null)
+            continue;
+        const values = Array.isArray(value) ? value : [value];
+        for (const v of values) {
+            if (v === undefined || v === null)
+                continue;
+            parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(v))}`);
+        }
+    }
+    return parts.length ? `?${parts.join('&')}` : '';
+}
+/** Percent-encode a single path segment (an id, slug, provider name). */
+function enc(segment) {
+    return encodeURIComponent(segment);
+}
+function joinUrl(base, path) {
+    return `${base.replace(/\/+$/, '')}${path.startsWith('/') ? path : `/${path}`}`;
+}
+function createRequest(config) {
+    if (!config.secretKey) {
+        throw new Error('createAtlasClient requires a secretKey.');
+    }
+    const base = config.apiUrl ?? exports.DEFAULT_API_URL;
+    const fetchImpl = config.fetch ?? globalThis.fetch;
+    if (typeof fetchImpl !== 'function') {
+        throw new Error('No fetch implementation found. Pass { fetch } to createAtlasClient on a runtime without a global fetch.');
+    }
+    return async function request(options) {
+        const url = joinUrl(base, options.path) + serializeQuery(options.query);
+        const headers = {
+            authorization: `Bearer ${config.secretKey}`,
+            accept: 'application/json',
+        };
+        let body;
+        if (options.body !== undefined) {
+            headers['content-type'] = 'application/json';
+            body = JSON.stringify(options.body);
+        }
+        if (options.idempotencyKey) {
+            headers['idempotency-key'] = options.idempotencyKey;
+        }
+        const response = await fetchImpl(url, { method: options.method, headers, body });
+        if (!response.ok) {
+            throw await toApiError(response);
+        }
+        // 204 and other empty bodies: nothing to parse.
+        if (response.status === 204)
+            return undefined;
+        if (options.raw) {
+            return (await response.text());
+        }
+        const text = await response.text();
+        if (!text)
+            return undefined;
+        return JSON.parse(text);
+    };
+}
+async function toApiError(response) {
+    let errors = [];
+    let message;
+    const text = await response.text().catch(() => '');
+    if (text) {
+        try {
+            const parsed = JSON.parse(text);
+            if (Array.isArray(parsed.errors) && parsed.errors.length) {
+                errors = parsed.errors;
+            }
+            else {
+                message = text.slice(0, 500);
+            }
+        }
+        catch {
+            // Non-JSON error body (e.g. an upstream proxy): keep it as the message.
+            message = text.slice(0, 500);
+        }
+    }
+    if (!errors.length) {
+        errors = [
+            {
+                code: 'UNKNOWN',
+                message: message ?? `Atlas API request failed with status ${response.status}`,
+            },
+        ];
+    }
+    return new error_1.AtlasApiError(response.status, errors);
+}
+//# sourceMappingURL=request.js.map

package/dist/client/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/client/request.ts"],"names":[],"mappings":";;;AAiDA,wCAYC;AAGD,kBAEC;AAYD,sCA6CC;AA3HD,mCAA6D;AA6B7D,sEAAsE;AACzD,QAAA,eAAe,GAAG,uBAAuB,CAAC;AAkBvD,uFAAuF;AACvF,SAAgB,cAAc,CAAC,KAA8B;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAgB,GAAG,CAAC,OAAe;IACjC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAClF,CAAC;AAQD,SAAgB,aAAa,CAAC,MAAyB;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,uBAAe,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACnD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,UAAU,OAAO,CAAI,OAAuB;QACtD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAExE,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,MAAM,CAAC,SAAS,EAAE;YAC3C,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,IAAwB,CAAC;QAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,gDAAgD;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAEnD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAc,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,OAA2B,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG;YACP;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,OAAO,IAAI,wCAAwC,QAAQ,CAAC,MAAM,EAAE;aAC9E;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,qBAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}

package/dist/client/resource-servers.d.ts

@@ -0,0 +1,44 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface ResourceServerScope {
+    value: string;
+    description?: string;
+}
+export interface ResourceServer {
+    object: 'resource_server';
+    id: string;
+    identifier: string;
+    name: string;
+    scopes: ResourceServerScope[];
+    token_ttl_seconds: number;
+    signing_alg: string;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateResourceServerBody {
+    identifier: string;
+    name: string;
+    /** Each scope is a bare string or `{ value, description? }`. */
+    scopes?: Array<string | ResourceServerScope>;
+    token_ttl_seconds?: number;
+    signing_alg?: string;
+}
+export interface UpdateResourceServerBody {
+    name?: string;
+    scopes?: Array<string | ResourceServerScope>;
+    token_ttl_seconds?: number;
+    signing_alg?: string;
+    /** Immutable — supplying a different value is rejected. */
+    identifier?: string;
+}
+export declare function resourceServersResource(request: RequestFn): {
+    list(): Promise<ListPage<ResourceServer>>;
+    get(id: string): Promise<ResourceServer>;
+    create(body: CreateResourceServerBody): Promise<ResourceServer>;
+    update(id: string, body: UpdateResourceServerBody): Promise<ResourceServer>;
+    delete(id: string): Promise<{
+        object: "resource_server";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/resource-servers.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resourceServersResource = resourceServersResource;
+const request_1 = require("./request");
+function resourceServersResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/resource_servers' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/resource_servers/${(0, request_1.enc)(id)}` });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/resource_servers', body });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/resource_servers/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/resource_servers/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=resource-servers.js.map

package/dist/client/resource-servers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-servers.js","sourceRoot":"","sources":["../../src/client/resource-servers.ts"],"names":[],"mappings":";;AAsCA,0DAkBC;AAxDD,uCAAgD;AAsChD,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAA8B;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA8B;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/restrictions.d.ts

@@ -0,0 +1,39 @@
+import { type RequestFn } from './request';
+export interface AllowlistIdentifier {
+    object: 'allowlist_identifier';
+    id: string;
+    identifier: string;
+    created_at: number;
+}
+export interface BlocklistIdentifier {
+    object: 'blocklist_identifier';
+    id: string;
+    identifier: string;
+    created_at: number;
+}
+export declare function allowlistResource(request: RequestFn): {
+    list(): Promise<{
+        object: "list";
+        data: AllowlistIdentifier[];
+        has_more: false;
+    }>;
+    add(identifier: string): Promise<AllowlistIdentifier>;
+    remove(id: string): Promise<{
+        object: string;
+        id: string;
+        deleted: true;
+    }>;
+};
+export declare function blocklistResource(request: RequestFn): {
+    list(): Promise<{
+        object: "list";
+        data: BlocklistIdentifier[];
+        has_more: false;
+    }>;
+    add(identifier: string): Promise<BlocklistIdentifier>;
+    remove(id: string): Promise<{
+        object: string;
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/restrictions.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allowlistResource = allowlistResource;
+exports.blocklistResource = blocklistResource;
+const request_1 = require("./request");
+/**
+ * Allowlist and blocklist share an identical route shape, so they share a
+ * factory. `path` and the `object` literal differ; nothing else does.
+ */
+function restrictionResource(request, path) {
+    return {
+        list() {
+            return request({ method: 'GET', path });
+        },
+        add(identifier) {
+            return request({ method: 'POST', path, body: { identifier } });
+        },
+        remove(id) {
+            return request({ method: 'DELETE', path: `${path}/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+function allowlistResource(request) {
+    return restrictionResource(request, '/v1/allowlist_identifiers');
+}
+function blocklistResource(request) {
+    return restrictionResource(request, '/v1/blocklist_identifiers');
+}
+//# sourceMappingURL=restrictions.js.map

package/dist/client/restrictions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restrictions.js","sourceRoot":"","sources":["../../src/client/restrictions.ts"],"names":[],"mappings":";;AAkCA,8CAEC;AAED,8CAEC;AAxCD,uCAAgD;AAgBhD;;;GAGG;AACH,SAAS,mBAAmB,CAA2B,OAAkB,EAAE,IAAY;IACrF,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,GAAG,CAAC,UAAkB;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO,mBAAmB,CAAsB,OAAO,EAAE,2BAA2B,CAAC,CAAC;AACxF,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO,mBAAmB,CAAsB,OAAO,EAAE,2BAA2B,CAAC,CAAC;AACxF,CAAC"}

package/dist/client/risk-based-mfa.d.ts

@@ -0,0 +1,51 @@
+import { type RequestFn } from './request';
+/** The risk level at or above which a sign-in is stepped up. */
+export type RiskLevel = 'low' | 'medium' | 'high';
+/** What to do at high risk when the user has NO enrolled factor. */
+export type OnHighRiskNoFactor = 'allow' | 'block' | 'require_enroll';
+/** Per-signal score weights that feed the risk total. */
+export interface RiskWeights {
+    newDevice: number;
+    newSubnet: number;
+    newIp: number;
+    velocity: number;
+    impossibleTravel: number;
+}
+/** Per-signal on/off toggles. A disabled signal contributes nothing. */
+export interface RiskSignalToggles {
+    newDevice: boolean;
+    newSubnet: boolean;
+    newIp: boolean;
+    velocity: boolean;
+    impossibleTravel: boolean;
+}
+/**
+ * Adaptive / risk-based MFA config (Auth0 "Adaptive MFA" parity). OFF by
+ * default and can only ever ADD friction — nothing here can weaken the sign-in
+ * gate.
+ */
+export interface RiskBasedMfa {
+    object: 'risk_based_mfa';
+    enabled: boolean;
+    step_up_threshold: RiskLevel;
+    on_high_risk_no_factor: OnHighRiskNoFactor;
+    weights: RiskWeights;
+    signals: RiskSignalToggles;
+}
+export interface UpdateRiskBasedMfaBody {
+    enabled?: boolean;
+    step_up_threshold?: RiskLevel;
+    on_high_risk_no_factor?: OnHighRiskNoFactor;
+    weights?: Partial<RiskWeights>;
+    signals?: Partial<RiskSignalToggles>;
+}
+/**
+ * Read and tune the instance's adaptive-MFA engine — when a second factor is
+ * demanded, and how each risk signal is weighted.
+ */
+export declare function riskBasedMfaResource(request: RequestFn): {
+    /** Read the current adaptive-MFA config. */
+    get(): Promise<RiskBasedMfa>;
+    /** Change any subset of the config; omitted fields are left unchanged. */
+    update(body: UpdateRiskBasedMfaBody): Promise<RiskBasedMfa>;
+};

package/dist/client/risk-based-mfa.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.riskBasedMfaResource = riskBasedMfaResource;
+/**
+ * Read and tune the instance's adaptive-MFA engine — when a second factor is
+ * demanded, and how each risk signal is weighted.
+ */
+function riskBasedMfaResource(request) {
+    return {
+        /** Read the current adaptive-MFA config. */
+        get() {
+            return request({ method: 'GET', path: '/v1/risk_based_mfa' });
+        },
+        /** Change any subset of the config; omitted fields are left unchanged. */
+        update(body) {
+            return request({ method: 'PATCH', path: '/v1/risk_based_mfa', body });
+        },
+    };
+}
+//# sourceMappingURL=risk-based-mfa.js.map

package/dist/client/risk-based-mfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-based-mfa.js","sourceRoot":"","sources":["../../src/client/risk-based-mfa.ts"],"names":[],"mappings":";;AAoDA,oDAWC;AAfD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4CAA4C;QAC5C,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,0EAA0E;QAC1E,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/roles.d.ts

@@ -0,0 +1,84 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface Role {
+    object: 'role';
+    id: string;
+    key: string;
+    name: string;
+    description: string | null;
+    is_system: boolean;
+    permissions: string[];
+    member_count: number;
+    created_at: number;
+}
+export interface Permission {
+    object: 'permission';
+    id: string;
+    key: string;
+    name: string;
+    description: string | null;
+    is_system: boolean;
+}
+export interface CreateRoleBody {
+    key: string;
+    name: string;
+    description?: string;
+    permissions?: string[];
+}
+export interface UpdateRoleBody {
+    name?: string;
+    description?: string;
+    /** May be supplied but must equal the current key — the key is immutable. */
+    key?: string;
+}
+/** `PUT /v1/roles/:id/permissions` returns this reduced shape, not a full Role. */
+export interface RolePermissionsResult {
+    object: 'role';
+    id: string;
+    key: string;
+    permissions: string[];
+    ignored: string[];
+}
+export declare function rolesResource(request: RequestFn): {
+    list(): Promise<ListPage<Role>>;
+    create(body: CreateRoleBody, idempotencyKey?: string): Promise<Role>;
+    update(id: string, body: UpdateRoleBody): Promise<Role>;
+    /** Replace a role's permission set wholesale. */
+    setPermissions(id: string, permissions: string[]): Promise<RolePermissionsResult>;
+    /**
+     * Delete a role. Pass `{ reassignTo }` to move every member onto another
+     * role first (atomic, before the delete) so an in-use role can be retired;
+     * without it, deleting a role people still hold fails with `role_in_use`.
+     */
+    delete(id: string, opts?: {
+        reassignTo?: string;
+    }): Promise<{
+        object: "role";
+        id: string;
+        deleted: true;
+        members_reassigned: number;
+    }>;
+};
+export interface CreatePermissionBody {
+    key: string;
+    name?: string;
+    description?: string;
+}
+export interface UpdatePermissionBody {
+    name?: string;
+    description?: string | null;
+    /** May be supplied but must equal the current key — the key is immutable. */
+    key?: string;
+}
+export declare function permissionsResource(request: RequestFn): {
+    list(): Promise<ListPage<Permission>>;
+    create(body: CreatePermissionBody, idempotencyKey?: string): Promise<Permission>;
+    /** Relabel a custom permission (name/description only — the key is immutable). */
+    update(id: string, body: UpdatePermissionBody): Promise<Permission>;
+    /** Delete a custom permission. Fails with `role_in_use` if a role still grants it. */
+    delete(id: string): Promise<{
+        object: "permission";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/roles.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rolesResource = rolesResource;
+exports.permissionsResource = permissionsResource;
+const request_1 = require("./request");
+function rolesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/roles' });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/roles', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/roles/${(0, request_1.enc)(id)}`, body });
+        },
+        /** Replace a role's permission set wholesale. */
+        setPermissions(id, permissions) {
+            return request({
+                method: 'PUT',
+                path: `/v1/roles/${(0, request_1.enc)(id)}/permissions`,
+                body: { permissions },
+            });
+        },
+        /**
+         * Delete a role. Pass `{ reassignTo }` to move every member onto another
+         * role first (atomic, before the delete) so an in-use role can be retired;
+         * without it, deleting a role people still hold fails with `role_in_use`.
+         */
+        delete(id, opts) {
+            return request({
+                method: 'DELETE',
+                path: `/v1/roles/${(0, request_1.enc)(id)}`,
+                query: opts?.reassignTo ? { reassign_to: opts.reassignTo } : undefined,
+            });
+        },
+    };
+}
+function permissionsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/permissions' });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/permissions', body, idempotencyKey });
+        },
+        /** Relabel a custom permission (name/description only — the key is immutable). */
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/permissions/${(0, request_1.enc)(id)}`, body });
+        },
+        /** Delete a custom permission. Fails with `role_in_use` if a role still grants it. */
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/permissions/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=roles.js.map

package/dist/client/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/client/roles.ts"],"names":[],"mappings":";;AA+CA,sCAmCC;AAeD,kDAiBC;AAlHD,uCAAgD;AA+ChD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,iDAAiD;QACjD,cAAc,CAAC,EAAU,EAAE,WAAqB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;gBACxC,IAAI,EAAE,EAAE,WAAW,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,MAAM,CACJ,EAAU,EACV,IAA8B;YAE9B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE;gBAC5B,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;aACvE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,kFAAkF;QAClF,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/scim-provisioning.d.ts

@@ -0,0 +1,94 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * An OUTBOUND SCIM provisioning target — a downstream SCIM 2.0 endpoint Atlas
+ * pushes its users/groups OUT to (Clerk/Auth0 "directory provisioning" parity,
+ * the reverse of the inbound SCIM server). The `bearer_token` is write-only:
+ * stored encrypted and never returned, so a read reports only `has_bearer_token`.
+ */
+export interface ScimProvisioningTarget {
+    object: 'scim_provisioning_target';
+    id: string;
+    name: string;
+    base_url: string;
+    /** Whether a bearer is set — never the value. */
+    has_bearer_token: boolean;
+    enabled: boolean;
+    attribute_mapping: Record<string, unknown>;
+    deprovision_action: string;
+    status: string;
+    cursor: string | null;
+    consecutive_failures: number;
+    last_error: string | null;
+    last_synced_at: number | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateScimProvisioningTargetBody {
+    name: string;
+    /** Must be an https:// URL so the bearer never travels in cleartext. */
+    base_url: string;
+    /** Write-only; stored encrypted, never returned. */
+    bearer_token: string;
+    attribute_mapping?: Record<string, unknown>;
+    deprovision_action?: 'deactivate' | 'delete';
+    enabled?: boolean;
+}
+export interface UpdateScimProvisioningTargetBody {
+    name?: string;
+    base_url?: string;
+    /** Write-only; omit to leave the stored bearer unchanged. */
+    bearer_token?: string;
+    attribute_mapping?: Record<string, unknown>;
+    deprovision_action?: 'deactivate' | 'delete';
+    enabled?: boolean;
+    status?: 'active' | 'paused';
+}
+/** The connectivity/auth probe's outcome (GET ServiceProviderConfig; writes nothing). */
+export interface ScimProvisioningTestResult {
+    object: 'scim_provisioning_test_result';
+    id: string;
+    ok: boolean;
+    status: number | null;
+    error: string | null;
+}
+/** The result of forcing one user's sync now. */
+export interface ScimProvisioningSyncResult {
+    object: 'scim_provisioning_sync_result';
+    id: string;
+    user_id: string;
+    action: string;
+    ok: boolean;
+    status: number | null;
+    remote_id: string | null;
+    error: string | null;
+}
+/** The result of forcing one org's (group) sync now. */
+export interface ScimProvisioningGroupSyncResult {
+    object: 'scim_provisioning_group_sync_result';
+    id: string;
+    organization_id: string;
+    action: string;
+    ok: boolean;
+    status: number | null;
+    remote_id: string | null;
+    member_count: number;
+    error: string | null;
+}
+export declare function scimProvisioningResource(request: RequestFn): {
+    list(): Promise<ListPage<ScimProvisioningTarget>>;
+    get(id: string): Promise<ScimProvisioningTarget>;
+    create(body: CreateScimProvisioningTargetBody, idempotencyKey?: string): Promise<ScimProvisioningTarget>;
+    update(id: string, body: UpdateScimProvisioningTargetBody): Promise<ScimProvisioningTarget>;
+    delete(id: string): Promise<{
+        object: "scim_provisioning_target";
+        id: string;
+        deleted: true;
+    }>;
+    /** Probe connectivity + auth to the downstream with the real bearer. Writes nothing. */
+    test(id: string): Promise<ScimProvisioningTestResult>;
+    /** Force one user's sync now (backfill / re-push), out of band from the worker. */
+    syncUser(id: string, userId: string): Promise<ScimProvisioningSyncResult>;
+    /** Force one org's (group) sync now; only already-provisioned members are sent. */
+    syncGroup(id: string, organizationId: string): Promise<ScimProvisioningGroupSyncResult>;
+};

package/dist/client/scim-provisioning.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scimProvisioningResource = scimProvisioningResource;
+const request_1 = require("./request");
+function scimProvisioningResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/scim_provisioning_targets' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/scim_provisioning_targets/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({
+                method: 'POST',
+                path: '/v1/scim_provisioning_targets',
+                body,
+                idempotencyKey,
+            });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/scim_provisioning_targets/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/scim_provisioning_targets/${(0, request_1.enc)(id)}` });
+        },
+        /** Probe connectivity + auth to the downstream with the real bearer. Writes nothing. */
+        test(id) {
+            return request({ method: 'POST', path: `/v1/scim_provisioning_targets/${(0, request_1.enc)(id)}/test` });
+        },
+        /** Force one user's sync now (backfill / re-push), out of band from the worker. */
+        syncUser(id, userId) {
+            return request({
+                method: 'POST',
+                path: `/v1/scim_provisioning_targets/${(0, request_1.enc)(id)}/sync_user`,
+                body: { user_id: userId },
+            });
+        },
+        /** Force one org's (group) sync now; only already-provisioned members are sent. */
+        syncGroup(id, organizationId) {
+            return request({
+                method: 'POST',
+                path: `/v1/scim_provisioning_targets/${(0, request_1.enc)(id)}/sync_group`,
+                body: { organization_id: organizationId },
+            });
+        },
+    };
+}
+//# sourceMappingURL=scim-provisioning.js.map

package/dist/client/scim-provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-provisioning.js","sourceRoot":"","sources":["../../src/client/scim-provisioning.ts"],"names":[],"mappings":";;AAoFA,4DAmDC;AAvID,uCAAgD;AAoFhD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CACJ,IAAsC,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,+BAA+B;gBACrC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CACJ,EAAU,EACV,IAAsC;YAEtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,CACJ,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,wFAAwF;QACxF,IAAI,CAAC,EAAU;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,mFAAmF;QACnF,QAAQ,CAAC,EAAU,EAAE,MAAc;YACjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY;gBAC1D,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,mFAAmF;QACnF,SAAS,CAAC,EAAU,EAAE,cAAsB;YAC1C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBAC3D,IAAI,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/scim-tokens.d.ts

@@ -0,0 +1,34 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface ScimToken {
+    object: 'scim_token';
+    id: string;
+    name: string | null;
+    organization_id: string;
+    connection_id: string | null;
+    prefix: string;
+    last_used_at: number | null;
+    expires_at: number | null;
+    revoked_at: number | null;
+    created_at: number;
+}
+/** Create reveals the usable secret exactly once. */
+export interface ScimTokenWithSecret extends ScimToken {
+    secret: string;
+    note: string;
+}
+export interface CreateScimTokenBody {
+    organization_id: string;
+    name?: string;
+    connection_id?: string;
+}
+export declare function scimTokensResource(request: RequestFn): {
+    list(): Promise<ListPage<ScimToken>>;
+    create(body: CreateScimTokenBody, idempotencyKey?: string): Promise<ScimTokenWithSecret>;
+    revoke(id: string): Promise<{
+        object: "scim_token";
+        id: string;
+        revoked: true;
+        note: string;
+    }>;
+};