@atlasauth/backend 0.1.0

package/dist/client/scim-tokens.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scimTokensResource = scimTokensResource;
+const request_1 = require("./request");
+function scimTokensResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/scim_tokens' });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/scim_tokens', body, idempotencyKey });
+        },
+        revoke(id) {
+            return request({ method: 'POST', path: `/v1/scim_tokens/${(0, request_1.enc)(id)}/revoke` });
+        },
+    };
+}
+//# sourceMappingURL=scim-tokens.js.map

package/dist/client/scim-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-tokens.js","sourceRoot":"","sources":["../../src/client/scim-tokens.ts"],"names":[],"mappings":";;AA4BA,gDAcC;AA1CD,uCAAgD;AA4BhD,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAyB,EAAE,cAAuB;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CACJ,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sessions.d.ts

@@ -0,0 +1,58 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface Session {
+    object: 'session';
+    id: string;
+    user_id: string;
+    status: string;
+    last_active_organization_id: string | null;
+    impersonated_by: string | null;
+    last_active_at: number;
+    expire_at: number;
+    abandon_at: number;
+    created_at: number;
+}
+export interface ListSessionsParams {
+    /** Required by the BAPI: sessions are always scoped to one user. */
+    user_id: string;
+}
+export interface CreateSessionParams {
+    /** The user to mint a session for. */
+    user_id: string;
+    /** Optional impersonation actor — records who is acting as the user. */
+    actor?: {
+        sub: string;
+    };
+}
+/**
+ * A freshly-minted session. Unlike a listed {@link Session}, this carries the
+ * bearer `jwt` and `refresh_token` in-body — returned by design for headless use
+ * (the sk_ caller already holds full power; it saves the pk_ redeem/exchange
+ * hops). Store the refresh_token to keep the session alive.
+ */
+export interface MintedSession {
+    object: 'session';
+    id: string;
+    user_id: string;
+    jwt: string;
+    refresh_token: string;
+    expires_in: number;
+    impersonated_by?: {
+        sub: string;
+    };
+}
+export declare function sessionsResource(request: RequestFn): {
+    /**
+     * `POST /v1/sessions` — mint a session for a user without the sign-in flow.
+     * Returns the bearer jwt + refresh token in-body. Refused for a banned user.
+     */
+    create(params: CreateSessionParams): Promise<MintedSession>;
+    /** `GET /v1/sessions?user_id=` — requires a user_id. */
+    list(params: ListSessionsParams): Promise<ListPage<Session>>;
+    get(id: string): Promise<Session>;
+    revoke(id: string): Promise<{
+        object: "session";
+        id: string;
+        status: "revoked";
+    }>;
+};

package/dist/client/sessions.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionsResource = sessionsResource;
+const request_1 = require("./request");
+function sessionsResource(request) {
+    return {
+        /**
+         * `POST /v1/sessions` — mint a session for a user without the sign-in flow.
+         * Returns the bearer jwt + refresh token in-body. Refused for a banned user.
+         */
+        create(params) {
+            return request({ method: 'POST', path: '/v1/sessions', body: { ...params } });
+        },
+        /** `GET /v1/sessions?user_id=` — requires a user_id. */
+        list(params) {
+            return request({ method: 'GET', path: '/v1/sessions', query: { ...params } });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/sessions/${(0, request_1.enc)(id)}` });
+        },
+        revoke(id) {
+            return request({ method: 'POST', path: `/v1/sessions/${(0, request_1.enc)(id)}/revoke` });
+        },
+    };
+}
+//# sourceMappingURL=sessions.js.map

package/dist/client/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/client/sessions.ts"],"names":[],"mappings":";;AA4CA,4CAoBC;AAhED,uCAAgD;AA4ChD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL;;;WAGG;QACH,MAAM,CAAC,MAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,wDAAwD;QACxD,IAAI,CAAC,MAA0B;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sign-in-tokens.d.ts

@@ -0,0 +1,18 @@
+import type { RequestFn } from './request';
+export interface SignInToken {
+    object: 'sign_in_token';
+    user_id: string;
+    token: string;
+    expires_in: number;
+}
+export interface CreateSignInTokenBody {
+    user_id: string;
+    /**
+     * Accepted by the wire type but currently ignored server-side — the token
+     * always lives 60 seconds. Kept so the shape matches the BAPI.
+     */
+    expires_in_seconds?: number;
+}
+export declare function signInTokensResource(request: RequestFn): {
+    create(body: CreateSignInTokenBody, idempotencyKey?: string): Promise<SignInToken>;
+};

package/dist/client/sign-in-tokens.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signInTokensResource = signInTokensResource;
+function signInTokensResource(request) {
+    return {
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/sign_in_tokens', body, idempotencyKey });
+        },
+    };
+}
+//# sourceMappingURL=sign-in-tokens.js.map

package/dist/client/sign-in-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-tokens.js","sourceRoot":"","sources":["../../src/client/sign-in-tokens.ts"],"names":[],"mappings":";;AAkBA,oDAMC;AAND,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sms-templates.d.ts

@@ -0,0 +1,46 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/** The transactional SMS a template drives. */
+export type SmsTemplateName = 'verification_code' | 'mfa_code';
+/**
+ * A template row: table-backed, keyed by `name`. The built-in `default` and the
+ * stored `body` override are both returned so a caller can show a diff. `body`
+ * is null when no override is stored.
+ */
+export interface SmsTemplate {
+    object: 'sms_template';
+    name: SmsTemplateName;
+    default: string;
+    body: string | null;
+    enabled: boolean;
+    customised: boolean;
+    variables: readonly string[];
+}
+export interface CreateSmsTemplateBody {
+    name: string;
+    body: string;
+    enabled?: boolean;
+}
+/** A rendered body with a fixed SAMPLE code (`123456`), never a live OTP. */
+export interface SmsTemplatePreview {
+    object: 'sms_template_preview';
+    name: SmsTemplateName;
+    body: string;
+    customised: boolean;
+}
+export declare function smsTemplatesResource(request: RequestFn): {
+    list(): Promise<ListPage<SmsTemplate>>;
+    /** Upsert an override by name. */
+    create(body: CreateSmsTemplateBody, idempotencyKey?: string): Promise<SmsTemplate>;
+    get(name: string): Promise<SmsTemplate>;
+    update(name: string, body: {
+        body?: string;
+        enabled?: boolean;
+    }): Promise<SmsTemplate>;
+    /** Revert to the built-in. */
+    delete(name: string): Promise<SmsTemplate>;
+    /** Render an unsaved draft (if a body is given) or the stored/built-in. */
+    preview(name: string, body?: {
+        body?: string;
+    }): Promise<SmsTemplatePreview>;
+};

package/dist/client/sms-templates.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.smsTemplatesResource = smsTemplatesResource;
+const request_1 = require("./request");
+function smsTemplatesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/sms_templates' });
+        },
+        /** Upsert an override by name. */
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/sms_templates', body, idempotencyKey });
+        },
+        get(name) {
+            return request({ method: 'GET', path: `/v1/sms_templates/${(0, request_1.enc)(name)}` });
+        },
+        update(name, body) {
+            return request({ method: 'PATCH', path: `/v1/sms_templates/${(0, request_1.enc)(name)}`, body });
+        },
+        /** Revert to the built-in. */
+        delete(name) {
+            return request({ method: 'DELETE', path: `/v1/sms_templates/${(0, request_1.enc)(name)}` });
+        },
+        /** Render an unsaved draft (if a body is given) or the stored/built-in. */
+        preview(name, body = {}) {
+            return request({ method: 'POST', path: `/v1/sms_templates/${(0, request_1.enc)(name)}/preview`, body });
+        },
+    };
+}
+//# sourceMappingURL=sms-templates.js.map

package/dist/client/sms-templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sms-templates.js","sourceRoot":"","sources":["../../src/client/sms-templates.ts"],"names":[],"mappings":";;AAmCA,oDAwBC;AA3DD,uCAAgD;AAmChD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,kCAAkC;QAClC,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAAY,EAAE,IAA0C;YAC7D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sso-connections.d.ts

@@ -0,0 +1,76 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface ClaimRoleMapping {
+    claim: string;
+    value: string;
+    /** camelCase on the wire, unlike the surrounding snake_case fields. */
+    roleKey: string;
+}
+export interface SsoConnection {
+    object: 'sso_connection';
+    id: string;
+    organization_id: string | null;
+    type: string;
+    status: string;
+    oidc_issuer: string | null;
+    oidc_client_id: string | null;
+    has_secret: boolean;
+    saml_idp_entity_id: string | null;
+    saml_idp_sso_url: string | null;
+    saml_sp_entity_id: string | null;
+    has_saml_certificate: boolean;
+    saml_allow_idp_initiated: boolean;
+    saml_sign_authn_requests: boolean;
+    saml_want_response_signed: boolean;
+    has_discourse_secret: boolean;
+    discourse_provider_url: string | null;
+    allowed_domains: string[];
+    claim_role_mappings: ClaimRoleMapping[];
+    default_role_id: string | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface SamlMetadata {
+    object: 'sso_saml_metadata';
+    sp_entity_id: string;
+    acs_url: string;
+    /** The SP EntityDescriptor XML, carried as a string inside this JSON envelope. */
+    metadata_xml: string;
+}
+export interface CreateSsoConnectionBody {
+    organization_id?: string | null;
+    type?: 'oidc' | 'saml' | 'discourse' | 'discourse_consumer';
+    status?: 'draft' | 'active' | 'disabled';
+    oidc_issuer?: string;
+    oidc_client_id?: string;
+    /** Write-only; stored encrypted, never returned. */
+    oidc_client_secret?: string;
+    saml_idp_entity_id?: string;
+    saml_idp_sso_url?: string;
+    /** Write-only; only `has_saml_certificate` is ever returned. */
+    saml_idp_certificate?: string;
+    saml_sp_entity_id?: string;
+    saml_allow_idp_initiated?: boolean;
+    saml_sign_authn_requests?: boolean;
+    saml_want_response_signed?: boolean;
+    discourse_secret?: string;
+    discourse_provider_url?: string;
+    allowed_domains?: string[];
+    claim_role_mappings?: ClaimRoleMapping[];
+    default_role_id?: string | null;
+}
+/** PATCH accepts everything create does except `type`, which is immutable. */
+export type UpdateSsoConnectionBody = Omit<CreateSsoConnectionBody, 'type'>;
+export declare function ssoConnectionsResource(request: RequestFn): {
+    list(): Promise<ListPage<SsoConnection>>;
+    get(id: string): Promise<SsoConnection>;
+    create(body: CreateSsoConnectionBody, idempotencyKey?: string): Promise<SsoConnection>;
+    update(id: string, body: UpdateSsoConnectionBody): Promise<SsoConnection>;
+    delete(id: string): Promise<{
+        object: "sso_connection";
+        id: string;
+        deleted: true;
+    }>;
+    /** SP SAML metadata for a connection (JSON envelope carrying the XML). */
+    samlMetadata(id: string): Promise<SamlMetadata>;
+};

package/dist/client/sso-connections.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ssoConnectionsResource = ssoConnectionsResource;
+const request_1 = require("./request");
+function ssoConnectionsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/sso_connections' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/sso_connections/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/sso_connections', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/sso_connections/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/sso_connections/${(0, request_1.enc)(id)}` });
+        },
+        /** SP SAML metadata for a connection (JSON envelope carrying the XML). */
+        samlMetadata(id) {
+            return request({ method: 'GET', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/saml_metadata` });
+        },
+    };
+}
+//# sourceMappingURL=sso-connections.js.map

package/dist/client/sso-connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-connections.js","sourceRoot":"","sources":["../../src/client/sso-connections.ts"],"names":[],"mappings":";;AAqEA,wDAsBC;AA3FD,uCAAgD;AAqEhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA6B,EAAE,cAAuB;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA6B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,0EAA0E;QAC1E,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sso-onboarding.d.ts

@@ -0,0 +1,76 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * A self-service SSO onboarding profile — the WorkOS Admin Portal / Auth0
+ * self-service-profiles model. It fixes which protocols an end-customer may
+ * configure and either binds an org or promises to name one at ticket issue.
+ */
+export interface SsoOnboardingProfile {
+    object: 'sso_onboarding_profile';
+    id: string;
+    name: string;
+    allowed_connection_types: string[];
+    /** Set = every ticket targets this org; null = the ticket names its org. */
+    organization_id: string | null;
+    company_name: string | null;
+    allow_scim: boolean;
+    created_at: number;
+    updated_at: number;
+}
+/**
+ * A one-time, expiring ticket for a specific end-customer org. Its opaque token
+ * (and the hosted setup URL carrying it) are revealed exactly once — see
+ * {@link IssuedSsoOnboardingTicket}.
+ */
+export interface SsoOnboardingTicket {
+    object: 'sso_onboarding_ticket';
+    id: string;
+    profile_id: string;
+    organization_id: string;
+    sso_connection_id: string | null;
+    status: string;
+    expires_at: number;
+    created_at: number;
+    completed_at: number | null;
+}
+/** The create response: the ticket plus the once-only token and hosted URL. */
+export interface IssuedSsoOnboardingTicket extends SsoOnboardingTicket {
+    /** Revealed exactly once; only its hash is stored. */
+    token: string;
+    /** The hosted URL the end-customer's IT admin opens (no dashboard account). */
+    url: string;
+    expires_in: number;
+}
+export interface CreateSsoOnboardingProfileBody {
+    name: string;
+    /** Defaults to both `oidc` and `saml`. */
+    allowed_connection_types?: Array<'oidc' | 'saml'>;
+    /** Bind the profile to an org in this instance; omit for a per-ticket org. */
+    organization_id?: string | null;
+    company_name?: string | null;
+    allow_scim?: boolean;
+}
+export interface CreateSsoOnboardingTicketBody {
+    /** Required for an unbound profile; must match (or be omitted) for a bound one. */
+    organization_id?: string | null;
+    /** Clamped to a 5-minute…30-day band; defaults to 3 days. */
+    expires_in_seconds?: number;
+}
+export declare function ssoOnboardingResource(request: RequestFn): {
+    list(): Promise<ListPage<SsoOnboardingProfile>>;
+    get(id: string): Promise<SsoOnboardingProfile>;
+    create(body: CreateSsoOnboardingProfileBody, idempotencyKey?: string): Promise<SsoOnboardingProfile>;
+    delete(id: string): Promise<{
+        object: "sso_onboarding_profile";
+        id: string;
+        deleted: true;
+    }>;
+    /** Issue a one-time ticket for a profile. The token is returned once, here. */
+    createTicket(profileId: string, body?: CreateSsoOnboardingTicketBody, idempotencyKey?: string): Promise<IssuedSsoOnboardingTicket>;
+    /** Kill a still-live ticket. 404 once it is used, expired, or already revoked. */
+    revokeTicket(ticketId: string): Promise<{
+        object: "sso_onboarding_ticket";
+        id: string;
+        revoked: true;
+    }>;
+};

package/dist/client/sso-onboarding.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ssoOnboardingResource = ssoOnboardingResource;
+const request_1 = require("./request");
+function ssoOnboardingResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/sso_onboarding_profiles' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/sso_onboarding_profiles/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({
+                method: 'POST',
+                path: '/v1/sso_onboarding_profiles',
+                body,
+                idempotencyKey,
+            });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/sso_onboarding_profiles/${(0, request_1.enc)(id)}` });
+        },
+        /** Issue a one-time ticket for a profile. The token is returned once, here. */
+        createTicket(profileId, body = {}, idempotencyKey) {
+            return request({
+                method: 'POST',
+                path: `/v1/sso_onboarding_profiles/${(0, request_1.enc)(profileId)}/tickets`,
+                body,
+                idempotencyKey,
+            });
+        },
+        /** Kill a still-live ticket. 404 once it is used, expired, or already revoked. */
+        revokeTicket(ticketId) {
+            return request({
+                method: 'POST',
+                path: `/v1/sso_onboarding_tickets/${(0, request_1.enc)(ticketId)}/revoke`,
+            });
+        },
+    };
+}
+//# sourceMappingURL=sso-onboarding.js.map

package/dist/client/sso-onboarding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-onboarding.js","sourceRoot":"","sources":["../../src/client/sso-onboarding.ts"],"names":[],"mappings":";;AAgEA,sDA6CC;AA7GD,uCAAgD;AAgEhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CACJ,IAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B;gBACnC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,+EAA+E;QAC/E,YAAY,CACV,SAAiB,EACjB,OAAsC,EAAE,EACxC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,SAAS,CAAC,UAAU;gBAC7D,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,YAAY,CACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;aAC3D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/tokens.d.ts

@@ -0,0 +1,37 @@
+import type { RequestFn } from './request';
+/**
+ * §7.7 authoritative token verification. Backend SDKs verify session JWTs
+ * locally against JWKS — fast, offline, and correct within the 60-second token
+ * lifetime, but blind to a revocation. This endpoint is for the requests where
+ * "signed out a moment ago" has to mean now: it checks the revocation set and,
+ * when the cache cannot answer, falls through to the database.
+ *
+ * One failure is reported as `verified: false` with a coarse `reason`; telling a
+ * caller which check failed would help a forger more than a developer.
+ */
+export interface VerifyTokenBody {
+    token: string;
+    /** Expected `azp` values, if the token carries an authorized-party claim. */
+    authorized_parties?: string[];
+}
+export interface TokenVerificationFailure {
+    object: 'token_verification';
+    verified: false;
+    reason: 'invalid' | 'revoked';
+}
+export interface TokenVerificationSuccess {
+    object: 'token_verification';
+    verified: true;
+    user_id: string;
+    session_id: string;
+    organization_id: string | null;
+    organization_role: string | null;
+    organization_permissions: string[];
+    mfa: boolean;
+    /** True when the cache could not answer and the database was consulted. */
+    checked_authoritatively: boolean;
+}
+export type TokenVerification = TokenVerificationSuccess | TokenVerificationFailure;
+export declare function tokensResource(request: RequestFn): {
+    verify(body: VerifyTokenBody): Promise<TokenVerification>;
+};

package/dist/client/tokens.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokensResource = tokensResource;
+function tokensResource(request) {
+    return {
+        verify(body) {
+            return request({ method: 'POST', path: '/v1/tokens/verify', body });
+        },
+    };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/client/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/client/tokens.ts"],"names":[],"mappings":";;AAwCA,wCAMC;AAND,SAAgB,cAAc,CAAC,OAAkB;IAC/C,OAAO;QACL,MAAM,CAAC,IAAqB;YAC1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/types.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Shapes shared across resource namespaces.
+ *
+ * The wire is snake_case JSON; these types mirror it exactly (no camelCase
+ * translation), because the SDK's job is to type the BAPI, not to invent a
+ * second dialect a reader would then have to reconcile against the docs.
+ */
+/** A free-form metadata bag. The BAPI stores arbitrary JSON objects here. */
+export type Metadata = Record<string, unknown>;
+/**
+ * The `GET /v1/users`-style cursor page: no total, a boolean `has_more`, and an
+ * opaque `next_cursor` to pass back as `starting_after`.
+ */
+export interface CursorPage<T> {
+    data: T[];
+    has_more: boolean;
+    next_cursor: string | null;
+}
+/** The `{ object: 'list', data, has_more }` envelope some list routes use. */
+export interface ListPage<T> {
+    object: 'list';
+    data: T[];
+    has_more?: boolean;
+}
+/** A bare `{ data }` list with no pagination metadata. */
+export interface DataList<T> {
+    data: T[];
+}
+/** Common cursor-pagination params. */
+export interface CursorParams {
+    /** Page size. Server clamps to its own maximum. */
+    limit?: number;
+    /** Opaque cursor: the id after which to continue (from `next_cursor`). */
+    starting_after?: string;
+}
+/** A minimal deletion acknowledgement several mutation routes return. */
+export interface DeletedObject {
+    object: string;
+    id: string;
+    deleted: true;
+}

package/dist/client/types.js

@@ -0,0 +1,10 @@
+"use strict";
+/**
+ * Shapes shared across resource namespaces.
+ *
+ * The wire is snake_case JSON; these types mirror it exactly (no camelCase
+ * translation), because the SDK's job is to type the BAPI, not to invent a
+ * second dialect a reader would then have to reconcile against the docs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/client/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/client/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG"}