@atlasauth/backend 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @atlasauth/backend changelog
 
+## 0.11.0
+- **Referral attribution settings.** New `referrals` namespace: `get()` and `update(body, idempotencyKey?)` (`GET`/`PATCH /v1/instance/referrals`; `ReferralSettings`, `UpdateReferralSettingsBody` with nested `security`: `ReferralSecuritySettings` `challenge_referred_signups`, `on_high_risk`, `hold_until_email_verified`, `max_referred_signups_per_ip_hour`), `test()` (`ReferralConnectionTest`), `listCalls({ limit?, status?, kind?, user_id? })` (`ReferralCall`, `ListReferralCallsParams`) and `retryCall(id, idempotencyKey?)`. Also `ReferralProviderInfo`, `ReferralProviderCapabilities`, `ReferralConnectionStatus`, `ReferralRisk`, `ReferralCallKind`, `ReferralCallStatus`.
+- **Users.** `User` gains optional `referral` (`UserReferral`: `partner_id`, `referrer_external_id`, `referrer_user_id`, `matched_via`, `status`, `risk_level`, `flagged`), `referral_code` and `referral_link`. `CreateUserBody` accepts `referral` (`CreateUserReferralInput`: `code`, `click_id`, `anon_id`) and `referral_code`; `UpdateUserBody` accepts `referral_code` (`null` clears). New `users.flagReferral(id, { reason? }, idempotencyKey?)` (`POST /v1/users/:id/referral/flag`, `UserReferralFlag`).
+- **Webhooks.** `UserReferralAttributedEvent` types the `data` of the new `user.referral_attributed` event (the referral platform answered after `user.created`).
+- **Error codes.** `AtlasErrorCodes` adds `REFERRALS_NOT_CONFIGURED` (422) and `REFERRAL_CODE_TAKEN` (409). Preflight can report `referrals_enabled_unverified` and `referrals_without_bot_protection`.
+- **Referral protocol receiver.** `verifyReferralRequest({ body, headers, secret, path?, expectedOp?, now?, toleranceMs? })` verifies a call from Atlas to a referral platform (the webhook signature scheme; every call is a `POST` whose signed body carries `op` and `customerRef`) and returns `call` by operation (`ReferralProtocolCall`: `signup`, `erase`, `export` with `test`, `partner`, `signal`), plus `deliveryId`, `timestamp` and `idempotencyKey`. It refuses (`ReferralVerifyFailure`) a body that is not an object (`malformed_body`), a missing or unknown `op` (`missing_op`, `unknown_op`), a path that is not a protocol endpoint (`unknown_endpoint`) and an `op` that does not match the path or `expectedOp` (`op_mismatch`). Payload types: `ReferralSignupPayload`, `ReferralSignupResponse`, `ReferralErasePayload`, `ReferralExportPayload`, `ReferralPartnerPayload`, `ReferralSignalPayload`, `ReferralSignalType`, `ReferralContext`, `ReferralRiskVerdict`, `ReferralOp`; `referralOpForPath`; constants `REFERRAL_OP_ENDPOINTS`, `REFERRAL_CONNECTION_TEST_REF`, `REFERRAL_PROTOCOL_USER_AGENT`.
+- **Compatible.** New methods, types, optional fields and constants only.
+
 ## 0.10.0
 - **Trusted reverse proxy secret.** `instanceSecurity.getProxySecret()` (`ProxySecret`: `set`, `created_at`, `previous_expires_at`, `secret_header`, `client_ip_header`), `instanceSecurity.createProxySecret({ overlap_seconds? })` (`ProxySecretCreated`: adds `secret`, shown once, and `rotated`; `CreateProxySecretBody`) and `instanceSecurity.deleteProxySecret()`. A proxy that serves the Frontend API from your own origin sends the secret in `X-Atlas-Proxy-Secret` and the browser's IP in `X-Atlas-Client-IP`; Atlas then uses that IP for rate limits, lockout, risk signals, geo, audit logs and session metadata.
 - **Managed email feedback on Resend.** `ManagedEmail.feedback_webhook` is now also returned for Resend (on create and verify): Atlas registers a bounce / complaint webhook on your own Resend account, so `usage.bounces` / `usage.complaints` count for Resend domains too.

package/README.md

@@ -401,3 +401,58 @@ To check the route end to end, `oauthClients.testBackchannelLogout(id)` sends a
 `verifyWebhook` checks the signature on events Atlas sends to your webhook endpoints. You manage endpoints with `atlas.webhooks.endpoints`: create, update, reveal or rotate a secret, send a test event, and redeliver a past delivery.
 
 The `atlas-signature` header can carry more than one signature, separated by spaces (`v1,<sig> v1,<sig>`). While an endpoint secret rotates, Atlas may sign each delivery with the old and the new secret. `verifyWebhook` accepts the delivery when any one signature matches your secret.
+
+## Referral attribution
+
+With referral attribution on, Atlas reports every interactive sign-up to your referral platform before `user.created` is sent. The answer lands on the user: `referral` (who referred them, or null), `referral_code` and `referral_link` (the user's own code and link, when they are a referrer).
+
+```ts
+await atlas.referrals.update({
+  enabled: true,
+  provider: 'webhook', // the Atlas referral protocol; or a built-in vendor adapter
+  endpoint_url: 'https://referrals.example.com/atlas',
+  signing_secret: process.env.REFERRAL_SIGNING_SECRET,
+  auto_enroll_users: true,
+  link_template: 'https://app.example.com/join?ref={code}',
+  security: { on_high_risk: 'hold' },
+});
+const test = await atlas.referrals.test(); // { ok, http_status, latency_ms, error? }
+const failed = await atlas.referrals.listCalls({ status: 'failed', limit: 20 });
+await atlas.referrals.retryCall(failed.data[0]!.id);
+
+const user = await atlas.users.get('user_123');
+user.referral?.referrer_user_id;
+await atlas.users.update('user_123', { referral_code: 'ada-1' }); // 409 REFERRAL_CODE_TAKEN if held
+await atlas.users.flagReferral('user_123', { reason: 'self-referral' });
+```
+
+Enabling without what the provider needs is `422 REFERRALS_NOT_CONFIGURED`. When the platform answers late, Atlas sends the `user.referral_attributed` webhook (`UserReferralAttributedEvent`). Preflight may report `referrals_enabled_unverified` and `referrals_without_bot_protection`.
+
+### Receive the referral protocol (referral platforms)
+
+A referral platform that implements the Atlas referral protocol verifies Atlas's calls with `verifyReferralRequest`. Every call is a `POST` signed like a webhook, and its JSON body says which operation it is (`op`): `signup`, `erase`, `export`, `partner` or `signal`. Pass the path the call arrived on: a signed body whose `op` does not match the endpoint is refused (`op_mismatch`).
+
+```ts
+import { verifyReferralRequest } from '@atlasauth/backend';
+
+app.post('/atlas/:endpoint', express.raw({ type: '*/*' }), async (req, res) => {
+  const { verified, call } = verifyReferralRequest({
+    body: req.body,
+    headers: req.headers,
+    secret: process.env.REFERRAL_SIGNING_SECRET!,
+    path: req.path, // or expectedOp: 'signup' on a handler for one endpoint
+  });
+  if (!verified || !call) return res.sendStatus(401);
+  switch (call.op) {
+    case 'signup': // ReferralSignupPayload → answer ReferralSignupResponse
+      return res.json({ referral: await match(call.payload), partner: await enroll(call.payload) });
+    case 'export': // the connection test sends test: true
+      return call.test ? res.sendStatus(404) : res.json(await exportFor(call.payload.customerRef));
+    default: // erase, partner, signal
+      await handle(call);
+      return res.sendStatus(204);
+  }
+});
+```
+
+A retry of one call keeps its `atlas-id` (`deliveryId`). Sign-ups are idempotent on `customerRef`: answer a retry the same way.

package/dist/client/error.d.ts

@@ -57,6 +57,10 @@ export declare const AtlasErrorCodes: {
     readonly DEVELOPMENT_EMAIL_LIMIT_REACHED: "DEVELOPMENT_EMAIL_LIMIT_REACHED";
     /** 422 — the development sender sends only Atlas's own sign-in emails, never custom templates. */
     readonly DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED: "DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED";
+    /** 422 — referrals cannot be enabled until the provider's needs are set (`meta` names what is missing). */
+    readonly REFERRALS_NOT_CONFIGURED: "REFERRALS_NOT_CONFIGURED";
+    /** 409 — another user on the instance already holds that referral code. */
+    readonly REFERRAL_CODE_TAKEN: "REFERRAL_CODE_TAKEN";
     /** The billing plan still has subscribers and cannot be removed. */
     readonly PLAN_IN_USE: "PLAN_IN_USE";
     /** The key is valid but for another API surface (e.g. a platform key on the Backend API). */

package/dist/client/error.js

@@ -53,6 +53,10 @@ exports.AtlasErrorCodes = {
     DEVELOPMENT_EMAIL_LIMIT_REACHED: 'DEVELOPMENT_EMAIL_LIMIT_REACHED',
     /** 422 — the development sender sends only Atlas's own sign-in emails, never custom templates. */
     DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED: 'DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED',
+    /** 422 — referrals cannot be enabled until the provider's needs are set (`meta` names what is missing). */
+    REFERRALS_NOT_CONFIGURED: 'REFERRALS_NOT_CONFIGURED',
+    /** 409 — another user on the instance already holds that referral code. */
+    REFERRAL_CODE_TAKEN: 'REFERRAL_CODE_TAKEN',
     /** The billing plan still has subscribers and cannot be removed. */
     PLAN_IN_USE: 'PLAN_IN_USE',
     /** The key is valid but for another API surface (e.g. a platform key on the Backend API). */

package/dist/client/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,wGAAwG;IACxG,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,uIAAuI;IACvI,eAAe,EAAE,iBAAiB;IAClC,oFAAoF;IACpF,6BAA6B,EAAE,+BAA+B;IAC9D,8EAA8E;IAC9E,6BAA6B,EAAE,+BAA+B;IAC9D,6HAA6H;IAC7H,+BAA+B,EAAE,iCAAiC;IAClE,kGAAkG;IAClG,sCAAsC,EAAE,wCAAwC;IAChF,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,4FAA4F;IAC5F,oBAAoB,EAAE,sBAAsB;IAC5C,yFAAyF;IACzF,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,wGAAwG;IACxG,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,uIAAuI;IACvI,eAAe,EAAE,iBAAiB;IAClC,oFAAoF;IACpF,6BAA6B,EAAE,+BAA+B;IAC9D,8EAA8E;IAC9E,6BAA6B,EAAE,+BAA+B;IAC9D,6HAA6H;IAC7H,+BAA+B,EAAE,iCAAiC;IAClE,kGAAkG;IAClG,sCAAsC,EAAE,wCAAwC;IAChF,2GAA2G;IAC3G,wBAAwB,EAAE,0BAA0B;IACpD,2EAA2E;IAC3E,mBAAmB,EAAE,qBAAqB;IAC1C,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,4FAA4F;IAC5F,oBAAoB,EAAE,sBAAsB;IAC5C,yFAAyF;IACzF,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}

package/dist/client/index.d.ts

@@ -23,6 +23,9 @@ declare function buildNamespaces(request: RequestFn): {
             duration_in_seconds?: number;
         }): Promise<import("./users").User>;
         unlock(id: string): Promise<import("./users").User>;
+        flagReferral(id: string, body?: {
+            reason?: string;
+        }, idempotencyKey?: string): Promise<import("./users").UserReferralFlag>;
         delete(id: string): Promise<import("./types").DeletedObject>;
         resetMfa(id: string): Promise<{
             object: "user";
@@ -970,6 +973,13 @@ declare function buildNamespaces(request: RequestFn): {
             deleted: true;
         }>;
     };
+    referrals: {
+        get(): Promise<import("./referrals").ReferralSettings>;
+        update(body: import("./referrals").UpdateReferralSettingsBody, idempotencyKey?: string): Promise<import("./referrals").ReferralSettings>;
+        test(): Promise<import("./referrals").ReferralConnectionTest>;
+        listCalls(params?: import("./referrals").ListReferralCallsParams): Promise<import("./types").ListPage<import("./referrals").ReferralCall>>;
+        retryCall(id: string, idempotencyKey?: string): Promise<import("./referrals").ReferralCall>;
+    };
     tokens: {
         verify(body: import("./tokens").VerifyTokenBody): Promise<import("./tokens").TokenVerification>;
     };
@@ -1320,6 +1330,7 @@ export * from './radius-clients';
 export * from './lti-platforms';
 export * from './instance';
 export * from './instance-security';
+export * from './referrals';
 export * from './tokens';
 export * from './captcha';
 export * from './design';

package/dist/client/index.js

@@ -60,6 +60,7 @@ const radius_clients_1 = require("./radius-clients");
 const lti_platforms_1 = require("./lti-platforms");
 const instance_1 = require("./instance");
 const instance_security_1 = require("./instance-security");
+const referrals_1 = require("./referrals");
 const tokens_1 = require("./tokens");
 const captcha_1 = require("./captcha");
 const design_1 = require("./design");
@@ -147,6 +148,8 @@ function buildNamespaces(request) {
         ltiPlatforms: (0, lti_platforms_1.ltiPlatformsResource)(request),
         instance: (0, instance_1.instanceResource)(request),
         instanceSecurity: (0, instance_security_1.instanceSecurityResource)(request),
+        // Referral attribution: the instance's referral platform connection and call log.
+        referrals: (0, referrals_1.referralsResource)(request),
         tokens: (0, tokens_1.tokensResource)(request),
         // §5 "captcha anywhere" — verify any CAPTCHA token against the instance's
         // centrally-configured provider, server-side, with the secret held by Atlas.
@@ -236,6 +239,7 @@ __exportStar(require("./radius-clients"), exports);
 __exportStar(require("./lti-platforms"), exports);
 __exportStar(require("./instance"), exports);
 __exportStar(require("./instance-security"), exports);
+__exportStar(require("./referrals"), exports);
 __exportStar(require("./tokens"), exports);
 __exportStar(require("./captcha"), exports);
 __exportStar(require("./design"), exports);

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA4EA,8CAQC;AApFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA6EA,8CAQC;AArFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,2CAAgD;AAChD,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,kFAAkF;QAClF,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,8CAA4B;AAC5B,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}

package/dist/client/referrals.d.ts

@@ -0,0 +1,210 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * Referral attribution: the instance's connection to a referral platform.
+ *
+ * With referrals on, every interactive sign-up is reported to the platform
+ * before `user.created` is sent and before the session is issued. The
+ * platform's answer lands on the user (`referral`, `referral_code`,
+ * `referral_link`). A slow or failing platform never fails a sign-up: the
+ * call is retried, and `user.referral_attributed` is sent when it resolves.
+ *
+ * `provider` is `webhook` (the Atlas referral protocol, which any platform can
+ * implement; see {@link verifyReferralRequest}) or a built-in vendor adapter.
+ * `signing_secret` and `api_key` are write-only: reads return
+ * `signing_secret_set` / `api_key_set`.
+ */
+/** What a provider can do. An operation it lacks is recorded as `skipped`. */
+export interface ReferralProviderCapabilities {
+    signup: boolean;
+    erase: boolean;
+    export: boolean;
+    partner: boolean;
+    auto_enroll: boolean;
+    signal: boolean;
+}
+/** A referral provider Atlas supports. */
+export interface ReferralProviderInfo {
+    /** `webhook` (the Atlas referral protocol) or a vendor adapter id (`dub`, `firstpromoter`, …). */
+    id: string;
+    name: string;
+    capabilities: ReferralProviderCapabilities;
+    /** What must be set before `enabled` can be true. */
+    needs: Array<'endpoint_url' | 'signing_secret' | 'api_key' | 'connection_id'>;
+    /** The vendor's own first-party tracking cookie, suggested when this provider is picked. */
+    default_context_cookie: string | null;
+    docs_url: string | null;
+}
+/** Fraud and bot protection for referred sign-ups (`security` on the settings). */
+export interface ReferralSecuritySettings {
+    /**
+     * `always` (default): a sign-up carrying a referral code must pass the bot
+     * challenge, even where the captcha is otherwise off. `inherit`: the
+     * instance captcha policy decides. With no working captcha, `always` behaves
+     * as `inherit` and preflight reports `referrals_without_bot_protection`.
+     */
+    challenge_referred_signups: 'always' | 'inherit';
+    /**
+     * `flag` (default): report the sign-up with its risk. `strip`: report it as
+     * not referred, with `rejected.reason`. `hold`: report nothing until the
+     * email is proven, then re-assess.
+     */
+    on_high_risk: 'flag' | 'strip' | 'hold';
+    /** Hold every referred sign-up until the email is proven. Default false. */
+    hold_until_email_verified: boolean;
+    /** Referred sign-ups per code from one IP network or device per hour before a velocity signal (1-1000, default 5). */
+    max_referred_signups_per_ip_hour: number;
+}
+/** The connection's health, as the settings read reports it. */
+export interface ReferralConnectionStatus {
+    /** The last connection test, or null when never tested. */
+    last_test: {
+        ok: boolean;
+        at: number;
+        http_status: number | null;
+        error: string | null;
+    } | null;
+    /** Calls that failed permanently in the last 7 days. */
+    failed_calls_7d: number;
+    /** Calls waiting for a retry. */
+    retrying_calls: number;
+    /** Epoch ms of the last successful call, or null. */
+    last_success_at: number | null;
+}
+/** `GET /v1/instance/referrals`. */
+export interface ReferralSettings {
+    object: 'referral_settings';
+    enabled: boolean;
+    /** `webhook` (the Atlas referral protocol) or a built-in vendor adapter id. */
+    provider: string;
+    /** Base URL of the platform connection (Atlas referral protocol). */
+    endpoint_url: string | null;
+    /** Passed through to the platform. */
+    program_id: string | null;
+    /** Your label for the connection on the platform side. */
+    connection_id: string | null;
+    /** Whether a signing secret is stored (the value is never returned). */
+    signing_secret_set: boolean;
+    /** Whether a vendor API key is stored (the value is never returned). */
+    api_key_set: boolean;
+    /** Query parameters that carry a referral code, in priority order (default `ref`, `via`, `aff`). */
+    url_params: string[];
+    /** First-party tracking cookie read under consent; null = never read a cookie. */
+    context_cookie: string | null;
+    consent_category: string;
+    consent_fallback_category: string | null;
+    /** Every new user becomes a referrer (gets a code and link from the platform). */
+    auto_enroll_users: boolean;
+    /** e.g. `https://app.example.com/join?ref={code}`; builds `referral_link`. */
+    link_template: string | null;
+    /** How long a sign-up waits for the platform (100-5000 ms, default 3000). */
+    timeout_ms: number;
+    security: ReferralSecuritySettings;
+    /** What the chosen provider still needs before referrals can be enabled. */
+    missing?: string[];
+    connection?: ReferralConnectionStatus | null;
+    providers: ReferralProviderInfo[];
+    updated_at?: number | null;
+}
+/**
+ * `PATCH /v1/instance/referrals`: only the fields sent change, `null` clears.
+ * Enabling without what the provider needs is `422 REFERRALS_NOT_CONFIGURED`.
+ */
+export interface UpdateReferralSettingsBody {
+    enabled?: boolean;
+    provider?: string;
+    /** https only (http only for localhost on a development instance). */
+    endpoint_url?: string | null;
+    program_id?: string | null;
+    connection_id?: string | null;
+    /** Write-only, 16-512 characters. */
+    signing_secret?: string | null;
+    /** Write-only vendor API key. */
+    api_key?: string | null;
+    /** 1-10 names of `[A-Za-z0-9_.-]{1,40}`. */
+    url_params?: string[];
+    context_cookie?: string | null;
+    consent_category?: string;
+    consent_fallback_category?: string | null;
+    auto_enroll_users?: boolean;
+    /** An https URL containing `{code}`. */
+    link_template?: string | null;
+    /** 100-5000. */
+    timeout_ms?: number;
+    /** Partial: only the security fields sent change. */
+    security?: Partial<ReferralSecuritySettings>;
+}
+/** `POST /v1/instance/referrals/test`. */
+export interface ReferralConnectionTest {
+    ok: boolean;
+    http_status?: number | null;
+    latency_ms?: number | null;
+    /** e.g. `signature_rejected` (the platform answered 401/403), `timeout`, `network_error`, `url_blocked`, `http_500`. */
+    error?: {
+        code: string;
+        message: string;
+    };
+}
+export type ReferralCallKind = 'signup' | 'erase' | 'export' | 'partner' | 'signal' | 'test';
+export type ReferralCallStatus = 'pending' | 'succeeded' | 'retrying' | 'failed' | 'held' | 'skipped';
+/** The risk verdict sent with a sign-up (camelCase, as on the referral protocol). */
+export interface ReferralRisk {
+    level: 'low' | 'medium' | 'high';
+    /** 0-100. */
+    score: number;
+    /**
+     * e.g. `self_referral`, `ip_velocity`, `device_velocity`, `disposable_email`,
+     * `datacenter_ip`, `tor_ip`, `captcha_not_passed`, `email_unverified`,
+     * `restricted_identifier`.
+     */
+    signals: string[];
+    captcha: 'passed' | 'not_required' | 'not_configured';
+    emailVerified: boolean;
+}
+/** One call in the referral call log. */
+export interface ReferralCall {
+    object: 'referral_call';
+    /** Also the signed `atlas-id` header of every attempt. */
+    id: string;
+    kind: ReferralCallKind;
+    status: ReferralCallStatus;
+    /** Sign-up calls: `referred`, `not_referred` or `stripped`. */
+    outcome?: string | null;
+    customer_ref: string;
+    user_id?: string | null;
+    http_status?: number | null;
+    last_error?: string | null;
+    attempts: number;
+    /** Epoch ms of the next retry, while pending or retrying. */
+    next_attempt_at?: number | null;
+    risk?: ReferralRisk | null;
+    /** What was sent (never secrets). */
+    payload?: Record<string, unknown>;
+    created_at: number;
+    updated_at?: number;
+}
+export interface ListReferralCallsParams {
+    /** 1-200, default 50, newest first. */
+    limit?: number;
+    status?: ReferralCallStatus;
+    kind?: ReferralCallKind;
+    user_id?: string;
+}
+export declare function referralsResource(request: RequestFn): {
+    /** `GET /v1/instance/referrals` — settings, connection status and the supported providers. */
+    get(): Promise<ReferralSettings>;
+    /** `PATCH /v1/instance/referrals` — partial update; secrets are write-only. */
+    update(body: UpdateReferralSettingsBody, idempotencyKey?: string): Promise<ReferralSettings>;
+    /**
+     * `POST /v1/instance/referrals/test` — a signed probe of the platform. `ok`
+     * when it answered 2xx or 404; `error.code` `signature_rejected` on 401/403.
+     */
+    test(): Promise<ReferralConnectionTest>;
+    /** `GET /v1/instance/referrals/calls` — the call log, newest first. */
+    listCalls(params?: ListReferralCallsParams): Promise<ListPage<ReferralCall>>;
+    /**
+     * `POST /v1/instance/referrals/calls/:id/retry` — retry a failed, retrying
+     * or skipped call now (a connection test cannot be retried).
+     */
+    retryCall(id: string, idempotencyKey?: string): Promise<ReferralCall>;
+};

package/dist/client/referrals.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.referralsResource = referralsResource;
+const request_1 = require("./request");
+function referralsResource(request) {
+    return {
+        /** `GET /v1/instance/referrals` — settings, connection status and the supported providers. */
+        get() {
+            return request({ method: 'GET', path: '/v1/instance/referrals' });
+        },
+        /** `PATCH /v1/instance/referrals` — partial update; secrets are write-only. */
+        update(body, idempotencyKey) {
+            return request({ method: 'PATCH', path: '/v1/instance/referrals', body, idempotencyKey });
+        },
+        /**
+         * `POST /v1/instance/referrals/test` — a signed probe of the platform. `ok`
+         * when it answered 2xx or 404; `error.code` `signature_rejected` on 401/403.
+         */
+        test() {
+            return request({ method: 'POST', path: '/v1/instance/referrals/test' });
+        },
+        /** `GET /v1/instance/referrals/calls` — the call log, newest first. */
+        listCalls(params = {}) {
+            return request({ method: 'GET', path: '/v1/instance/referrals/calls', query: { ...params } });
+        },
+        /**
+         * `POST /v1/instance/referrals/calls/:id/retry` — retry a failed, retrying
+         * or skipped call now (a connection test cannot be retried).
+         */
+        retryCall(id, idempotencyKey) {
+            return request({
+                method: 'POST',
+                path: `/v1/instance/referrals/calls/${(0, request_1.enc)(id)}/retry`,
+                idempotencyKey,
+            });
+        },
+    };
+}
+//# sourceMappingURL=referrals.js.map

package/dist/client/referrals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"referrals.js","sourceRoot":"","sources":["../../src/client/referrals.ts"],"names":[],"mappings":";;AAqMA,8CAiCC;AAtOD,uCAAgD;AAqMhD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,8FAA8F;QAC9F,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,+EAA+E;QAC/E,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD;;;WAGG;QACH,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,uEAAuE;QACvE,SAAS,CAAC,SAAkC,EAAE;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,EAAU,EAAE,cAAuB;YAC3C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;gBACrD,cAAc;aACf,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/users.d.ts

@@ -22,6 +22,72 @@ export interface User {
      * the one you hold. (Absent from servers older than this field.)
      */
     version?: number;
+    /**
+     * How the user arrived through a referral program, when the instance has
+     * referral attribution on and the platform matched a referrer; null when not
+     * referred, not answered yet, or referrals are off. (Absent from servers
+     * older than this field.)
+     */
+    referral?: UserReferral | null;
+    /** The user's own referral code, when they are a referrer. */
+    referral_code?: string | null;
+    /** The user's own referral link, when they are a referrer. */
+    referral_link?: string | null;
+}
+/** The inbound referral the referral platform matched for a user. */
+export interface UserReferral {
+    /** The platform's id for the referring partner. */
+    partner_id: string | null;
+    /** The referrer as the platform knows them (your `external_id` for that user, or their Atlas id). */
+    referrer_external_id: string | null;
+    /** The referrer's Atlas user id, when they are a user of this instance. */
+    referrer_user_id: string | null;
+    /** How the platform matched the referral, e.g. `code`, `click`, `coupon`. */
+    matched_via: string | null;
+    /** The platform's own status for the referral. */
+    status: string | null;
+    /** The risk level Atlas assessed at sign-up, when one was. */
+    risk_level?: 'low' | 'medium' | 'high' | null;
+    /** An admin marked the referral fraudulent (`users.flagReferral`). */
+    flagged?: boolean;
+}
+/**
+ * An imported referral on `users.create`: how the user arrived. With referral
+ * attribution on, the user is reported to the referral platform. Each id is
+ * 3-64 characters of `A-Z a-z 0-9 _ -`.
+ */
+export interface CreateUserReferralInput {
+    code?: string;
+    click_id?: string;
+    anon_id?: string;
+}
+/** `POST /v1/users/:id/referral/flag`. */
+export interface UserReferralFlag {
+    object: 'user_referral';
+    user_id: string;
+    /** `flagged` after this call. */
+    status: string;
+    flagged: boolean;
+    flag_reason: string | null;
+    /** Epoch ms. */
+    flagged_at: number | null;
+    risk_level: 'low' | 'medium' | 'high' | null;
+}
+/**
+ * The `data` of a `user.referral_attributed` webhook: the referral platform
+ * answered after `user.created` was sent.
+ */
+export interface UserReferralAttributedEvent {
+    object: 'user_referral';
+    user_id: string;
+    /** `attributed`, `not_referred`, `failed`, … (`not_referred`: the platform found no referrer). */
+    attribution_status: string;
+    referral: UserReferral | null;
+    referral_code: string | null;
+    referral_link: string | null;
+    /** Epoch ms. */
+    signed_up_at: number;
+    updated_at: number;
 }
 export interface EmailAddress {
     object: 'email_address';
@@ -75,12 +141,21 @@ export interface CreateUserBody {
      * guarantees no email, SMS or push is sent as a consequence of the create.
      */
     notify?: boolean;
+    /**
+     * Import a referral (how the user arrived). With referral attribution on,
+     * the user is reported to the referral platform.
+     */
+    referral?: CreateUserReferralInput;
+    /** The user's own referral code; unique per instance (`409 REFERRAL_CODE_TAKEN`). */
+    referral_code?: string;
 }
 export interface UpdateUserBody {
     first_name?: string;
     last_name?: string;
     public_metadata?: Metadata;
     private_metadata?: Metadata;
+    /** The user's own referral code; `null` clears. Unique per instance (`409 REFERRAL_CODE_TAKEN`). */
+    referral_code?: string | null;
 }
 export interface ReplaceUserMetadataBody {
     public_metadata?: Metadata;
@@ -101,6 +176,16 @@ export declare function usersResource(request: RequestFn): {
         duration_in_seconds?: number;
     }): Promise<User>;
     unlock(id: string): Promise<User>;
+    /**
+     * `POST /v1/users/:id/referral/flag` — mark the user's referral fraudulent.
+     * The referral reads `flagged: true`, the referral platform is sent a
+     * `fraud_confirmed` signal (when referrals are on) and the action is
+     * audited. The user's account is not changed. 404 when the user has no
+     * referral. `reason` (at most 500 characters) is sent to the platform.
+     */
+    flagReferral(id: string, body?: {
+        reason?: string;
+    }, idempotencyKey?: string): Promise<UserReferralFlag>;
     delete(id: string): Promise<DeletedObject>;
     resetMfa(id: string): Promise<{
         object: "user";

package/dist/client/users.js

@@ -33,6 +33,21 @@ function usersResource(request) {
         unlock(id) {
             return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/unlock` });
         },
+        /**
+         * `POST /v1/users/:id/referral/flag` — mark the user's referral fraudulent.
+         * The referral reads `flagged: true`, the referral platform is sent a
+         * `fraud_confirmed` signal (when referrals are on) and the action is
+         * audited. The user's account is not changed. 404 when the user has no
+         * referral. `reason` (at most 500 characters) is sent to the platform.
+         */
+        flagReferral(id, body = {}, idempotencyKey) {
+            return request({
+                method: 'POST',
+                path: `/v1/users/${(0, request_1.enc)(id)}/referral/flag`,
+                body,
+                idempotencyKey,
+            });
+        },
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/users/${(0, request_1.enc)(id)}` });
         },

package/dist/client/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/client/users.ts"],"names":[],"mappings":";;AA8FA,sCA2aC;AAzgBD,uCAAgD;AA8FhD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,SAA0B,EAAE;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,wEAAwE;QACxE,eAAe,CAAC,EAAU,EAAE,IAA6B;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,EAAU,EAAE,OAAyC,EAAE;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,eAAe,CACb,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;WAGG;QACH,cAAc,CACZ,EAAU,EACV,UAAuC,EAAE;YAEzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;gBAC5C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,EAAU,EAAE,IAA+B;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,WAAW,CAAC,EAAU,EAAE,OAAe;YACrC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;aACpE,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,EAAU,EAAE,OAAe;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU;aACrE,CAAC,CAAC;QACL,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,EAAU,EAAE,QAAgB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,cAAc,CAAC,EAAU;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,YAAY,CACV,EAAU,EACV,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD;;;;;;;;WAQG;QACH,sBAAsB,CACpB,EAAU,EACV,IAA8E,EAC9E,cAAuB;YASvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,4BAA4B;gBACtD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CACZ,EAAU,EACV,UAAkB;YAElB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,+EAA+E;QAC/E,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QACD;;;;WAIG;QACH,eAAe,CACb,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,WAAW,CACT,OAAe;YAEf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,IAAuB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,6GAA6G;QAC7G,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;;WAIG;QACH,aAAa,CAAC,EAAU,EAAE,SAAuB,EAAE;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;gBAC5C,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,2BAA2B,CACzB,EAAU,EACV,SAAuB,EAAE;YAEzB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;gBACrD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,WAAW,CAAC,EAAU,EAAE,IAAyB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,sEAAsE;QACtE,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,sFAAsF;QACtF,aAAa,CACX,EAAU,EACV,SAAiB;YAEjB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CAAC,EAAU,EAAE,IAAwB;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD;;;;WAIG;QACH,wBAAwB,CACtB,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,kBAAkB,CAChB,EAAU,EACV,IAAwB,EACxB,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe;gBACzC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,aAAa,CAAC,EAAU;YACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,sGAAsG;QACtG,QAAQ,EAAE;YACR,wGAAwG;YACxG,QAAQ,CACN,EAAU,EACV,OAAmC,EAAE,EACrC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,uFAAuF;YACvF,MAAM,CAAC,EAAU,EAAE,cAAuB;gBACxC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;oBAC5C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,qGAAqG;YACrG,QAAQ,CACN,EAAU,EACV,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB;oBAC9C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,uEAAuE;QACvE,UAAU,EAAE;YACV,gFAAgF;YAChF,MAAM,CACJ,EAAU,EACV,IAA6B,EAC7B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;oBACvC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,qEAAqE;YACrE,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;YAChF,CAAC;SACF;QACD,yEAAyE;QACzE,QAAQ,EAAE;YACR,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,wHAAwH;YACxH,MAAM,CACJ,EAAU,EACV,IAA2B,EAC3B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,sFAAsF;QACtF,gBAAgB,EAAE;YAChB;;;;eAIG;YACH,MAAM,CAAC,EAAU,EAAE,IAAmC;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,2EAA2E;YAC3E,GAAG,CAAC,EAAU,EAAE,UAAkB;gBAChC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;QACD,yDAAyD;QACzD,uBAAuB,EAAE;YACvB,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;iBACtD,CAAC,CAAC;YACL,CAAC;YACD,iGAAiG;YACjG,MAAM,CACJ,EAAU,EACV,IAA2C;gBAE3C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;oBACrD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;SACF;QACD,wEAAwE;QACxE,YAAY,EAAE;YACZ,yBAAyB;YACzB,GAAG,CAAC,EAAU,EAAE,IAA8B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CAAC,EAAU,EAAE,OAAe;gBAChC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;iBAClE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,EAAU,EACV,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;SACF;QACD,8BAA8B;QAC9B,WAAW,EAAE;YACX;;;eAGG;YACH,QAAQ,CAAC,EAAU,EAAE,IAA8B;gBACjD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,qBAAqB;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/client/users.ts"],"names":[],"mappings":";;AA6KA,sCA8bC;AA3mBD,uCAAgD;AA6KhD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,SAA0B,EAAE;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,wEAAwE;QACxE,eAAe,CAAC,EAAU,EAAE,IAA6B;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,EAAU,EAAE,OAAyC,EAAE;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD;;;;;;WAMG;QACH,YAAY,CACV,EAAU,EACV,OAA4B,EAAE,EAC9B,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAC1C,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,eAAe,CACb,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;WAGG;QACH,cAAc,CACZ,EAAU,EACV,UAAuC,EAAE;YAEzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;gBAC5C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,EAAU,EAAE,IAA+B;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,WAAW,CAAC,EAAU,EAAE,OAAe;YACrC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;aACpE,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,EAAU,EAAE,OAAe;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU;aACrE,CAAC,CAAC;QACL,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,EAAU,EAAE,QAAgB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,cAAc,CAAC,EAAU;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,YAAY,CACV,EAAU,EACV,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD;;;;;;;;WAQG;QACH,sBAAsB,CACpB,EAAU,EACV,IAA8E,EAC9E,cAAuB;YASvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,4BAA4B;gBACtD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CACZ,EAAU,EACV,UAAkB;YAElB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,+EAA+E;QAC/E,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QACD;;;;WAIG;QACH,eAAe,CACb,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,WAAW,CACT,OAAe;YAEf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,IAAuB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,6GAA6G;QAC7G,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;;WAIG;QACH,aAAa,CAAC,EAAU,EAAE,SAAuB,EAAE;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;gBAC5C,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,2BAA2B,CACzB,EAAU,EACV,SAAuB,EAAE;YAEzB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;gBACrD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,WAAW,CAAC,EAAU,EAAE,IAAyB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,sEAAsE;QACtE,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,sFAAsF;QACtF,aAAa,CACX,EAAU,EACV,SAAiB;YAEjB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CAAC,EAAU,EAAE,IAAwB;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD;;;;WAIG;QACH,wBAAwB,CACtB,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,kBAAkB,CAChB,EAAU,EACV,IAAwB,EACxB,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe;gBACzC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,aAAa,CAAC,EAAU;YACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,sGAAsG;QACtG,QAAQ,EAAE;YACR,wGAAwG;YACxG,QAAQ,CACN,EAAU,EACV,OAAmC,EAAE,EACrC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,uFAAuF;YACvF,MAAM,CAAC,EAAU,EAAE,cAAuB;gBACxC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;oBAC5C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,qGAAqG;YACrG,QAAQ,CACN,EAAU,EACV,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB;oBAC9C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,uEAAuE;QACvE,UAAU,EAAE;YACV,gFAAgF;YAChF,MAAM,CACJ,EAAU,EACV,IAA6B,EAC7B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;oBACvC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,qEAAqE;YACrE,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;YAChF,CAAC;SACF;QACD,yEAAyE;QACzE,QAAQ,EAAE;YACR,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,wHAAwH;YACxH,MAAM,CACJ,EAAU,EACV,IAA2B,EAC3B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,sFAAsF;QACtF,gBAAgB,EAAE;YAChB;;;;eAIG;YACH,MAAM,CAAC,EAAU,EAAE,IAAmC;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,2EAA2E;YAC3E,GAAG,CAAC,EAAU,EAAE,UAAkB;gBAChC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;QACD,yDAAyD;QACzD,uBAAuB,EAAE;YACvB,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;iBACtD,CAAC,CAAC;YACL,CAAC;YACD,iGAAiG;YACjG,MAAM,CACJ,EAAU,EACV,IAA2C;gBAE3C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;oBACrD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;SACF;QACD,wEAAwE;QACxE,YAAY,EAAE;YACZ,yBAAyB;YACzB,GAAG,CAAC,EAAU,EAAE,IAA8B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CAAC,EAAU,EAAE,OAAe;gBAChC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;iBAClE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,EAAU,EACV,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;SACF;QACD,8BAA8B;QAC9B,WAAW,EAAE;YACX;;;eAGG;YACH,QAAQ,CAAC,EAAU,EAAE,IAA8B;gBACjD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,qBAAqB;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, Log
 export { AtlasOidcError, OIDC_FLOW_COOKIE, OIDC_FLOW_MAX_AGE_SECONDS, oidc, oidcCallback, oidcClearCookie, oidcLogoutUrl, oidcStart, oidcVerifyIdToken, resetOidcCaches, } from './oidc';
 export type { AtlasOidc, AtlasOidcErrorCode, OidcCallbackOptions, OidcClientAuth, OidcIdentity, OidcLogoutUrlOptions, OidcStartOptions, OidcStartResult, VerifyIdTokenOptions, } from './oidc';
 export * from './webhooks';
+export * from './referrals';
 export { createAtlasClient } from './client';
 export type { AtlasClient } from './client';
 export * from './client';

package/dist/index.js

@@ -48,6 +48,8 @@ Object.defineProperty(exports, "oidcVerifyIdToken", { enumerable: true, get: fun
 Object.defineProperty(exports, "resetOidcCaches", { enumerable: true, get: function () { return oidc_1.resetOidcCaches; } });
 // §12.2 inbound webhook verification for consumers.
 __exportStar(require("./webhooks"), exports);
+// The Atlas referral protocol, for a referral platform receiving Atlas's signed calls.
+__exportStar(require("./referrals"), exports);
 // The typed management client for the secret-key Backend API.
 var client_1 = require("./client");
 Object.defineProperty(exports, "createAtlasClient", { enumerable: true, get: function () { return client_1.createAtlasClient; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAU7C,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAU7C,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA"}

package/dist/referrals.d.ts

@@ -0,0 +1,199 @@
+import { type WebhookVerifyFailure } from './webhooks';
+import type { ReferralRisk } from './client/referrals';
+/**
+ * The Atlas referral protocol (v1), for a REFERRAL PLATFORM receiving calls
+ * from Atlas. An Atlas instance with referral attribution on (provider
+ * `webhook`) calls the platform's base URL. Every call is a signed POST whose
+ * JSON body says which operation it is (`op`) and which customer it is about:
+ *
+ *   POST {base}/signups   { op: 'signup', customerRef, … }            → 200 ReferralSignupResponse
+ *   POST {base}/erase     { op: 'erase', customerRef }                → 2xx (404 = already gone)
+ *   POST {base}/export    { op: 'export', customerRef, test }         → 200 JSON (any shape) | 404
+ *   POST {base}/partners  { op: 'partner', customerRef, code, emailHash } → 2xx | 409 code taken | 404/405/501 unsupported
+ *   POST {base}/signals   { op: 'signal', customerRef, type, occurredAt, data } → 2xx | 404/405/501 unsupported
+ *
+ * The connection test is `POST {base}/export` with
+ * `{ op: 'export', customerRef: 'atlas_connection_test', test: true }` (answer
+ * 2xx or 404). Calls are signed exactly like Atlas webhooks (`atlas-id`,
+ * `atlas-timestamp`, `atlas-signature` over `<id>.<timestamp>.<raw body>`),
+ * with `Idempotency-Key` and `User-Agent: Atlas-Referrals/1`. `atlas-id` is the
+ * call id, the same on every retry of one call.
+ *
+ * The signature covers the body, not the URL, so everything that matters is in
+ * the body. Pass the path the request arrived on (or the operation you
+ * expect): a signed body whose `op` does not match it is refused, so a
+ * captured call cannot be replayed against another endpoint.
+ */
+/** `customerRef` of the connection test (`POST {base}/export` with `test: true`). */
+export declare const REFERRAL_CONNECTION_TEST_REF = "atlas_connection_test";
+/** The `User-Agent` Atlas sends on every referral call. */
+export declare const REFERRAL_PROTOCOL_USER_AGENT = "Atlas-Referrals/1";
+/** The referral captured at sign-up (from the page URL, or a tracking cookie under consent). Never trusted. */
+export interface ReferralContext {
+    /** The referral code from the URL (or cookie), 3-64 of `A-Z a-z 0-9 _ -`. */
+    code: string | null;
+    /** The platform's click id, read from its cookie only under consent. */
+    clickId: string | null;
+    /** The platform's anonymous visitor id, read from its cookie only under consent. */
+    anonId: string | null;
+    /** ISO 8601. */
+    capturedAt: string;
+    /** `granted`: the cookie was read under consent. `not_required`: a URL code only. */
+    consent: 'granted' | 'not_required';
+}
+/** The risk verdict Atlas sends with a sign-up (the same shape as `ReferralCall.risk`). */
+export type ReferralRiskVerdict = ReferralRisk;
+/** `POST {base}/signups`. Idempotent on `customerRef` (`Idempotency-Key: signup:<customerRef>`). */
+export interface ReferralSignupPayload {
+    op: 'signup';
+    /** The app's id for the user: its external_id when set, else the Atlas user id. */
+    customerRef: string;
+    /** sha256 hex of the lower-cased, trimmed primary email; null when the user has none. */
+    emailHash: string | null;
+    ip: string | null;
+    ua: string | null;
+    /** ISO 8601: the original sign-up time, the same on every retry. */
+    signedUpAt: string;
+    programId: string | null;
+    /** Make the user a referrer: answer with `partner { id, code, link }`. */
+    autoEnroll: boolean;
+    /** Null when the user arrived with no referral (reported because of `autoEnroll`), or when stripped. */
+    referral: ReferralContext | null;
+    risk?: ReferralRiskVerdict | null;
+    /** Set when Atlas stripped the referral because of its risk policy. */
+    rejected?: {
+        reason: string;
+    } | null;
+}
+/** The answer a platform gives to `POST {base}/signups`. */
+export interface ReferralSignupResponse {
+    /** The matched referral, or null when not referred. */
+    referral: {
+        partnerId: string | null;
+        /** The referrer as the app knows them (their customerRef); Atlas maps it to a local user. */
+        referrerExternalRef: string | null;
+        /** e.g. `code`, `click`, `coupon`. */
+        matchedVia: string | null;
+        status: string | null;
+    } | null;
+    /** The user's own partner record when `autoEnroll` was true. `link` may be omitted: Atlas builds it from its link template. */
+    partner?: {
+        id: string | null;
+        code: string | null;
+        link?: string | null;
+    } | null;
+}
+/** `POST {base}/erase`. */
+export interface ReferralErasePayload {
+    op: 'erase';
+    customerRef: string;
+}
+/** `POST {base}/export`: what you hold about a customer (answer any JSON, or 404). */
+export interface ReferralExportPayload {
+    op: 'export';
+    customerRef: string;
+    /** True for the connection test (`customerRef` `atlas_connection_test`). */
+    test: boolean;
+}
+/** `POST {base}/partners`: the user's own referral code was set in Atlas. */
+export interface ReferralPartnerPayload {
+    op: 'partner';
+    customerRef: string;
+    code: string;
+    emailHash: string | null;
+}
+/** The lifecycle signal types. */
+export type ReferralSignalType = 'email_verified' | 'user_banned' | 'user_unbanned' | 'user_locked' | 'risk_elevated' | 'fraud_confirmed';
+/** `POST {base}/signals`: a lifecycle update, so the platform can qualify, hold or void a commission. */
+export interface ReferralSignalPayload {
+    op: 'signal';
+    customerRef: string;
+    type: ReferralSignalType | (string & {});
+    /** ISO 8601. */
+    occurredAt: string;
+    data: Record<string, unknown>;
+}
+/** The operations of the referral protocol (the `op` of every call). */
+export type ReferralOp = 'signup' | 'erase' | 'export' | 'partner' | 'signal';
+/** The endpoint (last path segment) each operation is sent to. */
+export declare const REFERRAL_OP_ENDPOINTS: Record<ReferralOp, string>;
+/** A verified call, by operation. */
+export type ReferralProtocolCall = {
+    op: 'signup';
+    payload: ReferralSignupPayload;
+} | {
+    op: 'erase';
+    payload: ReferralErasePayload;
+} | {
+    op: 'export';
+    payload: ReferralExportPayload;
+    /** The connection test (`customerRef` `atlas_connection_test`): answer 2xx or 404. */
+    test: boolean;
+} | {
+    op: 'partner';
+    payload: ReferralPartnerPayload;
+} | {
+    op: 'signal';
+    payload: ReferralSignalPayload;
+};
+/**
+ * Why a call was refused: a webhook signature failure, or
+ * `malformed_body` (not a JSON object), `missing_op`, `unknown_op`,
+ * `unknown_endpoint` (the path's last segment is not a protocol endpoint) or
+ * `op_mismatch` (the signed `op` is not the operation of the endpoint or the
+ * expected operation).
+ */
+export type ReferralVerifyFailure = WebhookVerifyFailure | 'malformed_body' | 'missing_op' | 'unknown_op' | 'unknown_endpoint' | 'op_mismatch';
+type HeadersLike = Headers | Record<string, string | string[] | undefined>;
+export interface VerifyReferralRequestInput {
+    /** The RAW request body (string or Buffer), before any JSON parse. */
+    body: string | Buffer;
+    headers: HeadersLike;
+    /** The signing secret configured on the Atlas instance's referral settings. */
+    secret: string;
+    /**
+     * The path (or full URL) the request arrived on, e.g. `req.path`. Its last
+     * segment (`signups`, `erase`, `export`, `partners`, `signals`) must match
+     * the signed `op`.
+     */
+    path?: string;
+    /** The operation this handler serves; the signed `op` must equal it. */
+    expectedOp?: ReferralOp;
+    now?: Date;
+    /** Defaults to 5 minutes, as for webhooks. */
+    toleranceMs?: number;
+}
+export interface ReferralVerifyResult {
+    verified: boolean;
+    reason?: ReferralVerifyFailure;
+    /** The signed `atlas-id` (the call id): the same on every retry of one call. */
+    deliveryId?: string;
+    /** The signed `atlas-timestamp` (epoch ms). */
+    timestamp?: number;
+    /** The `Idempotency-Key` header (`signup:<customerRef>` on sign-ups). Not signed. */
+    idempotencyKey?: string;
+    /** The operation and its payload, present only when `verified`. */
+    call?: ReferralProtocolCall;
+}
+/** The operation of a path's last segment, or null when it is not a protocol endpoint. */
+export declare function referralOpForPath(path: string): ReferralOp | null;
+/**
+ * Verify a call from Atlas to your referral platform and tell which operation
+ * it is. Never throws: check `verified`. Verify over the RAW body, before any
+ * JSON parse, and pass the path it arrived on (or `expectedOp`) so a signed
+ * body cannot be replayed against another endpoint.
+ *
+ * ```ts
+ * app.post('/atlas/:endpoint', express.raw({ type: '*\/*' }), async (req, res) => {
+ *   const { verified, call } = verifyReferralRequest({
+ *     body: req.body, headers: req.headers, secret, path: req.path,
+ *   });
+ *   if (!verified || !call) return res.sendStatus(401);
+ *   if (call.op === 'export' && call.test) return res.sendStatus(404);
+ *   if (call.op === 'signup') return res.json(await attribute(call.payload)); // ReferralSignupResponse
+ *   // erase, export, partner, signal ...
+ * });
+ * ```
+ */
+export declare function verifyReferralRequest(input: VerifyReferralRequestInput): ReferralVerifyResult;
+export {};

package/dist/referrals.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFERRAL_OP_ENDPOINTS = exports.REFERRAL_PROTOCOL_USER_AGENT = exports.REFERRAL_CONNECTION_TEST_REF = void 0;
+exports.referralOpForPath = referralOpForPath;
+exports.verifyReferralRequest = verifyReferralRequest;
+const webhooks_1 = require("./webhooks");
+/**
+ * The Atlas referral protocol (v1), for a REFERRAL PLATFORM receiving calls
+ * from Atlas. An Atlas instance with referral attribution on (provider
+ * `webhook`) calls the platform's base URL. Every call is a signed POST whose
+ * JSON body says which operation it is (`op`) and which customer it is about:
+ *
+ *   POST {base}/signups   { op: 'signup', customerRef, … }            → 200 ReferralSignupResponse
+ *   POST {base}/erase     { op: 'erase', customerRef }                → 2xx (404 = already gone)
+ *   POST {base}/export    { op: 'export', customerRef, test }         → 200 JSON (any shape) | 404
+ *   POST {base}/partners  { op: 'partner', customerRef, code, emailHash } → 2xx | 409 code taken | 404/405/501 unsupported
+ *   POST {base}/signals   { op: 'signal', customerRef, type, occurredAt, data } → 2xx | 404/405/501 unsupported
+ *
+ * The connection test is `POST {base}/export` with
+ * `{ op: 'export', customerRef: 'atlas_connection_test', test: true }` (answer
+ * 2xx or 404). Calls are signed exactly like Atlas webhooks (`atlas-id`,
+ * `atlas-timestamp`, `atlas-signature` over `<id>.<timestamp>.<raw body>`),
+ * with `Idempotency-Key` and `User-Agent: Atlas-Referrals/1`. `atlas-id` is the
+ * call id, the same on every retry of one call.
+ *
+ * The signature covers the body, not the URL, so everything that matters is in
+ * the body. Pass the path the request arrived on (or the operation you
+ * expect): a signed body whose `op` does not match it is refused, so a
+ * captured call cannot be replayed against another endpoint.
+ */
+/** `customerRef` of the connection test (`POST {base}/export` with `test: true`). */
+exports.REFERRAL_CONNECTION_TEST_REF = 'atlas_connection_test';
+/** The `User-Agent` Atlas sends on every referral call. */
+exports.REFERRAL_PROTOCOL_USER_AGENT = 'Atlas-Referrals/1';
+/** The endpoint (last path segment) each operation is sent to. */
+exports.REFERRAL_OP_ENDPOINTS = {
+    signup: 'signups',
+    erase: 'erase',
+    export: 'export',
+    partner: 'partners',
+    signal: 'signals',
+};
+function header(headers, name) {
+    if (typeof headers.get === 'function')
+        return headers.get(name) ?? undefined;
+    const bag = headers;
+    const hit = Object.keys(bag).find((k) => k.toLowerCase() === name);
+    const v = hit ? bag[hit] : undefined;
+    return Array.isArray(v) ? v[0] : v;
+}
+const OPS = Object.keys(exports.REFERRAL_OP_ENDPOINTS);
+/** The operation of a path's last segment, or null when it is not a protocol endpoint. */
+function referralOpForPath(path) {
+    let pathname = path;
+    try {
+        pathname = new URL(path, 'http://referrals.invalid').pathname;
+    }
+    catch {
+        /* use it as given */
+    }
+    const segments = pathname.split('/').filter(Boolean);
+    const last = segments[segments.length - 1] ?? '';
+    return OPS.find((op) => exports.REFERRAL_OP_ENDPOINTS[op] === last) ?? null;
+}
+/**
+ * Verify a call from Atlas to your referral platform and tell which operation
+ * it is. Never throws: check `verified`. Verify over the RAW body, before any
+ * JSON parse, and pass the path it arrived on (or `expectedOp`) so a signed
+ * body cannot be replayed against another endpoint.
+ *
+ * ```ts
+ * app.post('/atlas/:endpoint', express.raw({ type: '*\/*' }), async (req, res) => {
+ *   const { verified, call } = verifyReferralRequest({
+ *     body: req.body, headers: req.headers, secret, path: req.path,
+ *   });
+ *   if (!verified || !call) return res.sendStatus(401);
+ *   if (call.op === 'export' && call.test) return res.sendStatus(404);
+ *   if (call.op === 'signup') return res.json(await attribute(call.payload)); // ReferralSignupResponse
+ *   // erase, export, partner, signal ...
+ * });
+ * ```
+ */
+function verifyReferralRequest(input) {
+    const result = (0, webhooks_1.verifyWebhook)({
+        body: input.body,
+        headers: input.headers,
+        secret: input.secret,
+        now: input.now,
+        toleranceMs: input.toleranceMs,
+    });
+    if (!result.verified)
+        return { verified: false, reason: result.reason };
+    const body = result.event;
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return { verified: false, reason: 'malformed_body' };
+    const op = body.op;
+    if (op === undefined || op === null || op === '')
+        return { verified: false, reason: 'missing_op' };
+    if (typeof op !== 'string' || !OPS.includes(op))
+        return { verified: false, reason: 'unknown_op' };
+    if (input.path !== undefined) {
+        const endpointOp = referralOpForPath(input.path);
+        if (!endpointOp)
+            return { verified: false, reason: 'unknown_endpoint' };
+        if (endpointOp !== op)
+            return { verified: false, reason: 'op_mismatch' };
+    }
+    if (input.expectedOp !== undefined && input.expectedOp !== op)
+        return { verified: false, reason: 'op_mismatch' };
+    const call = op === 'export'
+        ? { op, payload: body, test: body.test === true }
+        : { op, payload: body };
+    return {
+        verified: true,
+        deliveryId: result.deliveryId,
+        timestamp: result.timestamp,
+        idempotencyKey: header(input.headers, 'idempotency-key'),
+        call,
+    };
+}
+//# sourceMappingURL=referrals.js.map

package/dist/referrals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"referrals.js","sourceRoot":"","sources":["../src/referrals.ts"],"names":[],"mappings":";;;AAqNA,8CAUC;AAoBD,sDA+BC;AAlRD,yCAAsE;AAGtE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,qFAAqF;AACxE,QAAA,4BAA4B,GAAG,uBAAuB,CAAC;AAEpE,2DAA2D;AAC9C,QAAA,4BAA4B,GAAG,mBAAmB,CAAC;AAmGhE,kEAAkE;AACrD,QAAA,qBAAqB,GAA+B;IAC/D,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,SAAS;CAClB,CAAC;AAgEF,SAAS,MAAM,CAAC,OAAoB,EAAE,IAAY;IAChD,IAAI,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU;QAAE,OAAQ,OAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACvG,MAAM,GAAG,GAAG,OAAwD,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,6BAAqB,CAAiB,CAAC;AAE/D,0FAA0F;AAC1F,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,6BAAqB,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,qBAAqB,CAAC,KAAiC;IACrE,MAAM,MAAM,GAAG,IAAA,wBAAa,EAAU;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACnH,MAAM,EAAE,GAAI,IAAyB,CAAC,EAAE,CAAC;IACzC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACnG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAE,GAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAChH,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACxE,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACjH,MAAM,IAAI,GACR,EAAE,KAAK,QAAQ;QACb,CAAC,CAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAA6B,EAAE,IAAI,EAAG,IAA8B,CAAC,IAAI,KAAK,IAAI,EAAY;QAChH,CAAC,CAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAA2B,CAAC;IACtD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC;QACxD,IAAI;KACL,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/backend",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "dependencies": {