@atlasauth/backend 0.14.0 → 0.15.0

package/dist/client/instance-security.js

@@ -4,6 +4,14 @@ exports.instanceSecurityResource = instanceSecurityResource;
 const request_1 = require("./request");
 function instanceSecurityResource(request) {
     return {
+        /** The published token-signing keys, newest first. */
+        listSigningKeys() {
+            return request({ method: 'GET', path: '/v1/instance/signing_keys' });
+        },
+        /** Rotate the signing key (optionally switching between RS256 and ES256). */
+        rotateSigningKey(body = {}) {
+            return request({ method: 'POST', path: '/v1/instance/signing_keys/rotate', body });
+        },
         get() {
             return request({ method: 'GET', path: '/v1/instance/security' });
         },

package/dist/client/instance-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;AA0EA,4DA6DC;AAvID,uCAAgD;AA0EhD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,+EAA+E;QAC/E,gBAAgB,CACd,IAAwB;YAExB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,sFAAsF;QACtF,iBAAiB,CAAC,IAAwB;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,oBAAoB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,wEAAwE;QACxE,cAAc;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,iHAAiH;QACjH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,qEAAqE;QACrE,iBAAiB;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED;oEAC4D;QAC5D,mBAAmB,CACjB,YAAoB,EACpB,IAA+B;YAE/B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;gBACxE,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,sBAAsB,CACpB,YAAoB;YAEpB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;AAwGA,4DAqEC;AA7KD,uCAAgD;AAwGhD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,sDAAsD;QACtD,eAAe;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,6EAA6E;QAC7E,gBAAgB,CAAC,OAA6B,EAAE;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,+EAA+E;QAC/E,gBAAgB,CACd,IAAwB;YAExB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,sFAAsF;QACtF,iBAAiB,CAAC,IAAwB;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,oBAAoB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,wEAAwE;QACxE,cAAc;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,iHAAiH;QACjH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,qEAAqE;QACrE,iBAAiB;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED;oEAC4D;QAC5D,mBAAmB,CACjB,YAAoB,EACpB,IAA+B;YAE/B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;gBACxE,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,sBAAsB,CACpB,YAAoB;YAEpB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/notifications.d.ts

@@ -1,6 +1,6 @@
 import { type RequestFn } from './request';
 /** Built-in notification templates `send` falls back to when no tenant template has the name. */
-export type BuiltInNotificationTemplate = 'new_device' | 'unattended_access' | 'password_changed' | 'mfa_changed';
+export type BuiltInNotificationTemplate = 'new_device' | 'unattended_access' | 'password_changed' | 'mfa_changed' | 'email_changed';
 export interface SendNotificationBody {
     /** The end-user to notify. */
     user_id: string;

package/dist/client/notifications.js.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/client/notifications.ts"],"names":[],"mappings":";;AAiEA,sDAqDC;AAtHD,uCAAgD;AAiEhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,2FAA2F;QAC3F,IAAI,CAAC,IAA0B,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAuB;gBACzC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,MAAM,CACJ,GAAW;gBAEX,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,iCAAiC;YACjC,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAAY;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,IAAY,EAAE,IAAoC;gBACvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAAY;gBAEZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/client/notifications.ts"],"names":[],"mappings":";;AAkEA,sDAqDC;AAvHD,uCAAgD;AAkEhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,2FAA2F;QAC3F,IAAI,CAAC,IAA0B,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAuB;gBACzC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,MAAM,CACJ,GAAW;gBAEX,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,iCAAiC;YACjC,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAAY;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,IAAY,EAAE,IAAoC;gBACvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAAY;gBAEZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/oauth-clients.d.ts

@@ -34,9 +34,46 @@ export interface OAuthClient {
      * with no "Sign out?" page. First-party clients only.
      */
     skip_logout_confirmation?: boolean;
+    /** Refused at every OAuth endpoint while true (kept, not deleted). */
+    disabled?: boolean;
+    /** PKCE required even though the client is confidential. */
+    require_pkce?: boolean;
+    /** OIDC Core §8: `pairwise` clients see a per-sector `sub` instead of the user id. */
+    subject_type?: 'public' | 'pairwise';
+    sector_identifier_uri?: string | null;
+    /** When the current secret stops authenticating (epoch ms); null = never. */
+    client_secret_expires_at?: number | null;
     created_at: number;
     updated_at: number;
 }
+/** OIDC Core §8 subject settings, accepted on create and update. */
+export interface OAuthClientSubjectFields {
+    /** `public` (default): the user id. `pairwise`: a per-sector identifier. */
+    subject_type?: 'public' | 'pairwise';
+    /** https URL serving a JSON array of every redirect URI; its host is the sector. `null` clears it. */
+    sector_identifier_uri?: string | null;
+}
+/** An RFC 7591 §3 initial access token for dynamic client registration. */
+export interface OAuthInitialAccessToken {
+    object: 'oauth_initial_access_token';
+    id: string;
+    token_prefix: string;
+    description: string | null;
+    status: 'active' | 'expired' | 'used_up' | 'revoked';
+    max_uses: number | null;
+    use_count: number;
+    expires_at: number | null;
+    revoked_at: number | null;
+    last_used_at: number | null;
+    created_at: number;
+}
+export interface CreateInitialAccessTokenBody {
+    description?: string;
+    /** Lifetime in seconds (60 – 31536000); omit for no expiry. */
+    expires_in_seconds?: number;
+    /** Registrations allowed (1 – 1000000); omit for unlimited. */
+    max_uses?: number;
+}
 /**
  * OIDC logout registration (RP-Initiated, Back-Channel and Front-Channel
  * Logout), accepted on create and update. On update, `null` clears a URI and
@@ -62,6 +99,8 @@ export interface RotateOAuthClientSecretBody {
      * hours); 0 revokes it now (after a leak); at most 604800 (7 days).
      */
     overlap_seconds?: number;
+    /** How long the NEW secret authenticates, in seconds; omit for no expiry. */
+    secret_expires_in_seconds?: number;
 }
 /** The rotate response: the new secret (shown once) and when the old one stops working. */
 export interface OAuthClientSecretRotation extends OAuthClientWithSecret {
@@ -81,7 +120,7 @@ export interface ClientGrant {
     created_at: number;
     updated_at: number;
 }
-export interface CreateOAuthClientBody extends OAuthClientLogoutFields {
+export interface CreateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields {
     name: string;
     redirect_uris: string[];
     allowed_scopes?: string[];
@@ -89,14 +128,20 @@ export interface CreateOAuthClientBody extends OAuthClientLogoutFields {
     token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
     logo_url?: string;
     first_party?: boolean;
+    /** How long the issued secret authenticates, in seconds; omit for no expiry. */
+    secret_expires_in_seconds?: number;
 }
-export interface UpdateOAuthClientBody extends OAuthClientLogoutFields {
+export interface UpdateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields {
     name?: string;
     redirect_uris?: string[];
     allowed_scopes?: string[];
     token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
     logo_url?: string | null;
     first_party?: boolean;
+    /** Refuse every OAuth flow for this client without deleting it. */
+    disabled?: boolean;
+    /** Require PKCE for this confidential client too. */
+    require_pkce?: boolean;
 }
 /** One client in a migration import. Idempotent per `client_id`. */
 export interface ImportOAuthClientEntry {
@@ -197,6 +242,16 @@ export declare function oauthClientsResource(request: RequestFn): {
     listBackchannelDeliveries(id: string, query?: BackchannelDeliveriesQuery): Promise<BackchannelLogoutDeliveryPage>;
     /** Send a test back-channel logout now and return what the receiver answered. */
     testBackchannelLogout(id: string): Promise<BackchannelLogoutTest>;
+    /** RFC 7591 §3 initial access tokens for dynamic client registration. */
+    initialAccessTokens: {
+        list(): Promise<ListPage<OAuthInitialAccessToken>>;
+        /** The `token` is in this response only. */
+        create(body?: CreateInitialAccessTokenBody): Promise<OAuthInitialAccessToken & {
+            token: string;
+            note: string;
+        }>;
+        revoke(id: string): Promise<OAuthInitialAccessToken>;
+    };
     grants: {
         list(clientId: string): Promise<ListPage<ClientGrant>>;
         create(clientId: string, body: {

package/dist/client/oauth-clients.js

@@ -47,6 +47,19 @@ function oauthClientsResource(request) {
         testBackchannelLogout(id) {
             return request({ method: 'POST', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/backchannel_logout/test` });
         },
+        /** RFC 7591 §3 initial access tokens for dynamic client registration. */
+        initialAccessTokens: {
+            list() {
+                return request({ method: 'GET', path: '/v1/oauth_initial_access_tokens' });
+            },
+            /** The `token` is in this response only. */
+            create(body = {}) {
+                return request({ method: 'POST', path: '/v1/oauth_initial_access_tokens', body });
+            },
+            revoke(id) {
+                return request({ method: 'DELETE', path: `/v1/oauth_initial_access_tokens/${(0, request_1.enc)(id)}` });
+            },
+        },
         grants: {
             list(clientId) {
                 return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/grants` });

package/dist/client/oauth-clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA8LA,oDAiFC;AA/QD,uCAAgD;AA8LhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA8OA,oDA+FC;AA7UD,uCAAgD;AA8OhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/referrals.d.ts

@@ -12,7 +12,7 @@ import type { UserReferralResult } from './users';
  *
  * `provider` is `webhook` (the Atlas referral protocol, which any platform can
  * implement; see {@link verifyReferralRequest}), `referally` (the built-in
- * Referally adapter: `endpoint_url` is your Referally base URL, plus
+ * Referalli adapter: `endpoint_url` is your Referalli base URL, plus
  * `connection_id`, `signing_secret` and optionally `tracking_token`) or
  * another built-in vendor adapter.
  * `signing_secret`, `api_key` and `inbound_secret` are write-only: reads
@@ -379,6 +379,12 @@ export interface ReferralCall {
      * `rate_limited`, `timeout`, `network_error`.
      */
     error_code?: string | null;
+    /** The last attempt's request as the platform received it (method, URL, body; personal data removed). Null until sent. */
+    request?: {
+        method: string;
+        url: string;
+        body: unknown;
+    } | null;
     /** The platform's last answer, with personal data removed. */
     response?: unknown;
     /** Sign-up calls: how the platform matched, the referrer and its notes. */

package/dist/client/referrals.js.map

@@ -1 +1 @@
-{"version":3,"file":"referrals.js","sourceRoot":"","sources":["../../src/client/referrals.ts"],"names":[],"mappings":";;AAkaA,8CAmEC;AAreD,uCAAgD;AAkahD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,8FAA8F;QAC9F,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,+EAA+E;QAC/E,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD;;;WAGG;QACH,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,uEAAuE;QACvE,SAAS,CAAC,SAAkC,EAAE;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,EAAU,EAAE,cAAuB;YAC3C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;gBACrD,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,6GAA6G;QAC7G,WAAW,CACT,SAA2D,EAAE,EAC7D,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACtH,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,OAA0B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,IAA0B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,iDAAiD;QACjD,WAAW,CAAC,EAAU;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD;;;WAGG;QACH,UAAU,CAAC,MAAc;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"referrals.js","sourceRoot":"","sources":["../../src/client/referrals.ts"],"names":[],"mappings":";;AAoaA,8CAmEC;AAveD,uCAAgD;AAoahD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,8FAA8F;QAC9F,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,+EAA+E;QAC/E,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD;;;WAGG;QACH,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,uEAAuE;QACvE,SAAS,CAAC,SAAkC,EAAE;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,EAAU,EAAE,cAAuB;YAC3C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;gBACrD,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,6GAA6G;QAC7G,WAAW,CACT,SAA2D,EAAE,EAC7D,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACtH,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,OAA0B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,IAA0B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,iDAAiD;QACjD,WAAW,CAAC,EAAU;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD;;;WAGG;QACH,UAAU,CAAC,MAAc;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/resource-servers.d.ts

@@ -11,7 +11,10 @@ export interface ResourceServer {
     name: string;
     scopes: ResourceServerScope[];
     token_ttl_seconds: number;
-    signing_alg: string;
+    /** RS256 (default) or ES256: the algorithm of this API's access tokens. */
+    signing_alg: 'RS256' | 'ES256' | string;
+    /** RFC 9728: Atlas serves protected-resource metadata for this API. */
+    publish_resource_metadata?: boolean;
     created_at: number;
     updated_at: number;
 }
@@ -21,13 +24,19 @@ export interface CreateResourceServerBody {
     /** Each scope is a bare string or `{ value, description? }`. */
     scopes?: Array<string | ResourceServerScope>;
     token_ttl_seconds?: number;
-    signing_alg?: string;
+    /** RS256 (default) or ES256. */
+    signing_alg?: 'RS256' | 'ES256';
+    /** RFC 9728: serve protected-resource metadata for this API. */
+    publish_resource_metadata?: boolean;
 }
 export interface UpdateResourceServerBody {
     name?: string;
     scopes?: Array<string | ResourceServerScope>;
     token_ttl_seconds?: number;
-    signing_alg?: string;
+    /** RS256 (default) or ES256. */
+    signing_alg?: 'RS256' | 'ES256';
+    /** RFC 9728: serve protected-resource metadata for this API. */
+    publish_resource_metadata?: boolean;
     /** Immutable — supplying a different value is rejected. */
     identifier?: string;
 }

package/dist/client/resource-servers.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-servers.js","sourceRoot":"","sources":["../../src/client/resource-servers.ts"],"names":[],"mappings":";;AAsCA,0DAkBC;AAxDD,uCAAgD;AAsChD,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAA8B;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA8B;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resource-servers.js","sourceRoot":"","sources":["../../src/client/resource-servers.ts"],"names":[],"mappings":";;AA+CA,0DAkBC;AAjED,uCAAgD;AA+ChD,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAA8B;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA8B;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/scim-tokens.d.ts

@@ -7,6 +7,10 @@ export interface ScimToken {
     organization_id: string;
     connection_id: string | null;
     prefix: string;
+    /** null = read and write; ['read'] = read-only. */
+    scopes?: Array<'read' | 'write'> | null;
+    /** SCIM user roles[].value → organization role key. */
+    role_mappings?: ScimRoleMapping[];
     last_used_at: number | null;
     expires_at: number | null;
     revoked_at: number | null;
@@ -17,14 +21,28 @@ export interface ScimTokenWithSecret extends ScimToken {
     secret: string;
     note: string;
 }
+export interface ScimRoleMapping {
+    value: string;
+    role: string;
+}
 export interface CreateScimTokenBody {
     organization_id: string;
     name?: string;
     connection_id?: string;
+    /** ['read'] mints a read-only token. */
+    scopes?: Array<'read' | 'write'>;
+    role_mappings?: ScimRoleMapping[];
+}
+export interface UpdateScimTokenBody {
+    name?: string | null;
+    scopes?: Array<'read' | 'write'> | null;
+    role_mappings?: ScimRoleMapping[] | null;
 }
 export declare function scimTokensResource(request: RequestFn): {
     list(): Promise<ListPage<ScimToken>>;
     create(body: CreateScimTokenBody, idempotencyKey?: string): Promise<ScimTokenWithSecret>;
+    /** Change a token's name, scopes or role mappings. */
+    update(id: string, body: UpdateScimTokenBody): Promise<ScimToken>;
     revoke(id: string): Promise<{
         object: "scim_token";
         id: string;

package/dist/client/scim-tokens.js

@@ -10,6 +10,10 @@ function scimTokensResource(request) {
         create(body, idempotencyKey) {
             return request({ method: 'POST', path: '/v1/scim_tokens', body, idempotencyKey });
         },
+        /** Change a token's name, scopes or role mappings. */
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/scim_tokens/${(0, request_1.enc)(id)}`, body });
+        },
         revoke(id) {
             return request({ method: 'POST', path: `/v1/scim_tokens/${(0, request_1.enc)(id)}/revoke` });
         },

package/dist/client/scim-tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.js","sourceRoot":"","sources":["../../src/client/scim-tokens.ts"],"names":[],"mappings":";;AA4BA,gDAcC;AA1CD,uCAAgD;AA4BhD,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAyB,EAAE,cAAuB;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CACJ,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scim-tokens.js","sourceRoot":"","sources":["../../src/client/scim-tokens.ts"],"names":[],"mappings":";;AA8CA,gDAkBC;AAhED,uCAAgD;AA8ChD,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAyB,EAAE,cAAuB;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,sDAAsD;QACtD,MAAM,CAAC,EAAU,EAAE,IAAyB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CACJ,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sso-connections.d.ts

@@ -27,6 +27,15 @@ export interface SsoConnection {
     allowed_domains: string[];
     claim_role_mappings: ClaimRoleMapping[];
     default_role_id: string | null;
+    /** Which IdP claim/attribute carries each profile field (only the set keys). */
+    attribute_mapping?: SsoAttributeMapping;
+    /** OIDC: extra scopes requested on top of openid email profile. */
+    oidc_scopes?: string[];
+    /** Routing domains of an org-owned connection that the org has not verified. */
+    domain_warnings?: Array<{
+        domain: string;
+        code: 'unverified_organization_domain';
+    }>;
     created_at: number;
     updated_at: number;
 }
@@ -58,6 +67,19 @@ export interface CreateSsoConnectionBody {
     allowed_domains?: string[];
     claim_role_mappings?: ClaimRoleMapping[];
     default_role_id?: string | null;
+    /** null clears it. */
+    attribute_mapping?: SsoAttributeMapping | null;
+    /** OIDC only; null clears them. */
+    oidc_scopes?: string[] | null;
+}
+/** Claim (OIDC) or attribute (SAML) names for each profile field. */
+export interface SsoAttributeMapping {
+    email?: string;
+    /** A remapped email is unverified unless this claim is mapped and true. */
+    email_verified?: string;
+    first_name?: string;
+    last_name?: string;
+    username?: string;
 }
 /** PATCH accepts everything create does except `type`, which is immutable. */
 export type UpdateSsoConnectionBody = Omit<CreateSsoConnectionBody, 'type'>;

package/dist/client/sso-connections.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connections.js","sourceRoot":"","sources":["../../src/client/sso-connections.ts"],"names":[],"mappings":";;AAqEA,wDAsBC;AA3FD,uCAAgD;AAqEhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA6B,EAAE,cAAuB;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA6B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,0EAA0E;QAC1E,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sso-connections.js","sourceRoot":"","sources":["../../src/client/sso-connections.ts"],"names":[],"mappings":";;AAyFA,wDAsBC;AA/GD,uCAAgD;AAyFhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA6B,EAAE,cAAuB;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA6B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,0EAA0E;QAC1E,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/users.d.ts

@@ -11,6 +11,8 @@ export interface User {
     public_metadata: Metadata;
     mfa_enabled: boolean;
     banned: boolean;
+    /** A timed ban's expiry (epoch ms); null for a permanent ban or none. */
+    ban_expires_at?: number | null;
     locked: boolean;
     /** Epoch milliseconds, or null if never signed in. */
     last_sign_in_at: number | null;
@@ -175,7 +177,29 @@ export interface UserSession {
     impersonated_by?: string | null;
     created_at: number;
 }
-export type ListUsersParams = CursorParams;
+/** `GET /v1/users` search, filters and sort. Every filter is optional and they AND together. */
+export interface ListUsersParams extends CursorParams {
+    /** Substring match over id, names, username, emails, phone numbers and external_id. */
+    query?: string;
+    /** Exact (case-insensitive) match on any of the user's email addresses. */
+    email_address?: string;
+    username?: string;
+    phone_number?: string;
+    external_id?: string;
+    banned?: boolean;
+    /** true = has at least one verified email; false = has none. */
+    email_verified?: boolean;
+    /** Only members of this organization. */
+    organization_id?: string;
+    /** Unix ms bounds on `created_at` (inclusive). */
+    created_after?: number;
+    created_before?: number;
+    /** Default `-created_at`. `last_sign_in_at` orders page with `offset`, not `starting_after`. */
+    order_by?: 'created_at' | '-created_at' | 'last_sign_in_at' | '-last_sign_in_at';
+    offset?: number;
+    /** Adds `total_count` (a COUNT over the filters) to the page. */
+    include_total_count?: boolean;
+}
 export interface CreateUserBody {
     email_address: string;
     password?: string;
@@ -218,8 +242,10 @@ export interface ReplaceUserMetadataBody {
     unsafe_metadata?: Metadata;
 }
 export declare function usersResource(request: RequestFn): {
-    /** `GET /v1/users` — cursor-paginated. */
-    list(params?: ListUsersParams): Promise<CursorPage<User>>;
+    /** `GET /v1/users` — search, filter and sort; cursor- (or offset-) paginated. */
+    list(params?: ListUsersParams): Promise<CursorPage<User> & {
+        total_count?: number;
+    }>;
     get(id: string): Promise<User>;
     create(body: CreateUserBody, idempotencyKey?: string): Promise<User>;
     update(id: string, body: UpdateUserBody): Promise<User>;
@@ -232,7 +258,17 @@ export declare function usersResource(request: RequestFn): {
     setExternalId(id: string, externalId: string | null): Promise<User>;
     /** `PUT /v1/users/:id/metadata` — replaces the named bags wholesale. */
     replaceMetadata(id: string, body: ReplaceUserMetadataBody): Promise<User>;
-    ban(id: string): Promise<User>;
+    /**
+     * `POST /v1/users/:id/ban` — ban and revoke every session. Permanent unless
+     * `expires_in_seconds` or `expires_at` (Unix ms) is sent: a timed ban lifts
+     * itself (`user.unbanned` is sent when it does).
+     */
+    ban(id: string, body?: {
+        reason?: string;
+        note?: string;
+        expires_in_seconds?: number;
+        expires_at?: number;
+    }): Promise<User>;
     unban(id: string): Promise<User>;
     lock(id: string, body?: {
         duration_in_seconds?: number;

package/dist/client/users.js

@@ -4,7 +4,7 @@ exports.usersResource = usersResource;
 const request_1 = require("./request");
 function usersResource(request) {
     return {
-        /** `GET /v1/users` — cursor-paginated. */
+        /** `GET /v1/users` — search, filter and sort; cursor- (or offset-) paginated. */
         list(params = {}) {
             return request({ method: 'GET', path: '/v1/users', query: { ...params } });
         },
@@ -30,8 +30,13 @@ function usersResource(request) {
         replaceMetadata(id, body) {
             return request({ method: 'PUT', path: `/v1/users/${(0, request_1.enc)(id)}/metadata`, body });
         },
-        ban(id) {
-            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/ban` });
+        /**
+         * `POST /v1/users/:id/ban` — ban and revoke every session. Permanent unless
+         * `expires_in_seconds` or `expires_at` (Unix ms) is sent: a timed ban lifts
+         * itself (`user.unbanned` is sent when it does).
+         */
+        ban(id, body = {}) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/ban`, body });
         },
         unban(id) {
             return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/unban` });

package/dist/client/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/client/users.ts"],"names":[],"mappings":";;AAsOA,sCAucC;AA7qBD,uCAAgD;AAsOhD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,SAA0B,EAAE;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD;;;;;WAKG;QACH,aAAa,CAAC,EAAU,EAAE,UAAyB;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,wEAAwE;QACxE,eAAe,CAAC,EAAU,EAAE,IAA6B;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,EAAU,EAAE,OAAyC,EAAE;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD;;;;;;WAMG;QACH,YAAY,CACV,EAAU,EACV,OAA4B,EAAE,EAC9B,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAC1C,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,eAAe,CACb,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;WAGG;QACH,cAAc,CACZ,EAAU,EACV,UAAuC,EAAE;YAEzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;gBAC5C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,EAAU,EAAE,IAA+B;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,WAAW,CAAC,EAAU,EAAE,OAAe;YACrC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;aACpE,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,EAAU,EAAE,OAAe;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU;aACrE,CAAC,CAAC;QACL,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,EAAU,EAAE,QAAgB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,cAAc,CAAC,EAAU;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,YAAY,CACV,EAAU,EACV,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD;;;;;;;;WAQG;QACH,sBAAsB,CACpB,EAAU,EACV,IAA8E,EAC9E,cAAuB;YASvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,4BAA4B;gBACtD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CACZ,EAAU,EACV,UAAkB;YAElB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,+EAA+E;QAC/E,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QACD;;;;WAIG;QACH,eAAe,CACb,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,WAAW,CACT,OAAe;YAEf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,IAAuB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,6GAA6G;QAC7G,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;;WAIG;QACH,aAAa,CAAC,EAAU,EAAE,SAAuB,EAAE;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;gBAC5C,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,2BAA2B,CACzB,EAAU,EACV,SAAuB,EAAE;YAEzB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;gBACrD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,WAAW,CAAC,EAAU,EAAE,IAAyB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,sEAAsE;QACtE,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,sFAAsF;QACtF,aAAa,CACX,EAAU,EACV,SAAiB;YAEjB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CAAC,EAAU,EAAE,IAAwB;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD;;;;WAIG;QACH,wBAAwB,CACtB,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,kBAAkB,CAChB,EAAU,EACV,IAAwB,EACxB,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe;gBACzC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,aAAa,CAAC,EAAU;YACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,sGAAsG;QACtG,QAAQ,EAAE;YACR,wGAAwG;YACxG,QAAQ,CACN,EAAU,EACV,OAAmC,EAAE,EACrC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,uFAAuF;YACvF,MAAM,CAAC,EAAU,EAAE,cAAuB;gBACxC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;oBAC5C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,qGAAqG;YACrG,QAAQ,CACN,EAAU,EACV,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB;oBAC9C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,uEAAuE;QACvE,UAAU,EAAE;YACV,gFAAgF;YAChF,MAAM,CACJ,EAAU,EACV,IAA6B,EAC7B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;oBACvC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,qEAAqE;YACrE,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;YAChF,CAAC;SACF;QACD,yEAAyE;QACzE,QAAQ,EAAE;YACR,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,wHAAwH;YACxH,MAAM,CACJ,EAAU,EACV,IAA2B,EAC3B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,sFAAsF;QACtF,gBAAgB,EAAE;YAChB;;;;eAIG;YACH,MAAM,CAAC,EAAU,EAAE,IAAmC;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,2EAA2E;YAC3E,GAAG,CAAC,EAAU,EAAE,UAAkB;gBAChC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;QACD,yDAAyD;QACzD,uBAAuB,EAAE;YACvB,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;iBACtD,CAAC,CAAC;YACL,CAAC;YACD,iGAAiG;YACjG,MAAM,CACJ,EAAU,EACV,IAA2C;gBAE3C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;oBACrD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;SACF;QACD,wEAAwE;QACxE,YAAY,EAAE;YACZ,yBAAyB;YACzB,GAAG,CAAC,EAAU,EAAE,IAA8B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CAAC,EAAU,EAAE,OAAe;gBAChC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;iBAClE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,EAAU,EACV,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;SACF;QACD,8BAA8B;QAC9B,WAAW,EAAE;YACX;;;eAGG;YACH,QAAQ,CAAC,EAAU,EAAE,IAA8B;gBACjD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,qBAAqB;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/client/users.ts"],"names":[],"mappings":";;AA8PA,sCA+cC;AA7sBD,uCAAgD;AA8PhD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,iFAAiF;QACjF,IAAI,CAAC,SAA0B,EAAE;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD;;;;;WAKG;QACH,aAAa,CAAC,EAAU,EAAE,UAAyB;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,wEAAwE;QACxE,eAAe,CAAC,EAAU,EAAE,IAA6B;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD;;;;WAIG;QACH,GAAG,CACD,EAAU,EACV,OAA6F,EAAE;YAE/F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,EAAU,EAAE,OAAyC,EAAE;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD;;;;;;WAMG;QACH,YAAY,CACV,EAAU,EACV,OAA4B,EAAE,EAC9B,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAC1C,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,eAAe,CACb,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;WAGG;QACH,cAAc,CACZ,EAAU,EACV,UAAuC,EAAE;YAEzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;gBAC5C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,EAAU,EAAE,IAA+B;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,WAAW,CAAC,EAAU,EAAE,OAAe;YACrC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;aACpE,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,EAAU,EAAE,OAAe;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU;aACrE,CAAC,CAAC;QACL,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,EAAU,EAAE,QAAgB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,cAAc,CAAC,EAAU;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,YAAY,CACV,EAAU,EACV,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD;;;;;;;;WAQG;QACH,sBAAsB,CACpB,EAAU,EACV,IAA8E,EAC9E,cAAuB;YASvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,4BAA4B;gBACtD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CACZ,EAAU,EACV,UAAkB;YAElB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,+EAA+E;QAC/E,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QACD;;;;WAIG;QACH,eAAe,CACb,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,WAAW,CACT,OAAe;YAEf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,IAAuB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,6GAA6G;QAC7G,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;;WAIG;QACH,aAAa,CAAC,EAAU,EAAE,SAAuB,EAAE;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;gBAC5C,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,2BAA2B,CACzB,EAAU,EACV,SAAuB,EAAE;YAEzB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;gBACrD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,WAAW,CAAC,EAAU,EAAE,IAAyB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,sEAAsE;QACtE,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,sFAAsF;QACtF,aAAa,CACX,EAAU,EACV,SAAiB;YAEjB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CAAC,EAAU,EAAE,IAAwB;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD;;;;WAIG;QACH,wBAAwB,CACtB,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,kBAAkB,CAChB,EAAU,EACV,IAAwB,EACxB,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe;gBACzC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,aAAa,CAAC,EAAU;YACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,sGAAsG;QACtG,QAAQ,EAAE;YACR,wGAAwG;YACxG,QAAQ,CACN,EAAU,EACV,OAAmC,EAAE,EACrC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,uFAAuF;YACvF,MAAM,CAAC,EAAU,EAAE,cAAuB;gBACxC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB;oBAC5C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,qGAAqG;YACrG,QAAQ,CACN,EAAU,EACV,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB;oBAC9C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,uEAAuE;QACvE,UAAU,EAAE;YACV,gFAAgF;YAChF,MAAM,CACJ,EAAU,EACV,IAA6B,EAC7B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;oBACvC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,qEAAqE;YACrE,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;YAChF,CAAC;SACF;QACD,yEAAyE;QACzE,QAAQ,EAAE;YACR,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,wHAAwH;YACxH,MAAM,CACJ,EAAU,EACV,IAA2B,EAC3B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,sFAAsF;QACtF,gBAAgB,EAAE;YAChB;;;;eAIG;YACH,MAAM,CAAC,EAAU,EAAE,IAAmC;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,2EAA2E;YAC3E,GAAG,CAAC,EAAU,EAAE,UAAkB;gBAChC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;QACD,yDAAyD;QACzD,uBAAuB,EAAE;YACvB,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;iBACtD,CAAC,CAAC;YACL,CAAC;YACD,iGAAiG;YACjG,MAAM,CACJ,EAAU,EACV,IAA2C;gBAE3C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B;oBACrD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;SACF;QACD,wEAAwE;QACxE,YAAY,EAAE;YACZ,yBAAyB;YACzB,GAAG,CAAC,EAAU,EAAE,IAA8B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CAAC,EAAU,EAAE,OAAe;gBAChC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;iBAClE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,EAAU,EACV,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;SACF;QACD,8BAA8B;QAC9B,WAAW,EAAE;YACX;;;eAGG;YACH,QAAQ,CAAC,EAAU,EAAE,IAA8B;gBACjD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,qBAAqB;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export * from './jwks-cache';
 export { DiscoveryError, JwksDiscovery, discoveryUrlFor, instanceIdFromPublishableKey } from './discovery';
 export * from './verify';
+export * from './access-control';
 export * from './handshake';
 export { BACKCHANNEL_LOGOUT_EVENT, LOGOUT_TOKEN_CLOCK_SKEW_SECONDS, LOGOUT_TOKEN_MAX_AGE_SECONDS, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
 export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions, } from './logout-token';
@@ -19,3 +20,5 @@ export { verifyPCActn } from './pca/verify';
 export type { PcaVerdict, PcaContext, VerifyPCActnOptions } from './pca/verify';
 export { requirePCA, defaultExtract, memoryPcaStore } from './pca/require-pca';
 export type { RequirePcaOptions, PcaGuardResult, PcaRequestLike, PcaStateStore } from './pca/require-pca';
+export { ACCESS_TOKEN_CLOCK_SKEW_SECONDS, DPOP_PROOF_MAX_AGE_SECONDS, buildWwwAuthenticate, createAccessTokenVerifier, memoryDpopReplayStore, protectedResourceMetadata, protectedResourceMetadataPath, verifyAccessToken, } from './oauth-resource';
+export type { AccessTokenClaims, AccessTokenErrorCode, AccessTokenResult, AccessTokenVerifierOptions, DpopReplayStore, ResourceRequestLike, } from './oauth-resource';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
+exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
 // §7.3 token verification — the original surface, unchanged.
 __exportStar(require("./jwks-cache"), exports);
 // OIDC discovery of the JWKS URL when only `issuer` is configured.
@@ -24,6 +24,7 @@ Object.defineProperty(exports, "JwksDiscovery", { enumerable: true, get: functio
 Object.defineProperty(exports, "discoveryUrlFor", { enumerable: true, get: function () { return discovery_1.discoveryUrlFor; } });
 Object.defineProperty(exports, "instanceIdFromPublishableKey", { enumerable: true, get: function () { return discovery_1.instanceIdFromPublishableKey; } });
 __exportStar(require("./verify"), exports);
+__exportStar(require("./access-control"), exports);
 __exportStar(require("./handshake"), exports);
 // OIDC Back-Channel Logout: verify the logout_token Atlas POSTs to your app.
 var logout_token_1 = require("./logout-token");
@@ -75,4 +76,15 @@ var require_pca_1 = require("./pca/require-pca");
 Object.defineProperty(exports, "requirePCA", { enumerable: true, get: function () { return require_pca_1.requirePCA; } });
 Object.defineProperty(exports, "defaultExtract", { enumerable: true, get: function () { return require_pca_1.defaultExtract; } });
 Object.defineProperty(exports, "memoryPcaStore", { enumerable: true, get: function () { return require_pca_1.memoryPcaStore; } });
+// Protecting your own API / MCP server with Atlas-issued OAuth access tokens:
+// local verification (aud, scopes, DPoP) + RFC 6750/9728 challenges + metadata.
+var oauth_resource_1 = require("./oauth-resource");
+Object.defineProperty(exports, "ACCESS_TOKEN_CLOCK_SKEW_SECONDS", { enumerable: true, get: function () { return oauth_resource_1.ACCESS_TOKEN_CLOCK_SKEW_SECONDS; } });
+Object.defineProperty(exports, "DPOP_PROOF_MAX_AGE_SECONDS", { enumerable: true, get: function () { return oauth_resource_1.DPOP_PROOF_MAX_AGE_SECONDS; } });
+Object.defineProperty(exports, "buildWwwAuthenticate", { enumerable: true, get: function () { return oauth_resource_1.buildWwwAuthenticate; } });
+Object.defineProperty(exports, "createAccessTokenVerifier", { enumerable: true, get: function () { return oauth_resource_1.createAccessTokenVerifier; } });
+Object.defineProperty(exports, "memoryDpopReplayStore", { enumerable: true, get: function () { return oauth_resource_1.memoryDpopReplayStore; } });
+Object.defineProperty(exports, "protectedResourceMetadata", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadata; } });
+Object.defineProperty(exports, "protectedResourceMetadataPath", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadataPath; } });
+Object.defineProperty(exports, "verifyAccessToken", { enumerable: true, get: function () { return oauth_resource_1.verifyAccessToken; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAS0B;AARxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}

package/dist/logout-token.d.ts

@@ -3,7 +3,7 @@ import { JwksCache, type Jwks } from './jwks-cache';
  * OpenID Connect Back-Channel Logout 1.0 — verifying the `logout_token` Atlas
  * POSTs to your `backchannel_logout_uri` when a user's session ends.
  *
- * The checks are those of §2.6 of the spec: RS256 signature from the issuer's
+ * The checks are those of §2.6 of the spec: RS256 or ES256 signature from the issuer's
  * JWKS, `iss`, `aud` containing your client id, `iat` present (and not in the
  * future), `exp` when present, a `jti`, the back-channel-logout event, a `sid`
  * and/or `sub`, NO `nonce`, and a `typ` of `logout+jwt` when the header has one.

package/dist/logout-token.js

@@ -7,11 +7,12 @@ exports.checkLogoutToken = checkLogoutToken;
 const jose_1 = require("jose");
 const jwks_cache_1 = require("./jwks-cache");
 const discovery_1 = require("./discovery");
+const algs_1 = require("./algs");
 /**
  * OpenID Connect Back-Channel Logout 1.0 — verifying the `logout_token` Atlas
  * POSTs to your `backchannel_logout_uri` when a user's session ends.
  *
- * The checks are those of §2.6 of the spec: RS256 signature from the issuer's
+ * The checks are those of §2.6 of the spec: RS256 or ES256 signature from the issuer's
  * JWKS, `iss`, `aud` containing your client id, `iat` present (and not in the
  * future), `exp` when present, a `jti`, the back-channel-logout event, a `sid`
  * and/or `sub`, NO `nonce`, and a `typ` of `logout+jwt` when the header has one.
@@ -122,7 +123,7 @@ async function checkLogoutToken(token, cache, options) {
     let payload;
     try {
         const verified = await (0, jose_1.jwtVerify)(token, (0, jose_1.createLocalJWKSet)(keys), {
-            algorithms: ['RS256'],
+            algorithms: algs_1.ATLAS_SIGNING_ALGS,
             issuer: options.issuer,
             audience,
             clockTolerance: exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS,