@atlasauth/backend 0.14.1 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @atlasauth/backend changelog
 
+## 0.15.0 — 2026-10-23
+
+### Added
+
+- `createAccessTokenVerifier` / `verifyAccessToken`: verify Atlas-issued OAuth access tokens in your own API or MCP server — signature against the instance JWKS, issuer, expiry, access-token type, audience (RFC 8707), required scopes (scope + permissions) and DPoP sender constraint (RFC 9449, with a replay store). Failures return the status and the RFC 6750 / RFC 9728 `WWW-Authenticate` challenge (`resource_metadata`, `insufficient_scope`).
+- `protectedResourceMetadata` / `protectedResourceMetadataPath`: build and locate your API's RFC 9728 protected-resource metadata document.
+- `buildWwwAuthenticate`, `memoryDpopReplayStore`.
+- `createTestIssuer({ alg: 'ES256' })`: an ES256 test key, like an instance switched to ES256.
+- Backend API client: `instanceSecurity.listSigningKeys()` / `rotateSigningKey({ alg, grace_period_seconds, emergency })`; `oauthClients.initialAccessTokens.list()` / `create()` / `revoke()` (RFC 7591 §3); OAuth client fields `subject_type`, `sector_identifier_uri`, `client_secret_expires_at`, `disabled`, `require_pkce` and `secret_expires_in_seconds` on create / rotate; resource server `publish_resource_metadata` and a typed `signing_alg`.
+- `users.list({ external_id })`: find a user by the id it had in the system it was migrated from.
+- User search: `users.list()` takes `query`, `email_address`, `username`, `phone_number`, `banned`, `email_verified`, `organization_id`, `created_after` / `created_before`, `order_by`, `offset` and `include_total_count` (the page then carries `total_count`).
+- Timed bans: `users.ban(id, { reason, note, expires_in_seconds, expires_at })`; `User.ban_expires_at`.
+- App roles (instance-wide, no active organization needed): `appRoles.list()` / `create()` / `get()` / `update()` / `delete()` / `listUsers()` / `getForUser()` / `setForUser()` / `removeFromUser()`; `SessionClaims.app_roles` / `app_permissions` with `hasAppRole()` / `hasAppPermission()`.
+- `createAccessControl(statements)`: typed resource/action statements for app roles — `permission()`, `permissions()`, `allPermissions()`, `role()` (a definition ready for `appRoles.create`), and `can()` / `canAny()` against session claims.
+- API key controls: create / update bodies take `enabled`, `rate_limit` (`ApiKeyRateLimit`), `remaining`, and create also `prefix` and `expires_in_seconds`; `apiKeys.verify(secret, { required_scopes })` and a coded refusal of a live key (`insufficient_scope`, `rate_limited`, `usage_exhausted`, with `missing_scopes`, `retry_after_ms`, `remaining`).
+- SCIM tokens: `scopes` and `role_mappings` on create, and `scimTokens.update()`.
+- SSO connections: `attribute_mapping` (`SsoAttributeMapping`) and `oidc_scopes`; `domain_warnings` on the connection.
+- Email template keys `email_changed`, `verification_link`, `password_reset_link`; notification `email_changed`.
+
+### Changed
+
+- Every verifier (`AtlasBackend.verify`, the OIDC relying-party helpers, `verifyLogoutToken`, `createAccessTokenVerifier`) accepts ES256 as well as RS256, since an Atlas instance — or a single API — can now sign with ES256. Verification stays pinned to those two algorithms; `none`, HMAC and anything else are refused.
+
 ## 0.14.1
 
 ### Added

package/dist/access-control.d.ts

@@ -0,0 +1,53 @@
+import type { SessionClaims } from './verify';
+/**
+ * Typed access-control definitions for app-level roles.
+ *
+ * Declare your resources and their actions once; the result gives you
+ * type-checked permission keys (`tickets:read`), role definitions you can send
+ * to `atlas.appRoles.create`, and checks against a verified session's
+ * `app_permissions` claim — so a typo in a permission is a compile error, not a
+ * silent deny.
+ *
+ * ```ts
+ * const ac = createAccessControl({
+ *   tickets: ['read', 'write', 'close'],
+ *   billing: ['read', 'refund'],
+ * } as const);
+ *
+ * const support = ac.role('support', 'Support agent', { tickets: ['read', 'write'] });
+ * await atlas.appRoles.create(support);            // { key, name, permissions: [...] }
+ *
+ * if (!ac.can(claims, { tickets: ['close'] })) return forbidden();
+ * ```
+ */
+export type AccessStatements = Readonly<Record<string, readonly string[]>>;
+/** Every `resource:action` key a statement set allows. */
+export type PermissionOf<S extends AccessStatements> = {
+    [R in keyof S & string]: `${R}:${S[R][number]}`;
+}[keyof S & string];
+/** A partial grant: some actions on some resources. */
+export type AccessGrant<S extends AccessStatements> = {
+    [R in keyof S]?: ReadonlyArray<S[R][number]>;
+};
+export interface AppRoleDefinition<S extends AccessStatements> {
+    key: string;
+    name: string;
+    description?: string;
+    permissions: Array<PermissionOf<S>>;
+}
+export interface AccessControl<S extends AccessStatements> {
+    readonly statements: S;
+    /** One typed permission key. */
+    permission<R extends keyof S & string>(resource: R, action: S[R][number]): PermissionOf<S>;
+    /** Flatten a grant into sorted permission keys. */
+    permissions(grant: AccessGrant<S>): Array<PermissionOf<S>>;
+    /** Every permission the statements define. */
+    allPermissions(): Array<PermissionOf<S>>;
+    /** An app role definition (the body `appRoles.create` takes). */
+    role(key: string, name: string, grant: AccessGrant<S>, description?: string): AppRoleDefinition<S>;
+    /** Whether the verified claims hold EVERY permission in the grant (from `app_permissions`). */
+    can(claims: SessionClaims | null | undefined, grant: AccessGrant<S>): boolean;
+    /** Whether the verified claims hold AT LEAST ONE permission in the grant. */
+    canAny(claims: SessionClaims | null | undefined, grant: AccessGrant<S>): boolean;
+}
+export declare function createAccessControl<const S extends AccessStatements>(statements: S): AccessControl<S>;

package/dist/access-control.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessControl = createAccessControl;
+const authz_1 = require("@atlasauth/authz");
+function createAccessControl(statements) {
+    for (const [resource, actions] of Object.entries(statements)) {
+        if (!/^[a-z][a-z0-9_]{0,63}$/.test(resource) || resource === 'org') {
+            throw new Error(`Invalid resource "${resource}": lowercase letters, digits and _, not "org".`);
+        }
+        for (const action of actions) {
+            if (!/^[a-z*][a-z0-9_*]{0,63}$/.test(action))
+                throw new Error(`Invalid action "${action}" on "${resource}".`);
+        }
+    }
+    const permissions = (grant) => {
+        const out = new Set();
+        for (const [resource, actions] of Object.entries(grant)) {
+            const allowed = statements[resource];
+            if (!allowed)
+                throw new Error(`Unknown resource "${resource}".`);
+            for (const action of actions ?? []) {
+                if (!allowed.includes(action))
+                    throw new Error(`Unknown action "${action}" on "${resource}".`);
+                out.add(`${resource}:${action}`);
+            }
+        }
+        return [...out].sort();
+    };
+    return {
+        statements,
+        permission: (resource, action) => `${resource}:${String(action)}`,
+        permissions,
+        allPermissions: () => Object.entries(statements)
+            .flatMap(([r, actions]) => actions.map((a) => `${r}:${a}`))
+            .sort(),
+        role: (key, name, grant, description) => ({
+            key,
+            name,
+            ...(description !== undefined ? { description } : {}),
+            permissions: permissions(grant),
+        }),
+        can: (claims, grant) => (0, authz_1.hasFromClaims)(claims, { allAppPermissions: permissions(grant) }),
+        canAny: (claims, grant) => (0, authz_1.hasFromClaims)(claims, { anyAppPermission: permissions(grant) }),
+    };
+}
+//# sourceMappingURL=access-control.js.map

package/dist/access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../src/access-control.ts"],"names":[],"mappings":";;AAyDA,kDAwCC;AAjGD,4CAAiD;AAyDjD,SAAgB,mBAAmB,CAAmC,UAAa;IACjF,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,gDAAgD,CAAC,CAAC;QACjG,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,SAAS,QAAQ,IAAI,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,KAAqB,EAA0B,EAAE;QACpE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAuD,EAAE,CAAC;YAC9G,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,IAAI,CAAC,CAAC;YACjE,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,SAAS,QAAQ,IAAI,CAAC,CAAC;gBAC/F,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAA4B,CAAC;IACnD,CAAC,CAAC;IAEF,OAAO;QACL,UAAU;QACV,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,EAAqB;QACpF,WAAW;QACX,cAAc,EAAE,GAAG,EAAE,CACnB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;aACvB,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;aAC1D,IAAI,EAA4B;QACrC,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YACxC,GAAG;YACH,IAAI;YACJ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC;SAChC,CAAC;QACF,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;KAC3F,CAAC;AACJ,CAAC"}

package/dist/algs.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The JWS algorithms Atlas signs tokens with. An instance key is RS256 (the
+ * default) or ES256; APIs may be set to either. Verification is pinned to this
+ * list — `none` and HMAC never verify — and the token's `kid` selects exactly
+ * one published key, whose type fixes which of the two applies.
+ */
+export declare const ATLAS_SIGNING_ALGS: string[];

package/dist/algs.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ATLAS_SIGNING_ALGS = void 0;
+/**
+ * The JWS algorithms Atlas signs tokens with. An instance key is RS256 (the
+ * default) or ES256; APIs may be set to either. Verification is pinned to this
+ * list — `none` and HMAC never verify — and the token's `kid` selects exactly
+ * one published key, whose type fixes which of the two applies.
+ */
+exports.ATLAS_SIGNING_ALGS = ['RS256', 'ES256'];
+//# sourceMappingURL=algs.js.map

package/dist/algs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"algs.js","sourceRoot":"","sources":["../src/algs.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACU,QAAA,kBAAkB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC"}

package/dist/client/api-keys.d.ts

@@ -20,11 +20,31 @@ export interface ApiKey {
     limits?: ApiKeyLimit[] | null;
     /** Each cap with its current-window usage (empty when the key has no caps). */
     usage?: ApiKeyLimitState[];
+    /** A disabled key fails verify until re-enabled (it is not revoked). */
+    enabled?: boolean;
+    /** Per-key verify rate limit, or null. */
+    rate_limit?: ApiKeyRateLimit | null;
+    /** Uses left (each successful verify spends one); null = unlimited. */
+    remaining?: number | null;
     last_used_at: number | null;
     expires_at: number | null;
     revoked_at: number | null;
     created_at: number;
 }
+/** At most `max` successful verifies per `window_seconds`. */
+export interface ApiKeyRateLimit {
+    max: number;
+    window_seconds: number;
+}
+/** Controls shared by create and update. */
+export interface ApiKeyControls {
+    /** Default true. A disabled key fails verify and cannot mint tokens. */
+    enabled?: boolean;
+    /** Per-key verify rate limit; null removes it. */
+    rate_limit?: ApiKeyRateLimit | null;
+    /** Uses left; null = unlimited. */
+    remaining?: number | null;
+}
 /** The window a spend cap counts over. `request` caps a single debit; `day`/`month` are UTC calendar windows; `total` never resets. */
 export type ApiKeyLimitPeriod = 'request' | 'day' | 'month' | 'total';
 /** A per-key spend cap, metered with {@link apiKeysResource} `recordUsage`. */
@@ -103,17 +123,21 @@ export interface ApiKeyWithSecret extends ApiKey {
     secret: string;
     note: string;
 }
-export interface CreateApiKeyBody {
+export interface CreateApiKeyBody extends ApiKeyControls {
     subject_type: ApiKeySubjectType;
     subject_id: string;
     name?: string;
     claims?: Record<string, unknown>;
-    /** Epoch ms; null (or omitted) never expires. */
+    /** Epoch ms; null never expires (omitted: the instance default lifetime, if any). */
     expires_at?: number | null;
+    /** Relative expiry; mutually exclusive with `expires_at`. */
+    expires_in_seconds?: number;
+    /** Custom secret prefix (e.g. `acme` gives `acme_<id>_<secret>`). */
+    prefix?: string;
     /** Per-key spend caps, metered with `recordUsage`. */
     limits?: ApiKeyLimit[] | null;
 }
-export interface UpdateApiKeyBody {
+export interface UpdateApiKeyBody extends ApiKeyControls {
     name?: string | null;
     claims?: Record<string, unknown>;
     expires_at?: number | null;
@@ -128,6 +152,19 @@ export interface UpdateApiKeyBody {
 export type ApiKeyVerification = {
     object: 'api_key_verification';
     valid: false;
+} | {
+    /**
+     * A live key refused by its own policy: `insufficient_scope` (see
+     * `missing_scopes`), `rate_limited` (retry after `retry_after_ms`) or
+     * `usage_exhausted` (no uses left).
+     */
+    object: 'api_key_verification';
+    valid: false;
+    code: 'insufficient_scope' | 'rate_limited' | 'usage_exhausted';
+    id: string;
+    missing_scopes?: string[];
+    retry_after_ms?: number;
+    remaining?: number;
 } | {
     object: 'api_key_verification';
     valid: true;
@@ -144,6 +181,8 @@ export type ApiKeyVerification = {
     usage?: ApiKeyLimitState[];
     last_used_at: number | null;
     expires_at?: number | null;
+    /** Uses left after this verify (null = unlimited). */
+    remaining?: number | null;
 };
 /**
  * §P1-8 a short-lived, offline-verifiable access JWT minted from a long-lived
@@ -193,7 +232,13 @@ export declare function apiKeysResource(request: RequestFn): {
     /** Mint a key. The secret is returned once, here. */
     create(body: CreateApiKeyBody, idempotencyKey?: string): Promise<ApiKeyWithSecret>;
     /** Check a presented secret. Rate-limited — it is an online credential check. */
-    verify(secret: string): Promise<ApiKeyVerification>;
+    /**
+     * Verify a presented key. `required_scopes`: every one must be on the key,
+     * else `{ valid: false, code: 'insufficient_scope' }`.
+     */
+    verify(secret: string, options?: {
+        required_scopes?: string[];
+    }): Promise<ApiKeyVerification>;
     get(id: string): Promise<ApiKey>;
     update(id: string, body: UpdateApiKeyBody): Promise<ApiKey>;
     /** Revoke a key. It stays queryable but never authenticates again. */

package/dist/client/api-keys.js

@@ -13,8 +13,12 @@ function apiKeysResource(request) {
             return request({ method: 'POST', path: '/v1/api_keys', body, idempotencyKey });
         },
         /** Check a presented secret. Rate-limited — it is an online credential check. */
-        verify(secret) {
-            return request({ method: 'POST', path: '/v1/api_keys/verify', body: { secret } });
+        /**
+         * Verify a presented key. `required_scopes`: every one must be on the key,
+         * else `{ valid: false, code: 'insufficient_scope' }`.
+         */
+        verify(secret, options = {}) {
+            return request({ method: 'POST', path: '/v1/api_keys/verify', body: { secret, ...options } });
         },
         get(id) {
             return request({ method: 'GET', path: `/v1/api_keys/${(0, request_1.enc)(id)}` });

package/dist/client/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/client/api-keys.ts"],"names":[],"mappings":";;AA2MA,0CAyDC;AApQD,uCAAgD;AA2MhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,KAGJ;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qDAAqD;QACrD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,iFAAiF;QACjF,MAAM,CAAC,MAAc;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;;;;;WAOG;QACH,WAAW,CAAC,EAAU,EAAE,IAA2B;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,iFAAiF;QACjF,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,IAAyB;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD;;;WAGG;QACH,WAAW,CAAC,QAAiC,EAAE;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/client/api-keys.ts"],"names":[],"mappings":";;AAqPA,0CA6DC;AAlTD,uCAAgD;AAqPhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,KAGJ;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qDAAqD;QACrD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,iFAAiF;QACjF;;;WAGG;QACH,MAAM,CAAC,MAAc,EAAE,UAA0C,EAAE;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;;;;;WAOG;QACH,WAAW,CAAC,EAAU,EAAE,IAA2B;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,iFAAiF;QACjF,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,IAAyB;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD;;;WAGG;QACH,WAAW,CAAC,QAAiC,EAAE;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/app-roles.d.ts

@@ -0,0 +1,76 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * App-level (instance-wide) user roles: roles that are not tied to an
+ * organization, each granting permission keys like `tickets:read`. A user's
+ * role keys and the union of their permissions travel on the session token as
+ * `app_roles` / `app_permissions`; check them offline with
+ * `has(claims, { appPermission: 'tickets:read' })` or `hasAppPermission`.
+ */
+export interface AppRole {
+    object: 'app_role';
+    id: string;
+    key: string;
+    name: string;
+    description: string | null;
+    permissions: string[];
+    /** On list and create only. */
+    users_count?: number;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateAppRoleBody {
+    /** 2-64 lowercase letters, digits, _ or -, starting with a letter. */
+    key: string;
+    name: string;
+    description?: string | null;
+    /** `resource:action` keys (the `org:` namespace is reserved for organizations). */
+    permissions?: string[];
+}
+export interface UpdateAppRoleBody {
+    name?: string;
+    description?: string | null;
+    permissions?: string[];
+}
+export interface UserAppRoles {
+    object: 'user_app_roles';
+    user_id: string;
+    roles: AppRole[];
+    role_keys: string[];
+    permissions: string[];
+}
+/**
+ * Change a user's app roles: `roles` replaces the set; `add`/`remove` change it
+ * (role keys or ids). Send one form, not both.
+ */
+export type SetUserAppRolesBody = {
+    roles: string[];
+} | {
+    add?: string[];
+    remove?: string[];
+};
+export declare function appRolesResource(request: RequestFn): {
+    list(): Promise<ListPage<AppRole>>;
+    create(body: CreateAppRoleBody): Promise<AppRole>;
+    /** By id or key. */
+    get(idOrKey: string): Promise<AppRole>;
+    update(idOrKey: string, body: UpdateAppRoleBody): Promise<AppRole>;
+    delete(idOrKey: string): Promise<{
+        object: "app_role";
+        id: string;
+        deleted: true;
+    }>;
+    /** The users holding a role. */
+    listUsers(idOrKey: string, query?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<ListPage<{
+        object: "user_app_role";
+        user_id: string;
+        role: string;
+    }>>;
+    /** A user's app roles and effective permissions. */
+    getForUser(userId: string): Promise<UserAppRoles>;
+    setForUser(userId: string, body: SetUserAppRolesBody): Promise<UserAppRoles>;
+    removeFromUser(userId: string, idOrKey: string): Promise<UserAppRoles>;
+};

package/dist/client/app-roles.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appRolesResource = appRolesResource;
+const request_1 = require("./request");
+function appRolesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/app_roles' });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/app_roles', body });
+        },
+        /** By id or key. */
+        get(idOrKey) {
+            return request({ method: 'GET', path: `/v1/app_roles/${(0, request_1.enc)(idOrKey)}` });
+        },
+        update(idOrKey, body) {
+            return request({ method: 'PATCH', path: `/v1/app_roles/${(0, request_1.enc)(idOrKey)}`, body });
+        },
+        delete(idOrKey) {
+            return request({ method: 'DELETE', path: `/v1/app_roles/${(0, request_1.enc)(idOrKey)}` });
+        },
+        /** The users holding a role. */
+        listUsers(idOrKey, query = {}) {
+            return request({ method: 'GET', path: `/v1/app_roles/${(0, request_1.enc)(idOrKey)}/users`, query });
+        },
+        /** A user's app roles and effective permissions. */
+        getForUser(userId) {
+            return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(userId)}/app_roles` });
+        },
+        setForUser(userId, body) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(userId)}/app_roles`, body });
+        },
+        removeFromUser(userId, idOrKey) {
+            return request({ method: 'DELETE', path: `/v1/users/${(0, request_1.enc)(userId)}/app_roles/${(0, request_1.enc)(idOrKey)}` });
+        },
+    };
+}
+//# sourceMappingURL=app-roles.js.map

package/dist/client/app-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-roles.js","sourceRoot":"","sources":["../../src/client/app-roles.ts"],"names":[],"mappings":";;AAoDA,4CAoCC;AAxFD,uCAAgD;AAoDhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,IAAuB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,oBAAoB;QACpB,GAAG,CAAC,OAAe;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,OAAe,EAAE,IAAuB;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,CAAC,OAAe;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,gCAAgC;QAChC,SAAS,CACP,OAAe,EACf,QAA6C,EAAE;YAE/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,oDAAoD;QACpD,UAAU,CAAC,MAAc;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,UAAU,CAAC,MAAc,EAAE,IAAyB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,cAAc,CAAC,MAAc,EAAE,OAAe;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-templates.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The transactional email a template drives. */
-export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed';
+export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'verification_link' | 'password_reset_link';
 /** The customizable body of a template: a subject line and a text body. */
 export interface EmailTemplateBody {
     subject?: string;

package/dist/client/email-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AAyDA,wDAkBC;AA3ED,uCAAgD;AAyDhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AA4DA,wDAkBC;AA9ED,uCAAgD;AA4DhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/index.d.ts

@@ -12,13 +12,20 @@ import type { RequestFn } from './request';
 export declare function createAtlasClient(config: AtlasClientConfig): AtlasClient;
 declare function buildNamespaces(request: RequestFn): {
     users: {
-        list(params?: import("./users").ListUsersParams): Promise<import("./types").CursorPage<import("./users").User>>;
+        list(params?: import("./users").ListUsersParams): Promise<import("./types").CursorPage<import("./users").User> & {
+            total_count?: number;
+        }>;
         get(id: string): Promise<import("./users").User>;
         create(body: import("./users").CreateUserBody, idempotencyKey?: string): Promise<import("./users").User>;
         update(id: string, body: import("./users").UpdateUserBody): Promise<import("./users").User>;
         setExternalId(id: string, externalId: string | null): Promise<import("./users").User>;
         replaceMetadata(id: string, body: import("./users").ReplaceUserMetadataBody): Promise<import("./users").User>;
-        ban(id: string): Promise<import("./users").User>;
+        ban(id: string, body?: {
+            reason?: string;
+            note?: string;
+            expires_in_seconds?: number;
+            expires_at?: number;
+        }): Promise<import("./users").User>;
         unban(id: string): Promise<import("./users").User>;
         lock(id: string, body?: {
             duration_in_seconds?: number;
@@ -354,6 +361,14 @@ declare function buildNamespaces(request: RequestFn): {
         }>;
         listBackchannelDeliveries(id: string, query?: import("./oauth-clients").BackchannelDeliveriesQuery): Promise<import("./oauth-clients").BackchannelLogoutDeliveryPage>;
         testBackchannelLogout(id: string): Promise<import("./oauth-clients").BackchannelLogoutTest>;
+        initialAccessTokens: {
+            list(): Promise<import("./types").ListPage<import("./oauth-clients").OAuthInitialAccessToken>>;
+            create(body?: import("./oauth-clients").CreateInitialAccessTokenBody): Promise<import("./oauth-clients").OAuthInitialAccessToken & {
+                token: string;
+                note: string;
+            }>;
+            revoke(id: string): Promise<import("./oauth-clients").OAuthInitialAccessToken>;
+        };
         grants: {
             list(clientId: string): Promise<import("./types").ListPage<import("./oauth-clients").ClientGrant>>;
             create(clientId: string, body: {
@@ -393,6 +408,7 @@ declare function buildNamespaces(request: RequestFn): {
     scimTokens: {
         list(): Promise<import("./types").ListPage<import("./scim-tokens").ScimToken>>;
         create(body: import("./scim-tokens").CreateScimTokenBody, idempotencyKey?: string): Promise<import("./scim-tokens").ScimTokenWithSecret>;
+        update(id: string, body: import("./scim-tokens").UpdateScimTokenBody): Promise<import("./scim-tokens").ScimToken>;
         revoke(id: string): Promise<{
             object: "scim_token";
             id: string;
@@ -530,7 +546,9 @@ declare function buildNamespaces(request: RequestFn): {
             subject_id?: string;
         }): Promise<import("./types").ListPage<import("./api-keys").ApiKey>>;
         create(body: import("./api-keys").CreateApiKeyBody, idempotencyKey?: string): Promise<import("./api-keys").ApiKeyWithSecret>;
-        verify(secret: string): Promise<import("./api-keys").ApiKeyVerification>;
+        verify(secret: string, options?: {
+            required_scopes?: string[];
+        }): Promise<import("./api-keys").ApiKeyVerification>;
         get(id: string): Promise<import("./api-keys").ApiKey>;
         update(id: string, body: import("./api-keys").UpdateApiKeyBody): Promise<import("./api-keys").ApiKey>;
         delete(id: string): Promise<{
@@ -543,6 +561,28 @@ declare function buildNamespaces(request: RequestFn): {
         mintToken(body: import("./api-keys").MintApiKeyTokenBody): Promise<import("./api-keys").ApiKeyToken>;
         listRevoked(query?: import("./api-keys").ListRevokedApiKeysQuery): Promise<import("./types").CursorPage<import("./api-keys").RevokedApiKeyRef>>;
     };
+    appRoles: {
+        list(): Promise<import("./types").ListPage<import("./app-roles").AppRole>>;
+        create(body: import("./app-roles").CreateAppRoleBody): Promise<import("./app-roles").AppRole>;
+        get(idOrKey: string): Promise<import("./app-roles").AppRole>;
+        update(idOrKey: string, body: import("./app-roles").UpdateAppRoleBody): Promise<import("./app-roles").AppRole>;
+        delete(idOrKey: string): Promise<{
+            object: "app_role";
+            id: string;
+            deleted: true;
+        }>;
+        listUsers(idOrKey: string, query?: {
+            limit?: number;
+            offset?: number;
+        }): Promise<import("./types").ListPage<{
+            object: "user_app_role";
+            user_id: string;
+            role: string;
+        }>>;
+        getForUser(userId: string): Promise<import("./app-roles").UserAppRoles>;
+        setForUser(userId: string, body: import("./app-roles").SetUserAppRolesBody): Promise<import("./app-roles").UserAppRoles>;
+        removeFromUser(userId: string, idOrKey: string): Promise<import("./app-roles").UserAppRoles>;
+    };
     machines: {
         list(query?: import("./machines").ListMachinesQuery): Promise<import("./machines").MachineListPage>;
         create(body: import("./machines").CreateMachineBody, idempotencyKey?: string): Promise<import("./machines").MachineWithSecret>;
@@ -931,6 +971,11 @@ declare function buildNamespaces(request: RequestFn): {
         };
     };
     instanceSecurity: {
+        listSigningKeys(): Promise<{
+            object: "list";
+            data: import("./instance-security").SigningKey[];
+        }>;
+        rotateSigningKey(body?: import("./instance-security").RotateSigningKeyBody): Promise<import("./instance-security").SigningKeyRotation>;
         get(): Promise<import("./instance-security").InstanceSecurity>;
         update(body: import("./instance-security").UpdateInstanceSecurityBody): Promise<import("./instance-security").InstanceSecurityResult>;
         setCaptchaSecret(body: {
@@ -1307,6 +1352,7 @@ export * from './users';
 export * from './sessions';
 export * from './organizations';
 export * from './roles';
+export * from './app-roles';
 export * from './oauth-clients';
 export * from './resource-servers';
 export * from './sso-connections';

package/dist/client/index.js

@@ -36,6 +36,7 @@ const sign_in_tokens_1 = require("./sign-in-tokens");
 const audit_logs_1 = require("./audit-logs");
 const jwt_templates_1 = require("./jwt-templates");
 const api_keys_1 = require("./api-keys");
+const app_roles_1 = require("./app-roles");
 const machines_1 = require("./machines");
 const oauth_providers_1 = require("./oauth-providers");
 const sso_onboarding_1 = require("./sso-onboarding");
@@ -124,6 +125,8 @@ function buildNamespaces(request) {
         auditLogs: (0, audit_logs_1.auditLogsResource)(request),
         jwtTemplates: (0, jwt_templates_1.jwtTemplatesResource)(request),
         apiKeys: (0, api_keys_1.apiKeysResource)(request),
+        // App-level (instance-wide) user roles and permissions.
+        appRoles: (0, app_roles_1.appRolesResource)(request),
         // §9.3 / §P1-7 named machine identities + device registry + enrolment tokens.
         machines: (0, machines_1.machinesResource)(request),
         oauthProviders: (0, oauth_providers_1.oauthProvidersResource)(request),
@@ -203,6 +206,7 @@ __exportStar(require("./users"), exports);
 __exportStar(require("./sessions"), exports);
 __exportStar(require("./organizations"), exports);
 __exportStar(require("./roles"), exports);
+__exportStar(require("./app-roles"), exports);
 __exportStar(require("./oauth-clients"), exports);
 __exportStar(require("./resource-servers"), exports);
 __exportStar(require("./sso-connections"), exports);

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA8EA,8CAQC;AAtFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,2CAAgD;AAChD,6CAAiD;AACjD,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,kFAAkF;QAClF,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,yEAAyE;QACzE,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,8CAA4B;AAC5B,+CAA6B;AAC7B,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA+EA,8CAQC;AAvFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,2CAA+C;AAC/C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,2CAAgD;AAChD,6CAAiD;AACjD,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,wDAAwD;QACxD,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,kFAAkF;QAClF,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,yEAAyE;QACzE,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,8CAA4B;AAC5B,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,8CAA4B;AAC5B,+CAA6B;AAC7B,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}

package/dist/client/instance-security.d.ts

@@ -63,7 +63,41 @@ export interface CreateProxySecretBody {
 export interface InstanceSecurityResult extends InstanceSecurity {
     warning?: string;
 }
+/** One published instance signing key (`GET /v1/instance/signing_keys`). */
+export interface SigningKey {
+    object: 'signing_key';
+    kid: string;
+    alg: 'RS256' | 'ES256' | string;
+    status: 'current' | 'previous';
+    /** `main` signs every token; `secondary` signs access tokens for APIs set to the other algorithm. */
+    role: 'main' | 'secondary';
+    /** When a previous key leaves the JWKS (epoch ms); null for a current key. */
+    retires_at: number | null;
+}
+export interface RotateSigningKeyBody {
+    /** How long the previous key stays published (default 86400, at most 2592000). */
+    grace_period_seconds?: number;
+    /** Publish only the new key now (suspected compromise). */
+    emergency?: boolean;
+    /** The new main key's algorithm; omit to keep the current one. */
+    alg?: 'RS256' | 'ES256';
+}
+export interface SigningKeyRotation {
+    object: 'signing_key_rotation';
+    kid: string;
+    alg: 'RS256' | 'ES256';
+    previous_kid: string | null;
+    previous_retires_at: number | null;
+    emergency: boolean;
+}
 export declare function instanceSecurityResource(request: RequestFn): {
+    /** The published token-signing keys, newest first. */
+    listSigningKeys(): Promise<{
+        object: "list";
+        data: SigningKey[];
+    }>;
+    /** Rotate the signing key (optionally switching between RS256 and ES256). */
+    rotateSigningKey(body?: RotateSigningKeyBody): Promise<SigningKeyRotation>;
     get(): Promise<InstanceSecurity>;
     update(body: UpdateInstanceSecurityBody): Promise<InstanceSecurityResult>;
     /** Store the captcha provider secret. Refused while the provider is `none`. */