@atlasauth/backend 0.14.1 → 0.16.0

package/dist/client/custom-oauth-providers.d.ts

@@ -0,0 +1,243 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * Custom (generic) OAuth 2.0 / OpenID Connect login providers — your own
+ * upstream identity provider, with Atlas as the relying party. Configure the
+ * endpoints (or just an OIDC issuer), the token-endpoint client authentication
+ * (incl. private_key_jwt with an Atlas-held key), a declarative profile
+ * mapping, upstream logout and third-party initiated login. The provider then
+ * signs users in like any built-in one: `provider: <provider_key>`.
+ */
+/** A claim path, a `{{template}}`, or a rule. */
+export type ProfileMappingExpr = string | {
+    /** A path, or paths tried in order (the first non-empty wins). */
+    from?: string | string[];
+    template?: string;
+    /** A constant. */
+    value?: string | number | boolean | null;
+    transforms?: Array<'lowercase' | 'uppercase' | 'trim' | 'first' | 'last' | 'compact' | 'unique' | 'to_string' | 'to_number' | 'to_boolean' | {
+        split: string;
+    } | {
+        join: string;
+    } | {
+        index: number;
+    } | {
+        replace: {
+            find: string;
+            with: string;
+        };
+    } | {
+        prefix: string;
+    } | {
+        suffix: string;
+    } | {
+        default: string | number | boolean | null;
+    }>;
+};
+export interface ProfileMapping {
+    fields?: Partial<Record<'id' | 'email' | 'email_verified' | 'first_name' | 'last_name' | 'full_name' | 'username' | 'image_url' | 'phone_number' | 'external_id', ProfileMappingExpr>>;
+    public_metadata?: Record<string, ProfileMappingExpr>;
+    private_metadata?: Record<string, ProfileMappingExpr>;
+    /** Re-apply names, image and metadata on every sign-in (default: at account creation). */
+    update_on_sign_in?: boolean;
+}
+export type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'none';
+export interface UpstreamLogoutSettings {
+    /** On Atlas sign-out, hand back the provider end-session URL to send the browser to. */
+    rp_initiated?: boolean;
+    post_logout_redirect_url?: string | null;
+    /** Accept OIDC Back-Channel Logout tokens and end the matching Atlas sessions. */
+    backchannel?: boolean;
+    /** Accept OIDC Front-Channel Logout (the provider frames frontchannel_logout_uri). */
+    frontchannel?: boolean;
+    /** Front-channel: require iss + sid (default true). */
+    frontchannel_session_required?: boolean;
+    end_session_endpoint?: string | null;
+}
+export interface IdpInitiatedLoginSettings {
+    enabled?: boolean;
+    /** Exact URLs or bare origins a third-party initiated login may land on. */
+    allowed_targets?: string[];
+    default_target?: string | null;
+}
+export interface UpstreamSigningKey {
+    object: 'upstream_signing_key';
+    kid: string;
+    alg: 'RS256' | 'PS256' | 'ES256';
+    status: 'active' | 'retiring' | 'retired';
+    public_jwk: Record<string, unknown>;
+    created_at: number;
+    retired_at: number | null;
+}
+export interface UpstreamUrls {
+    /** Register at the provider as the client JWKS URL (private_key_jwt). */
+    client_jwks_uri: string;
+    backchannel_logout_uri: string;
+    frontchannel_logout_uri: string;
+    post_logout_redirect_uri: string;
+    initiate_login_uri: string;
+}
+export interface CustomOAuthProviderSettings {
+    display_name?: string;
+    icon_url?: string | null;
+    protocol?: 'oidc' | 'oauth2';
+    issuer?: string | null;
+    discovery_url?: string | null;
+    authorization_endpoint?: string | null;
+    token_endpoint?: string | null;
+    userinfo_endpoint?: string | null;
+    jwks_uri?: string | null;
+    end_session_endpoint?: string | null;
+    scopes?: string[];
+    scope_separator?: ' ' | ',' | '+';
+    pkce?: boolean;
+    authorization_params?: Record<string, string> | null;
+    token_params?: Record<string, string> | null;
+    userinfo_auth?: 'header' | 'query';
+    token_endpoint_auth_method?: TokenEndpointAuthMethod;
+    client_assertion_audience?: string | null;
+    profile_source?: 'merged' | 'userinfo' | 'id_token';
+    profile_mapping?: ProfileMapping | null;
+    logout?: UpstreamLogoutSettings | null;
+    idp_initiated_login?: IdpInitiatedLoginSettings | null;
+    client_id?: string;
+    /** Write-only; never returned. */
+    client_secret?: string;
+    enabled?: boolean;
+    allow_sign_in?: boolean;
+    allow_sign_up?: boolean;
+}
+export interface CreateCustomOAuthProviderBody extends CustomOAuthProviderSettings {
+    provider_key: string;
+    display_name: string;
+}
+export interface CustomOAuthProvider extends UpstreamUrls {
+    object: 'custom_oauth_provider';
+    id: string;
+    provider_key: string;
+    display_name: string;
+    icon_url: string | null;
+    protocol: 'oidc' | 'oauth2';
+    issuer: string | null;
+    discovery_url: string | null;
+    authorization_endpoint: string | null;
+    token_endpoint: string | null;
+    userinfo_endpoint: string | null;
+    jwks_uri: string | null;
+    end_session_endpoint: string | null;
+    scopes: string[];
+    scope_separator: ' ' | ',' | '+';
+    pkce: boolean;
+    authorization_params: Record<string, string>;
+    token_params: Record<string, string>;
+    userinfo_auth: 'header' | 'query';
+    token_endpoint_auth_method: TokenEndpointAuthMethod;
+    client_assertion_audience: string | null;
+    profile_source: 'merged' | 'userinfo' | 'id_token';
+    profile_mapping: Required<ProfileMapping> | null;
+    logout: Required<UpstreamLogoutSettings>;
+    idp_initiated_login: Required<IdpInitiatedLoginSettings>;
+    client_id: string | null;
+    has_secret: boolean;
+    enabled: boolean;
+    allow_sign_in: boolean;
+    allow_sign_up: boolean;
+    /** Register at the provider as the redirect / callback URI. */
+    redirect_uri: string;
+    signing_keys: UpstreamSigningKey[];
+    created_at: number;
+    updated_at: number;
+}
+export interface ProfileMappingPreviewBody {
+    profile_mapping?: ProfileMapping;
+    userinfo?: Record<string, unknown>;
+    id_token_claims?: Record<string, unknown>;
+    /** A sample id_token — decoded, not verified. */
+    id_token?: string;
+}
+export interface ProfileMappingPreview {
+    object: 'profile_mapping_preview';
+    profile: {
+        id: string | null;
+        email: string | null;
+        email_verified: boolean;
+        first_name: string | null;
+        last_name: string | null;
+        username: string | null;
+        image_url: string | null;
+        phone_number: string | null;
+        external_id: string | null;
+        public_metadata: Record<string, unknown>;
+        private_metadata: Record<string, unknown>;
+    };
+    trace: Record<string, {
+        value: unknown;
+        source: string | null;
+    }>;
+    warnings: string[];
+}
+export interface OidcDiscoveryResult {
+    object: 'oidc_discovery';
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string | null;
+    jwks_uri: string;
+    end_session_endpoint: string | null;
+    scopes_supported: string[];
+    claims_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    token_endpoint_auth_signing_alg_values_supported: string[];
+    code_challenge_methods_supported: string[];
+    backchannel_logout_supported: boolean;
+    backchannel_logout_session_supported: boolean;
+}
+/** The signing-key operations shared by custom providers and OIDC connections. */
+export declare function upstreamSigningKeys(request: RequestFn, base: string): {
+    list(): Promise<ListPage<UpstreamSigningKey>>;
+    /** Generate a new active key; the previous one turns `retiring` (still published). */
+    rotate(body?: {
+        alg?: "RS256" | "PS256" | "ES256";
+    }, idempotencyKey?: string): Promise<UpstreamSigningKey>;
+    /** Retire a non-active key (it leaves the JWKS). */
+    retire(kid: string): Promise<{
+        object: "upstream_signing_key";
+        kid: string;
+        status: "retired";
+    }>;
+};
+export declare function customOAuthProvidersResource(request: RequestFn): {
+    list(): Promise<ListPage<CustomOAuthProvider>>;
+    get(id: string): Promise<CustomOAuthProvider>;
+    create(body: CreateCustomOAuthProviderBody, idempotencyKey?: string): Promise<CustomOAuthProvider>;
+    update(id: string, body: CustomOAuthProviderSettings, idempotencyKey?: string): Promise<CustomOAuthProvider>;
+    delete(id: string): Promise<{
+        object: "custom_oauth_provider";
+        id: string;
+        provider_key: string;
+        deleted: true;
+    }>;
+    /** Fetch + validate an issuer's OpenID configuration (for autofill). */
+    discover(body: {
+        issuer: string;
+        discovery_url?: string;
+    }): Promise<OidcDiscoveryResult>;
+    /**
+     * Run a mapping against a pasted sample. With `id`, the provider's stored
+     * mapping is used unless the body carries one.
+     */
+    previewProfileMapping(body: ProfileMappingPreviewBody, id?: string): Promise<ProfileMappingPreview>;
+    signingKeys(id: string): {
+        list(): Promise<ListPage<UpstreamSigningKey>>;
+        /** Generate a new active key; the previous one turns `retiring` (still published). */
+        rotate(body?: {
+            alg?: "RS256" | "PS256" | "ES256";
+        }, idempotencyKey?: string): Promise<UpstreamSigningKey>;
+        /** Retire a non-active key (it leaves the JWKS). */
+        retire(kid: string): Promise<{
+            object: "upstream_signing_key";
+            kid: string;
+            status: "retired";
+        }>;
+    };
+};

package/dist/client/custom-oauth-providers.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.upstreamSigningKeys = upstreamSigningKeys;
+exports.customOAuthProvidersResource = customOAuthProvidersResource;
+const request_1 = require("./request");
+/** The signing-key operations shared by custom providers and OIDC connections. */
+function upstreamSigningKeys(request, base) {
+    return {
+        list() {
+            return request({ method: 'GET', path: `${base}/signing_keys` });
+        },
+        /** Generate a new active key; the previous one turns `retiring` (still published). */
+        rotate(body = {}, idempotencyKey) {
+            return request({ method: 'POST', path: `${base}/signing_keys`, body, idempotencyKey });
+        },
+        /** Retire a non-active key (it leaves the JWKS). */
+        retire(kid) {
+            return request({ method: 'POST', path: `${base}/signing_keys/${(0, request_1.enc)(kid)}/retire` });
+        },
+    };
+}
+function customOAuthProvidersResource(request) {
+    const base = (id) => `/v1/custom_oauth_providers/${(0, request_1.enc)(id)}`;
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/custom_oauth_providers' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: base(id) });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/custom_oauth_providers', body, idempotencyKey });
+        },
+        update(id, body, idempotencyKey) {
+            return request({ method: 'PATCH', path: base(id), body, idempotencyKey });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: base(id) });
+        },
+        /** Fetch + validate an issuer's OpenID configuration (for autofill). */
+        discover(body) {
+            return request({ method: 'POST', path: '/v1/custom_oauth_providers/discover', body });
+        },
+        /**
+         * Run a mapping against a pasted sample. With `id`, the provider's stored
+         * mapping is used unless the body carries one.
+         */
+        previewProfileMapping(body, id) {
+            return request({
+                method: 'POST',
+                path: id ? `${base(id)}/profile_mapping/preview` : '/v1/custom_oauth_providers/profile_mapping/preview',
+                body,
+            });
+        },
+        signingKeys(id) {
+            return upstreamSigningKeys(request, base(id));
+        },
+    };
+}
+//# sourceMappingURL=custom-oauth-providers.js.map

package/dist/client/custom-oauth-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-oauth-providers.js","sourceRoot":"","sources":["../../src/client/custom-oauth-providers.ts"],"names":[],"mappings":";;AAqOA,kDAcC;AAED,oEAqCC;AA1RD,uCAAgD;AAoOhD,kFAAkF;AAClF,SAAgB,mBAAmB,CAAC,OAAkB,EAAE,IAAY;IAClE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,OAA8C,EAAE,EAAE,cAAuB;YAC9E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,oDAAoD;QACpD,MAAM,CAAC,GAAW;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,iBAAiB,IAAA,aAAG,EAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,4BAA4B,CAAC,OAAkB;IAC7D,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,CAAC;IACrE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAmC,EAAE,cAAuB;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAiC,EAAE,cAAuB;YAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,wEAAwE;QACxE,QAAQ,CAAC,IAAgD;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD;;;WAGG;QACH,qBAAqB,CAAC,IAA+B,EAAE,EAAW;YAChE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,oDAAoD;gBACvG,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,WAAW,CAAC,EAAU;YACpB,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-templates.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The transactional email a template drives. */
-export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed';
+export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'verification_link' | 'password_reset_link' | 'account_reactivated';
 /** The customizable body of a template: a subject line and a text body. */
 export interface EmailTemplateBody {
     subject?: string;

package/dist/client/email-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AAyDA,wDAkBC;AA3ED,uCAAgD;AAyDhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AA6DA,wDAkBC;AA/ED,uCAAgD;AA6DhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/index.d.ts

@@ -12,13 +12,20 @@ import type { RequestFn } from './request';
 export declare function createAtlasClient(config: AtlasClientConfig): AtlasClient;
 declare function buildNamespaces(request: RequestFn): {
     users: {
-        list(params?: import("./users").ListUsersParams): Promise<import("./types").CursorPage<import("./users").User>>;
+        list(params?: import("./users").ListUsersParams): Promise<import("./types").CursorPage<import("./users").User> & {
+            total_count?: number;
+        }>;
         get(id: string): Promise<import("./users").User>;
         create(body: import("./users").CreateUserBody, idempotencyKey?: string): Promise<import("./users").User>;
         update(id: string, body: import("./users").UpdateUserBody): Promise<import("./users").User>;
         setExternalId(id: string, externalId: string | null): Promise<import("./users").User>;
         replaceMetadata(id: string, body: import("./users").ReplaceUserMetadataBody): Promise<import("./users").User>;
-        ban(id: string): Promise<import("./users").User>;
+        ban(id: string, body?: {
+            reason?: string;
+            note?: string;
+            expires_in_seconds?: number;
+            expires_at?: number;
+        }): Promise<import("./users").User>;
         unban(id: string): Promise<import("./users").User>;
         lock(id: string, body?: {
             duration_in_seconds?: number;
@@ -173,6 +180,8 @@ declare function buildNamespaces(request: RequestFn): {
             id: string;
             status: "revoked";
         }>;
+        setCustomData(id: string, customData: Record<string, unknown> | null): Promise<import("./sessions").Session>;
+        updateCustomData(id: string, patch: Record<string, unknown>): Promise<import("./sessions").Session>;
         touch(id: string): Promise<import("./sessions").TouchedSession>;
         getToken(id: string, template: string): Promise<import("./sessions").SessionTemplateToken>;
     };
@@ -354,6 +363,14 @@ declare function buildNamespaces(request: RequestFn): {
         }>;
         listBackchannelDeliveries(id: string, query?: import("./oauth-clients").BackchannelDeliveriesQuery): Promise<import("./oauth-clients").BackchannelLogoutDeliveryPage>;
         testBackchannelLogout(id: string): Promise<import("./oauth-clients").BackchannelLogoutTest>;
+        initialAccessTokens: {
+            list(): Promise<import("./types").ListPage<import("./oauth-clients").OAuthInitialAccessToken>>;
+            create(body?: import("./oauth-clients").CreateInitialAccessTokenBody): Promise<import("./oauth-clients").OAuthInitialAccessToken & {
+                token: string;
+                note: string;
+            }>;
+            revoke(id: string): Promise<import("./oauth-clients").OAuthInitialAccessToken>;
+        };
         grants: {
             list(clientId: string): Promise<import("./types").ListPage<import("./oauth-clients").ClientGrant>>;
             create(clientId: string, body: {
@@ -388,11 +405,28 @@ declare function buildNamespaces(request: RequestFn): {
             id: string;
             deleted: true;
         }>;
+        previewProfileMapping(id: string, body: import("./custom-oauth-providers").ProfileMappingPreviewBody): Promise<import("./custom-oauth-providers").ProfileMappingPreview>;
+        signingKeys(id: string): {
+            list(): Promise<import("./types").ListPage<import("./custom-oauth-providers").UpstreamSigningKey>>;
+            rotate(body?: {
+                alg?: "RS256" | "PS256" | "ES256";
+            }, idempotencyKey?: string): Promise<import("./custom-oauth-providers").UpstreamSigningKey>;
+            retire(kid: string): Promise<{
+                object: "upstream_signing_key";
+                kid: string;
+                status: "retired";
+            }>;
+        };
         samlMetadata(id: string): Promise<import("./sso-connections").SamlMetadata>;
+        getSamlEncryptionKey(id: string): Promise<import("./sso-connections").SamlEncryptionKey>;
+        createSamlEncryptionKey(id: string, idempotencyKey?: string): Promise<import("./sso-connections").SamlEncryptionKey>;
+        retirePreviousSamlEncryptionKey(id: string): Promise<import("./sso-connections").SamlEncryptionKey>;
+        deleteSamlEncryptionKey(id: string): Promise<import("./sso-connections").SamlEncryptionKey>;
     };
     scimTokens: {
         list(): Promise<import("./types").ListPage<import("./scim-tokens").ScimToken>>;
         create(body: import("./scim-tokens").CreateScimTokenBody, idempotencyKey?: string): Promise<import("./scim-tokens").ScimTokenWithSecret>;
+        update(id: string, body: import("./scim-tokens").UpdateScimTokenBody): Promise<import("./scim-tokens").ScimToken>;
         revoke(id: string): Promise<{
             object: "scim_token";
             id: string;
@@ -530,7 +564,9 @@ declare function buildNamespaces(request: RequestFn): {
             subject_id?: string;
         }): Promise<import("./types").ListPage<import("./api-keys").ApiKey>>;
         create(body: import("./api-keys").CreateApiKeyBody, idempotencyKey?: string): Promise<import("./api-keys").ApiKeyWithSecret>;
-        verify(secret: string): Promise<import("./api-keys").ApiKeyVerification>;
+        verify(secret: string, options?: {
+            required_scopes?: string[];
+        }): Promise<import("./api-keys").ApiKeyVerification>;
         get(id: string): Promise<import("./api-keys").ApiKey>;
         update(id: string, body: import("./api-keys").UpdateApiKeyBody): Promise<import("./api-keys").ApiKey>;
         delete(id: string): Promise<{
@@ -543,6 +579,28 @@ declare function buildNamespaces(request: RequestFn): {
         mintToken(body: import("./api-keys").MintApiKeyTokenBody): Promise<import("./api-keys").ApiKeyToken>;
         listRevoked(query?: import("./api-keys").ListRevokedApiKeysQuery): Promise<import("./types").CursorPage<import("./api-keys").RevokedApiKeyRef>>;
     };
+    appRoles: {
+        list(): Promise<import("./types").ListPage<import("./app-roles").AppRole>>;
+        create(body: import("./app-roles").CreateAppRoleBody): Promise<import("./app-roles").AppRole>;
+        get(idOrKey: string): Promise<import("./app-roles").AppRole>;
+        update(idOrKey: string, body: import("./app-roles").UpdateAppRoleBody): Promise<import("./app-roles").AppRole>;
+        delete(idOrKey: string): Promise<{
+            object: "app_role";
+            id: string;
+            deleted: true;
+        }>;
+        listUsers(idOrKey: string, query?: {
+            limit?: number;
+            offset?: number;
+        }): Promise<import("./types").ListPage<{
+            object: "user_app_role";
+            user_id: string;
+            role: string;
+        }>>;
+        getForUser(userId: string): Promise<import("./app-roles").UserAppRoles>;
+        setForUser(userId: string, body: import("./app-roles").SetUserAppRolesBody): Promise<import("./app-roles").UserAppRoles>;
+        removeFromUser(userId: string, idOrKey: string): Promise<import("./app-roles").UserAppRoles>;
+    };
     machines: {
         list(query?: import("./machines").ListMachinesQuery): Promise<import("./machines").MachineListPage>;
         create(body: import("./machines").CreateMachineBody, idempotencyKey?: string): Promise<import("./machines").MachineWithSecret>;
@@ -813,6 +871,35 @@ declare function buildNamespaces(request: RequestFn): {
         getBindings(trigger: import("./actions").ActionTrigger): Promise<import("./actions").ActionBindingList>;
         setBindings(trigger: import("./actions").ActionTrigger, actionIds: string[]): Promise<import("./actions").ActionBindingList>;
     };
+    actionGallery: {
+        list(filter?: import("./action-gallery").ActionGalleryFilter): Promise<import("./types").ListPage<import("./action-gallery").ActionGalleryEntry>>;
+        get(slug: string): Promise<import("./action-gallery").ActionGalleryDetail>;
+        install(slug: string, body?: import("./action-gallery").InstallTemplateBody, idempotencyKey?: string): Promise<import("./action-gallery").ActionGalleryInstallResult>;
+        installs(): Promise<import("./types").ListPage<import("./action-gallery").ActionGalleryInstallation>>;
+        update(actionId: string, body?: {
+            secrets?: Record<string, string>;
+        }): Promise<import("./action-gallery").ActionGalleryUpdateResult>;
+    };
+    actionTemplates: {
+        list(): Promise<import("./types").ListPage<import("./action-gallery").ActionTemplate>>;
+        create(body: import("./action-gallery").CreateActionTemplateBody, idempotencyKey?: string): Promise<import("./action-gallery").ActionTemplate>;
+        get(id: string): Promise<import("./action-gallery").ActionTemplate>;
+        update(id: string, body: import("./action-gallery").ActionTemplateListing): Promise<import("./action-gallery").ActionTemplate>;
+        delete(id: string): Promise<{
+            object: "action_template";
+            id: string;
+            deleted: true;
+        }>;
+        addVersion(id: string, body: import("./action-gallery").NewTemplateVersion): Promise<import("./action-gallery").ActionTemplateVersion>;
+        submitVersion(id: string, version: string): Promise<import("./action-gallery").ActionTemplateVersion>;
+        deleteVersion(id: string, version: string): Promise<{
+            object: "action_template_version";
+            version: string;
+            deleted: true;
+        }>;
+        publish(id: string): Promise<import("./action-gallery").ActionTemplate>;
+        unlist(id: string): Promise<import("./action-gallery").ActionTemplate>;
+    };
     billing: {
         listPlans(): Promise<import("./types").ListPage<import("./billing-plans").BillingPlan>>;
         createPlan(body: import("./billing-plans").CreateBillingPlanBody, idempotencyKey?: string): Promise<import("./billing-plans").BillingPlan>;
@@ -824,6 +911,18 @@ declare function buildNamespaces(request: RequestFn): {
             deleted: true;
         }>;
         listSubscriptions(params?: import("./billing-plans").ListSubscriptionsParams): Promise<import("./types").ListPage<import("./billing-plans").BillingSubscription>>;
+        getSubscription(id: string): Promise<import("./billing-plans").BillingSubscription>;
+        changeSubscription(id: string, body: import("./billing-plans").ChangeBillingSubscriptionBody): Promise<import("./billing-plans").BillingSubscription & {
+            scheduled: boolean;
+        }>;
+        cancelSubscription(id: string, body?: {
+            immediately?: boolean;
+        }): Promise<import("./billing-plans").BillingSubscription>;
+        restoreSubscription(id: string): Promise<import("./billing-plans").BillingSubscription>;
+        syncPlanEntitlements(id: string): Promise<import("./billing-plans").BillingPlan>;
+        getSettings(): Promise<import("./billing-plans").BillingSettings>;
+        updateSettings(body: import("./billing-plans").UpdateBillingSettingsBody): Promise<import("./billing-plans").BillingSettings>;
+        checkFeature(body: import("./billing-plans").CheckBillingFeatureBody): Promise<import("./billing-plans").BillingFeatureCheck>;
         importSubscription(body: import("./billing-plans").ImportBillingSubscriptionBody, idempotencyKey?: string): Promise<import("./billing-plans").BillingSubscription>;
         reportUsage(body: import("./billing-plans").ReportBillingUsageBody): Promise<import("./billing-plans").BillingUsageReport>;
         syncSeats(subjectType: "user" | "org", subjectId: string): Promise<import("./billing-plans").BillingSeatSync>;
@@ -931,10 +1030,26 @@ declare function buildNamespaces(request: RequestFn): {
         };
     };
     instanceSecurity: {
+        listSigningKeys(): Promise<{
+            object: "list";
+            data: import("./instance-security").SigningKey[];
+        }>;
+        rotateSigningKey(body?: import("./instance-security").RotateSigningKeyBody): Promise<import("./instance-security").SigningKeyRotation>;
+        getSigningKeyProvider(): Promise<import("./instance-security").SigningKeyProviderSettings>;
+        setSigningKeyProvider(body: import("./instance-security").SetSigningKeyProviderBody): Promise<import("./instance-security").SigningKeyProviderSettings & {
+            rotation: import("./instance-security").SigningKeyRotation;
+        }>;
+        removeSigningKeyProvider(body?: import("./instance-security").RotateSigningKeyBody): Promise<{
+            object: "signing_key_provider";
+            provider: "local";
+            deleted: true;
+            rotation: import("./instance-security").SigningKeyRotation | null;
+        }>;
         get(): Promise<import("./instance-security").InstanceSecurity>;
         update(body: import("./instance-security").UpdateInstanceSecurityBody): Promise<import("./instance-security").InstanceSecurityResult>;
         setCaptchaSecret(body: {
             secret: string;
+            provider?: string;
         }): Promise<{
             object: "captcha_secret";
             provider: string;
@@ -945,6 +1060,14 @@ declare function buildNamespaces(request: RequestFn): {
             provider: string;
             deleted: true;
         }>;
+        setWalletRpcSecret(body: {
+            chain_id: number;
+            url: string;
+        }): Promise<{
+            object: "wallet_rpc_secret";
+            chain_id: number;
+            set: boolean;
+        }>;
         setKerberosSecret(body: {
             secret: string;
         }): Promise<{
@@ -1123,6 +1246,34 @@ declare function buildNamespaces(request: RequestFn): {
             data: import("./connectors").ConnectorDirectoryEntry[];
         }>;
     };
+    customOAuthProviders: {
+        list(): Promise<import("./types").ListPage<import("./custom-oauth-providers").CustomOAuthProvider>>;
+        get(id: string): Promise<import("./custom-oauth-providers").CustomOAuthProvider>;
+        create(body: import("./custom-oauth-providers").CreateCustomOAuthProviderBody, idempotencyKey?: string): Promise<import("./custom-oauth-providers").CustomOAuthProvider>;
+        update(id: string, body: import("./custom-oauth-providers").CustomOAuthProviderSettings, idempotencyKey?: string): Promise<import("./custom-oauth-providers").CustomOAuthProvider>;
+        delete(id: string): Promise<{
+            object: "custom_oauth_provider";
+            id: string;
+            provider_key: string;
+            deleted: true;
+        }>;
+        discover(body: {
+            issuer: string;
+            discovery_url?: string;
+        }): Promise<import("./custom-oauth-providers").OidcDiscoveryResult>;
+        previewProfileMapping(body: import("./custom-oauth-providers").ProfileMappingPreviewBody, id?: string): Promise<import("./custom-oauth-providers").ProfileMappingPreview>;
+        signingKeys(id: string): {
+            list(): Promise<import("./types").ListPage<import("./custom-oauth-providers").UpstreamSigningKey>>;
+            rotate(body?: {
+                alg?: "RS256" | "PS256" | "ES256";
+            }, idempotencyKey?: string): Promise<import("./custom-oauth-providers").UpstreamSigningKey>;
+            retire(kid: string): Promise<{
+                object: "upstream_signing_key";
+                kid: string;
+                status: "retired";
+            }>;
+        };
+    };
     notifications: {
         send(body: import("./notifications").SendNotificationBody, idempotencyKey?: string): Promise<import("./notifications").SentNotification>;
         categories: {
@@ -1307,6 +1458,7 @@ export * from './users';
 export * from './sessions';
 export * from './organizations';
 export * from './roles';
+export * from './app-roles';
 export * from './oauth-clients';
 export * from './resource-servers';
 export * from './sso-connections';
@@ -1338,6 +1490,7 @@ export * from './email-templates';
 export * from './sms-templates';
 export * from './localizations';
 export * from './actions';
+export * from './action-gallery';
 export * from './billing-plans';
 export * from './messaging';
 export * from './import-export';
@@ -1357,6 +1510,7 @@ export * from './organization-settings-schema';
 export * from './email-addresses';
 export * from './openfga';
 export * from './connectors';
+export * from './custom-oauth-providers';
 export * from './notifications';
 export * from './audit-events';
 export * from './activity';