@atlasauth/backend 0.14.1 → 0.16.0

package/dist/client/index.js

@@ -36,6 +36,7 @@ const sign_in_tokens_1 = require("./sign-in-tokens");
 const audit_logs_1 = require("./audit-logs");
 const jwt_templates_1 = require("./jwt-templates");
 const api_keys_1 = require("./api-keys");
+const app_roles_1 = require("./app-roles");
 const machines_1 = require("./machines");
 const oauth_providers_1 = require("./oauth-providers");
 const sso_onboarding_1 = require("./sso-onboarding");
@@ -52,6 +53,7 @@ const email_templates_1 = require("./email-templates");
 const sms_templates_1 = require("./sms-templates");
 const localizations_1 = require("./localizations");
 const actions_1 = require("./actions");
+const action_gallery_1 = require("./action-gallery");
 const billing_plans_1 = require("./billing-plans");
 const messaging_1 = require("./messaging");
 const import_export_1 = require("./import-export");
@@ -71,6 +73,7 @@ const organization_settings_schema_1 = require("./organization-settings-schema")
 const email_addresses_1 = require("./email-addresses");
 const openfga_1 = require("./openfga");
 const connectors_1 = require("./connectors");
+const custom_oauth_providers_1 = require("./custom-oauth-providers");
 const notifications_1 = require("./notifications");
 const audit_events_1 = require("./audit-events");
 const activity_1 = require("./activity");
@@ -124,6 +127,8 @@ function buildNamespaces(request) {
         auditLogs: (0, audit_logs_1.auditLogsResource)(request),
         jwtTemplates: (0, jwt_templates_1.jwtTemplatesResource)(request),
         apiKeys: (0, api_keys_1.apiKeysResource)(request),
+        // App-level (instance-wide) user roles and permissions.
+        appRoles: (0, app_roles_1.appRolesResource)(request),
         // §9.3 / §P1-7 named machine identities + device registry + enrolment tokens.
         machines: (0, machines_1.machinesResource)(request),
         oauthProviders: (0, oauth_providers_1.oauthProvidersResource)(request),
@@ -141,6 +146,8 @@ function buildNamespaces(request) {
         smsTemplates: (0, sms_templates_1.smsTemplatesResource)(request),
         localizations: (0, localizations_1.localizationsResource)(request),
         actions: (0, actions_1.actionsResource)(request),
+        actionGallery: (0, action_gallery_1.actionGalleryResource)(request),
+        actionTemplates: (0, action_gallery_1.actionTemplatesResource)(request),
         billing: (0, billing_plans_1.billingResource)(request),
         messaging: (0, messaging_1.messagingResource)(request),
         importExport: (0, import_export_1.importExportResource)(request),
@@ -166,6 +173,7 @@ function buildNamespaces(request) {
         // OpenFGA-wire ReBAC stores, models and tuples.
         openfga: (0, openfga_1.openfgaResource)(request),
         connectors: (0, connectors_1.connectorsResource)(request),
+        customOAuthProviders: (0, custom_oauth_providers_1.customOAuthProvidersResource)(request),
         notifications: (0, notifications_1.notificationsResource)(request),
         // The tenant's own custom audit events (distinct from Atlas's auditLogs).
         auditEvents: (0, audit_events_1.auditEventsResource)(request),
@@ -203,6 +211,7 @@ __exportStar(require("./users"), exports);
 __exportStar(require("./sessions"), exports);
 __exportStar(require("./organizations"), exports);
 __exportStar(require("./roles"), exports);
+__exportStar(require("./app-roles"), exports);
 __exportStar(require("./oauth-clients"), exports);
 __exportStar(require("./resource-servers"), exports);
 __exportStar(require("./sso-connections"), exports);
@@ -234,6 +243,7 @@ __exportStar(require("./email-templates"), exports);
 __exportStar(require("./sms-templates"), exports);
 __exportStar(require("./localizations"), exports);
 __exportStar(require("./actions"), exports);
+__exportStar(require("./action-gallery"), exports);
 __exportStar(require("./billing-plans"), exports);
 __exportStar(require("./messaging"), exports);
 __exportStar(require("./import-export"), exports);
@@ -253,6 +263,7 @@ __exportStar(require("./organization-settings-schema"), exports);
 __exportStar(require("./email-addresses"), exports);
 __exportStar(require("./openfga"), exports);
 __exportStar(require("./connectors"), exports);
+__exportStar(require("./custom-oauth-providers"), exports);
 __exportStar(require("./notifications"), exports);
 __exportStar(require("./audit-events"), exports);
 __exportStar(require("./activity"), exports);

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA8EA,8CAQC;AAtFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,2CAAgD;AAChD,6CAAiD;AACjD,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,kFAAkF;QAClF,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,yEAAyE;QACzE,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,8CAA4B;AAC5B,+CAA6B;AAC7B,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAiFA,8CAQC;AAzFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,2CAA+C;AAC/C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,qDAAkF;AAClF,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,2CAAgD;AAChD,6CAAiD;AACjD,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,qEAAwE;AACxE,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,wDAAwD;QACxD,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,eAAe,EAAE,IAAA,wCAAuB,EAAC,OAAO,CAAC;QACjD,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,kFAAkF;QAClF,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,yEAAyE;QACzE,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,oBAAoB,EAAE,IAAA,qDAA4B,EAAC,OAAO,CAAC;QAC3D,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,8CAA4B;AAC5B,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,8CAA4B;AAC5B,+CAA6B;AAC7B,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,2DAAyC;AACzC,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}

package/dist/client/instance-security.d.ts

@@ -63,12 +63,103 @@ export interface CreateProxySecretBody {
 export interface InstanceSecurityResult extends InstanceSecurity {
     warning?: string;
 }
+/** One published instance signing key (`GET /v1/instance/signing_keys`). */
+export interface SigningKey {
+    object: 'signing_key';
+    kid: string;
+    alg: 'RS256' | 'ES256' | string;
+    status: 'current' | 'previous';
+    /** `main` signs every token; `secondary` signs access tokens for APIs set to the other algorithm. */
+    role: 'main' | 'secondary';
+    /** When a previous key leaves the JWKS (epoch ms); null for a current key. */
+    retires_at: number | null;
+    /** On the current main key: `local`, or the KMS that holds its private half. */
+    provider?: 'local' | SigningKeyProviderKind;
+}
+/** The cloud key management services a signing key can live in. */
+export type SigningKeyProviderKind = 'aws_kms' | 'gcp_kms' | 'azure_key_vault';
+/** The instance's key management service (`GET /v1/instance/signing_key_provider`). Never carries credentials. */
+export interface SigningKeyProviderSettings {
+    object: 'signing_key_provider';
+    id?: string;
+    provider: 'local' | SigningKeyProviderKind;
+    /** The non-secret settings (region, key / key ring / vault, algorithm). Null for `local`. */
+    config: Record<string, unknown> | null;
+    /** True when the current main key is in this KMS. */
+    active: boolean;
+    /** The KMS key version tokens are signed with (ARN, resource name or key id). */
+    key_version: string | null;
+    last_verified_at?: number | null;
+    created_at?: number;
+    updated_at?: number;
+}
+/**
+ * Switch signing to a key in your own KMS. Config and credentials per provider:
+ *  - `aws_kms`: config `{ region, key_id?, alg? }`, credentials `{ access_key_id, secret_access_key, session_token? }`
+ *  - `gcp_kms`: config `{ crypto_key, key_version? }`, credentials `{ service_account_json }` (the key file)
+ *  - `azure_key_vault`: config `{ vault_url, key_name, key_version?, alg? }`, credentials `{ tenant_id, client_id, client_secret }`
+ * Without a key id / version Atlas creates a new key version in the KMS. Add
+ * `config.secondary` for a second key of the other algorithm (aws: `{ alg, key_id? }`;
+ * gcp: `{ crypto_key, key_version? }`; azure: `{ key_name, key_version?, alg }`).
+ */
+export interface SetSigningKeyProviderBody {
+    provider: SigningKeyProviderKind;
+    config: Record<string, unknown>;
+    credentials: Record<string, unknown>;
+    /** How long the previous key stays published (default 86400, at most 2592000). */
+    grace_period_seconds?: number;
+    /** Publish only the new key now. */
+    emergency?: boolean;
+}
+export interface RotateSigningKeyBody {
+    /** How long the previous key stays published (default 86400, at most 2592000). */
+    grace_period_seconds?: number;
+    /** Publish only the new key now (suspected compromise). */
+    emergency?: boolean;
+    /** The new main key's algorithm; omit to keep the current one. */
+    alg?: 'RS256' | 'ES256';
+    /** With keys in a key management service: rotate only the `main` or the `secondary` key (default both). */
+    key?: 'main' | 'secondary';
+}
+export interface SigningKeyRotation {
+    object: 'signing_key_rotation';
+    kid: string;
+    alg: 'RS256' | 'ES256';
+    previous_kid: string | null;
+    previous_retires_at: number | null;
+    emergency: boolean;
+    /** Where the key lives (`local` or the key management service). */
+    provider?: 'local' | SigningKeyProviderKind;
+    /** With keys in a key management service: the current second-algorithm key, if configured. */
+    secondary_kid?: string | null;
+}
 export declare function instanceSecurityResource(request: RequestFn): {
+    /** The published token-signing keys, newest first. */
+    listSigningKeys(): Promise<{
+        object: "list";
+        data: SigningKey[];
+    }>;
+    /** Rotate the signing key (optionally switching between RS256 and ES256). */
+    rotateSigningKey(body?: RotateSigningKeyBody): Promise<SigningKeyRotation>;
+    /** The key management service the signing key lives in (`local` when none). */
+    getSigningKeyProvider(): Promise<SigningKeyProviderSettings>;
+    /** Sign every token with a key in your own AWS KMS, Google Cloud KMS or Azure Key Vault. */
+    setSigningKeyProvider(body: SetSigningKeyProviderBody): Promise<SigningKeyProviderSettings & {
+        rotation: SigningKeyRotation;
+    }>;
+    /** Stop using the KMS: rotate back to a key Atlas holds and forget the credentials. */
+    removeSigningKeyProvider(body?: RotateSigningKeyBody): Promise<{
+        object: "signing_key_provider";
+        provider: "local";
+        deleted: true;
+        rotation: SigningKeyRotation | null;
+    }>;
     get(): Promise<InstanceSecurity>;
     update(body: UpdateInstanceSecurityBody): Promise<InstanceSecurityResult>;
     /** Store the captcha provider secret. Refused while the provider is `none`. */
     setCaptchaSecret(body: {
         secret: string;
+        provider?: string;
     }): Promise<{
         object: "captcha_secret";
         provider: string;
@@ -79,6 +170,19 @@ export declare function instanceSecurityResource(request: RequestFn): {
         provider: string;
         deleted: true;
     }>;
+    /**
+     * Store (write-only, encrypted) the wallet RPC endpoint for an EIP-155 chain
+     * — used by wallet token gating and the Sign in with Ethereum ENS lookup. An
+     * empty url removes it. The URL is never returned.
+     */
+    setWalletRpcSecret(body: {
+        chain_id: number;
+        url: string;
+    }): Promise<{
+        object: "wallet_rpc_secret";
+        chain_id: number;
+        set: boolean;
+    }>;
     /** Store the Kerberos/IWA trusted-proxy secret. Refused while the strategy is off. */
     setKerberosSecret(body: {
         secret: string;

package/dist/client/instance-security.js

@@ -4,6 +4,26 @@ exports.instanceSecurityResource = instanceSecurityResource;
 const request_1 = require("./request");
 function instanceSecurityResource(request) {
     return {
+        /** The published token-signing keys, newest first. */
+        listSigningKeys() {
+            return request({ method: 'GET', path: '/v1/instance/signing_keys' });
+        },
+        /** Rotate the signing key (optionally switching between RS256 and ES256). */
+        rotateSigningKey(body = {}) {
+            return request({ method: 'POST', path: '/v1/instance/signing_keys/rotate', body });
+        },
+        /** The key management service the signing key lives in (`local` when none). */
+        getSigningKeyProvider() {
+            return request({ method: 'GET', path: '/v1/instance/signing_key_provider' });
+        },
+        /** Sign every token with a key in your own AWS KMS, Google Cloud KMS or Azure Key Vault. */
+        setSigningKeyProvider(body) {
+            return request({ method: 'PUT', path: '/v1/instance/signing_key_provider', body });
+        },
+        /** Stop using the KMS: rotate back to a key Atlas holds and forget the credentials. */
+        removeSigningKeyProvider(body = {}) {
+            return request({ method: 'DELETE', path: '/v1/instance/signing_key_provider', body });
+        },
         get() {
             return request({ method: 'GET', path: '/v1/instance/security' });
         },
@@ -17,6 +37,14 @@ function instanceSecurityResource(request) {
         deleteCaptchaSecret() {
             return request({ method: 'DELETE', path: '/v1/instance/captcha_secret' });
         },
+        /**
+         * Store (write-only, encrypted) the wallet RPC endpoint for an EIP-155 chain
+         * — used by wallet token gating and the Sign in with Ethereum ENS lookup. An
+         * empty url removes it. The URL is never returned.
+         */
+        setWalletRpcSecret(body) {
+            return request({ method: 'PUT', path: '/v1/instance/wallet_rpc_secret', body });
+        },
         /** Store the Kerberos/IWA trusted-proxy secret. Refused while the strategy is off. */
         setKerberosSecret(body) {
             return request({ method: 'PUT', path: '/v1/instance/kerberos_secret', body });

package/dist/client/instance-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;AA0EA,4DA6DC;AAvID,uCAAgD;AA0EhD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,+EAA+E;QAC/E,gBAAgB,CACd,IAAwB;YAExB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,sFAAsF;QACtF,iBAAiB,CAAC,IAAwB;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,oBAAoB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,wEAAwE;QACxE,cAAc;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,iHAAiH;QACjH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,qEAAqE;QACrE,iBAAiB;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED;oEAC4D;QAC5D,mBAAmB,CACjB,YAAoB,EACpB,IAA+B;YAE/B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;gBACxE,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,sBAAsB,CACpB,YAAoB;YAEpB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;AAsJA,4DAgGC;AAtPD,uCAAgD;AAsJhD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,sDAAsD;QACtD,eAAe;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,6EAA6E;QAC7E,gBAAgB,CAAC,OAA6B,EAAE;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,+EAA+E;QAC/E,qBAAqB;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,4FAA4F;QAC5F,qBAAqB,CACnB,IAA+B;YAE/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,uFAAuF;QACvF,wBAAwB,CACtB,OAA6B,EAAE;YAE/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,+EAA+E;QAC/E,gBAAgB,CACd,IAA2C;YAE3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;;WAIG;QACH,kBAAkB,CAAC,IAGlB;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,sFAAsF;QACtF,iBAAiB,CAAC,IAAwB;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,oBAAoB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,wEAAwE;QACxE,cAAc;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,iHAAiH;QACjH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,qEAAqE;QACrE,iBAAiB;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED;oEAC4D;QAC5D,mBAAmB,CACjB,YAAoB,EACpB,IAA+B;YAE/B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;gBACxE,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,sBAAsB,CACpB,YAAoB;YAEpB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/notifications.d.ts

@@ -1,6 +1,6 @@
 import { type RequestFn } from './request';
 /** Built-in notification templates `send` falls back to when no tenant template has the name. */
-export type BuiltInNotificationTemplate = 'new_device' | 'unattended_access' | 'password_changed' | 'mfa_changed';
+export type BuiltInNotificationTemplate = 'new_device' | 'unattended_access' | 'password_changed' | 'mfa_changed' | 'email_changed';
 export interface SendNotificationBody {
     /** The end-user to notify. */
     user_id: string;

package/dist/client/notifications.js.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/client/notifications.ts"],"names":[],"mappings":";;AAiEA,sDAqDC;AAtHD,uCAAgD;AAiEhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,2FAA2F;QAC3F,IAAI,CAAC,IAA0B,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAuB;gBACzC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,MAAM,CACJ,GAAW;gBAEX,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,iCAAiC;YACjC,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAAY;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,IAAY,EAAE,IAAoC;gBACvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAAY;gBAEZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/client/notifications.ts"],"names":[],"mappings":";;AAkEA,sDAqDC;AAvHD,uCAAgD;AAkEhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,2FAA2F;QAC3F,IAAI,CAAC,IAA0B,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAuB;gBACzC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,MAAM,CACJ,GAAW;gBAEX,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,iCAAiC;YACjC,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAAY;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,IAAY,EAAE,IAAoC;gBACvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAAY;gBAEZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/oauth-clients.d.ts

@@ -34,9 +34,73 @@ export interface OAuthClient {
      * with no "Sign out?" page. First-party clients only.
      */
     skip_logout_confirmation?: boolean;
+    /** Refused at every OAuth endpoint while true (kept, not deleted). */
+    disabled?: boolean;
+    /** PKCE required even though the client is confidential. */
+    require_pkce?: boolean;
+    /** OIDC Core §8: `pairwise` clients see a per-sector `sub` instead of the user id. */
+    subject_type?: 'public' | 'pairwise';
+    sector_identifier_uri?: string | null;
+    /** When the current secret stops authenticating (epoch ms); null = never. */
+    client_secret_expires_at?: number | null;
+    /** `jwt` or `opaque` access tokens for this client; null = inherited from the API / instance. */
+    access_token_format?: AccessTokenFormat | null;
+    /** This client's token lifetime overrides (seconds); a null field is inherited. */
+    token_lifetimes?: OAuthTokenLifetimes;
     created_at: number;
     updated_at: number;
 }
+/** Signed JWT access tokens, or opaque references validated by introspection. */
+export type AccessTokenFormat = 'jwt' | 'opaque';
+/**
+ * Token lifetimes in seconds. A field left out (or null) inherits the API's,
+ * then the instance's, then Atlas's default. Bounds: access / id token 60–86400;
+ * refresh token 300–31536000 (idle ≤ absolute); authorization code 10–600;
+ * device code 60–1800.
+ */
+export interface OAuthTokenLifetimes {
+    access_token_ttl_seconds?: number | null;
+    id_token_ttl_seconds?: number | null;
+    refresh_token_absolute_ttl_seconds?: number | null;
+    refresh_token_idle_ttl_seconds?: number | null;
+    authorization_code_ttl_seconds?: number | null;
+    device_code_ttl_seconds?: number | null;
+}
+/** Access-token format and lifetimes, accepted on create and update. */
+export interface OAuthClientTokenFields {
+    /** `jwt` or `opaque`; null inherits. */
+    access_token_format?: AccessTokenFormat | null;
+    /** Replaces the overrides; null clears them all. */
+    token_lifetimes?: OAuthTokenLifetimes | null;
+}
+/** OIDC Core §8 subject settings, accepted on create and update. */
+export interface OAuthClientSubjectFields {
+    /** `public` (default): the user id. `pairwise`: a per-sector identifier. */
+    subject_type?: 'public' | 'pairwise';
+    /** https URL serving a JSON array of every redirect URI; its host is the sector. `null` clears it. */
+    sector_identifier_uri?: string | null;
+}
+/** An RFC 7591 §3 initial access token for dynamic client registration. */
+export interface OAuthInitialAccessToken {
+    object: 'oauth_initial_access_token';
+    id: string;
+    token_prefix: string;
+    description: string | null;
+    status: 'active' | 'expired' | 'used_up' | 'revoked';
+    max_uses: number | null;
+    use_count: number;
+    expires_at: number | null;
+    revoked_at: number | null;
+    last_used_at: number | null;
+    created_at: number;
+}
+export interface CreateInitialAccessTokenBody {
+    description?: string;
+    /** Lifetime in seconds (60 – 31536000); omit for no expiry. */
+    expires_in_seconds?: number;
+    /** Registrations allowed (1 – 1000000); omit for unlimited. */
+    max_uses?: number;
+}
 /**
  * OIDC logout registration (RP-Initiated, Back-Channel and Front-Channel
  * Logout), accepted on create and update. On update, `null` clears a URI and
@@ -62,6 +126,8 @@ export interface RotateOAuthClientSecretBody {
      * hours); 0 revokes it now (after a leak); at most 604800 (7 days).
      */
     overlap_seconds?: number;
+    /** How long the NEW secret authenticates, in seconds; omit for no expiry. */
+    secret_expires_in_seconds?: number;
 }
 /** The rotate response: the new secret (shown once) and when the old one stops working. */
 export interface OAuthClientSecretRotation extends OAuthClientWithSecret {
@@ -81,7 +147,7 @@ export interface ClientGrant {
     created_at: number;
     updated_at: number;
 }
-export interface CreateOAuthClientBody extends OAuthClientLogoutFields {
+export interface CreateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields, OAuthClientTokenFields {
     name: string;
     redirect_uris: string[];
     allowed_scopes?: string[];
@@ -89,14 +155,20 @@ export interface CreateOAuthClientBody extends OAuthClientLogoutFields {
     token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
     logo_url?: string;
     first_party?: boolean;
+    /** How long the issued secret authenticates, in seconds; omit for no expiry. */
+    secret_expires_in_seconds?: number;
 }
-export interface UpdateOAuthClientBody extends OAuthClientLogoutFields {
+export interface UpdateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields, OAuthClientTokenFields {
     name?: string;
     redirect_uris?: string[];
     allowed_scopes?: string[];
     token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
     logo_url?: string | null;
     first_party?: boolean;
+    /** Refuse every OAuth flow for this client without deleting it. */
+    disabled?: boolean;
+    /** Require PKCE for this confidential client too. */
+    require_pkce?: boolean;
 }
 /** One client in a migration import. Idempotent per `client_id`. */
 export interface ImportOAuthClientEntry {
@@ -197,6 +269,16 @@ export declare function oauthClientsResource(request: RequestFn): {
     listBackchannelDeliveries(id: string, query?: BackchannelDeliveriesQuery): Promise<BackchannelLogoutDeliveryPage>;
     /** Send a test back-channel logout now and return what the receiver answered. */
     testBackchannelLogout(id: string): Promise<BackchannelLogoutTest>;
+    /** RFC 7591 §3 initial access tokens for dynamic client registration. */
+    initialAccessTokens: {
+        list(): Promise<ListPage<OAuthInitialAccessToken>>;
+        /** The `token` is in this response only. */
+        create(body?: CreateInitialAccessTokenBody): Promise<OAuthInitialAccessToken & {
+            token: string;
+            note: string;
+        }>;
+        revoke(id: string): Promise<OAuthInitialAccessToken>;
+    };
     grants: {
         list(clientId: string): Promise<ListPage<ClientGrant>>;
         create(clientId: string, body: {

package/dist/client/oauth-clients.js

@@ -47,6 +47,19 @@ function oauthClientsResource(request) {
         testBackchannelLogout(id) {
             return request({ method: 'POST', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/backchannel_logout/test` });
         },
+        /** RFC 7591 §3 initial access tokens for dynamic client registration. */
+        initialAccessTokens: {
+            list() {
+                return request({ method: 'GET', path: '/v1/oauth_initial_access_tokens' });
+            },
+            /** The `token` is in this response only. */
+            create(body = {}) {
+                return request({ method: 'POST', path: '/v1/oauth_initial_access_tokens', body });
+            },
+            revoke(id) {
+                return request({ method: 'DELETE', path: `/v1/oauth_initial_access_tokens/${(0, request_1.enc)(id)}` });
+            },
+        },
         grants: {
             list(clientId) {
                 return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/grants` });

package/dist/client/oauth-clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA8LA,oDAiFC;AA/QD,uCAAgD;AA8LhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA4QA,oDA+FC;AA3WD,uCAAgD;AA4QhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/referrals.d.ts

@@ -12,7 +12,7 @@ import type { UserReferralResult } from './users';
  *
  * `provider` is `webhook` (the Atlas referral protocol, which any platform can
  * implement; see {@link verifyReferralRequest}), `referally` (the built-in
- * Referally adapter: `endpoint_url` is your Referally base URL, plus
+ * Referalli adapter: `endpoint_url` is your Referalli base URL, plus
  * `connection_id`, `signing_secret` and optionally `tracking_token`) or
  * another built-in vendor adapter.
  * `signing_secret`, `api_key` and `inbound_secret` are write-only: reads

package/dist/client/resource-servers.d.ts

@@ -11,23 +11,52 @@ export interface ResourceServer {
     name: string;
     scopes: ResourceServerScope[];
     token_ttl_seconds: number;
-    signing_alg: string;
+    /** RS256 (default) or ES256: the algorithm of this API's access tokens. */
+    signing_alg: 'RS256' | 'ES256' | string;
+    /** RFC 9728: Atlas serves protected-resource metadata for this API. */
+    publish_resource_metadata?: boolean;
+    /** `jwt` or `opaque` access tokens for this API; null = inherited from the client / instance. */
+    access_token_format?: 'jwt' | 'opaque' | null;
+    /** Refresh-token lifetimes for grants issued for this API (seconds); null = inherited. */
+    refresh_token_absolute_ttl_seconds?: number | null;
+    refresh_token_idle_ttl_seconds?: number | null;
+    /** client_ids of the confidential clients allowed to introspect this API's tokens. */
+    introspection_client_ids?: string[];
     created_at: number;
     updated_at: number;
 }
-export interface CreateResourceServerBody {
+/** Token settings an API can carry (create and update). */
+export interface ResourceServerTokenFields {
+    /** The access-token lifetime, 60–86400 seconds. */
+    token_ttl_seconds?: number;
+    /** `jwt` or `opaque`; null inherits. */
+    access_token_format?: 'jwt' | 'opaque' | null;
+    /** 300–31536000 seconds; null inherits. */
+    refresh_token_absolute_ttl_seconds?: number | null;
+    /** 300–31536000 seconds, at most the absolute lifetime; null inherits. */
+    refresh_token_idle_ttl_seconds?: number | null;
+    /** client_ids of confidential clients (e.g. this API's backend) that may introspect its tokens. */
+    introspection_client_ids?: string[];
+}
+export interface CreateResourceServerBody extends ResourceServerTokenFields {
     identifier: string;
     name: string;
     /** Each scope is a bare string or `{ value, description? }`. */
     scopes?: Array<string | ResourceServerScope>;
     token_ttl_seconds?: number;
-    signing_alg?: string;
+    /** RS256 (default) or ES256. */
+    signing_alg?: 'RS256' | 'ES256';
+    /** RFC 9728: serve protected-resource metadata for this API. */
+    publish_resource_metadata?: boolean;
 }
-export interface UpdateResourceServerBody {
+export interface UpdateResourceServerBody extends ResourceServerTokenFields {
     name?: string;
     scopes?: Array<string | ResourceServerScope>;
     token_ttl_seconds?: number;
-    signing_alg?: string;
+    /** RS256 (default) or ES256. */
+    signing_alg?: 'RS256' | 'ES256';
+    /** RFC 9728: serve protected-resource metadata for this API. */
+    publish_resource_metadata?: boolean;
     /** Immutable — supplying a different value is rejected. */
     identifier?: string;
 }

package/dist/client/resource-servers.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-servers.js","sourceRoot":"","sources":["../../src/client/resource-servers.ts"],"names":[],"mappings":";;AAsCA,0DAkBC;AAxDD,uCAAgD;AAsChD,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAA8B;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA8B;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resource-servers.js","sourceRoot":"","sources":["../../src/client/resource-servers.ts"],"names":[],"mappings":";;AAoEA,0DAkBC;AAtFD,uCAAgD;AAoEhD,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAA8B;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA8B;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/risk-based-mfa.d.ts

@@ -10,6 +10,8 @@ export interface RiskWeights {
     newIp: number;
     velocity: number;
     impossibleTravel: number;
+    /** The account was idle past the dormant-account threshold before this sign-in. */
+    dormantAccount?: number;
 }
 /** Per-signal on/off toggles. A disabled signal contributes nothing. */
 export interface RiskSignalToggles {
@@ -18,6 +20,7 @@ export interface RiskSignalToggles {
     newIp: boolean;
     velocity: boolean;
     impossibleTravel: boolean;
+    dormantAccount?: boolean;
 }
 /**
  * Adaptive / risk-based MFA config (Auth0 "Adaptive MFA" parity). OFF by

package/dist/client/risk-based-mfa.js.map

@@ -1 +1 @@
-{"version":3,"file":"risk-based-mfa.js","sourceRoot":"","sources":["../../src/client/risk-based-mfa.ts"],"names":[],"mappings":";;AAoDA,oDAWC;AAfD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4CAA4C;QAC5C,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,0EAA0E;QAC1E,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"risk-based-mfa.js","sourceRoot":"","sources":["../../src/client/risk-based-mfa.ts"],"names":[],"mappings":";;AAuDA,oDAWC;AAfD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4CAA4C;QAC5C,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,0EAA0E;QAC1E,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/scim-tokens.d.ts

@@ -7,6 +7,10 @@ export interface ScimToken {
     organization_id: string;
     connection_id: string | null;
     prefix: string;
+    /** null = read and write; ['read'] = read-only. */
+    scopes?: Array<'read' | 'write'> | null;
+    /** SCIM user roles[].value → organization role key. */
+    role_mappings?: ScimRoleMapping[];
     last_used_at: number | null;
     expires_at: number | null;
     revoked_at: number | null;
@@ -17,14 +21,28 @@ export interface ScimTokenWithSecret extends ScimToken {
     secret: string;
     note: string;
 }
+export interface ScimRoleMapping {
+    value: string;
+    role: string;
+}
 export interface CreateScimTokenBody {
     organization_id: string;
     name?: string;
     connection_id?: string;
+    /** ['read'] mints a read-only token. */
+    scopes?: Array<'read' | 'write'>;
+    role_mappings?: ScimRoleMapping[];
+}
+export interface UpdateScimTokenBody {
+    name?: string | null;
+    scopes?: Array<'read' | 'write'> | null;
+    role_mappings?: ScimRoleMapping[] | null;
 }
 export declare function scimTokensResource(request: RequestFn): {
     list(): Promise<ListPage<ScimToken>>;
     create(body: CreateScimTokenBody, idempotencyKey?: string): Promise<ScimTokenWithSecret>;
+    /** Change a token's name, scopes or role mappings. */
+    update(id: string, body: UpdateScimTokenBody): Promise<ScimToken>;
     revoke(id: string): Promise<{
         object: "scim_token";
         id: string;

package/dist/client/scim-tokens.js

@@ -10,6 +10,10 @@ function scimTokensResource(request) {
         create(body, idempotencyKey) {
             return request({ method: 'POST', path: '/v1/scim_tokens', body, idempotencyKey });
         },
+        /** Change a token's name, scopes or role mappings. */
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/scim_tokens/${(0, request_1.enc)(id)}`, body });
+        },
         revoke(id) {
             return request({ method: 'POST', path: `/v1/scim_tokens/${(0, request_1.enc)(id)}/revoke` });
         },

package/dist/client/scim-tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.js","sourceRoot":"","sources":["../../src/client/scim-tokens.ts"],"names":[],"mappings":";;AA4BA,gDAcC;AA1CD,uCAAgD;AA4BhD,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAyB,EAAE,cAAuB;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CACJ,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scim-tokens.js","sourceRoot":"","sources":["../../src/client/scim-tokens.ts"],"names":[],"mappings":";;AA8CA,gDAkBC;AAhED,uCAAgD;AA8ChD,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAyB,EAAE,cAAuB;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,sDAAsD;QACtD,MAAM,CAAC,EAAU,EAAE,IAAyB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CACJ,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}