@atlasauth/backend 0.15.0 → 0.16.0

package/dist/client/index.d.ts

@@ -180,6 +180,8 @@ declare function buildNamespaces(request: RequestFn): {
             id: string;
             status: "revoked";
         }>;
+        setCustomData(id: string, customData: Record<string, unknown> | null): Promise<import("./sessions").Session>;
+        updateCustomData(id: string, patch: Record<string, unknown>): Promise<import("./sessions").Session>;
         touch(id: string): Promise<import("./sessions").TouchedSession>;
         getToken(id: string, template: string): Promise<import("./sessions").SessionTemplateToken>;
     };
@@ -403,7 +405,23 @@ declare function buildNamespaces(request: RequestFn): {
             id: string;
             deleted: true;
         }>;
+        previewProfileMapping(id: string, body: import("./custom-oauth-providers").ProfileMappingPreviewBody): Promise<import("./custom-oauth-providers").ProfileMappingPreview>;
+        signingKeys(id: string): {
+            list(): Promise<import("./types").ListPage<import("./custom-oauth-providers").UpstreamSigningKey>>;
+            rotate(body?: {
+                alg?: "RS256" | "PS256" | "ES256";
+            }, idempotencyKey?: string): Promise<import("./custom-oauth-providers").UpstreamSigningKey>;
+            retire(kid: string): Promise<{
+                object: "upstream_signing_key";
+                kid: string;
+                status: "retired";
+            }>;
+        };
         samlMetadata(id: string): Promise<import("./sso-connections").SamlMetadata>;
+        getSamlEncryptionKey(id: string): Promise<import("./sso-connections").SamlEncryptionKey>;
+        createSamlEncryptionKey(id: string, idempotencyKey?: string): Promise<import("./sso-connections").SamlEncryptionKey>;
+        retirePreviousSamlEncryptionKey(id: string): Promise<import("./sso-connections").SamlEncryptionKey>;
+        deleteSamlEncryptionKey(id: string): Promise<import("./sso-connections").SamlEncryptionKey>;
     };
     scimTokens: {
         list(): Promise<import("./types").ListPage<import("./scim-tokens").ScimToken>>;
@@ -853,6 +871,35 @@ declare function buildNamespaces(request: RequestFn): {
         getBindings(trigger: import("./actions").ActionTrigger): Promise<import("./actions").ActionBindingList>;
         setBindings(trigger: import("./actions").ActionTrigger, actionIds: string[]): Promise<import("./actions").ActionBindingList>;
     };
+    actionGallery: {
+        list(filter?: import("./action-gallery").ActionGalleryFilter): Promise<import("./types").ListPage<import("./action-gallery").ActionGalleryEntry>>;
+        get(slug: string): Promise<import("./action-gallery").ActionGalleryDetail>;
+        install(slug: string, body?: import("./action-gallery").InstallTemplateBody, idempotencyKey?: string): Promise<import("./action-gallery").ActionGalleryInstallResult>;
+        installs(): Promise<import("./types").ListPage<import("./action-gallery").ActionGalleryInstallation>>;
+        update(actionId: string, body?: {
+            secrets?: Record<string, string>;
+        }): Promise<import("./action-gallery").ActionGalleryUpdateResult>;
+    };
+    actionTemplates: {
+        list(): Promise<import("./types").ListPage<import("./action-gallery").ActionTemplate>>;
+        create(body: import("./action-gallery").CreateActionTemplateBody, idempotencyKey?: string): Promise<import("./action-gallery").ActionTemplate>;
+        get(id: string): Promise<import("./action-gallery").ActionTemplate>;
+        update(id: string, body: import("./action-gallery").ActionTemplateListing): Promise<import("./action-gallery").ActionTemplate>;
+        delete(id: string): Promise<{
+            object: "action_template";
+            id: string;
+            deleted: true;
+        }>;
+        addVersion(id: string, body: import("./action-gallery").NewTemplateVersion): Promise<import("./action-gallery").ActionTemplateVersion>;
+        submitVersion(id: string, version: string): Promise<import("./action-gallery").ActionTemplateVersion>;
+        deleteVersion(id: string, version: string): Promise<{
+            object: "action_template_version";
+            version: string;
+            deleted: true;
+        }>;
+        publish(id: string): Promise<import("./action-gallery").ActionTemplate>;
+        unlist(id: string): Promise<import("./action-gallery").ActionTemplate>;
+    };
     billing: {
         listPlans(): Promise<import("./types").ListPage<import("./billing-plans").BillingPlan>>;
         createPlan(body: import("./billing-plans").CreateBillingPlanBody, idempotencyKey?: string): Promise<import("./billing-plans").BillingPlan>;
@@ -864,6 +911,18 @@ declare function buildNamespaces(request: RequestFn): {
             deleted: true;
         }>;
         listSubscriptions(params?: import("./billing-plans").ListSubscriptionsParams): Promise<import("./types").ListPage<import("./billing-plans").BillingSubscription>>;
+        getSubscription(id: string): Promise<import("./billing-plans").BillingSubscription>;
+        changeSubscription(id: string, body: import("./billing-plans").ChangeBillingSubscriptionBody): Promise<import("./billing-plans").BillingSubscription & {
+            scheduled: boolean;
+        }>;
+        cancelSubscription(id: string, body?: {
+            immediately?: boolean;
+        }): Promise<import("./billing-plans").BillingSubscription>;
+        restoreSubscription(id: string): Promise<import("./billing-plans").BillingSubscription>;
+        syncPlanEntitlements(id: string): Promise<import("./billing-plans").BillingPlan>;
+        getSettings(): Promise<import("./billing-plans").BillingSettings>;
+        updateSettings(body: import("./billing-plans").UpdateBillingSettingsBody): Promise<import("./billing-plans").BillingSettings>;
+        checkFeature(body: import("./billing-plans").CheckBillingFeatureBody): Promise<import("./billing-plans").BillingFeatureCheck>;
         importSubscription(body: import("./billing-plans").ImportBillingSubscriptionBody, idempotencyKey?: string): Promise<import("./billing-plans").BillingSubscription>;
         reportUsage(body: import("./billing-plans").ReportBillingUsageBody): Promise<import("./billing-plans").BillingUsageReport>;
         syncSeats(subjectType: "user" | "org", subjectId: string): Promise<import("./billing-plans").BillingSeatSync>;
@@ -976,10 +1035,21 @@ declare function buildNamespaces(request: RequestFn): {
             data: import("./instance-security").SigningKey[];
         }>;
         rotateSigningKey(body?: import("./instance-security").RotateSigningKeyBody): Promise<import("./instance-security").SigningKeyRotation>;
+        getSigningKeyProvider(): Promise<import("./instance-security").SigningKeyProviderSettings>;
+        setSigningKeyProvider(body: import("./instance-security").SetSigningKeyProviderBody): Promise<import("./instance-security").SigningKeyProviderSettings & {
+            rotation: import("./instance-security").SigningKeyRotation;
+        }>;
+        removeSigningKeyProvider(body?: import("./instance-security").RotateSigningKeyBody): Promise<{
+            object: "signing_key_provider";
+            provider: "local";
+            deleted: true;
+            rotation: import("./instance-security").SigningKeyRotation | null;
+        }>;
         get(): Promise<import("./instance-security").InstanceSecurity>;
         update(body: import("./instance-security").UpdateInstanceSecurityBody): Promise<import("./instance-security").InstanceSecurityResult>;
         setCaptchaSecret(body: {
             secret: string;
+            provider?: string;
         }): Promise<{
             object: "captcha_secret";
             provider: string;
@@ -990,6 +1060,14 @@ declare function buildNamespaces(request: RequestFn): {
             provider: string;
             deleted: true;
         }>;
+        setWalletRpcSecret(body: {
+            chain_id: number;
+            url: string;
+        }): Promise<{
+            object: "wallet_rpc_secret";
+            chain_id: number;
+            set: boolean;
+        }>;
         setKerberosSecret(body: {
             secret: string;
         }): Promise<{
@@ -1168,6 +1246,34 @@ declare function buildNamespaces(request: RequestFn): {
             data: import("./connectors").ConnectorDirectoryEntry[];
         }>;
     };
+    customOAuthProviders: {
+        list(): Promise<import("./types").ListPage<import("./custom-oauth-providers").CustomOAuthProvider>>;
+        get(id: string): Promise<import("./custom-oauth-providers").CustomOAuthProvider>;
+        create(body: import("./custom-oauth-providers").CreateCustomOAuthProviderBody, idempotencyKey?: string): Promise<import("./custom-oauth-providers").CustomOAuthProvider>;
+        update(id: string, body: import("./custom-oauth-providers").CustomOAuthProviderSettings, idempotencyKey?: string): Promise<import("./custom-oauth-providers").CustomOAuthProvider>;
+        delete(id: string): Promise<{
+            object: "custom_oauth_provider";
+            id: string;
+            provider_key: string;
+            deleted: true;
+        }>;
+        discover(body: {
+            issuer: string;
+            discovery_url?: string;
+        }): Promise<import("./custom-oauth-providers").OidcDiscoveryResult>;
+        previewProfileMapping(body: import("./custom-oauth-providers").ProfileMappingPreviewBody, id?: string): Promise<import("./custom-oauth-providers").ProfileMappingPreview>;
+        signingKeys(id: string): {
+            list(): Promise<import("./types").ListPage<import("./custom-oauth-providers").UpstreamSigningKey>>;
+            rotate(body?: {
+                alg?: "RS256" | "PS256" | "ES256";
+            }, idempotencyKey?: string): Promise<import("./custom-oauth-providers").UpstreamSigningKey>;
+            retire(kid: string): Promise<{
+                object: "upstream_signing_key";
+                kid: string;
+                status: "retired";
+            }>;
+        };
+    };
     notifications: {
         send(body: import("./notifications").SendNotificationBody, idempotencyKey?: string): Promise<import("./notifications").SentNotification>;
         categories: {
@@ -1384,6 +1490,7 @@ export * from './email-templates';
 export * from './sms-templates';
 export * from './localizations';
 export * from './actions';
+export * from './action-gallery';
 export * from './billing-plans';
 export * from './messaging';
 export * from './import-export';
@@ -1403,6 +1510,7 @@ export * from './organization-settings-schema';
 export * from './email-addresses';
 export * from './openfga';
 export * from './connectors';
+export * from './custom-oauth-providers';
 export * from './notifications';
 export * from './audit-events';
 export * from './activity';

package/dist/client/index.js

@@ -53,6 +53,7 @@ const email_templates_1 = require("./email-templates");
 const sms_templates_1 = require("./sms-templates");
 const localizations_1 = require("./localizations");
 const actions_1 = require("./actions");
+const action_gallery_1 = require("./action-gallery");
 const billing_plans_1 = require("./billing-plans");
 const messaging_1 = require("./messaging");
 const import_export_1 = require("./import-export");
@@ -72,6 +73,7 @@ const organization_settings_schema_1 = require("./organization-settings-schema")
 const email_addresses_1 = require("./email-addresses");
 const openfga_1 = require("./openfga");
 const connectors_1 = require("./connectors");
+const custom_oauth_providers_1 = require("./custom-oauth-providers");
 const notifications_1 = require("./notifications");
 const audit_events_1 = require("./audit-events");
 const activity_1 = require("./activity");
@@ -144,6 +146,8 @@ function buildNamespaces(request) {
         smsTemplates: (0, sms_templates_1.smsTemplatesResource)(request),
         localizations: (0, localizations_1.localizationsResource)(request),
         actions: (0, actions_1.actionsResource)(request),
+        actionGallery: (0, action_gallery_1.actionGalleryResource)(request),
+        actionTemplates: (0, action_gallery_1.actionTemplatesResource)(request),
         billing: (0, billing_plans_1.billingResource)(request),
         messaging: (0, messaging_1.messagingResource)(request),
         importExport: (0, import_export_1.importExportResource)(request),
@@ -169,6 +173,7 @@ function buildNamespaces(request) {
         // OpenFGA-wire ReBAC stores, models and tuples.
         openfga: (0, openfga_1.openfgaResource)(request),
         connectors: (0, connectors_1.connectorsResource)(request),
+        customOAuthProviders: (0, custom_oauth_providers_1.customOAuthProvidersResource)(request),
         notifications: (0, notifications_1.notificationsResource)(request),
         // The tenant's own custom audit events (distinct from Atlas's auditLogs).
         auditEvents: (0, audit_events_1.auditEventsResource)(request),
@@ -238,6 +243,7 @@ __exportStar(require("./email-templates"), exports);
 __exportStar(require("./sms-templates"), exports);
 __exportStar(require("./localizations"), exports);
 __exportStar(require("./actions"), exports);
+__exportStar(require("./action-gallery"), exports);
 __exportStar(require("./billing-plans"), exports);
 __exportStar(require("./messaging"), exports);
 __exportStar(require("./import-export"), exports);
@@ -257,6 +263,7 @@ __exportStar(require("./organization-settings-schema"), exports);
 __exportStar(require("./email-addresses"), exports);
 __exportStar(require("./openfga"), exports);
 __exportStar(require("./connectors"), exports);
+__exportStar(require("./custom-oauth-providers"), exports);
 __exportStar(require("./notifications"), exports);
 __exportStar(require("./audit-events"), exports);
 __exportStar(require("./activity"), exports);

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA+EA,8CAQC;AAvFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,2CAA+C;AAC/C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,2CAAgD;AAChD,6CAAiD;AACjD,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,wDAAwD;QACxD,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,kFAAkF;QAClF,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,yEAAyE;QACzE,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,8CAA4B;AAC5B,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,8CAA4B;AAC5B,+CAA6B;AAC7B,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAiFA,8CAQC;AAzFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,2CAA+C;AAC/C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,qDAAkF;AAClF,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,2CAAgD;AAChD,6CAAiD;AACjD,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,qEAAwE;AACxE,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,wDAAwD;QACxD,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,eAAe,EAAE,IAAA,wCAAuB,EAAC,OAAO,CAAC;QACjD,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,kFAAkF;QAClF,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,yEAAyE;QACzE,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,oBAAoB,EAAE,IAAA,qDAA4B,EAAC,OAAO,CAAC;QAC3D,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,8CAA4B;AAC5B,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,8CAA4B;AAC5B,+CAA6B;AAC7B,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,2DAAyC;AACzC,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}

package/dist/client/instance-security.d.ts

@@ -73,6 +73,43 @@ export interface SigningKey {
     role: 'main' | 'secondary';
     /** When a previous key leaves the JWKS (epoch ms); null for a current key. */
     retires_at: number | null;
+    /** On the current main key: `local`, or the KMS that holds its private half. */
+    provider?: 'local' | SigningKeyProviderKind;
+}
+/** The cloud key management services a signing key can live in. */
+export type SigningKeyProviderKind = 'aws_kms' | 'gcp_kms' | 'azure_key_vault';
+/** The instance's key management service (`GET /v1/instance/signing_key_provider`). Never carries credentials. */
+export interface SigningKeyProviderSettings {
+    object: 'signing_key_provider';
+    id?: string;
+    provider: 'local' | SigningKeyProviderKind;
+    /** The non-secret settings (region, key / key ring / vault, algorithm). Null for `local`. */
+    config: Record<string, unknown> | null;
+    /** True when the current main key is in this KMS. */
+    active: boolean;
+    /** The KMS key version tokens are signed with (ARN, resource name or key id). */
+    key_version: string | null;
+    last_verified_at?: number | null;
+    created_at?: number;
+    updated_at?: number;
+}
+/**
+ * Switch signing to a key in your own KMS. Config and credentials per provider:
+ *  - `aws_kms`: config `{ region, key_id?, alg? }`, credentials `{ access_key_id, secret_access_key, session_token? }`
+ *  - `gcp_kms`: config `{ crypto_key, key_version? }`, credentials `{ service_account_json }` (the key file)
+ *  - `azure_key_vault`: config `{ vault_url, key_name, key_version?, alg? }`, credentials `{ tenant_id, client_id, client_secret }`
+ * Without a key id / version Atlas creates a new key version in the KMS. Add
+ * `config.secondary` for a second key of the other algorithm (aws: `{ alg, key_id? }`;
+ * gcp: `{ crypto_key, key_version? }`; azure: `{ key_name, key_version?, alg }`).
+ */
+export interface SetSigningKeyProviderBody {
+    provider: SigningKeyProviderKind;
+    config: Record<string, unknown>;
+    credentials: Record<string, unknown>;
+    /** How long the previous key stays published (default 86400, at most 2592000). */
+    grace_period_seconds?: number;
+    /** Publish only the new key now. */
+    emergency?: boolean;
 }
 export interface RotateSigningKeyBody {
     /** How long the previous key stays published (default 86400, at most 2592000). */
@@ -81,6 +118,8 @@ export interface RotateSigningKeyBody {
     emergency?: boolean;
     /** The new main key's algorithm; omit to keep the current one. */
     alg?: 'RS256' | 'ES256';
+    /** With keys in a key management service: rotate only the `main` or the `secondary` key (default both). */
+    key?: 'main' | 'secondary';
 }
 export interface SigningKeyRotation {
     object: 'signing_key_rotation';
@@ -89,6 +128,10 @@ export interface SigningKeyRotation {
     previous_kid: string | null;
     previous_retires_at: number | null;
     emergency: boolean;
+    /** Where the key lives (`local` or the key management service). */
+    provider?: 'local' | SigningKeyProviderKind;
+    /** With keys in a key management service: the current second-algorithm key, if configured. */
+    secondary_kid?: string | null;
 }
 export declare function instanceSecurityResource(request: RequestFn): {
     /** The published token-signing keys, newest first. */
@@ -98,11 +141,25 @@ export declare function instanceSecurityResource(request: RequestFn): {
     }>;
     /** Rotate the signing key (optionally switching between RS256 and ES256). */
     rotateSigningKey(body?: RotateSigningKeyBody): Promise<SigningKeyRotation>;
+    /** The key management service the signing key lives in (`local` when none). */
+    getSigningKeyProvider(): Promise<SigningKeyProviderSettings>;
+    /** Sign every token with a key in your own AWS KMS, Google Cloud KMS or Azure Key Vault. */
+    setSigningKeyProvider(body: SetSigningKeyProviderBody): Promise<SigningKeyProviderSettings & {
+        rotation: SigningKeyRotation;
+    }>;
+    /** Stop using the KMS: rotate back to a key Atlas holds and forget the credentials. */
+    removeSigningKeyProvider(body?: RotateSigningKeyBody): Promise<{
+        object: "signing_key_provider";
+        provider: "local";
+        deleted: true;
+        rotation: SigningKeyRotation | null;
+    }>;
     get(): Promise<InstanceSecurity>;
     update(body: UpdateInstanceSecurityBody): Promise<InstanceSecurityResult>;
     /** Store the captcha provider secret. Refused while the provider is `none`. */
     setCaptchaSecret(body: {
         secret: string;
+        provider?: string;
     }): Promise<{
         object: "captcha_secret";
         provider: string;
@@ -113,6 +170,19 @@ export declare function instanceSecurityResource(request: RequestFn): {
         provider: string;
         deleted: true;
     }>;
+    /**
+     * Store (write-only, encrypted) the wallet RPC endpoint for an EIP-155 chain
+     * — used by wallet token gating and the Sign in with Ethereum ENS lookup. An
+     * empty url removes it. The URL is never returned.
+     */
+    setWalletRpcSecret(body: {
+        chain_id: number;
+        url: string;
+    }): Promise<{
+        object: "wallet_rpc_secret";
+        chain_id: number;
+        set: boolean;
+    }>;
     /** Store the Kerberos/IWA trusted-proxy secret. Refused while the strategy is off. */
     setKerberosSecret(body: {
         secret: string;

package/dist/client/instance-security.js

@@ -12,6 +12,18 @@ function instanceSecurityResource(request) {
         rotateSigningKey(body = {}) {
             return request({ method: 'POST', path: '/v1/instance/signing_keys/rotate', body });
         },
+        /** The key management service the signing key lives in (`local` when none). */
+        getSigningKeyProvider() {
+            return request({ method: 'GET', path: '/v1/instance/signing_key_provider' });
+        },
+        /** Sign every token with a key in your own AWS KMS, Google Cloud KMS or Azure Key Vault. */
+        setSigningKeyProvider(body) {
+            return request({ method: 'PUT', path: '/v1/instance/signing_key_provider', body });
+        },
+        /** Stop using the KMS: rotate back to a key Atlas holds and forget the credentials. */
+        removeSigningKeyProvider(body = {}) {
+            return request({ method: 'DELETE', path: '/v1/instance/signing_key_provider', body });
+        },
         get() {
             return request({ method: 'GET', path: '/v1/instance/security' });
         },
@@ -25,6 +37,14 @@ function instanceSecurityResource(request) {
         deleteCaptchaSecret() {
             return request({ method: 'DELETE', path: '/v1/instance/captcha_secret' });
         },
+        /**
+         * Store (write-only, encrypted) the wallet RPC endpoint for an EIP-155 chain
+         * — used by wallet token gating and the Sign in with Ethereum ENS lookup. An
+         * empty url removes it. The URL is never returned.
+         */
+        setWalletRpcSecret(body) {
+            return request({ method: 'PUT', path: '/v1/instance/wallet_rpc_secret', body });
+        },
         /** Store the Kerberos/IWA trusted-proxy secret. Refused while the strategy is off. */
         setKerberosSecret(body) {
             return request({ method: 'PUT', path: '/v1/instance/kerberos_secret', body });

package/dist/client/instance-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;AAwGA,4DAqEC;AA7KD,uCAAgD;AAwGhD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,sDAAsD;QACtD,eAAe;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,6EAA6E;QAC7E,gBAAgB,CAAC,OAA6B,EAAE;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,+EAA+E;QAC/E,gBAAgB,CACd,IAAwB;YAExB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,sFAAsF;QACtF,iBAAiB,CAAC,IAAwB;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,oBAAoB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,wEAAwE;QACxE,cAAc;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,iHAAiH;QACjH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,qEAAqE;QACrE,iBAAiB;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED;oEAC4D;QAC5D,mBAAmB,CACjB,YAAoB,EACpB,IAA+B;YAE/B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;gBACxE,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,sBAAsB,CACpB,YAAoB;YAEpB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;AAsJA,4DAgGC;AAtPD,uCAAgD;AAsJhD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,sDAAsD;QACtD,eAAe;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,6EAA6E;QAC7E,gBAAgB,CAAC,OAA6B,EAAE;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,+EAA+E;QAC/E,qBAAqB;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,4FAA4F;QAC5F,qBAAqB,CACnB,IAA+B;YAE/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,uFAAuF;QACvF,wBAAwB,CACtB,OAA6B,EAAE;YAE/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,+EAA+E;QAC/E,gBAAgB,CACd,IAA2C;YAE3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;;WAIG;QACH,kBAAkB,CAAC,IAGlB;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,sFAAsF;QACtF,iBAAiB,CAAC,IAAwB;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,oBAAoB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,wEAAwE;QACxE,cAAc;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,iHAAiH;QACjH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,qEAAqE;QACrE,iBAAiB;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED;oEAC4D;QAC5D,mBAAmB,CACjB,YAAoB,EACpB,IAA+B;YAE/B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;gBACxE,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,sBAAsB,CACpB,YAAoB;YAEpB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/oauth-clients.d.ts

@@ -43,9 +43,36 @@ export interface OAuthClient {
     sector_identifier_uri?: string | null;
     /** When the current secret stops authenticating (epoch ms); null = never. */
     client_secret_expires_at?: number | null;
+    /** `jwt` or `opaque` access tokens for this client; null = inherited from the API / instance. */
+    access_token_format?: AccessTokenFormat | null;
+    /** This client's token lifetime overrides (seconds); a null field is inherited. */
+    token_lifetimes?: OAuthTokenLifetimes;
     created_at: number;
     updated_at: number;
 }
+/** Signed JWT access tokens, or opaque references validated by introspection. */
+export type AccessTokenFormat = 'jwt' | 'opaque';
+/**
+ * Token lifetimes in seconds. A field left out (or null) inherits the API's,
+ * then the instance's, then Atlas's default. Bounds: access / id token 60–86400;
+ * refresh token 300–31536000 (idle ≤ absolute); authorization code 10–600;
+ * device code 60–1800.
+ */
+export interface OAuthTokenLifetimes {
+    access_token_ttl_seconds?: number | null;
+    id_token_ttl_seconds?: number | null;
+    refresh_token_absolute_ttl_seconds?: number | null;
+    refresh_token_idle_ttl_seconds?: number | null;
+    authorization_code_ttl_seconds?: number | null;
+    device_code_ttl_seconds?: number | null;
+}
+/** Access-token format and lifetimes, accepted on create and update. */
+export interface OAuthClientTokenFields {
+    /** `jwt` or `opaque`; null inherits. */
+    access_token_format?: AccessTokenFormat | null;
+    /** Replaces the overrides; null clears them all. */
+    token_lifetimes?: OAuthTokenLifetimes | null;
+}
 /** OIDC Core §8 subject settings, accepted on create and update. */
 export interface OAuthClientSubjectFields {
     /** `public` (default): the user id. `pairwise`: a per-sector identifier. */
@@ -120,7 +147,7 @@ export interface ClientGrant {
     created_at: number;
     updated_at: number;
 }
-export interface CreateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields {
+export interface CreateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields, OAuthClientTokenFields {
     name: string;
     redirect_uris: string[];
     allowed_scopes?: string[];
@@ -131,7 +158,7 @@ export interface CreateOAuthClientBody extends OAuthClientLogoutFields, OAuthCli
     /** How long the issued secret authenticates, in seconds; omit for no expiry. */
     secret_expires_in_seconds?: number;
 }
-export interface UpdateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields {
+export interface UpdateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields, OAuthClientTokenFields {
     name?: string;
     redirect_uris?: string[];
     allowed_scopes?: string[];

package/dist/client/oauth-clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA8OA,oDA+FC;AA7UD,uCAAgD;AA8OhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA4QA,oDA+FC;AA3WD,uCAAgD;AA4QhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/resource-servers.d.ts

@@ -15,10 +15,30 @@ export interface ResourceServer {
     signing_alg: 'RS256' | 'ES256' | string;
     /** RFC 9728: Atlas serves protected-resource metadata for this API. */
     publish_resource_metadata?: boolean;
+    /** `jwt` or `opaque` access tokens for this API; null = inherited from the client / instance. */
+    access_token_format?: 'jwt' | 'opaque' | null;
+    /** Refresh-token lifetimes for grants issued for this API (seconds); null = inherited. */
+    refresh_token_absolute_ttl_seconds?: number | null;
+    refresh_token_idle_ttl_seconds?: number | null;
+    /** client_ids of the confidential clients allowed to introspect this API's tokens. */
+    introspection_client_ids?: string[];
     created_at: number;
     updated_at: number;
 }
-export interface CreateResourceServerBody {
+/** Token settings an API can carry (create and update). */
+export interface ResourceServerTokenFields {
+    /** The access-token lifetime, 60–86400 seconds. */
+    token_ttl_seconds?: number;
+    /** `jwt` or `opaque`; null inherits. */
+    access_token_format?: 'jwt' | 'opaque' | null;
+    /** 300–31536000 seconds; null inherits. */
+    refresh_token_absolute_ttl_seconds?: number | null;
+    /** 300–31536000 seconds, at most the absolute lifetime; null inherits. */
+    refresh_token_idle_ttl_seconds?: number | null;
+    /** client_ids of confidential clients (e.g. this API's backend) that may introspect its tokens. */
+    introspection_client_ids?: string[];
+}
+export interface CreateResourceServerBody extends ResourceServerTokenFields {
     identifier: string;
     name: string;
     /** Each scope is a bare string or `{ value, description? }`. */
@@ -29,7 +49,7 @@ export interface CreateResourceServerBody {
     /** RFC 9728: serve protected-resource metadata for this API. */
     publish_resource_metadata?: boolean;
 }
-export interface UpdateResourceServerBody {
+export interface UpdateResourceServerBody extends ResourceServerTokenFields {
     name?: string;
     scopes?: Array<string | ResourceServerScope>;
     token_ttl_seconds?: number;

package/dist/client/resource-servers.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-servers.js","sourceRoot":"","sources":["../../src/client/resource-servers.ts"],"names":[],"mappings":";;AA+CA,0DAkBC;AAjED,uCAAgD;AA+ChD,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAA8B;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA8B;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resource-servers.js","sourceRoot":"","sources":["../../src/client/resource-servers.ts"],"names":[],"mappings":";;AAoEA,0DAkBC;AAtFD,uCAAgD;AAoEhD,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAA8B;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA8B;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/risk-based-mfa.d.ts

@@ -10,6 +10,8 @@ export interface RiskWeights {
     newIp: number;
     velocity: number;
     impossibleTravel: number;
+    /** The account was idle past the dormant-account threshold before this sign-in. */
+    dormantAccount?: number;
 }
 /** Per-signal on/off toggles. A disabled signal contributes nothing. */
 export interface RiskSignalToggles {
@@ -18,6 +20,7 @@ export interface RiskSignalToggles {
     newIp: boolean;
     velocity: boolean;
     impossibleTravel: boolean;
+    dormantAccount?: boolean;
 }
 /**
  * Adaptive / risk-based MFA config (Auth0 "Adaptive MFA" parity). OFF by

package/dist/client/risk-based-mfa.js.map

@@ -1 +1 @@
-{"version":3,"file":"risk-based-mfa.js","sourceRoot":"","sources":["../../src/client/risk-based-mfa.ts"],"names":[],"mappings":";;AAoDA,oDAWC;AAfD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4CAA4C;QAC5C,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,0EAA0E;QAC1E,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"risk-based-mfa.js","sourceRoot":"","sources":["../../src/client/risk-based-mfa.ts"],"names":[],"mappings":";;AAuDA,oDAWC;AAfD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4CAA4C;QAC5C,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,0EAA0E;QAC1E,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sessions.d.ts

@@ -17,6 +17,8 @@ export interface Session {
      */
     idle_expires_at?: number;
     created_at: number;
+    /** Custom per-session data your backend (or a post_login Action) attached; null when none. */
+    custom_data?: Record<string, unknown> | null;
 }
 /** The session after a keep-alive {@link sessionsResource} `touch`. */
 export interface TouchedSession extends Session {
@@ -35,6 +37,8 @@ export interface CreateSessionParams {
     actor?: {
         sub: string;
     };
+    /** Custom per-session data to attach (a JSON object, at most 2 KB). */
+    custom_data?: Record<string, unknown>;
 }
 /**
  * A freshly-minted session. Unlike a listed {@link Session}, this carries the
@@ -52,6 +56,7 @@ export interface MintedSession {
     impersonated_by?: {
         sub: string;
     };
+    custom_data?: Record<string, unknown> | null;
 }
 /** A JWT minted from a named JWT template. */
 export interface SessionTemplateToken {
@@ -74,6 +79,17 @@ export declare function sessionsResource(request: RequestFn): {
         id: string;
         status: "revoked";
     }>;
+    /**
+     * `PUT /v1/sessions/:id/custom_data` — replace the session's custom data
+     * (null clears it). At most 2 KB; only an active session can be changed.
+     * Not for secrets: the signed-in user can read it.
+     */
+    setCustomData(id: string, customData: Record<string, unknown> | null): Promise<Session>;
+    /**
+     * `PATCH /v1/sessions/:id/custom_data` — merge keys into the session's custom
+     * data; a key set to null is removed.
+     */
+    updateCustomData(id: string, patch: Record<string, unknown>): Promise<Session>;
     /**
      * `POST /v1/sessions/:id/touch` — keep a session alive from your backend:
      * slides its inactivity window as if the user had just loaded a page. Never

package/dist/client/sessions.js

@@ -21,6 +21,21 @@ function sessionsResource(request) {
         revoke(id) {
             return request({ method: 'POST', path: `/v1/sessions/${(0, request_1.enc)(id)}/revoke` });
         },
+        /**
+         * `PUT /v1/sessions/:id/custom_data` — replace the session's custom data
+         * (null clears it). At most 2 KB; only an active session can be changed.
+         * Not for secrets: the signed-in user can read it.
+         */
+        setCustomData(id, customData) {
+            return request({ method: 'PUT', path: `/v1/sessions/${(0, request_1.enc)(id)}/custom_data`, body: { custom_data: customData } });
+        },
+        /**
+         * `PATCH /v1/sessions/:id/custom_data` — merge keys into the session's custom
+         * data; a key set to null is removed.
+         */
+        updateCustomData(id, patch) {
+            return request({ method: 'PATCH', path: `/v1/sessions/${(0, request_1.enc)(id)}/custom_data`, body: { custom_data: patch } });
+        },
         /**
          * `POST /v1/sessions/:id/touch` — keep a session alive from your backend:
          * slides its inactivity window as if the user had just loaded a page. Never

package/dist/client/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/client/sessions.ts"],"names":[],"mappings":";;AAiEA,4CAwCC;AAzGD,uCAAgD;AAiEhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL;;;WAGG;QACH,MAAM,CAAC,MAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,wDAAwD;QACxD,IAAI,CAAC,MAA0B;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU,EAAE,QAAgB;YACnC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/client/sessions.ts"],"names":[],"mappings":";;AAsEA,4CAuDC;AA7HD,uCAAgD;AAsEhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL;;;WAGG;QACH,MAAM,CAAC,MAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,wDAAwD;QACxD,IAAI,CAAC,MAA0B;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;WAIG;QACH,aAAa,CAAC,EAAU,EAAE,UAA0C;YAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;QACD;;;WAGG;QACH,gBAAgB,CAAC,EAAU,EAAE,KAA8B;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjH,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU,EAAE,QAAgB;YACnC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}