@atlasauth/backend 0.15.0 → 0.17.0

package/dist/client/action-gallery.d.ts

@@ -0,0 +1,215 @@
+import { type RequestFn } from './request';
+import type { Action, ActionTrigger } from './actions';
+import type { ListPage } from './types';
+/**
+ * §actions gallery — browse reusable Action templates (first-party and
+ * community), install one into the instance as a DISABLED action, keep installed
+ * actions up to date, and publish your own templates for review.
+ */
+/** Every trigger a template can target (a superset of the classic three). */
+export type GalleryTrigger = ActionTrigger | 'pre_organization_create' | 'pre_member_add' | 'pre_invitation_create';
+/** A secret a template reads, declared by NAME; values are never part of a template. */
+export interface ActionTemplateSecret {
+    name: string;
+    description: string;
+    required: boolean;
+}
+export interface ActionGalleryEntry {
+    object: 'action_template';
+    source: 'builtin' | 'community';
+    slug: string;
+    name: string;
+    summary: string;
+    trigger: GalleryTrigger;
+    category: string;
+    tags: string[];
+    /** SPDX licence id. */
+    license: string;
+    author: {
+        name: string;
+        first_party: boolean;
+    };
+    verified: boolean;
+    featured: boolean;
+    install_count: number;
+    latest_version: string;
+    /** The code sends outbound requests with `api.http`. */
+    uses_http: boolean;
+    secrets: ActionTemplateSecret[];
+    updated_at: number | null;
+}
+export interface ActionGalleryDetail extends ActionGalleryEntry {
+    /** Markdown. */
+    description: string;
+    code: string;
+    changelog: string | null;
+    repository_url: string | null;
+    versions: Array<{
+        version: string;
+        changelog: string | null;
+        released_at: number | null;
+    }>;
+}
+export interface ActionGalleryFilter {
+    q?: string;
+    category?: string;
+    trigger?: GalleryTrigger;
+    source?: 'builtin' | 'community';
+}
+export interface InstallTemplateBody {
+    /** A specific approved version (default: the latest). */
+    version?: string;
+    /** The action's name (default: the template's). */
+    name?: string;
+    /** Values for the secrets the template declares. Write-only. */
+    secrets?: Record<string, string>;
+}
+export interface ActionGalleryInstallResult {
+    object: 'action_gallery_install';
+    /** The new action: disabled and not bound to any flow yet. */
+    action: Action;
+    template: {
+        slug: string;
+        source: 'builtin' | 'community';
+        version: string;
+    };
+    install_id: string;
+    /** Required secrets you have not supplied yet. */
+    missing_secrets: string[];
+}
+export interface ActionGalleryInstallation {
+    object: 'action_gallery_installation';
+    action_id: string;
+    action_name: string;
+    enabled: boolean;
+    trigger: string;
+    source: 'builtin' | 'community';
+    template_slug: string;
+    installed_version: string;
+    latest_version: string | null;
+    update_available: boolean;
+    missing_secrets: string[];
+    update_requires_secrets: string[];
+    installed_at: number;
+    updated_at: number;
+}
+export interface ActionGalleryUpdateResult {
+    object: 'action_gallery_update';
+    /** false when the action already runs the latest version. */
+    updated: boolean;
+    action: Action;
+    from_version?: string;
+    version: string;
+}
+export type ActionTemplateStatus = 'draft' | 'in_review' | 'published' | 'unlisted' | 'rejected' | 'banned';
+export interface ActionTemplateVersion {
+    object: 'action_template_version';
+    version: string;
+    status: 'draft' | 'pending_review' | 'approved' | 'rejected';
+    trigger: GalleryTrigger;
+    secrets: ActionTemplateSecret[];
+    changelog: string | null;
+    /** Why staff rejected it, when they did. */
+    review_note: string | null;
+    code: string;
+    submitted_at: number | null;
+    reviewed_at: number | null;
+    created_at: number;
+}
+/** A template this instance publishes. */
+export interface ActionTemplate {
+    object: 'action_template';
+    id: string;
+    slug: string;
+    name: string;
+    author_name: string;
+    summary: string;
+    description: string | null;
+    category: string;
+    tags: string[];
+    trigger: GalleryTrigger;
+    license: string;
+    repository_url: string | null;
+    status: ActionTemplateStatus;
+    latest_version: string | null;
+    verified: boolean;
+    featured: boolean;
+    install_count: number;
+    view_count: number;
+    published_at: number | null;
+    created_at: number;
+    updated_at: number;
+    versions: ActionTemplateVersion[];
+}
+export interface ActionTemplateListing {
+    slug?: string;
+    name?: string;
+    /** Shown as the author on the gallery. */
+    author_name?: string;
+    summary?: string;
+    /** Markdown. */
+    description?: string;
+    category?: string;
+    tags?: string[];
+    trigger?: GalleryTrigger;
+    /** SPDX id (MIT, Apache-2.0, BSD-3-Clause, ISC, MPL-2.0, …). */
+    license?: string;
+    repository_url?: string | null;
+}
+export interface NewTemplateVersion {
+    /** MAJOR.MINOR.PATCH, higher than every existing version. */
+    version: string;
+    code: string;
+    secrets?: ActionTemplateSecret[];
+    changelog?: string;
+    /** Send to review right away. */
+    submit?: boolean;
+}
+export interface CreateActionTemplateBody extends ActionTemplateListing {
+    slug: string;
+    name: string;
+    author_name: string;
+    trigger: GalleryTrigger;
+    /** Optionally the first version in the same call. */
+    version?: string;
+    code?: string;
+    secrets?: ActionTemplateSecret[];
+    changelog?: string;
+    submit?: boolean;
+}
+export declare function actionGalleryResource(request: RequestFn): {
+    /** The gallery, best first. */
+    list(filter?: ActionGalleryFilter): Promise<ListPage<ActionGalleryEntry>>;
+    /** One template with its code, secret names and versions. */
+    get(slug: string): Promise<ActionGalleryDetail>;
+    /** Install as a new, disabled action. Supply secrets, bind it, then enable it. */
+    install(slug: string, body?: InstallTemplateBody, idempotencyKey?: string): Promise<ActionGalleryInstallResult>;
+    /** Actions installed from the gallery, with update status. */
+    installs(): Promise<ListPage<ActionGalleryInstallation>>;
+    /** Move an installed action to its template's latest version. */
+    update(actionId: string, body?: {
+        secrets?: Record<string, string>;
+    }): Promise<ActionGalleryUpdateResult>;
+};
+export declare function actionTemplatesResource(request: RequestFn): {
+    list(): Promise<ListPage<ActionTemplate>>;
+    create(body: CreateActionTemplateBody, idempotencyKey?: string): Promise<ActionTemplate>;
+    get(id: string): Promise<ActionTemplate>;
+    update(id: string, body: ActionTemplateListing): Promise<ActionTemplate>;
+    delete(id: string): Promise<{
+        object: "action_template";
+        id: string;
+        deleted: true;
+    }>;
+    addVersion(id: string, body: NewTemplateVersion): Promise<ActionTemplateVersion>;
+    submitVersion(id: string, version: string): Promise<ActionTemplateVersion>;
+    deleteVersion(id: string, version: string): Promise<{
+        object: "action_template_version";
+        version: string;
+        deleted: true;
+    }>;
+    /** List an approved template again after unlisting it. */
+    publish(id: string): Promise<ActionTemplate>;
+    /** Hide a template from the gallery (installs keep working). */
+    unlist(id: string): Promise<ActionTemplate>;
+};

package/dist/client/action-gallery.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actionGalleryResource = actionGalleryResource;
+exports.actionTemplatesResource = actionTemplatesResource;
+const request_1 = require("./request");
+function actionGalleryResource(request) {
+    return {
+        /** The gallery, best first. */
+        list(filter = {}) {
+            return request({ method: 'GET', path: '/v1/action_gallery', query: { ...filter } });
+        },
+        /** One template with its code, secret names and versions. */
+        get(slug) {
+            return request({ method: 'GET', path: `/v1/action_gallery/${(0, request_1.enc)(slug)}` });
+        },
+        /** Install as a new, disabled action. Supply secrets, bind it, then enable it. */
+        install(slug, body = {}, idempotencyKey) {
+            return request({ method: 'POST', path: `/v1/action_gallery/${(0, request_1.enc)(slug)}/install`, body, idempotencyKey });
+        },
+        /** Actions installed from the gallery, with update status. */
+        installs() {
+            return request({ method: 'GET', path: '/v1/action_gallery_installs' });
+        },
+        /** Move an installed action to its template's latest version. */
+        update(actionId, body = {}) {
+            return request({ method: 'POST', path: `/v1/actions/${(0, request_1.enc)(actionId)}/gallery_update`, body });
+        },
+    };
+}
+function actionTemplatesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/action_templates' });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/action_templates', body, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/action_templates/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/action_templates/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/action_templates/${(0, request_1.enc)(id)}` });
+        },
+        addVersion(id, body) {
+            return request({ method: 'POST', path: `/v1/action_templates/${(0, request_1.enc)(id)}/versions`, body });
+        },
+        submitVersion(id, version) {
+            return request({ method: 'POST', path: `/v1/action_templates/${(0, request_1.enc)(id)}/versions/${(0, request_1.enc)(version)}/submit` });
+        },
+        deleteVersion(id, version) {
+            return request({ method: 'DELETE', path: `/v1/action_templates/${(0, request_1.enc)(id)}/versions/${(0, request_1.enc)(version)}` });
+        },
+        /** List an approved template again after unlisting it. */
+        publish(id) {
+            return request({ method: 'POST', path: `/v1/action_templates/${(0, request_1.enc)(id)}/publish` });
+        },
+        /** Hide a template from the gallery (installs keep working). */
+        unlist(id) {
+            return request({ method: 'POST', path: `/v1/action_templates/${(0, request_1.enc)(id)}/unlist` });
+        },
+    };
+}
+//# sourceMappingURL=action-gallery.js.map

package/dist/client/action-gallery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-gallery.js","sourceRoot":"","sources":["../../src/client/action-gallery.ts"],"names":[],"mappings":";;AA6LA,sDAuBC;AAED,0DAmCC;AAzPD,uCAAgD;AA6LhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,+BAA+B;QAC/B,IAAI,CAAC,SAA8B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,6DAA6D;QAC7D,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,kFAAkF;QAClF,OAAO,CAAC,IAAY,EAAE,OAA4B,EAAE,EAAE,cAAuB;YAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,8DAA8D;QAC9D,QAAQ;YACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,iEAAiE;QACjE,MAAM,CAAC,QAAgB,EAAE,OAA6C,EAAE;YACtE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAA8B,EAAE,cAAuB;YAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,IAAwB;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,aAAa,CAAC,EAAU,EAAE,OAAe;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,aAAa,CAAC,EAAU,EAAE,OAAe;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,0DAA0D;QAC1D,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,gEAAgE;QAChE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/actions.d.ts

@@ -40,15 +40,34 @@ export interface ActionTestEvent {
         email?: string;
         emailVerified?: boolean;
         metadata?: Record<string, unknown>;
+        /** The user's organization memberships, as `event.user.organizations`. */
+        organizations?: Array<{
+            id: string;
+            slug: string;
+            name: string;
+            role: string;
+        }>;
     };
     connection?: {
         strategy?: string;
     };
+    /** `country` is the ISO code `event.request.country` should carry. */
     request?: {
         ip?: string;
         user_agent?: string;
+        country?: string;
     };
 }
+/** An outbound request the code queued with `api.http` (a dry run sends nothing). */
+export interface ActionTestHttpRequest {
+    method: 'GET' | 'POST';
+    /** Query values are masked. */
+    url: string;
+    /** Header names only; values are never echoed. */
+    header_names: string[];
+    has_body: boolean;
+    save_response_as: string | null;
+}
 /** What an action produced against a sample event — no real data is touched. */
 export interface ActionTestResult {
     object: 'action_test_result';
@@ -59,6 +78,8 @@ export interface ActionTestResult {
     id_token_claims: Record<string, unknown>;
     app_metadata: Record<string, unknown>;
     logs: string[];
+    /** What the code queued with `api.http`; sent only on a real post_login / post_user_registration run. */
+    http_requests?: ActionTestHttpRequest[];
     error: string | null;
 }
 /** The ordered binding list for a trigger, replaced atomically as a set. */

package/dist/client/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AAwEA,0CAkCC;AA1GD,uCAAgD;AAwEhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AAwFA,0CAkCC;AA1HD,uCAAgD;AAwFhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/attack-protection.d.ts

@@ -25,8 +25,39 @@ export interface AttackProtection {
         secret_set: boolean;
         managed_by: 'auth_config_and_captcha_secret';
     };
+    /** Read-only reflections of auth_config.attackProtection. */
+    country_restrictions?: {
+        mode: 'off' | 'allow' | 'deny';
+        countries: string[];
+        sign_up: boolean;
+        sign_in: boolean;
+        block_unknown: boolean;
+        managed_by: 'auth_config';
+    };
+    device_accounts?: {
+        enabled: boolean;
+        max_accounts: number;
+        window_days: number;
+        managed_by: 'auth_config';
+    };
+    /** Dormant-account reactivation alerts (writable). */
+    dormant_accounts?: DormantAccountsSettings;
+}
+/**
+ * When an account idle for `threshold_days` signs in again: an audit entry, the
+ * `user.reactivated` webhook, an optional security notice to the user, and —
+ * with `require_mfa` — a second-factor step-up (`on_no_factor` decides for an
+ * account without one).
+ */
+export interface DormantAccountsSettings {
+    enabled: boolean;
+    /** 1–3650; default 90. */
+    threshold_days: number;
+    require_mfa: boolean;
+    on_no_factor: 'allow' | 'require_enroll' | 'block';
+    notify_user: boolean;
 }
-/** Only the two flags are writable; the rest of the object is read-only. */
+/** The writable parts; the rest of the object is read-only. */
 export interface UpdateAttackProtectionBody {
     brute_force?: {
         enabled?: boolean;
@@ -34,6 +65,7 @@ export interface UpdateAttackProtectionBody {
     breached_password?: {
         enabled?: boolean;
     };
+    dormant_accounts?: Partial<DormantAccountsSettings>;
 }
 export declare function attackProtectionResource(request: RequestFn): {
     get(): Promise<AttackProtection>;

package/dist/client/attack-protection.js.map

@@ -1 +1 @@
-{"version":3,"file":"attack-protection.js","sourceRoot":"","sources":["../../src/client/attack-protection.ts"],"names":[],"mappings":";;AAkCA,4DASC;AATD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"attack-protection.js","sourceRoot":"","sources":["../../src/client/attack-protection.ts"],"names":[],"mappings":";;AA8DA,4DASC;AATD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/better-auth-imports.d.ts

@@ -0,0 +1,205 @@
+import { type RequestFn } from './request';
+import type { CursorPage, CursorParams } from './types';
+/**
+ * Migrate from Better Auth: import a sealed bundle made by
+ * `@atlasauth/better-auth-migrate` (`npx atlas-better-auth-export`).
+ *
+ *   1. `getPublicKey()` — the key the exporter seals the bundle to.
+ *   2. `create()`, `uploadPart()` for each part, `finalize()` — or `upload()`
+ *      for all three. Atlas opens the bundle and runs the dry run.
+ *   3. Read the import's `report`, then `apply()`. Applying again after a
+ *      failure resumes where it stopped; every record is an idempotent upsert.
+ */
+export type BetterAuthImportStatus = 'uploading' | 'analyzing' | 'ready' | 'invalid' | 'queued' | 'applying' | 'completed' | 'failed';
+export interface BetterAuthImportKey {
+    object: 'better_auth_import_key';
+    kid: string;
+    /** base64url raw X25519 public key. */
+    public_key: string;
+    alg: 'X25519-HKDF-SHA256-A256GCM';
+    status: 'active' | 'retired';
+    /** SHA-256 of the raw key, first 16 bytes as hex pairs. */
+    fingerprint: string;
+    /** `kid:public_key`, the form `--public-key` takes. */
+    compact: string;
+    created_at: number;
+    retired_at: number | null;
+}
+export interface BetterAuthImportOptions {
+    models?: string[];
+    on_email_conflict?: 'skip' | 'link';
+    default_role?: string;
+    create_app_roles?: boolean;
+    import_oauth_tokens?: boolean;
+    passkeys_on_rp_mismatch?: 'skip' | 'import';
+    import_subscriptions?: boolean;
+    plan_map?: Record<string, string>;
+    import_jwks?: boolean;
+    jwks_cutover_days?: number;
+    import_sessions?: boolean;
+    retain_bundle?: boolean;
+}
+export interface BetterAuthImportActionItem {
+    code: string;
+    severity: 'required' | 'recommended' | 'info';
+    message: string;
+    count: number;
+    items: string[];
+}
+interface ReportCommon {
+    skipped: Array<{
+        model: string;
+        row_id: string | null;
+        reason_code: string;
+        reason: string;
+    }>;
+    skipped_total: number;
+    skipped_by_code: Record<string, number>;
+    conflicts: Array<{
+        model: string;
+        row_id: string | null;
+        code: string;
+        message: string;
+        resolution: 'merge' | 'skip';
+        existing_id: string | null;
+        value?: string;
+    }>;
+    conflicts_total: number;
+    action_items: BetterAuthImportActionItem[];
+    warnings: string[];
+    notes: Record<string, unknown>;
+}
+export interface BetterAuthImportReport extends ReportCommon {
+    models: Array<{
+        model: string;
+        label: string;
+        found: number;
+        will_create: number;
+        will_update: number;
+        will_skip: number;
+    }>;
+}
+export interface BetterAuthImportResult extends ReportCommon {
+    models: Array<{
+        model: string;
+        label: string;
+        found: number;
+        created: number;
+        updated: number;
+        unchanged: number;
+        skipped: number;
+        failed: number;
+    }>;
+    completed_at: number | null;
+}
+export interface BetterAuthImport {
+    object: 'better_auth_import';
+    id: string;
+    status: BetterAuthImportStatus;
+    key_id: string | null;
+    parts: number;
+    bytes: number;
+    bundle_sha256: string | null;
+    bundle_purged: boolean;
+    options: BetterAuthImportOptions;
+    source: {
+        exported_at: string;
+        exporter: {
+            name: string;
+            version: string;
+        };
+        better_auth_version: string | null;
+        base_url: string | null;
+        plugins: string[];
+        models: string[];
+        rp_id: string | null;
+        social_providers: string[];
+    } | null;
+    total: number;
+    progress: {
+        total: number;
+        processed: number;
+        succeeded: number;
+        failed: number;
+        percent: number;
+    } | null;
+    report: BetterAuthImportReport | null;
+    result: BetterAuthImportResult | null;
+    error: {
+        code: string;
+        message: string;
+    } | null;
+    created_at: number;
+    updated_at: number;
+    analyzed_at: number | null;
+    apply_started_at: number | null;
+    completed_at: number | null;
+}
+export interface ImportedJwk {
+    object: 'imported_jwk';
+    kid: string;
+    source: string;
+    jwk: Record<string, unknown>;
+    import_id: string | null;
+    expires_at: number | null;
+    created_at: number;
+}
+/** Bytes per uploaded part (the API takes at most 10 MiB). Parts end on a line boundary. */
+export declare const BETTER_AUTH_IMPORT_PART_BYTES: number;
+/** Split a sealed bundle's text into upload parts on line boundaries. */
+export declare function splitBundleParts(text: string, maxBytes?: number): string[];
+export declare function betterAuthImportsResource(request: RequestFn): {
+    /** The import public key (created on first read). */
+    getPublicKey(): Promise<BetterAuthImportKey>;
+    /** Replace the import key; bundles sealed to the old one no longer finalize. */
+    rotatePublicKey(): Promise<BetterAuthImportKey>;
+    create(body?: {
+        options?: BetterAuthImportOptions;
+    }, idempotencyKey?: string): Promise<BetterAuthImport>;
+    list(params?: CursorParams): Promise<CursorPage<BetterAuthImport>>;
+    get(id: string): Promise<BetterAuthImport>;
+    /** Upload part `part` (1-based) of the sealed bundle text. */
+    uploadPart(id: string, part: number, data: string): Promise<{
+        object: "better_auth_import_part";
+        import_id: string;
+        part: number;
+        bytes: number;
+        sha256: string;
+    }>;
+    /** Close the upload; Atlas checks the key and runs the dry run. */
+    finalize(id: string): Promise<BetterAuthImport>;
+    /** Run the dry run again, optionally with new options. */
+    dryRun(id: string, body?: {
+        options?: BetterAuthImportOptions;
+    }): Promise<BetterAuthImport>;
+    /** Import (or resume). Pass confirm_conflicts when the dry run reported conflicts. */
+    apply(id: string, body?: {
+        confirm_conflicts?: boolean;
+    }): Promise<BetterAuthImport>;
+    delete(id: string): Promise<{
+        object: "better_auth_import";
+        id: string;
+        deleted: true;
+    }>;
+    /** Better Auth JWT keys published in the instance JWKS for the cutover. */
+    listJwks(): Promise<CursorPage<ImportedJwk>>;
+    deleteJwk(kid: string): Promise<{
+        object: "imported_jwk";
+        kid: string;
+        deleted: true;
+    }>;
+    /** Create an import, upload the sealed bundle text in parts and finalize it. */
+    upload(bundleText: string, opts?: {
+        options?: BetterAuthImportOptions;
+        partBytes?: number;
+        onPart?: (n: number, of: number) => void;
+    }): Promise<BetterAuthImport>;
+    /** Poll until the import leaves analyzing / queued / applying. */
+    waitFor(id: string, opts?: {
+        intervalMs?: number;
+        timeoutMs?: number;
+        onProgress?: (imp: BetterAuthImport) => void;
+        sleep?: (ms: number) => Promise<void>;
+    }): Promise<BetterAuthImport>;
+};
+export {};