@atlasauth/backend 0.16.0 → 0.18.0

package/dist/client/policies.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.policiesResource = policiesResource;
+exports.policySourceResource = policySourceResource;
+const request_1 = require("./request");
+function policiesResource(request) {
+    return {
+        /** `GET /v1/policies` — active policies (`include_retired` for all). */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/policies', query: { ...params } });
+        },
+        /** `POST /v1/policies`. */
+        create(body) {
+            return request({ method: 'POST', path: '/v1/policies', body });
+        },
+        /** `GET /v1/policies/:id` — by id or key. */
+        get(idOrKey) {
+            return request({ method: 'GET', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}` });
+        },
+        /** `PATCH /v1/policies/:id`. */
+        update(idOrKey, body) {
+            return request({ method: 'PATCH', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}`, body });
+        },
+        /** `DELETE /v1/policies/:id` — deletes a never-published policy, retires one with history. */
+        delete(idOrKey) {
+            return request({ method: 'DELETE', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}` });
+        },
+        versions: {
+            list(idOrKey) {
+                return request({ method: 'GET', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions` });
+            },
+            /** `POST /v1/policies/:id/versions` — a draft (or published at once with `publish: true`). */
+            create(idOrKey, body) {
+                return request({ method: 'POST', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions`, body });
+            },
+            get(idOrKey, versionIdOrLabel) {
+                return request({ method: 'GET', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions/${(0, request_1.enc)(versionIdOrLabel)}` });
+            },
+            /** Drafts only. */
+            update(idOrKey, versionIdOrLabel, body) {
+                return request({ method: 'PATCH', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions/${(0, request_1.enc)(versionIdOrLabel)}`, body });
+            },
+            /** Drafts only. */
+            delete(idOrKey, versionIdOrLabel) {
+                return request({ method: 'DELETE', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions/${(0, request_1.enc)(versionIdOrLabel)}` });
+            },
+            /** `POST …/publish` — `effective_at` (epoch ms or ISO; default now) is when the gate starts asking for it. */
+            publish(idOrKey, versionIdOrLabel, body = {}) {
+                return request({ method: 'POST', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions/${(0, request_1.enc)(versionIdOrLabel)}/publish`, body });
+            },
+            retire(idOrKey, versionIdOrLabel) {
+                return request({ method: 'POST', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions/${(0, request_1.enc)(versionIdOrLabel)}/retire` });
+            },
+        },
+        /** `GET /v1/policies/:id/acceptances` — who accepted, newest first. */
+        listAcceptances(idOrKey, params = {}) {
+            return request({ method: 'GET', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/acceptances`, query: { ...params } });
+        },
+        /** The same as CSV (`format=csv`, up to 100,000 rows). */
+        exportAcceptancesCsv(idOrKey, params = {}) {
+            return request({ method: 'GET', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/acceptances`, query: { ...params, format: 'csv' }, raw: true });
+        },
+        /** `GET /v1/users/:id/policies` — a user's standing on every policy. */
+        forUser(userId) {
+            return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(userId)}/policies` });
+        },
+        settings: {
+            get() {
+                return request({ method: 'GET', path: '/v1/instance/policy_settings' });
+            },
+            update(body) {
+                return request({ method: 'PATCH', path: '/v1/instance/policy_settings', body });
+            },
+        },
+    };
+}
+function policySourceResource(request) {
+    return {
+        get() {
+            return request({ method: 'GET', path: '/v1/instance/policy_source' });
+        },
+        /** `PUT /v1/instance/policy_source` — partial; `signing_secret` is write-only. */
+        update(body) {
+            return request({ method: 'PUT', path: '/v1/instance/policy_source', body });
+        },
+        /** Disconnect the source (its policies and history stay). */
+        delete() {
+            return request({ method: 'DELETE', path: '/v1/instance/policy_source' });
+        },
+        /** A signed fetch of the feed, validated but not stored. */
+        test() {
+            return request({ method: 'POST', path: '/v1/instance/policy_source/test' });
+        },
+        /** Fetch and store now. */
+        sync() {
+            return request({ method: 'POST', path: '/v1/instance/policy_source/sync' });
+        },
+        listDeliveries(params = {}) {
+            return request({ method: 'GET', path: '/v1/instance/policy_source/deliveries', query: { ...params } });
+        },
+    };
+}
+//# sourceMappingURL=policies.js.map

package/dist/client/policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/client/policies.ts"],"names":[],"mappings":";;AA8OA,4CAsEC;AAED,oDA8BC;AApVD,uCAAgD;AA8OhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,wEAAwE;QACxE,IAAI,CAAC,SAAwC,EAAE;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,2BAA2B;QAC3B,MAAM,CAAC,IAAsB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,6CAA6C;QAC7C,GAAG,CAAC,OAAe;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,gCAAgC;QAChC,MAAM,CAAC,OAAe,EAAE,IAAsB;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,8FAA8F;QAC9F,MAAM,CAAC,OAAe;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,EAAE;YACR,IAAI,CAAC,OAAe;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,8FAA8F;YAC9F,MAAM,CAAC,OAAe,EAAE,IAA6B;gBACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,GAAG,CAAC,OAAe,EAAE,gBAAwB;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,aAAa,IAAA,aAAG,EAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,mBAAmB;YACnB,MAAM,CAAC,OAAe,EAAE,gBAAwB,EAAE,IAA6B;gBAC7E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,aAAa,IAAA,aAAG,EAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACpH,CAAC;YACD,mBAAmB;YACnB,MAAM,CAAC,OAAe,EAAE,gBAAwB;gBAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,aAAa,IAAA,aAAG,EAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,8GAA8G;YAC9G,OAAO,CAAC,OAAe,EAAE,gBAAwB,EAAE,OAA2C,EAAE;gBAC9F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,aAAa,IAAA,aAAG,EAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,CAAC,OAAe,EAAE,gBAAwB;gBAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,aAAa,IAAA,aAAG,EAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,CAAC;YACpH,CAAC;SACF;QACD,uEAAuE;QACvE,eAAe,CAAC,OAAe,EAAE,SAAsC,EAAE;YACvE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,0DAA0D;QAC1D,oBAAoB,CAAC,OAAe,EAAE,SAAwE,EAAE;YAC9G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACtI,CAAC;QACD,wEAAwE;QACxE,OAAO,CAAC,MAAc;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,QAAQ,EAAE;YACR,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,IAAiC;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,kFAAkF;QAClF,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,6DAA6D;QAC7D,MAAM;YACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,4DAA4D;QAC5D,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,2BAA2B;QAC3B,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,cAAc,CAAC,SAAsF,EAAE;YAMrG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/users.d.ts

@@ -664,6 +664,14 @@ export interface RecordUserConsentBody {
     status?: 'accepted' | 'withdrawn';
     source?: string;
     metadata?: Record<string, unknown>;
+    /** Policy acceptance evidence: the exact version (must be that version of that policy). */
+    policy_version_id?: string;
+    /** Must equal the version's `content_sha256` when given. */
+    content_sha256?: string;
+    display?: 'checkbox' | 'scroll' | 'link';
+    scrolled_to_end?: boolean;
+    view_ms?: number;
+    locale?: string;
 }
 export interface UserConsent {
     object: 'consent';
@@ -673,6 +681,13 @@ export interface UserConsent {
     status: 'accepted' | 'withdrawn' | (string & {});
     source: string | null;
     metadata?: unknown;
+    /** Policy acceptance evidence (null on records made outside a policy flow). */
+    policy_version_id?: string | null;
+    content_sha256?: string | null;
+    display?: 'checkbox' | 'scroll' | 'link' | null;
+    scrolled_to_end?: boolean | null;
+    view_ms?: number | null;
+    locale?: string | null;
     created_at: number;
 }
 export interface CreateUserApprovalRequestBody {

package/dist/index.d.ts

@@ -3,12 +3,16 @@ export { DiscoveryError, JwksDiscovery, discoveryUrlFor, instanceIdFromPublishab
 export * from './verify';
 export * from './access-control';
 export * from './handshake';
+export * from './better-auth';
+export { BETTER_AUTH_JWT_ALGS, peekIssuer } from './legacy-issuers';
+export type { LegacyIssuer } from './legacy-issuers';
 export { BACKCHANNEL_LOGOUT_EVENT, LOGOUT_TOKEN_CLOCK_SKEW_SECONDS, LOGOUT_TOKEN_MAX_AGE_SECONDS, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
 export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions, } from './logout-token';
 export { AtlasOidcError, OIDC_FLOW_COOKIE, OIDC_FLOW_MAX_AGE_SECONDS, oidc, oidcCallback, oidcClearCookie, oidcLogoutUrl, oidcStart, oidcVerifyIdToken, resetOidcCaches, } from './oidc';
 export type { AtlasOidc, AtlasOidcErrorCode, OidcCallbackOptions, OidcClientAuth, OidcIdentity, OidcLogoutUrlOptions, OidcStartOptions, OidcStartResult, VerifyIdTokenOptions, } from './oidc';
 export * from './webhooks';
 export * from './referrals';
+export * from './policy-source';
 export * from './botid';
 export { createAtlasClient } from './client';
 export type { AtlasClient } from './client';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
+exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.peekIssuer = exports.BETTER_AUTH_JWT_ALGS = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
 // §7.3 token verification — the original surface, unchanged.
 __exportStar(require("./jwks-cache"), exports);
 // OIDC discovery of the JWKS URL when only `issuer` is configured.
@@ -26,6 +26,11 @@ Object.defineProperty(exports, "instanceIdFromPublishableKey", { enumerable: tru
 __exportStar(require("./verify"), exports);
 __exportStar(require("./access-control"), exports);
 __exportStar(require("./handshake"), exports);
+// Moving from Better Auth: exchange its session cookie once, accept its JWTs for a window.
+__exportStar(require("./better-auth"), exports);
+var legacy_issuers_1 = require("./legacy-issuers");
+Object.defineProperty(exports, "BETTER_AUTH_JWT_ALGS", { enumerable: true, get: function () { return legacy_issuers_1.BETTER_AUTH_JWT_ALGS; } });
+Object.defineProperty(exports, "peekIssuer", { enumerable: true, get: function () { return legacy_issuers_1.peekIssuer; } });
 // OIDC Back-Channel Logout: verify the logout_token Atlas POSTs to your app.
 var logout_token_1 = require("./logout-token");
 Object.defineProperty(exports, "BACKCHANNEL_LOGOUT_EVENT", { enumerable: true, get: function () { return logout_token_1.BACKCHANNEL_LOGOUT_EVENT; } });
@@ -51,6 +56,7 @@ Object.defineProperty(exports, "resetOidcCaches", { enumerable: true, get: funct
 __exportStar(require("./webhooks"), exports);
 // The Atlas referral protocol, for a referral platform receiving Atlas's signed calls.
 __exportStar(require("./referrals"), exports);
+__exportStar(require("./policy-source"), exports);
 // Vercel BotID: sign checkBotId() verdicts on your Vercel route for Atlas's captcha gate.
 __exportStar(require("./botid"), exports);
 // The typed management client for the secret-key Backend API.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAGzC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}

package/dist/legacy-issuers.d.ts

@@ -0,0 +1,65 @@
+import { type Jwks } from './jwks-cache';
+/**
+ * Accepting your OLD auth provider's JWTs during a cutover — today, Better
+ * Auth's `jwt` plugin tokens.
+ *
+ * When you move to Atlas, API clients may still hold short-lived JWTs your
+ * Better Auth app minted. With `legacyIssuers` on an {@link AtlasBackend}, a
+ * token whose `iss` is one of these issuers is verified against THAT issuer's
+ * key set (the JWKS you imported into Atlas, or the old app's `/api/auth/jwks`)
+ * for a bounded window, and its `sub` (the Better Auth user id) is mapped to the
+ * Atlas user id — Atlas keeps the Better Auth id as the user's `external_id`.
+ * After `until`, those tokens are refused like any other foreign token.
+ */
+export interface LegacyIssuer {
+    /** The old provider. Only `better_auth` today. */
+    kind?: 'better_auth';
+    /** The `iss` the old tokens carry (Better Auth: its `baseURL`, unless `jwt.issuer` was set). */
+    issuer: string;
+    /** The imported key set. Exactly one of `jwks` / `jwksUrl`. */
+    jwks?: Jwks;
+    /** Where to fetch the old key set (e.g. `https://app.example.com/api/auth/jwks`). */
+    jwksUrl?: string;
+    /** Expected `aud` (Better Auth: its `baseURL`, unless `jwt.audience` was set). Unchecked when unset. */
+    audience?: string | readonly string[];
+    /** The end of the acceptance window. Required: a legacy issuer is never accepted forever. */
+    until: Date | string | number;
+    /** Signing algorithms to accept. Default: Better Auth's (EdDSA, ES256, ES512, RS256, PS256). */
+    algorithms?: readonly string[];
+    /**
+     * Map the old `sub` to the Atlas user id. Default: look the user up by
+     * `external_id` through the Backend API (needs `secretKey` + `bapiBaseUrl`
+     * on the backend), cached in memory. Return null to refuse the token.
+     */
+    resolveSubject?: (legacySub: string, claims: Record<string, unknown>) => Promise<string | null> | string | null;
+}
+/** Better Auth's `jwt` plugin key algorithms. */
+export declare const BETTER_AUTH_JWT_ALGS: string[];
+export interface LegacyVerifierDeps {
+    issuers: readonly LegacyIssuer[];
+    secretKey?: string;
+    bapiBaseUrl?: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    clockToleranceSeconds: number;
+}
+export type LegacyVerifyOutcome = {
+    ok: true;
+    claims: Record<string, unknown>;
+} | {
+    ok: false;
+    reason: 'invalid' | 'no_keys';
+};
+/** The unverified `iss` of a compact JWT, for routing only — never trusted on its own. */
+export declare function peekIssuer(token: string): string | undefined;
+export declare class LegacyIssuerVerifier {
+    private readonly deps;
+    private readonly caches;
+    private readonly subjects;
+    constructor(deps: LegacyVerifierDeps);
+    private get now();
+    /** The configured entry for this `iss`, when its window is still open. */
+    match(iss: string | undefined): LegacyIssuer | undefined;
+    verify(token: string, entry: LegacyIssuer): Promise<LegacyVerifyOutcome>;
+    private resolve;
+}

package/dist/legacy-issuers.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LegacyIssuerVerifier = exports.BETTER_AUTH_JWT_ALGS = void 0;
+exports.peekIssuer = peekIssuer;
+const jose_1 = require("jose");
+const jwks_cache_1 = require("./jwks-cache");
+/** Better Auth's `jwt` plugin key algorithms. */
+exports.BETTER_AUTH_JWT_ALGS = ['EdDSA', 'ES256', 'ES512', 'RS256', 'PS256'];
+/** How long a resolved sub → Atlas id mapping is reused. */
+const SUBJECT_TTL_MS = 5 * 60_000;
+/** Cap on cached subjects, so a stream of distinct tokens can't grow memory without bound. */
+const SUBJECT_CACHE_MAX = 10_000;
+/** The unverified `iss` of a compact JWT, for routing only — never trusted on its own. */
+function peekIssuer(token) {
+    try {
+        const iss = (0, jose_1.decodeJwt)(token).iss;
+        return typeof iss === 'string' ? iss : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function untilMs(until) {
+    const t = until instanceof Date ? until.getTime() : typeof until === 'number' ? until : Date.parse(until);
+    return Number.isFinite(t) ? t : 0;
+}
+class LegacyIssuerVerifier {
+    deps;
+    caches = new Map();
+    subjects = new Map();
+    constructor(deps) {
+        this.deps = deps;
+        for (const entry of deps.issuers) {
+            const hasUrl = typeof entry.jwksUrl === 'string' && entry.jwksUrl.length > 0;
+            if (hasUrl === (entry.jwks !== undefined)) {
+                throw new Error(`legacyIssuers: "${entry.issuer}" needs exactly one of \`jwks\` or \`jwksUrl\`.`);
+            }
+            if (!entry.issuer)
+                throw new Error('legacyIssuers: every entry needs `issuer`.');
+            if (!untilMs(entry.until))
+                throw new Error(`legacyIssuers: "${entry.issuer}" needs a valid \`until\` (the end of the window).`);
+            if (!entry.resolveSubject && (!deps.secretKey || !deps.bapiBaseUrl)) {
+                throw new Error(`legacyIssuers: "${entry.issuer}" maps its \`sub\` to an Atlas user through the Backend API, which needs \`secretKey\` and \`bapiBaseUrl\` on AtlasBackend — or give the issuer a \`resolveSubject\`.`);
+            }
+            this.caches.set(entry.issuer, new jwks_cache_1.JwksCache({
+                url: hasUrl ? entry.jwksUrl : undefined,
+                staticJwks: entry.jwks,
+                fetchImpl: deps.fetchImpl,
+                now: deps.now,
+            }));
+        }
+    }
+    get now() {
+        return (this.deps.now ?? Date.now)();
+    }
+    /** The configured entry for this `iss`, when its window is still open. */
+    match(iss) {
+        if (!iss)
+            return undefined;
+        const entry = this.deps.issuers.find((e) => e.issuer === iss);
+        if (!entry)
+            return undefined;
+        return untilMs(entry.until) > this.now ? entry : undefined;
+    }
+    async verify(token, entry) {
+        const cache = this.caches.get(entry.issuer);
+        const keys = await cache.get((0, jwks_cache_1.readKid)(token));
+        if (!keys || keys.keys.length === 0)
+            return { ok: false, reason: 'no_keys' };
+        let payload;
+        try {
+            const verified = await (0, jose_1.jwtVerify)(token, (0, jose_1.createLocalJWKSet)(keys), {
+                algorithms: [...(entry.algorithms ?? exports.BETTER_AUTH_JWT_ALGS)],
+                issuer: entry.issuer,
+                ...(entry.audience !== undefined ? { audience: entry.audience } : {}),
+                clockTolerance: this.deps.clockToleranceSeconds,
+                currentDate: this.deps.now ? new Date(this.deps.now()) : undefined,
+            });
+            payload = verified.payload;
+        }
+        catch {
+            return { ok: false, reason: 'invalid' };
+        }
+        // A legacy token without an expiry would outlive the window it is accepted in.
+        if (typeof payload.exp !== 'number')
+            return { ok: false, reason: 'invalid' };
+        const legacySub = typeof payload.sub === 'string' && payload.sub ? payload.sub : typeof payload.id === 'string' ? payload.id : '';
+        if (!legacySub)
+            return { ok: false, reason: 'invalid' };
+        const atlasId = await this.resolve(legacySub, payload, entry);
+        if (!atlasId)
+            return { ok: false, reason: 'invalid' };
+        return {
+            ok: true,
+            claims: {
+                ...payload,
+                sub: atlasId,
+                sid: typeof payload.sid === 'string' ? payload.sid : '',
+                external_id: legacySub,
+                legacy: { kind: entry.kind ?? 'better_auth', issuer: entry.issuer, sub: legacySub },
+            },
+        };
+    }
+    async resolve(legacySub, claims, entry) {
+        if (entry.resolveSubject) {
+            try {
+                return (await entry.resolveSubject(legacySub, claims)) || null;
+            }
+            catch {
+                return null;
+            }
+        }
+        const key = `${entry.issuer}\u0000${legacySub}`;
+        const hit = this.subjects.get(key);
+        if (hit && this.now - hit.at < SUBJECT_TTL_MS)
+            return hit.id;
+        let id = null;
+        try {
+            const url = new URL('/v1/users', this.deps.bapiBaseUrl);
+            url.searchParams.set('external_id', legacySub);
+            url.searchParams.set('limit', '1');
+            const res = await (this.deps.fetchImpl ?? fetch)(url.toString(), {
+                headers: { authorization: `Bearer ${this.deps.secretKey}` },
+            });
+            if (!res.ok)
+                return null; // not cached: a transient failure should not stick
+            const body = (await res.json());
+            id = body.data?.[0]?.id ?? null;
+        }
+        catch {
+            return null;
+        }
+        if (this.subjects.size >= SUBJECT_CACHE_MAX)
+            this.subjects.clear();
+        this.subjects.set(key, { id, at: this.now });
+        return id;
+    }
+}
+exports.LegacyIssuerVerifier = LegacyIssuerVerifier;
+//# sourceMappingURL=legacy-issuers.js.map

package/dist/legacy-issuers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-issuers.js","sourceRoot":"","sources":["../src/legacy-issuers.ts"],"names":[],"mappings":";;;AA4DA,gCAOC;AAnED,+BAA+D;AAC/D,6CAA6D;AAqC7D,iDAAiD;AACpC,QAAA,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAElF,4DAA4D;AAC5D,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,8FAA8F;AAC9F,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAejC,0FAA0F;AAC1F,SAAgB,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QACjC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAA4B;IAC3C,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1G,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,MAAa,oBAAoB;IAIF;IAHZ,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IACtC,QAAQ,GAAG,IAAI,GAAG,EAA6C,CAAC;IAEjF,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QACnD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7E,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,iDAAiD,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACjF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,oDAAoD,CAAC,CAAC;YAChI,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,CAAC,MAAM,uKAAuK,CACvM,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,KAAK,CAAC,MAAM,EACZ,IAAI,sBAAS,CAAC;gBACZ,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACvC,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,GAAuB;QAC3B,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAmB;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE7E,IAAI,OAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBACxE,UAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,4BAAoB,CAAC,CAAC;gBAC3D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1F,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB;gBAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,+EAA+E;QAC/E,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE7E,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClI,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEtD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,GAAG,OAAO;gBACV,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBACvD,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE;aACpF;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,MAA+B,EAAE,KAAmB;QAC3F,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,SAAS,SAAS,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,cAAc;YAAE,OAAO,GAAG,CAAC,EAAE,CAAC;QAE7D,IAAI,EAAE,GAAkB,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAY,CAAC,CAAC;YACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC/D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,SAAU,EAAE,EAAE;aAC7D,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,CAAC,mDAAmD;YAC7E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;YACrE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,iBAAiB;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AA7GD,oDA6GC"}

package/dist/policy-source.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Atlas policy source protocol v1 — helpers for the system that SERVES an
+ * Atlas instance's policy documents (a CMS, a docs platform, your own service).
+ *
+ *  Atlas → you:  GET {endpoint_url}/policies            (full feed)
+ *                GET {endpoint_url}/policies?key=<key>  (one policy, after your event)
+ *    signed with the source's signing secret: `atlas-id`, `atlas-timestamp`
+ *    (epoch ms) and `atlas-signature: v1,<base64 HMAC-SHA256>` over
+ *    `{atlas-id}.{atlas-timestamp}.GET\n{path+query}`. Verify it with
+ *    {@link verifyPolicyFeedRequest}, then answer a {@link PolicyFeed}.
+ *  You → Atlas:  POST {webhook_url} (from GET /v1/instance/policy_source), a
+ *    {@link PolicySourceEvent} signed with the same secret —
+ *    {@link signPolicySourceEvent} (Atlas-style) or any Standard Webhooks library.
+ *    Atlas then re-fetches that policy; it never stores content from the event.
+ */
+export declare const POLICY_SOURCE_PROTOCOL_VERSION = "2026-10-24";
+export declare const POLICY_SOURCE_VERSION_HEADER = "atlas-policies-version";
+export interface PolicyFeedVersion {
+    version: string;
+    /** Epoch ms or ISO 8601. */
+    published_at?: number | string;
+    /** When Atlas starts asking users for it (defaults to published_at). */
+    effective_at?: number | string;
+    /** One of content_html / content_markdown, or content_url for Atlas to snapshot. At most 512 KB. */
+    content_html?: string;
+    content_markdown?: string;
+    content_url?: string;
+    summary_of_changes?: string;
+    locale?: string;
+}
+export interface PolicyFeedPolicy {
+    /** Slug: lowercase letters, digits, `_` and `-`. */
+    key: string;
+    title: string;
+    display?: 'checkbox' | 'scroll' | 'link';
+    required?: boolean;
+    applies_to?: 'sign_up' | 'sign_in_and_sign_up';
+    versions: PolicyFeedVersion[];
+}
+/** The answer to `GET {endpoint_url}/policies`. */
+export interface PolicyFeed {
+    object: 'policy_list';
+    policies: PolicyFeedPolicy[];
+}
+export type PolicySourceEvent = {
+    type: 'policy.published';
+    key: string;
+    version: string;
+    occurred_at?: string | number;
+} | {
+    type: 'policy.retired';
+    key: string;
+    occurred_at?: string | number;
+};
+type HeadersLike = Headers | Record<string, string | string[] | undefined>;
+export type PolicyFeedVerifyResult = {
+    verified: true;
+    deliveryId: string;
+    timestamp: number;
+    key: string | null;
+    protocolVersion: string | undefined;
+} | {
+    verified: false;
+    reason: 'missing_headers' | 'malformed_signature' | 'stale_timestamp' | 'signature_mismatch' | 'wrong_method';
+};
+/**
+ * Verify Atlas's signed GET of your feed. Pass the request's path AND query
+ * exactly as received (e.g. `req.originalUrl`), and the method.
+ *
+ * ```ts
+ * app.get('/atlas/policies', (req, res) => {
+ *   const v = verifyPolicyFeedRequest({ method: req.method, pathAndQuery: req.originalUrl, headers: req.headers, secret });
+ *   if (!v.verified) return res.sendStatus(401);
+ *   res.json(buildFeed(v.key)); // PolicyFeed, one policy when v.key is set
+ * });
+ * ```
+ */
+export declare function verifyPolicyFeedRequest(input: {
+    method?: string;
+    pathAndQuery: string;
+    headers: HeadersLike;
+    secret: string;
+    now?: Date;
+    toleranceMs?: number;
+}): PolicyFeedVerifyResult;
+/**
+ * Sign an event for `POST {webhook_url}` (Atlas-style headers). Send `body`
+ * byte-for-byte as returned.
+ *
+ * ```ts
+ * const { body, headers } = signPolicySourceEvent({ event: { type: 'policy.published', key: 'tos', version: '2026-10-24' }, secret });
+ * await fetch(webhookUrl, { method: 'POST', headers: { 'content-type': 'application/json', ...headers }, body });
+ * ```
+ */
+export declare function signPolicySourceEvent(input: {
+    event: PolicySourceEvent;
+    secret: string;
+    id?: string;
+    timestampMs?: number;
+}): {
+    body: string;
+    headers: Record<string, string>;
+};
+export {};

package/dist/policy-source.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POLICY_SOURCE_VERSION_HEADER = exports.POLICY_SOURCE_PROTOCOL_VERSION = void 0;
+exports.verifyPolicyFeedRequest = verifyPolicyFeedRequest;
+exports.signPolicySourceEvent = signPolicySourceEvent;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Atlas policy source protocol v1 — helpers for the system that SERVES an
+ * Atlas instance's policy documents (a CMS, a docs platform, your own service).
+ *
+ *  Atlas → you:  GET {endpoint_url}/policies            (full feed)
+ *                GET {endpoint_url}/policies?key=<key>  (one policy, after your event)
+ *    signed with the source's signing secret: `atlas-id`, `atlas-timestamp`
+ *    (epoch ms) and `atlas-signature: v1,<base64 HMAC-SHA256>` over
+ *    `{atlas-id}.{atlas-timestamp}.GET\n{path+query}`. Verify it with
+ *    {@link verifyPolicyFeedRequest}, then answer a {@link PolicyFeed}.
+ *  You → Atlas:  POST {webhook_url} (from GET /v1/instance/policy_source), a
+ *    {@link PolicySourceEvent} signed with the same secret —
+ *    {@link signPolicySourceEvent} (Atlas-style) or any Standard Webhooks library.
+ *    Atlas then re-fetches that policy; it never stores content from the event.
+ */
+exports.POLICY_SOURCE_PROTOCOL_VERSION = '2026-10-24';
+exports.POLICY_SOURCE_VERSION_HEADER = 'atlas-policies-version';
+const TOLERANCE_MS = 5 * 60_000;
+function header(headers, name) {
+    if (typeof headers.get === 'function')
+        return headers.get(name) ?? undefined;
+    const bag = headers;
+    const direct = bag[name] ?? bag[Object.keys(bag).find((k) => k.toLowerCase() === name) ?? ''];
+    return Array.isArray(direct) ? direct[0] : direct;
+}
+function mac(secret, id, timestamp, payload) {
+    return (0, node_crypto_1.createHmac)('sha256', secret).update(`${id}.${timestamp}.${payload}`).digest();
+}
+/**
+ * Verify Atlas's signed GET of your feed. Pass the request's path AND query
+ * exactly as received (e.g. `req.originalUrl`), and the method.
+ *
+ * ```ts
+ * app.get('/atlas/policies', (req, res) => {
+ *   const v = verifyPolicyFeedRequest({ method: req.method, pathAndQuery: req.originalUrl, headers: req.headers, secret });
+ *   if (!v.verified) return res.sendStatus(401);
+ *   res.json(buildFeed(v.key)); // PolicyFeed, one policy when v.key is set
+ * });
+ * ```
+ */
+function verifyPolicyFeedRequest(input) {
+    if (input.method && input.method.toUpperCase() !== 'GET')
+        return { verified: false, reason: 'wrong_method' };
+    const id = header(input.headers, 'atlas-id');
+    const ts = header(input.headers, 'atlas-timestamp');
+    const sig = header(input.headers, 'atlas-signature');
+    if (!id || !ts || !sig)
+        return { verified: false, reason: 'missing_headers' };
+    const provided = sig
+        .trim()
+        .split(/\s+/)
+        .filter((e) => e.startsWith('v1,'))
+        .map((e) => Buffer.from(e.slice(3), 'base64'));
+    if (provided.length === 0)
+        return { verified: false, reason: 'malformed_signature' };
+    const timestamp = Number(ts);
+    const now = (input.now ?? new Date()).getTime();
+    if (!Number.isFinite(timestamp) || Math.abs(now - timestamp) > (input.toleranceMs ?? TOLERANCE_MS)) {
+        return { verified: false, reason: 'stale_timestamp' };
+    }
+    const expected = mac(input.secret, id, ts, `GET\n${input.pathAndQuery}`);
+    const ok = provided.some((p) => p.length === expected.length && (0, node_crypto_1.timingSafeEqual)(p, expected));
+    if (!ok)
+        return { verified: false, reason: 'signature_mismatch' };
+    let key = null;
+    const q = input.pathAndQuery.indexOf('?');
+    if (q !== -1)
+        key = new URLSearchParams(input.pathAndQuery.slice(q + 1)).get('key');
+    return { verified: true, deliveryId: id, timestamp, key, protocolVersion: header(input.headers, exports.POLICY_SOURCE_VERSION_HEADER) };
+}
+/**
+ * Sign an event for `POST {webhook_url}` (Atlas-style headers). Send `body`
+ * byte-for-byte as returned.
+ *
+ * ```ts
+ * const { body, headers } = signPolicySourceEvent({ event: { type: 'policy.published', key: 'tos', version: '2026-10-24' }, secret });
+ * await fetch(webhookUrl, { method: 'POST', headers: { 'content-type': 'application/json', ...headers }, body });
+ * ```
+ */
+function signPolicySourceEvent(input) {
+    const body = JSON.stringify({ occurred_at: new Date().toISOString(), ...input.event });
+    const id = input.id ?? `evt_${(0, node_crypto_1.randomUUID)()}`;
+    const ts = String(input.timestampMs ?? Date.now());
+    return {
+        body,
+        headers: {
+            'atlas-id': id,
+            'atlas-timestamp': ts,
+            'atlas-signature': `v1,${mac(input.secret, id, ts, body).toString('base64')}`,
+        },
+    };
+}
+//# sourceMappingURL=policy-source.js.map

package/dist/policy-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-source.js","sourceRoot":"","sources":["../src/policy-source.ts"],"names":[],"mappings":";;;AAqFA,0DA+BC;AAWD,sDAiBC;AAhJD,6CAAsE;AAEtE;;;;;;;;;;;;;;GAcG;AAEU,QAAA,8BAA8B,GAAG,YAAY,CAAC;AAC9C,QAAA,4BAA4B,GAAG,wBAAwB,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC;AAsChC,SAAS,MAAM,CAAC,OAAoB,EAAE,IAAY;IAChD,IAAI,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU;QAAE,OAAQ,OAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACvG,MAAM,GAAG,GAAG,OAAwD,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,GAAG,CAAC,MAAc,EAAE,EAAU,EAAE,SAAiB,EAAE,OAAe;IACzE,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACvF,CAAC;AAMD;;;;;;;;;;;GAWG;AACH,SAAgB,uBAAuB,CAAC,KAOvC;IACC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC7G,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAG,GAAG;SACjB,IAAI,EAAE;SACN,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACrF,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,YAAY,CAAC,EAAE,CAAC;QACnG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACzE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAClE,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,oCAA4B,CAAC,EAAE,CAAC;AAClI,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,KAKrC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,OAAO,IAAA,wBAAU,GAAE,EAAE,CAAC;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,OAAO;QACL,IAAI;QACJ,OAAO,EAAE;YACP,UAAU,EAAE,EAAE;YACd,iBAAiB,EAAE,EAAE;YACrB,iBAAiB,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;SAC9E;KACF,CAAC;AACJ,CAAC"}