@atlasauth/backend 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @atlasauth/backend changelog
 
+## 0.18.0 — 2026-10-24
+
+### Added
+
+- Policy acceptance: `policies` (`list`, `create`, `get`, `update`, `delete`, `versions.list/create/get/update/delete/publish/retire`, `listAcceptances`, `exportAcceptancesCsv`, `forUser`, `settings.get/update` for the `pol` session claim) and `policySource` (`get`, `update`, `delete`, `test`, `sync`, `listDeliveries`) for the external policy source.
+- Policy source protocol v1 helpers for the system that serves policies: `verifyPolicyFeedRequest()` (Atlas's signed `GET {endpoint}/policies`) and `signPolicySourceEvent()` (`policy.published` / `policy.retired`), with the `PolicyFeed` types.
+- `RecordUserConsentBody` / `UserConsent`: `policy_version_id`, `content_sha256`, `display`, `scrolled_to_end`, `view_ms`, `locale`.
+
 ## 0.17.0 — 2026-10-24
 
 ### Added

package/dist/client/index.d.ts

@@ -1159,6 +1159,75 @@ declare function buildNamespaces(request: RequestFn): {
         getBackfill(id: string): Promise<import("./referrals").ReferralBackfillJob>;
         getForUser(userId: string): Promise<import("./users").UserReferralResult>;
     };
+    policies: {
+        list(params?: {
+            include_retired?: boolean;
+        }): Promise<{
+            object: "list";
+            data: import("./policies").Policy[];
+        }>;
+        create(body: import("./policies").CreatePolicyBody): Promise<import("./policies").Policy>;
+        get(idOrKey: string): Promise<import("./policies").Policy>;
+        update(idOrKey: string, body: import("./policies").UpdatePolicyBody): Promise<import("./policies").Policy>;
+        delete(idOrKey: string): Promise<{
+            object: "policy";
+            id: string;
+            key: string;
+            deleted: boolean;
+            retired: boolean;
+            policy?: import("./policies").Policy;
+        }>;
+        versions: {
+            list(idOrKey: string): Promise<{
+                object: "list";
+                data: import("./policies").PolicyVersion[];
+            }>;
+            create(idOrKey: string, body: import("./policies").CreatePolicyVersionBody): Promise<import("./policies").PolicyVersion>;
+            get(idOrKey: string, versionIdOrLabel: string): Promise<import("./policies").PolicyVersion>;
+            update(idOrKey: string, versionIdOrLabel: string, body: import("./policies").UpdatePolicyVersionBody): Promise<import("./policies").PolicyVersion>;
+            delete(idOrKey: string, versionIdOrLabel: string): Promise<{
+                object: "policy_version";
+                id: string;
+                deleted: true;
+            }>;
+            publish(idOrKey: string, versionIdOrLabel: string, body?: {
+                effective_at?: number | string;
+            }): Promise<import("./policies").PolicyVersion>;
+            retire(idOrKey: string, versionIdOrLabel: string): Promise<import("./policies").PolicyVersion>;
+        };
+        listAcceptances(idOrKey: string, params?: import("./policies").ListPolicyAcceptancesParams): Promise<import("./policies").PolicyAcceptancePage>;
+        exportAcceptancesCsv(idOrKey: string, params?: Omit<import("./policies").ListPolicyAcceptancesParams, "limit" | "starting_after">): Promise<string>;
+        forUser(userId: string): Promise<{
+            object: "list";
+            user_id: string;
+            data: import("./policies").PolicyStanding[];
+            needs_acceptance: boolean;
+        }>;
+        settings: {
+            get(): Promise<import("./policies").PolicySettings>;
+            update(body: {
+                session_claim?: boolean;
+            }): Promise<import("./policies").PolicySettings>;
+        };
+    };
+    policySource: {
+        get(): Promise<import("./policies").PolicySource>;
+        update(body: import("./policies").UpdatePolicySourceBody): Promise<import("./policies").PolicySource>;
+        delete(): Promise<import("./policies").PolicySource>;
+        test(): Promise<import("./policies").PolicySourceTest>;
+        sync(): Promise<import("./policies").PolicySourceSync>;
+        listDeliveries(params?: {
+            limit?: number;
+            starting_after?: string;
+            kind?: string;
+            status?: string;
+        }): Promise<{
+            object: "list";
+            data: import("./policies").PolicySourceDelivery[];
+            has_more: boolean;
+            next_cursor: string | null;
+        }>;
+    };
     userHooks: {
         getBeforeUserCreate(): Promise<import("./user-hooks").BeforeUserCreateHook>;
         updateBeforeUserCreate(body: import("./user-hooks").UpdateBeforeUserCreateHookBody): Promise<import("./user-hooks").BeforeUserCreateHook>;
@@ -1546,6 +1615,7 @@ export * from './lti-platforms';
 export * from './instance';
 export * from './instance-security';
 export * from './referrals';
+export * from './policies';
 export * from './user-hooks';
 export * from './tokens';
 export * from './captcha';

package/dist/client/index.js

@@ -64,6 +64,7 @@ const lti_platforms_1 = require("./lti-platforms");
 const instance_1 = require("./instance");
 const instance_security_1 = require("./instance-security");
 const referrals_1 = require("./referrals");
+const policies_1 = require("./policies");
 const user_hooks_1 = require("./user-hooks");
 const tokens_1 = require("./tokens");
 const captcha_1 = require("./captcha");
@@ -161,6 +162,9 @@ function buildNamespaces(request) {
         instanceSecurity: (0, instance_security_1.instanceSecurityResource)(request),
         // Referral attribution: the instance's referral platform connection and call log.
         referrals: (0, referrals_1.referralsResource)(request),
+        // Policy acceptance: policies, versions, acceptances, settings, and the external policy source.
+        policies: (0, policies_1.policiesResource)(request),
+        policySource: (0, policies_1.policySourceResource)(request),
         // The before_user_create hook (sets external_id before the user exists).
         userHooks: (0, user_hooks_1.userHooksResource)(request),
         tokens: (0, tokens_1.tokensResource)(request),
@@ -257,6 +261,7 @@ __exportStar(require("./lti-platforms"), exports);
 __exportStar(require("./instance"), exports);
 __exportStar(require("./instance-security"), exports);
 __exportStar(require("./referrals"), exports);
+__exportStar(require("./policies"), exports);
 __exportStar(require("./user-hooks"), exports);
 __exportStar(require("./tokens"), exports);
 __exportStar(require("./captcha"), exports);

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAkFA,8CAQC;AA1FD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,2CAA+C;AAC/C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,qDAAkF;AAClF,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,+DAAkE;AAClE,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,2CAAgD;AAChD,6CAAiD;AACjD,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,qEAAwE;AACxE,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,wDAAwD;QACxD,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,eAAe,EAAE,IAAA,wCAAuB,EAAC,OAAO,CAAC;QACjD,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,+EAA+E;QAC/E,iBAAiB,EAAE,IAAA,+CAAyB,EAAC,OAAO,CAAC;QACrD,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,kFAAkF;QAClF,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,yEAAyE;QACzE,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,oBAAoB,EAAE,IAAA,qDAA4B,EAAC,OAAO,CAAC;QAC3D,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,8CAA4B;AAC5B,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,wDAAsC;AACtC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,8CAA4B;AAC5B,+CAA6B;AAC7B,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,2DAAyC;AACzC,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAmFA,8CAQC;AA3FD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,2CAA+C;AAC/C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,qDAAkF;AAClF,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,+DAAkE;AAClE,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,2CAAgD;AAChD,yCAAoE;AACpE,6CAAiD;AACjD,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,qEAAwE;AACxE,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,wDAAwD;QACxD,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,eAAe,EAAE,IAAA,wCAAuB,EAAC,OAAO,CAAC;QACjD,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,+EAA+E;QAC/E,iBAAiB,EAAE,IAAA,+CAAyB,EAAC,OAAO,CAAC;QACrD,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,kFAAkF;QAClF,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,gGAAgG;QAChG,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,+BAAoB,EAAC,OAAO,CAAC;QAC3C,yEAAyE;QACzE,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,oBAAoB,EAAE,IAAA,qDAA4B,EAAC,OAAO,CAAC;QAC3D,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,8CAA4B;AAC5B,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,wDAAsC;AACtC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,8CAA4B;AAC5B,6CAA2B;AAC3B,+CAA6B;AAC7B,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,2DAAyC;AACzC,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}

package/dist/client/policies.d.ts

@@ -0,0 +1,316 @@
+import { type RequestFn } from './request';
+/**
+ * Policy acceptance: the policies (Terms of Service, privacy policy, any key)
+ * your users accept at sign-up — and, per policy, again at sign-in when a new
+ * version takes effect. A policy's versions go draft → published (with an
+ * `effective_at`) → retired; a published version is immutable, and its
+ * `content_sha256` is the SHA-256 of the sanitised HTML users are shown.
+ * Acceptances are consent records carrying that hash and the reading evidence.
+ *
+ * Content can also come from any external system through the Atlas policy
+ * source protocol (`policySource`): Atlas fetches `GET {endpoint_url}/policies`
+ * signed like an Atlas webhook, and your system tells Atlas about a new
+ * version with a signed `policy.published` event.
+ */
+export type PolicyDisplay = 'checkbox' | 'scroll' | 'link';
+export type PolicyAppliesTo = 'sign_up' | 'sign_in_and_sign_up';
+export type PolicyReaccept = 'none' | 'next_sign_in' | 'grace';
+export interface PolicyVersionRef {
+    id: string;
+    version: string;
+    status: 'draft' | 'published' | 'retired' | (string & {});
+    content_sha256: string;
+    published_at: number | null;
+    effective_at: number | null;
+}
+export interface Policy {
+    object: 'policy';
+    id: string;
+    key: string;
+    title: string;
+    display: PolicyDisplay;
+    required: boolean;
+    applies_to: PolicyAppliesTo;
+    reaccept: PolicyReaccept;
+    grace_days: number | null;
+    source: 'atlas' | 'external';
+    position: number;
+    status: 'active' | 'retired';
+    /** External policies: fields changed in Atlas that a sync keeps. */
+    overrides: string[];
+    /** The version in effect now. */
+    current_version: PolicyVersionRef | null;
+    /** A newer published version that is not in effect yet. */
+    upcoming_version: PolicyVersionRef | null;
+    /** The newest version of any status (drafts included). */
+    latest_version: PolicyVersionRef | null;
+    retired_at: number | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface PolicyVersion {
+    object: 'policy_version';
+    id: string;
+    policy_id: string;
+    policy: string;
+    version: string;
+    status: 'draft' | 'published' | 'retired';
+    content_markdown: string | null;
+    /** The sanitised HTML clients render. */
+    content_html: string;
+    content_url: string | null;
+    /** Hex SHA-256 of `content_html`. */
+    content_sha256: string;
+    summary_of_changes: string | null;
+    locale: string | null;
+    published_at: number | null;
+    effective_at: number | null;
+    retired_at: number | null;
+    created_at: number;
+    updated_at: number;
+    /** On list: how many users accepted this version. */
+    acceptance_count?: number;
+}
+export interface PolicyAcceptance {
+    object: 'policy_acceptance';
+    id: string;
+    user_id: string;
+    policy: string;
+    version: string;
+    policy_version_id: string | null;
+    status: 'accepted' | 'withdrawn';
+    source: 'signup' | 'signin' | 'reaccept' | 'api' | 'import' | (string & {}) | null;
+    content_sha256: string | null;
+    display: PolicyDisplay | null;
+    scrolled_to_end: boolean | null;
+    view_ms: number | null;
+    locale: string | null;
+    ip: string | null;
+    user_agent: string | null;
+    accepted_at: number;
+}
+export interface PolicyStanding {
+    object: 'policy_standing';
+    policy: string;
+    policy_id: string;
+    title: string;
+    display: PolicyDisplay;
+    required: boolean;
+    applies_to: PolicyAppliesTo;
+    reaccept: PolicyReaccept;
+    current_version_id: string | null;
+    current_version: string | null;
+    content_sha256: string | null;
+    summary_of_changes: string | null;
+    accepted_version_id: string | null;
+    accepted_version: string | null;
+    accepted_at: number | null;
+    needs_reaccept: boolean;
+    /** Accepting is required before the user's next sign-in completes. */
+    blocking: boolean;
+    grace_ends_at: number | null;
+}
+export interface CreatePolicyBody {
+    /** Slug, unique per instance (e.g. `tos`, `privacy`). Becomes the consent record's `policy`. */
+    key: string;
+    title: string;
+    display?: PolicyDisplay;
+    required?: boolean;
+    applies_to?: PolicyAppliesTo;
+    reaccept?: PolicyReaccept;
+    /** Required with `reaccept: 'grace'` (1–365). */
+    grace_days?: number | null;
+    position?: number;
+}
+export type UpdatePolicyBody = Partial<Omit<CreatePolicyBody, 'key'>> & {
+    status?: 'active' | 'retired';
+};
+export interface CreatePolicyVersionBody {
+    /** A label such as `2026-10-24` or `1.2.0`, unique per policy. */
+    version: string;
+    /** Markdown (rendered and sanitised by Atlas) — or `content_html`. */
+    content_markdown?: string;
+    content_html?: string;
+    content_url?: string | null;
+    summary_of_changes?: string | null;
+    locale?: string | null;
+    /** Publish immediately instead of saving a draft. */
+    publish?: boolean;
+    /** With `publish`: when the gate starts asking for it (epoch ms or ISO; default now). */
+    effective_at?: number | string;
+}
+export type UpdatePolicyVersionBody = Partial<Omit<CreatePolicyVersionBody, 'publish' | 'effective_at'>>;
+export interface ListPolicyAcceptancesParams {
+    /** A version id or label. */
+    version?: string;
+    /** `accepted` (default), `withdrawn` or `all`. */
+    status?: 'accepted' | 'withdrawn' | 'all';
+    limit?: number;
+    starting_after?: string;
+}
+export interface PolicyAcceptancePage {
+    object: 'list';
+    data: PolicyAcceptance[];
+    has_more: boolean;
+    next_cursor: string | null;
+}
+export interface PolicySettings {
+    object: 'policy_settings';
+    /** Put `pol` (accepted versions of required policies) on session tokens. */
+    session_claim: boolean;
+}
+export interface PolicySource {
+    object: 'policy_source';
+    enabled: boolean;
+    endpoint_url: string | null;
+    signing_secret_set: boolean;
+    sync: 'webhook' | 'poll';
+    poll_interval_minutes: number;
+    /** Where your source sends `policy.published` / `policy.retired` events. */
+    webhook_url: string | null;
+    protocol_version: string;
+    last_synced_at: number | null;
+    last_sync_ok: boolean | null;
+    last_sync_error: string | null;
+    next_poll_at: number | null;
+}
+export interface UpdatePolicySourceBody {
+    enabled?: boolean;
+    /** Base URL; Atlas calls `GET {endpoint_url}/policies`. */
+    endpoint_url?: string | null;
+    /** Write-only (a `whsec_` secret works). */
+    signing_secret?: string | null;
+    sync?: 'webhook' | 'poll';
+    /** Poll mode: 5–1440. */
+    poll_interval_minutes?: number;
+}
+export interface PolicySourceDelivery {
+    object: 'policy_source_delivery';
+    id: string;
+    direction: 'outbound' | 'inbound';
+    kind: 'fetch' | 'test' | 'poll' | 'webhook';
+    status: 'ok' | 'failed' | 'rejected';
+    http_status: number | null;
+    error: string | null;
+    event_type: string | null;
+    policy: string | null;
+    version: string | null;
+    url: string | null;
+    changes: Record<string, unknown> | null;
+    latency_ms: number | null;
+    created_at: number;
+}
+export interface PolicySourceTest {
+    object: 'policy_source_test';
+    ok: boolean;
+    http_status: number | null;
+    latency_ms: number | null;
+    error: string | null;
+    warnings: string[];
+    policies: Array<{
+        key: string;
+        title: string;
+        versions: string[];
+    }>;
+    delivery: PolicySourceDelivery;
+}
+export interface PolicySourceSync {
+    object: 'policy_source_sync';
+    ok: boolean;
+    error: string | null;
+    warnings: string[];
+    changes: {
+        created: string[];
+        updated: string[];
+        published: string[];
+        unchanged: string[];
+        rejected: string[];
+        retired: string[];
+    } | null;
+    delivery: PolicySourceDelivery;
+}
+export declare function policiesResource(request: RequestFn): {
+    /** `GET /v1/policies` — active policies (`include_retired` for all). */
+    list(params?: {
+        include_retired?: boolean;
+    }): Promise<{
+        object: "list";
+        data: Policy[];
+    }>;
+    /** `POST /v1/policies`. */
+    create(body: CreatePolicyBody): Promise<Policy>;
+    /** `GET /v1/policies/:id` — by id or key. */
+    get(idOrKey: string): Promise<Policy>;
+    /** `PATCH /v1/policies/:id`. */
+    update(idOrKey: string, body: UpdatePolicyBody): Promise<Policy>;
+    /** `DELETE /v1/policies/:id` — deletes a never-published policy, retires one with history. */
+    delete(idOrKey: string): Promise<{
+        object: "policy";
+        id: string;
+        key: string;
+        deleted: boolean;
+        retired: boolean;
+        policy?: Policy;
+    }>;
+    versions: {
+        list(idOrKey: string): Promise<{
+            object: "list";
+            data: PolicyVersion[];
+        }>;
+        /** `POST /v1/policies/:id/versions` — a draft (or published at once with `publish: true`). */
+        create(idOrKey: string, body: CreatePolicyVersionBody): Promise<PolicyVersion>;
+        get(idOrKey: string, versionIdOrLabel: string): Promise<PolicyVersion>;
+        /** Drafts only. */
+        update(idOrKey: string, versionIdOrLabel: string, body: UpdatePolicyVersionBody): Promise<PolicyVersion>;
+        /** Drafts only. */
+        delete(idOrKey: string, versionIdOrLabel: string): Promise<{
+            object: "policy_version";
+            id: string;
+            deleted: true;
+        }>;
+        /** `POST …/publish` — `effective_at` (epoch ms or ISO; default now) is when the gate starts asking for it. */
+        publish(idOrKey: string, versionIdOrLabel: string, body?: {
+            effective_at?: number | string;
+        }): Promise<PolicyVersion>;
+        retire(idOrKey: string, versionIdOrLabel: string): Promise<PolicyVersion>;
+    };
+    /** `GET /v1/policies/:id/acceptances` — who accepted, newest first. */
+    listAcceptances(idOrKey: string, params?: ListPolicyAcceptancesParams): Promise<PolicyAcceptancePage>;
+    /** The same as CSV (`format=csv`, up to 100,000 rows). */
+    exportAcceptancesCsv(idOrKey: string, params?: Omit<ListPolicyAcceptancesParams, "limit" | "starting_after">): Promise<string>;
+    /** `GET /v1/users/:id/policies` — a user's standing on every policy. */
+    forUser(userId: string): Promise<{
+        object: "list";
+        user_id: string;
+        data: PolicyStanding[];
+        needs_acceptance: boolean;
+    }>;
+    settings: {
+        get(): Promise<PolicySettings>;
+        update(body: {
+            session_claim?: boolean;
+        }): Promise<PolicySettings>;
+    };
+};
+export declare function policySourceResource(request: RequestFn): {
+    get(): Promise<PolicySource>;
+    /** `PUT /v1/instance/policy_source` — partial; `signing_secret` is write-only. */
+    update(body: UpdatePolicySourceBody): Promise<PolicySource>;
+    /** Disconnect the source (its policies and history stay). */
+    delete(): Promise<PolicySource>;
+    /** A signed fetch of the feed, validated but not stored. */
+    test(): Promise<PolicySourceTest>;
+    /** Fetch and store now. */
+    sync(): Promise<PolicySourceSync>;
+    listDeliveries(params?: {
+        limit?: number;
+        starting_after?: string;
+        kind?: string;
+        status?: string;
+    }): Promise<{
+        object: "list";
+        data: PolicySourceDelivery[];
+        has_more: boolean;
+        next_cursor: string | null;
+    }>;
+};

package/dist/client/policies.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.policiesResource = policiesResource;
+exports.policySourceResource = policySourceResource;
+const request_1 = require("./request");
+function policiesResource(request) {
+    return {
+        /** `GET /v1/policies` — active policies (`include_retired` for all). */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/policies', query: { ...params } });
+        },
+        /** `POST /v1/policies`. */
+        create(body) {
+            return request({ method: 'POST', path: '/v1/policies', body });
+        },
+        /** `GET /v1/policies/:id` — by id or key. */
+        get(idOrKey) {
+            return request({ method: 'GET', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}` });
+        },
+        /** `PATCH /v1/policies/:id`. */
+        update(idOrKey, body) {
+            return request({ method: 'PATCH', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}`, body });
+        },
+        /** `DELETE /v1/policies/:id` — deletes a never-published policy, retires one with history. */
+        delete(idOrKey) {
+            return request({ method: 'DELETE', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}` });
+        },
+        versions: {
+            list(idOrKey) {
+                return request({ method: 'GET', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions` });
+            },
+            /** `POST /v1/policies/:id/versions` — a draft (or published at once with `publish: true`). */
+            create(idOrKey, body) {
+                return request({ method: 'POST', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions`, body });
+            },
+            get(idOrKey, versionIdOrLabel) {
+                return request({ method: 'GET', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions/${(0, request_1.enc)(versionIdOrLabel)}` });
+            },
+            /** Drafts only. */
+            update(idOrKey, versionIdOrLabel, body) {
+                return request({ method: 'PATCH', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions/${(0, request_1.enc)(versionIdOrLabel)}`, body });
+            },
+            /** Drafts only. */
+            delete(idOrKey, versionIdOrLabel) {
+                return request({ method: 'DELETE', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions/${(0, request_1.enc)(versionIdOrLabel)}` });
+            },
+            /** `POST …/publish` — `effective_at` (epoch ms or ISO; default now) is when the gate starts asking for it. */
+            publish(idOrKey, versionIdOrLabel, body = {}) {
+                return request({ method: 'POST', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions/${(0, request_1.enc)(versionIdOrLabel)}/publish`, body });
+            },
+            retire(idOrKey, versionIdOrLabel) {
+                return request({ method: 'POST', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/versions/${(0, request_1.enc)(versionIdOrLabel)}/retire` });
+            },
+        },
+        /** `GET /v1/policies/:id/acceptances` — who accepted, newest first. */
+        listAcceptances(idOrKey, params = {}) {
+            return request({ method: 'GET', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/acceptances`, query: { ...params } });
+        },
+        /** The same as CSV (`format=csv`, up to 100,000 rows). */
+        exportAcceptancesCsv(idOrKey, params = {}) {
+            return request({ method: 'GET', path: `/v1/policies/${(0, request_1.enc)(idOrKey)}/acceptances`, query: { ...params, format: 'csv' }, raw: true });
+        },
+        /** `GET /v1/users/:id/policies` — a user's standing on every policy. */
+        forUser(userId) {
+            return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(userId)}/policies` });
+        },
+        settings: {
+            get() {
+                return request({ method: 'GET', path: '/v1/instance/policy_settings' });
+            },
+            update(body) {
+                return request({ method: 'PATCH', path: '/v1/instance/policy_settings', body });
+            },
+        },
+    };
+}
+function policySourceResource(request) {
+    return {
+        get() {
+            return request({ method: 'GET', path: '/v1/instance/policy_source' });
+        },
+        /** `PUT /v1/instance/policy_source` — partial; `signing_secret` is write-only. */
+        update(body) {
+            return request({ method: 'PUT', path: '/v1/instance/policy_source', body });
+        },
+        /** Disconnect the source (its policies and history stay). */
+        delete() {
+            return request({ method: 'DELETE', path: '/v1/instance/policy_source' });
+        },
+        /** A signed fetch of the feed, validated but not stored. */
+        test() {
+            return request({ method: 'POST', path: '/v1/instance/policy_source/test' });
+        },
+        /** Fetch and store now. */
+        sync() {
+            return request({ method: 'POST', path: '/v1/instance/policy_source/sync' });
+        },
+        listDeliveries(params = {}) {
+            return request({ method: 'GET', path: '/v1/instance/policy_source/deliveries', query: { ...params } });
+        },
+    };
+}
+//# sourceMappingURL=policies.js.map

package/dist/client/policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/client/policies.ts"],"names":[],"mappings":";;AA8OA,4CAsEC;AAED,oDA8BC;AApVD,uCAAgD;AA8OhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,wEAAwE;QACxE,IAAI,CAAC,SAAwC,EAAE;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,2BAA2B;QAC3B,MAAM,CAAC,IAAsB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,6CAA6C;QAC7C,GAAG,CAAC,OAAe;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,gCAAgC;QAChC,MAAM,CAAC,OAAe,EAAE,IAAsB;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,8FAA8F;QAC9F,MAAM,CAAC,OAAe;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,EAAE;YACR,IAAI,CAAC,OAAe;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,8FAA8F;YAC9F,MAAM,CAAC,OAAe,EAAE,IAA6B;gBACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,GAAG,CAAC,OAAe,EAAE,gBAAwB;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,aAAa,IAAA,aAAG,EAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,mBAAmB;YACnB,MAAM,CAAC,OAAe,EAAE,gBAAwB,EAAE,IAA6B;gBAC7E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,aAAa,IAAA,aAAG,EAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACpH,CAAC;YACD,mBAAmB;YACnB,MAAM,CAAC,OAAe,EAAE,gBAAwB;gBAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,aAAa,IAAA,aAAG,EAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,8GAA8G;YAC9G,OAAO,CAAC,OAAe,EAAE,gBAAwB,EAAE,OAA2C,EAAE;gBAC9F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,aAAa,IAAA,aAAG,EAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,CAAC,OAAe,EAAE,gBAAwB;gBAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,aAAa,IAAA,aAAG,EAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,CAAC;YACpH,CAAC;SACF;QACD,uEAAuE;QACvE,eAAe,CAAC,OAAe,EAAE,SAAsC,EAAE;YACvE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,0DAA0D;QAC1D,oBAAoB,CAAC,OAAe,EAAE,SAAwE,EAAE;YAC9G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACtI,CAAC;QACD,wEAAwE;QACxE,OAAO,CAAC,MAAc;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,QAAQ,EAAE;YACR,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,IAAiC;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,kFAAkF;QAClF,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,6DAA6D;QAC7D,MAAM;YACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,4DAA4D;QAC5D,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,2BAA2B;QAC3B,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,cAAc,CAAC,SAAsF,EAAE;YAMrG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/users.d.ts

@@ -664,6 +664,14 @@ export interface RecordUserConsentBody {
     status?: 'accepted' | 'withdrawn';
     source?: string;
     metadata?: Record<string, unknown>;
+    /** Policy acceptance evidence: the exact version (must be that version of that policy). */
+    policy_version_id?: string;
+    /** Must equal the version's `content_sha256` when given. */
+    content_sha256?: string;
+    display?: 'checkbox' | 'scroll' | 'link';
+    scrolled_to_end?: boolean;
+    view_ms?: number;
+    locale?: string;
 }
 export interface UserConsent {
     object: 'consent';
@@ -673,6 +681,13 @@ export interface UserConsent {
     status: 'accepted' | 'withdrawn' | (string & {});
     source: string | null;
     metadata?: unknown;
+    /** Policy acceptance evidence (null on records made outside a policy flow). */
+    policy_version_id?: string | null;
+    content_sha256?: string | null;
+    display?: 'checkbox' | 'scroll' | 'link' | null;
+    scrolled_to_end?: boolean | null;
+    view_ms?: number | null;
+    locale?: string | null;
     created_at: number;
 }
 export interface CreateUserApprovalRequestBody {

package/dist/index.d.ts

@@ -12,6 +12,7 @@ export { AtlasOidcError, OIDC_FLOW_COOKIE, OIDC_FLOW_MAX_AGE_SECONDS, oidc, oidc
 export type { AtlasOidc, AtlasOidcErrorCode, OidcCallbackOptions, OidcClientAuth, OidcIdentity, OidcLogoutUrlOptions, OidcStartOptions, OidcStartResult, VerifyIdTokenOptions, } from './oidc';
 export * from './webhooks';
 export * from './referrals';
+export * from './policy-source';
 export * from './botid';
 export { createAtlasClient } from './client';
 export type { AtlasClient } from './client';

package/dist/index.js

@@ -56,6 +56,7 @@ Object.defineProperty(exports, "resetOidcCaches", { enumerable: true, get: funct
 __exportStar(require("./webhooks"), exports);
 // The Atlas referral protocol, for a referral platform receiving Atlas's signed calls.
 __exportStar(require("./referrals"), exports);
+__exportStar(require("./policy-source"), exports);
 // Vercel BotID: sign checkBotId() verdicts on your Vercel route for Atlas's captcha gate.
 __exportStar(require("./botid"), exports);
 // The typed management client for the secret-key Backend API.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAGzC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAGzC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}

package/dist/policy-source.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Atlas policy source protocol v1 — helpers for the system that SERVES an
+ * Atlas instance's policy documents (a CMS, a docs platform, your own service).
+ *
+ *  Atlas → you:  GET {endpoint_url}/policies            (full feed)
+ *                GET {endpoint_url}/policies?key=<key>  (one policy, after your event)
+ *    signed with the source's signing secret: `atlas-id`, `atlas-timestamp`
+ *    (epoch ms) and `atlas-signature: v1,<base64 HMAC-SHA256>` over
+ *    `{atlas-id}.{atlas-timestamp}.GET\n{path+query}`. Verify it with
+ *    {@link verifyPolicyFeedRequest}, then answer a {@link PolicyFeed}.
+ *  You → Atlas:  POST {webhook_url} (from GET /v1/instance/policy_source), a
+ *    {@link PolicySourceEvent} signed with the same secret —
+ *    {@link signPolicySourceEvent} (Atlas-style) or any Standard Webhooks library.
+ *    Atlas then re-fetches that policy; it never stores content from the event.
+ */
+export declare const POLICY_SOURCE_PROTOCOL_VERSION = "2026-10-24";
+export declare const POLICY_SOURCE_VERSION_HEADER = "atlas-policies-version";
+export interface PolicyFeedVersion {
+    version: string;
+    /** Epoch ms or ISO 8601. */
+    published_at?: number | string;
+    /** When Atlas starts asking users for it (defaults to published_at). */
+    effective_at?: number | string;
+    /** One of content_html / content_markdown, or content_url for Atlas to snapshot. At most 512 KB. */
+    content_html?: string;
+    content_markdown?: string;
+    content_url?: string;
+    summary_of_changes?: string;
+    locale?: string;
+}
+export interface PolicyFeedPolicy {
+    /** Slug: lowercase letters, digits, `_` and `-`. */
+    key: string;
+    title: string;
+    display?: 'checkbox' | 'scroll' | 'link';
+    required?: boolean;
+    applies_to?: 'sign_up' | 'sign_in_and_sign_up';
+    versions: PolicyFeedVersion[];
+}
+/** The answer to `GET {endpoint_url}/policies`. */
+export interface PolicyFeed {
+    object: 'policy_list';
+    policies: PolicyFeedPolicy[];
+}
+export type PolicySourceEvent = {
+    type: 'policy.published';
+    key: string;
+    version: string;
+    occurred_at?: string | number;
+} | {
+    type: 'policy.retired';
+    key: string;
+    occurred_at?: string | number;
+};
+type HeadersLike = Headers | Record<string, string | string[] | undefined>;
+export type PolicyFeedVerifyResult = {
+    verified: true;
+    deliveryId: string;
+    timestamp: number;
+    key: string | null;
+    protocolVersion: string | undefined;
+} | {
+    verified: false;
+    reason: 'missing_headers' | 'malformed_signature' | 'stale_timestamp' | 'signature_mismatch' | 'wrong_method';
+};
+/**
+ * Verify Atlas's signed GET of your feed. Pass the request's path AND query
+ * exactly as received (e.g. `req.originalUrl`), and the method.
+ *
+ * ```ts
+ * app.get('/atlas/policies', (req, res) => {
+ *   const v = verifyPolicyFeedRequest({ method: req.method, pathAndQuery: req.originalUrl, headers: req.headers, secret });
+ *   if (!v.verified) return res.sendStatus(401);
+ *   res.json(buildFeed(v.key)); // PolicyFeed, one policy when v.key is set
+ * });
+ * ```
+ */
+export declare function verifyPolicyFeedRequest(input: {
+    method?: string;
+    pathAndQuery: string;
+    headers: HeadersLike;
+    secret: string;
+    now?: Date;
+    toleranceMs?: number;
+}): PolicyFeedVerifyResult;
+/**
+ * Sign an event for `POST {webhook_url}` (Atlas-style headers). Send `body`
+ * byte-for-byte as returned.
+ *
+ * ```ts
+ * const { body, headers } = signPolicySourceEvent({ event: { type: 'policy.published', key: 'tos', version: '2026-10-24' }, secret });
+ * await fetch(webhookUrl, { method: 'POST', headers: { 'content-type': 'application/json', ...headers }, body });
+ * ```
+ */
+export declare function signPolicySourceEvent(input: {
+    event: PolicySourceEvent;
+    secret: string;
+    id?: string;
+    timestampMs?: number;
+}): {
+    body: string;
+    headers: Record<string, string>;
+};
+export {};

package/dist/policy-source.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POLICY_SOURCE_VERSION_HEADER = exports.POLICY_SOURCE_PROTOCOL_VERSION = void 0;
+exports.verifyPolicyFeedRequest = verifyPolicyFeedRequest;
+exports.signPolicySourceEvent = signPolicySourceEvent;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Atlas policy source protocol v1 — helpers for the system that SERVES an
+ * Atlas instance's policy documents (a CMS, a docs platform, your own service).
+ *
+ *  Atlas → you:  GET {endpoint_url}/policies            (full feed)
+ *                GET {endpoint_url}/policies?key=<key>  (one policy, after your event)
+ *    signed with the source's signing secret: `atlas-id`, `atlas-timestamp`
+ *    (epoch ms) and `atlas-signature: v1,<base64 HMAC-SHA256>` over
+ *    `{atlas-id}.{atlas-timestamp}.GET\n{path+query}`. Verify it with
+ *    {@link verifyPolicyFeedRequest}, then answer a {@link PolicyFeed}.
+ *  You → Atlas:  POST {webhook_url} (from GET /v1/instance/policy_source), a
+ *    {@link PolicySourceEvent} signed with the same secret —
+ *    {@link signPolicySourceEvent} (Atlas-style) or any Standard Webhooks library.
+ *    Atlas then re-fetches that policy; it never stores content from the event.
+ */
+exports.POLICY_SOURCE_PROTOCOL_VERSION = '2026-10-24';
+exports.POLICY_SOURCE_VERSION_HEADER = 'atlas-policies-version';
+const TOLERANCE_MS = 5 * 60_000;
+function header(headers, name) {
+    if (typeof headers.get === 'function')
+        return headers.get(name) ?? undefined;
+    const bag = headers;
+    const direct = bag[name] ?? bag[Object.keys(bag).find((k) => k.toLowerCase() === name) ?? ''];
+    return Array.isArray(direct) ? direct[0] : direct;
+}
+function mac(secret, id, timestamp, payload) {
+    return (0, node_crypto_1.createHmac)('sha256', secret).update(`${id}.${timestamp}.${payload}`).digest();
+}
+/**
+ * Verify Atlas's signed GET of your feed. Pass the request's path AND query
+ * exactly as received (e.g. `req.originalUrl`), and the method.
+ *
+ * ```ts
+ * app.get('/atlas/policies', (req, res) => {
+ *   const v = verifyPolicyFeedRequest({ method: req.method, pathAndQuery: req.originalUrl, headers: req.headers, secret });
+ *   if (!v.verified) return res.sendStatus(401);
+ *   res.json(buildFeed(v.key)); // PolicyFeed, one policy when v.key is set
+ * });
+ * ```
+ */
+function verifyPolicyFeedRequest(input) {
+    if (input.method && input.method.toUpperCase() !== 'GET')
+        return { verified: false, reason: 'wrong_method' };
+    const id = header(input.headers, 'atlas-id');
+    const ts = header(input.headers, 'atlas-timestamp');
+    const sig = header(input.headers, 'atlas-signature');
+    if (!id || !ts || !sig)
+        return { verified: false, reason: 'missing_headers' };
+    const provided = sig
+        .trim()
+        .split(/\s+/)
+        .filter((e) => e.startsWith('v1,'))
+        .map((e) => Buffer.from(e.slice(3), 'base64'));
+    if (provided.length === 0)
+        return { verified: false, reason: 'malformed_signature' };
+    const timestamp = Number(ts);
+    const now = (input.now ?? new Date()).getTime();
+    if (!Number.isFinite(timestamp) || Math.abs(now - timestamp) > (input.toleranceMs ?? TOLERANCE_MS)) {
+        return { verified: false, reason: 'stale_timestamp' };
+    }
+    const expected = mac(input.secret, id, ts, `GET\n${input.pathAndQuery}`);
+    const ok = provided.some((p) => p.length === expected.length && (0, node_crypto_1.timingSafeEqual)(p, expected));
+    if (!ok)
+        return { verified: false, reason: 'signature_mismatch' };
+    let key = null;
+    const q = input.pathAndQuery.indexOf('?');
+    if (q !== -1)
+        key = new URLSearchParams(input.pathAndQuery.slice(q + 1)).get('key');
+    return { verified: true, deliveryId: id, timestamp, key, protocolVersion: header(input.headers, exports.POLICY_SOURCE_VERSION_HEADER) };
+}
+/**
+ * Sign an event for `POST {webhook_url}` (Atlas-style headers). Send `body`
+ * byte-for-byte as returned.
+ *
+ * ```ts
+ * const { body, headers } = signPolicySourceEvent({ event: { type: 'policy.published', key: 'tos', version: '2026-10-24' }, secret });
+ * await fetch(webhookUrl, { method: 'POST', headers: { 'content-type': 'application/json', ...headers }, body });
+ * ```
+ */
+function signPolicySourceEvent(input) {
+    const body = JSON.stringify({ occurred_at: new Date().toISOString(), ...input.event });
+    const id = input.id ?? `evt_${(0, node_crypto_1.randomUUID)()}`;
+    const ts = String(input.timestampMs ?? Date.now());
+    return {
+        body,
+        headers: {
+            'atlas-id': id,
+            'atlas-timestamp': ts,
+            'atlas-signature': `v1,${mac(input.secret, id, ts, body).toString('base64')}`,
+        },
+    };
+}
+//# sourceMappingURL=policy-source.js.map

package/dist/policy-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-source.js","sourceRoot":"","sources":["../src/policy-source.ts"],"names":[],"mappings":";;;AAqFA,0DA+BC;AAWD,sDAiBC;AAhJD,6CAAsE;AAEtE;;;;;;;;;;;;;;GAcG;AAEU,QAAA,8BAA8B,GAAG,YAAY,CAAC;AAC9C,QAAA,4BAA4B,GAAG,wBAAwB,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC;AAsChC,SAAS,MAAM,CAAC,OAAoB,EAAE,IAAY;IAChD,IAAI,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU;QAAE,OAAQ,OAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACvG,MAAM,GAAG,GAAG,OAAwD,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,GAAG,CAAC,MAAc,EAAE,EAAU,EAAE,SAAiB,EAAE,OAAe;IACzE,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACvF,CAAC;AAMD;;;;;;;;;;;GAWG;AACH,SAAgB,uBAAuB,CAAC,KAOvC;IACC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC7G,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAG,GAAG;SACjB,IAAI,EAAE;SACN,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACrF,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,YAAY,CAAC,EAAE,CAAC;QACnG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACzE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAClE,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,oCAA4B,CAAC,EAAE,CAAC;AAClI,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,KAKrC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,OAAO,IAAA,wBAAU,GAAE,EAAE,CAAC;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,OAAO;QACL,IAAI;QACJ,OAAO,EAAE;YACP,UAAU,EAAE,EAAE;YACd,iBAAiB,EAAE,EAAE;YACrB,iBAAiB,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;SAC9E;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/backend",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "dependencies": {