@atlasauth/backend 0.17.0 → 0.19.0

package/dist/client/status.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.statusResource = statusResource;
+const request_1 = require("./request");
+function statusResource(request) {
+    return {
+        /** `GET /v1/status` — the public service status (components with group and regions, open incidents). */
+        service() {
+            return request({ method: 'GET', path: '/v1/status' });
+        },
+        /** `GET /v1/instance/status_subscription`. */
+        getSubscription() {
+            return request({ method: 'GET', path: '/v1/instance/status_subscription' });
+        },
+        /** `PUT /v1/instance/status_subscription` — create or change it; only the fields sent change. */
+        updateSubscription(body) {
+            return request({ method: 'PUT', path: '/v1/instance/status_subscription', body });
+        },
+        /** `DELETE /v1/instance/status_subscription` — turn it off (settings are kept). */
+        disableSubscription() {
+            return request({ method: 'DELETE', path: '/v1/instance/status_subscription' });
+        },
+        /** `POST /v1/instance/status_subscription/rotate_feed` — a new private feed URL; the old one 404s. */
+        rotateFeed() {
+            return request({ method: 'POST', path: '/v1/instance/status_subscription/rotate_feed' });
+        },
+        /** `GET /v1/instance/status_incidents` — incidents that concern this instance, newest first. */
+        listIncidents(params = {}) {
+            return request({ method: 'GET', path: '/v1/instance/status_incidents', query: { ...params } });
+        },
+        /** `GET /v1/instance/status_dependencies` — with `state`, the worst among the enabled ones. */
+        listDependencies() {
+            return request({ method: 'GET', path: '/v1/instance/status_dependencies' });
+        },
+        /** `POST /v1/instance/status_dependencies` — read at once; the answer carries the state or `last_error`. */
+        createDependency(body) {
+            return request({ method: 'POST', path: '/v1/instance/status_dependencies', body });
+        },
+        getDependency(id) {
+            return request({ method: 'GET', path: `/v1/instance/status_dependencies/${(0, request_1.enc)(id)}` });
+        },
+        updateDependency(id, body) {
+            return request({ method: 'PATCH', path: `/v1/instance/status_dependencies/${(0, request_1.enc)(id)}`, body });
+        },
+        deleteDependency(id) {
+            return request({ method: 'DELETE', path: `/v1/instance/status_dependencies/${(0, request_1.enc)(id)}` });
+        },
+        /** `POST /v1/instance/status_dependencies/:id/refresh` — read the page now. */
+        refreshDependency(id) {
+            return request({ method: 'POST', path: `/v1/instance/status_dependencies/${(0, request_1.enc)(id)}/refresh` });
+        },
+    };
+}
+//# sourceMappingURL=status.js.map

package/dist/client/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/client/status.ts"],"names":[],"mappings":";;AA8JA,wCAgDC;AA9MD,uCAAgD;AA8JhD,SAAgB,cAAc,CAAC,OAAkB;IAC/C,OAAO;QACL,wGAAwG;QACxG,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,8CAA8C;QAC9C,eAAe;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,iGAAiG;QACjG,kBAAkB,CAAC,IAAkC;YACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,mFAAmF;QACnF,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,sGAAsG;QACtG,UAAU;YACR,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,gGAAgG;QAChG,aAAa,CAAC,SAA6C,EAAE;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,+FAA+F;QAC/F,gBAAgB;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,4GAA4G;QAC5G,gBAAgB,CAAC,IAAgC;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,aAAa,CAAC,EAAU;YACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,gBAAgB,CAAC,EAAU,EAAE,IAAgC;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oCAAoC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,gBAAgB,CAAC,EAAU;YACzB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,oCAAoC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,+EAA+E;QAC/E,iBAAiB,CAAC,EAAU;YAC1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oCAAoC,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QAClG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/users.d.ts

@@ -664,6 +664,14 @@ export interface RecordUserConsentBody {
     status?: 'accepted' | 'withdrawn';
     source?: string;
     metadata?: Record<string, unknown>;
+    /** Policy acceptance evidence: the exact version (must be that version of that policy). */
+    policy_version_id?: string;
+    /** Must equal the version's `content_sha256` when given. */
+    content_sha256?: string;
+    display?: 'checkbox' | 'scroll' | 'link';
+    scrolled_to_end?: boolean;
+    view_ms?: number;
+    locale?: string;
 }
 export interface UserConsent {
     object: 'consent';
@@ -673,6 +681,13 @@ export interface UserConsent {
     status: 'accepted' | 'withdrawn' | (string & {});
     source: string | null;
     metadata?: unknown;
+    /** Policy acceptance evidence (null on records made outside a policy flow). */
+    policy_version_id?: string | null;
+    content_sha256?: string | null;
+    display?: 'checkbox' | 'scroll' | 'link' | null;
+    scrolled_to_end?: boolean | null;
+    view_ms?: number | null;
+    locale?: string | null;
     created_at: number;
 }
 export interface CreateUserApprovalRequestBody {

package/dist/client/webhooks.d.ts

@@ -1,13 +1,98 @@
+import { type ProvisioningFields, type ProvisioningInput, type ProvisioningMetadata } from './compliance';
 import { type RequestFn } from './request';
-export interface WebhookEndpoint {
+export type WebhookDestinationType = 'https' | 'aws_eventbridge' | 'gcp_pubsub' | 'cloudflare_queue';
+/** Where deliveries go. Credentials are never returned. */
+export type WebhookDestination = {
+    type: 'https';
+} | {
+    type: 'aws_eventbridge';
+    region: string;
+    event_bus_name: string;
+    source?: string;
+} | {
+    type: 'gcp_pubsub';
+    project_id: string;
+    topic_id: string;
+} | {
+    type: 'cloudflare_queue';
+    account_id: string;
+    queue_id: string;
+};
+/** Your own credentials for an event destination (stored encrypted, write-only). */
+export type WebhookDestinationCredentials = {
+    access_key_id: string;
+    secret_access_key: string;
+    session_token?: string;
+} | {
+    service_account_json: string | Record<string, unknown>;
+} | {
+    api_token: string;
+};
+export interface WebhookLastFailure {
+    at: number;
+    status: number | null;
+    error: string | null;
+}
+export interface WebhookAutoDisableRule {
+    after_failing_ms: number;
+    after_consecutive_failures: number;
+    consecutive_failures_min_failing_ms: number;
+    description: string;
+}
+export interface WebhookRetention {
+    events_days: number;
+    delivery_log_days: number;
+    replay_window_days: number;
+}
+export interface WebhookEndpoint extends ProvisioningFields {
     object: 'webhook_endpoint';
     id: string;
+    /** The HTTPS receiver, or a descriptor such as `aws-eventbridge://us-east-1/default`. */
     url: string;
+    description?: string | null;
     enabled_events: string[];
+    /** Which names `*` delivers under. */
+    event_naming?: 'canonical' | 'legacy';
     active: boolean;
+    /** A third-party receiver: preflight does not flag its host. */
+    external?: boolean;
+    signature_versions?: Array<'v1' | 'v2'>;
+    destination?: WebhookDestination & {
+        credentials_set?: boolean;
+    };
+    health?: 'healthy' | 'failing' | 'disabled';
     /** Start of the current failure streak (epoch ms), or null when the last delivery succeeded. */
     failing_since?: number | null;
+    /** Start of the streak that preceded the last re-enable (epoch ms); what `since: 'failing_since'` resolves to once the live streak is cleared. */
+    last_failing_since?: number | null;
     disabled_at: number | null;
+    last_success_at?: number | null;
+    last_failure?: WebhookLastFailure | null;
+    consecutive_failures?: number;
+    /** Share of attempts in the last 24 hours that succeeded (0–1), null with none. */
+    success_rate_24h?: number | null;
+    attempts_24h?: {
+        succeeded: number;
+        failed: number;
+    };
+    /** Who is emailed when it fails; null = the account's owners. */
+    alert_contacts?: string[] | null;
+    alerts_sent?: {
+        first_sent_at: number | null;
+        second_sent_at: number | null;
+        disabled_sent_at: number | null;
+    };
+    auto_disable?: WebhookAutoDisableRule;
+    /** On an update that re-enabled the endpoint: the replay that re-sends what it missed. */
+    replay?: {
+        since: number;
+        method: 'POST';
+        path: string;
+        note: string;
+    } | null;
+    /** On create / upsert: whether this call created it. */
+    created?: boolean;
+    updated_at?: number;
     /**
      * While a secret rotation overlap is open: when the previous secret stops
      * signing deliveries (epoch ms). Until then every delivery carries two
@@ -24,8 +109,9 @@ export interface WebhookDelivery {
     object: 'webhook_delivery';
     id: string;
     event_id: string;
-    /** The event type, or null once the event has passed its retention. */
+    /** The name the event was delivered as, or null once the event has passed its retention. */
     event_type?: string | null;
+    latency_ms?: number | null;
     attempt_number: number;
     max_attempts?: number;
     /** The payload that was sent (null once the event has passed its retention). */
@@ -45,16 +131,95 @@ export interface WebhookDelivery {
     delivered_at: number | null;
     created_at: number;
 }
-export interface CreateWebhookEndpointBody {
-    url: string;
-    /** Each entry is `"*"` or a known event name. */
+export interface WebhookEndpointSettings {
+    /** Each entry is `"*"` or an event name (canonical or a deprecated spelling). */
     enabled_events?: string[];
+    event_naming?: 'canonical' | 'legacy';
+    external?: boolean;
+    signature_versions?: Array<'v1' | 'v2'>;
+    /** Up to 20 addresses; null = the account's owners. */
+    alert_contacts?: string[] | null;
+    description?: string | null;
+    /** An event destination instead of an HTTPS url. */
+    destination?: WebhookDestination;
+    destination_credentials?: WebhookDestinationCredentials;
+}
+export interface CreateWebhookEndpointBody extends WebhookEndpointSettings, ProvisioningInput {
+    /** Required unless `destination` is an event destination. */
+    url?: string;
 }
 /** Change an endpoint in place. The signing secret is kept. */
-export interface UpdateWebhookEndpointBody {
+export interface UpdateWebhookEndpointBody extends WebhookEndpointSettings {
     url?: string;
-    enabled_events?: string[];
     active?: boolean;
+    /** Replaces the provisioning metadata. */
+    metadata?: ProvisioningMetadata;
+}
+/** Find-or-create by url. */
+export interface UpsertWebhookEndpointBody extends WebhookEndpointSettings {
+    url: string;
+}
+/** The inline result of `test(id, { wait })`. */
+export interface WebhookTestResult {
+    object: 'webhook_test_result';
+    delivery_id: string;
+    event_id: string;
+    status: 'success' | 'failed';
+    http_status: number | null;
+    latency_ms: number | null;
+    response_snippet: string | null;
+    error: string | null;
+    signature_header_sent: string | null;
+    will_retry: boolean;
+}
+export interface WebhookWindow {
+    /** Epoch ms or ISO 8601 (at most 90 days ago), or the keyword `'failing_since'` for the endpoint's own failure streak. */
+    since?: number | string;
+    until?: number | string;
+}
+export interface WebhookBulkResult {
+    object: 'webhook_redelivery' | 'webhook_replay';
+    endpoint_id: string;
+    queued: number;
+    events_considered?: number;
+    has_more: boolean;
+    /** Pass as `since` to continue. */
+    next_since: number | null;
+    retention: WebhookRetention;
+}
+export interface EgressIps {
+    object: 'egress_ips';
+    /** false: this deployment does not send from fixed addresses. */
+    static: boolean;
+    ipv4: string[];
+    ipv6: string[];
+    applies_to: string[];
+    note: string;
+}
+export type DeliveryTargetKind = 'webhook_endpoint' | 'referral_connection' | 'backchannel_receiver' | 'integration';
+export interface DeliveryHealth {
+    object: 'delivery_health';
+    kind: DeliveryTargetKind;
+    target_id: string;
+    url: string | null;
+    label: string | null;
+    state: 'healthy' | 'failing' | 'disabled';
+    failing_since: number | null;
+    disabled_at: number | null;
+    last_success_at: number | null;
+    last_failure: WebhookLastFailure | null;
+    consecutive_failures: number;
+    success_rate_24h: number | null;
+    attempts_24h: {
+        succeeded: number;
+        failed: number;
+    };
+    alert_contacts: string[] | null;
+    alerts: {
+        first_sent_at: number | null;
+        second_sent_at: number | null;
+        disabled_sent_at: number | null;
+    };
 }
 /** One subscribable event, described. */
 export interface WebhookEventCatalogEntry {
@@ -62,8 +227,18 @@ export interface WebhookEventCatalogEntry {
     description: string;
     /** Who should act on it, e.g. `rp_sessions`, `rp_accounts`, `dsar`. Empty: no relying party needs it. */
     relevant_for: string[];
-    /** Set on a superseded spelling: subscribe to this event instead. */
+    /** Set on a deprecated spelling: subscribe to this canonical event instead. */
     deprecated_alias_of?: string;
+    /** `rename`: sent whenever the canonical event is; `companion`: only for some occurrences. */
+    alias_kind?: 'rename' | 'companion';
+    deprecated_at?: string;
+    /** After this the deprecated spelling is no longer sent (ISO 8601). */
+    sunset_at?: string;
+    /** JSON pointer to this event's payload schema in the OpenAPI document (`components.schemas.WebhookEvent.<name>`). */
+    payload_schema?: string;
+    version?: number;
+    /** When the event became available (YYYY-MM-DD). */
+    since?: string;
 }
 /** The endpoint list plus the delivery settings that apply to every endpoint. */
 export interface WebhookEndpointList {
@@ -81,6 +256,15 @@ export interface WebhookEndpointList {
     retry_schedule_ms?: number[];
     /** Delivery attempts per event before it is marked failed. */
     max_attempts?: number;
+    auto_disable?: WebhookAutoDisableRule;
+    retention?: WebhookRetention;
+    signature_versions?: string[];
+    destination_types?: Array<{
+        type: WebhookDestinationType;
+        name: string;
+        config: string[];
+        credentials: string[];
+    }>;
 }
 export interface WebhookSigningSecret {
     object: 'webhook_secret';
@@ -110,12 +294,33 @@ export interface WebhookDeliveryQueued {
     note: string;
 }
 export interface ListWebhookDeliveriesParams {
-    /** How many deliveries to return (1–100, default 50). */
+    /** How many deliveries to return (1–1000, default 50). */
     limit?: number;
+    starting_after?: string;
+    status?: 'pending' | 'success' | 'failed';
+    /** Comma-separated event names. */
+    event_type?: string;
+    /** Epoch ms or ISO 8601. */
+    since?: number | string;
+    until?: number | string;
 }
 export declare function webhooksResource(request: RequestFn): {
     endpoints: {
-        list(): Promise<WebhookEndpointList>;
+        /** `includeDeprecated` adds the deprecated event spellings to the catalogue. */
+        /** `metadata` filters on provisioning tags (`?metadata[key]=value`). */
+        list(opts?: {
+            includeDeprecated?: boolean;
+            metadata?: ProvisioningMetadata;
+        }): Promise<WebhookEndpointList>;
+        get(id: string): Promise<WebhookEndpoint>;
+        /**
+         * Find-or-create by url: updates the endpoint with this url to `body`, or
+         * creates it (then `secret` is in the result, once). Safe to run on every deploy.
+         */
+        upsertByUrl(body: UpsertWebhookEndpointBody, idempotencyKey?: string): Promise<WebhookEndpoint & {
+            secret?: string;
+            created: boolean;
+        }>;
         /** Update url, enabled_events or active. The signing secret is kept. */
         update(id: string, body: UpdateWebhookEndpointBody): Promise<WebhookEndpoint>;
         /** Show the current signing secret again. Audited. */
@@ -126,8 +331,23 @@ export declare function webhooksResource(request: RequestFn): {
          * every delivery is signed with both, so a verifier holding either passes.
          */
         rotateSecret(id: string, body?: RotateWebhookSecretBody): Promise<WebhookSigningSecret>;
-        /** Send a synthetic `webhook.test` event to this endpoint only. */
+        /** Send a synthetic `webhook.test` event to this endpoint only (queued for the worker). */
         test(id: string): Promise<WebhookDeliveryQueued>;
+        /**
+         * Send `webhook.test` now and return the result: status, HTTP status,
+         * latency, response snippet, error and the signature header sent.
+         * `wait` is at most 10 s (`'10s'`, `'5000ms'`).
+         */
+        testNow(id: string, wait?: string): Promise<WebhookTestResult>;
+        /** Bulk redeliver every event whose latest attempt in the window has `status` (default failed). */
+        redeliverWindow(id: string, body?: WebhookWindow & {
+            status?: "failed" | "success";
+        }, idempotencyKey?: string): Promise<WebhookBulkResult>;
+        /** Re-send everything since `since` the endpoint subscribes to and has not received. */
+        replay(id: string, body: WebhookWindow & {
+            since: number | string;
+            event_type?: string;
+        }, idempotencyKey?: string): Promise<WebhookBulkResult>;
         /** Redeliver a past event as a fresh attempt (409 once past its retention). */
         redeliver(id: string, deliveryId: string): Promise<WebhookDeliveryQueued>;
         create(body: CreateWebhookEndpointBody, idempotencyKey?: string): Promise<WebhookEndpointWithSecret>;
@@ -143,6 +363,19 @@ export declare function webhooksResource(request: RequestFn): {
         has_more: boolean;
         next_cursor?: string | null;
     }>;
+    /** The addresses deliveries leave from (public). */
+    egressIps(): Promise<EgressIps>;
+    /** Delivery health of every outbound target (webhooks, referral connection, back-channel receivers, integrations). */
+    health(params?: {
+        kind?: DeliveryTargetKind;
+        state?: "unhealthy" | "all";
+    }): Promise<{
+        data: DeliveryHealth[];
+        has_more: boolean;
+        unhealthy_count: number;
+    }>;
+    /** Set who is emailed when a target fails (null = the account's owners). */
+    setAlertContacts(kind: DeliveryTargetKind, targetId: string, alertContacts: string[] | null): Promise<DeliveryHealth>;
     /** Redeliver a past event (same as `endpoints.redeliver`). */
     redeliver(endpointId: string, deliveryId: string): Promise<WebhookDeliveryQueued>;
 };

package/dist/client/webhooks.js

@@ -1,12 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.webhooksResource = webhooksResource;
+const compliance_1 = require("./compliance");
 const request_1 = require("./request");
 function webhooksResource(request) {
     return {
         endpoints: {
-            list() {
-                return request({ method: 'GET', path: '/v1/webhook_endpoints' });
+            /** `includeDeprecated` adds the deprecated event spellings to the catalogue. */
+            /** `metadata` filters on provisioning tags (`?metadata[key]=value`). */
+            list(opts = {}) {
+                return request({
+                    method: 'GET',
+                    path: '/v1/webhook_endpoints',
+                    query: { ...(opts.includeDeprecated ? { include_deprecated: 'true' } : {}), ...(0, compliance_1.metadataQuery)(opts.metadata) },
+                });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}` });
+            },
+            /**
+             * Find-or-create by url: updates the endpoint with this url to `body`, or
+             * creates it (then `secret` is in the result, once). Safe to run on every deploy.
+             */
+            upsertByUrl(body, idempotencyKey) {
+                return request({ method: 'PUT', path: '/v1/webhook_endpoints/by_url', body, idempotencyKey });
             },
             /** Update url, enabled_events or active. The signing secret is kept. */
             update(id, body) {
@@ -24,10 +41,26 @@ function webhooksResource(request) {
             rotateSecret(id, body) {
                 return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/rotate_secret`, body });
             },
-            /** Send a synthetic `webhook.test` event to this endpoint only. */
+            /** Send a synthetic `webhook.test` event to this endpoint only (queued for the worker). */
             test(id) {
                 return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/test` });
             },
+            /**
+             * Send `webhook.test` now and return the result: status, HTTP status,
+             * latency, response snippet, error and the signature header sent.
+             * `wait` is at most 10 s (`'10s'`, `'5000ms'`).
+             */
+            testNow(id, wait = '10s') {
+                return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/test`, query: { wait } });
+            },
+            /** Bulk redeliver every event whose latest attempt in the window has `status` (default failed). */
+            redeliverWindow(id, body = {}, idempotencyKey) {
+                return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/redeliver`, body, idempotencyKey });
+            },
+            /** Re-send everything since `since` the endpoint subscribes to and has not received. */
+            replay(id, body, idempotencyKey) {
+                return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/replay`, body, idempotencyKey });
+            },
             /** Redeliver a past event as a fresh attempt (409 once past its retention). */
             redeliver(id, deliveryId) {
                 return request({
@@ -50,6 +83,22 @@ function webhooksResource(request) {
                 query: { ...params },
             });
         },
+        /** The addresses deliveries leave from (public). */
+        egressIps() {
+            return request({ method: 'GET', path: '/v1/meta/egress_ips' });
+        },
+        /** Delivery health of every outbound target (webhooks, referral connection, back-channel receivers, integrations). */
+        health(params = {}) {
+            return request({ method: 'GET', path: '/v1/delivery_health', query: { ...params } });
+        },
+        /** Set who is emailed when a target fails (null = the account's owners). */
+        setAlertContacts(kind, targetId, alertContacts) {
+            return request({
+                method: 'PUT',
+                path: `/v1/delivery_health/${(0, request_1.enc)(kind)}/${(0, request_1.enc)(targetId)}/alert_contacts`,
+                body: { alert_contacts: alertContacts },
+            });
+        },
         /** Redeliver a past event (same as `endpoints.redeliver`). */
         redeliver(endpointId, deliveryId) {
             return request({

package/dist/client/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;AA+HA,4CAgEC;AA/LD,uCAAgD;AA+HhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,wEAAwE;YACxE,MAAM,CAAC,EAAU,EAAE,IAA+B;gBAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,sDAAsD;YACtD,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;;eAIG;YACH,YAAY,CAAC,EAAU,EAAE,IAA8B;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,mEAAmE;YACnE,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,+EAA+E;YAC/E,SAAS,CAAC,EAAU,EAAE,UAAkB;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,oCAAoC;QACpC,UAAU,CACR,EAAU,EACV,SAAsC,EAAE;YAExC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBACnD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,8DAA8D;QAC9D,SAAS,CAAC,UAAkB,EAAE,UAAkB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,UAAU,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;aACzF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;AAkSA,4CA+HC;AAjaD,6CAAyH;AACzH,uCAAgD;AAiShD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,SAAS,EAAE;YACT,gFAAgF;YAChF,wEAAwE;YACxE,IAAI,CAAC,OAAyE,EAAE;gBAC9E,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,uBAAuB;oBAC7B,KAAK,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAA,0BAAa,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;iBAC9G,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD;;;eAGG;YACH,WAAW,CACT,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,wEAAwE;YACxE,MAAM,CAAC,EAAU,EAAE,IAA+B;gBAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,sDAAsD;YACtD,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;;eAIG;YACH,YAAY,CAAC,EAAU,EAAE,IAA8B;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,2FAA2F;YAC3F,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;YACD;;;;eAIG;YACH,OAAO,CAAC,EAAU,EAAE,OAAe,KAAK;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,mGAAmG;YACnG,eAAe,CACb,EAAU,EACV,OAA0D,EAAE,EAC5D,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,wFAAwF;YACxF,MAAM,CACJ,EAAU,EACV,IAAqE,EACrE,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,+EAA+E;YAC/E,SAAS,CAAC,EAAU,EAAE,UAAkB;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,oCAAoC;QACpC,UAAU,CACR,EAAU,EACV,SAAsC,EAAE;YAExC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBACnD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,oDAAoD;QACpD,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,sHAAsH;QACtH,MAAM,CAAC,SAAqE,EAAE;YAK5E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,4EAA4E;QAC5E,gBAAgB,CAAC,IAAwB,EAAE,QAAgB,EAAE,aAA8B;YACzF,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,IAAI,IAAA,aAAG,EAAC,QAAQ,CAAC,iBAAiB;gBACxE,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QACD,8DAA8D;QAC9D,SAAS,CAAC,UAAkB,EAAE,UAAkB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,UAAU,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;aACzF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -8,18 +8,21 @@ export { BETTER_AUTH_JWT_ALGS, peekIssuer } from './legacy-issuers';
 export type { LegacyIssuer } from './legacy-issuers';
 export { BACKCHANNEL_LOGOUT_EVENT, LOGOUT_TOKEN_CLOCK_SKEW_SECONDS, LOGOUT_TOKEN_MAX_AGE_SECONDS, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
 export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions, } from './logout-token';
-export { AtlasOidcError, OIDC_FLOW_COOKIE, OIDC_FLOW_MAX_AGE_SECONDS, oidc, oidcCallback, oidcClearCookie, oidcLogoutUrl, oidcStart, oidcVerifyIdToken, resetOidcCaches, } from './oidc';
-export type { AtlasOidc, AtlasOidcErrorCode, OidcCallbackOptions, OidcClientAuth, OidcIdentity, OidcLogoutUrlOptions, OidcStartOptions, OidcStartResult, VerifyIdTokenOptions, } from './oidc';
+export { expressBackchannelLogout, fastifyBackchannelLogout, fastifyBackchannelLogoutPlugin, fetchBackchannelLogout, handleBackchannelLogout, nextBackchannelLogout, readLogoutToken, } from './backchannel-handlers';
+export type { BackchannelLogoutOptions, BackchannelLogoutResponse } from './backchannel-handlers';
+export { AtlasOidcError, OIDC_FLOW_COOKIE, OIDC_FLOW_MAX_AGE_SECONDS, oidc, oidcCallback, oidcClearCookie, oidcLogoutUrl, oidcStart, oidcVerifyIdToken, oidcOrganizationOf, oidcOrganizationsOf, oidcSsoOf, resetOidcCaches, } from './oidc';
+export type { AtlasIdTokenClaims, AtlasOidc, AtlasOidcErrorCode, OidcOrganization, OidcOrganizationMembership, OidcSsoContext, OidcCallbackOptions, OidcClientAuth, OidcIdentity, OidcLogoutUrlOptions, OidcStartOptions, OidcStartResult, VerifyIdTokenOptions, } from './oidc';
 export * from './webhooks';
 export * from './referrals';
+export * from './policy-source';
 export * from './botid';
 export { createAtlasClient } from './client';
 export type { AtlasClient } from './client';
 export * from './client';
-export { createTestIssuer, TEST_TOKEN_TAMPERS } from './testing';
-export type { TestIssuer, CreateTestIssuerOptions, MintIdTokenOptions, TestAuthorizeOptions, TestAuthorizeResult, TestTokenTamper, } from './testing';
-export { signAtlasReferralCall, signReferallyCall, signReferralUpdatedEvent, referallySignature, referralEmailHash, REFERALLY_API_VERSION, } from './referral-test-calls';
-export type { AtlasReferralCallOptions, ReferallyCallOptions, ReferallyCallOp, ReferralUpdatedEvent, ReferralUpdatedEventOptions, SignedReferralCall, } from './referral-test-calls';
+export { createTestIssuer, TEST_TOKEN_TAMPERS, testTenantClaims } from './testing';
+export type { TestIssuer, TestTenantContext, CreateTestIssuerOptions, MintIdTokenOptions, TestAuthorizeOptions, TestAuthorizeResult, TestTokenTamper, } from './testing';
+export { signAtlasReferralCall, signReferalliCall, signReferralUpdatedEvent, referalliSignature, referalliSignatureV2, referralEmailHash, REFERALLI_API_VERSION, } from './referral-test-calls';
+export type { AtlasReferralCallOptions, ReferalliCallOptions, ReferalliCallOp, ReferralUpdatedEvent, ReferralUpdatedEventOptions, SignedReferralCall, } from './referral-test-calls';
 export { verifyPCActn } from './pca/verify';
 export type { PcaVerdict, PcaContext, VerifyPCActnOptions } from './pca/verify';
 export { requirePCA, defaultExtract, memoryPcaStore } from './pca/require-pca';

package/dist/index.js

@@ -14,7 +14,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.peekIssuer = exports.BETTER_AUTH_JWT_ALGS = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
+exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLI_API_VERSION = exports.referralEmailHash = exports.referalliSignatureV2 = exports.referalliSignature = exports.signReferralUpdatedEvent = exports.signReferalliCall = exports.signAtlasReferralCall = exports.testTenantClaims = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcSsoOf = exports.oidcOrganizationsOf = exports.oidcOrganizationOf = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.readLogoutToken = exports.nextBackchannelLogout = exports.handleBackchannelLogout = exports.fetchBackchannelLogout = exports.fastifyBackchannelLogoutPlugin = exports.fastifyBackchannelLogout = exports.expressBackchannelLogout = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.peekIssuer = exports.BETTER_AUTH_JWT_ALGS = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
+exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = void 0;
 // §7.3 token verification — the original surface, unchanged.
 __exportStar(require("./jwks-cache"), exports);
 // OIDC discovery of the JWKS URL when only `issuer` is configured.
@@ -39,6 +40,15 @@ Object.defineProperty(exports, "LOGOUT_TOKEN_MAX_AGE_SECONDS", { enumerable: tru
 Object.defineProperty(exports, "LogoutTokenVerifier", { enumerable: true, get: function () { return logout_token_1.LogoutTokenVerifier; } });
 Object.defineProperty(exports, "memoryLogoutReplayStore", { enumerable: true, get: function () { return logout_token_1.memoryLogoutReplayStore; } });
 Object.defineProperty(exports, "verifyLogoutToken", { enumerable: true, get: function () { return logout_token_1.verifyLogoutToken; } });
+// Ready-made back-channel logout receivers: Express, Fastify, Next.js / Fetch.
+var backchannel_handlers_1 = require("./backchannel-handlers");
+Object.defineProperty(exports, "expressBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.expressBackchannelLogout; } });
+Object.defineProperty(exports, "fastifyBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.fastifyBackchannelLogout; } });
+Object.defineProperty(exports, "fastifyBackchannelLogoutPlugin", { enumerable: true, get: function () { return backchannel_handlers_1.fastifyBackchannelLogoutPlugin; } });
+Object.defineProperty(exports, "fetchBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.fetchBackchannelLogout; } });
+Object.defineProperty(exports, "handleBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.handleBackchannelLogout; } });
+Object.defineProperty(exports, "nextBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.nextBackchannelLogout; } });
+Object.defineProperty(exports, "readLogoutToken", { enumerable: true, get: function () { return backchannel_handlers_1.readLogoutToken; } });
 // Server-side OIDC relying party for the hosted-redirect integration:
 // state + nonce + PKCE flow cookie, code exchange, RS256-pinned ID-token checks.
 var oidc_1 = require("./oidc");
@@ -51,11 +61,15 @@ Object.defineProperty(exports, "oidcClearCookie", { enumerable: true, get: funct
 Object.defineProperty(exports, "oidcLogoutUrl", { enumerable: true, get: function () { return oidc_1.oidcLogoutUrl; } });
 Object.defineProperty(exports, "oidcStart", { enumerable: true, get: function () { return oidc_1.oidcStart; } });
 Object.defineProperty(exports, "oidcVerifyIdToken", { enumerable: true, get: function () { return oidc_1.oidcVerifyIdToken; } });
+Object.defineProperty(exports, "oidcOrganizationOf", { enumerable: true, get: function () { return oidc_1.oidcOrganizationOf; } });
+Object.defineProperty(exports, "oidcOrganizationsOf", { enumerable: true, get: function () { return oidc_1.oidcOrganizationsOf; } });
+Object.defineProperty(exports, "oidcSsoOf", { enumerable: true, get: function () { return oidc_1.oidcSsoOf; } });
 Object.defineProperty(exports, "resetOidcCaches", { enumerable: true, get: function () { return oidc_1.resetOidcCaches; } });
 // §12.2 inbound webhook verification for consumers.
 __exportStar(require("./webhooks"), exports);
 // The Atlas referral protocol, for a referral platform receiving Atlas's signed calls.
 __exportStar(require("./referrals"), exports);
+__exportStar(require("./policy-source"), exports);
 // Vercel BotID: sign checkBotId() verdicts on your Vercel route for Atlas's captcha gate.
 __exportStar(require("./botid"), exports);
 // The typed management client for the secret-key Backend API.
@@ -68,13 +82,15 @@ __exportStar(require("./client"), exports);
 var testing_1 = require("./testing");
 Object.defineProperty(exports, "createTestIssuer", { enumerable: true, get: function () { return testing_1.createTestIssuer; } });
 Object.defineProperty(exports, "TEST_TOKEN_TAMPERS", { enumerable: true, get: function () { return testing_1.TEST_TOKEN_TAMPERS; } });
+Object.defineProperty(exports, "testTenantClaims", { enumerable: true, get: function () { return testing_1.testTenantClaims; } });
 var referral_test_calls_1 = require("./referral-test-calls");
 Object.defineProperty(exports, "signAtlasReferralCall", { enumerable: true, get: function () { return referral_test_calls_1.signAtlasReferralCall; } });
-Object.defineProperty(exports, "signReferallyCall", { enumerable: true, get: function () { return referral_test_calls_1.signReferallyCall; } });
+Object.defineProperty(exports, "signReferalliCall", { enumerable: true, get: function () { return referral_test_calls_1.signReferalliCall; } });
 Object.defineProperty(exports, "signReferralUpdatedEvent", { enumerable: true, get: function () { return referral_test_calls_1.signReferralUpdatedEvent; } });
-Object.defineProperty(exports, "referallySignature", { enumerable: true, get: function () { return referral_test_calls_1.referallySignature; } });
+Object.defineProperty(exports, "referalliSignature", { enumerable: true, get: function () { return referral_test_calls_1.referalliSignature; } });
+Object.defineProperty(exports, "referalliSignatureV2", { enumerable: true, get: function () { return referral_test_calls_1.referalliSignatureV2; } });
 Object.defineProperty(exports, "referralEmailHash", { enumerable: true, get: function () { return referral_test_calls_1.referralEmailHash; } });
-Object.defineProperty(exports, "REFERALLY_API_VERSION", { enumerable: true, get: function () { return referral_test_calls_1.REFERALLY_API_VERSION; } });
+Object.defineProperty(exports, "REFERALLI_API_VERSION", { enumerable: true, get: function () { return referral_test_calls_1.REFERALLI_API_VERSION; } });
 // Proof-Carrying Authority (agentic auth): offline verifier + framework-agnostic guard,
 // beside the session-token verifier above.
 var verify_1 = require("./pca/verify");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAGzC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAGzC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}