@atlasauth/backend 0.17.0 → 0.19.0

package/dist/client/credentials.d.ts

@@ -0,0 +1,409 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+import { type VerifyWebhookInput, type WebhookVerifyResult } from '../webhooks';
+/**
+ * The instance's own credentials (scoped secret keys, the standard key list,
+ * whoami), partner links, and Sign in with Atlas grant revocation for apps
+ * the instance manages.
+ */
+export type KeyKind = 'secret_key' | 'platform_key' | 'account_key' | 'webhook_secret' | 'partner_link' | 'access_token';
+/** The standard key shape every credential listing uses. */
+export interface StandardKey {
+    object: 'key' | 'secret_key';
+    id: string;
+    kind: KeyKind;
+    /** `atlas` = `atlas_<env>_<kind>_…`; `legacy` = `sk_` / `psk_` / `whsec_` / `dsk_`. */
+    format: 'atlas' | 'legacy';
+    prefix: string;
+    name: string | null;
+    owner: string | null;
+    scopes: string[];
+    environment: 'live' | 'test' | null;
+    resource: {
+        type: 'instance' | 'account' | 'application' | 'webhook_endpoint';
+        id: string;
+    };
+    expires_at: number | null;
+    expires_in_days: number | null;
+    status: 'active' | 'expiring' | 'expired' | 'revoked';
+    ip_allowlist: string[];
+    origin_allowlist: string[];
+    last_used_at: number | null;
+    last_used_ip: string | null;
+    created_at: number;
+    revoked_at: number | null;
+}
+export interface SecretKey extends StandardKey {
+    object: 'secret_key';
+    allowed_ips: string[];
+    /** Alias of `origin_allowlist`: browser origins the key may be used from (empty = any). */
+    allowed_origins: string[];
+    rotated_from: string | null;
+    /** Provisioning tags (filter the list with `metadata`). */
+    metadata?: Record<string, string | number | boolean>;
+    /** The idempotent-create key the key was created with, if any. */
+    external_ref?: string | null;
+}
+/** A create/rotate response: the secret is present once (or sealed, with a secret recipient). */
+export interface SecretKeyWithSecret extends SecretKey {
+    /** Absent on an `external_ref` replay (`idempotent_replay: true`): the secret was shown at the first create. */
+    secret?: string;
+    sealed_secret?: string;
+    idempotent_replay?: boolean;
+    note: string;
+}
+export interface CreateSecretKeyBody {
+    name?: string;
+    /** Instance scopes, or presets `read_only`, `privacy:execute`, `privacy:grants:revoke`. */
+    scopes: string[];
+    /** Unix ms or ISO 8601; at most one year away. Default: one year. Every new key expires. */
+    expires_at?: number | string;
+    /** CIDRs the key may be used from. */
+    allowed_ips?: string[];
+    /** Browser origins (`https://app.example.com`, `https://*.example.com`) a request with an Origin must come from. */
+    allowed_origins?: string[];
+    /** The person or service responsible. Default: whoever creates the key. */
+    owner?: string | null;
+    /** `atlas` (default) or `legacy`. */
+    key_format?: 'atlas' | 'legacy';
+    /** Idempotent create: a second create with the same ref returns the existing key (without its secret). */
+    external_ref?: string;
+    /** Provisioning tags (up to 20; string, number or boolean values). */
+    metadata?: Record<string, string | number | boolean>;
+}
+export interface Whoami {
+    object: 'whoami';
+    key: {
+        id: string | null;
+        type: 'secret' | 'publishable' | 'platform' | 'partner_link' | 'access_token';
+        prefix: string | null;
+        environment: 'live' | 'test' | null;
+        scopes: string[];
+        effective_scopes: string[];
+        owner: string | null;
+        created_at: number | null;
+        expires_at: number | null;
+        last_used_at: number | null;
+        last_used_ip?: string | null;
+        application_ids?: string[];
+    };
+    instance: {
+        id: string;
+        environment: string | null;
+        issuer?: string;
+        discovery_url?: string;
+        jwks_uri?: string;
+    } | null;
+    account: {
+        id: string | null;
+    };
+    platform?: {
+        id: string;
+    };
+    partner?: {
+        link_id: string;
+        id: string;
+        name: string | null;
+    };
+    operator?: {
+        sub: string;
+        auth_time: number | null;
+        acr: string | null;
+        amr: string[];
+    };
+}
+export interface PartnerLink {
+    object: 'partner_link';
+    id: string;
+    client_id: string;
+    /** Any lowercase id; cookiemunch, chatly, forumulate and referalli are presets. */
+    partner: string;
+    name: string;
+    preset: boolean;
+    resource: string;
+    scopes: string[];
+    client_secret_prefix: string;
+    token_endpoint: string;
+    /** mTLS: client-certificate SHA-256 fingerprints (base64url) every use must present; [] = none. */
+    cert_fingerprints: string[];
+    auth_methods: string[];
+    /** The partner link request this link was approved from; null when created by hand. */
+    request_id: string | null;
+    status: 'active' | 'expired' | 'revoked';
+    expires_at: number | null;
+    revoked_at: number | null;
+    last_used_at: number | null;
+    last_used_ip: string | null;
+    calls_30d: number;
+    created_at: number;
+    client_secret?: string;
+    sealed_client_secret?: string;
+}
+/** A consent manager's script the hosted pages load (any CMP). */
+export interface PartnerLinkCmp {
+    script_url: string;
+    script_id?: string | null;
+    site_id?: string | null;
+    blocking_mode?: string | null;
+    extra_origins?: string[];
+    settings_preset?: 'cookiemunch' | 'cookiebot' | 'onetrust' | 'custom' | null;
+}
+/** A partner link request: a partner asking this instance (inbound), or Atlas asking a partner (outbound). */
+export interface PartnerLinkRequest {
+    object: 'partner_link_request';
+    id: string;
+    direction: 'inbound' | 'outbound';
+    partner: string;
+    name: string;
+    preset: boolean;
+    resource: string | null;
+    scopes: string[];
+    callback_url: string | null;
+    callback_host: string | null;
+    cert_fingerprints: string[];
+    status: 'pending' | 'approved' | 'denied' | 'expired' | 'delivery_failed' | 'installed' | 'failed';
+    link_id: string | null;
+    remote_request_id: string | null;
+    decided_by: string | null;
+    decided_at: number | null;
+    delivery_attempts: number;
+    delivered_at: number | null;
+    last_error: string | null;
+    expires_at: number;
+    created_at: number;
+}
+export interface PartnerLinkRequestApproval extends PartnerLinkRequest {
+    delivered: boolean;
+    link: PartnerLink | null;
+    note: string;
+}
+export interface OutboundPartnerLink {
+    object: 'outbound_partner_link';
+    id: string;
+    partner: string;
+    name: string;
+    preset: boolean;
+    resource: string | null;
+    scopes: string[];
+    base_url: string;
+    token_url: string;
+    client_id: string;
+    auth_method: 'client_credentials' | 'bearer_secret';
+    has_client_secret: true;
+    source: 'manual' | 'oauth_install';
+    status: 'active' | 'revoked' | 'failing';
+    /** The consent manager this partner brings to the hosted pages, or null. */
+    cmp: PartnerLinkCmp | null;
+    /** True when `cmp` is derived (a Cookie Munch link with a `site:<id>` resource). */
+    cmp_default: boolean;
+    expires_at: number | null;
+    last_used_at: number | null;
+    last_error: string | null;
+    last_error_at: number | null;
+    calls_30d: number;
+    created_at: number;
+    updated_at: number;
+}
+export interface SaveOutboundPartnerLinkBody {
+    client_id: string;
+    client_secret: string;
+    scopes?: string[];
+    resource?: string;
+    /** Required for a partner that is not a preset. */
+    base_url?: string;
+    token_url?: string;
+    auth_method?: 'client_credentials' | 'bearer_secret';
+    name?: string;
+    expires_at?: number | string | null;
+    /**
+     * A consent-manager partner's script for the hosted pages. Used while the
+     * instance has no cookie_consent setting of its own. Null clears it; absent
+     * keeps it.
+     */
+    cmp?: PartnerLinkCmp | null;
+}
+export interface AtlasIdGrantLookup {
+    object: 'atlas_id_user';
+    sub: string;
+    grant_id: string;
+    scopes: string[];
+    granted_at: number;
+}
+export interface InstanceAtlasIdGrantRevocation {
+    object: 'atlas_id_grant';
+    id: string;
+    sub: string;
+    revoked: true;
+    tokens_revoked: number;
+    backchannel_logouts: number;
+}
+export declare function whoamiResource(request: RequestFn): () => Promise<Whoami>;
+export declare function secretKeysResource(request: RequestFn): {
+    create(body: CreateSecretKeyBody): Promise<SecretKeyWithSecret>;
+    /** `metadata` filters on provisioning tags (`?metadata[key]=value`). */
+    list(params?: {
+        metadata?: Record<string, string>;
+    }): Promise<ListPage<SecretKey>>;
+    get(id: string): Promise<SecretKey>;
+    update(id: string, body: {
+        name?: string | null;
+        owner?: string | null;
+        expires_at?: number | string | null;
+        allowed_ips?: string[];
+        allowed_origins?: string[];
+        metadata?: Record<string, string | number | boolean> | null;
+    }): Promise<SecretKey>;
+    /** New key with the same scopes; the old one works for `overlap_seconds` (default 72 h, 0 = now). */
+    rotate(id: string, body?: {
+        overlap_seconds?: number;
+        key_format?: "atlas" | "legacy";
+    }): Promise<SecretKeyWithSecret & {
+        replaces: string;
+        previous_key_expires_at: number | null;
+    }>;
+    revoke(id: string): Promise<SecretKey & {
+        revoked: true;
+    }>;
+};
+export declare function keysResource(request: RequestFn): {
+    /** Every credential on the instance, standard shape. */
+    list(): Promise<ListPage<StandardKey>>;
+};
+export declare function partnerLinksResource(request: RequestFn): {
+    /** Create a link by hand (the secret is returned once). Prefer approving a partner's request: no secret to hand over. */
+    create(body: {
+        partner: string;
+        name?: string;
+        scopes: string[];
+        expires_at?: number | string;
+        cert_fingerprints?: string[];
+    }): Promise<PartnerLink>;
+    /** Lock a link to client certificates (mTLS); [] removes the lock. */
+    setCertificates(id: string, certFingerprints: string[]): Promise<PartnerLink>;
+    requests: {
+        list(params?: {
+            direction?: "inbound" | "outbound";
+            status?: PartnerLinkRequest["status"][];
+        }): Promise<ListPage<PartnerLinkRequest>>;
+        get(id: string): Promise<PartnerLinkRequest>;
+        /** Approve: Atlas creates the link and delivers its credentials to the partner, signed. */
+        approve(id: string, body?: {
+            scopes?: string[];
+            expires_at?: number | string;
+        }): Promise<PartnerLinkRequestApproval>;
+        deny(id: string): Promise<PartnerLinkRequest>;
+    };
+    list(): Promise<ListPage<PartnerLink>>;
+    get(id: string): Promise<PartnerLink>;
+    rotateSecret(id: string): Promise<PartnerLink>;
+    revoke(id: string): Promise<PartnerLink & {
+        revoked: true;
+    }>;
+    outbound: {
+        list(): Promise<ListPage<OutboundPartnerLink>>;
+        save(partner: string, body: SaveOutboundPartnerLinkBody): Promise<OutboundPartnerLink>;
+        test(partner: string): Promise<{
+            object: "partner_link_test";
+            partner: string;
+            ok: boolean;
+            error?: string;
+        }>;
+        remove(partner: string): Promise<{
+            object: "outbound_partner_link";
+            partner: string;
+            deleted: true;
+        }>;
+        /** Ask a partner for a link; its credentials arrive by themselves once the partner approves. */
+        request(partner: string, body: {
+            scopes: string[];
+            resource?: string;
+            base_url?: string;
+            token_url?: string;
+            name?: string;
+        }): Promise<PartnerLinkRequest & {
+            note: string;
+        }>;
+    };
+};
+export declare function atlasIdGrantsResource(request: RequestFn): {
+    /** Sign in with Atlas apps this instance manages. */
+    listApps(): Promise<ListPage<{
+        object: "atlas_id_app";
+        id: string;
+        client_id: string;
+        name: string;
+        managed_by_instance_id: string;
+    }>>;
+    /** Is this verified email a user of the app? Empty list otherwise. */
+    lookup(appId: string, email: string): Promise<ListPage<AtlasIdGrantLookup>>;
+    revoke(appId: string, grantId: string): Promise<InstanceAtlasIdGrantRevocation>;
+};
+export interface PartnerLinkRequestInput {
+    /** Your product id (lowercase, 2–40 characters). */
+    partner: string;
+    name?: string;
+    /** The Atlas instance: its `ins_…` id or publishable key. */
+    resource: string;
+    scopes: string[];
+    /** Where Atlas delivers the credentials (https). */
+    callback_url: string;
+    state?: string;
+    /** Ask for a certificate-locked (mTLS) link. */
+    cert_fingerprints?: string[];
+}
+export interface PartnerLinkRequestCreated {
+    object: 'partner_link_request';
+    protocol: 'atlas.partner_link_request.v1';
+    id: string;
+    status: 'pending';
+    resource: string;
+    scopes: string[];
+    /** Keep it: it verifies the delivery and reads the request. Shown once. */
+    request_secret: string;
+    expires_at: number;
+}
+/** What Atlas POSTs to your callback once the owner decides. */
+export type PartnerLinkDelivery = {
+    object: 'partner_link.credentials';
+    protocol: 'atlas.partner_link_request.v1';
+    request_id: string;
+    state: string | null;
+    partner: string;
+    instance_id: string;
+    resource: string;
+    client_id: string;
+    client_secret: string;
+    scopes: string[];
+    token_endpoint: string;
+    api_base_url: string;
+    auth_methods: string[];
+    cert_fingerprints: string[];
+    expires_at: number | null;
+    issued_at: number;
+} | {
+    object: 'partner_link.denied';
+    protocol: 'atlas.partner_link_request.v1';
+    request_id: string;
+    state: string | null;
+    partner: string;
+    instance_id: string;
+    issued_at: number;
+};
+/**
+ * For a PARTNER product: ask an Atlas instance for a link (no Atlas credential
+ * needed). The owner approves it; the credentials then arrive at
+ * `callback_url`, signed with the returned `request_secret`
+ * (verify with {@link verifyPartnerLinkDelivery}).
+ */
+export declare function requestPartnerLink(input: PartnerLinkRequestInput, opts?: {
+    apiUrl?: string;
+    fetch?: typeof fetch;
+}): Promise<PartnerLinkRequestCreated>;
+/**
+ * For a PARTNER product: verify and parse the credentials (or denial) Atlas
+ * delivered to your callback. `secret` is the request's `request_secret`;
+ * pass `url` (your callback URL) to also check the URL-bound signature.
+ */
+export declare function verifyPartnerLinkDelivery(input: Omit<VerifyWebhookInput, 'secret'> & {
+    requestSecret: string;
+}): WebhookVerifyResult<PartnerLinkDelivery>;

package/dist/client/credentials.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.whoamiResource = whoamiResource;
+exports.secretKeysResource = secretKeysResource;
+exports.keysResource = keysResource;
+exports.partnerLinksResource = partnerLinksResource;
+exports.atlasIdGrantsResource = atlasIdGrantsResource;
+exports.requestPartnerLink = requestPartnerLink;
+exports.verifyPartnerLinkDelivery = verifyPartnerLinkDelivery;
+const request_1 = require("./request");
+const webhooks_1 = require("../webhooks");
+const enc = encodeURIComponent;
+function whoamiResource(request) {
+    /** Introspect the key this client uses. */
+    return () => request({ method: 'GET', path: '/v1/whoami' });
+}
+function secretKeysResource(request) {
+    return {
+        create(body) {
+            return request({ method: 'POST', path: '/v1/secret_keys', body });
+        },
+        /** `metadata` filters on provisioning tags (`?metadata[key]=value`). */
+        list(params = {}) {
+            const query = {};
+            for (const [k, v] of Object.entries(params.metadata ?? {}))
+                query[`metadata[${k}]`] = v;
+            return request({ method: 'GET', path: '/v1/secret_keys', ...(Object.keys(query).length ? { query } : {}) });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/secret_keys/${enc(id)}` });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/secret_keys/${enc(id)}`, body });
+        },
+        /** New key with the same scopes; the old one works for `overlap_seconds` (default 72 h, 0 = now). */
+        rotate(id, body = {}) {
+            return request({ method: 'POST', path: `/v1/secret_keys/${enc(id)}/rotate`, body });
+        },
+        revoke(id) {
+            return request({ method: 'POST', path: `/v1/secret_keys/${enc(id)}/revoke` });
+        },
+    };
+}
+function keysResource(request) {
+    return {
+        /** Every credential on the instance, standard shape. */
+        list() {
+            return request({ method: 'GET', path: '/v1/keys' });
+        },
+    };
+}
+function partnerLinksResource(request) {
+    return {
+        /** Create a link by hand (the secret is returned once). Prefer approving a partner's request: no secret to hand over. */
+        create(body) {
+            return request({ method: 'POST', path: '/v1/partner_links', body });
+        },
+        /** Lock a link to client certificates (mTLS); [] removes the lock. */
+        setCertificates(id, certFingerprints) {
+            return request({ method: 'PATCH', path: `/v1/partner_links/${enc(id)}`, body: { cert_fingerprints: certFingerprints } });
+        },
+        requests: {
+            list(params = {}) {
+                const query = {};
+                if (params.direction)
+                    query.direction = params.direction;
+                if (params.status?.length)
+                    query.status = params.status.join(',');
+                return request({ method: 'GET', path: '/v1/partner_links/requests', ...(Object.keys(query).length ? { query } : {}) });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/partner_links/requests/${enc(id)}` });
+            },
+            /** Approve: Atlas creates the link and delivers its credentials to the partner, signed. */
+            approve(id, body = {}) {
+                return request({ method: 'POST', path: `/v1/partner_links/requests/${enc(id)}/approve`, body });
+            },
+            deny(id) {
+                return request({ method: 'POST', path: `/v1/partner_links/requests/${enc(id)}/deny` });
+            },
+        },
+        list() {
+            return request({ method: 'GET', path: '/v1/partner_links' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/partner_links/${enc(id)}` });
+        },
+        rotateSecret(id) {
+            return request({ method: 'POST', path: `/v1/partner_links/${enc(id)}/rotate_secret` });
+        },
+        revoke(id) {
+            return request({ method: 'DELETE', path: `/v1/partner_links/${enc(id)}` });
+        },
+        outbound: {
+            list() {
+                return request({ method: 'GET', path: '/v1/partner_links/outbound' });
+            },
+            save(partner, body) {
+                return request({ method: 'PUT', path: `/v1/partner_links/outbound/${enc(partner)}`, body });
+            },
+            test(partner) {
+                return request({ method: 'POST', path: `/v1/partner_links/outbound/${enc(partner)}/test` });
+            },
+            remove(partner) {
+                return request({ method: 'DELETE', path: `/v1/partner_links/outbound/${enc(partner)}` });
+            },
+            /** Ask a partner for a link; its credentials arrive by themselves once the partner approves. */
+            request(partner, body) {
+                return request({ method: 'POST', path: `/v1/partner_links/outbound/${enc(partner)}/request`, body });
+            },
+        },
+    };
+}
+function atlasIdGrantsResource(request) {
+    return {
+        /** Sign in with Atlas apps this instance manages. */
+        listApps() {
+            return request({ method: 'GET', path: '/v1/atlas_id_apps' });
+        },
+        /** Is this verified email a user of the app? Empty list otherwise. */
+        lookup(appId, email) {
+            return request({ method: 'GET', path: `/v1/atlas_id_apps/${enc(appId)}/users`, query: { email } });
+        },
+        revoke(appId, grantId) {
+            return request({ method: 'DELETE', path: `/v1/atlas_id_apps/${enc(appId)}/grants/${enc(grantId)}` });
+        },
+    };
+}
+/**
+ * For a PARTNER product: ask an Atlas instance for a link (no Atlas credential
+ * needed). The owner approves it; the credentials then arrive at
+ * `callback_url`, signed with the returned `request_secret`
+ * (verify with {@link verifyPartnerLinkDelivery}).
+ */
+async function requestPartnerLink(input, opts = {}) {
+    const base = (opts.apiUrl ?? request_1.DEFAULT_API_URL).replace(/\/+$/, '');
+    const res = await (opts.fetch ?? fetch)(`${base}/v1/partner_link_requests`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json' },
+        body: JSON.stringify(input),
+    });
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        const first = body.errors?.[0];
+        throw new Error(`Atlas refused the partner link request (HTTP ${res.status}${first?.message ? `: ${first.message}` : ''}).`);
+    }
+    return body;
+}
+/**
+ * For a PARTNER product: verify and parse the credentials (or denial) Atlas
+ * delivered to your callback. `secret` is the request's `request_secret`;
+ * pass `url` (your callback URL) to also check the URL-bound signature.
+ */
+function verifyPartnerLinkDelivery(input) {
+    const { requestSecret, ...rest } = input;
+    return (0, webhooks_1.verifyWebhook)({ ...rest, secret: requestSecret });
+}
+//# sourceMappingURL=credentials.js.map

package/dist/client/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/client/credentials.ts"],"names":[],"mappings":";;AA2OA,wCAGC;AAED,gDAmCC;AAED,oCAOC;AAED,oDA8DC;AAED,sDAcC;AA0DD,gDAgBC;AAOD,8DAKC;AAlcD,uCAA4D;AAE5D,0CAA+F;AAuO/F,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,SAAgB,cAAc,CAAC,OAAkB;IAC/C,2CAA2C;IAC3C,OAAO,GAAoB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,MAAM,CAAC,IAAyB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,SAAgD,EAAE;YACrD,MAAM,KAAK,GAA2B,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CACJ,EAAU,EACV,IAOC;YAED,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,qGAAqG;QACrG,MAAM,CAAC,EAAU,EAAE,OAAsE,EAAE;YACzF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,wDAAwD;QACxD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,yHAAyH;QACzH,MAAM,CAAC,IAAsH;YAC3H,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,sEAAsE;QACtE,eAAe,CAAC,EAAU,EAAE,gBAA0B;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,QAAQ,EAAE;YACR,IAAI,CAAC,SAA0F,EAAE;gBAC/F,MAAM,KAAK,GAA2B,EAAE,CAAC;gBACzC,IAAI,MAAM,CAAC,SAAS;oBAAE,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;gBACzD,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM;oBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzH,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,2FAA2F;YAC3F,OAAO,CAAC,EAAU,EAAE,OAA4D,EAAE;gBAChF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,EAAE;YACR,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,OAAe,EAAE,IAAiC;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,OAAe;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,gGAAgG;YAChG,OAAO,CACL,OAAe,EACf,IAAmG;gBAEnG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACvG,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,qDAAqD;QACrD,QAAQ;YACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,KAAa,EAAE,KAAa;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,CAAC,KAAa,EAAE,OAAe;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;KACF,CAAC;AACJ,CAAC;AAoDD;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,KAA8B,EAC9B,OAAkD,EAAE;IAEpD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,2BAA2B,EAAE;QAC1E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,KAAK,GAAI,IAAI,CAAC,MAAkD,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,gDAAgD,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,IAA4C,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAgB,yBAAyB,CACvC,KAAqE;IAErE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACzC,OAAO,IAAA,wBAAa,EAAsB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AAChF,CAAC"}

package/dist/client/data-subject-requests.d.ts

@@ -10,9 +10,43 @@ import type { CursorPage, CursorParams } from './types';
 export interface DataSubjectRequest {
     object: 'data_subject_request';
     id: string;
+    /** Atlas's kind: `export` | `erasure` | `restriction` | `rectification`. */
     type: string;
+    /** The shared data-rights word: `access` | `deletion` | `closure` | `restriction` | `rectification`. */
+    canonical_type?: string;
+    /** Alias of `canonical_type` in the executor protocol spelling. */
+    canonicalType?: string;
+    /** What opened it: `user` | `api` | `admin` | `orchestrator` | `atlas_id`. */
+    source?: string;
     status: string;
     user_id: string;
+    detail?: string | null;
+    /** The orchestrator's case id, when an orchestrator drives this request. */
+    case_id?: string | null;
+    /** The case Atlas opened at the instance's data-rights orchestrator. */
+    external_case?: {
+        product: string;
+        id: string | null;
+        status: string;
+        attempts: number;
+        last_error: string | null;
+        opened_at: number | null;
+        atlas_id_app_id?: string;
+    } | null;
+    trace_id?: string | null;
+    steps?: Array<{
+        name: string;
+        status: string;
+        reason?: string;
+        at?: number;
+    }>;
+    retention?: Array<{
+        category: string;
+        basis: string;
+        until: string;
+    }>;
+    /** Erasures: when the account is erased (epoch ms). */
+    deletion_effective_at?: number | null;
     requested_by_type: string | null;
     requested_by_id: string | null;
     reason: string | null;
@@ -32,7 +66,8 @@ export interface ListDataSubjectRequestsParams extends CursorParams {
 }
 /** Identify the subject by `user_id` OR `subject_email` (`user_id` wins if both are given). */
 export interface CreateDataSubjectRequestBody {
-    type: 'export' | 'erasure';
+    /** Atlas's words or the canonical vocabulary; the answer echoes `canonical_type`. */
+    type: 'export' | 'erasure' | 'erase' | 'access' | 'deletion' | 'closure' | 'restriction' | 'rectification';
     user_id?: string;
     /** The subject's email (verified, else unverified), resolved to the user. */
     subject_email?: string;

package/dist/client/data-subject-requests.js.map

@@ -1 +1 @@
-{"version":3,"file":"data-subject-requests.js","sourceRoot":"","sources":["../../src/client/data-subject-requests.ts"],"names":[],"mappings":";;AA4CA,kEAkDC;AA9FD,uCAAgD;AA4ChD,SAAgB,2BAA2B,CAAC,OAAkB;IAC5D,OAAO;QACL;;;;WAIG;QACH,MAAM,CACJ,IAAkC,EAClC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD;;;WAGG;QACH,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CACF,SAAwC,EAAE;YAE1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+FAA+F;QAC/F,OAAO,CAAC,EAAU,EAAE,cAAuB;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU;gBACpD,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,oFAAoF;QACpF,MAAM,CACJ,EAAU,EACV,OAA4B,EAAE,EAC9B,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS;gBACnD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"data-subject-requests.js","sourceRoot":"","sources":["../../src/client/data-subject-requests.ts"],"names":[],"mappings":";;AA8EA,kEAkDC;AAhID,uCAAgD;AA8EhD,SAAgB,2BAA2B,CAAC,OAAkB;IAC5D,OAAO;QACL;;;;WAIG;QACH,MAAM,CACJ,IAAkC,EAClC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD;;;WAGG;QACH,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CACF,SAAwC,EAAE;YAE1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+FAA+F;QAC/F,OAAO,CAAC,EAAU,EAAE,cAAuB;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU;gBACpD,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,oFAAoF;QACpF,MAAM,CACJ,EAAU,EACV,OAA4B,EAAE,EAC9B,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS;gBACnD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}