@atlasauth/backend 0.17.0 → 0.19.0

package/dist/client/instance.js

@@ -10,8 +10,20 @@ function instanceResource(request) {
             return request({ method: 'PATCH', path: '/v1/instance', body });
         },
         /** Check your setup in one call: configuration the server can see is broken or risky. */
-        preflight() {
-            return request({ method: 'GET', path: '/v1/instance/preflight' });
+        preflight(params = {}) {
+            return request({ method: 'GET', path: '/v1/instance/preflight', query: { ...params } });
+        },
+        /**
+         * The unknown body fields your writes sent over the last `days` (1-90,
+         * default 30): fix every row with an `ignored_count`, then turn
+         * `auth_config.strictRequestBodies` on.
+         */
+        unknownFieldsReport(params = {}) {
+            return request({ method: 'GET', path: '/v1/instance/unknown_fields_report', query: { ...params } });
+        },
+        /** What changed in the API since a date (YYYY-MM-DD): operations added, deprecated and removed. */
+        openapiDiff(params) {
+            return request({ method: 'GET', path: '/v1/openapi/diff', query: { ...params } });
         },
         /**
          * Move every URL that points at one origin to another (a domain move), across
@@ -21,12 +33,74 @@ function instanceResource(request) {
         moveOrigin(body) {
             return request({ method: 'POST', path: '/v1/instance/move_origin', body });
         },
+        /**
+         * One report of everything that connects the instance to the outside world
+         * (setup checks, webhooks with the failing hop, back-channel logout,
+         * referrals, email, consent manager, SDK versions). `only` limits the
+         * sources; `probe: false` skips live reachability probes.
+         */
+        integrationHealth(params = {}) {
+            return request({
+                method: 'GET',
+                path: '/v1/integration-health',
+                query: { only: params.only?.join(','), probe: params.probe === undefined ? undefined : String(params.probe) },
+            });
+        },
+        /** The integration-health check sources this deployment reports. */
+        integrationHealthProviders() {
+            return request({ method: 'GET', path: '/v1/integration-health/providers' });
+        },
+        /**
+         * The embed manifest for an instance (public; no key needed): CSP sources per
+         * surface with its hosts filled in, and the merged policy in `tenant.policy`.
+         */
+        embed(params) {
+            return request({ method: 'GET', path: '/v1/embed', query: { ...params } });
+        },
         /** The instance's links to other platforms and their health. Read-only. */
         connections() {
             return request({ method: 'GET', path: '/v1/instance/connections' });
         },
-        /** Built-in connections to other platforms. */
+        /**
+         * Identity integrations: presets and custom integrations (generic), plus the
+         * earlier per-product helpers (`chatly`, `forumulate`) on the same records.
+         */
         integrations: {
+            /** Every integration (the presets, connected or not, and every custom one) with its health. */
+            list() {
+                return request({ method: 'GET', path: '/v1/instance/integrations' });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/instance/integrations/${encodeURIComponent(id)}` });
+            },
+            /** Connect or replace an integration. `{ dryRun: true }` validates and saves nothing. */
+            set(id, body, opts = {}) {
+                return request({
+                    method: 'PUT',
+                    path: `/v1/instance/integrations/${encodeURIComponent(id)}`,
+                    body,
+                    ...(opts.dryRun ? { query: { dry_run: 'true' } } : {}),
+                });
+            },
+            remove(id) {
+                return request({ method: 'DELETE', path: `/v1/instance/integrations/${encodeURIComponent(id)}` });
+            },
+            /** Event and back-channel logout deliveries, newest first; `trace` finds one operation. */
+            deliveries(id, query = {}) {
+                return request({ method: 'GET', path: `/v1/instance/integrations/${encodeURIComponent(id)}/deliveries`, query });
+            },
+            /** Reveal the event receiver's signing secret (audited). */
+            revealEventsSecret(id) {
+                return request({ method: 'POST', path: `/v1/instance/integrations/${encodeURIComponent(id)}/events_secret` });
+            },
+            /** An integration token for a Sign in with Atlas user (their Atlas ID access token). */
+            atlasIdToken(id, accessToken) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/instance/integrations/${encodeURIComponent(id)}/atlas_id_tokens`,
+                    body: { access_token: accessToken },
+                });
+            },
             chatly: {
                 get() {
                     return request({ method: 'GET', path: '/v1/instance/integrations/chatly' });

package/dist/client/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAwTA,4CAiEC;AAjED,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,+CAA+C;QAC/C,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAsmBA,4CA8IC;AA9ID,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS,CAAC,SAA0B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD;;;;WAIG;QACH,mBAAmB,CAAC,SAA4B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,mGAAmG;QACnG,WAAW,CAAC,MAA2C;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,iBAAiB,CAAC,SAA+C,EAAE;YACjE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QACD,oEAAoE;QACpE,0BAA0B;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,MAAsF;YAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,YAAY,EAAE;YACZ,+FAA+F;YAC/F,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,yFAAyF;YACzF,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,OAA6B,EAAE;gBACvE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC3D,IAAI;oBACJ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,2FAA2F;YAC3F,UAAU,CACR,EAAU,EACV,QAAmF,EAAE;gBAErF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,4DAA4D;YAC5D,kBAAkB,CAAC,EAAU;gBAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAChH,CAAC;YACD,wFAAwF;YACxF,YAAY,CAAC,EAAU,EAAE,WAAmB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,kBAAkB;oBAC3E,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/integrations.d.ts

@@ -0,0 +1,107 @@
+import { type RequestFn } from './request';
+/**
+ * The integration-facing routes, called with the instance secret key (an
+ * integrated service calls the same routes with the partner link the instance
+ * owner granted it): report a token a service refused, read the agent-sidebar
+ * card for a user and run its actions, and read an instance's public metadata.
+ */
+export type IntegrationVerifyErrorCode = 'aud_mismatch' | 'expired' | 'bad_signature' | 'unknown_kid' | 'session_revoked' | 'invalid_claims' | 'other';
+export interface ReportVerifyErrorBody {
+    /** The integration id the token was minted for (a preset or a custom id). */
+    integration: string;
+    error: IntegrationVerifyErrorCode;
+    audience?: string;
+    /** Epoch ms (or seconds) or an ISO time. Default now. */
+    at?: number | string;
+    kid?: string;
+    sid?: string;
+    detail?: string;
+}
+export interface IntegrationVerifyError {
+    object: 'integration_verify_error';
+    id: string;
+    integration: string;
+    audience: string | null;
+    error: IntegrationVerifyErrorCode;
+    at: number;
+    trace_id: string | null;
+    created_at: number;
+}
+export interface IntegrationCard {
+    object: 'integration_card';
+    integration: string;
+    user: {
+        id: string;
+        email: string | null;
+        email_verified: boolean;
+        name: string | null;
+        external_id: string | null;
+        banned: boolean;
+        mfa_enabled: boolean;
+        last_sign_in_at: number | null;
+        created_at: number;
+        organizations: Array<{
+            id: string;
+            name: string;
+            role: string;
+        }>;
+    };
+    sessions_active: number;
+    actions: Array<{
+        id: 'revoke_sessions';
+        label: string;
+        confirm: boolean;
+        available: boolean;
+        requires_scope: string;
+    }>;
+}
+export interface InstanceMetadata {
+    object: 'instance_metadata';
+    id: string;
+    issuer: string;
+    jwks_uri: string;
+    token_schema: string;
+    integrations: Record<string, {
+        audience: string;
+        preset: string | null;
+        ttl_seconds: number;
+        additional_issuers?: string[];
+    }>;
+    trusted_issuers: Array<{
+        issuer: string;
+        jwks_uri: string;
+        kind: 'instance' | 'atlas_id';
+    }>;
+    previous_issuers: Array<{
+        issuer: string;
+        jwks_uri: string;
+        replaced_at: number;
+    }>;
+}
+export declare function integrationsResource(request: RequestFn): {
+    /** `POST /v1/integrations/verify_errors` — record a token an integrated service refused. */
+    reportVerifyError(body: ReportVerifyErrorBody): Promise<IntegrationVerifyError>;
+    /** `GET /v1/integrations/:integration/card` — the agent-sidebar card for a user (by token sub). */
+    card(integration: string, query: {
+        sub: string;
+        iss?: string;
+    }): Promise<IntegrationCard>;
+    /** `POST /v1/integrations/:integration/card/actions/revoke_sessions` — sign the user out everywhere (audited with the agent). */
+    revokeSessions(integration: string, body: {
+        sub: string;
+        iss?: string;
+        agent?: {
+            id?: string;
+            name?: string;
+            email?: string;
+        };
+    }): Promise<{
+        object: "integration_card_action";
+        integration: string;
+        action: "revoke_sessions";
+        ok: boolean;
+        sessions_revoked: number;
+    }>;
+    /** `GET /v1/public/instances/:id` — the public metadata of an instance (no key needed). */
+    instanceMetadata(instanceId: string): Promise<InstanceMetadata>;
+};

package/dist/client/integrations.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.integrationsResource = integrationsResource;
+const request_1 = require("./request");
+function integrationsResource(request) {
+    return {
+        /** `POST /v1/integrations/verify_errors` — record a token an integrated service refused. */
+        reportVerifyError(body) {
+            return request({ method: 'POST', path: '/v1/integrations/verify_errors', body });
+        },
+        /** `GET /v1/integrations/:integration/card` — the agent-sidebar card for a user (by token sub). */
+        card(integration, query) {
+            return request({ method: 'GET', path: `/v1/integrations/${(0, request_1.enc)(integration)}/card`, query });
+        },
+        /** `POST /v1/integrations/:integration/card/actions/revoke_sessions` — sign the user out everywhere (audited with the agent). */
+        revokeSessions(integration, body) {
+            return request({ method: 'POST', path: `/v1/integrations/${(0, request_1.enc)(integration)}/card/actions/revoke_sessions`, body });
+        },
+        /** `GET /v1/public/instances/:id` — the public metadata of an instance (no key needed). */
+        instanceMetadata(instanceId) {
+            return request({ method: 'GET', path: `/v1/public/instances/${(0, request_1.enc)(instanceId)}` });
+        },
+    };
+}
+//# sourceMappingURL=integrations.js.map

package/dist/client/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","sourceRoot":"","sources":["../../src/client/integrations.ts"],"names":[],"mappings":";;AAuEA,oDAsBC;AA7FD,uCAAgD;AAuEhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4FAA4F;QAC5F,iBAAiB,CAAC,IAA2B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,mGAAmG;QACnG,IAAI,CAAC,WAAmB,EAAE,KAAoC;YAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,iIAAiI;QACjI,cAAc,CACZ,WAAmB,EACnB,IAA2F;YAE3F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,WAAW,CAAC,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,2FAA2F;QAC3F,gBAAgB,CAAC,UAAkB;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/messaging.d.ts

@@ -278,6 +278,16 @@ export type SmsProvider = {
 }[SmsTransport];
 /** Either channel's provider. Narrow on `transport` (or `channel`) to read its config. */
 export type MessagingProvider = EmailProvider | SmsProvider;
+/**
+ * What a singleton GET returns when nothing is configured yet (never a 404).
+ * A configured object carries `configured: true`.
+ */
+export interface NotConfigured<O extends string = string> {
+    object: O;
+    configured: false;
+    /** What to call to configure it. */
+    message?: string;
+}
 export interface MessagingProviders {
     object: 'messaging_providers';
     email: EmailProvider | null;
@@ -429,6 +439,10 @@ type LegacyInput<T extends string> = Omit<MessagingProviderInput, 'transport'> &
 export declare function messagingResource(request: RequestFn): {
     /** The instance's configured email and SMS providers, secrets omitted. */
     get(): Promise<MessagingProviders>;
+    /** One channel's provider, or `{ configured: false, channel }` when none is set. */
+    channel<C extends "email" | "sms">(channel: C): Promise<(C extends "email" ? EmailProvider : SmsProvider) | (NotConfigured<"messaging_provider"> & {
+        channel: C;
+    })>;
     /**
      * Configure (or update) the email provider. `config` keys are checked per
      * `transport`; on an update of the same transport, omitted keys — including
@@ -462,8 +476,8 @@ export declare function messagingResource(request: RequestFn): {
      * Atlas's sign-in emails without a verified domain ([Atlas test] subjects, capped).
      */
     developmentEmail: {
-        /** 404 when the provider is not in development mode. */
-        get(): Promise<DevelopmentEmail>;
+        /** `{ configured: false }` when the provider is not in development mode. */
+        get(): Promise<DevelopmentEmail | NotConfigured<"development_email">>;
         /** Turn development mode on. 409 `DEVELOPMENT_EMAIL_NOT_ALLOWED` on a production instance. */
         enable(body: EnableDevelopmentEmailBody): Promise<DevelopmentEmail>;
         /** Back to standard mode; the provider stays. */
@@ -476,8 +490,8 @@ export declare function messagingResource(request: RequestFn): {
     };
     /** Managed email: Atlas sets your sending domain up on your own Resend or Brevo account. */
     managedEmail: {
-        /** 404 when none is configured. */
-        get(): Promise<ManagedEmail>;
+        /** `{ configured: false }` when none is configured. */
+        get(): Promise<ManagedEmail | NotConfigured<"managed_email">>;
         /** Register the sending domain; returns the DNS `records` to publish. */
         create(body: CreateManagedEmailBody): Promise<ManagedEmail>;
         /** Re-check the DNS records now; `verified` is true once email can be sent. */

package/dist/client/messaging.js

@@ -14,6 +14,10 @@ function messagingResource(request) {
         get() {
             return request({ method: 'GET', path: '/v1/messaging_providers' });
         },
+        /** One channel's provider, or `{ configured: false, channel }` when none is set. */
+        channel(channel) {
+            return request({ method: 'GET', path: `/v1/messaging_providers/${channel}` });
+        },
         /**
          * Configure (or update) the email provider. `config` keys are checked per
          * `transport`; on an update of the same transport, omitted keys — including
@@ -45,7 +49,7 @@ function messagingResource(request) {
          * Atlas's sign-in emails without a verified domain ([Atlas test] subjects, capped).
          */
         developmentEmail: {
-            /** 404 when the provider is not in development mode. */
+            /** `{ configured: false }` when the provider is not in development mode. */
             get() {
                 return request({ method: 'GET', path: '/v1/messaging_providers/email/development' });
             },
@@ -60,7 +64,7 @@ function messagingResource(request) {
         },
         /** Managed email: Atlas sets your sending domain up on your own Resend or Brevo account. */
         managedEmail: {
-            /** 404 when none is configured. */
+            /** `{ configured: false }` when none is configured. */
             get() {
                 return request({ method: 'GET', path: '/v1/messaging_providers/email/managed' });
             },

package/dist/client/messaging.js.map

@@ -1 +1 @@
-{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAydA,8CAuGC;AAhkBD,uCAAgD;AAydhD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,gBAAgB,EAAE;YAChB,wDAAwD;YACxD,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,8FAA8F;YAC9F,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,iDAAiD;YACjD,OAAO;gBACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC1F,CAAC;SACF;QACD,4FAA4F;QAC5F,YAAY,EAAE;YACZ,mCAAmC;YACnC,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,yEAAyE;YACzE,MAAM,CAAC,IAA4B;gBACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD;;;;eAIG;YACH,MAAM,CAAC,UAA+B,EAAE;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,uCAAuC;oBAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;SACF;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAoeA,8CA6GC;AAjlBD,uCAAgD;AAoehD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,oFAAoF;QACpF,OAAO,CACL,OAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,OAAO,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,gBAAgB,EAAE;YAChB,4EAA4E;YAC5E,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,8FAA8F;YAC9F,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,iDAAiD;YACjD,OAAO;gBACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC1F,CAAC;SACF;QACD,4FAA4F;QAC5F,YAAY,EAAE;YACZ,uDAAuD;YACvD,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,yEAAyE;YACzE,MAAM,CAAC,IAA4B;gBACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD;;;;eAIG;YACH,MAAM,CAAC,UAA+B,EAAE;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,uCAAuC;oBAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;SACF;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/oauth-clients.d.ts

@@ -1,6 +1,7 @@
+import { type ProvisioningFields, type ProvisioningInput, type ProvisioningMetadata } from './compliance';
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
-export interface OAuthClient {
+export interface OAuthClient extends ProvisioningFields {
     object: 'oauth_client';
     id: string;
     client_id: string;
@@ -147,7 +148,7 @@ export interface ClientGrant {
     created_at: number;
     updated_at: number;
 }
-export interface CreateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields, OAuthClientTokenFields {
+export interface CreateOAuthClientBody extends ProvisioningInput, OAuthClientLogoutFields, OAuthClientSubjectFields, OAuthClientTokenFields {
     name: string;
     redirect_uris: string[];
     allowed_scopes?: string[];
@@ -157,8 +158,12 @@ export interface CreateOAuthClientBody extends OAuthClientLogoutFields, OAuthCli
     first_party?: boolean;
     /** How long the issued secret authenticates, in seconds; omit for no expiry. */
     secret_expires_in_seconds?: number;
+    /** Require PKCE. New clients default to true (confidential ones included); send false to opt out. */
+    require_pkce?: boolean;
 }
 export interface UpdateOAuthClientBody extends OAuthClientLogoutFields, OAuthClientSubjectFields, OAuthClientTokenFields {
+    /** Replaces the provisioning metadata. */
+    metadata?: ProvisioningMetadata;
     name?: string;
     redirect_uris?: string[];
     allowed_scopes?: string[];
@@ -250,7 +255,10 @@ export declare function oauthClientsResource(request: RequestFn): {
     import(body: {
         clients: ImportOAuthClientEntry[];
     }, idempotencyKey?: string): Promise<ListPage<ImportedOAuthClient>>;
-    list(): Promise<ListPage<OAuthClient>>;
+    /** `metadata` filters on provisioning tags (`?metadata[key]=value`). */
+    list(params?: {
+        metadata?: ProvisioningMetadata;
+    }): Promise<ListPage<OAuthClient>>;
     get(id: string): Promise<OAuthClient>;
     create(body: CreateOAuthClientBody, idempotencyKey?: string): Promise<OAuthClientWithSecret>;
     update(id: string, body: UpdateOAuthClientBody): Promise<OAuthClient>;

package/dist/client/oauth-clients.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.oauthClientsResource = oauthClientsResource;
+const compliance_1 = require("./compliance");
 const request_1 = require("./request");
 function oauthClientsResource(request) {
     return {
@@ -8,8 +9,9 @@ function oauthClientsResource(request) {
         import(body, idempotencyKey) {
             return request({ method: 'POST', path: '/v1/oauth_clients/import', body, idempotencyKey });
         },
-        list() {
-            return request({ method: 'GET', path: '/v1/oauth_clients' });
+        /** `metadata` filters on provisioning tags (`?metadata[key]=value`). */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/oauth_clients', query: (0, compliance_1.metadataQuery)(params.metadata) });
         },
         get(id) {
             return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}` });

package/dist/client/oauth-clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA4QA,oDA+FC;AA3WD,uCAAgD;AA4QhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AAiRA,oDAgGC;AAjXD,6CAAyH;AACzH,uCAAgD;AAgRhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,SAA8C,EAAE;YACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAA,0BAAa,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/operator.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Operator sign-in (`atlas login`) and token exchange, without a long-lived key.
+ *
+ *  1. `startOperatorLogin()` runs the RFC 8628 device flow against Atlas's own
+ *     sign-in (the operator issuer) with the public `atlas-cli` client: show the
+ *     person `verification_uri_complete` / `user_code`, then
+ *  2. `pollOperatorLogin()` until it returns the operator access token, then
+ *  3. `exchangeOperatorToken()` swaps it (RFC 8693) for a ONE-HOUR Atlas token
+ *     bound to one instance (`ins_…`, Backend API) or app/account (`app_…` /
+ *     `acct_…`, Platform API), with only the scopes you ask for.
+ *
+ * Root actions (create an app or instance, mint a key) need a multi-factor
+ * sign-in within 5 minutes; otherwise the API answers 403 STEP_UP_REQUIRED.
+ */
+export interface OperatorConfiguration {
+    issuer: string;
+    device_authorization_endpoint: string;
+    token_endpoint: string;
+    client_id: string;
+    scope: string;
+    token_exchange_endpoint: string;
+    token_exchange_audience: 'atlas';
+    root_action_max_mfa_age_seconds: number;
+}
+export interface DeviceAuthorization {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export interface OAuthTokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    scope?: string;
+    refresh_token?: string;
+    id_token?: string;
+    issued_token_type?: string;
+}
+export declare class OAuthFlowError extends Error {
+    readonly error: string;
+    readonly status: number;
+    constructor(error: string, message: string, status: number);
+}
+interface Opts {
+    apiUrl?: string;
+    fetch?: typeof fetch;
+}
+/** GET /v1/operator — where the operator device flow and token exchange live. */
+export declare function operatorConfiguration(opts?: Opts): Promise<OperatorConfiguration>;
+export declare function startOperatorLogin(opts?: Opts & {
+    config?: OperatorConfiguration;
+}): Promise<DeviceAuthorization & {
+    config: OperatorConfiguration;
+}>;
+/**
+ * Poll until the person approves (resolves the operator token), denies or the
+ * code expires (throws). Honours `interval` and `slow_down`.
+ */
+export declare function pollOperatorLogin(start: DeviceAuthorization & {
+    config: OperatorConfiguration;
+}, opts?: Opts & {
+    sleep?: (ms: number) => Promise<void>;
+    signal?: AbortSignal;
+}): Promise<OAuthTokenResponse>;
+/** RFC 8693: swap an operator token for a one-hour, resource-bound Atlas token. */
+export declare function exchangeOperatorToken(subjectToken: string, params: {
+    resource: string;
+    scope: string | string[];
+}, opts?: Opts): Promise<OAuthTokenResponse & {
+    resource: string;
+}>;
+/** client_credentials with a partner link's credentials (a partner calling an instance). */
+export declare function partnerLinkToken(clientId: string, clientSecret: string, opts?: Opts & {
+    scope?: string;
+}): Promise<OAuthTokenResponse>;
+/** A key pair for sealed secret delivery; pass `secretRecipient` to the client. */
+export declare function generateSealKeyPair(): {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+    secretRecipient: string;
+};
+/** Open a `sealed_*` field (base64 libsodium sealed box) from an Atlas response. */
+export declare function openSealedSecret(sealedBase64: string, keyPair: {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+}): string;
+/** POST /v1/keys/revoke_leaked — revoke leaked Atlas credentials (no key needed). */
+export declare function revokeLeakedKeys(secrets: string[], opts?: Opts & {
+    url?: string;
+}): Promise<{
+    results: Array<{
+        index: number;
+        kind: string;
+        outcome: 'revoked' | 'already_revoked' | 'not_found';
+    }>;
+}>;
+export { sealBox, openSealedBox } from './sealed-box';