@atlasauth/backend 0.17.0 → 0.19.0

package/dist/client/referrals.d.ts

@@ -11,7 +11,7 @@ import type { UserReferralResult } from './users';
  * call is retried, and `user.referral_attributed` is sent when it resolves.
  *
  * `provider` is `webhook` (the Atlas referral protocol, which any platform can
- * implement; see {@link verifyReferralRequest}), `referally` (the built-in
+ * implement; see {@link verifyReferralRequest}), `referalli` (the built-in
  * Referalli adapter: `endpoint_url` is your Referalli base URL, plus
  * `connection_id`, `signing_secret` and optionally `tracking_token`) or
  * another built-in vendor adapter.
@@ -49,6 +49,10 @@ export interface ReferralProviderInfo {
     needs: Array<'endpoint_url' | 'signing_secret' | 'api_key' | 'connection_id' | 'tracking_token'>;
     /** The vendor's own first-party tracking cookie, suggested when this provider is picked. */
     default_context_cookie: string | null;
+    /** Every cookie the vendor has written, in the order Atlas tries them. */
+    default_context_cookies?: string[];
+    /** Retired spellings of `id`, accepted on write (for example `referally` for `referalli`). */
+    aliases?: string[];
     docs_url: string | null;
 }
 /** Fraud and bot protection for referred sign-ups (`security` on the settings). */
@@ -117,9 +121,9 @@ export interface ReferralInboundStatus {
     } | null;
 }
 /** A referral program whose script or cookie the browser reads. */
-export type ReferralBrowserSource = 'referally' | 'rewardful' | 'tolt' | 'promotekit' | 'firstpromoter' | 'partnerstack' | 'dub';
+export type ReferralBrowserSource = 'referalli' | 'rewardful' | 'tolt' | 'promotekit' | 'firstpromoter' | 'partnerstack' | 'dub';
 /** Which consent manager decides on the tracking cookie's ids: `auto` (any common one), one manager, or `app` (only the app's own decision). */
-export type ReferralConsentProvider = 'auto' | 'cookiemunch' | 'onetrust' | 'cookiebot' | 'didomi' | 'usercentrics' | 'osano' | 'cookieyes' | 'complianz' | 'klaro' | 'tcf' | 'consent_mode' | 'app';
+export type ReferralConsentProvider = 'auto' | 'atlasconsent' | 'cookiemunch' | 'onetrust' | 'cookiebot' | 'didomi' | 'usercentrics' | 'osano' | 'cookieyes' | 'complianz' | 'klaro' | 'tcf' | 'consent_mode' | 'gpc' | 'app';
 /** What a platform answers to a ping. */
 export interface ReferralPing {
     ok: boolean;
@@ -141,6 +145,27 @@ export interface ReferralPing {
     error_code?: string | null;
     error?: string | null;
 }
+/** A one-click (OAuth) install a deployment offers for a referral platform. */
+export interface ReferralOneClick {
+    id: string;
+    name: string;
+    available: boolean;
+    /** What the connection is saved as: `referalli` or `webhook` (the generic protocol). */
+    provider: string;
+    scope: string;
+    redirect_uri: string;
+}
+/** `POST /v1/instance/referrals/{preset}/install`. */
+export interface ReferralInstall {
+    object: 'referral_install';
+    preset: string;
+    provider: string;
+    /** Send the merchant here to pick an organization and program. */
+    authorize_url: string;
+    redirect_uri: string;
+    /** Epoch ms; the link lasts 15 minutes. */
+    expires_at: number;
+}
 /** `GET /v1/instance/referrals`. */
 export interface ReferralSettings {
     object: 'referral_settings';
@@ -159,8 +184,18 @@ export interface ReferralSettings {
     api_key_set: boolean;
     /** Query parameters that carry a referral code, in priority order (default `ref`, `via`, `aff`). */
     url_params: string[];
-    /** First-party tracking cookie read under consent; null = never read a cookie. */
+    /** The first tracking cookie read under consent; null = never read a cookie. `context_cookies` lists them all. */
     context_cookie: string | null;
+    /** Every tracking cookie, in the order they are tried. */
+    context_cookies?: string[];
+    /** Retired spellings of `provider` that are still accepted on write. */
+    provider_aliases?: string[];
+    /** What the chosen provider can do now: its built-in capabilities plus what its last ping advertised. */
+    capabilities?: ReferralProviderCapabilities | null;
+    /** One-click connect to Referalli (the `referalli` preset). */
+    one_click?: ReferralOneClick | null;
+    /** Every platform this deployment offers a one-click install for. */
+    one_click_presets?: ReferralOneClick[];
     consent_category: string;
     consent_fallback_category: string | null;
     /** Every new user becomes a referrer (gets a code and link from the platform). */
@@ -170,7 +205,7 @@ export interface ReferralSettings {
     /** How long a sign-up waits for the platform (100-5000 ms, default 3000). */
     timeout_ms: number;
     security: ReferralSecuritySettings;
-    /** Public tracking token (the `referally` adapter derives the code lookup from it). */
+    /** Public tracking token (the `referalli` adapter derives the code lookup from it). */
     tracking_token?: string | null;
     /** Public, CORS-enabled lookup with `{code}` for "X invited you" on hosted sign-up. */
     code_lookup_url?: string | null;
@@ -221,7 +256,10 @@ export interface UpdateReferralSettingsBody {
     inbound_endpoint_id?: string | null;
     /** 1-10 names of `[A-Za-z0-9_.-]{1,40}`. */
     url_params?: string[];
-    context_cookie?: string | null;
+    /** A cookie name, or a list of up to 5 tried in order; null clears. */
+    context_cookie?: string | string[] | null;
+    /** The same with a list; wins over `context_cookie`. */
+    context_cookies?: string[] | null;
     consent_category?: string;
     consent_fallback_category?: string | null;
     auto_enroll_users?: boolean;
@@ -433,6 +471,15 @@ export declare function referralsResource(request: RequestFn): {
         kind?: ReferralCallKind;
         error_code?: string;
     }, idempotencyKey?: string): Promise<ReferralRetryFailedResult>;
+    /**
+     * `POST /v1/instance/referrals/{preset}/install` — start a one-click
+     * connection to a referral platform (`referalli`, or any id in
+     * `one_click_presets`). 422 `REFERRALS_NOT_CONFIGURED` when the deployment
+     * does not offer it; connect with a key or signing secret then.
+     */
+    install(preset: string, body?: {
+        return_to?: string | null;
+    }): Promise<ReferralInstall>;
     /**
      * `POST /v1/instance/referrals/simulate` — send a sign-up call for a fake
      * user (`atlas_test_<random>`, never stored) with an optional code, and

package/dist/client/referrals.js

@@ -38,6 +38,15 @@ function referralsResource(request) {
         retryFailed(filter = {}, idempotencyKey) {
             return request({ method: 'POST', path: '/v1/instance/referrals/calls/retry_failed', body: filter, idempotencyKey });
         },
+        /**
+         * `POST /v1/instance/referrals/{preset}/install` — start a one-click
+         * connection to a referral platform (`referalli`, or any id in
+         * `one_click_presets`). 422 `REFERRALS_NOT_CONFIGURED` when the deployment
+         * does not offer it; connect with a key or signing secret then.
+         */
+        install(preset, body = {}) {
+            return request({ method: 'POST', path: `/v1/instance/referrals/${(0, request_1.enc)(preset)}/install`, body });
+        },
         /**
          * `POST /v1/instance/referrals/simulate` — send a sign-up call for a fake
          * user (`atlas_test_<random>`, never stored) with an optional code, and

package/dist/client/referrals.js.map

@@ -1 +1 @@
-{"version":3,"file":"referrals.js","sourceRoot":"","sources":["../../src/client/referrals.ts"],"names":[],"mappings":";;AAoaA,8CAmEC;AAveD,uCAAgD;AAoahD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,8FAA8F;QAC9F,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,+EAA+E;QAC/E,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD;;;WAGG;QACH,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,uEAAuE;QACvE,SAAS,CAAC,SAAkC,EAAE;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,EAAU,EAAE,cAAuB;YAC3C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;gBACrD,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,6GAA6G;QAC7G,WAAW,CACT,SAA2D,EAAE,EAC7D,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACtH,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,OAA0B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,IAA0B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,iDAAiD;QACjD,WAAW,CAAC,EAAU;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD;;;WAGG;QACH,UAAU,CAAC,MAAc;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"referrals.js","sourceRoot":"","sources":["../../src/client/referrals.ts"],"names":[],"mappings":";;AA8cA,8CA4EC;AA1hBD,uCAAgD;AA8chD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,8FAA8F;QAC9F,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,+EAA+E;QAC/E,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD;;;WAGG;QACH,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,uEAAuE;QACvE,SAAS,CAAC,SAAkC,EAAE;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,EAAU,EAAE,cAAuB;YAC3C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;gBACrD,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,6GAA6G;QAC7G,WAAW,CACT,SAA2D,EAAE,EAC7D,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACtH,CAAC;QACD;;;;;WAKG;QACH,OAAO,CAAC,MAAc,EAAE,OAAsC,EAAE;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,OAA0B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,QAAQ,CAAC,IAA0B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,iDAAiD;QACjD,WAAW,CAAC,EAAU;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD;;;WAGG;QACH,UAAU,CAAC,MAAc;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/request.d.ts

@@ -38,6 +38,40 @@ export interface AtlasClientConfig {
      * newer API version. Not called in strict mode, where the write fails instead.
      */
     onUnknownFields?: (event: UnknownFieldsEvent) => void;
+    /**
+     * Dry run: every write (POST/PUT/PATCH/DELETE) is sent with `?dry_run=true`,
+     * so Atlas validates it and answers with the changes it WOULD make
+     * ({@link DryRunResult}) without changing anything. Use it for a single plan
+     * with `client.withOptions({ dryRun: true })`; the method's declared return
+     * type is then a `DryRunResult` at runtime.
+     */
+    dryRun?: boolean;
+    /**
+     * Sealed secret delivery: an `x25519:<public key>` (see `generateSealKeyPair`
+     * in `@atlasauth/backend`). Sent as `X-Secret-Recipient` on every request, so
+     * every shown-once secret in a response arrives sealed (`sealed_secret`, …)
+     * instead of in plaintext. Open it with `openSealedSecret`.
+     */
+    secretRecipient?: string;
+}
+/** One change a write would make (or made), in the config-changelog shape. */
+export interface DryRunChange {
+    section: string;
+    before: unknown;
+    after: unknown;
+}
+/** What a write answers with `?dry_run=true` (see {@link AtlasClientConfig.dryRun}). */
+export interface DryRunResult {
+    object: 'dry_run';
+    dry_run: true;
+    /** `native`: the endpoint validated in full. `plan`: the body diffed over the current object, unvalidated. */
+    mode: 'native' | 'plan';
+    validated: boolean;
+    method: string;
+    path: string;
+    changes: DryRunChange[];
+    would_return?: unknown;
+    note: string;
 }
 /** What {@link AtlasClientConfig.onUnknownFields} receives. */
 export interface UnknownFieldsEvent {
@@ -48,7 +82,7 @@ export interface UnknownFieldsEvent {
     fields: string[];
 }
 /** Per-client settings `withOptions` can override. */
-export type AtlasRequestSettings = Pick<AtlasClientConfig, 'strict' | 'onUnknownFields'>;
+export type AtlasRequestSettings = Pick<AtlasClientConfig, 'strict' | 'onUnknownFields' | 'dryRun'>;
 /** A raw (non-JSON) request body, e.g. image bytes for a design-asset upload. */
 export interface RawBody {
     data: Blob | ArrayBuffer | ArrayBufferView;
@@ -74,6 +108,8 @@ export interface RequestOptions {
     raw?: boolean;
     /** Per-request override of {@link AtlasClientConfig.strict}. */
     strict?: boolean;
+    /** Extra request headers. */
+    headers?: Record<string, string>;
 }
 /** Serialize a query object to a string, dropping null/undefined, spreading arrays. */
 export declare function serializeQuery(query: QueryParams | undefined): string;
@@ -89,6 +125,7 @@ export declare function createRequest(config: AtlasClientConfig): RequestFn;
 export interface KeyedRequestConfig extends AtlasRequestSettings {
     apiUrl?: string;
     fetch?: typeof fetch;
+    secretRecipient?: string;
 }
 /**
  * The request core for any bearer key: the secret key (`sk_...`) of the

package/dist/client/request.js

@@ -49,11 +49,15 @@ function createKeyedRequest(key, config) {
         throw new Error('No fetch implementation found. Pass { fetch } to createAtlasClient on a runtime without a global fetch.');
     }
     return async function request(options) {
-        const url = joinUrl(base, options.path) + serializeQuery(options.query);
+        const dryRun = config.dryRun === true && options.method !== 'GET';
+        const url = joinUrl(base, options.path) + serializeQuery(dryRun ? { ...options.query, dry_run: 'true' } : options.query);
         const headers = {
+            ...(options.headers ?? {}),
             authorization: `Bearer ${key}`,
             accept: 'application/json',
         };
+        if (config.secretRecipient)
+            headers['x-secret-recipient'] = config.secretRecipient;
         let body;
         if (options.rawBody !== undefined) {
             const { data, contentType } = options.rawBody;
@@ -68,7 +72,7 @@ function createKeyedRequest(key, config) {
             headers['content-type'] = 'application/json';
             body = JSON.stringify(options.body);
         }
-        if (options.idempotencyKey) {
+        if (options.idempotencyKey && !dryRun) {
             headers['idempotency-key'] = options.idempotencyKey;
         }
         const strict = options.strict ?? config.strict;

package/dist/client/request.js.map

@@ -1 +1 @@
-{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/client/request.ts"],"names":[],"mappings":";;;AAuFA,wCAYC;AAGD,kBAEC;AAYD,sCAKC;AAYD,gDAoEC;AAzMD,mCAA6D;AA+D7D,sEAAsE;AACzD,QAAA,eAAe,GAAG,2BAA2B,CAAC;AAsB3D,uFAAuF;AACvF,SAAgB,cAAc,CAAC,KAA8B;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAgB,GAAG,CAAC,OAAe;IACjC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAClF,CAAC;AAQD,SAAgB,aAAa,CAAC,MAAyB;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAQD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAW,EAAE,MAA0B;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,uBAAe,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACnD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,UAAU,OAAO,CAAI,OAAuB;QACtD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAExE,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,IAAyB,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;YAC9C,MAAM,IAAI,GACR,WAAW,IAAI,CAAC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;YAC/B,IAAI,GAAG,IAA2B,CAAC;QACrC,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrD,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,CAAC;YAChE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,OAAO;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAEnD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAc,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,OAA2B,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG;YACP;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,OAAO,IAAI,wCAAwC,QAAQ,CAAC,MAAM,EAAE;aAC9E;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,qBAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/client/request.ts"],"names":[],"mappings":";;;AA6HA,wCAYC;AAGD,kBAEC;AAYD,sCAKC;AAaD,gDAuEC;AAnPD,mCAA6D;AAmG7D,sEAAsE;AACzD,QAAA,eAAe,GAAG,2BAA2B,CAAC;AAwB3D,uFAAuF;AACvF,SAAgB,cAAc,CAAC,KAA8B;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAgB,GAAG,CAAC,OAAe;IACjC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAClF,CAAC;AAQD,SAAgB,aAAa,CAAC,MAAyB;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AASD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAW,EAAE,MAA0B;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,uBAAe,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACnD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,UAAU,OAAO,CAAI,OAAuB;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;QAClE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEzH,MAAM,OAAO,GAA2B;YACtC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1B,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,MAAM,CAAC,eAAe;YAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QACnF,IAAI,IAAyB,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;YAC9C,MAAM,IAAI,GACR,WAAW,IAAI,CAAC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;YAC/B,IAAI,GAAG,IAA2B,CAAC;QACrC,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrD,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,CAAC;YAChE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,OAAO;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAEnD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAc,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,OAA2B,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG;YACP;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,OAAO,IAAI,wCAAwC,QAAQ,CAAC,MAAM,EAAE;aAC9E;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,qBAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}

package/dist/client/sealed-box.d.ts

@@ -0,0 +1,7 @@
+export declare function beforeNm(publicKey: Uint8Array, secretKey: Uint8Array): Uint8Array;
+export declare function generateSealKeyPair(): {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+};
+export declare function sealBox(message: Uint8Array | string, recipientPublicKey: Uint8Array): Uint8Array;
+export declare function openSealedBox(sealed: Uint8Array, publicKey: Uint8Array, secretKey: Uint8Array): Uint8Array;

package/dist/client/sealed-box.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.beforeNm = beforeNm;
+exports.generateSealKeyPair = generateSealKeyPair;
+exports.sealBox = sealBox;
+exports.openSealedBox = openSealedBox;
+const ed25519_1 = require("@noble/curves/ed25519");
+const salsa_1 = require("@noble/ciphers/salsa");
+const blake2b_1 = require("@noble/hashes/blake2b");
+/**
+ * libsodium `crypto_box_seal` / `crypto_box_seal_open`, in pure JS so the
+ * client keeps running on every runtime (Node, Deno, Bun, edge, browsers).
+ *
+ *   nonce = BLAKE2b-192(epk ‖ pk);  k = HSalsa20(X25519(sk, pk), 0¹⁶)
+ *   box   = epk ‖ XSalsa20-Poly1305(k, nonce, message)
+ */
+const SIGMA = new Uint32Array([0x61707865, 0x3320646e, 0x79622d32, 0x6b206574]);
+function u32(b) {
+    const out = new Uint32Array(b.length / 4);
+    for (let i = 0; i < out.length; i += 1)
+        out[i] = (b[i * 4] | (b[i * 4 + 1] << 8) | (b[i * 4 + 2] << 16) | (b[i * 4 + 3] << 24)) >>> 0;
+    return out;
+}
+function beforeNm(publicKey, secretKey) {
+    const shared = ed25519_1.x25519.getSharedSecret(secretKey, publicKey);
+    const out = new Uint32Array(8);
+    (0, salsa_1.hsalsa)(SIGMA, u32(shared), new Uint32Array(4), out);
+    const bytes = new Uint8Array(32);
+    out.forEach((w, i) => {
+        bytes[i * 4] = w & 0xff;
+        bytes[i * 4 + 1] = (w >>> 8) & 0xff;
+        bytes[i * 4 + 2] = (w >>> 16) & 0xff;
+        bytes[i * 4 + 3] = (w >>> 24) & 0xff;
+    });
+    return bytes;
+}
+function nonceFor(epk, pk) {
+    const input = new Uint8Array(64);
+    input.set(epk, 0);
+    input.set(pk, 32);
+    return (0, blake2b_1.blake2b)(input, { dkLen: 24 });
+}
+function generateSealKeyPair() {
+    const secretKey = ed25519_1.x25519.utils.randomPrivateKey();
+    return { publicKey: ed25519_1.x25519.getPublicKey(secretKey), secretKey };
+}
+function sealBox(message, recipientPublicKey) {
+    const plain = typeof message === 'string' ? new TextEncoder().encode(message) : message;
+    const eph = generateSealKeyPair();
+    const boxed = (0, salsa_1.xsalsa20poly1305)(beforeNm(recipientPublicKey, eph.secretKey), nonceFor(eph.publicKey, recipientPublicKey)).encrypt(plain);
+    const out = new Uint8Array(32 + boxed.length);
+    out.set(eph.publicKey, 0);
+    out.set(boxed, 32);
+    return out;
+}
+function openSealedBox(sealed, publicKey, secretKey) {
+    if (sealed.length < 48)
+        throw new Error('openSealedBox: too short');
+    const epk = sealed.subarray(0, 32);
+    return (0, salsa_1.xsalsa20poly1305)(beforeNm(epk, secretKey), nonceFor(epk, publicKey)).decrypt(sealed.subarray(32));
+}
+//# sourceMappingURL=sealed-box.js.map

package/dist/client/sealed-box.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed-box.js","sourceRoot":"","sources":["../../src/client/sealed-box.ts"],"names":[],"mappings":";;AAoBA,4BAYC;AASD,kDAGC;AAED,0BAQC;AAED,sCAIC;AA5DD,mDAA+C;AAC/C,gDAAgE;AAChE,mDAAgD;AAEhD;;;;;;GAMG;AAEH,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhF,SAAS,GAAG,CAAC,CAAa;IACxB,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1I,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,QAAQ,CAAC,SAAqB,EAAE,SAAqB;IACnE,MAAM,MAAM,GAAG,gBAAM,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAA,cAAM,EAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnB,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;QACpC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAe,EAAE,EAAc;IAC/C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClB,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAClB,OAAO,IAAA,iBAAO,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAgB,mBAAmB;IACjC,MAAM,SAAS,GAAG,gBAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAClD,OAAO,EAAE,SAAS,EAAE,gBAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED,SAAgB,OAAO,CAAC,OAA4B,EAAE,kBAA8B;IAClF,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,IAAA,wBAAgB,EAAC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxI,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,aAAa,CAAC,MAAkB,EAAE,SAAqB,EAAE,SAAqB;IAC5F,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,IAAA,wBAAgB,EAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3G,CAAC"}

package/dist/client/sessions.d.ts

@@ -59,6 +59,16 @@ export interface MintedSession {
     custom_data?: Record<string, unknown> | null;
 }
 /** A JWT minted from a named JWT template. */
+/** An identity-integration token (claims: /schemas/integration-token-v1.json). */
+export interface SessionIntegrationToken {
+    object: 'integration_token';
+    integration: string;
+    product: string;
+    jwt: string;
+    /** Seconds until the token expires (at most 120). */
+    expires_in: number;
+    audience: string;
+}
 export interface SessionTemplateToken {
     object: string;
     jwt: string;
@@ -98,9 +108,10 @@ export declare function sessionsResource(request: RequestFn): {
      * effective write per minute, so calling it on every request is safe.
      */
     touch(id: string): Promise<TouchedSession>;
-    /**
-     * `POST /v1/sessions/:id/tokens/:template` — mint a token from a named JWT
-     * template for this session. The reserved name `session` is refused.
-     */
-    getToken(id: string, template: string): Promise<SessionTemplateToken>;
+    getToken: {
+        (id: string, template: string): Promise<SessionTemplateToken>;
+        (id: string, options: {
+            for: string;
+        }): Promise<SessionIntegrationToken>;
+    };
 };

package/dist/client/sessions.js

@@ -3,6 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sessionsResource = sessionsResource;
 const request_1 = require("./request");
 function sessionsResource(request) {
+    function getToken(id, what) {
+        if (typeof what === 'object') {
+            return request({ method: 'POST', path: `/v1/sessions/${(0, request_1.enc)(id)}/integration_tokens/${(0, request_1.enc)(what.for)}` });
+        }
+        return request({ method: 'POST', path: `/v1/sessions/${(0, request_1.enc)(id)}/tokens/${(0, request_1.enc)(what)}` });
+    }
     return {
         /**
          * `POST /v1/sessions` — mint a session for a user without the sign-in flow.
@@ -46,16 +52,7 @@ function sessionsResource(request) {
         touch(id) {
             return request({ method: 'POST', path: `/v1/sessions/${(0, request_1.enc)(id)}/touch` });
         },
-        /**
-         * `POST /v1/sessions/:id/tokens/:template` — mint a token from a named JWT
-         * template for this session. The reserved name `session` is refused.
-         */
-        getToken(id, template) {
-            return request({
-                method: 'POST',
-                path: `/v1/sessions/${(0, request_1.enc)(id)}/tokens/${(0, request_1.enc)(template)}`,
-            });
-        },
+        getToken,
     };
 }
 //# sourceMappingURL=sessions.js.map

package/dist/client/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/client/sessions.ts"],"names":[],"mappings":";;AAsEA,4CAuDC;AA7HD,uCAAgD;AAsEhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL;;;WAGG;QACH,MAAM,CAAC,MAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,wDAAwD;QACxD,IAAI,CAAC,MAA0B;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;WAIG;QACH,aAAa,CAAC,EAAU,EAAE,UAA0C;YAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;QACD;;;WAGG;QACH,gBAAgB,CAAC,EAAU,EAAE,KAA8B;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjH,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU,EAAE,QAAgB;YACnC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/client/sessions.ts"],"names":[],"mappings":";;AAiFA,4CA+DC;AAhJD,uCAAgD;AAiFhD,SAAgB,gBAAgB,CAAC,OAAkB;IAYjD,SAAS,QAAQ,CAAC,EAAU,EAAE,IAA8B;QAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO;QACL;;;WAGG;QACH,MAAM,CAAC,MAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,wDAAwD;QACxD,IAAI,CAAC,MAA0B;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;WAIG;QACH,aAAa,CAAC,EAAU,EAAE,UAA0C;YAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;QACD;;;WAGG;QACH,gBAAgB,CAAC,EAAU,EAAE,KAA8B;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjH,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/client/status.d.ts

@@ -0,0 +1,200 @@
+import { type RequestFn } from './request';
+/**
+ * Atlas service status for your instance: the incident subscription (owner
+ * email, `status_incident.*` webhooks, a private RSS / Atom feed) filtered by
+ * region, component and impact; the incidents that concern you; and the
+ * upstream status pages (any Statuspage-compatible URL) your app depends on.
+ *
+ * The public Statuspage-compatible feed itself needs no key:
+ * `https://<frontend api>/v1/status/api/v2/summary.json` (and the other
+ * Statuspage files, RSS and Atom) — point any status page at it.
+ */
+export type StatusComponentId = 'frontend_api' | 'backend_api' | 'database' | 'cache' | 'background_jobs';
+export type StatusImpact = 'none' | 'minor' | 'major' | 'critical';
+export type StatusIncidentStatus = 'investigating' | 'identified' | 'monitoring' | 'resolved' | 'scheduled' | 'in_progress' | 'completed';
+export type StatusDependencyState = 'operational' | 'degraded' | 'partial_outage' | 'major_outage' | 'maintenance' | 'unknown';
+/** `GET /v1/status` (public). */
+export interface ServiceStatus {
+    object: 'status';
+    status: 'operational' | 'degraded' | 'major_outage';
+    updated_at: number;
+    regions: string[];
+    groups: Array<{
+        id: string;
+        name: string;
+        component_ids: string[];
+    }>;
+    components: Array<{
+        id: StatusComponentId;
+        name: string;
+        status: 'operational' | 'degraded' | 'major_outage' | 'unknown';
+        description: string;
+        group: string;
+        regions: string[];
+    }>;
+    incidents: Array<{
+        id: string;
+        kind: 'incident' | 'maintenance';
+        title: string;
+        status: StatusIncidentStatus;
+        impact: StatusImpact;
+        regions: string[];
+        component_ids: string[];
+        started_at: number;
+        resolved_at: number | null;
+        updated_at: number;
+    }>;
+}
+export interface StatusSubscription {
+    object: 'status_subscription';
+    /** A subscription exists (it may be disabled). */
+    subscribed: boolean;
+    enabled: boolean;
+    /** [] = every region. */
+    regions: string[];
+    /** [] = every component. */
+    component_ids: StatusComponentId[];
+    min_impact: 'minor' | 'major' | 'critical';
+    include_maintenance: boolean;
+    email_owners: boolean;
+    webhook: boolean;
+    /** The private feed; treat it as a secret (`rotateFeed` replaces it). */
+    rss_url: string | null;
+    atom_url: string | null;
+    available_regions: string[];
+    available_components: Array<{
+        id: StatusComponentId;
+        name: string;
+    }>;
+    updated_at: number | null;
+}
+export interface UpdateStatusSubscriptionBody {
+    enabled?: boolean;
+    regions?: string[];
+    component_ids?: StatusComponentId[];
+    min_impact?: 'minor' | 'major' | 'critical';
+    include_maintenance?: boolean;
+    email_owners?: boolean;
+    webhook?: boolean;
+}
+export interface StatusIncidentUpdate {
+    id: string;
+    status: StatusIncidentStatus;
+    body: string;
+    created_at: number;
+}
+export interface StatusIncident {
+    object: 'status_incident';
+    id: string;
+    kind: 'incident' | 'maintenance';
+    title: string;
+    status: StatusIncidentStatus;
+    impact: StatusImpact;
+    regions: string[];
+    component_ids: string[];
+    started_at: number;
+    resolved_at: number | null;
+    updated_at: number;
+    source: 'atlas' | 'import' | (string & {});
+    scheduled_for: number | null;
+    scheduled_until: number | null;
+    /** Oldest first. */
+    updates: StatusIncidentUpdate[];
+}
+/** `data` of the `status_incident.created` / `updated` / `resolved` webhook events. */
+export interface StatusIncidentEventData {
+    object: 'status_incident';
+    id: string;
+    kind: 'incident' | 'maintenance';
+    title: string;
+    status: StatusIncidentStatus;
+    impact: StatusImpact;
+    regions: string[];
+    component_ids: string[];
+    /** The part of the incident that matches your subscription. */
+    affected_regions: string[];
+    affected_component_ids: string[];
+    started_at: number;
+    resolved_at: number | null;
+    update: StatusIncidentUpdate;
+    /** The incident on the status page. */
+    url: string;
+}
+export interface StatusDependency {
+    object: 'status_dependency';
+    id: string;
+    name: string;
+    /** Base URL of the Statuspage-compatible page (Atlas reads `{url}/api/v2/summary.json`). */
+    url: string;
+    component_filter: string[];
+    enabled: boolean;
+    state: StatusDependencyState;
+    indicator: string | null;
+    description: string | null;
+    components: Array<{
+        id: string;
+        name: string;
+        status: string;
+    }>;
+    incidents: Array<{
+        id: string;
+        name: string;
+        status: string;
+        impact: string;
+        updatedAt: string | null;
+    }>;
+    last_checked_at: number | null;
+    last_success_at: number | null;
+    last_error: string | null;
+    /** The last check failed or none has succeeded yet: `state` may be out of date. */
+    stale: boolean;
+    created_at: number;
+}
+export interface CreateStatusDependencyBody {
+    name: string;
+    url: string;
+    component_filter?: string[];
+    enabled?: boolean;
+}
+export interface UpdateStatusDependencyBody {
+    name?: string;
+    component_filter?: string[];
+    enabled?: boolean;
+}
+export declare function statusResource(request: RequestFn): {
+    /** `GET /v1/status` — the public service status (components with group and regions, open incidents). */
+    service(): Promise<ServiceStatus>;
+    /** `GET /v1/instance/status_subscription`. */
+    getSubscription(): Promise<StatusSubscription>;
+    /** `PUT /v1/instance/status_subscription` — create or change it; only the fields sent change. */
+    updateSubscription(body: UpdateStatusSubscriptionBody): Promise<StatusSubscription>;
+    /** `DELETE /v1/instance/status_subscription` — turn it off (settings are kept). */
+    disableSubscription(): Promise<StatusSubscription>;
+    /** `POST /v1/instance/status_subscription/rotate_feed` — a new private feed URL; the old one 404s. */
+    rotateFeed(): Promise<StatusSubscription>;
+    /** `GET /v1/instance/status_incidents` — incidents that concern this instance, newest first. */
+    listIncidents(params?: {
+        open?: boolean;
+        limit?: number;
+    }): Promise<{
+        object: "list";
+        data: StatusIncident[];
+    }>;
+    /** `GET /v1/instance/status_dependencies` — with `state`, the worst among the enabled ones. */
+    listDependencies(): Promise<{
+        object: "list";
+        data: StatusDependency[];
+        state: StatusDependencyState;
+    }>;
+    /** `POST /v1/instance/status_dependencies` — read at once; the answer carries the state or `last_error`. */
+    createDependency(body: CreateStatusDependencyBody): Promise<StatusDependency>;
+    getDependency(id: string): Promise<StatusDependency>;
+    updateDependency(id: string, body: UpdateStatusDependencyBody): Promise<StatusDependency>;
+    deleteDependency(id: string): Promise<{
+        object: "status_dependency";
+        id: string;
+        deleted: true;
+    }>;
+    /** `POST /v1/instance/status_dependencies/:id/refresh` — read the page now. */
+    refreshDependency(id: string): Promise<StatusDependency>;
+};