@atlasauth/backend 0.18.0 → 0.19.0

package/dist/client/instance.d.ts

@@ -67,6 +67,77 @@ export interface PreflightFinding {
     fix: string;
     /** Ids of what the finding is about (provider, client_id, domain, …). */
     subject?: Record<string, string>;
+    /** `security_posture` on the findings about settings weaker than the defaults new instances get. */
+    group?: 'security_posture';
+    /** Only with `include_suppressed: true`: the finding does not apply to how the instance integrates. */
+    suppressed?: true;
+    suppressed_reason?: string;
+}
+/** A finding that does not apply to how the instance integrates, and why. */
+export interface PreflightSuppressedFinding {
+    code: string;
+    severity: 'error' | 'warning' | 'info';
+    subject: Record<string, string> | null;
+    reason: string;
+}
+/** How one allowed https origin signs in, as preflight judged it. */
+export interface PreflightOriginIntegration {
+    origin: string;
+    integration: 'redirect' | 'embedded';
+    source: 'declared' | 'embedded_traffic' | 'redirect_clients' | 'default';
+    /** False only for the default (nothing says how the origin signs in). */
+    confident: boolean;
+    reason: string;
+}
+export interface PreflightParams {
+    /** Only findings at least this severe (`ok` still covers every finding). */
+    min_severity?: 'error' | 'warning' | 'info';
+    /** Also list the suppressed findings in `findings`, marked `suppressed: true`. */
+    include_suppressed?: boolean;
+}
+/** One unknown body field your writes sent, aggregated over the report window. */
+export interface UnknownFieldReportRow {
+    method: string;
+    /** The route template, e.g. `/v1/users/{id}`. */
+    path: string;
+    /** The field path, nested as `parent.child`. */
+    field: string;
+    count: number;
+    /** Lenient requests: the field was ignored and named in Atlas-Unknown-Fields. */
+    ignored_count: number;
+    /** Strict requests: refused with 422 UNKNOWN_FIELD. */
+    rejected_count: number;
+    /** Epoch ms. */
+    last_seen_at: number;
+    /** The secret key that sent it (null without a key). */
+    api_key_id: string | null;
+}
+export interface UnknownFieldsReport {
+    object: 'unknown_fields_report';
+    days: number;
+    retention_days: number;
+    strict_request_bodies: boolean;
+    /** True when nothing in the window would be refused by strict request bodies. */
+    safe_to_enable_strict: boolean;
+    data: UnknownFieldReportRow[];
+}
+/** One operation in an OpenAPI diff. */
+export interface OpenApiDiffItem {
+    method: string;
+    path: string;
+    operation_id: string | null;
+    summary: string | null;
+    /** YYYY-MM-DD of the change. */
+    at: string;
+}
+export interface OpenApiDiff {
+    object: 'openapi_diff';
+    since: string;
+    /** The API build the diff was computed on (`<date>+<sha>`). */
+    version: string;
+    added: OpenApiDiffItem[];
+    deprecated: OpenApiDiffItem[];
+    removed: OpenApiDiffItem[];
 }
 /** An advisory published for an Atlas browser SDK version. */
 export interface SdkAdvisory {
@@ -92,14 +163,104 @@ export interface SdkVersionSeen {
     /** The advisories that apply to this version. */
     advisories: SdkAdvisory[];
 }
+/** One row of the integration-health report. */
+export interface IntegrationHealthCheck {
+    /** A preflight code verbatim, or `<source>.<check>`. */
+    id: string;
+    /** false = failing; null = not known or not configured. */
+    ok: boolean | null;
+    detail: string;
+    fix: string | null;
+    docs: string | null;
+    /** For a check that calls your server: the hop that failed. */
+    hop?: 'dns' | 'tls' | 'http' | 'challenge' | 'auth';
+    status?: number;
+    elapsedMs?: number;
+    source: string;
+    severity?: 'error' | 'warning' | 'info';
+    subject?: Record<string, string>;
+    observedAt?: number | null;
+}
+export interface IntegrationHealthReport {
+    object: 'integration_health';
+    ok: boolean;
+    summary: {
+        failing: number;
+        passing: number;
+        unknown: number;
+    };
+    checks: IntegrationHealthCheck[];
+    /** ISO 8601. */
+    generatedAt: string;
+    /** The same instant, epoch ms. */
+    generated_at: number;
+}
+/** The embed manifest (embed-v1) for one instance: CSP sources per surface, storage, SRI and the merged policy. */
+export interface EmbedManifest {
+    schema: string;
+    product: string;
+    updated: string;
+    openapi?: string;
+    llms?: string;
+    status?: string;
+    docs?: string;
+    checkers?: {
+        userAgent: string;
+        userAgents?: string[];
+        egress: string[];
+    };
+    surfaces: Record<string, {
+        tenant?: boolean;
+        servedBy?: 'customer' | 'atlas';
+        csp?: Record<string, string[]>;
+        requires?: Record<string, string[]>;
+        trustedTypes?: string[];
+        consentCategory?: string;
+        storage?: Array<{
+            name: string;
+            type: string;
+            category: string;
+            lifetime: string;
+            purpose: {
+                en: string;
+            } & Record<string, string>;
+        }>;
+        sri?: Record<string, string>;
+        notes?: string[];
+    }>;
+    changes: Array<{
+        effective: string;
+        surface: string;
+        add: Record<string, string[]>;
+        remove: Record<string, string[]>;
+        note?: string;
+    }>;
+    tenant?: {
+        instance: string;
+        environment: string;
+        frontendApiHosts: string[];
+        shape: 'redirect' | 'panel' | 'button' | null;
+        origin: string | null;
+        originAllowed: boolean | null;
+        /** The merged sources for your pages, as one Content-Security-Policy value. */
+        policy: string;
+        sources: Record<string, string[]>;
+    };
+}
 export interface PreflightReport {
     object: 'preflight';
     /** True when there are no error-severity findings. */
     ok: boolean;
     /** When the check ran (epoch ms). */
     checked_at: number;
-    /** Ordered error, then warning, then info. */
+    /** Ordered error, then warning, then info; only those at or above `min_severity`. */
     findings: PreflightFinding[];
+    /** The `min_severity` the findings were filtered by (`info` = everything). */
+    min_severity?: 'error' | 'warning' | 'info';
+    /** Findings that do not apply to how the instance integrates (not counted in `ok`). */
+    suppressed?: PreflightSuppressedFinding[];
+    /** How each allowed https origin signs in. */
+    integrations?: PreflightOriginIntegration[];
     /** Atlas browser SDK versions seen in the last 7 days (newest first), with their advisories. */
     sdk_versions_seen?: SdkVersionSeen[];
 }
@@ -296,21 +457,258 @@ export interface SetForumulateIntegrationBody {
     /** The token `aud`. Default `forumulate:<org_id>`. */
     audience?: string | null;
 }
+/** Receiver health, in the webhook health vocabulary. */
+export interface IntegrationReceiverHealth {
+    url: string;
+    endpoint_id: string | null;
+    state: 'healthy' | 'failing' | 'disabled' | 'unknown';
+    failing_since: number | null;
+    disabled_at: number | null;
+    last_success_at: number | null;
+    last_failure: {
+        at: number;
+        status: number | null;
+        error: string | null;
+    } | null;
+    consecutive_failures: number;
+    success_rate_24h: number | null;
+    events?: string[];
+}
+/**
+ * An identity integration: any service that verifies a user with a JWT — a
+ * preset (`chatly`, `forumulate`, `cookiemunch`, `referalli`) or a custom one.
+ * `enabled: false, connected: false` when it was never connected.
+ */
+export interface Integration {
+    object: string;
+    id: string;
+    /** The same value as `id`. */
+    product: string;
+    preset: 'chatly' | 'forumulate' | 'cookiemunch' | 'referalli' | null;
+    name?: string;
+    role?: 'support_chat' | 'docs_community' | 'consent' | 'referrals' | 'other';
+    enabled: boolean;
+    connected: boolean;
+    audience?: string;
+    audience_format?: string | null;
+    principal_claim?: 'audience_hint' | null;
+    ext_claim?: 'external_id' | null;
+    ttl_seconds?: number;
+    issuer?: string;
+    jwks_url?: string;
+    token_schema?: string;
+    events_url?: string | null;
+    events_url_default?: boolean;
+    events?: string[];
+    backchannel_logout_url?: string | null;
+    backchannel_logout_url_default?: boolean;
+    /** Where the receiver comes from: set here, the first-party OAuth client's backchannel_logout_uri, or the preset's path. */
+    backchannel_logout_source?: 'integration' | 'oauth_client' | 'preset' | null;
+    /** With source `oauth_client`: that client's client_id (also the `aud` of its logout tokens). */
+    backchannel_logout_client_id?: string | null;
+    /** The first-party OAuth client the service signs users in with, as set (null = not set). */
+    oauth_client_id?: string | null;
+    verify_error_report_url?: string | null;
+    cmp?: {
+        script_url: string;
+        script_id: string | null;
+        site_id: string | null;
+        blocking_mode: string | null;
+        extra_origins: string[];
+        settings_preset: 'cookiemunch' | 'cookiebot' | 'onetrust' | 'custom' | null;
+    } | null;
+    atlas_id_users?: boolean;
+    atlas_id_issuer?: {
+        issuer: string;
+        jwks_url: string;
+    } | null;
+    enabled_at?: number | null;
+    updated_at?: number | null;
+    /** Present on a `?dry_run=true` answer. */
+    dry_run?: boolean;
+    health?: {
+        last_minted_at: number | null;
+        mints_24h: number;
+        verify_errors_24h: number;
+        last_verify_error: {
+            error: string;
+            audience: string | null;
+            at: number;
+            reported_at: number;
+        } | null;
+        events: IntegrationReceiverHealth | null;
+        backchannel_logout: IntegrationReceiverHealth | null;
+    };
+    /** Preset fields (chatly: channel/template/identity_verification; forumulate: org_id/spaces/reader_auth_provider; cookiemunch: site_id; referalli: org_id). */
+    [presetField: string]: unknown;
+}
+export interface SetIntegrationBody {
+    enabled?: boolean;
+    /** `<preset>:<id>` for a preset; any value for a custom integration. */
+    audience?: string;
+    /** Custom integrations: the display name (required), role and audience format. */
+    name?: string;
+    role?: 'support_chat' | 'docs_community' | 'consent' | 'referrals' | 'other';
+    audience_format?: string | null;
+    principal_claim?: 'audience_hint' | null;
+    ext_claim?: 'external_id' | null;
+    /** 10-120. Default 120. */
+    ttl_seconds?: number;
+    /** Omitted = the preset default; null = none. */
+    events_url?: string | null;
+    /**
+     * Omitted = the backchannel_logout_uri of the service's first-party OAuth
+     * client when it has one, else the preset default; null = none.
+     */
+    backchannel_logout_url?: string | null;
+    verify_error_report_url?: string | null;
+    /**
+     * The client_id of the first-party OAuth client the service signs users in
+     * with. Omitted = the first-party client tagged `metadata.product = <id>`;
+     * null = none.
+     */
+    oauth_client_id?: string | null;
+    cmp?: {
+        script_url: string;
+        script_id?: string | null;
+        site_id?: string | null;
+        blocking_mode?: string | null;
+        extra_origins?: string[];
+        settings_preset?: 'cookiemunch' | 'cookiebot' | 'onetrust' | 'custom' | null;
+    } | null;
+    atlas_id_users?: boolean;
+    /** chatly: the channel (same as `audience: 'chatly:<channel>'`). */
+    channel?: string;
+    /** forumulate: the org and spaces. */
+    org_id?: string;
+    spaces?: Array<string | {
+        id: string;
+        redeem_url?: string | null;
+    }>;
+}
+export interface IntegrationDelivery {
+    object: 'integration_delivery';
+    kind: 'event' | 'backchannel_logout';
+    integration: string;
+    id: string;
+    url: string;
+    event_id?: string;
+    event_type?: string | null;
+    sid?: string | null;
+    trace_id: string | null;
+    status: 'pending' | 'success' | 'failed';
+    attempt_number: number;
+    http_status: number | null;
+    error: string | null;
+    created_at: number;
+    [field: string]: unknown;
+}
+/** An integration token (the claims follow /schemas/integration-token-v1.json). */
+export interface IntegrationTokenResponse {
+    object: 'integration_token';
+    integration: string;
+    product: string;
+    jwt: string;
+    expires_in: number;
+    audience: string;
+    org_id?: string;
+    space_id?: string;
+    redeem_url?: string;
+    issuer?: string;
+    jwks_uri?: string;
+}
 export declare function instanceResource(request: RequestFn): {
     get(): Promise<Instance>;
     update(body: UpdateInstanceBody): Promise<InstanceUpdateResult>;
     /** Check your setup in one call: configuration the server can see is broken or risky. */
-    preflight(): Promise<PreflightReport>;
+    preflight(params?: PreflightParams): Promise<PreflightReport>;
+    /**
+     * The unknown body fields your writes sent over the last `days` (1-90,
+     * default 30): fix every row with an `ignored_count`, then turn
+     * `auth_config.strictRequestBodies` on.
+     */
+    unknownFieldsReport(params?: {
+        days?: number;
+    }): Promise<UnknownFieldsReport>;
+    /** What changed in the API since a date (YYYY-MM-DD): operations added, deprecated and removed. */
+    openapiDiff(params: {
+        since: string;
+        surface?: string;
+    }): Promise<OpenApiDiff>;
     /**
      * Move every URL that points at one origin to another (a domain move), across
      * the instance, its OAuth clients, webhooks, redirect URLs and Sign in with
      * Atlas apps. `dry_run: true` writes nothing.
      */
     moveOrigin(body: OriginMoveRequest): Promise<OriginMove>;
+    /**
+     * One report of everything that connects the instance to the outside world
+     * (setup checks, webhooks with the failing hop, back-channel logout,
+     * referrals, email, consent manager, SDK versions). `only` limits the
+     * sources; `probe: false` skips live reachability probes.
+     */
+    integrationHealth(params?: {
+        only?: string[];
+        probe?: boolean;
+    }): Promise<IntegrationHealthReport>;
+    /** The integration-health check sources this deployment reports. */
+    integrationHealthProviders(): Promise<{
+        object: "list";
+        data: {
+            object: "integration_health_provider";
+            source: string;
+            description: string;
+        }[];
+        has_more: false;
+    }>;
+    /**
+     * The embed manifest for an instance (public; no key needed): CSP sources per
+     * surface with its hosts filled in, and the merged policy in `tenant.policy`.
+     */
+    embed(params: {
+        instance: string;
+        origin?: string;
+        shape?: "redirect" | "panel" | "button";
+    }): Promise<EmbedManifest>;
     /** The instance's links to other platforms and their health. Read-only. */
     connections(): Promise<InstanceConnections>;
-    /** Built-in connections to other platforms. */
+    /**
+     * Identity integrations: presets and custom integrations (generic), plus the
+     * earlier per-product helpers (`chatly`, `forumulate`) on the same records.
+     */
     integrations: {
+        /** Every integration (the presets, connected or not, and every custom one) with its health. */
+        list(): Promise<{
+            object: "list";
+            data: Integration[];
+            has_more: boolean;
+        }>;
+        get(id: string): Promise<Integration>;
+        /** Connect or replace an integration. `{ dryRun: true }` validates and saves nothing. */
+        set(id: string, body: SetIntegrationBody, opts?: {
+            dryRun?: boolean;
+        }): Promise<Integration>;
+        remove(id: string): Promise<Integration>;
+        /** Event and back-channel logout deliveries, newest first; `trace` finds one operation. */
+        deliveries(id: string, query?: {
+            limit?: number;
+            trace?: string;
+            kind?: "event" | "backchannel_logout";
+        }): Promise<{
+            object: "list";
+            data: IntegrationDelivery[];
+            has_more: boolean;
+        }>;
+        /** Reveal the event receiver's signing secret (audited). */
+        revealEventsSecret(id: string): Promise<{
+            object: "integration_events_secret";
+            integration: string;
+            endpoint_id: string;
+            url: string;
+            secret: string;
+        }>;
+        /** An integration token for a Sign in with Atlas user (their Atlas ID access token). */
+        atlasIdToken(id: string, accessToken: string): Promise<IntegrationTokenResponse>;
         chatly: {
             get(): Promise<ChatlyIntegration>;
             set(body: SetChatlyIntegrationBody): Promise<ChatlyIntegration>;

package/dist/client/instance.js

@@ -10,8 +10,20 @@ function instanceResource(request) {
             return request({ method: 'PATCH', path: '/v1/instance', body });
         },
         /** Check your setup in one call: configuration the server can see is broken or risky. */
-        preflight() {
-            return request({ method: 'GET', path: '/v1/instance/preflight' });
+        preflight(params = {}) {
+            return request({ method: 'GET', path: '/v1/instance/preflight', query: { ...params } });
+        },
+        /**
+         * The unknown body fields your writes sent over the last `days` (1-90,
+         * default 30): fix every row with an `ignored_count`, then turn
+         * `auth_config.strictRequestBodies` on.
+         */
+        unknownFieldsReport(params = {}) {
+            return request({ method: 'GET', path: '/v1/instance/unknown_fields_report', query: { ...params } });
+        },
+        /** What changed in the API since a date (YYYY-MM-DD): operations added, deprecated and removed. */
+        openapiDiff(params) {
+            return request({ method: 'GET', path: '/v1/openapi/diff', query: { ...params } });
         },
         /**
          * Move every URL that points at one origin to another (a domain move), across
@@ -21,12 +33,74 @@ function instanceResource(request) {
         moveOrigin(body) {
             return request({ method: 'POST', path: '/v1/instance/move_origin', body });
         },
+        /**
+         * One report of everything that connects the instance to the outside world
+         * (setup checks, webhooks with the failing hop, back-channel logout,
+         * referrals, email, consent manager, SDK versions). `only` limits the
+         * sources; `probe: false` skips live reachability probes.
+         */
+        integrationHealth(params = {}) {
+            return request({
+                method: 'GET',
+                path: '/v1/integration-health',
+                query: { only: params.only?.join(','), probe: params.probe === undefined ? undefined : String(params.probe) },
+            });
+        },
+        /** The integration-health check sources this deployment reports. */
+        integrationHealthProviders() {
+            return request({ method: 'GET', path: '/v1/integration-health/providers' });
+        },
+        /**
+         * The embed manifest for an instance (public; no key needed): CSP sources per
+         * surface with its hosts filled in, and the merged policy in `tenant.policy`.
+         */
+        embed(params) {
+            return request({ method: 'GET', path: '/v1/embed', query: { ...params } });
+        },
         /** The instance's links to other platforms and their health. Read-only. */
         connections() {
             return request({ method: 'GET', path: '/v1/instance/connections' });
         },
-        /** Built-in connections to other platforms. */
+        /**
+         * Identity integrations: presets and custom integrations (generic), plus the
+         * earlier per-product helpers (`chatly`, `forumulate`) on the same records.
+         */
         integrations: {
+            /** Every integration (the presets, connected or not, and every custom one) with its health. */
+            list() {
+                return request({ method: 'GET', path: '/v1/instance/integrations' });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/instance/integrations/${encodeURIComponent(id)}` });
+            },
+            /** Connect or replace an integration. `{ dryRun: true }` validates and saves nothing. */
+            set(id, body, opts = {}) {
+                return request({
+                    method: 'PUT',
+                    path: `/v1/instance/integrations/${encodeURIComponent(id)}`,
+                    body,
+                    ...(opts.dryRun ? { query: { dry_run: 'true' } } : {}),
+                });
+            },
+            remove(id) {
+                return request({ method: 'DELETE', path: `/v1/instance/integrations/${encodeURIComponent(id)}` });
+            },
+            /** Event and back-channel logout deliveries, newest first; `trace` finds one operation. */
+            deliveries(id, query = {}) {
+                return request({ method: 'GET', path: `/v1/instance/integrations/${encodeURIComponent(id)}/deliveries`, query });
+            },
+            /** Reveal the event receiver's signing secret (audited). */
+            revealEventsSecret(id) {
+                return request({ method: 'POST', path: `/v1/instance/integrations/${encodeURIComponent(id)}/events_secret` });
+            },
+            /** An integration token for a Sign in with Atlas user (their Atlas ID access token). */
+            atlasIdToken(id, accessToken) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/instance/integrations/${encodeURIComponent(id)}/atlas_id_tokens`,
+                    body: { access_token: accessToken },
+                });
+            },
             chatly: {
                 get() {
                     return request({ method: 'GET', path: '/v1/instance/integrations/chatly' });

package/dist/client/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAwTA,4CAiEC;AAjED,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,+CAA+C;QAC/C,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAsmBA,4CA8IC;AA9ID,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS,CAAC,SAA0B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD;;;;WAIG;QACH,mBAAmB,CAAC,SAA4B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,mGAAmG;QACnG,WAAW,CAAC,MAA2C;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,iBAAiB,CAAC,SAA+C,EAAE;YACjE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QACD,oEAAoE;QACpE,0BAA0B;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,MAAsF;YAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,YAAY,EAAE;YACZ,+FAA+F;YAC/F,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,yFAAyF;YACzF,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,OAA6B,EAAE;gBACvE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC3D,IAAI;oBACJ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,2FAA2F;YAC3F,UAAU,CACR,EAAU,EACV,QAAmF,EAAE;gBAErF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,4DAA4D;YAC5D,kBAAkB,CAAC,EAAU;gBAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAChH,CAAC;YACD,wFAAwF;YACxF,YAAY,CAAC,EAAU,EAAE,WAAmB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,kBAAkB;oBAC3E,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/integrations.d.ts

@@ -0,0 +1,107 @@
+import { type RequestFn } from './request';
+/**
+ * The integration-facing routes, called with the instance secret key (an
+ * integrated service calls the same routes with the partner link the instance
+ * owner granted it): report a token a service refused, read the agent-sidebar
+ * card for a user and run its actions, and read an instance's public metadata.
+ */
+export type IntegrationVerifyErrorCode = 'aud_mismatch' | 'expired' | 'bad_signature' | 'unknown_kid' | 'session_revoked' | 'invalid_claims' | 'other';
+export interface ReportVerifyErrorBody {
+    /** The integration id the token was minted for (a preset or a custom id). */
+    integration: string;
+    error: IntegrationVerifyErrorCode;
+    audience?: string;
+    /** Epoch ms (or seconds) or an ISO time. Default now. */
+    at?: number | string;
+    kid?: string;
+    sid?: string;
+    detail?: string;
+}
+export interface IntegrationVerifyError {
+    object: 'integration_verify_error';
+    id: string;
+    integration: string;
+    audience: string | null;
+    error: IntegrationVerifyErrorCode;
+    at: number;
+    trace_id: string | null;
+    created_at: number;
+}
+export interface IntegrationCard {
+    object: 'integration_card';
+    integration: string;
+    user: {
+        id: string;
+        email: string | null;
+        email_verified: boolean;
+        name: string | null;
+        external_id: string | null;
+        banned: boolean;
+        mfa_enabled: boolean;
+        last_sign_in_at: number | null;
+        created_at: number;
+        organizations: Array<{
+            id: string;
+            name: string;
+            role: string;
+        }>;
+    };
+    sessions_active: number;
+    actions: Array<{
+        id: 'revoke_sessions';
+        label: string;
+        confirm: boolean;
+        available: boolean;
+        requires_scope: string;
+    }>;
+}
+export interface InstanceMetadata {
+    object: 'instance_metadata';
+    id: string;
+    issuer: string;
+    jwks_uri: string;
+    token_schema: string;
+    integrations: Record<string, {
+        audience: string;
+        preset: string | null;
+        ttl_seconds: number;
+        additional_issuers?: string[];
+    }>;
+    trusted_issuers: Array<{
+        issuer: string;
+        jwks_uri: string;
+        kind: 'instance' | 'atlas_id';
+    }>;
+    previous_issuers: Array<{
+        issuer: string;
+        jwks_uri: string;
+        replaced_at: number;
+    }>;
+}
+export declare function integrationsResource(request: RequestFn): {
+    /** `POST /v1/integrations/verify_errors` — record a token an integrated service refused. */
+    reportVerifyError(body: ReportVerifyErrorBody): Promise<IntegrationVerifyError>;
+    /** `GET /v1/integrations/:integration/card` — the agent-sidebar card for a user (by token sub). */
+    card(integration: string, query: {
+        sub: string;
+        iss?: string;
+    }): Promise<IntegrationCard>;
+    /** `POST /v1/integrations/:integration/card/actions/revoke_sessions` — sign the user out everywhere (audited with the agent). */
+    revokeSessions(integration: string, body: {
+        sub: string;
+        iss?: string;
+        agent?: {
+            id?: string;
+            name?: string;
+            email?: string;
+        };
+    }): Promise<{
+        object: "integration_card_action";
+        integration: string;
+        action: "revoke_sessions";
+        ok: boolean;
+        sessions_revoked: number;
+    }>;
+    /** `GET /v1/public/instances/:id` — the public metadata of an instance (no key needed). */
+    instanceMetadata(instanceId: string): Promise<InstanceMetadata>;
+};