@atlasauth/backend 0.2.0 → 0.4.0

package/dist/client/api-keys.d.ts

@@ -1,5 +1,5 @@
 import { type RequestFn } from './request';
-import type { ListPage } from './types';
+import type { CursorPage, ListPage } from './types';
 export type ApiKeySubjectType = 'user' | 'organization';
 /**
  * An end-user API key — Clerk `api_keys` parity. A tenant mints these for ITS OWN
@@ -56,6 +56,45 @@ export type ApiKeyVerification = {
     claims: Record<string, unknown>;
     last_used_at: number | null;
 };
+/**
+ * §P1-8 a short-lived, offline-verifiable access JWT minted from a long-lived
+ * `ak_` key (`POST /v1/api_keys/token`). Signed with the instance's RS256 key, so
+ * any resource server verifies it against the public JWKS without a round trip.
+ */
+export interface ApiKeyToken {
+    object: 'api_key_token';
+    token: string;
+    token_type: 'Bearer';
+    jti: string;
+    key_id: string;
+    subject_type: ApiKeySubjectType;
+    subject_id: string;
+    scopes: string[];
+    constraints: Record<string, unknown>;
+    expires_in: number;
+    expires_at: number;
+    /** Which JWKS/issuer a verifier should check, so it needn't parse the JWT first. */
+    issuer: string;
+}
+export interface MintApiKeyTokenBody {
+    /** The long-lived `ak_` secret to mint from. */
+    secret: string;
+    /** Requested lifetime; clamped to the key's ceiling, its expiry, and the global cap. */
+    ttl_seconds?: number;
+    audience?: string | string[];
+}
+/** One entry in the revocation feed: an id and when it was revoked. */
+export interface RevokedApiKeyRef {
+    object: 'api_key';
+    id: string;
+    revoked_at: number | null;
+}
+export interface ListRevokedApiKeysQuery {
+    /** An ISO-8601 instant, epoch-millis, or a `next_cursor` from a previous page. */
+    since?: string;
+    /** Page size (server clamps to its own maximum). */
+    limit?: number;
+}
 export declare function apiKeysResource(request: RequestFn): {
     /** Optionally narrowed to one subject. */
     list(query?: {
@@ -74,4 +113,14 @@ export declare function apiKeysResource(request: RequestFn): {
         id: string;
         revoked: true;
     }>;
+    /**
+     * §P1-8 mint a short-lived delegated token from an `ak_` key. Rate-limited —
+     * presenting the secret is the same online credential surface as verify.
+     */
+    mintToken(body: MintApiKeyTokenBody): Promise<ApiKeyToken>;
+    /**
+     * §P1-8 the revocation feed a resource server polls to deny-list revoked keys
+     * while their delegated tokens are still live. Keyset-paginated via `since`.
+     */
+    listRevoked(query?: ListRevokedApiKeysQuery): Promise<CursorPage<RevokedApiKeyRef>>;
 };

package/dist/client/api-keys.js

@@ -26,6 +26,20 @@ function apiKeysResource(request) {
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/api_keys/${(0, request_1.enc)(id)}` });
         },
+        /**
+         * §P1-8 mint a short-lived delegated token from an `ak_` key. Rate-limited —
+         * presenting the secret is the same online credential surface as verify.
+         */
+        mintToken(body) {
+            return request({ method: 'POST', path: '/v1/api_keys/token', body });
+        },
+        /**
+         * §P1-8 the revocation feed a resource server polls to deny-list revoked keys
+         * while their delegated tokens are still live. Keyset-paginated via `since`.
+         */
+        listRevoked(query = {}) {
+            return request({ method: 'GET', path: '/v1/api_keys/revoked', query: { ...query } });
+        },
     };
 }
 //# sourceMappingURL=api-keys.js.map

package/dist/client/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/client/api-keys.ts"],"names":[],"mappings":";;AAgEA,0CA4BC;AA5FD,uCAAgD;AAgEhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,KAGJ;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qDAAqD;QACrD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,iFAAiF;QACjF,MAAM,CAAC,MAAc;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/client/api-keys.ts"],"names":[],"mappings":";;AA2GA,0CA0CC;AArJD,uCAAgD;AA2GhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,KAGJ;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qDAAqD;QACrD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,iFAAiF;QACjF,MAAM,CAAC,MAAc;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,IAAyB;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD;;;WAGG;QACH,WAAW,CAAC,QAAiC,EAAE;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/index.d.ts

@@ -390,6 +390,33 @@ export declare function createAtlasClient(config: AtlasClientConfig): {
             id: string;
             revoked: true;
         }>;
+        mintToken(body: import("./api-keys").MintApiKeyTokenBody): Promise<import("./api-keys").ApiKeyToken>;
+        listRevoked(query?: import("./api-keys").ListRevokedApiKeysQuery): Promise<import("./types").CursorPage<import("./api-keys").RevokedApiKeyRef>>;
+    };
+    machines: {
+        list(query?: import("./machines").ListMachinesQuery): Promise<import("./machines").MachineListPage>;
+        create(body: import("./machines").CreateMachineBody, idempotencyKey?: string): Promise<import("./machines").MachineWithSecret>;
+        get(id: string): Promise<import("./machines").Machine>;
+        rename(id: string, name: string): Promise<import("./machines").Machine>;
+        patchMetadata(id: string, metadata: import("./machines").MachineMetadata): Promise<import("./machines").Machine>;
+        approve(id: string): Promise<import("./machines").Machine>;
+        revoke(id: string): Promise<import("./machines").Machine>;
+        rotateSecret(id: string): Promise<import("./machines").MachineWithSecret>;
+        rotateKey(id: string, publicKeyPem: string): Promise<import("./machines").Machine>;
+        delete(id: string): Promise<{
+            object: "machine";
+            id: string;
+            deleted: true;
+        }>;
+        organizationMemberships(id: string): Promise<import("./machines").MachineOrganizationMembershipPage>;
+        createEnrolmentToken(body?: import("./machines").CreateEnrolmentTokenBody, idempotencyKey?: string): Promise<import("./machines").MachineEnrolmentTokenWithSecret>;
+        listEnrolmentTokens(): Promise<import("./types").ListPage<import("./machines").MachineEnrolmentToken>>;
+        deleteEnrolmentToken(id: string): Promise<{
+            object: "machine_enrolment_token";
+            id: string;
+            deleted: true;
+        }>;
+        verifyM2mToken(token: string): Promise<import("./machines").M2mTokenVerification>;
     };
     oauthProviders: {
         list(): Promise<import("./types").ListPage<import("./oauth-providers").OAuthProvider>>;
@@ -654,8 +681,18 @@ export declare function createAtlasClient(config: AtlasClientConfig): {
     };
     messaging: {
         get(): Promise<import("./messaging").MessagingProviders>;
-        setEmail(body: import("./messaging").MessagingProviderInput): Promise<import("./messaging").MessagingProvider>;
-        setSms(body: import("./messaging").MessagingProviderInput): Promise<import("./messaging").MessagingProvider>;
+        setEmail: {
+            (body: import("./messaging").EmailProviderInput): Promise<import("./messaging").EmailProvider>;
+            <T extends string>(body: Omit<import("./messaging").MessagingProviderInput, "transport"> & {
+                transport: T;
+            } & (string extends T ? unknown : never)): Promise<import("./messaging").MessagingProvider>;
+        };
+        setSms: {
+            (body: import("./messaging").SmsProviderInput): Promise<import("./messaging").SmsProvider>;
+            <T extends string>(body: Omit<import("./messaging").MessagingProviderInput, "transport"> & {
+                transport: T;
+            } & (string extends T ? unknown : never)): Promise<import("./messaging").MessagingProvider>;
+        };
         deleteChannel(channel: "email" | "sms"): Promise<import("./messaging").DeletedMessagingProvider>;
         test(channel: "email" | "sms", body: {
             to: string;
@@ -773,6 +810,7 @@ export * from './sign-in-tokens';
 export * from './audit-logs';
 export * from './jwt-templates';
 export * from './api-keys';
+export * from './machines';
 export * from './oauth-providers';
 export * from './sso-onboarding';
 export * from './scim-provisioning';

package/dist/client/index.js

@@ -36,6 +36,7 @@ const sign_in_tokens_1 = require("./sign-in-tokens");
 const audit_logs_1 = require("./audit-logs");
 const jwt_templates_1 = require("./jwt-templates");
 const api_keys_1 = require("./api-keys");
+const machines_1 = require("./machines");
 const oauth_providers_1 = require("./oauth-providers");
 const sso_onboarding_1 = require("./sso-onboarding");
 const scim_provisioning_1 = require("./scim-provisioning");
@@ -94,6 +95,8 @@ function createAtlasClient(config) {
         auditLogs: (0, audit_logs_1.auditLogsResource)(request),
         jwtTemplates: (0, jwt_templates_1.jwtTemplatesResource)(request),
         apiKeys: (0, api_keys_1.apiKeysResource)(request),
+        // §9.3 / §P1-7 named machine identities + device registry + enrolment tokens.
+        machines: (0, machines_1.machinesResource)(request),
         oauthProviders: (0, oauth_providers_1.oauthProvidersResource)(request),
         ssoOnboarding: (0, sso_onboarding_1.ssoOnboardingResource)(request),
         scimProvisioning: (0, scim_provisioning_1.scimProvisioningResource)(request),
@@ -151,6 +154,7 @@ __exportStar(require("./sign-in-tokens"), exports);
 __exportStar(require("./audit-logs"), exports);
 __exportStar(require("./jwt-templates"), exports);
 __exportStar(require("./api-keys"), exports);
+__exportStar(require("./machines"), exports);
 __exportStar(require("./oauth-providers"), exports);
 __exportStar(require("./sso-onboarding"), exports);
 __exportStar(require("./scim-provisioning"), exports);

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAuDA,8CAqDC;AA5GD,uCAAkE;AAClE,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,qCAA0C;AAC1C,uCAA4C;AAE5C;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IAEtC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;KAClC,CAAC;AACJ,CAAC;AAMD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,2CAAyB;AACzB,4CAA0B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAwDA,8CAuDC;AA/GD,uCAAkE;AAClE,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,qCAA0C;AAC1C,uCAA4C;AAE5C;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IAEtC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;KAClC,CAAC;AACJ,CAAC;AAMD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,2CAAyB;AACzB,4CAA0B"}

package/dist/client/machines.d.ts

@@ -0,0 +1,183 @@
+import { type RequestFn } from './request';
+import type { CursorParams, ListPage, Metadata } from './types';
+/**
+ * §9.3 / §P1-7 MACHINE identities + the device registry.
+ *
+ * A machine is a first-class non-human principal with its own secret (`mk_…`),
+ * distinct from an instance API key. §P1-7 layers a DEVICE half on top: a machine
+ * can carry a registered public KEY, a lifecycle `status`, device `metadata`, and
+ * optional org/owner ownership. This namespace is the `sk_`-authenticated
+ * MANAGEMENT surface (list/filter, create, rename, metadata, approve, revoke, key
+ * rotation, delete) plus enrolment-token management and M2M-token verification.
+ *
+ * The device self-serve half (`/v1/machines/enroll`, `/challenge`, `/token`) is a
+ * PUBLIC, credential-presented surface a bootstrapping device calls with no `sk_`,
+ * so it is deliberately NOT part of this secret-key client.
+ */
+/** A machine's lifecycle state. `pending` awaits approval; `revoked` is terminal. */
+export type MachineStatus = 'pending' | 'active' | 'revoked';
+/** Device metadata bag (hostname/os/app_version/last_seen_at/…). */
+export type MachineMetadata = Record<string, unknown>;
+/**
+ * A named machine identity. `secret_hash` is never present on any machine surface
+ * — only a hash is stored, so the `mk_` secret is shown exactly once at
+ * create/rotate (see {@link MachineWithSecret}).
+ */
+export interface Machine {
+    object: 'machine';
+    id: string;
+    name: string;
+    organization_id: string | null;
+    status: MachineStatus;
+    /** JWK thumbprint of the registered device key, or null for a secret-only machine. */
+    public_key_jkt: string | null;
+    metadata: MachineMetadata;
+    enrolled_at: number | null;
+    created_at: number;
+    updated_at: number;
+}
+/** The create / rotate_secret response: the machine plus its `mk_` secret, shown once. */
+export interface MachineWithSecret extends Machine {
+    secret: string;
+}
+export interface CreateMachineBody {
+    name: string;
+    /** Round-7: the user who owns this machine identity. */
+    owner_user_id?: string;
+    /** Round-7: bind the machine to an organization at creation. */
+    organization_id?: string;
+    /** Round-7: free-form data bag stored on the machine. */
+    data?: Metadata;
+    /** Device metadata (hostname/os/app_version/…). */
+    metadata?: MachineMetadata;
+}
+export interface ListMachinesQuery extends CursorParams {
+    status?: MachineStatus;
+    /** Filter by the device's reported hostname. */
+    hostname?: string;
+    /** Round-7: only machines owned by this user. */
+    owner_user_id?: string;
+    /** Round-7: only machines belonging to this organization. */
+    organization_id?: string;
+    /** Round-7: a JSON-encoded metadata match filter. */
+    metadata?: string;
+}
+/**
+ * The machine list page. The envelope is `{ object: 'list', data }`; §P1-7's
+ * cursor fields (`has_more`/`next_cursor`) are present on the round-7 surface and
+ * optional here so the type is honest against both.
+ */
+export interface MachineListPage {
+    object: 'list';
+    data: Machine[];
+    has_more?: boolean;
+    next_cursor?: string | null;
+}
+/**
+ * A machine's org membership, membership-shaped like
+ * `GET /v1/users/:id/organization_memberships`. A machine belongs to at most one
+ * org today, so the list holds 0 or 1 entries; `role` is always null (a machine
+ * holds no org role).
+ */
+export interface MachineOrganizationMembership {
+    object: 'organization_membership';
+    organization_id: string;
+    organization_slug: string;
+    role: null;
+    plan: string | null;
+    joined_at: number;
+}
+export interface MachineOrganizationMembershipPage {
+    object: 'list';
+    data: MachineOrganizationMembership[];
+    has_more: boolean;
+    next_cursor: string | null;
+}
+/** An enrolment token — a short-lived credential a device presents to `/enroll`. */
+export interface MachineEnrolmentToken {
+    object: 'machine_enrolment_token';
+    id: string;
+    organization_id: string | null;
+    max_uses: number;
+    uses: number;
+    expires_at: number;
+    requires_approval: boolean;
+    created_at: number;
+}
+/** The create response: the enrolment token plus its `met_` secret, shown once. */
+export interface MachineEnrolmentTokenWithSecret extends MachineEnrolmentToken {
+    token: string;
+}
+export interface CreateEnrolmentTokenBody {
+    /** Bind machines enrolled with this token to an organization. */
+    organization_id?: string;
+    /** Round-7: the user who will own machines enrolled with this token. */
+    owner_user_id?: string;
+    /** Round-7: free-form data copied onto each enrolled machine. */
+    data?: Metadata;
+    /** Round-7: restrict the token to a single enrolment session. */
+    single_session?: boolean;
+    /** Round-7: the maximum number of machines that may enrol with this token. */
+    max_machines?: number;
+    /** How many times the token may be redeemed (defaults to 1 server-side). */
+    max_uses?: number;
+    /** Token lifetime; defaults to 3600s, capped at one year. */
+    expires_in_seconds?: number;
+    /** When true, enrolled machines start `pending` and must be approved. */
+    requires_approval?: boolean;
+}
+/**
+ * The verify verdict for an M2M credential (Clerk `verifyM2MToken`): resolve a
+ * presented machine secret to its machine. An unknown, rotated, or revoked secret
+ * all resolve to the SAME `{ valid: false }`, so a caller cannot probe which
+ * machines exist.
+ */
+export type M2mTokenVerification = {
+    object: 'm2m_verification';
+    valid: false;
+} | {
+    object: 'm2m_verification';
+    valid: true;
+    machine_id: string;
+    name: string;
+};
+export declare function machinesResource(request: RequestFn): {
+    /** List + filter machines (§P1-7 device-registry query). */
+    list(query?: ListMachinesQuery): Promise<MachineListPage>;
+    /** Create a machine. The `mk_` secret is returned once, here. */
+    create(body: CreateMachineBody, idempotencyKey?: string): Promise<MachineWithSecret>;
+    get(id: string): Promise<Machine>;
+    /** Rename a machine (`PATCH /v1/machines/:id`). */
+    rename(id: string, name: string): Promise<Machine>;
+    /** Merge device metadata (`PATCH /v1/machines/:id/metadata`). */
+    patchMetadata(id: string, metadata: MachineMetadata): Promise<Machine>;
+    /** Approve a `pending` device (→ `active`). */
+    approve(id: string): Promise<Machine>;
+    /** Revoke a machine (→ `revoked`). The record is kept; its key stops minting at once. */
+    revoke(id: string): Promise<Machine>;
+    /** Rotate the `mk_` secret. The new secret is shown once; the old stops working. */
+    rotateSecret(id: string): Promise<MachineWithSecret>;
+    /** Rotate the registered device keypair by supplying the new public key PEM. */
+    rotateKey(id: string, publicKeyPem: string): Promise<Machine>;
+    /** Delete a machine outright (distinct from {@link revoke}, which keeps the record). */
+    delete(id: string): Promise<{
+        object: "machine";
+        id: string;
+        deleted: true;
+    }>;
+    /** The machine's org memberships (0 or 1 entry). */
+    organizationMemberships(id: string): Promise<MachineOrganizationMembershipPage>;
+    /** Mint an enrolment token. The `met_` secret is returned once, here. */
+    createEnrolmentToken(body?: CreateEnrolmentTokenBody, idempotencyKey?: string): Promise<MachineEnrolmentTokenWithSecret>;
+    listEnrolmentTokens(): Promise<ListPage<MachineEnrolmentToken>>;
+    deleteEnrolmentToken(id: string): Promise<{
+        object: "machine_enrolment_token";
+        id: string;
+        deleted: true;
+    }>;
+    /**
+     * Verify a presented M2M credential (`POST /v1/m2m_tokens/verify`). Resolve a
+     * machine secret to its machine; every negative resolves to `{ valid: false }`.
+     */
+    verifyM2mToken(token: string): Promise<M2mTokenVerification>;
+};

package/dist/client/machines.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.machinesResource = machinesResource;
+const request_1 = require("./request");
+function machinesResource(request) {
+    return {
+        /** List + filter machines (§P1-7 device-registry query). */
+        list(query = {}) {
+            return request({ method: 'GET', path: '/v1/machines', query: { ...query } });
+        },
+        /** Create a machine. The `mk_` secret is returned once, here. */
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/machines', body, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/machines/${(0, request_1.enc)(id)}` });
+        },
+        /** Rename a machine (`PATCH /v1/machines/:id`). */
+        rename(id, name) {
+            return request({ method: 'PATCH', path: `/v1/machines/${(0, request_1.enc)(id)}`, body: { name } });
+        },
+        /** Merge device metadata (`PATCH /v1/machines/:id/metadata`). */
+        patchMetadata(id, metadata) {
+            return request({ method: 'PATCH', path: `/v1/machines/${(0, request_1.enc)(id)}/metadata`, body: { metadata } });
+        },
+        /** Approve a `pending` device (→ `active`). */
+        approve(id) {
+            return request({ method: 'POST', path: `/v1/machines/${(0, request_1.enc)(id)}/approve` });
+        },
+        /** Revoke a machine (→ `revoked`). The record is kept; its key stops minting at once. */
+        revoke(id) {
+            return request({ method: 'POST', path: `/v1/machines/${(0, request_1.enc)(id)}/revoke` });
+        },
+        /** Rotate the `mk_` secret. The new secret is shown once; the old stops working. */
+        rotateSecret(id) {
+            return request({ method: 'POST', path: `/v1/machines/${(0, request_1.enc)(id)}/rotate_secret` });
+        },
+        /** Rotate the registered device keypair by supplying the new public key PEM. */
+        rotateKey(id, publicKeyPem) {
+            return request({
+                method: 'POST',
+                path: `/v1/machines/${(0, request_1.enc)(id)}/rotate_key`,
+                body: { public_key_pem: publicKeyPem },
+            });
+        },
+        /** Delete a machine outright (distinct from {@link revoke}, which keeps the record). */
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/machines/${(0, request_1.enc)(id)}` });
+        },
+        /** The machine's org memberships (0 or 1 entry). */
+        organizationMemberships(id) {
+            return request({ method: 'GET', path: `/v1/machines/${(0, request_1.enc)(id)}/organization_memberships` });
+        },
+        /** Mint an enrolment token. The `met_` secret is returned once, here. */
+        createEnrolmentToken(body = {}, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/machine_enrolment_tokens', body, idempotencyKey });
+        },
+        listEnrolmentTokens() {
+            return request({ method: 'GET', path: '/v1/machine_enrolment_tokens' });
+        },
+        deleteEnrolmentToken(id) {
+            return request({ method: 'DELETE', path: `/v1/machine_enrolment_tokens/${(0, request_1.enc)(id)}` });
+        },
+        /**
+         * Verify a presented M2M credential (`POST /v1/m2m_tokens/verify`). Resolve a
+         * machine secret to its machine; every negative resolves to `{ valid: false }`.
+         */
+        verifyM2mToken(token) {
+            return request({ method: 'POST', path: '/v1/m2m_tokens/verify', body: { token } });
+        },
+    };
+}
+//# sourceMappingURL=machines.js.map

package/dist/client/machines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machines.js","sourceRoot":"","sources":["../../src/client/machines.ts"],"names":[],"mappings":";;AAwJA,4CA0EC;AAlOD,uCAAgD;AAwJhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,4DAA4D;QAC5D,IAAI,CAAC,QAA2B,EAAE;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,iEAAiE;QACjE,MAAM,CAAC,IAAuB,EAAE,cAAuB;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,mDAAmD;QACnD,MAAM,CAAC,EAAU,EAAE,IAAY;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,iEAAiE;QACjE,aAAa,CAAC,EAAU,EAAE,QAAyB;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,+CAA+C;QAC/C,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,yFAAyF;QACzF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,oFAAoF;QACpF,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,gFAAgF;QAChF,SAAS,CAAC,EAAU,EAAE,YAAoB;YACxC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBAC1C,IAAI,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aACvC,CAAC,CAAC;QACL,CAAC;QACD,wFAAwF;QACxF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,oDAAoD;QACpD,uBAAuB,CAAC,EAAU;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,2BAA2B,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,yEAAyE;QACzE,oBAAoB,CAClB,OAAiC,EAAE,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,oBAAoB,CAClB,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QAED;;;WAGG;QACH,cAAc,CAAC,KAAa;YAC1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/messaging.d.ts

@@ -1,30 +1,235 @@
 import { type RequestFn } from './request';
 /**
- * §BYOK messaging provider config — wire the tenant's own email/SMS provider
- * (Resend/SES/SMTP/Brevo/Mailgun, Twilio) over the secret-key BAPI.
+ * Messaging providers — wire your own email or SMS provider (Resend, SES, SMTP,
+ * Brevo, Mailgun; Twilio, Vonage, MessageBird, Plivo, Telnyx, Sinch, Infobip,
+ * ClickSend, Bandwidth, AWS SNS) over the secret-key Backend API.
+ *
+ * Each transport accepts an exact set of `config` keys; the API refuses an
+ * unknown key with a 422 naming `config.<key>`. These types mirror that schema,
+ * so a typo or another provider's key name fails to compile.
  *
  * A provider SECRET is WRITE-ONLY: it goes in through `config` and is never
  * read back — a response reports only WHICH secret keys are set (`secrets_set`).
- * Omit a secret on an edit to keep the stored one (so a from-address change need
- * not re-enter the API key).
+ *
+ * Required keys: every key marked "Required on first setup" must be sent the
+ * first time you configure a transport (or when you switch the channel to a
+ * different transport). When you update the SAME transport, the stored config is
+ * kept: omit a key — or send it as `''` — and its stored value (including a
+ * stored secret) stays. So a from-address change need not re-enter the API key.
  */
-export interface MessagingProvider {
-    object: 'messaging_provider';
-    channel: 'email' | 'sms';
-    transport: string;
-    from_address: string | null;
-    status: string;
-    /** Non-secret config only — secret values are stripped before serialising. */
-    config: Record<string, unknown>;
-    /** Which secret keys are set for this transport, never their values. */
-    secrets_set: Record<string, boolean>;
-    updated_at: number;
+/** Email transports accepted by `PUT /v1/messaging_providers/email`. */
+export type EmailTransport = 'resend' | 'ses' | 'smtp' | 'brevo' | 'mailgun';
+/** SMS transports accepted by `PUT /v1/messaging_providers/sms`. */
+export type SmsTransport = 'twilio' | 'vonage' | 'messagebird' | 'plivo' | 'telnyx' | 'sinch' | 'infobip' | 'clicksend' | 'bandwidth' | 'aws_sns';
+export type MessagingTransport = EmailTransport | SmsTransport;
+/** Sender number or ID for an SMS provider. `from_address` on the request takes precedence. */
+interface SmsFrom {
+    /** Sender number or ID for this provider. Optional; `from_address` on the request takes precedence. */
+    from?: string;
 }
-export interface MessagingProviders {
-    object: 'messaging_providers';
-    email: MessagingProvider | null;
-    sms: MessagingProvider | null;
+/** Resend. */
+export interface ResendConfig {
+    /** Resend API key (`re_…`). Required on first setup. Write-only: never returned. */
+    api_key: string;
+}
+/** Brevo. */
+export interface BrevoConfig {
+    /** Brevo API key (`xkeysib-…`). Required on first setup. Write-only: never returned. */
+    api_key: string;
+}
+/** Mailgun. */
+export interface MailgunConfig {
+    /** Mailgun private API key. Required on first setup. Write-only: never returned. */
+    api_key: string;
+    /** Your Mailgun sending domain, e.g. `mg.example.com`. Required on first setup. */
+    domain: string;
+    /** Mailgun region. Default `us`. */
+    region?: 'us' | 'eu';
+}
+/** Amazon SES. */
+export interface SesConfig {
+    /** AWS region, e.g. `us-east-1`. Required on first setup. */
+    region: string;
+    /** IAM access key ID. Required on first setup. Write-only: never returned. */
+    access_key_id: string;
+    /** IAM secret access key. Required on first setup. Write-only: never returned. */
+    secret_access_key: string;
+    /** STS session token, only for temporary credentials. Write-only: never returned. */
+    session_token?: string;
+}
+/** Any SMTP server. */
+export interface SmtpConfig {
+    /** SMTP server hostname, e.g. `smtp.example.com`. Required on first setup. */
+    host: string;
+    /** SMTP port (1-65535). Default 587. */
+    port?: number;
+    /** Use implicit TLS. Default: `true` on port 465, otherwise STARTTLS. */
+    secure?: boolean;
+    /** SMTP username, if the server requires authentication. */
+    username?: string;
+    /** SMTP password or app password. Write-only: never returned. */
+    password?: string;
+}
+/** Twilio. */
+export interface TwilioConfig extends SmsFrom {
+    /** Twilio Account SID (`AC…`). Required on first setup. */
+    account_sid: string;
+    /** Twilio auth token. Required on first setup. Write-only: never returned. */
+    auth_token: string;
+    /** WhatsApp-enabled sender number, for the WhatsApp channel. */
+    whatsapp_from?: string;
+    /** Voice-capable number, for the voice channel. */
+    voice_from?: string;
+}
+/** Vonage. */
+export interface VonageConfig extends SmsFrom {
+    /** Vonage API key. Required on first setup. */
+    api_key: string;
+    /** Vonage API secret. Required on first setup. Write-only: never returned. */
+    api_secret: string;
+}
+/** MessageBird (Bird). */
+export interface MessagebirdConfig extends SmsFrom {
+    /** MessageBird (Bird) access key. Required on first setup. Write-only: never returned. */
+    access_key: string;
+}
+/** Plivo. */
+export interface PlivoConfig extends SmsFrom {
+    /** Plivo Auth ID. Required on first setup. */
+    auth_id: string;
+    /** Plivo auth token. Required on first setup. Write-only: never returned. */
+    auth_token: string;
+}
+/** Telnyx. */
+export interface TelnyxConfig extends SmsFrom {
+    /** Telnyx API key. Required on first setup. Write-only: never returned. */
+    api_key: string;
+}
+/** Sinch. */
+export interface SinchConfig extends SmsFrom {
+    /** Sinch service plan ID. Required on first setup. */
+    service_plan_id: string;
+    /** Sinch API token. Required on first setup. Write-only: never returned. */
+    api_token: string;
+    /** Sinch API region, a short lowercase code such as `us` or `eu`. Default `us`. */
+    region?: string;
+}
+/** Infobip. */
+export interface InfobipConfig extends SmsFrom {
+    /** Your Infobip base URL, e.g. `https://xxxxx.api.infobip.com`. Must be https. Required on first setup. */
+    base_url: string;
+    /** Infobip API key. Required on first setup. Write-only: never returned. */
+    api_key: string;
+}
+/** ClickSend. */
+export interface ClicksendConfig extends SmsFrom {
+    /** ClickSend username (your login email). Required on first setup. */
+    username: string;
+    /** ClickSend API key. Required on first setup. Write-only: never returned. */
+    api_key: string;
+}
+/** Bandwidth. */
+export interface BandwidthConfig extends SmsFrom {
+    /** Bandwidth account ID. Required on first setup. */
+    account_id: string;
+    /** Bandwidth messaging application ID. Required on first setup. */
+    application_id: string;
+    /** Bandwidth API username. Required on first setup. */
+    username: string;
+    /** Bandwidth API password. Required on first setup. Write-only: never returned. */
+    password: string;
+}
+/** Amazon SNS. */
+export interface AwsSnsConfig extends SmsFrom {
+    /** AWS region, e.g. `us-east-1`. Required on first setup. */
+    region: string;
+    /** IAM access key ID. Required on first setup. */
+    access_key_id: string;
+    /** IAM secret access key. Required on first setup. Write-only: never returned. */
+    secret_access_key: string;
+    /** STS session token, only for temporary credentials. Write-only: never returned. */
+    session_token?: string;
+}
+/** The `config` shape for each transport, keyed by transport. */
+export interface MessagingTransportConfigs {
+    resend: ResendConfig;
+    ses: SesConfig;
+    smtp: SmtpConfig;
+    brevo: BrevoConfig;
+    mailgun: MailgunConfig;
+    twilio: TwilioConfig;
+    vonage: VonageConfig;
+    messagebird: MessagebirdConfig;
+    plivo: PlivoConfig;
+    telnyx: TelnyxConfig;
+    sinch: SinchConfig;
+    infobip: InfobipConfig;
+    clicksend: ClicksendConfig;
+    bandwidth: BandwidthConfig;
+    aws_sns: AwsSnsConfig;
 }
+/** The write-only (secret) keys of each transport — never present in a response. */
+export interface MessagingSecretKeys {
+    resend: 'api_key';
+    ses: 'access_key_id' | 'secret_access_key' | 'session_token';
+    smtp: 'password';
+    brevo: 'api_key';
+    mailgun: 'api_key';
+    twilio: 'auth_token';
+    vonage: 'api_secret';
+    messagebird: 'access_key';
+    plivo: 'auth_token';
+    telnyx: 'api_key';
+    sinch: 'api_token';
+    infobip: 'api_key';
+    clicksend: 'api_key';
+    bandwidth: 'password';
+    aws_sns: 'secret_access_key' | 'session_token';
+}
+interface ProviderBodyBase<T extends MessagingTransport> {
+    transport: T;
+    /**
+     * Email: the From address, e.g. `"Acme <no-reply@acme.com>"` — a sender your
+     * provider accepts. SMS: the sender number in E.164 format, e.g. `+15551234567`.
+     */
+    from_address?: string;
+}
+/**
+ * First setup of transport `T` (or a switch to it): `config` carries every
+ * required key.
+ */
+export interface MessagingProviderSetup<T extends MessagingTransport> extends ProviderBodyBase<T> {
+    config: MessagingTransportConfigs[T];
+}
+/**
+ * An update of the transport already configured on the channel: every `config`
+ * key is optional. An omitted (or `''`) key keeps its stored value — including a
+ * stored secret.
+ */
+export interface MessagingProviderUpdate<T extends MessagingTransport> extends ProviderBodyBase<T> {
+    config?: Partial<MessagingTransportConfigs[T]>;
+}
+/** Body for `messaging.setEmail` — discriminated by `transport`. */
+export type EmailProviderInput = {
+    [T in EmailTransport]: MessagingProviderSetup<T> | MessagingProviderUpdate<T>;
+}[EmailTransport];
+/** Body for `messaging.setSms` — discriminated by `transport`. */
+export type SmsProviderInput = {
+    [T in SmsTransport]: MessagingProviderSetup<T> | MessagingProviderUpdate<T>;
+}[SmsTransport];
+/** First-setup body for the email channel. Use with `satisfies` to require every required key. */
+export type EmailProviderSetup = {
+    [T in EmailTransport]: MessagingProviderSetup<T>;
+}[EmailTransport];
+/** First-setup body for the SMS channel. Use with `satisfies` to require every required key. */
+export type SmsProviderSetup = {
+    [T in SmsTransport]: MessagingProviderSetup<T>;
+}[SmsTransport];
+/**
+ * @deprecated The untyped body accepted before per-transport typing. Use
+ * {@link EmailProviderInput} / {@link SmsProviderInput} instead; the API refuses
+ * any `config` key the transport does not use.
+ */
 export interface MessagingProviderInput {
     /** The transport, e.g. `resend`, `ses`, `smtp` (email) or `twilio` (sms). */
     transport: string;
@@ -32,6 +237,42 @@ export interface MessagingProviderInput {
     /** Transport config; carries the write-only secret keys on write. */
     config?: Record<string, unknown>;
 }
+/** The non-secret config keys of transport `T`. */
+type PublicConfigKey<T extends MessagingTransport> = Exclude<keyof MessagingTransportConfigs[T], MessagingSecretKeys[T]>;
+/**
+ * A configured provider as returned by the API. `config` holds the non-secret
+ * settings only (values come back as strings, e.g. `port: "587"`); secrets are
+ * never returned — `secrets_set` says which ones are stored.
+ */
+export interface MessagingProviderOf<C extends 'email' | 'sms', T extends MessagingTransport> {
+    object: 'messaging_provider';
+    channel: C;
+    transport: T;
+    from_address: string | null;
+    status: string;
+    /** Non-secret config only — secret values are never returned. */
+    config: {
+        [K in PublicConfigKey<T>]?: string;
+    };
+    /** For each secret key of this transport: whether a value is stored. Never the value. */
+    secrets_set: {
+        [K in MessagingSecretKeys[T]]: boolean;
+    };
+    updated_at: number;
+}
+export type EmailProvider = {
+    [T in EmailTransport]: MessagingProviderOf<'email', T>;
+}[EmailTransport];
+export type SmsProvider = {
+    [T in SmsTransport]: MessagingProviderOf<'sms', T>;
+}[SmsTransport];
+/** Either channel's provider. Narrow on `transport` (or `channel`) to read its config. */
+export type MessagingProvider = EmailProvider | SmsProvider;
+export interface MessagingProviders {
+    object: 'messaging_providers';
+    email: EmailProvider | null;
+    sms: SmsProvider | null;
+}
 export interface MessagingTestResult {
     object: 'messaging_test';
     channel: string;
@@ -43,14 +284,39 @@ export interface DeletedMessagingProvider {
     channel: string;
     deleted: true;
 }
+/**
+ * The deprecated untyped body, accepted only when `transport` is a plain
+ * `string` (not a known literal) — so a typed literal with a wrong key still
+ * fails to compile instead of falling through to the legacy overload.
+ */
+type LegacyInput<T extends string> = Omit<MessagingProviderInput, 'transport'> & {
+    transport: T;
+} & (string extends T ? unknown : never);
 export declare function messagingResource(request: RequestFn): {
     /** The instance's configured email and SMS providers, secrets omitted. */
     get(): Promise<MessagingProviders>;
-    setEmail(body: MessagingProviderInput): Promise<MessagingProvider>;
-    setSms(body: MessagingProviderInput): Promise<MessagingProvider>;
+    /**
+     * Configure (or update) the email provider. `config` keys are checked per
+     * `transport`; on an update of the same transport, omitted keys — including
+     * secrets — keep their stored values.
+     */
+    setEmail: {
+        (body: EmailProviderInput): Promise<EmailProvider>;
+        <T extends string>(body: LegacyInput<T>): Promise<MessagingProvider>;
+    };
+    /**
+     * Configure (or update) the SMS provider. `config` keys are checked per
+     * `transport`; on an update of the same transport, omitted keys — including
+     * secrets — keep their stored values.
+     */
+    setSms: {
+        (body: SmsProviderInput): Promise<SmsProvider>;
+        <T extends string>(body: LegacyInput<T>): Promise<MessagingProvider>;
+    };
     deleteChannel(channel: "email" | "sms"): Promise<DeletedMessagingProvider>;
     /** Send a fixed, clearly-marked test message through the channel's provider. */
     test(channel: "email" | "sms", body: {
         to: string;
     }): Promise<MessagingTestResult>;
 };
+export {};

package/dist/client/messaging.js

@@ -3,17 +3,29 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.messagingResource = messagingResource;
 const request_1 = require("./request");
 function messagingResource(request) {
+    function setEmail(body) {
+        return request({ method: 'PUT', path: '/v1/messaging_providers/email', body });
+    }
+    function setSms(body) {
+        return request({ method: 'PUT', path: '/v1/messaging_providers/sms', body });
+    }
     return {
         /** The instance's configured email and SMS providers, secrets omitted. */
         get() {
             return request({ method: 'GET', path: '/v1/messaging_providers' });
         },
-        setEmail(body) {
-            return request({ method: 'PUT', path: '/v1/messaging_providers/email', body });
-        },
-        setSms(body) {
-            return request({ method: 'PUT', path: '/v1/messaging_providers/sms', body });
-        },
+        /**
+         * Configure (or update) the email provider. `config` keys are checked per
+         * `transport`; on an update of the same transport, omitted keys — including
+         * secrets — keep their stored values.
+         */
+        setEmail,
+        /**
+         * Configure (or update) the SMS provider. `config` keys are checked per
+         * `transport`; on an update of the same transport, omitted keys — including
+         * secrets — keep their stored values.
+         */
+        setSms,
         deleteChannel(channel) {
             return request({ method: 'DELETE', path: `/v1/messaging_providers/${(0, request_1.enc)(channel)}` });
         },

package/dist/client/messaging.js.map

@@ -1 +1 @@
-{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAmDA,8CAwBC;AA3ED,uCAAgD;AAmDhD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,IAA4B;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,aAAa,CAAC,OAAwB;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAsVA,8CA4CC;AAlYD,uCAAgD;AAsVhD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN,aAAa,CAAC,OAAwB;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -7,3 +7,7 @@ export type { AtlasClient } from './client';
 export * from './client';
 export { createTestIssuer } from './testing';
 export type { TestIssuer, CreateTestIssuerOptions } from './testing';
+export { verifyPCActn } from './pca/verify';
+export type { PcaVerdict, PcaContext, VerifyPCActnOptions } from './pca/verify';
+export { requirePCA, defaultExtract, memoryPcaStore } from './pca/require-pca';
+export type { RequirePcaOptions, PcaGuardResult, PcaRequestLike, PcaStateStore } from './pca/require-pca';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createTestIssuer = exports.createAtlasClient = void 0;
+exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.createTestIssuer = exports.createAtlasClient = void 0;
 // §7.3 token verification — the original surface, unchanged.
 __exportStar(require("./jwks-cache"), exports);
 __exportStar(require("./verify"), exports);
@@ -30,4 +30,12 @@ __exportStar(require("./client"), exports);
 // Its own module, so it never sits on the hot verification path.
 var testing_1 = require("./testing");
 Object.defineProperty(exports, "createTestIssuer", { enumerable: true, get: function () { return testing_1.createTestIssuer; } });
+// Proof-Carrying Authority (agentic auth): offline verifier + framework-agnostic guard,
+// beside the session-token verifier above.
+var verify_1 = require("./pca/verify");
+Object.defineProperty(exports, "verifyPCActn", { enumerable: true, get: function () { return verify_1.verifyPCActn; } });
+var require_pca_1 = require("./pca/require-pca");
+Object.defineProperty(exports, "requirePCA", { enumerable: true, get: function () { return require_pca_1.requirePCA; } });
+Object.defineProperty(exports, "defaultExtract", { enumerable: true, get: function () { return require_pca_1.defaultExtract; } });
+Object.defineProperty(exports, "memoryPcaStore", { enumerable: true, get: function () { return require_pca_1.memoryPcaStore; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,2CAAyB;AACzB,8CAA4B;AAE5B,oDAAoD;AACpD,6CAA2B;AAE3B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAA6C;AAApC,2GAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,2CAAyB;AACzB,8CAA4B;AAE5B,oDAAoD;AACpD,6CAA2B;AAE3B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAA6C;AAApC,2GAAA,gBAAgB,OAAA;AAGzB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA"}

package/dist/pca/require-pca.d.ts

@@ -0,0 +1,47 @@
+import { type Capability, type PCActn, type TrustBudget, type VerifyHooks } from '@atlasauth/pca';
+import { type PcaContext, type PcaVerdict } from './verify';
+/** Framework-agnostic request shape: anything with headers and (optionally) a parsed/raw body. */
+export interface PcaRequestLike {
+    headers: Record<string, string | string[] | undefined> | {
+        get(name: string): string | null;
+    };
+    body?: unknown;
+}
+/** Per-holder replay + budget state. Implement over Redis/DB; the in-memory one is for tests/single node. */
+export interface PcaStateStore {
+    get(key: string): Promise<{
+        budget?: TrustBudget;
+        lastCounter?: number;
+    } | undefined>;
+    put(key: string, state: {
+        budget?: TrustBudget;
+        lastCounter?: number;
+    }): Promise<void>;
+}
+export declare function memoryPcaStore(): PcaStateStore;
+export interface RequirePcaOptions {
+    /** Resolve the Root Intent Grant from the PCActn's `grant_ref`. null = unknown grant. */
+    resolveGrant: (grantRef: string, pcactn: PCActn) => Promise<Capability | null>;
+    hooks?: VerifyHooks;
+    extract?: (req: PcaRequestLike) => PCActn | string | null;
+    /** Anti-replay counter + budget persistence. Without it counters are not checked (surfaced in checks). */
+    budgetStore?: PcaStateStore;
+    /** Build verification context (params, plan, risk) per request. */
+    context?: (req: PcaRequestLike, pcactn: PCActn) => PcaContext | Promise<PcaContext>;
+    now?: () => number;
+    /** WWW-Authenticate realm (default "pca"). */
+    realm?: string;
+}
+export type PcaGuardResult = {
+    ok: true;
+    verdict: PcaVerdict;
+    pcactn: PCActn;
+} | {
+    ok: false;
+    status: 401 | 403;
+    verdict: PcaVerdict;
+    wwwAuthenticate?: string;
+};
+/** Default extraction: `PCA-Action: <base64url PCActn JSON>` header, else JSON body `{ pcactn }`. */
+export declare function defaultExtract(req: PcaRequestLike): PCActn | string | null;
+export declare function requirePCA(opts: RequirePcaOptions): (req: PcaRequestLike) => Promise<PcaGuardResult>;

package/dist/pca/require-pca.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.memoryPcaStore = memoryPcaStore;
+exports.defaultExtract = defaultExtract;
+exports.requirePCA = requirePCA;
+const pca_1 = require("@atlasauth/pca");
+const verify_1 = require("./verify");
+function memoryPcaStore() {
+    const m = new Map();
+    return { get: async (k) => m.get(k), put: async (k, v) => void m.set(k, v) };
+}
+function header(req, name) {
+    const h = req.headers;
+    if (typeof h.get === 'function')
+        return h.get(name) ?? undefined;
+    const v = h[name] ?? h[name.toLowerCase()];
+    return Array.isArray(v) ? v[0] : v;
+}
+function fromB64u(s) {
+    const b = s.replace(/-/g, '+').replace(/_/g, '/');
+    return Buffer.from(b, 'base64').toString('utf8');
+}
+/** Default extraction: `PCA-Action: <base64url PCActn JSON>` header, else JSON body `{ pcactn }`. */
+function defaultExtract(req) {
+    const h = header(req, 'pca-action');
+    if (h)
+        return fromB64u(h.trim());
+    let b = req.body;
+    if (typeof b === 'string') {
+        try {
+            b = JSON.parse(b);
+        }
+        catch {
+            return null;
+        }
+    }
+    const x = b?.pcactn;
+    if (typeof x === 'string' || (x !== null && typeof x === 'object'))
+        return x;
+    return null;
+}
+const denyVerdict = (reason) => ({
+    allow: false,
+    r: 1,
+    requiredThreshold: { t: 3, proof: 'strong', optimisticAllowed: false },
+    checks: { pcactn: 'fail' },
+    reasons: [reason],
+});
+function requirePCA(opts) {
+    const realm = opts.realm ?? 'pca';
+    const challenge = (error) => `PCA realm="${realm}"${error ? `, error="${error}"` : ''}, hint="send PCA-Action: <base64url PCActn> or JSON body {pcactn}"`;
+    const unauth = (reason, error = 'invalid_request') => ({
+        ok: false,
+        status: 401,
+        verdict: denyVerdict(reason),
+        wwwAuthenticate: challenge(error),
+    });
+    return async (req) => {
+        try {
+            let raw;
+            try {
+                raw = (opts.extract ?? defaultExtract)(req);
+            }
+            catch (e) {
+                return unauth(`unreadable PCActn: ${e.message}`);
+            }
+            if (raw === null || raw === undefined)
+                return unauth('no PCActn presented', 'missing_pcactn');
+            let p;
+            try {
+                p = typeof raw === 'string' ? (0, pca_1.decodePCActn)(raw) : raw;
+            }
+            catch (e) {
+                return unauth(`undecodable PCActn: ${e.message}`, 'invalid_pcactn');
+            }
+            if (p === null || typeof p !== 'object' || typeof p.grant_ref !== 'string') {
+                return unauth('malformed PCActn', 'invalid_pcactn');
+            }
+            const grant = await opts.resolveGrant(p.grant_ref, p);
+            if (!grant)
+                return unauth('unknown grant_ref', 'unknown_grant');
+            const now = opts.now?.() ?? Date.now();
+            const leafHolder = p.cap_chain?.[p.cap_chain.length - 1]?.holder;
+            const key = `${grant.id}:${leafHolder ?? ''}`;
+            const state = opts.budgetStore && leafHolder ? await opts.budgetStore.get(key) : undefined;
+            const ctx = { ...(await opts.context?.(req, p)) };
+            if (state?.budget && ctx.budget === undefined)
+                ctx.budget = state.budget;
+            const verdict = await (0, verify_1.verifyPCActn)(p, { grant, hooks: opts.hooks, now, context: ctx });
+            // Anti-replay (Appendix A step 5): strictly increasing per holder.
+            if (opts.budgetStore) {
+                if (state?.lastCounter !== undefined && !(p.counter > state.lastCounter)) {
+                    verdict.allow = false;
+                    verdict.checks.counter = 'fail';
+                    verdict.reasons.push(`counter: ${String(p.counter)} is not greater than last seen ${state.lastCounter} (replay)`);
+                }
+                else if (verdict.checks.counter === 'pass') {
+                    verdict.checks.counter = 'pass';
+                }
+            }
+            else if (verdict.checks.counter === 'pass') {
+                verdict.checks.counter = 'not-enforced';
+            }
+            if (!verdict.allow) {
+                // A bad signature / chain is an authentication failure; policy denial is authorization.
+                const authnFailed = ['version', 'cap_chain', 'leaf_signature', 'malformed', 'grant_ref'].some((c) => verdict.checks[c] === 'fail');
+                return authnFailed
+                    ? { ok: false, status: 401, verdict, wwwAuthenticate: challenge('invalid_pcactn') }
+                    : { ok: false, status: 403, verdict };
+            }
+            if (opts.budgetStore && leafHolder) {
+                await opts.budgetStore.put(key, { budget: verdict.budget ?? state?.budget, lastCounter: p.counter });
+            }
+            return { ok: true, verdict, pcactn: p };
+        }
+        catch (e) {
+            return { ok: false, status: 403, verdict: denyVerdict(`guard error (fail closed): ${e instanceof Error ? e.message : 'unknown'}`) };
+        }
+    };
+}
+//# sourceMappingURL=require-pca.js.map

package/dist/pca/require-pca.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-pca.js","sourceRoot":"","sources":["../../src/pca/require-pca.ts"],"names":[],"mappings":";;AAeA,wCAGC;AAiCD,wCAcC;AAUD,gCAuEC;AAlJD,wCAAgH;AAChH,qCAA0E;AAc1E,SAAgB,cAAc;IAC5B,MAAM,CAAC,GAAG,IAAI,GAAG,EAA0D,CAAC;IAC5E,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAoBD,SAAS,MAAM,CAAC,GAAmB,EAAE,IAAY;IAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAiG,CAAC;IAChH,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACjE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,qGAAqG;AACrG,SAAgB,cAAc,CAAC,GAAmB;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACpC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;IACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAI,CAA6C,EAAE,MAAM,CAAC;IACjE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,CAAoB,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,MAAc,EAAc,EAAE,CAAC,CAAC;IACnD,KAAK,EAAE,KAAK;IACZ,CAAC,EAAE,CAAC;IACJ,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACtE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;IAC1B,OAAO,EAAE,CAAC,MAAM,CAAC;CAClB,CAAC,CAAC;AAEH,SAAgB,UAAU,CAAC,IAAuB;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE,CACnC,cAAc,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,oEAAoE,CAAC;IAC/H,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAK,GAAG,iBAAiB,EAAkB,EAAE,CAAC,CAAC;QAC7E,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC;QAC5B,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC;KAClC,CAAC,CAAC;IAEH,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,CAAC;YACH,IAAI,GAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC,sBAAuB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;YAC9F,IAAI,CAAS,CAAC;YACd,IAAI,CAAC;gBACH,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,kBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC,uBAAwB,CAAW,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3E,OAAO,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;YAEhE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC;YACjE,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3F,MAAM,GAAG,GAAe,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,IAAI,KAAK,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAEzE,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAY,EAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAEvF,mEAAmE;YACnE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,IAAI,KAAK,EAAE,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;oBACzE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;oBACtB,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;oBAChC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,kCAAkC,KAAK,CAAC,WAAW,WAAW,CAAC,CAAC;gBACpH,CAAC;qBAAM,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;oBAC7C,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;gBAClC,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC7C,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC;YAC1C,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,wFAAwF;gBACxF,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,CAC3F,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CACpC,CAAC;gBACF,OAAO,WAAW;oBAChB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,CAAC,gBAAgB,CAAC,EAAE;oBACnF,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC1C,CAAC;YACD,IAAI,IAAI,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QACtI,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/pca/verify.d.ts

@@ -0,0 +1,36 @@
+import { type Capability, type CheckStatus, type PCActn, type PlanNode, type RequiredThreshold, type RiskInputs, type TrustBudget, type VerifyHooks } from '@atlasauth/pca';
+/**
+ * Resource-server side Proof-Carrying Authority verifier (spec §4, §7, Appendix A).
+ * Deterministic and offline; never throws (any internal error becomes a fail-closed verdict).
+ */
+export interface PcaContext {
+    /** Plaintext action params. If given they MUST hash to `action.params_digest`; needed by predicates. */
+    params?: Record<string, unknown>;
+    subject?: Record<string, unknown>;
+    env?: Record<string, unknown>;
+    /** The committed plan, if the RS knows it. Its Merkle root must equal `plan.root`. */
+    plan?: PlanNode[];
+    /** Risk inputs the RS can vouch for. Missing ones fail closed (worst case) except `taint`, see below. */
+    risk?: Partial<RiskInputs>;
+    /** Current trust budget for the leaf holder. Absent = a full budget (`budget` check reports not-enforced). */
+    budget?: TrustBudget;
+    recentActionTimes?: number[];
+}
+export interface VerifyPCActnOptions {
+    grant: Capability;
+    hooks?: VerifyHooks;
+    /** epoch ms (default Date.now()) */
+    now?: number;
+    context?: PcaContext;
+}
+export interface PcaVerdict {
+    allow: boolean;
+    /** Recomputed risk score in [0,1]. */
+    r: number;
+    requiredThreshold: RequiredThreshold;
+    checks: Record<string, CheckStatus>;
+    reasons: string[];
+    /** Budget after the decision (leaked, and debited when auto-admitted). Persist it on allow. */
+    budget?: TrustBudget;
+}
+export declare function verifyPCActn(pcactn: PCActn | string, opts: VerifyPCActnOptions): Promise<PcaVerdict>;

package/dist/pca/verify.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyPCActn = verifyPCActn;
+const pca_1 = require("@atlasauth/pca");
+const WORST_THRESHOLD = { t: 3, proof: 'strong', optimisticAllowed: false };
+function failClosed(reason, checks = {}) {
+    return {
+        allow: false,
+        r: 1,
+        requiredThreshold: WORST_THRESHOLD,
+        checks: { ...checks, malformed: 'fail' },
+        reasons: [reason],
+    };
+}
+async function verifyPCActn(pcactn, opts) {
+    try {
+        let p;
+        try {
+            p = typeof pcactn === 'string' ? (0, pca_1.decodePCActn)(pcactn) : pcactn;
+        }
+        catch (e) {
+            return failClosed(`undecodable PCActn: ${e.message}`);
+        }
+        if (p === null || typeof p !== 'object')
+            return failClosed('PCActn is not an object');
+        const now = opts.now ?? Date.now();
+        const ctx = opts.context ?? {};
+        const core = await (0, pca_1.verifyPCActnCore)(p, { grant: opts.grant, nowEpoch: now, hooks: opts.hooks });
+        const checks = { ...core.checks };
+        const reasons = [];
+        if (!core.allow && core.reason)
+            reasons.push(core.reason);
+        const fail = (name, why) => {
+            checks[name] = 'fail';
+            reasons.push(`${name}: ${why}`);
+        };
+        // grant_ref binds the object to this grant
+        if (p.grant_ref === opts.grant.id)
+            checks.grant_ref = 'pass';
+        else
+            fail('grant_ref', 'does not reference the supplied grant');
+        // params plaintext must open the committed digest
+        if (ctx.params !== undefined) {
+            if ((0, pca_1.hashCanonical)(ctx.params) === p.action?.params_digest)
+                checks.params_digest = 'pass';
+            else
+                fail('params_digest', 'supplied params do not hash to action.params_digest');
+        }
+        else
+            checks.params_digest = 'not-enforced';
+        // the RS's own copy of the plan must be the committed one
+        if (ctx.plan) {
+            if ((0, pca_1.merkleRoot)(ctx.plan.map(pca_1.planNodeLeaf)) === p.plan?.root)
+                checks.plan_root_authorized = 'pass';
+            else
+                fail('plan_root_authorized', 'known plan does not match plan.root');
+        }
+        const chain = Array.isArray(p.cap_chain) ? p.cap_chain : [];
+        const leaf = chain[chain.length - 1];
+        const depth = Math.max(0, chain.length - 1);
+        const now0 = now;
+        const budgetIn = ctx.budget ?? { B: Number.POSITIVE_INFINITY, tau: now0, asOf: now0 };
+        checks.budget = ctx.budget ? 'pass' : 'not-enforced';
+        // Taint: the agent's claim, used only as a default input (RS-supplied risk.taint wins).
+        const claimedTaint = p.provenance?.taint_level;
+        const risk = { ...ctx.risk };
+        if (risk.taint === undefined && typeof claimedTaint === 'number')
+            risk.taint = claimedTaint;
+        const reversibility = p.action?.reversibility_class;
+        const bMaxProbe = decideBudget(opts.grant, budgetIn, ctx.budget === undefined);
+        const d = (0, pca_1.decide)({
+            grant: opts.grant,
+            action: {
+                action: { verb: p.action?.verb, resource: p.action?.resource, params: ctx.params, reversibility_class: reversibility },
+                subject: ctx.subject,
+                env: ctx.env,
+            },
+            plan: ctx.plan,
+            nodeId: p.plan?.node_id,
+            risk,
+            budget: bMaxProbe,
+            now,
+            caveatContext: { delegationDepth: depth, recentActionTimes: ctx.recentActionTimes },
+        });
+        // Caveats added by delegation hops (beyond the root's) are conjunctive too.
+        if (leaf) {
+            const extra = leaf.caveats.slice(opts.grant.caveats.length);
+            const cv = (0, pca_1.evaluateCaveats)(extra, {
+                now,
+                blastRadius: risk.blastRadius,
+                reversibilityClass: reversibility,
+                delegationDepth: depth,
+                recentActionTimes: ctx.recentActionTimes,
+            });
+            if (cv.ok)
+                checks.delegated_caveats = 'pass';
+            else
+                fail('delegated_caveats', `delegation caveat(s) not satisfied: ${cv.failed.join(', ')}`);
+        }
+        if (d.releaseGuardianShare)
+            checks.policy = 'pass';
+        else {
+            checks.policy = 'fail';
+            reasons.push(...d.reasons.map((x) => `policy: ${x}`));
+        }
+        if (d.releaseGuardianShare) {
+            // informational reasons (step-up, assumed worst case) are kept even when released
+            reasons.push(...d.reasons.map((x) => `policy: ${x}`));
+        }
+        // Threshold: t > 1 needs a proof we can only get from an enforced threshold hook.
+        const th = checks.threshold;
+        if (d.requiredThreshold.t > 1 && d.releaseGuardianShare && th !== 'pass') {
+            fail('threshold', th === 'fail'
+                ? `t=${d.requiredThreshold.t} required and the threshold proof was rejected`
+                : `t=${d.requiredThreshold.t} (${d.requiredThreshold.proof}) required but no threshold verifier is enforced`);
+        }
+        const allow = !Object.values(checks).includes('fail') && d.releaseGuardianShare && core.allow;
+        if (allow) {
+            return { allow, r: d.r, requiredThreshold: d.requiredThreshold, checks, reasons, budget: ctx.budget ? d.budget : undefined };
+        }
+        if (reasons.length === 0)
+            reasons.push('denied');
+        return { allow: false, r: d.r, requiredThreshold: d.requiredThreshold, checks, reasons };
+    }
+    catch (e) {
+        return failClosed(`verifier error (fail closed): ${e instanceof Error ? e.message : 'unknown'}`);
+    }
+}
+/** Without a caller-supplied budget, use a full budget (grant's bMax) so absence does not itself deny. */
+function decideBudget(grant, b, absent) {
+    if (!absent)
+        return b;
+    const bMax = (0, pca_1.readEnvelope)(grant)?.risk_policy.bMax;
+    return { ...b, B: typeof bMax === 'number' && Number.isFinite(bMax) ? bMax : 0 };
+}
+//# sourceMappingURL=verify.js.map

package/dist/pca/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/pca/verify.ts"],"names":[],"mappings":";;AAsEA,oCA+GC;AArLD,wCAiBwB;AAyCxB,MAAM,eAAe,GAAsB,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;AAE/F,SAAS,UAAU,CAAC,MAAc,EAAE,SAAsC,EAAE;IAC1E,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,CAAC,EAAE,CAAC;QACJ,iBAAiB,EAAE,eAAe;QAClC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE;QACxC,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,MAAuB,EAAE,IAAyB;IACnF,IAAI,CAAC;QACH,IAAI,CAAS,CAAC;QACd,IAAI,CAAC;YACH,CAAC,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,kBAAY,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,UAAU,CAAC,uBAAwB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC,yBAAyB,CAAC,CAAC;QAEtF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAA,sBAAgB,EAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChG,MAAM,MAAM,GAAgC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAE;YACzC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC;QAEF,2CAA2C;QAC3C,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;;YACxD,IAAI,CAAC,WAAW,EAAE,uCAAuC,CAAC,CAAC;QAEhE,kDAAkD;QAClD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,IAAA,mBAAa,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,aAAa;gBAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC;;gBACpF,IAAI,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;QACpF,CAAC;;YAAM,MAAM,CAAC,aAAa,GAAG,cAAc,CAAC;QAE7C,0DAA0D;QAC1D,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,IAAA,gBAAU,EAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAY,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI;gBAAE,MAAM,CAAC,oBAAoB,GAAG,MAAM,CAAC;;gBAC7F,IAAI,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,GAAG,CAAC;QACjB,MAAM,QAAQ,GAAgB,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;QAErD,wFAAwF;QACxF,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC;QAC/C,MAAM,IAAI,GAAwB,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,YAAY,KAAK,QAAQ;YAAE,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;QAE5F,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACpD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,IAAA,YAAM,EAAC;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE;gBACN,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE;gBACtH,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,GAAG,EAAE,GAAG,CAAC,GAAG;aACb;YACD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO;YACvB,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,GAAG;YACH,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE;SACpF,CAAC,CAAC;QAEH,4EAA4E;QAC5E,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,EAAE,GAAG,IAAA,qBAAe,EAAC,KAAK,EAAE;gBAChC,GAAG;gBACH,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,aAAa;gBACjC,eAAe,EAAE,KAAK;gBACtB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;aACzC,CAAC,CAAC;YACH,IAAI,EAAE,CAAC,EAAE;gBAAE,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;;gBACxC,IAAI,CAAC,mBAAmB,EAAE,uCAAuC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,CAAC,CAAC,oBAAoB;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;aAC9C,CAAC;YACJ,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;YAC3B,kFAAkF;YAClF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,kFAAkF;QAClF,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;QAC5B,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,oBAAoB,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YACzE,IAAI,CACF,WAAW,EACX,EAAE,KAAK,MAAM;gBACX,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,gDAAgD;gBAC5E,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,kDAAkD,CAC/G,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GACT,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,IAAI,IAAI,CAAC,KAAK,CAAC;QAClF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC/H,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,iCAAiC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,SAAS,YAAY,CAAC,KAAiB,EAAE,CAAc,EAAE,MAAe;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,IAAA,kBAAY,EAAC,KAAK,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC;IACnD,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC"}

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@atlasauth/backend",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "dependencies": {
     "jose": "^5.9.6",
-    "@atlasauth/authz": "0.1.1"
+    "@atlasauth/authz": "0.1.1",
+    "@atlasauth/pca": "0.1.0"
   },
   "devDependencies": {
     "typescript": "^5.6.3",