@atlasauth/backend 0.22.0 → 0.23.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @atlasauth/backend changelog
 
+## Unreleased
+
+## 0.23.0 — 2026-10-25
+
+### Added
+
+- `jwtTemplates.create` and `jwtTemplates.update` take `settings` (`lifetime_seconds` 10–86400, `audience`, `algorithm`, `signing_secret`); `JwtTemplate` returns `settings`. `update` accepts claims, settings or both.
+- `instance.integrations.rotateEventsSecret(id, { overlap_seconds })`: rotate an integration's event signing secret, with the old one still signing during the overlap.
+- `startDeviceAuthorization({ issuer, clientId, clientSecret?, scope?, resource? })` and `pollDeviceAuthorization(start)`: the RFC 8628 device flow against any instance's OAuth server, for a CLI of your own. `startOperatorLogin` / `pollOperatorLogin` now use them.
+- `authenticatedWithin(claims, maxAgeSeconds)` and `usedMultiFactor(claims)`: step-up checks on a verified token's `auth_time`, `acr` and `amr`.
+
 ## 0.22.0 — 2026-10-25
 
 ### Added

package/dist/client/index.d.ts

@@ -580,9 +580,7 @@ declare function buildNamespaces(request: RequestFn): {
         list(): Promise<import("./types").ListPage<import("./jwt-templates").JwtTemplate>>;
         get(name: string): Promise<import("./jwt-templates").JwtTemplate>;
         create(body: import("./jwt-templates").CreateJwtTemplateBody): Promise<import("./jwt-templates").JwtTemplate>;
-        update(name: string, body: {
-            claims: Record<string, string>;
-        }): Promise<import("./jwt-templates").JwtTemplate>;
+        update(name: string, body: import("./jwt-templates").UpdateJwtTemplateBody): Promise<import("./jwt-templates").JwtTemplate>;
         delete(name: string): Promise<{
             object: "jwt_template";
             name: string;
@@ -1195,6 +1193,18 @@ declare function buildNamespaces(request: RequestFn): {
                 url: string;
                 secret: string;
             }>;
+            rotateEventsSecret(id: string, body?: {
+                overlap_seconds?: number;
+            }): Promise<{
+                object: "integration_events_secret";
+                integration: string;
+                endpoint_id: string;
+                url: string;
+                secret: string;
+                overlap_seconds: number;
+                previous_secret_expires_at: number | null;
+                warning: string;
+            }>;
             atlasIdToken(id: string, accessToken: string): Promise<import("./instance").IntegrationTokenResponse>;
             chatly: {
                 get(): Promise<import("./instance").ChatlyIntegration>;

package/dist/client/instance.d.ts

@@ -28,8 +28,31 @@ export interface Instance {
      */
     allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
     auth_config: Metadata;
+    /**
+     * Sign-in methods that are switched on but not offered to users, because they
+     * need an email provider and the instance has none (email is bring-your-own).
+     * They become active on their own once a provider is configured.
+     */
+    inactive_methods?: InactiveMethod[];
+    /** Methods that still work, minus the parts that need email (e.g. password without reset). */
+    limited_methods?: LimitedMethod[];
     created_at: number;
 }
+/** A switched-on sign-in method that is not offered to users, and why. */
+export interface InactiveMethod {
+    method: 'password' | 'email_code' | 'email_link';
+    reason: 'email_provider_required';
+}
+/**
+ * A sign-in method that works, minus parts that need email: password sign-in
+ * for users who already hold a password, without reset (and without sign-up
+ * while sign-up must verify the address by email).
+ */
+export interface LimitedMethod {
+    method: 'password';
+    reason: 'email_provider_required';
+    unavailable: Array<'password_reset' | 'password_sign_up'>;
+}
 /**
  * How an allowed origin signs in: `redirect` (hosted-redirect OIDC: the app
  * never runs the embedded components), `embedded` (the sign-in components run
@@ -55,12 +78,32 @@ export interface InstanceUpdateResult {
     allowed_origins: string[];
     allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
     auth_config: Metadata;
+    /**
+     * The write is accepted even when a method needs an email provider the
+     * instance does not have yet (Terraform or config import may add it later in
+     * the same apply). Such methods are listed here and are not offered to users
+     * until a provider is configured.
+     */
+    inactive_methods?: InactiveMethod[];
+    /** Methods that still work, minus the parts that need email. */
+    limited_methods?: LimitedMethod[];
 }
+/**
+ * Setup-check codes about sign-in methods that need email. The full list is at
+ * `GET /v1/instance/preflight/codes`; a finding's `code` may be any of them.
+ *
+ * - `email_provider_missing`: an enabled method needs email and the instance has no
+ *   email provider (`subject.methods` names them). A warning while the methods are
+ *   inactive, an error while users with a password cannot reset it.
+ * - `instance_sign_in_unused` (info): the instance's own sign-in methods are on but
+ *   every user signs in with Sign in with Atlas.
+ */
+export type EmailSignInPreflightCode = 'email_provider_missing' | 'email_sign_in_available' | 'instance_sign_in_unused' | 'no_usable_sign_in_methods' | 'sign_up_unreachable';
 /** One problem (or note) the setup check found. */
 export interface PreflightFinding {
     severity: 'error' | 'warning' | 'info';
     /** Stable snake_case identifier, e.g. `oauth_provider_missing_credentials`. */
-    code: string;
+    code: EmailSignInPreflightCode | (string & {});
     /** What is wrong, in a plain sentence. */
     message: string;
     /** What to do about it, in a plain sentence. */
@@ -720,6 +763,23 @@ export declare function instanceResource(request: RequestFn): {
             url: string;
             secret: string;
         }>;
+        /**
+         * Rotate the event receiver's signing secret (shown once). With
+         * `overlap_seconds` (at most 604800) the old secret keeps signing every
+         * delivery as a second Atlas-Signature entry until `previous_secret_expires_at`.
+         */
+        rotateEventsSecret(id: string, body?: {
+            overlap_seconds?: number;
+        }): Promise<{
+            object: "integration_events_secret";
+            integration: string;
+            endpoint_id: string;
+            url: string;
+            secret: string;
+            overlap_seconds: number;
+            previous_secret_expires_at: number | null;
+            warning: string;
+        }>;
         /** An integration token for a Sign in with Atlas user (their Atlas ID access token). */
         atlasIdToken(id: string, accessToken: string): Promise<IntegrationTokenResponse>;
         chatly: {

package/dist/client/instance.js

@@ -93,6 +93,14 @@ function instanceResource(request) {
             revealEventsSecret(id) {
                 return request({ method: 'POST', path: `/v1/instance/integrations/${encodeURIComponent(id)}/events_secret` });
             },
+            /**
+             * Rotate the event receiver's signing secret (shown once). With
+             * `overlap_seconds` (at most 604800) the old secret keeps signing every
+             * delivery as a second Atlas-Signature entry until `previous_secret_expires_at`.
+             */
+            rotateEventsSecret(id, body = {}) {
+                return request({ method: 'POST', path: `/v1/instance/integrations/${encodeURIComponent(id)}/events_secret/rotate`, body });
+            },
             /** An integration token for a Sign in with Atlas user (their Atlas ID access token). */
             atlasIdToken(id, accessToken) {
                 return request({

package/dist/client/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAymBA,4CA8IC;AA9ID,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS,CAAC,SAA0B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD;;;;WAIG;QACH,mBAAmB,CAAC,SAA4B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,mGAAmG;QACnG,WAAW,CAAC,MAA2C;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,iBAAiB,CAAC,SAA+C,EAAE;YACjE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QACD,oEAAoE;QACpE,0BAA0B;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,MAAsF;YAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,YAAY,EAAE;YACZ,+FAA+F;YAC/F,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,yFAAyF;YACzF,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,OAA6B,EAAE;gBACvE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC3D,IAAI;oBACJ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,2FAA2F;YAC3F,UAAU,CACR,EAAU,EACV,QAAmF,EAAE;gBAErF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,4DAA4D;YAC5D,kBAAkB,CAAC,EAAU;gBAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAChH,CAAC;YACD,wFAAwF;YACxF,YAAY,CAAC,EAAU,EAAE,WAAmB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,kBAAkB;oBAC3E,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AA4pBA,4CAkKC;AAlKD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS,CAAC,SAA0B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD;;;;WAIG;QACH,mBAAmB,CAAC,SAA4B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,mGAAmG;QACnG,WAAW,CAAC,MAA2C;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,iBAAiB,CAAC,SAA+C,EAAE;YACjE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QACD,oEAAoE;QACpE,0BAA0B;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,MAAsF;YAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,YAAY,EAAE;YACZ,+FAA+F;YAC/F,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,yFAAyF;YACzF,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,OAA6B,EAAE;gBACvE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC3D,IAAI;oBACJ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,2FAA2F;YAC3F,UAAU,CACR,EAAU,EACV,QAAmF,EAAE;gBAErF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,4DAA4D;YAC5D,kBAAkB,CAAC,EAAU;gBAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAChH,CAAC;YACD;;;;eAIG;YACH,kBAAkB,CAChB,EAAU,EACV,OAAqC,EAAE;gBAWvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7H,CAAC;YACD,wFAAwF;YACxF,YAAY,CAAC,EAAU,EAAE,WAAmB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,kBAAkB;oBAC3E,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/jwt-templates.d.ts

@@ -4,20 +4,45 @@ export interface JwtTemplate {
     object: 'jwt_template';
     name: string;
     claims: Record<string, string>;
+    /** Non-secret mint settings; the HS256 secret is never returned. */
+    settings?: {
+        lifetime_seconds: number | null;
+        audience: string | null;
+        algorithm: 'RS256' | 'HS256';
+        has_signing_secret: boolean;
+    };
+}
+/**
+ * Per-template mint settings. `lifetime_seconds` is 10–86400 (default: the
+ * instance session-token lifetime, 60 s); null clears a value on update.
+ */
+export interface JwtTemplateSettingsInput {
+    lifetime_seconds?: number | null;
+    audience?: string | null;
+    algorithm?: 'RS256' | 'HS256';
+    /** HS256 shared secret, at least 16 characters. Write-only. */
+    signing_secret?: string;
 }
 export interface CreateJwtTemplateBody {
     name: string;
+    /**
+     * Claim → expression. `{{org.id}}`, `{{org.membership_id}}` and `{{org.role}}`
+     * resolve per session from the active organization at mint time.
+     */
     claims: Record<string, string>;
+    settings?: JwtTemplateSettingsInput;
+}
+export interface UpdateJwtTemplateBody {
+    claims?: Record<string, string>;
+    settings?: JwtTemplateSettingsInput;
 }
 export declare function jwtTemplatesResource(request: RequestFn): {
     list(): Promise<ListPage<JwtTemplate>>;
     /** Fetched by template name. */
     get(name: string): Promise<JwtTemplate>;
     create(body: CreateJwtTemplateBody): Promise<JwtTemplate>;
-    /** Only the claims are updatable; the name is the key. */
-    update(name: string, body: {
-        claims: Record<string, string>;
-    }): Promise<JwtTemplate>;
+    /** Claims and/or settings; the name is the key and cannot change. */
+    update(name: string, body: UpdateJwtTemplateBody): Promise<JwtTemplate>;
     delete(name: string): Promise<{
         object: "jwt_template";
         name: string;

package/dist/client/jwt-templates.js

@@ -14,7 +14,7 @@ function jwtTemplatesResource(request) {
         create(body) {
             return request({ method: 'POST', path: '/v1/jwt_templates', body });
         },
-        /** Only the claims are updatable; the name is the key. */
+        /** Claims and/or settings; the name is the key and cannot change. */
         update(name, body) {
             return request({ method: 'PATCH', path: `/v1/jwt_templates/${(0, request_1.enc)(name)}`, body });
         },

package/dist/client/jwt-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-templates.js","sourceRoot":"","sources":["../../src/client/jwt-templates.ts"],"names":[],"mappings":";;AAcA,oDAoBC;AAlCD,uCAAgD;AAchD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,gCAAgC;QAChC,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,0DAA0D;QAC1D,MAAM,CAAC,IAAY,EAAE,IAAwC;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"jwt-templates.js","sourceRoot":"","sources":["../../src/client/jwt-templates.ts"],"names":[],"mappings":";;AA2CA,oDAoBC;AA/DD,uCAAgD;AA2ChD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,gCAAgC;QAChC,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,qEAAqE;QACrE,MAAM,CAAC,IAAY,EAAE,IAA2B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/operator.d.ts

@@ -54,6 +54,41 @@ interface Opts {
 }
 /** GET /v1/operator — where the operator device flow and token exchange live. */
 export declare function operatorConfiguration(opts?: Opts): Promise<OperatorConfiguration>;
+/**
+ * Start an RFC 8628 device flow against any Atlas instance's OAuth server, for a
+ * CLI or TV app of your own: `issuer` is the instance's issuer (its Frontend API
+ * host, e.g. `https://acme-fapi.atlasauth.net`) and `clientId` an OAuth client
+ * with the `urn:ietf:params:oauth:grant-type:device_code` grant. Show the person
+ * `verification_uri_complete` (or `verification_uri` + `user_code`), then
+ * {@link pollDeviceAuthorization}. A confidential client passes `clientSecret`.
+ */
+export declare function startDeviceAuthorization(params: {
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    scope?: string | string[];
+    resource?: string;
+}, opts?: Pick<Opts, 'fetch'>): Promise<DeviceAuthorization & {
+    config: DeviceFlowEndpoints;
+}>;
+/** Where a device flow runs: {@link startDeviceAuthorization} fills it from the issuer. */
+export interface DeviceFlowEndpoints {
+    device_authorization_endpoint: string;
+    token_endpoint: string;
+    client_id: string;
+    client_secret?: string;
+}
+/**
+ * Poll the token endpoint until the person approves (resolves the tokens),
+ * denies (`access_denied`) or the code expires (`expired_token`); both throw an
+ * {@link OAuthFlowError}. Honours `interval` and adds 5 s on each `slow_down`.
+ */
+export declare function pollDeviceAuthorization(start: DeviceAuthorization & {
+    config: DeviceFlowEndpoints;
+}, opts?: Pick<Opts, 'fetch'> & {
+    sleep?: (ms: number) => Promise<void>;
+    signal?: AbortSignal;
+}): Promise<OAuthTokenResponse>;
 /**
  * Start the device flow. With `audience` (one of the configuration's
  * `audiences`), the operator token is minted FOR that other product

package/dist/client/operator.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.openSealedBox = exports.sealBox = exports.OAuthFlowError = void 0;
 exports.operatorConfiguration = operatorConfiguration;
+exports.startDeviceAuthorization = startDeviceAuthorization;
+exports.pollDeviceAuthorization = pollDeviceAuthorization;
 exports.startOperatorLogin = startOperatorLogin;
 exports.pollOperatorLogin = pollOperatorLogin;
 exports.exchangeOperatorToken = exchangeOperatorToken;
@@ -42,27 +44,41 @@ async function operatorConfiguration(opts = {}) {
     return (await res.json());
 }
 /**
- * Start the device flow. With `audience` (one of the configuration's
- * `audiences`), the operator token is minted FOR that other product
- * (`aud=<audience>`, sent as the RFC 8707 `resource`): hand it to that product;
- * Atlas's own token exchange refuses it.
+ * Start an RFC 8628 device flow against any Atlas instance's OAuth server, for a
+ * CLI or TV app of your own: `issuer` is the instance's issuer (its Frontend API
+ * host, e.g. `https://acme-fapi.atlasauth.net`) and `clientId` an OAuth client
+ * with the `urn:ietf:params:oauth:grant-type:device_code` grant. Show the person
+ * `verification_uri_complete` (or `verification_uri` + `user_code`), then
+ * {@link pollDeviceAuthorization}. A confidential client passes `clientSecret`.
  */
-async function startOperatorLogin(opts = {}) {
-    const config = opts.config ?? (await operatorConfiguration(opts));
-    const out = await form(opts.fetch ?? globalThis.fetch, config.device_authorization_endpoint, {
+async function startDeviceAuthorization(params, opts = {}) {
+    const base = params.issuer.replace(/\/+$/, '');
+    const config = {
+        device_authorization_endpoint: `${base}/oauth2/device_authorization`,
+        token_endpoint: `${base}/oauth2/token`,
+        client_id: params.clientId,
+        ...(params.clientSecret ? { client_secret: params.clientSecret } : {}),
+    };
+    const scope = Array.isArray(params.scope) ? params.scope.join(' ') : params.scope;
+    return startDevice(opts.fetch ?? globalThis.fetch, config, { scope, resource: params.resource });
+}
+async function startDevice(f, config, params) {
+    const out = await form(f, config.device_authorization_endpoint, {
         client_id: config.client_id,
-        scope: config.scope,
-        ...(opts.audience ? { resource: opts.audience } : {}),
+        ...(config.client_secret ? { client_secret: config.client_secret } : {}),
+        ...(params.scope ? { scope: params.scope } : {}),
+        ...(params.resource ? { resource: params.resource } : {}),
     });
     if (out._status !== 200)
         throw new OAuthFlowError(String(out.error ?? 'error'), String(out.error_description ?? 'Device authorization failed.'), out._status);
     return { ...out, config };
 }
 /**
- * Poll until the person approves (resolves the operator token), denies or the
- * code expires (throws). Honours `interval` and `slow_down`.
+ * Poll the token endpoint until the person approves (resolves the tokens),
+ * denies (`access_denied`) or the code expires (`expired_token`); both throw an
+ * {@link OAuthFlowError}. Honours `interval` and adds 5 s on each `slow_down`.
  */
-async function pollOperatorLogin(start, opts = {}) {
+async function pollDeviceAuthorization(start, opts = {}) {
     const f = opts.fetch ?? globalThis.fetch;
     const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     let interval = Math.max(1, start.interval) * 1000;
@@ -75,6 +91,7 @@ async function pollOperatorLogin(start, opts = {}) {
             grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
             device_code: start.device_code,
             client_id: start.config.client_id,
+            ...(start.config.client_secret ? { client_secret: start.config.client_secret } : {}),
         });
         if (out._status === 200)
             return out;
@@ -88,6 +105,24 @@ async function pollOperatorLogin(start, opts = {}) {
     }
     throw new OAuthFlowError('expired_token', 'The sign-in code expired. Run the login again.', 400);
 }
+/**
+ * Start the device flow. With `audience` (one of the configuration's
+ * `audiences`), the operator token is minted FOR that other product
+ * (`aud=<audience>`, sent as the RFC 8707 `resource`): hand it to that product;
+ * Atlas's own token exchange refuses it.
+ */
+async function startOperatorLogin(opts = {}) {
+    const config = opts.config ?? (await operatorConfiguration(opts));
+    const out = await startDevice(opts.fetch ?? globalThis.fetch, config, { scope: config.scope, resource: opts.audience });
+    return { ...out, config };
+}
+/**
+ * Poll until the person approves (resolves the operator token), denies or the
+ * code expires (throws). Honours `interval` and `slow_down`.
+ */
+async function pollOperatorLogin(start, opts = {}) {
+    return pollDeviceAuthorization(start, opts);
+}
 /** RFC 8693: swap an operator token for a one-hour, resource-bound Atlas token. */
 async function exchangeOperatorToken(subjectToken, params, opts = {}) {
     const out = await form(opts.fetch ?? globalThis.fetch, `${(opts.apiUrl ?? DEFAULT_API).replace(/\/+$/, '')}/v1/oauth/token`, {

package/dist/client/operator.js.map

@@ -1 +1 @@
-{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/client/operator.ts"],"names":[],"mappings":";;;AAmFA,sDAKC;AAQD,gDAWC;AAMD,8CAyBC;AAGD,sDAmBC;AAGD,4CAUC;AAGD,kDAGC;AAGD,4CAEC;AAGD,4CAYC;AAvMD,6CAAiF;AAEjF,MAAM,KAAK,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAmDhF,MAAa,cAAe,SAAQ,KAAK;IAE5B;IAEA;IAHX,YACW,KAAa,EACtB,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,UAAK,GAAL,KAAK,CAAQ;QAEb,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AATD,wCASC;AAOD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,KAAK,UAAU,IAAI,CAAC,SAAuB,EAAE,GAAW,EAAE,IAA4B;IACpF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,iFAAiF;AAC1E,KAAK,UAAU,qBAAqB,CAAC,OAAa,EAAE;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACpI,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,2DAA2D,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAqE,EAAE;IAEvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,6BAA6B,EAAE;QAC3F,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,8BAA8B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9J,OAAO,EAAE,GAAI,GAAsC,EAAE,MAAM,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CACrC,KAA8D,EAC9D,OAA+E,EAAE;IAEjF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;YACrD,UAAU,EAAE,8CAA8C;YAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;YAAE,OAAO,GAAoC,CAAC;QACrE,IAAI,GAAG,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QACpD,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,IAAI,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAC;AACnG,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,MAAsD,EACtD,OAAa,EAAE;IAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE;QAC3H,UAAU,EAAE,iDAAiD;QAC7D,aAAa,EAAE,YAAY;QAC3B,kBAAkB,EAAE,+CAA+C;QACnE,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;KAC3E,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3G,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC9I,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAA2D,CAAC;AACrE,CAAC;AAED,4FAA4F;AACrF,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IAC5H,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACnI,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACvJ,OAAO,GAAoC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AACnF,SAAgB,mBAAmB;IACjC,MAAM,IAAI,GAAG,IAAA,gCAAG,GAAE,CAAC;IACnB,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,oFAAoF;AACpF,SAAgB,gBAAgB,CAAC,YAAoB,EAAE,OAAyD;IAC9G,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAA,0BAAI,EAAC,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,gBAAgB,CACpC,OAAiB,EACjB,OAAgC,EAAE;IAElC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,EAAE;QAC/F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,yBAAyB,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7G,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8G,CAAC;AACzI,CAAC;AACD,2CAAsD;AAA7C,qGAAA,OAAO,OAAA;AAAE,2GAAA,aAAa,OAAA"}
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/client/operator.ts"],"names":[],"mappings":";;;AAmFA,sDAKC;AAUD,4DAaC;AA8BD,0DA0BC;AAQD,gDAMC;AAMD,8CAKC;AAGD,sDAmBC;AAGD,4CAUC;AAGD,kDAGC;AAGD,4CAEC;AAGD,4CAYC;AA7PD,6CAAiF;AAEjF,MAAM,KAAK,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAmDhF,MAAa,cAAe,SAAQ,KAAK;IAE5B;IAEA;IAHX,YACW,KAAa,EACtB,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,UAAK,GAAL,KAAK,CAAQ;QAEb,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AATD,wCASC;AAOD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,KAAK,UAAU,IAAI,CAAC,SAAuB,EAAE,GAAW,EAAE,IAA4B;IACpF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,iFAAiF;AAC1E,KAAK,UAAU,qBAAqB,CAAC,OAAa,EAAE;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACpI,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,2DAA2D,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,wBAAwB,CAC5C,MAAiH,EACjH,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAwB;QAClC,6BAA6B,EAAE,GAAG,IAAI,8BAA8B;QACpE,cAAc,EAAE,GAAG,IAAI,eAAe;QACtC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAClF,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AACnG,CAAC;AAUD,KAAK,UAAU,WAAW,CACxB,CAAe,EACf,MAA2B,EAC3B,MAA6C;IAE7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,6BAA6B,EAAE;QAC9D,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,8BAA8B,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9J,OAAO,EAAE,GAAI,GAAsC,EAAE,MAAM,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,uBAAuB,CAC3C,KAA4D,EAC5D,OAA8F,EAAE;IAEhG,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;YACrD,UAAU,EAAE,8CAA8C;YAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;YACjC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;YAAE,OAAO,GAAoC,CAAC;QACrE,IAAI,GAAG,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QACpD,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,IAAI,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAqE,EAAE;IAEvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxH,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CACrC,KAA8D,EAC9D,OAA+E,EAAE;IAEjF,OAAO,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,MAAsD,EACtD,OAAa,EAAE;IAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE;QAC3H,UAAU,EAAE,iDAAiD;QAC7D,aAAa,EAAE,YAAY;QAC3B,kBAAkB,EAAE,+CAA+C;QACnE,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;KAC3E,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3G,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC9I,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAA2D,CAAC;AACrE,CAAC;AAED,4FAA4F;AACrF,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IAC5H,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACnI,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACvJ,OAAO,GAAoC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AACnF,SAAgB,mBAAmB;IACjC,MAAM,IAAI,GAAG,IAAA,gCAAG,GAAE,CAAC;IACnB,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,oFAAoF;AACpF,SAAgB,gBAAgB,CAAC,YAAoB,EAAE,OAAyD;IAC9G,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAA,0BAAI,EAAC,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,gBAAgB,CACpC,OAAiB,EACjB,OAAgC,EAAE;IAElC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,EAAE;QAC/F,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,yBAAyB,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7G,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8G,CAAC;AACzI,CAAC;AACD,2CAAsD;AAA7C,qGAAA,OAAO,OAAA;AAAE,2GAAA,aAAa,OAAA"}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export * from './jwks-cache';
 export { DiscoveryError, JwksDiscovery, discoveryUrlFor, instanceIdFromPublishableKey } from './discovery';
 export * from './verify';
+export * from './recent-auth';
 export * from './access-control';
 export * from './handshake';
 export * from './better-auth';

package/dist/index.js

@@ -25,6 +25,7 @@ Object.defineProperty(exports, "JwksDiscovery", { enumerable: true, get: functio
 Object.defineProperty(exports, "discoveryUrlFor", { enumerable: true, get: function () { return discovery_1.discoveryUrlFor; } });
 Object.defineProperty(exports, "instanceIdFromPublishableKey", { enumerable: true, get: function () { return discovery_1.instanceIdFromPublishableKey; } });
 __exportStar(require("./verify"), exports);
+__exportStar(require("./recent-auth"), exports);
 __exportStar(require("./access-control"), exports);
 __exportStar(require("./handshake"), exports);
 // Moving from Better Auth: exchange its session cookie once, accept its JWTs for a window.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAGzC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,gDAA8B;AAC9B,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAGzC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}

package/dist/recent-auth.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Step-up checks on a verified Atlas token. Session and template tokens carry
+ * `auth_time` (the first-factor sign-in, or the last step-up), `amr` and `acr`
+ * (`urn:atlas:acr:basic`, `urn:atlas:acr:mfa`, `urn:atlas:acr:step_up`).
+ *
+ *   const auth = await atlas.authenticateRequest(req);
+ *   if (!auth.ok) return res.status(401).end();
+ *   if (!authenticatedWithin(auth.claims, 300)) {
+ *     // Ask the browser to step up (POST /v1/client/me/step_up) and retry.
+ *     return res.status(401).json({ error: 'reauthentication_required', max_age: 300 });
+ *   }
+ */
+/** Whether `auth_time` is within `maxAgeSeconds` of now. A token without `auth_time` never is. */
+export declare function authenticatedWithin(claims: {
+    auth_time?: unknown;
+}, maxAgeSeconds: number, nowMs?: number): boolean;
+/** Whether the session proved a second factor (`acr` is mfa or step_up after an MFA method, or `amr` includes `mfa`). */
+export declare function usedMultiFactor(claims: {
+    acr?: unknown;
+    amr?: unknown;
+}): boolean;

package/dist/recent-auth.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * Step-up checks on a verified Atlas token. Session and template tokens carry
+ * `auth_time` (the first-factor sign-in, or the last step-up), `amr` and `acr`
+ * (`urn:atlas:acr:basic`, `urn:atlas:acr:mfa`, `urn:atlas:acr:step_up`).
+ *
+ *   const auth = await atlas.authenticateRequest(req);
+ *   if (!auth.ok) return res.status(401).end();
+ *   if (!authenticatedWithin(auth.claims, 300)) {
+ *     // Ask the browser to step up (POST /v1/client/me/step_up) and retry.
+ *     return res.status(401).json({ error: 'reauthentication_required', max_age: 300 });
+ *   }
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authenticatedWithin = authenticatedWithin;
+exports.usedMultiFactor = usedMultiFactor;
+/** Whether `auth_time` is within `maxAgeSeconds` of now. A token without `auth_time` never is. */
+function authenticatedWithin(claims, maxAgeSeconds, nowMs = Date.now()) {
+    const at = claims.auth_time;
+    if (typeof at !== 'number' || !Number.isFinite(at))
+        return false;
+    return nowMs / 1000 - at <= maxAgeSeconds;
+}
+/** Whether the session proved a second factor (`acr` is mfa or step_up after an MFA method, or `amr` includes `mfa`). */
+function usedMultiFactor(claims) {
+    if (claims.acr === 'urn:atlas:acr:mfa')
+        return true;
+    return Array.isArray(claims.amr) && claims.amr.includes('mfa');
+}
+//# sourceMappingURL=recent-auth.js.map

package/dist/recent-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recent-auth.js","sourceRoot":"","sources":["../src/recent-auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAGH,kDAIC;AAGD,0CAGC;AAXD,kGAAkG;AAClG,SAAgB,mBAAmB,CAAC,MAA+B,EAAE,aAAqB,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IACpH,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI,aAAa,CAAC;AAC5C,CAAC;AAED,yHAAyH;AACzH,SAAgB,eAAe,CAAC,MAAwC;IACtE,IAAI,MAAM,CAAC,GAAG,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/backend",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "dependencies": {