@atlasauth/backend 0.22.0 → 0.24.0

package/dist/client/instance.d.ts

@@ -28,8 +28,31 @@ export interface Instance {
      */
     allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
     auth_config: Metadata;
+    /**
+     * Sign-in methods that are switched on but not offered to users, because they
+     * need an email provider and the instance has none (email is bring-your-own).
+     * They become active on their own once a provider is configured.
+     */
+    inactive_methods?: InactiveMethod[];
+    /** Methods that still work, minus the parts that need email (e.g. password without reset). */
+    limited_methods?: LimitedMethod[];
     created_at: number;
 }
+/** A switched-on sign-in method that is not offered to users, and why. */
+export interface InactiveMethod {
+    method: 'password' | 'email_code' | 'email_link';
+    reason: 'email_provider_required';
+}
+/**
+ * A sign-in method that works, minus parts that need email: password sign-in
+ * for users who already hold a password, without reset (and without sign-up
+ * while sign-up must verify the address by email).
+ */
+export interface LimitedMethod {
+    method: 'password';
+    reason: 'email_provider_required';
+    unavailable: Array<'password_reset' | 'password_sign_up'>;
+}
 /**
  * How an allowed origin signs in: `redirect` (hosted-redirect OIDC: the app
  * never runs the embedded components), `embedded` (the sign-in components run
@@ -55,12 +78,32 @@ export interface InstanceUpdateResult {
     allowed_origins: string[];
     allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
     auth_config: Metadata;
+    /**
+     * The write is accepted even when a method needs an email provider the
+     * instance does not have yet (Terraform or config import may add it later in
+     * the same apply). Such methods are listed here and are not offered to users
+     * until a provider is configured.
+     */
+    inactive_methods?: InactiveMethod[];
+    /** Methods that still work, minus the parts that need email. */
+    limited_methods?: LimitedMethod[];
 }
+/**
+ * Setup-check codes about sign-in methods that need email. The full list is at
+ * `GET /v1/instance/preflight/codes`; a finding's `code` may be any of them.
+ *
+ * - `email_provider_missing`: an enabled method needs email and the instance has no
+ *   email provider (`subject.methods` names them). A warning while the methods are
+ *   inactive, an error while users with a password cannot reset it.
+ * - `instance_sign_in_unused` (info): the instance's own sign-in methods are on but
+ *   every user signs in with Sign in with Atlas.
+ */
+export type EmailSignInPreflightCode = 'email_provider_missing' | 'email_sign_in_available' | 'instance_sign_in_unused' | 'no_usable_sign_in_methods' | 'sign_up_unreachable';
 /** One problem (or note) the setup check found. */
 export interface PreflightFinding {
     severity: 'error' | 'warning' | 'info';
     /** Stable snake_case identifier, e.g. `oauth_provider_missing_credentials`. */
-    code: string;
+    code: EmailSignInPreflightCode | (string & {});
     /** What is wrong, in a plain sentence. */
     message: string;
     /** What to do about it, in a plain sentence. */
@@ -720,6 +763,23 @@ export declare function instanceResource(request: RequestFn): {
             url: string;
             secret: string;
         }>;
+        /**
+         * Rotate the event receiver's signing secret (shown once). With
+         * `overlap_seconds` (at most 604800) the old secret keeps signing every
+         * delivery as a second Atlas-Signature entry until `previous_secret_expires_at`.
+         */
+        rotateEventsSecret(id: string, body?: {
+            overlap_seconds?: number;
+        }): Promise<{
+            object: "integration_events_secret";
+            integration: string;
+            endpoint_id: string;
+            url: string;
+            secret: string;
+            overlap_seconds: number;
+            previous_secret_expires_at: number | null;
+            warning: string;
+        }>;
         /** An integration token for a Sign in with Atlas user (their Atlas ID access token). */
         atlasIdToken(id: string, accessToken: string): Promise<IntegrationTokenResponse>;
         chatly: {

package/dist/client/instance.js

@@ -93,6 +93,14 @@ function instanceResource(request) {
             revealEventsSecret(id) {
                 return request({ method: 'POST', path: `/v1/instance/integrations/${encodeURIComponent(id)}/events_secret` });
             },
+            /**
+             * Rotate the event receiver's signing secret (shown once). With
+             * `overlap_seconds` (at most 604800) the old secret keeps signing every
+             * delivery as a second Atlas-Signature entry until `previous_secret_expires_at`.
+             */
+            rotateEventsSecret(id, body = {}) {
+                return request({ method: 'POST', path: `/v1/instance/integrations/${encodeURIComponent(id)}/events_secret/rotate`, body });
+            },
             /** An integration token for a Sign in with Atlas user (their Atlas ID access token). */
             atlasIdToken(id, accessToken) {
                 return request({

package/dist/client/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAymBA,4CA8IC;AA9ID,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS,CAAC,SAA0B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD;;;;WAIG;QACH,mBAAmB,CAAC,SAA4B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,mGAAmG;QACnG,WAAW,CAAC,MAA2C;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,iBAAiB,CAAC,SAA+C,EAAE;YACjE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QACD,oEAAoE;QACpE,0BAA0B;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,MAAsF;YAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,YAAY,EAAE;YACZ,+FAA+F;YAC/F,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,yFAAyF;YACzF,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,OAA6B,EAAE;gBACvE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC3D,IAAI;oBACJ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,2FAA2F;YAC3F,UAAU,CACR,EAAU,EACV,QAAmF,EAAE;gBAErF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,4DAA4D;YAC5D,kBAAkB,CAAC,EAAU;gBAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAChH,CAAC;YACD,wFAAwF;YACxF,YAAY,CAAC,EAAU,EAAE,WAAmB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,kBAAkB;oBAC3E,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AA4pBA,4CAkKC;AAlKD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS,CAAC,SAA0B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD;;;;WAIG;QACH,mBAAmB,CAAC,SAA4B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,mGAAmG;QACnG,WAAW,CAAC,MAA2C;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,iBAAiB,CAAC,SAA+C,EAAE;YACjE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QACD,oEAAoE;QACpE,0BAA0B;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,MAAsF;YAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,YAAY,EAAE;YACZ,+FAA+F;YAC/F,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,yFAAyF;YACzF,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,OAA6B,EAAE;gBACvE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC3D,IAAI;oBACJ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,2FAA2F;YAC3F,UAAU,CACR,EAAU,EACV,QAAmF,EAAE;gBAErF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,4DAA4D;YAC5D,kBAAkB,CAAC,EAAU;gBAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAChH,CAAC;YACD;;;;eAIG;YACH,kBAAkB,CAChB,EAAU,EACV,OAAqC,EAAE;gBAWvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7H,CAAC;YACD,wFAAwF;YACxF,YAAY,CAAC,EAAU,EAAE,WAAmB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,kBAAkB;oBAC3E,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/jwt-templates.d.ts

@@ -4,20 +4,45 @@ export interface JwtTemplate {
     object: 'jwt_template';
     name: string;
     claims: Record<string, string>;
+    /** Non-secret mint settings; the HS256 secret is never returned. */
+    settings?: {
+        lifetime_seconds: number | null;
+        audience: string | null;
+        algorithm: 'RS256' | 'HS256';
+        has_signing_secret: boolean;
+    };
+}
+/**
+ * Per-template mint settings. `lifetime_seconds` is 10–86400 (default: the
+ * instance session-token lifetime, 60 s); null clears a value on update.
+ */
+export interface JwtTemplateSettingsInput {
+    lifetime_seconds?: number | null;
+    audience?: string | null;
+    algorithm?: 'RS256' | 'HS256';
+    /** HS256 shared secret, at least 16 characters. Write-only. */
+    signing_secret?: string;
 }
 export interface CreateJwtTemplateBody {
     name: string;
+    /**
+     * Claim → expression. `{{org.id}}`, `{{org.membership_id}}` and `{{org.role}}`
+     * resolve per session from the active organization at mint time.
+     */
     claims: Record<string, string>;
+    settings?: JwtTemplateSettingsInput;
+}
+export interface UpdateJwtTemplateBody {
+    claims?: Record<string, string>;
+    settings?: JwtTemplateSettingsInput;
 }
 export declare function jwtTemplatesResource(request: RequestFn): {
     list(): Promise<ListPage<JwtTemplate>>;
     /** Fetched by template name. */
     get(name: string): Promise<JwtTemplate>;
     create(body: CreateJwtTemplateBody): Promise<JwtTemplate>;
-    /** Only the claims are updatable; the name is the key. */
-    update(name: string, body: {
-        claims: Record<string, string>;
-    }): Promise<JwtTemplate>;
+    /** Claims and/or settings; the name is the key and cannot change. */
+    update(name: string, body: UpdateJwtTemplateBody): Promise<JwtTemplate>;
     delete(name: string): Promise<{
         object: "jwt_template";
         name: string;

package/dist/client/jwt-templates.js

@@ -14,7 +14,7 @@ function jwtTemplatesResource(request) {
         create(body) {
             return request({ method: 'POST', path: '/v1/jwt_templates', body });
         },
-        /** Only the claims are updatable; the name is the key. */
+        /** Claims and/or settings; the name is the key and cannot change. */
         update(name, body) {
             return request({ method: 'PATCH', path: `/v1/jwt_templates/${(0, request_1.enc)(name)}`, body });
         },

package/dist/client/jwt-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-templates.js","sourceRoot":"","sources":["../../src/client/jwt-templates.ts"],"names":[],"mappings":";;AAcA,oDAoBC;AAlCD,uCAAgD;AAchD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,gCAAgC;QAChC,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,0DAA0D;QAC1D,MAAM,CAAC,IAAY,EAAE,IAAwC;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"jwt-templates.js","sourceRoot":"","sources":["../../src/client/jwt-templates.ts"],"names":[],"mappings":";;AA2CA,oDAoBC;AA/DD,uCAAgD;AA2ChD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,gCAAgC;QAChC,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,qEAAqE;QACrE,MAAM,CAAC,IAAY,EAAE,IAA2B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/migrations.d.ts

@@ -0,0 +1,286 @@
+import { type BetterAuthImportActionItem } from './better-auth-imports';
+import { type RequestFn } from './request';
+import type { CursorPage, CursorParams } from './types';
+/**
+ * Migrate to Atlas from any source: the vendor-neutral surface every vendor
+ * plugs into (`{source}`: `auth0`, `clerk`, `cognito`, `firebase`, …,
+ * `better_auth`, `custom`).
+ *
+ *   imports  `/v1/migrations/{source}/imports` — a sealed migration bundle
+ *            (`@atlasauth/migrate`, or `atlas migrate export <vendor>`):
+ *            `getPublicKey()`, `upload()` (create + parts + finalize), read the
+ *            `report`, `apply()`; applying again after a failure resumes.
+ *   bridge   `/v1/migrations/{source}/bridge` — the zero-logout bridge settings
+ *            (a vendor JWT preset, or imported sessions).
+ *   sources  `/v1/migrations/sources` — what each source supports.
+ */
+export type MigrationSourceId = 'better_auth' | 'auth0' | 'clerk' | 'cognito' | 'firebase' | 'supabase' | 'workos' | 'authjs' | 'okta' | 'stytch' | 'keycloak' | 'fusionauth' | 'kinde' | 'descope' | 'lucia' | 'ory' | 'frontegg' | 'custom';
+export type MigrationImportStatus = 'uploading' | 'analyzing' | 'ready' | 'invalid' | 'queued' | 'applying' | 'completed' | 'failed';
+export interface MigrationImportKey {
+    object: 'migration_import_key';
+    kid: string;
+    /** base64url raw X25519 public key. One key serves every source. */
+    public_key: string;
+    alg: 'X25519-HKDF-SHA256-A256GCM';
+    status: 'active' | 'retired';
+    fingerprint: string;
+    /** `kid:public_key`, the form the exporters take. */
+    compact: string;
+    created_at: number;
+    retired_at: number | null;
+}
+/** Options of a non-Better-Auth import (a `better_auth` import takes {@link BetterAuthImportOptions}). */
+export interface MigrationImportOptions {
+    models?: Array<'organization' | 'role' | 'user' | 'identity' | 'mfa_factor' | 'passkey' | 'membership' | 'invitation' | 'api_key' | 'sso_connection' | 'jwks' | 'session'>;
+    on_email_conflict?: 'skip' | 'link';
+    create_app_roles?: boolean;
+    import_oauth_tokens?: boolean;
+    passkeys_on_rp_mismatch?: 'skip' | 'import';
+    import_sessions?: boolean;
+    import_jwks?: boolean;
+    jwks_cutover_days?: number;
+    /** Source provider name → Atlas provider key. */
+    provider_map?: Record<string, string>;
+    /** Hash parameters that live outside the export, per algorithm id (Firebase signer key …). */
+    password_hash_params?: Record<string, Record<string, string | number | boolean>>;
+    retain_bundle?: boolean;
+    [option: string]: unknown;
+}
+interface MigrationReportCommon {
+    skipped: Array<{
+        model: string;
+        row_id: string | null;
+        reason_code: string;
+        reason: string;
+    }>;
+    skipped_total: number;
+    skipped_by_code: Record<string, number>;
+    conflicts: Array<{
+        model: string;
+        row_id: string | null;
+        code: string;
+        message: string;
+        resolution: 'merge' | 'skip';
+        existing_id: string | null;
+    }>;
+    conflicts_total: number;
+    action_items: BetterAuthImportActionItem[];
+    warnings: string[];
+    notes: Record<string, unknown>;
+}
+export interface MigrationImportReport extends MigrationReportCommon {
+    models: Array<{
+        model: string;
+        label: string;
+        found: number;
+        will_create: number;
+        will_update: number;
+        will_skip: number;
+    }>;
+    /** Users per password-hash algorithm. */
+    password_algorithms?: Record<string, number>;
+}
+export interface MigrationImportResult extends MigrationReportCommon {
+    models: Array<{
+        model: string;
+        label: string;
+        found: number;
+        created: number;
+        updated: number;
+        unchanged: number;
+        skipped: number;
+        failed: number;
+    }>;
+    completed_at: number | null;
+}
+export interface MigrationImport {
+    object: 'migration_import';
+    id: string;
+    source: MigrationSourceId;
+    format: 'atlas-migration-bundle' | 'atlas-better-auth-bundle';
+    status: MigrationImportStatus;
+    key_id: string | null;
+    parts: number;
+    bytes: number;
+    bundle_sha256: string | null;
+    bundle_purged: boolean;
+    options: Record<string, unknown>;
+    manifest: {
+        exported_at: string;
+        exporter: {
+            name: string;
+            version: string;
+        };
+        origin: string | null;
+        source_version: string | null;
+        models: string[];
+        providers: string[];
+        rp_id: string | null;
+        warnings: string[];
+    } | null;
+    total: number;
+    progress: {
+        total: number;
+        processed: number;
+        succeeded: number;
+        failed: number;
+        percent: number;
+    } | null;
+    report: MigrationImportReport | null;
+    result: MigrationImportResult | null;
+    error: {
+        code: string;
+        message: string;
+    } | null;
+    created_at: number;
+    updated_at: number;
+    analyzed_at: number | null;
+    apply_started_at: number | null;
+    completed_at: number | null;
+}
+export interface MigrationClaimMap {
+    subject?: string;
+    email?: string;
+    email_verified?: string;
+    name?: string;
+    session_key?: string;
+    mfa?: string;
+}
+/** PUT body of the bridge settings; every field optional, merged onto the stored ones. */
+export interface MigrationBridgeSettingsUpdate {
+    enabled?: boolean;
+    ends_at?: string | number | null;
+    mode?: 'jwt' | 'session_table' | 'remote';
+    preset?: string | null;
+    preset_vars?: Record<string, string>;
+    issuer?: string | null;
+    jwks_url?: string | null;
+    audience?: string[] | null;
+    algorithms?: string[] | null;
+    claim_map?: MigrationClaimMap;
+    expired_grace_seconds?: number;
+    cookie_names?: string[];
+    create_users?: boolean;
+    /** Write-only HS256 secret; omit to keep, null to clear. */
+    shared_secret?: string | null;
+}
+export interface MigrationBridgeSettings {
+    object: 'migration_bridge';
+    source: MigrationSourceId;
+    enabled: boolean;
+    ends_at: number | null;
+    mode: 'jwt' | 'session_table' | 'remote';
+    preset: string | null;
+    preset_vars: Record<string, string>;
+    issuer: string | null;
+    jwks_url: string | null;
+    audience: string[] | null;
+    algorithms: string[];
+    claim_map: Record<string, string>;
+    expired_grace_seconds: number;
+    cookie_names: string[];
+    create_users: boolean;
+    has_shared_secret: boolean;
+    exchange_path: string;
+    stats: {
+        exchanged: number;
+        from_import: number;
+        from_jwt: number;
+    };
+    created_at: number | null;
+    updated_at: number | null;
+}
+export interface MigrationSourceView {
+    object: 'migration_source';
+    source: MigrationSourceId;
+    label: string;
+    models: string[];
+    passwords: 'export' | 'ticket' | 'lazy' | 'none';
+    export_via: Array<'api' | 'file' | 'database' | 'support_ticket'>;
+    bridge: {
+        mode: 'jwt' | 'session_table' | 'remote' | 'none';
+        preset: string | null;
+        vars: Record<string, string>;
+        cookies: string[];
+    };
+    lazy_migration: {
+        preset: string;
+        config: Record<string, {
+            label: string;
+            required: boolean;
+        }>;
+        secret: {
+            label: string;
+            required: boolean;
+        } | null;
+    } | null;
+    password_algorithms: string[];
+    limits: string | null;
+}
+export declare function migrationsResource(request: RequestFn): {
+    /** Every migration source and what it supports. */
+    sources(): Promise<CursorPage<MigrationSourceView>>;
+    /** The import surface of one source: `migrations.imports('auth0').upload(text)`. */
+    imports: (source: MigrationSourceId | string) => {
+        /** The import public key (created on first read; shared by every source). */
+        getPublicKey(): Promise<MigrationImportKey>;
+        /** Replace the import key; bundles sealed to the old one no longer finalize. */
+        rotatePublicKey(): Promise<MigrationImportKey>;
+        create(body?: {
+            options?: MigrationImportOptions;
+        }, idempotencyKey?: string): Promise<MigrationImport>;
+        list(params?: CursorParams): Promise<CursorPage<MigrationImport>>;
+        get(id: string): Promise<MigrationImport>;
+        /** Upload part `part` (1-based) of the sealed bundle text. */
+        uploadPart(id: string, part: number, data: string): Promise<{
+            object: "migration_import_part";
+            import_id: string;
+            part: number;
+            bytes: number;
+            sha256: string;
+        }>;
+        /** Close the upload; Atlas checks the key and the format, then runs the dry run. */
+        finalize(id: string): Promise<MigrationImport>;
+        dryRun(id: string, body?: {
+            options?: MigrationImportOptions;
+        }): Promise<MigrationImport>;
+        /** Import (or resume). Pass confirm_conflicts when the dry run reported conflicts. */
+        apply(id: string, body?: {
+            confirm_conflicts?: boolean;
+        }): Promise<MigrationImport>;
+        delete(id: string): Promise<{
+            object: "migration_import";
+            id: string;
+            deleted: true;
+        }>;
+        /**
+         * Create an import (or continue `importId`), upload the sealed bundle text
+         * in parts from `resumeFrom` (1-based) and finalize it.
+         */
+        upload(bundleText: string, opts?: {
+            options?: MigrationImportOptions;
+            partBytes?: number;
+            importId?: string;
+            resumeFrom?: number;
+            onPart?: (n: number, of: number) => void;
+        }): Promise<MigrationImport>;
+        /** Poll until the import leaves analyzing / queued / applying. */
+        waitFor(id: string, opts?: {
+            intervalMs?: number;
+            timeoutMs?: number;
+            onProgress?: (imp: MigrationImport) => void;
+            sleep?: (ms: number) => Promise<void>;
+        }): Promise<MigrationImport>;
+    };
+    /** The zero-logout bridge settings of one source. */
+    bridge: (source: MigrationSourceId | string) => {
+        get(): Promise<MigrationBridgeSettings>;
+        update(body: MigrationBridgeSettingsUpdate): Promise<MigrationBridgeSettings>;
+        delete(): Promise<{
+            object: "migration_bridge";
+            source: string;
+            deleted: true;
+        }>;
+    };
+};
+export {};

package/dist/client/migrations.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrationsResource = migrationsResource;
+const better_auth_imports_1 = require("./better-auth-imports");
+const request_1 = require("./request");
+const TERMINAL = ['ready', 'invalid', 'completed', 'failed'];
+function migrationsResource(request) {
+    const importsFor = (source) => {
+        const base = `/v1/migrations/${(0, request_1.enc)(source)}/imports`;
+        const self = {
+            /** The import public key (created on first read; shared by every source). */
+            getPublicKey() {
+                return request({ method: 'GET', path: `${base}/public_key` });
+            },
+            /** Replace the import key; bundles sealed to the old one no longer finalize. */
+            rotatePublicKey() {
+                return request({ method: 'POST', path: `${base}/public_key/rotate` });
+            },
+            create(body = {}, idempotencyKey) {
+                return request({ method: 'POST', path: base, body, idempotencyKey });
+            },
+            list(params = {}) {
+                return request({ method: 'GET', path: base, query: { ...params } });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `${base}/${(0, request_1.enc)(id)}` });
+            },
+            /** Upload part `part` (1-based) of the sealed bundle text. */
+            uploadPart(id, part, data) {
+                return request({ method: 'PUT', path: `${base}/${(0, request_1.enc)(id)}/parts/${part}`, body: { data } });
+            },
+            /** Close the upload; Atlas checks the key and the format, then runs the dry run. */
+            finalize(id) {
+                return request({ method: 'POST', path: `${base}/${(0, request_1.enc)(id)}/finalize` });
+            },
+            dryRun(id, body = {}) {
+                return request({ method: 'POST', path: `${base}/${(0, request_1.enc)(id)}/dry_run`, body });
+            },
+            /** Import (or resume). Pass confirm_conflicts when the dry run reported conflicts. */
+            apply(id, body = {}) {
+                return request({ method: 'POST', path: `${base}/${(0, request_1.enc)(id)}/apply`, body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: `${base}/${(0, request_1.enc)(id)}` });
+            },
+            /**
+             * Create an import (or continue `importId`), upload the sealed bundle text
+             * in parts from `resumeFrom` (1-based) and finalize it.
+             */
+            async upload(bundleText, opts = {}) {
+                const parts = (0, better_auth_imports_1.splitBundleParts)(bundleText, opts.partBytes);
+                if (parts.length === 0)
+                    throw new Error('The bundle is empty.');
+                const id = opts.importId ?? (await self.create(opts.options ? { options: opts.options } : {})).id;
+                for (let i = Math.max(0, (opts.resumeFrom ?? 1) - 1); i < parts.length; i++) {
+                    await self.uploadPart(id, i + 1, parts[i]);
+                    opts.onPart?.(i + 1, parts.length);
+                }
+                return self.finalize(id);
+            },
+            /** Poll until the import leaves analyzing / queued / applying. */
+            async waitFor(id, opts = {}) {
+                const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+                const deadline = Date.now() + (opts.timeoutMs ?? 6 * 3600_000);
+                for (;;) {
+                    const imp = await self.get(id);
+                    opts.onProgress?.(imp);
+                    if (TERMINAL.includes(imp.status) || imp.status === 'uploading')
+                        return imp;
+                    if (Date.now() > deadline)
+                        throw new Error(`Timed out waiting for migration import ${id} (status ${imp.status}).`);
+                    await sleep(opts.intervalMs ?? 2000);
+                }
+            },
+        };
+        return self;
+    };
+    const bridgeFor = (source) => {
+        const path = `/v1/migrations/${(0, request_1.enc)(source)}/bridge`;
+        return {
+            get() {
+                return request({ method: 'GET', path });
+            },
+            update(body) {
+                return request({ method: 'PUT', path, body });
+            },
+            delete() {
+                return request({ method: 'DELETE', path });
+            },
+        };
+    };
+    return {
+        /** Every migration source and what it supports. */
+        sources() {
+            return request({ method: 'GET', path: '/v1/migrations/sources' });
+        },
+        /** The import surface of one source: `migrations.imports('auth0').upload(text)`. */
+        imports: importsFor,
+        /** The zero-logout bridge settings of one source. */
+        bridge: bridgeFor,
+    };
+}
+//# sourceMappingURL=migrations.js.map

package/dist/client/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/client/migrations.ts"],"names":[],"mappings":";;AAkMA,gDAkGC;AApSD,+DAA0F;AAC1F,uCAAgD;AA+LhD,MAAM,QAAQ,GAAqC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAE/F,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,MAAM,UAAU,GAAG,CAAC,MAAkC,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,kBAAkB,IAAA,aAAG,EAAC,MAAM,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG;YACX,6EAA6E;YAC7E,YAAY;gBACV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,gFAAgF;YAChF,eAAe;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,oBAAoB,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,CAAC,OAA6C,EAAE,EAAE,cAAuB;gBAC7E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,SAAuB,EAAE;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,8DAA8D;YAC9D,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,IAAY;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,oFAAoF;YACpF,QAAQ,CAAC,EAAU;gBACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,OAA6C,EAAE;gBAChE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,sFAAsF;YACtF,KAAK,CAAC,EAAU,EAAE,OAAwC,EAAE;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,CAAC;YACD;;;eAGG;YACH,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,OAAmJ,EAAE;gBAErJ,MAAM,KAAK,GAAG,IAAA,sCAAgB,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAChE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC5E,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;oBAC5C,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrC,CAAC;gBACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;YACD,kEAAkE;YAClE,KAAK,CAAC,OAAO,CACX,EAAU,EACV,OAAwI,EAAE;gBAE1I,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAC/D,SAAS,CAAC;oBACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC/B,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;oBACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;wBAAE,OAAO,GAAG,CAAC;oBAC5E,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;wBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,EAAE,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;oBACnH,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;SACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAkC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,kBAAkB,IAAA,aAAG,EAAC,MAAM,CAAC,SAAS,CAAC;QACpD,OAAO;YACL,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,CAAC,IAAmC;gBACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,mDAAmD;QACnD,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,oFAAoF;QACpF,OAAO,EAAE,UAAU;QACnB,qDAAqD;QACrD,MAAM,EAAE,SAAS;KAClB,CAAC;AACJ,CAAC"}

package/dist/client/operator.d.ts

@@ -54,6 +54,41 @@ interface Opts {
 }
 /** GET /v1/operator — where the operator device flow and token exchange live. */
 export declare function operatorConfiguration(opts?: Opts): Promise<OperatorConfiguration>;
+/**
+ * Start an RFC 8628 device flow against any Atlas instance's OAuth server, for a
+ * CLI or TV app of your own: `issuer` is the instance's issuer (its Frontend API
+ * host, e.g. `https://acme-fapi.atlasauth.net`) and `clientId` an OAuth client
+ * with the `urn:ietf:params:oauth:grant-type:device_code` grant. Show the person
+ * `verification_uri_complete` (or `verification_uri` + `user_code`), then
+ * {@link pollDeviceAuthorization}. A confidential client passes `clientSecret`.
+ */
+export declare function startDeviceAuthorization(params: {
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    scope?: string | string[];
+    resource?: string;
+}, opts?: Pick<Opts, 'fetch'>): Promise<DeviceAuthorization & {
+    config: DeviceFlowEndpoints;
+}>;
+/** Where a device flow runs: {@link startDeviceAuthorization} fills it from the issuer. */
+export interface DeviceFlowEndpoints {
+    device_authorization_endpoint: string;
+    token_endpoint: string;
+    client_id: string;
+    client_secret?: string;
+}
+/**
+ * Poll the token endpoint until the person approves (resolves the tokens),
+ * denies (`access_denied`) or the code expires (`expired_token`); both throw an
+ * {@link OAuthFlowError}. Honours `interval` and adds 5 s on each `slow_down`.
+ */
+export declare function pollDeviceAuthorization(start: DeviceAuthorization & {
+    config: DeviceFlowEndpoints;
+}, opts?: Pick<Opts, 'fetch'> & {
+    sleep?: (ms: number) => Promise<void>;
+    signal?: AbortSignal;
+}): Promise<OAuthTokenResponse>;
 /**
  * Start the device flow. With `audience` (one of the configuration's
  * `audiences`), the operator token is minted FOR that other product