@atlasauth/backend 0.23.0 → 0.25.0

package/dist/client/risk-based-mfa.d.ts

@@ -3,6 +3,14 @@ import { type RequestFn } from './request';
 export type RiskLevel = 'low' | 'medium' | 'high';
 /** What to do at high risk when the user has NO enrolled factor. */
 export type OnHighRiskNoFactor = 'allow' | 'block' | 'require_enroll';
+/** `audit` scores and records every sign-in but never changes the outcome. */
+export type RiskMode = 'enforce' | 'audit';
+/** What a risk level does; `default` keeps the step-up threshold behaviour. */
+export type RiskLevelAction = 'default' | 'allow' | 'notify' | 'mfa' | 'block';
+export interface RiskLevelActions {
+    medium: RiskLevelAction;
+    high: RiskLevelAction;
+}
 /** Per-signal score weights that feed the risk total. */
 export interface RiskWeights {
     newDevice: number;
@@ -34,6 +42,78 @@ export interface RiskBasedMfa {
     on_high_risk_no_factor: OnHighRiskNoFactor;
     weights: RiskWeights;
     signals: RiskSignalToggles;
+    mode: RiskMode;
+    level_actions: RiskLevelActions;
+    reputation: RiskReputation;
+    fraud: FraudConfig;
+    /** Per-user baseline: unusual sign-in hour or never-seen country adds `weight` points each. */
+    baseline: {
+        enabled: boolean;
+        weight: number;
+    };
+    /** Re-evaluate a session when it refreshes from a different network. */
+    mid_session: {
+        enabled: boolean;
+        action: 'revoke' | 'notify' | 'audit';
+    };
+}
+export type FraudAction = 'allow' | 'challenge' | 'block';
+export interface FraudRule {
+    id: string;
+    name: string;
+    enabled: boolean;
+    action: FraudAction;
+    /** Reason code returned when the rule matches. */
+    reason: string;
+    /** All conditions must hold. */
+    conditions: Array<{
+        field: 'country' | 'asn' | 'datacenter' | 'anonymizer' | 'headless' | 'automation' | 'client_class' | 'bot_score' | 'email_disposable' | 'ip_velocity' | 'device_velocity' | 'email_velocity';
+        op: 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'nin';
+        value: string | number | boolean | Array<string | number>;
+    }>;
+}
+export interface FraudConfig {
+    /** Two-letter country codes that are always blocked. */
+    sanctioned_countries: string[];
+    rules: FraudRule[];
+    /** Cap on lookups per device per hour; adaptive halves it for bot-like, datacenter or anonymized clients. */
+    device_rate_limit?: {
+        enabled: boolean;
+        per_hour: number;
+        adaptive: boolean;
+    };
+}
+export interface FraudLookupBody {
+    ip: string;
+    user_agent?: string;
+    /** The stable id from the JS SDK. */
+    device_id?: string;
+    email?: string;
+    /** A user of this instance, for user_age_days / user_mfa_enabled / user_banned rules. */
+    user_id?: string;
+    /** The organization the action is for, for org_id rules. */
+    org_id?: string;
+    /** Device features reported by the SDK (see the telemetry beacon). */
+    device?: Record<string, unknown>;
+}
+export interface FraudLookup {
+    object: 'fraud_lookup';
+    verdict: FraudAction;
+    reasons: string[];
+    matched_rules: string[];
+    device_id: string | null;
+    signals: Record<string, string | number | boolean | null>;
+}
+/** External IP-reputation / email-risk feeds (bring your own provider key). */
+export interface RiskReputation {
+    provider: 'none' | 'ipqs' | 'spur' | 'minfraud';
+    /** Score points added when the IP is flagged. */
+    ip_weight: number;
+    /** Provider fraud score (1-100) at or above which the IP is flagged. */
+    min_score: number;
+    flag_anonymizers: boolean;
+    email_checks: boolean;
+    email_weight: number;
 }
 export interface UpdateRiskBasedMfaBody {
     enabled?: boolean;
@@ -41,6 +121,40 @@ export interface UpdateRiskBasedMfaBody {
     on_high_risk_no_factor?: OnHighRiskNoFactor;
     weights?: Partial<RiskWeights>;
     signals?: Partial<RiskSignalToggles>;
+    mode?: RiskMode;
+    level_actions?: Partial<RiskLevelActions>;
+    reputation?: Partial<RiskReputation>;
+    fraud?: Partial<FraudConfig>;
+    baseline?: Partial<RiskBasedMfa['baseline']>;
+    mid_session?: Partial<RiskBasedMfa['mid_session']>;
+}
+/** One risk-scored sign-in on the audit / shadow-mode timeline. */
+export interface RiskEvent {
+    object: 'risk_event';
+    id: string;
+    user_id: string;
+    level: RiskLevel;
+    score: number;
+    /** Names of the signals that fired. */
+    signals: string[];
+    /** The action decided; in audit mode, what WOULD have happened. */
+    action: string;
+    mode: RiskMode;
+    ip: string | null;
+    feedback: 'legit' | 'fraud' | null;
+    feedback_at: string | null;
+    created_at: string;
+}
+export interface RiskEventMetrics {
+    object: 'risk_event_metrics';
+    days: number;
+    total: number;
+    buckets: Array<{
+        level: string;
+        action: string;
+        mode: string;
+        count: number;
+    }>;
 }
 /**
  * Read and tune the instance's adaptive-MFA engine — when a second factor is
@@ -51,4 +165,37 @@ export declare function riskBasedMfaResource(request: RequestFn): {
     get(): Promise<RiskBasedMfa>;
     /** Change any subset of the config; omitted fields are left unchanged. */
     update(body: UpdateRiskBasedMfaBody): Promise<RiskBasedMfa>;
+    /** Fraud decision (allow / challenge / block with reason codes) for a sign-up, sign-in or checkout. */
+    fraudLookup(body: FraudLookupBody): Promise<FraudLookup>;
+    /** Store the reputation provider's API key (write-only; minfraud: "<account id>:<license key>"). */
+    setReputationSecret(secret: string, provider?: "ipqs" | "spur" | "minfraud"): Promise<{
+        object: "risk_reputation_secret";
+        provider: string;
+        set: true;
+    }>;
+    /** Remove a stored reputation provider key (default: the configured provider). */
+    removeReputationSecret(provider?: "ipqs" | "spur" | "minfraud"): Promise<{
+        object: "risk_reputation_secret";
+        provider: string;
+        deleted: true;
+    }>;
+};
+/** The risk-event timeline, metrics and feedback. */
+export declare function riskEventsResource(request: RequestFn): {
+    /** Newest first. Page with `before` (the created_at of the last row). */
+    list(query?: {
+        user_id?: string;
+        level?: RiskLevel;
+        limit?: number;
+        before?: string;
+    }): Promise<{
+        object: "list";
+        data: RiskEvent[];
+    }>;
+    /** Counts per level / action / mode over the last `days`. */
+    metrics(query?: {
+        days?: number;
+    }): Promise<RiskEventMetrics>;
+    /** Mark a scored sign-in `legit` or `fraud`; the fired signals' weights move accordingly. */
+    feedback(id: string, verdict: "legit" | "fraud"): Promise<RiskEvent>;
 };

package/dist/client/risk-based-mfa.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.riskBasedMfaResource = riskBasedMfaResource;
+exports.riskEventsResource = riskEventsResource;
 /**
  * Read and tune the instance's adaptive-MFA engine — when a second factor is
  * demanded, and how each risk signal is weighted.
@@ -15,6 +16,35 @@ function riskBasedMfaResource(request) {
         update(body) {
             return request({ method: 'PATCH', path: '/v1/risk_based_mfa', body });
         },
+        /** Fraud decision (allow / challenge / block with reason codes) for a sign-up, sign-in or checkout. */
+        fraudLookup(body) {
+            return request({ method: 'POST', path: '/v1/fraud/lookup', body });
+        },
+        /** Store the reputation provider's API key (write-only; minfraud: "<account id>:<license key>"). */
+        setReputationSecret(secret, provider) {
+            return request({ method: 'PUT', path: '/v1/risk_based_mfa/reputation_secret', body: { secret, provider } });
+        },
+        /** Remove a stored reputation provider key (default: the configured provider). */
+        removeReputationSecret(provider) {
+            return request({ method: 'DELETE', path: '/v1/risk_based_mfa/reputation_secret', query: { provider } });
+        },
+    };
+}
+/** The risk-event timeline, metrics and feedback. */
+function riskEventsResource(request) {
+    return {
+        /** Newest first. Page with `before` (the created_at of the last row). */
+        list(query = {}) {
+            return request({ method: 'GET', path: '/v1/risk_events', query });
+        },
+        /** Counts per level / action / mode over the last `days`. */
+        metrics(query = {}) {
+            return request({ method: 'GET', path: '/v1/risk_events/metrics', query });
+        },
+        /** Mark a scored sign-in `legit` or `fraud`; the fired signals' weights move accordingly. */
+        feedback(id, verdict) {
+            return request({ method: 'POST', path: `/v1/risk_events/${encodeURIComponent(id)}/feedback`, body: { verdict } });
+        },
     };
 }
 //# sourceMappingURL=risk-based-mfa.js.map

package/dist/client/risk-based-mfa.js.map

@@ -1 +1 @@
-{"version":3,"file":"risk-based-mfa.js","sourceRoot":"","sources":["../../src/client/risk-based-mfa.ts"],"names":[],"mappings":";;AAuDA,oDAWC;AAfD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4CAA4C;QAC5C,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,0EAA0E;QAC1E,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"risk-based-mfa.js","sourceRoot":"","sources":["../../src/client/risk-based-mfa.ts"],"names":[],"mappings":";;AAqKA,oDAuBC;AAGD,gDAeC;AA7CD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4CAA4C;QAC5C,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,0EAA0E;QAC1E,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,uGAAuG;QACvG,WAAW,CAAC,IAAqB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,oGAAoG;QACpG,mBAAmB,CAAC,MAAc,EAAE,QAAuC;YACzE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,kFAAkF;QAClF,sBAAsB,CAAC,QAAuC;YAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,yEAAyE;QACzE,IAAI,CAAC,QAAkF,EAAE;YACvF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,6DAA6D;QAC7D,OAAO,CAAC,QAA2B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,6FAA6F;QAC7F,QAAQ,CAAC,EAAU,EAAE,OAA0B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/roles.d.ts

@@ -7,6 +7,7 @@ export interface Role {
     name: string;
     description: string | null;
     is_system: boolean;
+    visibility: 'public' | 'internal';
     permissions: string[];
     member_count: number;
     created_at: number;
@@ -23,11 +24,14 @@ export interface CreateRoleBody {
     key: string;
     name: string;
     description?: string;
+    /** `internal` = assignable by your backend only; hidden from org-admin pickers. */
+    visibility?: 'public' | 'internal';
     permissions?: string[];
 }
 export interface UpdateRoleBody {
     name?: string;
     description?: string;
+    visibility?: 'public' | 'internal';
     /** May be supplied but must equal the current key — the key is immutable. */
     key?: string;
 }

package/dist/client/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/client/roles.ts"],"names":[],"mappings":";;AA+CA,sCAmCC;AAeD,kDAiBC;AAlHD,uCAAgD;AA+ChD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,iDAAiD;QACjD,cAAc,CAAC,EAAU,EAAE,WAAqB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;gBACxC,IAAI,EAAE,EAAE,WAAW,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,MAAM,CACJ,EAAU,EACV,IAA8B;YAE9B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE;gBAC5B,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;aACvE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,kFAAkF;QAClF,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/client/roles.ts"],"names":[],"mappings":";;AAmDA,sCAmCC;AAeD,kDAiBC;AAtHD,uCAAgD;AAmDhD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,iDAAiD;QACjD,cAAc,CAAC,EAAU,EAAE,WAAqB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;gBACxC,IAAI,EAAE,EAAE,WAAW,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,MAAM,CACJ,EAAU,EACV,IAA8B;YAE9B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE;gBAC5B,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;aACvE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,kFAAkF;QAClF,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/service-connectors.d.ts

@@ -0,0 +1,83 @@
+import { type RequestFn } from './request';
+export type ServiceConnectorCategory = 'messaging' | 'crm' | 'analytics' | 'fraud' | 'idv' | 'http';
+/** A configured service. Credentials are write-only: they live in the vault and are never returned. */
+export interface ServiceConnector {
+    object: 'service_connector';
+    id: string;
+    name: string;
+    /** `twilio`, `sendgrid`, `slack`, `hubspot`, `salesforce`, `segment`, `fingerprint`, `arkose`, `forter`, `sardine`, `persona`, `onfido`, `veriff`, `stripe_identity` or `http`. */
+    kind: string;
+    category: ServiceConnectorCategory | null;
+    config: Record<string, string>;
+    enabled: boolean;
+    last_used_at: number | null;
+    last_status: 'ok' | 'error' | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface ServiceConnectorField {
+    key: string;
+    label: string;
+    required: boolean;
+    type?: string;
+    enum?: string[];
+    default?: string;
+}
+export interface ServiceConnectorKind {
+    object: 'service_connector_kind';
+    kind: string;
+    name: string;
+    category: ServiceConnectorCategory;
+    summary: string;
+    credentials: ServiceConnectorField[];
+    config: ServiceConnectorField[];
+    operations: Array<{
+        operation: string;
+        summary: string;
+        input: ServiceConnectorField[];
+    }>;
+}
+export interface CreateServiceConnectorBody {
+    /** Lowercase letters, digits, `-` and `_`; what Actions call it by. */
+    name: string;
+    kind: string;
+    config?: Record<string, string>;
+    /** Stored in the vault. See the catalog entry for the fields. */
+    credentials: Record<string, string>;
+}
+export interface UpdateServiceConnectorBody {
+    name?: string;
+    enabled?: boolean;
+    /** Merged into the current config. */
+    config?: Record<string, string>;
+    /** Only the fields you pass are replaced. */
+    credentials?: Record<string, string>;
+}
+/** Typed connectors to messaging, CRM, analytics, fraud and identity-verification services. */
+export declare function serviceConnectorsResource(request: RequestFn): {
+    /** The services you can connect, with their fields and operations. */
+    catalog(): Promise<{
+        object: "list";
+        data: ServiceConnectorKind[];
+        has_more: boolean;
+    }>;
+    list(): Promise<{
+        object: "list";
+        data: ServiceConnector[];
+        has_more: boolean;
+    }>;
+    get(id: string): Promise<ServiceConnector>;
+    create(body: CreateServiceConnectorBody, idempotencyKey?: string): Promise<ServiceConnector>;
+    update(id: string, body: UpdateServiceConnectorBody): Promise<ServiceConnector>;
+    delete(id: string): Promise<{
+        object: "service_connector.deleted";
+        id: string;
+        deleted: boolean;
+    }>;
+    /** Run an operation, e.g. `invoke(id, 'send_sms', { to, body })`. A failure from the service is a 502 `CONNECTOR_UPSTREAM_ERROR`. */
+    invoke(id: string, operation: string, input?: Record<string, unknown>): Promise<{
+        object: "service_connector_result";
+        operation: string;
+        result: Record<string, unknown>;
+    }>;
+};

package/dist/client/service-connectors.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serviceConnectorsResource = serviceConnectorsResource;
+const request_1 = require("./request");
+/** Typed connectors to messaging, CRM, analytics, fraud and identity-verification services. */
+function serviceConnectorsResource(request) {
+    return {
+        /** The services you can connect, with their fields and operations. */
+        catalog() {
+            return request({ method: 'GET', path: '/v1/service_connector_catalog' });
+        },
+        list() {
+            return request({ method: 'GET', path: '/v1/service_connectors' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/service_connectors/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/service_connectors', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/service_connectors/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/service_connectors/${(0, request_1.enc)(id)}` });
+        },
+        /** Run an operation, e.g. `invoke(id, 'send_sms', { to, body })`. A failure from the service is a 502 `CONNECTOR_UPSTREAM_ERROR`. */
+        invoke(id, operation, input = {}) {
+            return request({ method: 'POST', path: `/v1/service_connectors/${(0, request_1.enc)(id)}/invoke`, body: { operation, input } });
+        },
+    };
+}
+//# sourceMappingURL=service-connectors.js.map

package/dist/client/service-connectors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-connectors.js","sourceRoot":"","sources":["../../src/client/service-connectors.ts"],"names":[],"mappings":";;AA2DA,8DA0BC;AArFD,uCAAgD;AA0DhD,+FAA+F;AAC/F,SAAgB,yBAAyB,CAAC,OAAkB;IAC1D,OAAO;QACL,sEAAsE;QACtE,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAgC;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,qIAAqI;QACrI,MAAM,CAAC,EAAU,EAAE,SAAiB,EAAE,QAAiC,EAAE;YACvE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/ssf.d.ts

@@ -0,0 +1,111 @@
+import { type RequestFn } from './request';
+/** Event type URIs (CAEP + RISC) a stream can subscribe to. */
+export type SsfEventType = 'https://schemas.openid.net/secevent/caep/event-type/session-revoked' | 'https://schemas.openid.net/secevent/caep/event-type/credential-change' | 'https://schemas.openid.net/secevent/caep/event-type/assurance-level-change' | 'https://schemas.openid.net/secevent/caep/event-type/token-claims-change' | 'https://schemas.openid.net/secevent/caep/event-type/risk-level-change' | 'https://schemas.openid.net/secevent/risc/event-type/account-disabled' | 'https://schemas.openid.net/secevent/risc/event-type/account-enabled' | 'https://schemas.openid.net/secevent/risc/event-type/account-purged' | 'https://schemas.openid.net/secevent/risc/event-type/credential-compromise';
+export interface SsfStream {
+    object: 'ssf_stream';
+    id: string;
+    description: string | null;
+    delivery: {
+        method: string;
+        endpoint_url?: string | null;
+    };
+    delivery_method: 'push' | 'poll';
+    audience: string;
+    events_requested: string[];
+    events_supported: string[];
+    status: 'enabled' | 'paused' | 'disabled';
+    created_at: number;
+    updated_at: number;
+    pending_events?: number;
+}
+/** Returned once on create for a poll stream. */
+export interface SsfStreamCreated extends SsfStream {
+    poll_token?: string;
+    poll_endpoint?: string;
+}
+export interface CreateSsfStreamBody {
+    delivery_method: 'push' | 'poll';
+    /** Push only: the https endpoint that receives each SET. */
+    endpoint_url?: string;
+    /** Push only: sent as the `Authorization` header (write-only). */
+    authorization_header?: string;
+    audience?: string;
+    description?: string;
+    events_requested?: string[];
+}
+export interface UpdateSsfStreamBody {
+    endpoint_url?: string;
+    authorization_header?: string;
+    description?: string;
+    events_requested?: string[];
+    status?: 'enabled' | 'paused' | 'disabled';
+}
+export interface SsfEventRecord {
+    object: 'ssf_event';
+    id: string;
+    event_type: string;
+    user_id: string | null;
+    status: 'pending' | 'delivered' | 'failed';
+    attempts: number;
+    last_error: string | null;
+    delivered_at: number | null;
+    created_at: number;
+}
+export type SsfReceiverAction = 'revoke_sessions' | 'ban' | 'ignore';
+export interface SsfReceiver {
+    object: 'ssf_receiver';
+    id: string;
+    name: string;
+    issuer: string;
+    jwks_uri: string;
+    audience: string | null;
+    actions: Record<string, SsfReceiverAction>;
+    enabled: boolean;
+    last_received_at: number | null;
+    created_at: number;
+    /** Only on create. */
+    receive_endpoint?: string;
+}
+export interface CreateSsfReceiverBody {
+    name: string;
+    issuer: string;
+    jwks_uri: string;
+    audience?: string;
+    actions?: Record<string, SsfReceiverAction>;
+}
+/** Shared Signals Framework (SSF 1.0) with CAEP and RISC: transmitter streams and inbound receivers. */
+export declare function ssfResource(request: RequestFn): {
+    streams: {
+        list(): Promise<{
+            object: "list";
+            data: SsfStream[];
+        }>;
+        create(body: CreateSsfStreamBody): Promise<SsfStreamCreated>;
+        get(id: string): Promise<SsfStream>;
+        update(id: string, body: UpdateSsfStreamBody): Promise<SsfStream>;
+        delete(id: string): Promise<void>;
+        /** Queue a verification event so the receiver can confirm the stream works. */
+        verify(id: string, state?: string): Promise<{
+            object: "ssf_verification";
+            stream_id: string;
+            state: string;
+        }>;
+        events(id: string, query?: {
+            limit?: number;
+        }): Promise<{
+            object: "list";
+            data: SsfEventRecord[];
+        }>;
+    };
+    receivers: {
+        list(): Promise<{
+            object: "list";
+            data: SsfReceiver[];
+        }>;
+        create(body: CreateSsfReceiverBody): Promise<SsfReceiver>;
+        update(id: string, body: Partial<Omit<CreateSsfReceiverBody, "issuer">> & {
+            enabled?: boolean;
+        }): Promise<SsfReceiver>;
+        delete(id: string): Promise<void>;
+    };
+};

package/dist/client/ssf.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ssfResource = ssfResource;
+/** Shared Signals Framework (SSF 1.0) with CAEP and RISC: transmitter streams and inbound receivers. */
+function ssfResource(request) {
+    const stream = (id) => `/v1/ssf/streams/${encodeURIComponent(id)}`;
+    const receiver = (id) => `/v1/ssf/receivers/${encodeURIComponent(id)}`;
+    return {
+        streams: {
+            list() {
+                return request({ method: 'GET', path: '/v1/ssf/streams' });
+            },
+            create(body) {
+                return request({ method: 'POST', path: '/v1/ssf/streams', body });
+            },
+            get(id) {
+                return request({ method: 'GET', path: stream(id) });
+            },
+            update(id, body) {
+                return request({ method: 'PATCH', path: stream(id), body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: stream(id) });
+            },
+            /** Queue a verification event so the receiver can confirm the stream works. */
+            verify(id, state) {
+                return request({ method: 'POST', path: `${stream(id)}/verify`, body: { state } });
+            },
+            events(id, query = {}) {
+                return request({ method: 'GET', path: `${stream(id)}/events`, query });
+            },
+        },
+        receivers: {
+            list() {
+                return request({ method: 'GET', path: '/v1/ssf/receivers' });
+            },
+            create(body) {
+                return request({ method: 'POST', path: '/v1/ssf/receivers', body });
+            },
+            update(id, body) {
+                return request({ method: 'PATCH', path: receiver(id), body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: receiver(id) });
+            },
+        },
+    };
+}
+//# sourceMappingURL=ssf.js.map

package/dist/client/ssf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssf.js","sourceRoot":"","sources":["../../src/client/ssf.ts"],"names":[],"mappings":";;AA4FA,kCA2CC;AA5CD,wGAAwG;AACxG,SAAgB,WAAW,CAAC,OAAkB;IAC5C,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,OAAO;QACL,OAAO,EAAE;YACP,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,CAAC,IAAyB;gBAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAyB;gBAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,+EAA+E;YAC/E,MAAM,CAAC,EAAU,EAAE,KAAc;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,QAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACzE,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,IAA2B;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA4E;gBAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sso-onboarding.d.ts

@@ -5,6 +5,8 @@ import type { ListPage } from './types';
  * self-service-profiles model. It fixes which protocols an end-customer may
  * configure and either binds an org or promises to name one at ticket issue.
  */
+/** An Admin Portal task a ticket may perform for its organization. */
+export type SsoPortalIntent = 'sso' | 'directory_sync' | 'domain_verification' | 'log_stream' | 'audit_log' | 'certificate_renewal' | 'api_keys' | 'webhooks';
 export interface SsoOnboardingProfile {
     object: 'sso_onboarding_profile';
     id: string;
@@ -14,6 +16,8 @@ export interface SsoOnboardingProfile {
     organization_id: string | null;
     company_name: string | null;
     allow_scim: boolean;
+    /** The Admin Portal tasks this profile's tickets may perform. */
+    intents: SsoPortalIntent[];
     created_at: number;
     updated_at: number;
 }
@@ -49,6 +53,8 @@ export interface CreateSsoOnboardingProfileBody {
     organization_id?: string | null;
     company_name?: string | null;
     allow_scim?: boolean;
+    /** Admin Portal tasks to grant; omit for the classic SSO (+ domain) profile. */
+    intents?: SsoPortalIntent[];
 }
 export interface CreateSsoOnboardingTicketBody {
     /** Required for an unbound profile; must match (or be omitted) for a bound one. */

package/dist/client/sso-onboarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-onboarding.js","sourceRoot":"","sources":["../../src/client/sso-onboarding.ts"],"names":[],"mappings":";;AAgEA,sDA6CC;AA7GD,uCAAgD;AAgEhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CACJ,IAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B;gBACnC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,+EAA+E;QAC/E,YAAY,CACV,SAAiB,EACjB,OAAsC,EAAE,EACxC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,SAAS,CAAC,UAAU;gBAC7D,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,YAAY,CACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;aAC3D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sso-onboarding.js","sourceRoot":"","sources":["../../src/client/sso-onboarding.ts"],"names":[],"mappings":";;AA+EA,sDA6CC;AA5HD,uCAAgD;AA+EhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CACJ,IAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B;gBACnC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,+EAA+E;QAC/E,YAAY,CACV,SAAiB,EACjB,OAAsC,EAAE,EACxC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,SAAS,CAAC,UAAU;gBAC7D,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,YAAY,CACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;aAC3D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}